URL: https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
Submission: On February 21 via manual from JP

Summary

This website contacted 42 IPs in 7 countries across 35 domains to perform 103 HTTP transactions. The main IP is 2.16.123.243, located in Ascension Island and belongs to AKAMAI-ASN1, US. The main domain is us.norton.com.
TLS certificate: Issued by DigiCert SHA2 Extended Validation Ser... on July 19th 2019. Valid for: a year.
This is the only time us.norton.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
3 2.16.123.243 20940 (AKAMAI-ASN1)
16 2.20.20.197 20940 (AKAMAI-ASN1)
15 18.195.42.228 16509 (AMAZON-02)
1 23.37.60.173 16625 (AKAMAI-AS)
2 66.117.29.3 15224 (OMNITURE)
1 4 52.213.129.52 16509 (AMAZON-02)
1 2600:9000:214... 16509 (AMAZON-02)
1 2 23.100.48.86 8075 (MICROSOFT...)
1 151.101.112.157 54113 (FASTLY)
2 2a03:2880:f01... 32934 (FACEBOOK)
1 35.186.249.72 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
2 23.0.36.169 16625 (AKAMAI-AS)
1 1 35.241.9.210 15169 (GOOGLE)
1 35.244.144.168 15169 (GOOGLE)
1 52.209.33.201 16509 (AMAZON-02)
2 18.140.85.34 16509 (AMAZON-02)
1 1 66.117.28.86 15224 (OMNITURE)
1 143.204.202.96 16509 (AMAZON-02)
1 1 216.200.122.11 6461 (ZAYO-6461)
3 4 172.217.18.102 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 1 35.153.153.196 14618 (AMAZON-AES)
1 52.216.138.213 16509 (AMAZON-02)
2 172.217.23.98 15169 (GOOGLE)
1 104.244.42.197 13414 (TWITTER)
1 2 2a03:2880:f11... 32934 (FACEBOOK)
1 2 2a00:1450:400... 15169 (GOOGLE)
1 2a02:26f0:6c0... 20940 (AKAMAI-ASN1)
1 2 2a00:1450:400... 15169 (GOOGLE)
2 34.98.72.95 15169 (GOOGLE)
7 35.227.229.34 15169 (GOOGLE)
2 2620:1ec:c11:... 8068 (MICROSOFT...)
5 2a02:26f0:6c0... 20940 (AKAMAI-ASN1)
1 52.50.252.134 16509 (AMAZON-02)
1 23.210.250.44 16625 (AKAMAI-AS)
1 151.101.114.109 54113 (FASTLY)
1 1 67.231.146.66 26211 (PROOFPOIN...)
1 2 34.230.135.71 14618 (AMAZON-AES)
1 104.244.42.67 13414 (TWITTER)
3 151.101.13.175 54113 (FASTLY)
1 5 2.21.37.45 20940 (AKAMAI-ASN1)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a03:2880:f01... 32934 (FACEBOOK)
6 52.0.147.218 14618 (AMAZON-AES)
1 35.241.45.82 15169 (GOOGLE)
2 70.42.32.31 22075 (AS-OUTBRAIN)
103 42
Apex Domain
Subdomains
Transfer
16 symassets.com
now.symassets.com
394 KB
15 ensighten.com
nexus.ensighten.com
157 KB
11 clicktale.net
cdnssl.clicktale.net
conductor.clicktale.net
168 KB
11 bounceexchange.com
bounceexchange.com
tag.bounceexchange.com
assets.bounceexchange.com
api.bounceexchange.com
126 KB
7 norton.com
us.norton.com
buy.norton.com
oms.norton.com
20 KB
6 doubleclick.net
ad.doubleclick.net
googleads.g.doubleclick.net
6612401.fls.doubleclick.net
3 KB
5 mathtag.com
pixel.mathtag.com
6 KB
5 demdex.net
dpm.demdex.net
symantec.demdex.net
3 KB
4 kampyle.com
nebula-cdn.kampyle.com
udc-neb.kampyle.com
64 KB
3 outbrain.com
amplify.outbrain.com
tr.outbrain.com
amplifypixel.outbrain.com
4 KB
3 google.com
adservice.google.com
www.google.com
1 KB
3 omtrdc.net
cdn.tt.omtrdc.net
symantec.tt.omtrdc.net
16 KB
2 trkn.us
trkn.us
1 KB
2 bing.com
bat.bing.com
7 KB
2 facebook.com
www.facebook.com
558 B
2 googleadservices.com
www.googleadservices.com
11 KB
2 go-mpulse.net
s.go-mpulse.net
c.go-mpulse.net
48 KB
2 facebook.net
connect.facebook.net
142 KB
1 akstat.io
684dd30b.akstat.io
200 B
1 atdmt.com
cx.atdmt.com
431 B
1 google.de
www.google.de
110 B
1 twitter.com
analytics.twitter.com
283 B
1 proofpoint.com
urldefense.proofpoint.com
385 B
1 ispot.tv
pt.ispot.tv
314 B
1 ow5a.net
norton.ow5a.net
814 B
1 t.co
t.co
171 B
1 amazonaws.com
s3.amazonaws.com
9 KB
1 glancecdn.net
glancecdn.net
207 B
1 gwmtracking.com
gwmtracking.com
388 B
1 gomoxie.solutions
asset.gomoxie.solutions
129 KB
1 everesttech.net
cm.everesttech.net
554 B
1 googletagmanager.com
www.googletagmanager.com
28 KB
1 impactradius-event.com
d.impactradius-event.com
13 KB
1 ads-twitter.com
static.ads-twitter.com
2 KB
1 consensu.org
vendorlist.consensu.org
17 KB
103 35
Domain Requested by
16 now.symassets.com us.norton.com
15 nexus.ensighten.com us.norton.com
nexus.ensighten.com
7 api.bounceexchange.com us.norton.com
nexus.ensighten.com
6 conductor.clicktale.net nexus.ensighten.com
5 pixel.mathtag.com 1 redirects nexus.ensighten.com
5 cdnssl.clicktale.net nexus.ensighten.com
4 dpm.demdex.net 1 redirects us.norton.com
3 nebula-cdn.kampyle.com nexus.ensighten.com
3 us.norton.com now.symassets.com
nexus.ensighten.com
2 trkn.us 1 redirects
2 6612401.fls.doubleclick.net 1 redirects nexus.ensighten.com
2 bat.bing.com nexus.ensighten.com
2 assets.bounceexchange.com nexus.ensighten.com
2 www.google.com 1 redirects us.norton.com
2 googleads.g.doubleclick.net 1 redirects nexus.ensighten.com
2 www.facebook.com 1 redirects us.norton.com
2 www.googleadservices.com nexus.ensighten.com
2 ad.doubleclick.net 2 redirects
2 oms.norton.com nexus.ensighten.com
us.norton.com
2 connect.facebook.net nexus.ensighten.com
2 buy.norton.com 1 redirects us.norton.com
2 symantec.tt.omtrdc.net now.symassets.com
nexus.ensighten.com
1 amplifypixel.outbrain.com
1 tr.outbrain.com
1 udc-neb.kampyle.com
1 684dd30b.akstat.io nexus.ensighten.com
1 cx.atdmt.com
1 www.google.de
1 analytics.twitter.com nexus.ensighten.com
1 urldefense.proofpoint.com 1 redirects
1 pt.ispot.tv
1 amplify.outbrain.com nexus.ensighten.com
1 norton.ow5a.net nexus.ensighten.com
1 c.go-mpulse.net s.go-mpulse.net
1 t.co us.norton.com
1 s3.amazonaws.com us.norton.com
1 glancecdn.net 1 redirects
1 adservice.google.com us.norton.com
1 gwmtracking.com 1 redirects
1 asset.gomoxie.solutions nexus.ensighten.com
1 cm.everesttech.net 1 redirects
1 symantec.demdex.net nexus.ensighten.com
1 tag.bounceexchange.com us.norton.com
1 bounceexchange.com 1 redirects
1 s.go-mpulse.net nexus.ensighten.com
1 www.googletagmanager.com nexus.ensighten.com
1 d.impactradius-event.com nexus.ensighten.com
1 static.ads-twitter.com nexus.ensighten.com
1 vendorlist.consensu.org nexus.ensighten.com
1 cdn.tt.omtrdc.net now.symassets.com
103 50
Subject Issuer Validity Valid
www.norton.com
DigiCert SHA2 Extended Validation Server CA
2019-07-19 -
2020-08-26
a year crt.sh
store.norton.com
DigiCert SHA2 Extended Validation Server CA
2020-01-28 -
2020-06-29
5 months crt.sh
nexus.ensighten.com
DigiCert SHA2 Secure Server CA
2019-10-03 -
2020-10-02
a year crt.sh
*.tt.omtrdc.net
DigiCert SHA2 High Assurance Server CA
2017-10-26 -
2020-11-25
3 years crt.sh
*.demdex.net
DigiCert SHA2 High Assurance Server CA
2018-01-09 -
2021-02-12
3 years crt.sh
vendorlist.consensu.org
Amazon
2020-02-07 -
2021-03-07
a year crt.sh
buy.norton.com
DigiCert SHA2 Extended Validation Server CA
2019-11-26 -
2020-11-26
a year crt.sh
ads-twitter.com
DigiCert SHA2 High Assurance Server CA
2019-08-14 -
2020-08-18
a year crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA
2020-01-16 -
2020-04-15
3 months crt.sh
*.impactradius-event.com
COMODO RSA Domain Validation Secure Server CA
2019-01-08 -
2021-01-20
2 years crt.sh
*.google-analytics.com
GTS CA 1O1
2020-01-29 -
2020-04-22
3 months crt.sh
akstat.io
DigiCert SHA2 Secure Server CA
2019-04-16 -
2020-06-14
a year crt.sh
tag.bounceexchange.com
Let's Encrypt Authority X3
2020-01-20 -
2020-04-19
3 months crt.sh
oms.norton.com
DigiCert SHA2 High Assurance Server CA
2019-10-23 -
2020-10-27
a year crt.sh
*.gomoxie.solutions
Go Daddy Secure Certificate Authority - G2
2017-10-30 -
2020-12-01
3 years crt.sh
*.google.com
GTS CA 1O1
2020-01-29 -
2020-04-22
3 months crt.sh
s3.amazonaws.com
DigiCert Baltimore CA-2 G2
2019-11-09 -
2020-12-02
a year crt.sh
www.googleadservices.com
GTS CA 1O1
2020-02-12 -
2020-05-06
3 months crt.sh
t.co
DigiCert SHA2 High Assurance Server CA
2019-04-09 -
2020-04-01
a year crt.sh
*.g.doubleclick.net
GTS CA 1O1
2020-02-12 -
2020-05-06
3 months crt.sh
www.google.com
GTS CA 1O1
2020-01-29 -
2020-04-22
3 months crt.sh
assets.bounceexchange.com
GTS CA 1D2
2020-02-11 -
2020-05-11
3 months crt.sh
bounceexchange.com
Let's Encrypt Authority X3
2020-01-21 -
2020-04-20
3 months crt.sh
www.bing.com
Microsoft IT TLS CA 2
2019-04-30 -
2021-04-30
2 years crt.sh
*.clicktale.net
DigiCert SHA2 Secure Server CA
2019-10-06 -
2020-11-04
a year crt.sh
pkof.net
Amazon
2019-05-21 -
2020-06-21
a year crt.sh
*.outbrain.com
DigiCert SHA2 Secure Server CA
2018-12-14 -
2020-03-14
a year crt.sh
*.doubleclick.net
GTS CA 1O1
2020-02-12 -
2020-05-06
3 months crt.sh
f3.shared.global.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3
2019-05-29 -
2020-04-23
a year crt.sh
*.trkn.us
Go Daddy Secure Certificate Authority - G2
2017-11-16 -
2020-12-16
3 years crt.sh
*.twitter.com
DigiCert SHA2 High Assurance Server CA
2019-04-09 -
2020-04-01
a year crt.sh
j.ssl.fastly.net
GlobalSign Organization Validation CA - SHA256 - G2
2020-02-06 -
2020-06-11
4 months crt.sh
pixel.mathtag.com
DigiCert SHA2 Secure Server CA
2019-01-25 -
2020-04-25
a year crt.sh
www.google.de
GTS CA 1O1
2020-01-29 -
2020-04-22
3 months crt.sh
*.atlassolutions.com
DigiCert SHA2 High Assurance Server CA
2020-01-20 -
2020-04-19
3 months crt.sh
*.kampyle.com
RapidSSL RSA CA 2018
2020-02-11 -
2022-03-06
2 years crt.sh

This page contains 5 frames:

Primary Page: https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
Frame ID: EB3C4F3B0B83707B56FFD0DB40C17667
Requests: 98 HTTP requests in this frame

Frame: https://s.go-mpulse.net/boomerang/MDDJR-3RVW8-S3M46-HL4QS-RLVQ4
Frame ID: CF9A91ED3CBADE137A9516611BE13894
Requests: 2 HTTP requests in this frame

Frame: https://symantec.demdex.net/dest5.html?d_nsid=0
Frame ID: 9E0E9630F9DB07AFB372A36B0787A1CC
Requests: 1 HTTP requests in this frame

Frame: https://assets.bounceexchange.com/assets/bounce/local_storage_frame15.min.html
Frame ID: 114458A09192BBCF547EBED8496E71F5
Requests: 1 HTTP requests in this frame

Frame: https://6612401.fls.doubleclick.net/activityi;dc_pre=CJyv8P2J4ucCFZgX4AodAbkJ3Q;src=6612401;type=pagev0;cat=nwpmd0;u1=;u4=symcom;u5=norton.com:us:internetsecurity:online-threats:writeup:backdoor.cobalt!gen1;u7=undefined;ord=1
Frame ID: CAF4E06A075475F14DD9DFB2B815C126
Requests: 1 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • script /\/etc\/designs\//i
  • script /\/etc\/clientlibs\//i
  • script /\/etc.clientlibs\//i

Overall confidence: 100%
Detected patterns
  • script /\/etc\/designs\//i
  • script /\/etc\/clientlibs\//i
  • script /\/etc.clientlibs\//i

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

Overall confidence: 100%
Detected patterns
  • script /\/\/nexus\.ensighten\.com\//i

Overall confidence: 100%
Detected patterns
  • script /\/\/connect\.facebook\.net\/[^\/]*\/[a-z]*\.js/i

Page Statistics

103
Requests

100 %
HTTPS

26 %
IPv6

35
Domains

50
Subdomains

42
IPs

7
Countries

1364 kB
Transfer

4707 kB
Size

37
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 16
  • https://dpm.demdex.net/id?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=67C716D751E567F70A490D4C%40AdobeOrg&d_nsid=0&ts=1582268630420 HTTP 302
  • https://dpm.demdex.net/id/rd?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=67C716D751E567F70A490D4C%40AdobeOrg&d_nsid=0&ts=1582268630420
Request Chain 24
  • https://buy.norton.com/redirector/seo?callback=jQuery1113024856483421921705_1582268630168&ptype=cartpopover&trf_id=symcom&scsguid=0&COUNTRY=US&LANGUAGE=en&_=1582268630169 HTTP 302
  • https://buy.norton.com/estore/staticStoreRequest?country=US&callback=jQuery1113024856483421921705_1582268630168&action=9&language=en&trf_id=symcom&ptype=cartpopover&scsguid=0&_=1582268630169&
Request Chain 41
  • https://bounceexchange.com/tag/2004/i.js HTTP 301
  • https://tag.bounceexchange.com/2004/i.js
Request Chain 44
  • https://cm.everesttech.net/cm/dd?d_uuid=79549224783269911893663617195779330274 HTTP 302
  • https://dpm.demdex.net/ibs:dpid=411&dpuuid=Xk_A1gAAAqzbZVL0
Request Chain 46
  • https://gwmtracking.com/p/v/1/59bc0993f8708105b27e9bf1/format/img HTTP 302
  • https://ad.doubleclick.net/ddm/activity/src=9309239;type=invmedia;cat=norto00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1 HTTP 302
  • https://ad.doubleclick.net/ddm/activity/src=9309239;dc_pre=CPC44P2J4ucCFQRxGwodCWcHlQ;type=invmedia;cat=norto00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1 HTTP 302
  • https://adservice.google.com/ddm/fls/z/src=9309239;dc_pre=CPC44P2J4ucCFQRxGwodCWcHlQ;type=invmedia;cat=norto00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1
Request Chain 47
  • https://glancecdn.net/cobrowse/CoBrowseJS.ashx?group=20636&site=production%20id=%22cobrowsescript%22%20charset=%22UTF-8%22%20data-inputevents=%27{%22ctrl-13%22:%22startSession%22}%27 HTTP 302
  • https://s3.amazonaws.com/glancecdn/cobrowse/js/GlanceCobrowseLoader_4.9.0M.js
Request Chain 70
  • https://6612401.fls.doubleclick.net/activityi;src=6612401;type=pagev0;cat=nwpmd0;u1=;u4=symcom;u5=norton.com:us:internetsecurity:online-threats:writeup:backdoor.cobalt!gen1;u7=undefined;ord=1 HTTP 302
  • https://6612401.fls.doubleclick.net/activityi;dc_pre=CJyv8P2J4ucCFZgX4AodAbkJ3Q;src=6612401;type=pagev0;cat=nwpmd0;u1=;u4=symcom;u5=norton.com:us:internetsecurity:online-threats:writeup:backdoor.cobalt!gen1;u7=undefined;ord=1
Request Chain 72
  • https://urldefense.proofpoint.com/v2/url?u=https-3A__trkn.us_pixel_conv_ppt-3D5476-3Bg-3Dsitewide-3Bgid-3D21516-3Bord-3D-5Buniqueid-5D&d=DwIGAg&c=GC0NZZhaEw6GOQSjMHI2g15k_drElRoPmOYiK2k0eZ8&r=Ee60g2IVWH4ilx5qVtN5SWhZ_dp83IhavcKtQdRHVR0&m=6acsyUwmRa9pAPbejHWFamACbRxd9ZuTHzjRaskDlck&s=Cg0u3-75AdqpvrktwMVS9VI00PPkNNPjHSunAIvUfUY&e= HTTP 302
  • https://trkn.us/pixel/conv/ppt=5476;g=sitewide;gid=21516;ord=[uniqueid] HTTP 302
  • https://trkn.us/pixel/conv/ppt=5476;g=sitewide;gid=21516;ord=[uniqueid];ip=82.102.19.132;cuidchk=1
Request Chain 76
  • https://pixel.mathtag.com/event/js?mt_pp=1&event_type=catchall&industry=retail&mt_id=1080302&mt_adid=174308&page_name=norton.com:us:internetsecurity:online-threats:writeup:backdoor.cobalt!gen1&s1=online%20(1st) HTTP 302
  • https://pixel.mathtag.com/event/js?mt_pp=1&event_type=catchall&industry=retail&mt_id=1080302&mt_adid=174308&page_name=norton.com:us:internetsecurity:online-threats:writeup:backdoor.cobalt!gen1&s1=online%20(1st)&mm_bnc&mm_bct&UUID=9a6a5e4f-80d7-4700-b715-2cdaa967daba
Request Chain 78
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1043330685/?random=528950114&cv=9&fst=*&num=1&label=sale&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2od2c0&sendb=1&ig=1&data=event%3Dconversion%3Ballow_custom_scripts%3Dtrue%3Becomm_pagename%3Dwriteup%3Abackdoor.cobalt!gen1%3Becomm_traffic_source%3Dsymcom%3Becomm_current_subchannel%3DOnline%20(1st)&frm=0&url=https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html&tiba=Backdoor.Cobalt!gen1%20%7C%20Technical%20Details%20%7C%20Removing%20Help%20-%20Removal%20%7C%20Norton&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=14BPXriwLbSElQeVr4SYDQ&sscte=1&crd=&gtd= HTTP 302
  • https://www.google.com/pagead/1p-conversion/1043330685/?random=528950114&cv=9&fst=*&num=1&label=sale&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2od2c0&sendb=1&ig=1&data=event%3Dconversion%3Ballow_custom_scripts%3Dtrue%3Becomm_pagename%3Dwriteup%3Abackdoor.cobalt!gen1%3Becomm_traffic_source%3Dsymcom%3Becomm_current_subchannel%3DOnline%20(1st)&frm=0&url=https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html&tiba=Backdoor.Cobalt!gen1%20%7C%20Technical%20Details%20%7C%20Removing%20Help%20-%20Removal%20%7C%20Norton&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&gtd=&is_vtc=1&ocp_id=14BPXriwLbSElQeVr4SYDQ&random=2474868009&resp=GooglemKTybQhCsO HTTP 302
  • https://www.google.de/pagead/1p-conversion/1043330685/?random=528950114&cv=9&fst=*&num=1&label=sale&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2od2c0&sendb=1&ig=1&data=event%3Dconversion%3Ballow_custom_scripts%3Dtrue%3Becomm_pagename%3Dwriteup%3Abackdoor.cobalt!gen1%3Becomm_traffic_source%3Dsymcom%3Becomm_current_subchannel%3DOnline%20(1st)&frm=0&url=https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html&tiba=Backdoor.Cobalt!gen1%20%7C%20Technical%20Details%20%7C%20Removing%20Help%20-%20Removal%20%7C%20Norton&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&gtd=&is_vtc=1&ocp_id=14BPXriwLbSElQeVr4SYDQ&random=2474868009&resp=GooglemKTybQhCsO&ipr=y
Request Chain 82
  • https://www.facebook.com/tr/?id=2010787619164716&ev=ViewContent&dl=https%3A%2F%2Fus.norton.com%2Fonline-threats%2Fbackdoor.cobalt!gen1-2018-121403-1729-99-writeup.html&rl=&if=false&ts=1582268631818&cd[content_name]=writeup%3Abackdoor.cobalt!gen1&cd[content_type]=product&sw=1600&sh=1200&v=2.9.15&r=stable&a=tmensighten&ec=1&o=29&fbp=fb.1.1582268630693.857900625&it=1582268630657&coo=false&tm=1&rqm=GET HTTP 302
  • https://cx.atdmt.com/?c=3331614991868087643&f=AYw2-_ceZ09h_dey2lo3XMqrEQf7MUHXUIscL39EJJd031V2VddAHhKPEQjG9-f2MOaWj3g5V66SuWPUaZkP7cZE&id=2010787619164716&l=3&v=0

103 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
us.norton.com/online-threats/
69 KB
13 KB
Document
General
Full URL
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.16.123.243 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-123-243.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
e6d946fa7cbdfc1c66ba00393241fc5a72be76878aeeb3139a1af086000b96d2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
us.norton.com
:scheme
https
:path
/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest
document
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
document

Response headers

status
200
content-type
text/html; charset=UTF-8
content-length
12991
server
Apache
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block
x-content-type-options
nosniff
last-modified
Fri, 21 Feb 2020 04:59:12 GMT
etag
"1133e-59f0ee1ef9334-gzip"
accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
cache-control
max-age=865
expires
Fri, 21 Feb 2020 07:18:14 GMT
date
Fri, 21 Feb 2020 07:03:49 GMT
head.min.eG81hcPlJsHbDrGzcbCBjQ==.css
now.symassets.com/etc/designs/norton/libs-rover/
323 KB
50 KB
Stylesheet
General
Full URL
https://now.symassets.com/etc/designs/norton/libs-rover/head.min.eG81hcPlJsHbDrGzcbCBjQ==.css
Requested by
Host: us.norton.com
URL: https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.20.20.197 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-20-20-197.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
0481c082aaafd63cf83a83bf6ba4e7b9ef1cd99fe367a218523920ad3044d7b2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
style

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 03 Feb 2020 18:24:13 GMT
server
Apache
access-control-allow-origin
*
etag
"50a83-59db007bb93d4-gzip"
vary
Accept-Encoding
content-type
text/css
status
200
date
Fri, 21 Feb 2020 07:03:50 GMT
accept-ranges
bytes
content-length
50337
x-xss-protection
1; mode=block
head.min._JHh_2cpji897CXG4Ae5kA==.js
now.symassets.com/etc/designs/norton/libs-rover/
222 KB
65 KB
Script
General
Full URL
https://now.symassets.com/etc/designs/norton/libs-rover/head.min._JHh_2cpji897CXG4Ae5kA==.js
Requested by
Host: us.norton.com
URL: https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.20.20.197 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-20-20-197.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
481b6d479ef35617ffccea2e351d0801e4eae3053183191fad255b9e2435b334
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 03 Feb 2020 18:24:10 GMT
server
Apache
access-control-allow-origin
*
etag
"379e7-59db00790e9ef-gzip"
vary
Accept-Encoding
content-type
application/x-javascript; charset=UTF-8
status
200
date
Fri, 21 Feb 2020 07:03:50 GMT
accept-ranges
bytes
content-length
66487
x-xss-protection
1; mode=block
target.min.ycnxPM0SEr__LYqzB8O_FA==.js
now.symassets.com/etc/clientlibs/core/publish/scripts/testandtarget/
45 KB
14 KB
Script
General
Full URL
https://now.symassets.com/etc/clientlibs/core/publish/scripts/testandtarget/target.min.ycnxPM0SEr__LYqzB8O_FA==.js
Requested by
Host: us.norton.com
URL: https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.20.20.197 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-20-20-197.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
2c5c4b96d0181519469719af63b77f3bcc57a51bbd6b5541e0f95823a4c2df0e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 10 Oct 2019 22:29:28 GMT
server
Apache
access-control-allow-origin
*
etag
"b570-59495ef3a1299-gzip"
vary
Accept-Encoding
content-type
application/x-javascript; charset=UTF-8
status
200
date
Fri, 21 Feb 2020 07:03:50 GMT
accept-ranges
bytes
content-length
14023
x-xss-protection
1; mode=block
Bootstrap.js
nexus.ensighten.com/symantec/aemprod/
573 KB
119 KB
Script
General
Full URL
https://nexus.ensighten.com/symantec/aemprod/Bootstrap.js
Requested by
Host: us.norton.com
URL: https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
c89841c22481fc9eb58f82d340a9499b9ad7614df3c61d50ecb90ffca036efe0

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Fri, 21 Feb 2020 07:03:50 GMT
content-encoding
gzip
last-modified
Thu, 20 Feb 2020 22:39:49 GMT
server
nginx
etag
W/"5e4f0ab5-8f496"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
status
200
cache-control
max-age=300
logo_norton_91x35.png
now.symassets.com/content/dam/norton/global/images/non-product/logos/
2 KB
2 KB
Image
General
Full URL
https://now.symassets.com/content/dam/norton/global/images/non-product/logos/logo_norton_91x35.png
Requested by
Host: us.norton.com
URL: https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.20.20.197 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-20-20-197.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
149f1c066d9c44292f68050cf7b777238c736f6a59a972e34046e7cedb9158ed
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
last-modified
Wed, 12 Feb 2020 22:48:29 GMT
server
Apache
access-control-allow-origin
*
etag
"754-59e68c569db00"
content-type
image/png
status
200
date
Fri, 21 Feb 2020 07:03:50 GMT
accept-ranges
bytes
content-length
1876
x-xss-protection
1; mode=block
m_logo_norton_checkmark_68x71.png
now.symassets.com/content/dam/clp/global/images/non-product/logos/
3 KB
3 KB
Image
General
Full URL
https://now.symassets.com/content/dam/clp/global/images/non-product/logos/m_logo_norton_checkmark_68x71.png
Requested by
Host: us.norton.com
URL: https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.20.20.197 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-20-20-197.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
3307151d5b444757abf22c0b40dd7ab5df26a424c29e6aac99542493fa935663
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
last-modified
Thu, 10 Oct 2019 19:53:41 GMT
server
Apache
access-control-allow-origin
*
etag
"acc-59493c21d5434"
content-type
image/png
status
200
date
Fri, 21 Feb 2020 07:03:50 GMT
accept-ranges
bytes
content-length
2764
x-xss-protection
1; mode=block
img-security-response-lp-image-1800x500.jpg
now.symassets.com/content/dam/norton/global/images/non-product/banners/
75 KB
75 KB
Image
General
Full URL
https://now.symassets.com/content/dam/norton/global/images/non-product/banners/img-security-response-lp-image-1800x500.jpg
Requested by
Host: us.norton.com
URL: https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.20.20.197 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-20-20-197.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
3444f8d802b147e9938653db4890915cd92bd803c14776611fc003b1c2b4f275
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
last-modified
Thu, 10 Oct 2019 22:48:01 GMT
server
Apache
access-control-allow-origin
*
etag
"12b35-59496319d77c0"
content-type
image/jpeg
status
200
date
Fri, 21 Feb 2020 07:03:50 GMT
accept-ranges
bytes
content-length
76597
x-xss-protection
1; mode=block
icon_fb_k_12x25.png
now.symassets.com/content/dam/norton/global/images/non-product/icons/
4 KB
5 KB
Image
General
Full URL
https://now.symassets.com/content/dam/norton/global/images/non-product/icons/icon_fb_k_12x25.png
Requested by
Host: us.norton.com
URL: https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.20.20.197 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-20-20-197.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
61164135ac4f772076ebf25a8ac6f8cade571440c23ea3cca276171479f4a51d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
last-modified
Thu, 10 Oct 2019 19:53:41 GMT
server
Apache
access-control-allow-origin
*
etag
"11a0-59493c2271836"
content-type
image/png
status
200
date
Fri, 21 Feb 2020 07:03:50 GMT
accept-ranges
bytes
content-length
4512
x-xss-protection
1; mode=block
icon_twitter_k_25x20.png
now.symassets.com/content/dam/norton/global/images/non-product/icons/
3 KB
3 KB
Image
General
Full URL
https://now.symassets.com/content/dam/norton/global/images/non-product/icons/icon_twitter_k_25x20.png
Requested by
Host: us.norton.com
URL: https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.20.20.197 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-20-20-197.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
266c45f1c3f781f4b2b370a92b5a901ac7c3ed9e898f98d8288aa196ebf70cfa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
last-modified
Thu, 10 Oct 2019 19:48:43 GMT
server
Apache
access-control-allow-origin
*
etag
"ade-59493b063fee1"
content-type
image/png
status
200
date
Fri, 21 Feb 2020 07:03:50 GMT
accept-ranges
bytes
content-length
2782
x-xss-protection
1; mode=block
icon_youtube_34x24.png
now.symassets.com/content/dam/norton/global/images/non-product/icons/
3 KB
3 KB
Image
General
Full URL
https://now.symassets.com/content/dam/norton/global/images/non-product/icons/icon_youtube_34x24.png
Requested by
Host: us.norton.com
URL: https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.20.20.197 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-20-20-197.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
269c8dbed8ace9cdf488d1b5886a5a007845d7fa44e6d8e63b30f6ad83b63303
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
last-modified
Thu, 10 Oct 2019 19:53:43 GMT
server
Apache
access-control-allow-origin
*
etag
"ae9-59493c243db82"
content-type
image/png
status
200
date
Fri, 21 Feb 2020 07:03:50 GMT
accept-ranges
bytes
content-length
2793
x-xss-protection
1; mode=block
logo_NLOK_132x26.svg
now.symassets.com/content/dam/norton/global/images/non-product/logos/dark/
10 KB
11 KB
Image
General
Full URL
https://now.symassets.com/content/dam/norton/global/images/non-product/logos/dark/logo_NLOK_132x26.svg
Requested by
Host: us.norton.com
URL: https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.20.20.197 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-20-20-197.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
9c28255a4751f9bb7447d173b7c974f1dd50e9ce458ff10d3a6bbbb9be35f8c6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
last-modified
Wed, 15 Jan 2020 19:14:31 GMT
server
Apache
access-control-allow-origin
*
etag
"2979-59c3284a82315"
content-type
image/svg+xml
status
200
date
Fri, 21 Feb 2020 07:03:50 GMT
accept-ranges
bytes
content-length
10617
x-xss-protection
1; mode=block
footer.min.UOujLsmjLa0WaG0attP_8w==.js
now.symassets.com/etc/designs/norton/libs-rover/
207 KB
60 KB
Script
General
Full URL
https://now.symassets.com/etc/designs/norton/libs-rover/footer.min.UOujLsmjLa0WaG0attP_8w==.js
Requested by
Host: us.norton.com
URL: https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.20.20.197 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-20-20-197.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
4627d7eba198458549211c2e96e214d11ea6dc182c74870f05cb86eb73fd9b68
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 03 Feb 2020 18:24:08 GMT
server
Apache
access-control-allow-origin
*
etag
"33c53-59db0077cdd1c-gzip"
vary
Accept-Encoding
content-type
application/javascript
status
200
date
Fri, 21 Feb 2020 07:03:50 GMT
accept-ranges
bytes
content-length
60581
x-xss-protection
1; mode=block
s_code_norton_min.js
nexus.ensighten.com/symantec/scode/
72 KB
24 KB
Script
General
Full URL
https://nexus.ensighten.com/symantec/scode/s_code_norton_min.js
Requested by
Host: us.norton.com
URL: https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
b4c7f2eef48e56bc43441c5e4e3e4c41697b8f164494c909f4df0c6cfc90e1f9

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Fri, 21 Feb 2020 07:03:50 GMT
content-encoding
gzip
last-modified
Tue, 03 Dec 2019 21:39:53 GMT
server
nginx
etag
W/"5de6d629-1202c"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
status
200
cache-control
public, max-age=300
head
us.norton.com/service/norton/
0
885 B
XHR
General
Full URL
https://us.norton.com/service/norton/head?ct=us&lg=en&ref=&
Requested by
Host: now.symassets.com
URL: https://now.symassets.com/etc/designs/norton/libs-rover/head.min._JHh_2cpji897CXG4Ae5kA==.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.16.123.243 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-123-243.deploy.static.akamaitechnologies.com
Software
Apache / Jetty(9.2.9.v20150224)
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff, nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
empty

Response headers

pragma
no-cache
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff, nosniff
server
Apache
x-powered-by
Jetty(9.2.9.v20150224)
x-frame-options
SAMEORIGIN
content-type
text/plain
status
200
cache-control
max-age=0, no-cache, no-store
date
Fri, 21 Feb 2020 07:03:50 GMT
content-length
0
x-xss-protection
1; mode=block
expires
Fri, 21 Feb 2020 07:03:50 GMT
target.js
cdn.tt.omtrdc.net/cdn/
43 KB
14 KB
Script
General
Full URL
https://cdn.tt.omtrdc.net/cdn/target.js
Requested by
Host: now.symassets.com
URL: https://now.symassets.com/etc/clientlibs/core/publish/scripts/testandtarget/target.min.ycnxPM0SEr__LYqzB8O_FA==.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.37.60.173 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-37-60-173.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
7ecf3bf86151cd72036fb67feb8fcbd8c80359e0ca871e1aeb955428ed43c26d

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
Sec-Fetch-Dest
script
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

Date
Fri, 21 Feb 2020 07:03:50 GMT
Content-Encoding
gzip
Last-Modified
Tue, 01 Oct 2019 05:03:41 GMT
Server
Apache
ETag
"1fcda-aa3e-593d246a6d5b9"
Vary
Accept-Encoding
Content-Type
text/javascript; charset=utf-8
Cache-Control
must-revalidate, max-age=3600
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
14200
ajax
symantec.tt.omtrdc.net/m2/symantec/mbox/
1 KB
887 B
Script
General
Full URL
https://symantec.tt.omtrdc.net/m2/symantec/mbox/ajax?mboxHost=us.norton.com&mboxPage=12e435eda9134856a4777d23b85cca9d&screenHeight=1200&screenWidth=1600&browserWidth=1600&browserHeight=1200&browserTimeOffset=60&colorDepth=24&mboxSession=12e435eda9134856a4777d23b85cca9d&mboxCount=1&mboxTime=1582272230299&content_title=writeup&current_subchannel=Online%20(1st)&ExistingCustomer=existing_customer%3A%20No&ExistingCustomerList=missing&original_subchannel=Online%20(1st)&product_name=undefined&profile.current_subchannel=Online%20(1st)&profile.ExistingCustomer=existing_customer%3A%20No&profile.original_subchannel=Online%20(1st)&profile.product_name=undefined&profile.program_type=unknown&profile.site_content_title=writeup&profile.site_country=us&profile.site_language=en&profile.site_section=norton.com&profile.site_sub_section=internetsecurity&profile.TCG=5&profile.traffic_source=symcom&profile.vendor_type=norton%3Asymantec&program_type=unknown&site_country=us&site_language=en&site_section=norton.com&site_sub_section=internetsecurity&traffic_source=symcom&vendor_type=norton%3Asymantec&mbox=sym_global_mbox&mboxId=0&mboxURL=https%3A%2F%2Fus.norton.com%2Fonline-threats%2Fbackdoor.cobalt!gen1-2018-121403-1729-99-writeup.html&mboxReferrer=&mboxVersion=63
Requested by
Host: now.symassets.com
URL: https://now.symassets.com/etc/clientlibs/core/publish/scripts/testandtarget/target.min.ycnxPM0SEr__LYqzB8O_FA==.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
66.117.29.3 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software
/
Resource Hash
86cfc8acb0ad8a720e08ff3ae9d9f2983f113c042f71d0a3dd50db19f80b1908

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
Sec-Fetch-Dest
script
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

pragma
no-cache
date
Fri, 21 Feb 2020 07:03:49 GMT
content-encoding
gzip
vary
Accept-Encoding
content-type
text/javascript;charset=utf-8
status
200
cache-control
no-cache
timing-allow-origin
*
x-request-id
911d8837-ce0d-465d-85fe-063616297686
rd
dpm.demdex.net/id/
Redirect Chain
  • https://dpm.demdex.net/id?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=67C716D751E567F70A490D4C%40AdobeOrg&d_nsid=0&ts=1582268630420
  • https://dpm.demdex.net/id/rd?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=67C716D751E567F70A490D4C%40AdobeOrg&d_nsid=0&ts=1582268630420
0
-1 B
XHR
General
Full URL
https://dpm.demdex.net/id/rd?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=67C716D751E567F70A490D4C%40AdobeOrg&d_nsid=0&ts=1582268630420
Requested by
Host: us.norton.com
URL: https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.213.129.52 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-213-129-52.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
Location
https://dpm.demdex.net/id/rd?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=67C716D751E567F70A490D4C%40AdobeOrg&d_nsid=0&ts=1582268630420
X-TID
gOgfeGYnS5A=
Vary
Origin
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin
https://us.norton.com
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
Access-Control-Allow-Origin
https://us.norton.com
X-TID
gOgfeGYnS5A=
Vary
Origin
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location
https://dpm.demdex.net/id/rd?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=67C716D751E567F70A490D4C%40AdobeOrg&d_nsid=0&ts=1582268630420
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:00 GMT
vendorlist.json
vendorlist.consensu.org/
93 KB
17 KB
XHR
General
Full URL
https://vendorlist.consensu.org/vendorlist.json
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/symantec/aemprod/Bootstrap.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:214f:b400:1:af78:4c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
a4370188e3b8f3641ad43ef72bfa9e8bc5e519da306984c328fc1885d621c470

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
Origin
https://us.norton.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 20 Feb 2020 16:10:37 GMT
content-encoding
gzip
vary
Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
age
53594
x-cache
Hit from cloudfront
status
200
access-control-allow-origin
*
last-modified
Thu, 20 Feb 2020 16:00:54 GMT
server
AmazonS3
access-control-max-age
604800
access-control-allow-methods
GET
x-amz-version-id
L0crZbDtq.lFwCMFonQA4ZA5hP.DwxFe
via
1.1 48391c4ed2c51e95dcabcb70cf613127.cloudfront.net (CloudFront)
cache-control
max-age=604800
x-amz-cf-pop
FRA53-C1
content-type
application/json; charset=utf-8
x-amz-cf-id
TEYsof-S-WSGQrq6KL1bLsOk38jCgDpHDDL3FRiViqzcPpr7qXMFDw==
site-s5375c1150e.png
now.symassets.com/etc/designs/norton/images/generated/rover/sprites/rover/
54 KB
54 KB
Image
General
Full URL
https://now.symassets.com/etc/designs/norton/images/generated/rover/sprites/rover/site-s5375c1150e.png
Requested by
Host: us.norton.com
URL: https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.20.20.197 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-20-20-197.deploy.static.akamaitechnologies.com
Software
Apache/2.4.29 (Unix) Communique/4.2.2 /
Resource Hash
188a6e6dac88f34b69a2e6d52f7c0d48432e092bddac2bf3fd31531bd3aeed5b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://now.symassets.com/etc/designs/norton/libs-rover/head.min.eG81hcPlJsHbDrGzcbCBjQ==.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 21 Feb 2020 07:03:50 GMT
x-content-type-options
nosniff
last-modified
Wed, 08 Aug 2018 21:58:23 GMT
server
Apache/2.4.29 (Unix) Communique/4.2.2
access-control-allow-origin
*
etag
"d660-572f39bfe8b4d"
content-type
image/png
status
200
accept-ranges
bytes
content-length
54880
x-xss-protection
1; mode=block
site-icons-sd322172196.png
now.symassets.com/etc/designs/norton/images/generated/rover/sprites/rover/
2 KB
3 KB
Image
General
Full URL
https://now.symassets.com/etc/designs/norton/images/generated/rover/sprites/rover/site-icons-sd322172196.png
Requested by
Host: us.norton.com
URL: https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.20.20.197 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-20-20-197.deploy.static.akamaitechnologies.com
Software
Apache/2.4.29 (Unix) Communique/4.2.2 /
Resource Hash
46bfad6d9a825875b7f34dffef008715e20b0e2e968066e8731ef4b60691256a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://now.symassets.com/etc/designs/norton/libs-rover/head.min.eG81hcPlJsHbDrGzcbCBjQ==.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
last-modified
Wed, 07 Mar 2018 17:34:21 GMT
server
Apache/2.4.29 (Unix) Communique/4.2.2
access-control-allow-origin
*
etag
"91d-566d5f836c4eb"
content-type
image/png
status
200
date
Fri, 21 Feb 2020 07:03:50 GMT
accept-ranges
bytes
content-length
2333
x-xss-protection
1; mode=block
source-sans-pro-v13-latin-regular.woff2
now.symassets.com/etc/designs/global/libs-global/head/styles/fonts/source-sans-pro-v13-latin/
16 KB
16 KB
Font
General
Full URL
https://now.symassets.com/etc/designs/global/libs-global/head/styles/fonts/source-sans-pro-v13-latin/source-sans-pro-v13-latin-regular.woff2
Requested by
Host: us.norton.com
URL: https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.20.20.197 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-20-20-197.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
a9950fa5ca9cf47072770900d259bcf6778aa1119652d2e706d5eb92df254199
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://now.symassets.com/etc/designs/norton/libs-rover/head.min.eG81hcPlJsHbDrGzcbCBjQ==.css
Origin
https://us.norton.com
Sec-Fetch-Dest
font
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
last-modified
Thu, 10 Oct 2019 01:04:01 GMT
server
Apache
access-control-allow-origin
*
etag
"3ef0-59483fa1a8d5c"
content-type
application/octet-stream
status
200
date
Fri, 21 Feb 2020 07:03:50 GMT
accept-ranges
bytes
content-length
16112
x-xss-protection
1; mode=block
source-sans-pro-v13-latin-300.woff2
now.symassets.com/etc/designs/global/libs-global/head/styles/fonts/source-sans-pro-v13-latin/
16 KB
16 KB
Font
General
Full URL
https://now.symassets.com/etc/designs/global/libs-global/head/styles/fonts/source-sans-pro-v13-latin/source-sans-pro-v13-latin-300.woff2
Requested by
Host: us.norton.com
URL: https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.20.20.197 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-20-20-197.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
f3d7092e6eb6f3aa0c572e52e061a59cc88a3e9eff581c95c4bd7456800904d0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://now.symassets.com/etc/designs/norton/libs-rover/head.min.eG81hcPlJsHbDrGzcbCBjQ==.css
Origin
https://us.norton.com
Sec-Fetch-Dest
font
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
last-modified
Thu, 10 Oct 2019 01:28:45 GMT
server
Apache
access-control-allow-origin
*
etag
"3ec0-5948452957679"
content-type
application/octet-stream
status
200
date
Fri, 21 Feb 2020 07:03:50 GMT
accept-ranges
bytes
content-length
16064
x-xss-protection
1; mode=block
source-sans-pro-v13-latin-700.woff2
now.symassets.com/etc/designs/global/libs-global/head/styles/fonts/source-sans-pro-v13-latin/
15 KB
16 KB
Font
General
Full URL
https://now.symassets.com/etc/designs/global/libs-global/head/styles/fonts/source-sans-pro-v13-latin/source-sans-pro-v13-latin-700.woff2
Requested by
Host: us.norton.com
URL: https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.20.20.197 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-20-20-197.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
24f7e397faec79e62c37ff2f00b170f6dc1557fb46ac169f9f1897a9d641dd03
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://now.symassets.com/etc/designs/norton/libs-rover/head.min.eG81hcPlJsHbDrGzcbCBjQ==.css
Origin
https://us.norton.com
Sec-Fetch-Dest
font
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
last-modified
Thu, 10 Oct 2019 00:16:36 GMT
server
Apache
access-control-allow-origin
*
etag
"3d94-594835090f624"
content-type
application/octet-stream
status
200
date
Fri, 21 Feb 2020 07:03:50 GMT
accept-ranges
bytes
content-length
15764
x-xss-protection
1; mode=block
token.json
us.norton.com/libs/granite/csrf/
2 B
287 B
XHR
General
Full URL
https://us.norton.com/libs/granite/csrf/token.json
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/symantec/aemprod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.16.123.243 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-123-243.deploy.static.akamaitechnologies.com
Software
Apache / Jetty(9.2.9.v20150224)
Resource Hash
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff, nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
empty

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff, nosniff
server
Apache
x-powered-by
Jetty(9.2.9.v20150224)
x-frame-options
SAMEORIGIN
content-type
application/json; charset=ISO-8859-1
status
200
cache-control
no-cache
date
Fri, 21 Feb 2020 07:03:50 GMT
content-length
2
x-xss-protection
1; mode=block
expires
Fri, 21 Feb 2020 07:03:50 GMT
staticStoreRequest
buy.norton.com/estore/
Redirect Chain
  • https://buy.norton.com/redirector/seo?callback=jQuery1113024856483421921705_1582268630168&ptype=cartpopover&trf_id=symcom&scsguid=0&COUNTRY=US&LANGUAGE=en&_=1582268630169
  • https://buy.norton.com/estore/staticStoreRequest?country=US&callback=jQuery1113024856483421921705_1582268630168&action=9&language=en&trf_id=symcom&ptype=cartpopover&scsguid=0&_=1582268630169&
66 B
1 KB
Script
General
Full URL
https://buy.norton.com/estore/staticStoreRequest?country=US&callback=jQuery1113024856483421921705_1582268630168&action=9&language=en&trf_id=symcom&ptype=cartpopover&scsguid=0&_=1582268630169&
Requested by
Host: us.norton.com
URL: https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
23.100.48.86 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
b17634e6bfe621446f4c0ef4cf5ea52fbd358f131c430f3a05641af11221d89d
Security Headers
Name Value
Strict-Transport-Security max-age=2592000;includeSubDomains
X-Frame-Options DENY

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Fri, 21 Feb 2020 07:03:50 GMT
Content-Type
text/javascript; charset=UTF-8
Connection
keep-alive
X-FRAME-OPTIONS
DENY
Content-Length
66
Strict-Transport-Security
max-age=2592000;includeSubDomains
requestId
680308688109080576

Redirect headers

Date
Fri, 21 Feb 2020 07:03:50 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
requestId
680308687731593216
X-FRAME-OPTIONS
DENY
Content-Type
text/html
Location
https://buy.norton.com/estore/staticStoreRequest?country=US&callback=jQuery1113024856483421921705_1582268630168&action=9&language=en&trf_id=symcom&ptype=cartpopover&scsguid=0&_=1582268630169&
Connection
keep-alive
Content-Length
643
serverComponent.php
nexus.ensighten.com/symantec/aemprod/
1 KB
614 B
Script
General
Full URL
https://nexus.ensighten.com/symantec/aemprod/serverComponent.php?r=2917742.184995773&ClientID=21&PageID=https%3A%2F%2Fus.norton.com%2Fonline-threats%2Fbackdoor.cobalt!gen1-2018-121403-1729-99-writeup.html%3F_COUNTRY%3Dus%26_LANGUAGE%3Den%26_TRAFFIC_SOURCE%3Dsymcom%26_PGM_ID%3Dmissing%26_PGM_TYPE%3Dunknown%26_IPF%3Dmissing%26_IPD%3Dmissing%26_PSN%3Dmissing%26_SUBCHANNEL%3Donline%20(1st)%26_ORIG_SUB%3Donline%20(1st)%26_PIFCAM%3Dmissing%26_I_SKU%3Dmissing%26_DEX%3Dmissing%26_INID%3Dmissing%26_IPV%3Dmissing%26_IPC%3Dmissing%26_IUC%3Dmissing%26_IPL%3Dmissing%26_ENP%3Dmissing%26_SKT%3Dmissing%26_ITD%3Dmissing%26now_site_country%3Dus%26now_site_language%3Den%26now_site_content_title%3Dwriteup%26now_site_sub_section%3Dinternetsecurity%26now_site_section%3Dnorton.com%26now_trafficsource_cookie_name%3Dsymcom%26now_program_type%3Dunknown%26now_current_subchannel%3Donline%20(1st)%26now_original_subchannel%3Donline%20(1st)%26product_name%3Dwriteup%3Abackdoor.cobalt!gen1%26vendor_type%3Dnorton%3Asymantec%26isMobile%3Dfalse%26viewCampaigns%3Dmissing%26path%3D%2Fonline-threats%2Fbackdoor.cobalt!gen1-2018-121403-1729-99-writeup.html%26siteCode%3Dnortoncom
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/symantec/aemprod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
917a13322705f8f8fb8bdbdf43778027cc2ba919c4927221ce599d458e5cfa7b

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Fri, 21 Feb 2020 07:03:50 GMT
content-encoding
gzip
server
nginx
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
no-cache, no-store
expires
Fri, 21 Feb 2020 07:03:49 GMT
rd
dpm.demdex.net/id/
367 B
1 KB
XHR
General
Full URL
https://dpm.demdex.net/id/rd?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=67C716D751E567F70A490D4C%40AdobeOrg&d_nsid=0&ts=1582268630420
Requested by
Host: us.norton.com
URL: https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.213.129.52 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-213-129-52.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
fc4606c43c45bd8695e9df69bf34b61fba6693368cfb079a6381d3877e9da6c8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
Origin
https://us.norton.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

DCS
dcs-prod-irl1-v061-0607686d9.edge-irl1.demdex.com 5.65.0.20200212140016 3ms (+1ms)
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Encoding
gzip
X-TID
qjm4sdhbR1M=
Vary
Origin, Accept-Encoding, User-Agent
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin
https://us.norton.com
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json;charset=utf-8
Content-Length
300
Expires
Thu, 01 Jan 1970 00:00:00 GMT
a3fd03993fb484a5c5f30c4bc124f872.js
nexus.ensighten.com/symantec/aemprod/code/
7 KB
2 KB
Script
General
Full URL
https://nexus.ensighten.com/symantec/aemprod/code/a3fd03993fb484a5c5f30c4bc124f872.js?conditionId0=423130
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/symantec/aemprod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
ff3814209c050228f5b76942dcec58bbac590c8ccfde770ecd1830cddd6ce71f

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Fri, 21 Feb 2020 07:03:50 GMT
content-encoding
gzip
last-modified
Thu, 20 Feb 2020 22:22:12 GMT
server
nginx
etag
W/"5e4f0694-1aa4"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
status
200
cache-control
max-age=315360000
52c84c9c84d00aca35bc8aaa6b21b007.js
nexus.ensighten.com/symantec/aemprod/code/
9 KB
3 KB
Script
General
Full URL
https://nexus.ensighten.com/symantec/aemprod/code/52c84c9c84d00aca35bc8aaa6b21b007.js?conditionId0=473595
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/symantec/aemprod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
df6435877275dfa95c0c33ff26c3f8517e21ee1cf345e1a27bc583112663b92c

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Fri, 21 Feb 2020 07:03:50 GMT
content-encoding
gzip
last-modified
Fri, 03 May 2019 16:40:11 GMT
server
nginx
etag
W/"5ccc6eeb-242f"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
status
200
cache-control
max-age=315360000
7b4b49848bc08d35eff3f49f50749ed0.js
nexus.ensighten.com/symantec/aemprod/code/
407 B
590 B
Script
General
Full URL
https://nexus.ensighten.com/symantec/aemprod/code/7b4b49848bc08d35eff3f49f50749ed0.js?conditionId0=650739
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/symantec/aemprod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
0e40de2991be33c009d63512509ccbbde093042c86c3d5e27d4de5dd4b956847

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Fri, 21 Feb 2020 07:03:50 GMT
last-modified
Thu, 03 Oct 2019 22:59:41 GMT
server
nginx
etag
"5d967d5d-197"
content-type
application/javascript; charset=utf-8
status
200
cache-control
max-age=315360000
accept-ranges
bytes
content-length
407
c5f2a0e990287bdebbb646124bd6d780.js
nexus.ensighten.com/symantec/aemprod/code/
2 KB
934 B
Script
General
Full URL
https://nexus.ensighten.com/symantec/aemprod/code/c5f2a0e990287bdebbb646124bd6d780.js?conditionId0=649166
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/symantec/aemprod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
0f9f35089390609110d7c2c393ad8e46474f79957f194c2c4ca8c213120445b8

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Fri, 21 Feb 2020 07:03:50 GMT
content-encoding
gzip
last-modified
Thu, 20 Feb 2020 22:22:12 GMT
server
nginx
etag
W/"5e4f0694-622"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
status
200
cache-control
max-age=315360000
4ecf75334b0b4672a9d31d751410223f.js
nexus.ensighten.com/symantec/aemprod/code/
1 KB
872 B
Script
General
Full URL
https://nexus.ensighten.com/symantec/aemprod/code/4ecf75334b0b4672a9d31d751410223f.js?conditionId0=379007
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/symantec/aemprod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
9048cb41b012db0da6c685e116a3f687783ea13d688a42410eadf49c9056ce4d

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Fri, 21 Feb 2020 07:03:50 GMT
content-encoding
gzip
last-modified
Fri, 03 May 2019 16:40:11 GMT
server
nginx
etag
W/"5ccc6eeb-4ea"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
status
200
cache-control
max-age=315360000
8f899a3aa29b07a1927c1fae56e7c9d8.js
nexus.ensighten.com/symantec/aemprod/code/
663 B
845 B
Script
General
Full URL
https://nexus.ensighten.com/symantec/aemprod/code/8f899a3aa29b07a1927c1fae56e7c9d8.js?conditionId0=1790211
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/symantec/aemprod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
49bff3da68e5bc1d3c8d51651c9a8f102db01e2e6a574c7635da27a5ff4831c3

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Fri, 21 Feb 2020 07:03:50 GMT
last-modified
Fri, 03 May 2019 16:40:11 GMT
server
nginx
etag
"5ccc6eeb-297"
content-type
application/javascript; charset=utf-8
status
200
cache-control
max-age=315360000
accept-ranges
bytes
content-length
663
b6126aab1adefb057d7f2589388ede1a.js
nexus.ensighten.com/symantec/aemprod/code/
8 KB
3 KB
Script
General
Full URL
https://nexus.ensighten.com/symantec/aemprod/code/b6126aab1adefb057d7f2589388ede1a.js?conditionId0=473910
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/symantec/aemprod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
ac5062a26074b1f55f8fac636722017921d379703a5fed821ec29d14f16a4411

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Fri, 21 Feb 2020 07:03:50 GMT
content-encoding
gzip
last-modified
Tue, 21 Jan 2020 18:27:16 GMT
server
nginx
etag
W/"5e274284-1f16"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
status
200
cache-control
max-age=315360000
8d5c03b6d225956050a79dd8248c9f74.js
nexus.ensighten.com/symantec/aemprod/code/
3 KB
1 KB
Script
General
Full URL
https://nexus.ensighten.com/symantec/aemprod/code/8d5c03b6d225956050a79dd8248c9f74.js?conditionId0=292034
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/symantec/aemprod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
e6a252dd3dc47ec3385baa7bd0f8d08c7bf63371c0c0184f1877403d13f32604

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Fri, 21 Feb 2020 07:03:50 GMT
content-encoding
gzip
last-modified
Fri, 03 May 2019 16:40:11 GMT
server
nginx
etag
W/"5ccc6eeb-bad"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
status
200
cache-control
max-age=315360000
38340922e01e72a053205b6550bc1aa6.js
nexus.ensighten.com/symantec/aemprod/code/
230 B
412 B
Script
General
Full URL
https://nexus.ensighten.com/symantec/aemprod/code/38340922e01e72a053205b6550bc1aa6.js?conditionId0=4850002
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/symantec/aemprod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
d2a224459854487475c6edd91c8124d08c679750bd9d1be5dc645a2d743acdde

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Fri, 21 Feb 2020 07:03:50 GMT
last-modified
Mon, 17 Jun 2019 17:20:41 GMT
server
nginx
etag
"5d07cbe9-e6"
content-type
application/javascript; charset=utf-8
status
200
cache-control
max-age=315360000
accept-ranges
bytes
content-length
230
uwt.js
static.ads-twitter.com/
5 KB
2 KB
Script
General
Full URL
https://static.ads-twitter.com/uwt.js
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/symantec/aemprod/Bootstrap.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.112.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
319949c8c08b86e9c35ea542c0dc0c30cedaa9b8d3d3c3327a36c91aefbd8af5

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Fri, 21 Feb 2020 07:03:50 GMT
content-encoding
gzip
age
82207
x-cache
HIT
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status
200
content-length
1954
x-served-by
cache-hhn4026-HHN
last-modified
Tue, 23 Jan 2018 20:09:00 GMT
x-timer
S1582268631.614093,VS0,VE0
etag
"b7b33882a4f3ffd5cbf07434f3137166+gzip"
vary
Accept-Encoding,Host
content-type
application/javascript; charset=utf-8
via
1.1 varnish
cache-control
no-cache
accept-ranges
bytes
fbevents.js
connect.facebook.net/en_US/
126 KB
30 KB
Script
General
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/symantec/aemprod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
5a91c6d3e635c0bd1551a53cf0769328132151a7732039170280d500dbcb4685
Security Headers
Name Value
Content-Security-Policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
status
200
alt-svc
h3-24=":443"; ma=3600
content-length
30466
x-xss-protection
0
pragma
public
x-fb-debug
0HSj5T2+Vbzp1QhQGPyQ5nFFNpdkJyCPcxBkW1vgxDcKSMnFDTYeCD1tCCjOdYcMbb+nQYD1sCQGPXqurXz7ng==
x-fb-trip-id
420120009
date
Fri, 21 Feb 2020 07:03:50 GMT, Fri, 21 Feb 2020 07:03:50 GMT
x-frame-options
DENY
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
content-security-policy
default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires
Sat, 01 Jan 2000 00:00:00 GMT
A247452-16ea-46a1-bf3e-0d9e4518ff9c1.js
d.impactradius-event.com/
40 KB
13 KB
Script
General
Full URL
https://d.impactradius-event.com/A247452-16ea-46a1-bf3e-0d9e4518ff9c1.js
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/symantec/aemprod/Bootstrap.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.186.249.72 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
72.249.186.35.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
5130b4e7d768a441b2d23a7e8e6cbd3ef5231744a011399e5fc6e43155ae46b6

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Fri, 21 Feb 2020 07:03:39 GMT
content-encoding
gzip
age
11
status
200
x-guploader-uploadid
AEnB2Urd1jLnZ7UzdpurFv4UwaSeZxEY9PE5coe9cqXI2ItzCd0BV5EG1emWLDSq8MBQ8Ut3OQdiYilB-NFM761EtBAYLMfp-4JSaZ_tr7GVp80Cq353uEw
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
1
x-goog-stored-content-encoding
gzip
alt-svc
clear
content-length
12976
last-modified
Tue, 18 Feb 2020 03:20:44 GMT
server
UploadServer
etag
"e474fac8af446df3a81b09a7c719fec5"
vary
Accept-Encoding
x-goog-hash
crc32c=Z2tF3A==, md5=5HT6yK9EbfOoGwmnxxn+xQ==
x-goog-generation
1581996044960152
cache-control
public,max-age=900,s-maxage=300
x-goog-stored-content-length
12976
accept-ranges
bytes
content-type
text/javascript; charset=utf-8
expires
Fri, 21 Feb 2020 07:08:39 GMT
js
www.googletagmanager.com/gtag/
74 KB
28 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=DC-8136487
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/symantec/aemprod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
16f2f0cba7086f8d7cedc1ea8fe8358307f4845a0bd563126c3f8ca8b43b23d2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Fri, 21 Feb 2020 07:03:50 GMT
content-encoding
br
status
200
strict-transport-security
max-age=31536000; includeSubDomains
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
28488
x-xss-protection
0
last-modified
Fri, 21 Feb 2020 06:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
http://www.googletagmanager.com
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Fri, 21 Feb 2020 07:03:50 GMT
MDDJR-3RVW8-S3M46-HL4QS-RLVQ4
s.go-mpulse.net/boomerang/ Frame CF9A
187 KB
47 KB
Script
General
Full URL
https://s.go-mpulse.net/boomerang/MDDJR-3RVW8-S3M46-HL4QS-RLVQ4
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/symantec/aemprod/code/4ecf75334b0b4672a9d31d751410223f.js?conditionId0=379007
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.0.36.169 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-0-36-169.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e0b8436d50fb200de76d7a25cf450ea238cd100197f8e9d462e9228153da873f

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Fri, 21 Feb 2020 07:03:50 GMT
content-encoding
br
last-modified
Thu, 06 Feb 2020 18:12:33 GMT
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
status
200
cache-control
max-age=604800
timing-allow-origin
*
content-length
47928
i.js
tag.bounceexchange.com/2004/
Redirect Chain
  • https://bounceexchange.com/tag/2004/i.js
  • https://tag.bounceexchange.com/2004/i.js
49 KB
11 KB
Script
General
Full URL
https://tag.bounceexchange.com/2004/i.js
Requested by
Host: us.norton.com
URL: https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.244.144.168 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
168.144.244.35.bc.googleusercontent.com
Software
fasthttp /
Resource Hash
a0a771310c3d3f2d34b576c677a5055aa8a328bd9a9601849c3f35dfa2a9e71c

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 21 Feb 2020 07:03:47 GMT
content-encoding
gzip
server
fasthttp
age
3
etag
2641d3181d709b
content-type
text/plain; charset=utf-8
status
200
cache-control
public, max-age=60
x-region
us-east4
alt-svc
clear
content-length
10995
via
1.1 google

Redirect headers

date
Fri, 21 Feb 2020 07:03:50 GMT
via
1.1 google
server
nginx
location
https://tag.bounceexchange.com/2004/i.js
content-type
text/html
status
301
alt-svc
clear
content-length
162
Cookie set dest5.html
symantec.demdex.net/ Frame 9E0E
0
0
Document
General
Full URL
https://symantec.demdex.net/dest5.html?d_nsid=0
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/symantec/aemprod/Bootstrap.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.209.33.201 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-209-33-201.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Host
symantec.demdex.net
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
demdex=79549224783269911893663617195779330274
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html

Response headers

Accept-Ranges
bytes
Cache-Control
max-age=21600
Content-Encoding
gzip
Content-Type
text/html
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Last-Modified
Wed, 19 Feb 2020 10:21:47 GMT
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma
no-cache
Set-Cookie
demdex=79549224783269911893663617195779330274;Path=/;Domain=.demdex.net;Expires=Wed, 19-Aug-2020 07:03:50 GMT;Max-Age=15552000;Secure;SameSite=None
Strict-Transport-Security
max-age=31536000; includeSubDomains
Vary
Accept-Encoding, User-Agent
X-TID
iNM14jkyS/M=
Content-Length
2785
Connection
keep-alive
id
oms.norton.com/
48 B
480 B
XHR
General
Full URL
https://oms.norton.com/id?d_visid_ver=4.4.0&d_fieldgroup=A&mcorgid=67C716D751E567F70A490D4C%40AdobeOrg&mid=79394489270989470443647019660199926867&ts=1582268630626
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/symantec/aemprod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.140.85.34 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-140-85-34.ap-southeast-1.compute.amazonaws.com
Software
jag /
Resource Hash
583ac3341c1b1199e3813fd17c5722770d7c29474e10e7aff4554f93f9c41312
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
Origin
https://us.norton.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

status
200
date
Fri, 21 Feb 2020 07:03:51 GMT
x-content-type-options
nosniff
server
jag
xserver
anedge-665bcdccf8-9cr8z
vary
Origin
x-c
master-1169.Ie4359b.M0-349
p3p
CP="This is not a P3P policy"
access-control-allow-origin
https://us.norton.com
cache-control
no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials
true
content-type
application/x-javascript;charset=utf-8
content-length
48
x-xss-protection
1; mode=block
ibs:dpid=411&dpuuid=Xk_A1gAAAqzbZVL0
dpm.demdex.net/
Redirect Chain
  • https://cm.everesttech.net/cm/dd?d_uuid=79549224783269911893663617195779330274
  • https://dpm.demdex.net/ibs:dpid=411&dpuuid=Xk_A1gAAAqzbZVL0
42 B
915 B
Image
General
Full URL
https://dpm.demdex.net/ibs:dpid=411&dpuuid=Xk_A1gAAAqzbZVL0
Requested by
Host: us.norton.com
URL: https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.213.129.52 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-213-129-52.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

DCS
dcs-prod-irl1-v061-089dd2cbd.edge-irl1.demdex.com 5.65.0.20200212140016 1ms (+1ms)
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
X-TID
v2NthaxYSPY=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Type
image/gif
Content-Length
42
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Date
Fri, 21 Feb 2020 07:03:50 GMT
Server
AMO-cookiemap/1.1
P3P
CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Location
https://dpm.demdex.net/ibs:dpid=411&dpuuid=Xk_A1gAAAqzbZVL0
Cache-Control
no-cache
Connection
Keep-Alive
Keep-Alive
timeout=15,max=100
Content-Length
0
concierge-client.js
asset.gomoxie.solutions/concierge/norton/client/
450 KB
129 KB
Script
General
Full URL
https://asset.gomoxie.solutions/concierge/norton/client/concierge-client.js
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/symantec/aemprod/Bootstrap.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.202.96 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-202-96.fra53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
8157d9df62aa076157f63d4bcc571ea6cc96876d845035946f7c47c19604fc8a

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

Date
Fri, 21 Feb 2020 06:57:07 GMT
Content-Encoding
gzip
Last-Modified
Wed, 29 Jan 2020 18:40:57 GMT
Server
AmazonS3
Age
404
ETag
"69798d418c3ad25282045d3c69bad511"
X-Cache
Hit from cloudfront
Content-Type
application/javascript
Via
1.1 c714e4f593454d65f62cf3fecf756a4c.cloudfront.net (CloudFront)
Cache-Control
public, max-age=1800
X-Amz-Cf-Pop
FRA53-C1
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
131275
X-Amz-Cf-Id
fLg3ymCLDXnz2qHejOkuEBDcuQn2ArultTMVtkaAX4s7G2UaYWf71Q==
src=9309239;dc_pre=CPC44P2J4ucCFQRxGwodCWcHlQ;type=invmedia;cat=norto00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1
adservice.google.com/ddm/fls/z/
Redirect Chain
  • https://gwmtracking.com/p/v/1/59bc0993f8708105b27e9bf1/format/img
  • https://ad.doubleclick.net/ddm/activity/src=9309239;type=invmedia;cat=norto00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1?
  • https://ad.doubleclick.net/ddm/activity/src=9309239;dc_pre=CPC44P2J4ucCFQRxGwodCWcHlQ;type=invmedia;cat=norto00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1?
  • https://adservice.google.com/ddm/fls/z/src=9309239;dc_pre=CPC44P2J4ucCFQRxGwodCWcHlQ;type=invmedia;cat=norto00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1
42 B
719 B
Image
General
Full URL
https://adservice.google.com/ddm/fls/z/src=9309239;dc_pre=CPC44P2J4ucCFQRxGwodCWcHlQ;type=invmedia;cat=norto00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1
Requested by
Host: us.norton.com
URL: https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 21 Feb 2020 07:03:51 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, must-revalidate
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 21 Feb 2020 07:03:51 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
location
https://adservice.google.com/ddm/fls/z/src=9309239;dc_pre=CPC44P2J4ucCFQRxGwodCWcHlQ;type=invmedia;cat=norto00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
302
cache-control
no-cache, must-revalidate
content-type
text/html; charset=UTF-8
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
GlanceCobrowseLoader_4.9.0M.js
s3.amazonaws.com/glancecdn/cobrowse/js/
Redirect Chain
  • https://glancecdn.net/cobrowse/CoBrowseJS.ashx?group=20636&site=production%20id=%22cobrowsescript%22%20charset=%22UTF-8%22%20data-inputevents=%27{%22ctrl-13%22:%22startSession%22}%27
  • https://s3.amazonaws.com/glancecdn/cobrowse/js/GlanceCobrowseLoader_4.9.0M.js
9 KB
9 KB
Script
General
Full URL
https://s3.amazonaws.com/glancecdn/cobrowse/js/GlanceCobrowseLoader_4.9.0M.js
Requested by
Host: us.norton.com
URL: https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.216.138.213 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
19b399504472722d29b53e85751d99089d6f98c18ba73931dfbbbe251c4e07a9

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Fri, 21 Feb 2020 07:03:52 GMT
Last-Modified
Tue, 05 Nov 2019 22:35:58 GMT
Server
AmazonS3
x-amz-request-id
5FC72B6F2B386489
ETag
"3fcc37d0e9ddabde15d8f4bdb51cb1e9"
x-amz-version-id
T_IiJ.xSF7THsIBNdbQc2hbXg4MUIuQ2
Cache-Control
public, max-age=31556926
x-amz-replication-status
COMPLETED
Accept-Ranges
bytes
Content-Type
text/javascript
Content-Length
9082
x-amz-id-2
g1/O6HuYAS3LNTDE04sB9tqVvG1juyTQ/sPzcuf5VY8biMG2YDMxZFdQ0BkNHt7sLS9NkTeZg+U=

Redirect headers

date
Fri, 21 Feb 2020 07:03:50 GMT
server
Microsoft-IIS/8.5
x-aspnet-version
4.0.30319
access-control-allow-origin
*
location
https://s3.amazonaws.com/glancecdn/cobrowse/js/GlanceCobrowseLoader_4.9.0M.js
content-type
text/html; charset=utf-8
status
302
cache-control
max-age=3600
content-length
194
2010787619164716
connect.facebook.net/signals/config/
447 KB
112 KB
Script
General
Full URL
https://connect.facebook.net/signals/config/2010787619164716?v=2.9.15&r=stable
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/symantec/aemprod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
8f22857be0fc9b8a537aed130130ef07638450809869c2f3d0ad5a939d623425
Security Headers
Name Value
Content-Security-Policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
status
200
alt-svc
h3-24=":443"; ma=3600
content-length
114949
x-xss-protection
0
pragma
public
x-fb-debug
LE6DJzXd0jz0lcV2pK6vfRGrD9gK5cBQpwOVdRFwUmsaWxjpD28ZVF4oBEDhENtil631O1/q8Uczpz1GUEDjdQ==
x-fb-trip-id
420120009
date
Fri, 21 Feb 2020 07:03:50 GMT, Fri, 21 Feb 2020 07:03:50 GMT
x-frame-options
DENY
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
content-security-policy
default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires
Sat, 01 Jan 2000 00:00:00 GMT
conversion_async.js
www.googleadservices.com/pagead/
26 KB
10 KB
Script
General
Full URL
https://www.googleadservices.com/pagead/conversion_async.js
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/symantec/aemprod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.23.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
mil04s23-in-f98.1e100.net
Software
cafe /
Resource Hash
e613df9aa843851d019cc12e6184972311e2229c14299d2f6c80f4aadf2d844a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Fri, 21 Feb 2020 07:03:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
9931
x-xss-protection
0
server
cafe
etag
9478280665056484852
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Fri, 21 Feb 2020 07:03:50 GMT
adsct
t.co/i/
43 B
171 B
Image
General
Full URL
https://t.co/i/adsct?p_id=Twitter&p_user_id=0&txn_id=nuzip&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0
Requested by
Host: us.norton.com
URL: https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.42.197 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=0
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 21 Feb 2020 07:03:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
status
200, 200 OK
x-twitter-response-tags
BouncerCompliant
strict-transport-security
max-age=0
content-length
65
x-xss-protection
0
x-response-time
152
pragma
no-cache
last-modified
Fri, 21 Feb 2020 07:03:50 GMT
server
tsa_o
x-frame-options
SAMEORIGIN
content-type
image/gif;charset=utf-8
cache-control
no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash
6b7bef23305aae2fdbba497b3e65f75c
x-transaction
00975dc4005f96e0
expires
Tue, 31 Mar 1981 05:00:00 GMT
/
www.facebook.com/tr/
44 B
249 B
Image
General
Full URL
https://www.facebook.com/tr/?id=2010787619164716&ev=PageView&dl=https%3A%2F%2Fus.norton.com%2Fonline-threats%2Fbackdoor.cobalt!gen1-2018-121403-1729-99-writeup.html&rl=&if=false&ts=1582268630694&sw=1600&sh=1200&v=2.9.15&r=stable&a=tmensighten&ec=0&o=29&fbp=fb.1.1582268630693.857900625&it=1582268630657&coo=false&rqm=GET
Requested by
Host: us.norton.com
URL: https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 21 Feb 2020 07:03:50 GMT, Fri, 21 Feb 2020 07:03:50 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
status
200
cache-control
no-cache, must-revalidate, max-age=0
alt-svc
h3-24=":443"; ma=3600
content-length
44
expires
Fri, 21 Feb 2020 07:03:50 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/1043330685/
2 KB
1 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1043330685/?random=1582268630708&cv=9&fst=1582268630708&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2od2c0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fus.norton.com%2Fonline-threats%2Fbackdoor.cobalt!gen1-2018-121403-1729-99-writeup.html&tiba=Backdoor.Cobalt!gen1%20%7C%20Technical%20Details%20%7C%20Removing%20Help%20-%20Removal%20%7C%20Norton&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/symantec/aemprod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ac91c555d84965c54dbf299e474193ac0b8f1eb07b9fa24301a87ad59a911491
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

pragma
no-cache
date
Fri, 21 Feb 2020 07:03:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
text/javascript; charset=UTF-8
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
no-cache, must-revalidate
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
1101
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
config.json
c.go-mpulse.net/api/ Frame CF9A
3 KB
1 KB
XHR
General
Full URL
https://c.go-mpulse.net/api/config.json?key=MDDJR-3RVW8-S3M46-HL4QS-RLVQ4&d=us.norton.com&t=5274229&v=1.571.0&if=&sl=0&si=jz86nh34bv-NaN&plugins=ConfigOverride,Continuity,PageParams,IFrameDelay,AutoXHR,SPA,Angular,Backbone,Ember,History,RT,CrossDomain,BW,PaintTiming,NavigationTiming,ResourceTiming,Memory,CACHE_RELOAD,Errors,TPAnalytics,UserTiming,LOGN&acao=
Requested by
Host: s.go-mpulse.net
URL: https://s.go-mpulse.net/boomerang/MDDJR-3RVW8-S3M46-HL4QS-RLVQ4
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:6c00:184::11a6 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
/
Resource Hash
ce3746cc543545bf405359f11b14b5d7f94cba1b0a4725f22d622713b771d7a9

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
Origin
https://us.norton.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Fri, 21 Feb 2020 07:03:50 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
application/json
Access-Control-Allow-Origin
*
Cache-Control
private, max-age=300, stale-while-revalidate=60, stale-if-error=120
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
939
/
www.google.com/pagead/1p-user-list/1043330685/
42 B
116 B
Image
General
Full URL
https://www.google.com/pagead/1p-user-list/1043330685/?random=1582268630708&cv=9&fst=1582268400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2od2c0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fus.norton.com%2Fonline-threats%2Fbackdoor.cobalt!gen1-2018-121403-1729-99-writeup.html&tiba=Backdoor.Cobalt!gen1%20%7C%20Technical%20Details%20%7C%20Removing%20Help%20-%20Removal%20%7C%20Norton&async=1&fmt=3&is_vtc=1&random=1508315829&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Requested by
Host: us.norton.com
URL: https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:821::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Fri, 21 Feb 2020 07:03:50 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ijs_all_modules_cjs_min_ae6697f005edb1254700241be1167cdb.js
assets.bounceexchange.com/assets/smart-tag/versioned/
402 KB
110 KB
Script
General
Full URL
https://assets.bounceexchange.com/assets/smart-tag/versioned/ijs_all_modules_cjs_min_ae6697f005edb1254700241be1167cdb.js
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/symantec/aemprod/Bootstrap.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.98.72.95 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
95.72.98.34.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
4d8464d6001bfd6b3393bac88d3ef7b49aa2c1b100e4632b012a575b0195922a

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Mon, 10 Feb 2020 21:26:37 GMT
content-encoding
gzip
age
898633
status
200
x-guploader-uploadid
AEnB2UrMJPG2qfFD1PcL7LXJr6TXvXup51H29cvJNxKrGg7kqQ6ePr0hi01X8r_oQJqxzJmYjHyQFWYRZb2oqN_aw_TAtDIZAQ
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
1
x-goog-stored-content-encoding
gzip
alt-svc
clear
content-length
111927
last-modified
Mon, 10 Feb 2020 21:26:30 GMT
server
UploadServer
etag
"c5850246da0af104c0005e409e65d3e2"
vary
Accept-Encoding
x-goog-hash
crc32c=IYZzUQ==, md5=xYUCRtoK8QTAAF5AnmXT4g==
x-goog-generation
1581369990786847
cache-control
public,max-age=31536000
x-goog-stored-content-length
111927
accept-ranges
bytes
content-type
text/javascript
expires
Tue, 09 Feb 2021 21:26:37 GMT
ajax
symantec.tt.omtrdc.net/m2/symantec/mbox/
968 B
550 B
Script
General
Full URL
https://symantec.tt.omtrdc.net/m2/symantec/mbox/ajax?mboxHost=us.norton.com&mboxPage=12e435eda9134856a4777d23b85cca9d&screenHeight=1200&screenWidth=1600&browserWidth=1600&browserHeight=1200&browserTimeOffset=60&colorDepth=24&mboxSession=12e435eda9134856a4777d23b85cca9d&mboxCount=2&mboxTime=1582272230449&content_title=writeup&current_subchannel=Online%20(1st)&ExistingCustomer=existing_customer%3A%20No&ExistingCustomerList=missing&original_subchannel=Online%20(1st)&product_name=undefined&profile.current_subchannel=Online%20(1st)&profile.ExistingCustomer=existing_customer%3A%20No&profile.original_subchannel=Online%20(1st)&profile.product_name=undefined&profile.program_type=unknown&profile.site_content_title=writeup&profile.site_country=us&profile.site_language=en&profile.site_section=norton.com&profile.site_sub_section=internetsecurity&profile.TCG=5&profile.traffic_source=symcom&profile.vendor_type=norton%3Asymantec&program_type=unknown&site_country=us&site_language=en&site_section=norton.com&site_sub_section=internetsecurity&traffic_source=symcom&vendor_type=norton%3Asymantec&mboxPC=12e435eda9134856a4777d23b85cca9d.26_0&mbox=nortoncom_global_mbox&mboxId=0&mboxMCSDID=22195E602A8BC975-79A654317F58C451&mboxMCGVID=79394489270989470443647019660199926867&vst.trk=om.norton.com&vst.trks=oms.norton.com&mboxURL=https%3A%2F%2Fus.norton.com%2Fonline-threats%2Fbackdoor.cobalt!gen1-2018-121403-1729-99-writeup.html&mboxReferrer=&mboxVersion=63
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/symantec/aemprod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
66.117.29.3 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software
/
Resource Hash
ae03ecaf785b33a67314d7ccdaadda6a1f9a4c9ba357ae56cacbe3c30dea0b69

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

pragma
no-cache
date
Fri, 21 Feb 2020 07:03:50 GMT
content-encoding
gzip
vary
Accept-Encoding
content-type
text/javascript;charset=utf-8
status
200
cache-control
no-cache
timing-allow-origin
*
x-request-id
f9e00857-f8bc-4e23-ae67-24ce2f2dce61
local_storage_frame15.min.html
assets.bounceexchange.com/assets/bounce/ Frame 1144
0
0
Document
General
Full URL
https://assets.bounceexchange.com/assets/bounce/local_storage_frame15.min.html
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/symantec/aemprod/Bootstrap.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.98.72.95 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
95.72.98.34.bc.googleusercontent.com
Software
UploadServer /
Resource Hash

Request headers

:method
GET
:authority
assets.bounceexchange.com
:scheme
https
:path
/assets/bounce/local_storage_frame15.min.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest
iframe
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html

Response headers

status
200
x-guploader-uploadid
AEnB2UoBq-k40MaUn3DBO0if-iLwqaSEwZtFi7vRVf4Pzb3LWnkU5NQwfLhIwb0jOoLA3u_Xws2-REd5MtCmRkAu3M0RaqCjzgwBOUWYRAE7SAQHuRXbW7I
date
Fri, 21 Feb 2020 07:03:51 GMT
cache-control
max-age=31536000
expires
Sat, 20 Feb 2021 07:03:51 GMT
last-modified
Tue, 04 Feb 2020 01:30:01 GMT
etag
"a450c11eab71db53fd6ac946aef497af"
x-goog-generation
1580779801190315
x-goog-metageneration
2
x-goog-stored-content-encoding
gzip
x-goog-stored-content-length
1084
content-type
text/html
content-encoding
gzip
x-goog-hash
crc32c=+XVPJw== md5=pFDBHqtx21P9aslGrvSXrw==
x-goog-storage-class
MULTI_REGIONAL
accept-ranges
bytes
vary
Accept-Encoding
content-length
1084
server
UploadServer
alt-svc
clear
update_cookie
api.bounceexchange.com/capture/
42 B
406 B
Image
General
Full URL
https://api.bounceexchange.com/capture/update_cookie?cookie_name=bounceClientVisit2004&cookie=%7B%22v%22%3A%7B%22discount_amount%22%3A0%2C%22source_type%22%3A%22Online%20(1st)%22%7D%7D
Requested by
Host: us.norton.com
URL: https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.227.229.34 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
34.229.227.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Fri, 21 Feb 2020 07:03:51 GMT
via
1.1 google
server
nginx
p3p
CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
status
200
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
alt-svc
clear
expires
0
update_cookie
api.bounceexchange.com/capture/
42 B
522 B
Image
General
Full URL
https://api.bounceexchange.com/capture/update_cookie?cookie_name=bounceClientVisit2004&cookie=%7B%22v%22%3A%7B%22discount_amount%22%3A0%2C%22source_type%22%3A%22Online%20(1st)%22%2C%22days_to_expiration%22%3Afalse%2C%22incoming_prod_sub_length%22%3Afalse%2C%22items_in_cart%22%3A0%2C%22cart_tracking_link%22%3Afalse%2C%22cart%22%3Afalse%2C%22ibx_test%22%3Afalse%2C%22deluxe_discount%22%3A0%2C%22first_cart_item%22%3Afalse%2C%22first_cart_item_fix%22%3Afalse%2C%22ever_logged_in%22%3Afalse%2C%22largest_discount%22%3Anull%7D%7D
Requested by
Host: us.norton.com
URL: https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.227.229.34 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
34.229.227.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Fri, 21 Feb 2020 07:03:51 GMT
via
1.1 google
server
nginx
p3p
CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
status
200
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
alt-svc
clear
expires
0
update_cookie
api.bounceexchange.com/capture/
42 B
868 B
Image
General
Full URL
https://api.bounceexchange.com/capture/update_cookie?cookie_name=bounceClientVisit2004&cookie=%7B%22v%22%3A%7B%22discount_amount%22%3A0%2C%22source_type%22%3A%22Online%20(1st)%22%2C%22days_to_expiration%22%3Afalse%2C%22incoming_prod_sub_length%22%3Afalse%2C%22items_in_cart%22%3A0%2C%22cart_tracking_link%22%3Afalse%2C%22cart%22%3Afalse%2C%22ibx_test%22%3Afalse%2C%22deluxe_discount%22%3A0%2C%22first_cart_item%22%3Afalse%2C%22first_cart_item_fix%22%3Afalse%2C%22ever_logged_in%22%3Afalse%2C%22largest_discount%22%3Anull%2C%22product_recommendation%22%3A0%2C%22affiliate_type%22%3Afalse%2C%22affiliate_type_general%22%3Afalse%2C%22cobranding_partner%22%3Afalse%2C%22affilate_pararms%22%3Afalse%2C%22affiliate_event%22%3Afalse%2C%22affiliate_params_jan%22%3Afalse%2C%22affiliate_params_july%22%3Afalse%2C%22affiliate_params_april%22%3Afalse%2C%22affiliate_params_bluedoor_mar2019%22%3Afalse%2C%22bx_testing%22%3Afalse%2C%22affiliate_tracking%22%3Afalse%2C%22atc_link%22%3Afalse%2C%22cart_plurality_quantity%22%3A%22%22%7D%7D
Requested by
Host: us.norton.com
URL: https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.227.229.34 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
34.229.227.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Fri, 21 Feb 2020 07:03:51 GMT
via
1.1 google
server
nginx
p3p
CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
status
200
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
alt-svc
clear
expires
0
update_cookie
api.bounceexchange.com/capture/
42 B
901 B
Image
General
Full URL
https://api.bounceexchange.com/capture/update_cookie?cookie_name=bounceClientVisit2004&cookie=%7B%22v%22%3A%7B%22discount_amount%22%3A0%2C%22source_type%22%3A%22Online%20(1st)%22%2C%22days_to_expiration%22%3Afalse%2C%22incoming_prod_sub_length%22%3Afalse%2C%22items_in_cart%22%3A0%2C%22cart_tracking_link%22%3Afalse%2C%22cart%22%3Afalse%2C%22ibx_test%22%3Afalse%2C%22deluxe_discount%22%3A0%2C%22first_cart_item%22%3Afalse%2C%22first_cart_item_fix%22%3Afalse%2C%22ever_logged_in%22%3Afalse%2C%22largest_discount%22%3Anull%2C%22product_recommendation%22%3A0%2C%22affiliate_type%22%3Afalse%2C%22affiliate_type_general%22%3Afalse%2C%22cobranding_partner%22%3Afalse%2C%22affilate_pararms%22%3Afalse%2C%22affiliate_event%22%3Afalse%2C%22affiliate_params_jan%22%3Afalse%2C%22affiliate_params_july%22%3Afalse%2C%22affiliate_params_april%22%3Afalse%2C%22affiliate_params_bluedoor_mar2019%22%3Afalse%2C%22bx_testing%22%3Afalse%2C%22affiliate_tracking%22%3Afalse%2C%22atc_link%22%3Afalse%2C%22cart_plurality_quantity%22%3A%22%22%2C%22cart_plurality_qualify%22%3A%22product%22%7D%7D
Requested by
Host: us.norton.com
URL: https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.227.229.34 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
34.229.227.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Fri, 21 Feb 2020 07:03:51 GMT
via
1.1 google
server
nginx
p3p
CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
status
200
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
alt-svc
clear
expires
0
update_cookie
api.bounceexchange.com/capture/
42 B
1018 B
Image
General
Full URL
https://api.bounceexchange.com/capture/update_cookie?cookie_name=bounceClientVisit2004&cookie=%7B%22v%22%3A%7B%22discount_amount%22%3A0%2C%22source_type%22%3A%22Online%20(1st)%22%2C%22days_to_expiration%22%3Afalse%2C%22incoming_prod_sub_length%22%3Afalse%2C%22items_in_cart%22%3A0%2C%22cart_tracking_link%22%3Afalse%2C%22cart%22%3Afalse%2C%22ibx_test%22%3Afalse%2C%22deluxe_discount%22%3A0%2C%22first_cart_item%22%3Afalse%2C%22first_cart_item_fix%22%3Afalse%2C%22ever_logged_in%22%3Afalse%2C%22largest_discount%22%3Anull%2C%22product_recommendation%22%3A0%2C%22affiliate_type%22%3Afalse%2C%22affiliate_type_general%22%3Afalse%2C%22cobranding_partner%22%3Afalse%2C%22affilate_pararms%22%3Afalse%2C%22affiliate_event%22%3Afalse%2C%22affiliate_params_jan%22%3Afalse%2C%22affiliate_params_july%22%3Afalse%2C%22affiliate_params_april%22%3Afalse%2C%22affiliate_params_bluedoor_mar2019%22%3Afalse%2C%22bx_testing%22%3Afalse%2C%22affiliate_tracking%22%3Afalse%2C%22atc_link%22%3Afalse%2C%22cart_plurality_quantity%22%3A%22%22%2C%22cart_plurality_qualify%22%3A%22product%22%2C%22logged_in_identified%22%3Afalse%2C%22affiliate_params_cobranding%22%3Afalse%2C%22affiliate_params_cobranding_update%22%3Afalse%2C%22cart_plurality%22%3A%22item%22%7D%7D
Requested by
Host: us.norton.com
URL: https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.227.229.34 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
34.229.227.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Fri, 21 Feb 2020 07:03:51 GMT
via
1.1 google
server
nginx
p3p
CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
status
200
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
alt-svc
clear
expires
0
update_cookie
api.bounceexchange.com/capture/
42 B
1 KB
Image
General
Full URL
https://api.bounceexchange.com/capture/update_cookie?cookie_name=bounceClientVisit2004&cookie=%7B%22v%22%3A%7B%22discount_amount%22%3A0%2C%22source_type%22%3A%22Online%20(1st)%22%2C%22days_to_expiration%22%3Afalse%2C%22incoming_prod_sub_length%22%3Afalse%2C%22items_in_cart%22%3A0%2C%22cart_tracking_link%22%3Afalse%2C%22cart%22%3Afalse%2C%22ibx_test%22%3Afalse%2C%22deluxe_discount%22%3A0%2C%22first_cart_item%22%3Afalse%2C%22first_cart_item_fix%22%3Afalse%2C%22ever_logged_in%22%3Afalse%2C%22largest_discount%22%3Anull%2C%22product_recommendation%22%3A0%2C%22affiliate_type%22%3Afalse%2C%22affiliate_type_general%22%3Afalse%2C%22cobranding_partner%22%3Afalse%2C%22affilate_pararms%22%3Afalse%2C%22affiliate_event%22%3Afalse%2C%22affiliate_params_jan%22%3Afalse%2C%22affiliate_params_july%22%3Afalse%2C%22affiliate_params_april%22%3Afalse%2C%22affiliate_params_bluedoor_mar2019%22%3Afalse%2C%22bx_testing%22%3Afalse%2C%22affiliate_tracking%22%3Afalse%2C%22atc_link%22%3Afalse%2C%22cart_plurality_quantity%22%3A%22%22%2C%22cart_plurality_qualify%22%3A%22product%22%2C%22logged_in_identified%22%3Afalse%2C%22affiliate_params_cobranding%22%3Afalse%2C%22affiliate_params_cobranding_update%22%3Afalse%2C%22cart_plurality%22%3A%22item%22%2C%22fire_affiliate_once%22%3Afalse%2C%22cart_set%22%3Afalse%2C%22cart_value%22%3A0%7D%7D
Requested by
Host: us.norton.com
URL: https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.227.229.34 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
34.229.227.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Fri, 21 Feb 2020 07:03:51 GMT
via
1.1 google
server
nginx
p3p
CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
status
200
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
alt-svc
clear
expires
0
s63112904899086
oms.norton.com/b/ss/symanteccom/1/JS-2.17.0/
43 B
643 B
Image
General
Full URL
https://oms.norton.com/b/ss/symanteccom/1/JS-2.17.0/s63112904899086?AQB=1&ndh=1&pf=1&t=21%2F1%2F2020%208%3A3%3A51%205%20-60&sdid=22195E602A8BC975-79A654317F58C451&mid=79394489270989470443647019660199926867&aamlh=6&ce=UTF-8&pageName=norton.com%3Aus%3Ainternetsecurity%3Aonline-threats%3Awriteup%3Abackdoor.cobalt%21gen1&g=https%3A%2F%2Fus.norton.com%2Fonline-threats%2Fbackdoor.cobalt%21gen1-2018-121403-1729-99-writeup.html&server=norton&events=event79%3D6%2Cevent69&aamb=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&c2=us&c3=en&v5=norton%3Asymantec&c14=D%3Dv16&v16=norton%3Asymcom&v18=D%3DpageName&v21=D%3Dc21&v27=D%3Dc2&v28=D%3Dc3&v33=D%3Dc17&c35=D%3DpageName&c41=norton.com&v41=D%3Dc41&c46=html&c47=page&v47=s_code_norton&c48=writeup&v48=D%3Dc49&c49=internetsecurity&v49=D%3Dc48&v57=79394489270989470443647019660199926867&v58=online-threats&c59=norton.com%3Ainternetsecurity%3Aonline-threats%3Awriteup%3Abackdoor.cobalt%21gen1&v59=D%3Dc59&v66=unknown&v72=norton.com&c75=D%3Dv57&v90=existing_customer%3A%20No&v96=https%3A%2F%2Fus.norton.com%2Fonline-threats%2Fbackdoor.cobalt%21gen1-2018-121403-1729-99-writeup.html&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=67C716D751E567F70A490D4C%40AdobeOrg&AQE=1
Requested by
Host: us.norton.com
URL: https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.140.85.34 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-140-85-34.ap-southeast-1.compute.amazonaws.com
Software
jag /
Resource Hash
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 21 Feb 2020 07:03:51 GMT
x-content-type-options
nosniff
x-c
master-1169.Ie4359b.M0-349
p3p
CP="This is not a P3P policy"
status
200
content-length
43
x-xss-protection
1; mode=block
pragma
no-cache
last-modified
Sat, 22 Feb 2020 07:03:51 GMT
server
jag
xserver
anedge-665bcdccf8-cl4ks
etag
3397896011901140992-4618558005314916823
vary
*
content-type
image/gif;charset=utf-8
access-control-allow-origin
*
cache-control
no-cache, no-store, max-age=0, no-transform, private
expires
Thu, 20 Feb 2020 07:03:51 GMT
bat.js
bat.bing.com/
23 KB
7 KB
Script
General
Full URL
https://bat.bing.com/bat.js
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/symantec/aemprod/Bootstrap.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
89b531e78902333807b825faf77cd11cc927fe364ea2ba9307f65365f7e811f7

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Fri, 21 Feb 2020 07:03:50 GMT
content-encoding
gzip
last-modified
Fri, 31 Jan 2020 21:01:31 GMT
x-msedge-ref
Ref A: 18B94D75E3F44D58A2A15A38DE414647 Ref B: FRAEDGE0817 Ref C: 2020-02-21T07:03:51Z
access-control-allow-origin
*
etag
"8087c39c79d8d51:0"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
private,max-age=1800
accept-ranges
bytes
content-length
7295
22035892-1a3b-438f-894c-7c43c5815226.js
cdnssl.clicktale.net/www25/ptc/
356 KB
69 KB
Script
General
Full URL
https://cdnssl.clicktale.net/www25/ptc/22035892-1a3b-438f-894c-7c43c5815226.js
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/symantec/aemprod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:6c00:183::2db0 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
/
Resource Hash
90178d10fa4b173bf46c50673c4885c80a27fb1e6f3f363f2ad9bb1bb734e446

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Fri, 21 Feb 2020 07:03:51 GMT
content-encoding
gzip
access-control-allow-origin
*
vary
Accept-Encoding
content-type
text/javascript; charset=utf-8
status
200
cache-control
public, max-age=600
timing-allow-origin
*
content-length
70749
expires
Fri, 21 Feb 2020 07:13:51 GMT
4405
norton.ow5a.net/xur/
46 B
814 B
XHR
General
Full URL
https://norton.ow5a.net/xur/4405
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/symantec/aemprod/Bootstrap.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.50.252.134 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-50-252-134.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
b26f5d3bd43927960b86149951b58cee9eef0d3c454b392d75824888a5ca6f52

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
Origin
https://us.norton.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded;charset=UTF-8

Response headers

pragma
no-cache
date
Fri, 21 Feb 2020 07:03:51 GMT
server
status
200
p3p
policyref="\/w3c/p3p.xml", CP="ALL BUS LEG DSP COR ADM CUR DEV PSA OUR NAV INT"
access-control-allow-origin
https://us.norton.com
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
access-control-allow-credentials
true
content-type
application/json; charset=UTF-8
expires
Fri, 21 Feb 2020 07:03:51 GMT
obtp.js
amplify.outbrain.com/cp/
6 KB
3 KB
Script
General
Full URL
https://amplify.outbrain.com/cp/obtp.js
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/symantec/aemprod/Bootstrap.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.250.44 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-210-250-44.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
8bd397636ecd49c36d687ad591807ea5ee621b1e11888657827902a5003fc4bb

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

Date
Fri, 21 Feb 2020 07:03:51 GMT
Content-Encoding
gzip
Last-Modified
Tue, 07 Jan 2020 07:28:40 GMT
Server
AkamaiNetStorage
ETag
"522e4451790939ca385c10f4b474de63:1578382119.826889"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=1200
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
2617
Expires
Fri, 21 Feb 2020 07:23:51 GMT
/
www.googleadservices.com/pagead/conversion/1043330685/
2 KB
1 KB
Script
General
Full URL
https://www.googleadservices.com/pagead/conversion/1043330685/?random=1582268631724&cv=9&fst=1582268631724&num=1&label=sale&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2od2c0&sendb=1&ig=1&data=event%3Dconversion%3Ballow_custom_scripts%3Dtrue%3Becomm_pagename%3Dwriteup%3Abackdoor.cobalt!gen1%3Becomm_traffic_source%3Dsymcom%3Becomm_current_subchannel%3DOnline%20(1st)&frm=0&url=https%3A%2F%2Fus.norton.com%2Fonline-threats%2Fbackdoor.cobalt!gen1-2018-121403-1729-99-writeup.html&tiba=Backdoor.Cobalt!gen1%20%7C%20Technical%20Details%20%7C%20Removing%20Help%20-%20Removal%20%7C%20Norton&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/symantec/aemprod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.23.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
mil04s23-in-f98.1e100.net
Software
cafe /
Resource Hash
f3e8bbb0d6ab1b3ed67c3f008a596236467c8919df7b59863832f21deee4c8fb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

pragma
no-cache
date
Fri, 21 Feb 2020 07:03:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
text/javascript; charset=UTF-8
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, must-revalidate
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
1235
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
activityi;dc_pre=CJyv8P2J4ucCFZgX4AodAbkJ3Q;src=6612401;type=pagev0;cat=nwpmd0;u1=;u4=symcom;u5=norton.com:us:internetsecurity:online-threats:writeup:backdoor.cobalt!gen1;u7=undefined;ord=1
6612401.fls.doubleclick.net/ Frame CAF4
Redirect Chain
  • https://6612401.fls.doubleclick.net/activityi;src=6612401;type=pagev0;cat=nwpmd0;u1=;u4=symcom;u5=norton.com:us:internetsecurity:online-threats:writeup:backdoor.cobalt!gen1;u7=undefined;ord=1?
  • https://6612401.fls.doubleclick.net/activityi;dc_pre=CJyv8P2J4ucCFZgX4AodAbkJ3Q;src=6612401;type=pagev0;cat=nwpmd0;u1=;u4=symcom;u5=norton.com:us:internetsecurity:online-threats:writeup:backdoor.co...
0
0
Document
General
Full URL
https://6612401.fls.doubleclick.net/activityi;dc_pre=CJyv8P2J4ucCFZgX4AodAbkJ3Q;src=6612401;type=pagev0;cat=nwpmd0;u1=;u4=symcom;u5=norton.com:us:internetsecurity:online-threats:writeup:backdoor.cobalt!gen1;u7=undefined;ord=1?
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/symantec/aemprod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.18.102 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
zrh04s05-in-f102.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=21600
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
6612401.fls.doubleclick.net
:scheme
https
:path
/activityi;dc_pre=CJyv8P2J4ucCFZgX4AodAbkJ3Q;src=6612401;type=pagev0;cat=nwpmd0;u1=;u4=symcom;u5=norton.com:us:internetsecurity:online-threats:writeup:backdoor.cobalt!gen1;u7=undefined;ord=1?
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest
iframe
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
IDE=AHWqTUlxNEm2J5YOvSSpWPcH7cULf6dHMaifbwrxEXFa7ZiyscL8-LmwOE356_uy
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
date
Fri, 21 Feb 2020 07:03:51 GMT
expires
Fri, 21 Feb 2020 07:03:51 GMT
cache-control
private, max-age=0
strict-transport-security
max-age=21600
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
410
x-xss-protection
0
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

Redirect headers

status
302
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
date
Fri, 21 Feb 2020 07:03:51 GMT
pragma
no-cache
expires
Fri, 01 Jan 1990 00:00:00 GMT
cache-control
no-cache, must-revalidate
follow-only-when-prerender-shown
1
strict-transport-security
max-age=21600
location
https://6612401.fls.doubleclick.net/activityi;dc_pre=CJyv8P2J4ucCFZgX4AodAbkJ3Q;src=6612401;type=pagev0;cat=nwpmd0;u1=;u4=symcom;u5=norton.com:us:internetsecurity:online-threats:writeup:backdoor.cobalt!gen1;u7=undefined;ord=1?
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
server
cafe
content-length
0
x-xss-protection
0
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
TC-3086-2.gif
pt.ispot.tv/v2/
43 B
314 B
Image
General
Full URL
https://pt.ispot.tv/v2/TC-3086-2.gif?type=visit&refid=missing&customdata=symcom
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.109 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
0227e0e4dea130eb6f3163aa3ab03720dce83a0e219c282189b03bc5b8a727e3

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Fri, 21 Feb 2020 07:03:51 GMT
content-type
image/gif
status
200
cache-control
no-cache, no-store, must-revalidate
accept-ranges
bytes
content-length
43
expires
0
ppt=5476;g=sitewide;gid=21516;ord=[uniqueid];ip=82.102.19.132;cuidchk=1
trkn.us/pixel/conv/
Redirect Chain
  • https://urldefense.proofpoint.com/v2/url?u=https-3A__trkn.us_pixel_conv_ppt-3D5476-3Bg-3Dsitewide-3Bgid-3D21516-3Bord-3D-5Buniqueid-5D&d=DwIGAg&c=GC0NZZhaEw6GOQSjMHI2g15k_drElRoPmOYiK2k0eZ8&r=Ee60g...
  • https://trkn.us/pixel/conv/ppt=5476;g=sitewide;gid=21516;ord=[uniqueid]
  • https://trkn.us/pixel/conv/ppt=5476;g=sitewide;gid=21516;ord=[uniqueid];ip=82.102.19.132;cuidchk=1
42 B
758 B
Image
General
Full URL
https://trkn.us/pixel/conv/ppt=5476;g=sitewide;gid=21516;ord=[uniqueid];ip=82.102.19.132;cuidchk=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.230.135.71 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-230-135-71.compute-1.amazonaws.com
Software
Apache /
Resource Hash
b2c78c910f5ea29e3a9d223dabc203c055c8708b1fe7d83788b490638126db4d
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 21 Feb 2020 07:03:52 GMT
X-Content-Type-Options
nosniff
Last-Modified
Sun, 9 Nov 1980 12:59:00 GMT
Server
Apache
P3P
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Cache-Control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Connection
keep-alive
Content-Type
image/gif
Content-Length
42
Expires
Sun, 9 Nov 1980 12:58:00 GMT

Redirect headers

Date
Fri, 21 Feb 2020 07:03:52 GMT
X-Content-Type-Options
nosniff
Server
Apache
P3P
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Location
/pixel/conv/ppt=5476;g=sitewide;gid=21516;ord=[uniqueid];ip=82.102.19.132;cuidchk=1
Connection
keep-alive
Content-Type
text/html; charset=UTF-8
Content-Length
0
adsct
analytics.twitter.com/i/
31 B
283 B
Script
General
Full URL
https://analytics.twitter.com/i/adsct?p_id=Twitter&p_user_id=0&txn_id=nuzip&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fus.norton.com%2Fonline-threats%2Fbackdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/symantec/aemprod/Bootstrap.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.42.67 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Fri, 21 Feb 2020 07:03:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status
200, 200 OK
x-twitter-response-tags
BouncerCompliant
content-length
57
x-xss-protection
0
x-response-time
155
pragma
no-cache
last-modified
Fri, 21 Feb 2020 07:03:51 GMT
server
tsa_o
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=631138519
content-type
application/javascript;charset=utf-8
cache-control
no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash
59fb12679ee5cbaf38aff8ccfc6388e5
x-transaction
00acba7c00abc731
expires
Tue, 31 Mar 1981 05:00:00 GMT
init1.js
api.bounceexchange.com/bounce/
29 B
134 B
Script
General
Full URL
https://api.bounceexchange.com/bounce/init1.js?tojQ=function&cts=1582268631740&tzo=-60&website_id=2004&resolution=1600x1200&referrer=&calling_url=https%3A%2F%2Fus.norton.com%2Fonline-threats%2Fbackdoor.cobalt!gen1-2018-121403-1729-99-writeup.html&visit_cookie=%7B%22lp%22%3A%22https%253A%252F%252Fus.norton.com%252Fonline-threats%252Fbackdoor.cobalt%21gen1-2018-121403-1729-99-writeup.html%22%2C%22r%22%3A%22%22%7D&cookie=%7B%7D&vars[candy_rack_visible]=false&vars[checkout_items]=false&vars[checkout_step]=false&vars[discount_amount]=0&vars[chat_box_present]=false&vars[session_modal_present]=false&vars[on_review_order_step]=false&vars[valid_coupon]=false&vars[cc_number_entered]=false&vars[security_code_entered]=false&vars[second_premium_clicked]=false&vars[source_type]=Online%20%281st%29&vars[days_to_expiration]=false&vars[incoming_prod_sub_length]=false&vars[items_in_cart]=0&vars[logged_in]=false&vars[cc_autofilled]=false&vars[cart_tracking_link]=false&vars[cart]=false&vars[ibx_test]=false&vars[deluxe_discount]=0&vars[second_standard_clicked]=false&vars[second_deluxe_clicked]=false&vars[device_type]=Desktop&vars[first_cart_item]=false&vars[first_cart_item_fix]=false&vars[ever_logged_in]=false&vars[largest_discount]=-Infinity&vars[product_recommendation]=0&vars[affiliate_type]=false&vars[affiliate_type_general]=false&vars[cobranding_partner]=false&vars[rail_add_on_present]=false&vars[ctu_in_cart]=true&vars[affilate_pararms]=false&vars[page_type]=product&vars[affiliate_event]=false&vars[affiliate_params_jan]=false&vars[affiliate_params_july]=false&vars[affiliate_params_april]=false&vars[affiliate_params_bluedoor_mar2019]=false&vars[basic_price]=&vars[standard_price]=&vars[deluxe_price]=&vars[premium_price]=&vars[basic_url]=https%3A//us.norton.comundefined&vars[standard_url]=https%3A//us.norton.comundefined&vars[deluxe_url]=https%3A//us.norton.comundefined&vars[premium_url]=https%3A//us.norton.comundefined&vars[bx_testing]=false&vars[ibx_page_type]=false&vars[ibx_page_layout]=&vars[ibx_product_id]=false&vars[ibx_product_copy]=false&vars[ibx_product_category]=security&vars[ibx_product_url]=https%3A//us.norton.com/online-threats/backdoor.cobalt%21gen1-2018-121403-1729-99-writeup.html&vars[ibx_in_stock]=1&vars[existing_customer]=false&vars[support_widget_present]=false&vars[user_identified]=false&vars[affiliate_tracking]=false&vars[add_link]=false&vars[atc_link]=false&vars[cart_plurality_quantity]=&vars[cart_plurality_qualify]=product&vars[console_source]=symcom&vars[logged_in_identified]=false&vars[valid_domain]=true&vars[ibx_checkout_logged_in]=false&vars[affiliate_params_cobranding]=false&vars[affiliate_params_cobranding_update]=false&vars[cart_plurality]=item&vars[fire_affiliate_once]=false&vars[cart_set]=false&vars[cart_qty]=0&vars[cart_value]=0&vars[prod_price]=false&vars[prod_name]=false&vars[chatmodal_active]=false&vdef[discount_amount]=0&vdef[days_to_expiration]=false&vdef[incoming_prod_sub_length]=false&vdef[items_in_cart]=0&vdef[cart_tracking_link]=false&vdef[ibx_test]=false&vdef[deluxe_discount]=0&vdef[product_recommendation]=0&vdef[affiliate_type]=false&vdef[cobranding_partner]=false&vdef[affilate_pararms]=false&vdef[affiliate_event]=false&vdef[affiliate_params_jan]=false&vdef[affiliate_params_july]=false&vdef[affiliate_params_april]=false&vdef[affiliate_params_bluedoor_mar2019]=false&vdef[bx_testing]=false&vdef[affiliate_tracking]=false&vdef[atc_link]=false&vdef[logged_in_identified]=false&vdef[affiliate_params_cobranding]=false&vdef[affiliate_params_cobranding_update]=false&vdef[fire_affiliate_once]=false&vdef[cart_value]=0&cookie_too_large=false&bp=0&etp=[%22cart_or_checkout%22,%22category%22,%22home%22,%22product%22,%22search%22]&pts=&compliance_flag=gdpr_no_consent
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/symantec/aemprod/Bootstrap.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.227.229.34 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
34.229.227.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
d035405664700e6d4643eab43b006e2da9044726bd7295f77e5dcf5d273beac2

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Fri, 21 Feb 2020 07:03:51 GMT
content-encoding
gzip
server
nginx
p3p
CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
status
200
content-type
text/html; charset=UTF-8
alt-svc
clear
via
1.1 google
embed.js
nebula-cdn.kampyle.com/wu/458056/onsite/
2 KB
1 KB
Script
General
Full URL
https://nebula-cdn.kampyle.com/wu/458056/onsite/embed.js
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/symantec/aemprod/Bootstrap.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.13.175 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
9f64ee673b2e33d78f5191a03dd873fc05ce3f0b17cb28643f41881e4aa45a36

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Fri, 21 Feb 2020 07:03:51 GMT
content-encoding
gzip
age
32275
via
1.1 varnish, 1.1 varnish
x-cache
HIT, HIT
status
200
content-length
662
x-amz-id-2
oSAjZPECGWZwbaq5n0ikinBXrTGg11mPHmrm/q+7pCyPoXVtEJOwixTfoaGVQyWHy0PfotZSS0M=
x-served-by
cache-iad2139-IAD, cache-fra19146-FRA
last-modified
Thu, 20 Feb 2020 22:05:57 GMT
server
AmazonS3
x-timer
S1582268632.851224,VS0,VE0
etag
"d4133f6b59bd1622b72395d53b6a79be"
vary
Accept-Encoding
x-amz-request-id
34355F9A8B43CFD0
access-control-allow-origin
*
cache-control
max-age=0,must-revalidate
accept-ranges
bytes
content-type
application/javascript
x-cache-hits
1, 124
js
pixel.mathtag.com/event/
Redirect Chain
  • https://pixel.mathtag.com/event/js?mt_pp=1&event_type=catchall&industry=retail&mt_id=1080302&mt_adid=174308&page_name=norton.com:us:internetsecurity:online-threats:writeup:backdoor.cobalt!gen1&s1=o...
  • https://pixel.mathtag.com/event/js?mt_pp=1&event_type=catchall&industry=retail&mt_id=1080302&mt_adid=174308&page_name=norton.com:us:internetsecurity:online-threats:writeup:backdoor.cobalt!gen1&s1=o...
3 KB
3 KB
Script
General
Full URL
https://pixel.mathtag.com/event/js?mt_pp=1&event_type=catchall&industry=retail&mt_id=1080302&mt_adid=174308&page_name=norton.com:us:internetsecurity:online-threats:writeup:backdoor.cobalt!gen1&s1=online%20(1st)&mm_bnc&mm_bct&UUID=9a6a5e4f-80d7-4700-b715-2cdaa967daba
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.21.37.45 , France, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-21-37-45.deploy.static.akamaitechnologies.com
Software
MT3 2129 8dd2d16 master zrh-pixel-x19 /
Resource Hash
b05ee17bb9cdbd78d207c4b1708627eed86d3b37585f7ffff0dfe0887f2feab4

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Fri, 21 Feb 2020 07:03:51 GMT
Server
MT3 2129 8dd2d16 master zrh-pixel-x19
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
text/javascript
Content-Length
2727
Expires
Fri, 21 Feb 2020 07:03:50 GMT

Redirect headers

Date
Fri, 21 Feb 2020 07:03:51 GMT
Server
MT3 2129 8dd2d16 master zrh-pixel-x3
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Location
https://pixel.mathtag.com/event/js?mt_pp=1&event_type=catchall&industry=retail&mt_id=1080302&mt_adid=174308&page_name=norton.com:us:internetsecurity:online-threats:writeup:backdoor.cobalt!gen1&s1=online%20(1st)&mm_bnc&mm_bct&UUID=9a6a5e4f-80d7-4700-b715-2cdaa967daba
Cache-Control
no-cache
Connection
keep-alive
Content-Type
text/javascript
Content-Length
0
Expires
Fri, 21 Feb 2020 07:03:50 GMT
0
bat.bing.com/action/
0
117 B
Image
General
Full URL
https://bat.bing.com/action/0?ti=5441611&Ver=2&mid=8def218b-cb6c-9d0f-657a-d9f2005f3c38&pi=0&lg=en-US&sw=1600&sh=1200&sc=24&tl=Backdoor.Cobalt!gen1%20%7C%20Technical%20Details%20%7C%20Removing%20Help%20-%20Removal%20%7C%20Norton&kw=Backdoor.Cobalt!gen1,%20Backdoor.Cobalt!gen1%20Removal,%20Backdoor.Cobalt!gen1%20Removing%20Help,%20Backdoor.Cobalt!gen1%20Remover,%20Remove%20Backdoor.Cobalt!gen1&p=https%3A%2F%2Fus.norton.com%2Fonline-threats%2Fbackdoor.cobalt!gen1-2018-121403-1729-99-writeup.html&r=&lt=1973&evt=pageLoad&msclkid=N&rn=892131
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

status
204
pragma
no-cache
date
Fri, 21 Feb 2020 07:03:51 GMT
cache-control
no-cache, must-revalidate
x-msedge-ref
Ref A: 73B0EB53FD9D45BEAD74AB36955B4DF5 Ref B: FRAEDGE0817 Ref C: 2020-02-21T07:03:51Z
access-control-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-conversion/1043330685/
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1043330685/?random=528950114&cv=9&fst=*&num=1&label=sale&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=16...
  • https://www.google.com/pagead/1p-conversion/1043330685/?random=528950114&cv=9&fst=*&num=1&label=sale&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_...
  • https://www.google.de/pagead/1p-conversion/1043330685/?random=528950114&cv=9&fst=*&num=1&label=sale&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_t...
42 B
110 B
Image
General
Full URL
https://www.google.de/pagead/1p-conversion/1043330685/?random=528950114&cv=9&fst=*&num=1&label=sale&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2od2c0&sendb=1&ig=1&data=event%3Dconversion%3Ballow_custom_scripts%3Dtrue%3Becomm_pagename%3Dwriteup%3Abackdoor.cobalt!gen1%3Becomm_traffic_source%3Dsymcom%3Becomm_current_subchannel%3DOnline%20(1st)&frm=0&url=https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html&tiba=Backdoor.Cobalt!gen1%20%7C%20Technical%20Details%20%7C%20Removing%20Help%20-%20Removal%20%7C%20Norton&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&gtd=&is_vtc=1&ocp_id=14BPXriwLbSElQeVr4SYDQ&random=2474868009&resp=GooglemKTybQhCsO&ipr=y
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:821::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 21 Feb 2020 07:03:51 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 21 Feb 2020 07:03:51 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
location
https://www.google.de/pagead/1p-conversion/1043330685/?random=528950114&cv=9&fst=*&num=1&label=sale&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2od2c0&sendb=1&ig=1&data=event%3Dconversion%3Ballow_custom_scripts%3Dtrue%3Becomm_pagename%3Dwriteup%3Abackdoor.cobalt!gen1%3Becomm_traffic_source%3Dsymcom%3Becomm_current_subchannel%3DOnline%20(1st)&frm=0&url=https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html&tiba=Backdoor.Cobalt!gen1%20%7C%20Technical%20Details%20%7C%20Removing%20Help%20-%20Removal%20%7C%20Norton&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&gtd=&is_vtc=1&ocp_id=14BPXriwLbSElQeVr4SYDQ&random=2474868009&resp=GooglemKTybQhCsO&ipr=y
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
302
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
monitor-latest.js
cdnssl.clicktale.net/www/
61 KB
19 KB
Script
General
Full URL
https://cdnssl.clicktale.net/www/monitor-latest.js
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/symantec/aemprod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:6c00:183::2db0 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
Microsoft-IIS/8.5 /
Resource Hash
9d8a2811fe6cec544f8e4ba7915c7ee8d4caa72257d97bf4f8964dae6c621ff6

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
Origin
https://us.norton.com
Sec-Fetch-Dest
script
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 21 Feb 2020 07:03:51 GMT
content-encoding
gzip
last-modified
Sun, 21 Jul 2019 07:11:33 GMT
server
Microsoft-IIS/8.5
access-control-allow-origin
*
etag
"8040b486933fd51:0"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=86400
accept-ranges
bytes
timing-allow-origin
*
content-length
19662
expires
Sat, 22 Feb 2020 07:03:51 GMT
22035892-1a3b-438f-894c-7c43c5815226.js
cdnssl.clicktale.net/www25/pcc/
170 KB
43 KB
Script
General
Full URL
https://cdnssl.clicktale.net/www25/pcc/22035892-1a3b-438f-894c-7c43c5815226.js?DeploymentConfigName=Release_20190101&Version=1
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/symantec/aemprod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:6c00:183::2db0 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
/
Resource Hash
86f3a471058986198cf3971445aa6b7997f81ccd9aa0df3ddd35f87373c4fe4b

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
Origin
https://us.norton.com
Sec-Fetch-Dest
script
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 21 Feb 2020 07:03:51 GMT
content-encoding
gzip
access-control-allow-origin
*
vary
Accept-Encoding
content-type
text/javascript; charset=utf-8
status
200
cache-control
public, max-age=86400
timing-allow-origin
*
content-length
43477
expires
Sat, 22 Feb 2020 07:03:51 GMT
WR-latest.js
cdnssl.clicktale.net/www/
56 KB
19 KB
Script
General
Full URL
https://cdnssl.clicktale.net/www/WR-latest.js
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/symantec/aemprod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:6c00:183::2db0 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
Microsoft-IIS/8.5 /
Resource Hash
8b025aa2e2b21b2ac6990d09e0ce2ff7fa15d7ac2c80b65fd1a9bf5e13f0fc8b

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
Origin
https://us.norton.com
Sec-Fetch-Dest
script
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 21 Feb 2020 07:03:51 GMT
content-encoding
gzip
last-modified
Thu, 20 Feb 2020 13:23:06 GMT
server
Microsoft-IIS/8.5
access-control-allow-origin
*
etag
"099c4e2f0e7d51:0"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=86400
accept-ranges
bytes
timing-allow-origin
*
content-length
18980
expires
Sat, 22 Feb 2020 07:03:51 GMT
/
cx.atdmt.com/
Redirect Chain
  • https://www.facebook.com/tr/?id=2010787619164716&ev=ViewContent&dl=https%3A%2F%2Fus.norton.com%2Fonline-threats%2Fbackdoor.cobalt!gen1-2018-121403-1729-99-writeup.html&rl=&if=false&ts=1582268631818...
  • https://cx.atdmt.com/?c=3331614991868087643&f=AYw2-_ceZ09h_dey2lo3XMqrEQf7MUHXUIscL39EJJd031V2VddAHhKPEQjG9-f2MOaWj3g5V66SuWPUaZkP7cZE&id=2010787619164716&l=3&v=0
42 B
431 B
Image
General
Full URL
https://cx.atdmt.com/?c=3331614991868087643&f=AYw2-_ceZ09h_dey2lo3XMqrEQf7MUHXUIscL39EJJd031V2VddAHhKPEQjG9-f2MOaWj3g5V66SuWPUaZkP7cZE&id=2010787619164716&l=3&v=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8004:face:b00c:0:8c , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
200
date
Fri, 21 Feb 2020 07:03:51 GMT, Fri, 21 Feb 2020 07:03:51 GMT, Fri, 21 Feb 2020 07:03:51 GMT
p3p
CP="NOI DSP COR CUR ADM DEV TAIo PSAo PSDo OUR BUS UNI PUR COM NAV INT DEM STA PRE OTC"
alt-svc
h3-24=":443"; ma=3600
content-length
42
content-type
image/gif

Redirect headers

pragma
no-cache
date
Fri, 21 Feb 2020 07:03:51 GMT, Fri, 21 Feb 2020 07:03:51 GMT
server
proxygen-bolt
location
https://cx.atdmt.com/?c=3331614991868087643&f=AYw2-_ceZ09h_dey2lo3XMqrEQf7MUHXUIscL39EJJd031V2VddAHhKPEQjG9-f2MOaWj3g5V66SuWPUaZkP7cZE&id=2010787619164716&l=3&v=0
content-type
text/plain
status
302
cache-control
no-cache, no-store, must-revalidate
alt-svc
h3-24=":443"; ma=3600
content-length
0
expires
0
monitor
conductor.clicktale.net/
1 B
251 B
Other
General
Full URL
https://conductor.clicktale.net/monitor?t=preinit&p=112&2=5298823325765428&v=1.5.5&7=https%3A%2F%2Fus.norton.com%2Fonline-threats%2Fbackdoor.cobalt!gen1-2018-121403-1729-99-writeup.html&3=7349776136419505&4=8066527144244028&5=0
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/symantec/aemprod/Bootstrap.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.0.147.218 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-0-147-218.compute-1.amazonaws.com
Software
/
Resource Hash
36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
Origin
https://us.norton.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Access-Control-Allow-Origin
https://us.norton.com
Date
Fri, 21 Feb 2020 07:03:52 GMT
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
*
Content-Length
1
Content-Type
text/plain
monitor
conductor.clicktale.net/
1 B
260 B
XHR
General
Full URL
https://conductor.clicktale.net/monitor?t=auth&p=112&2=5298823325765428&v=1.5.5
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/symantec/aemprod/Bootstrap.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.0.147.218 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-0-147-218.compute-1.amazonaws.com
Software
/
Resource Hash
36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
Origin
https://us.norton.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

Date
Fri, 21 Feb 2020 07:03:52 GMT
Vary
*
Content-Type
text/plain
Access-Control-Allow-Origin
https://us.norton.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
*
Content-Length
1
ChangeMonitor-latest.js
cdnssl.clicktale.net/www/
47 KB
16 KB
Script
General
Full URL
https://cdnssl.clicktale.net/www/ChangeMonitor-latest.js
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/symantec/aemprod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:6c00:183::2db0 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
Microsoft-IIS/8.5 /
Resource Hash
1958bb7f293956e7170f639ce93a3d628ae465fa24fd751e1a2b3cd837059ffa

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
Origin
https://us.norton.com
Sec-Fetch-Dest
script
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 21 Feb 2020 07:03:51 GMT
content-encoding
gzip
last-modified
Sun, 11 Aug 2019 10:08:15 GMT
server
Microsoft-IIS/8.5
access-control-allow-origin
*
etag
"b334b5b02c50d51:0"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=86400
accept-ranges
bytes
timing-allow-origin
*
content-length
16091
expires
Sat, 22 Feb 2020 07:03:51 GMT
generic1582236355325.js
nebula-cdn.kampyle.com/wu/458056/onsite/
261 KB
57 KB
Script
General
Full URL
https://nebula-cdn.kampyle.com/wu/458056/onsite/generic1582236355325.js
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/symantec/aemprod/Bootstrap.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.13.175 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
8789124679e420a7b1a2edcfb7ce0b22b834d8b2d4a80ff045e772af3bdb01c4

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Fri, 21 Feb 2020 07:03:51 GMT
content-encoding
gzip
age
0
via
1.1 varnish, 1.1 varnish
x-cache
HIT, HIT
status
200
content-length
58172
x-amz-request-id
AC49C28B918E4EAD
x-amz-id-2
IbCxE4hSYhtvt4QKN3y7O8rsiVOemQnZxRggyAHqW9OS/tVXLH2l+cJZ/EdGCrcuy07P7rh/JTg=
x-served-by
cache-iad2135-IAD, cache-fra19146-FRA
last-modified
Thu, 20 Feb 2020 22:05:56 GMT
server
AmazonS3
x-timer
S1582268632.891234,VS0,VE0
etag
"c69c078d036ff1b2c90bb31b3c27fa2f"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
x-cache-hits
1, 48
/
684dd30b.akstat.io/
0
200 B
Other
General
Full URL
https://684dd30b.akstat.io/
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/symantec/aemprod/Bootstrap.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.0.36.169 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-0-36-169.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
Origin
https://us.norton.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

pragma
no-cache
date
Fri, 21 Feb 2020 07:03:51 GMT
access-control-allow-origin
https://us.norton.com
content-type
image/gif
status
204
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
true
timing-allow-origin
*
x-xss-protection
0
expires
Fri, 21 Feb 2020 07:03:51 GMT
js
pixel.mathtag.com/event/
597 B
1 KB
Script
General
Full URL
https://pixel.mathtag.com/event/js?mt_pp=2&mt_adid=174308&s1=online%252520(1st)&event_type=catchall&page_name=norton.com%253Aus%253Ainternetsecurity%253Aonline-threats%253Awriteup%253Abackdoor.cobalt!gen1&UUID=9a6a5e4f-80d7-4700-b715-2cdaa967daba&industry=retail&mt_lim=20&mt_id=1080302&language=en-US&document_title=Backdoor.Cobalt!gen1%20%7C%20Technical%20Details%20%7C%20Removing%20Help%20-%20Removal%20%7C%20Norton&location=https%3A%2F%2Fus.norton.com%2Fonline-threats%2Fbackdoor.cobalt!gen1-2018-121403-1729-99-writeup.html&document_path=%2Fonline-threats%2Fbackdoor.cobalt!gen1-2018-121403-1729-99-writeup.html&mt_cb=1582268631912
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/symantec/aemprod/Bootstrap.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.21.37.45 , France, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-21-37-45.deploy.static.akamaitechnologies.com
Software
MT3 2129 8dd2d16 master zrh-pixel-x7 /
Resource Hash
acfa1f03ac087fc08ca7389b23f01c47b31c6d00d412a21d9342af3c070fff57

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

Date
Fri, 21 Feb 2020 07:03:51 GMT
Server
MT3 2129 8dd2d16 master zrh-pixel-x7
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
text/javascript
Content-Length
597
Expires
Fri, 21 Feb 2020 07:03:50 GMT
cool-2.1.15.min.js
nebula-cdn.kampyle.com/resources/onsite/js/
14 KB
5 KB
Script
General
Full URL
https://nebula-cdn.kampyle.com/resources/onsite/js/cool-2.1.15.min.js
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/symantec/aemprod/Bootstrap.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.13.175 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
3e72de5de67d6d80b65a114af684eaf880c53c250155a663cb17d677ff064bc1

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Fri, 21 Feb 2020 07:03:51 GMT
content-encoding
gzip
age
0
via
1.1 varnish, 1.1 varnish
x-cache
MISS, HIT
status
200
content-length
5197
x-amz-request-id
71FC2A84E93E1AEE
x-amz-id-2
LJscIvBGyKvqouXESr5OVrgH+zsVBZvvCr8me/VmV7I5pjQB0vVG7y618Mbcd39LkYnNbXmhyNE=
x-served-by
cache-iad2146-IAD, cache-fra19146-FRA
last-modified
Sun, 09 Feb 2020 13:45:39 GMT
server
AmazonS3
x-timer
S1582268632.953451,VS0,VE0
etag
"80dd5e3be5152c5c72d552c6a26ef6ff"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
x-cache-hits
0, 56347
img
pixel.mathtag.com/misc/
43 B
625 B
Image
General
Full URL
https://pixel.mathtag.com/misc/img?mm_bnc&bcdv=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.21.37.45 , France, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-21-37-45.deploy.static.akamaitechnologies.com
Software
MT3 2129 8dd2d16 master zrh-pixel-x3 /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

Date
Fri, 21 Feb 2020 07:03:51 GMT
Server
MT3 2129 8dd2d16 master zrh-pixel-x3
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Fri, 21 Feb 2020 07:03:50 GMT
__cool.gif
udc-neb.kampyle.com/egw/5/qceuv8449dzg58ptt1bhda9g8ue19c7s/track/
0
321 B
Image
General
Full URL
https://udc-neb.kampyle.com/egw/5/qceuv8449dzg58ptt1bhda9g8ue19c7s/track/__cool.gif?data=eyJldmVudHMiOiBbCiAgICB7InNlc3Npb25fc2NyZWVuX3NpemUiOiAiMTYwMHgxMjAwIiwic2Vzc2lvbl9kdWEiOiAiTW96aWxsYS81LjAgKE1hY2ludG9zaDsgSW50ZWwgTWFjIE9TIFggMTBfMTRfNSkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzc0LjAuMzcyOS4xNjkgU2FmYXJpLzUzNy4zNiIsInNlc3Npb25fcGxhdGZvcm0iOiAiTGludXggeDg2XzY0IiwidHJhY2tlcl90eXBlIjogImphdmFzY3JpcHQiLCJ0cmFja2VyX3ZlcnNpb24iOiAiMi4xLjE1IiwiZXZlbnRfbmFtZSI6ICJuZWJ1bGFfcGFnZV92aWV3IiwiZXZlbnRfdGltZXN0YW1wX2Vwb2NoIjogIjE1ODIyNjg2MzE5NzAiLCJldmVudF90aW1lem9uZV9vZmZzZXQiOiAxLCJ1c2VyX2lkIjogIjE3MDY2OGY0YmEwYjU0LTBmNDE0ZDBhZmIxMTJlLTM3NjQ3ZTAzLTFkNGMwMC0xNzA2NjhmNGJhMWMwMiIsImVudmlyb21lbnQiOiAicHJvZFVzT3JlZ29uIiwiYWNjb3VudElkIjogNDU4MDU0LCJ1cmwiOiAiaHR0cHM6Ly91cy5ub3J0b24uY29tL29ubGluZS10aHJlYXRzL2JhY2tkb29yLmNvYmFsdCFnZW4xLTIwMTgtMTIxNDAzLTE3MjktOTktd3JpdGV1cC5odG1sIiwid2Vic2l0ZUlkIjogNDU4MDU2LCJmZWVkYmFja191dWlkIjogbnVsbCwiZm9ybUlkIjogbnVsbCwiZm9ybVRyaWdnZXJUeXBlIjogbnVsbCwia2FtcHlsZV9kYXRhIjogeyJMQVNUX0lOVklUQVRJT05fVklFVyI6ICIiLCJERUNMSU5FRF9EQVRFIjogIiIsImthbXB5bGVJbnZpdGVQcmVzZW50ZWQiOiAiIiwia2FtcHlsZV91c2VyaWQiOiAiYTdlMC1jOWQ4LTJlYmEtNDk1Yi0zN2M2LWVlMmItOGQxYy0yZWQwIiwia2FtcHlsZVVzZXJTZXNzaW9uIjogIjE1ODIyNjg2MzE5NDIiLCJrYW1weWxlVXNlclBlcmNlbnRpbGUiOiAiIiwiU1VCTUlUVEVEX0RBVEUiOiAiIn0sImNvb2tpZV9zaXplIjogMzI2NSwia2FtcHlsZV92ZXJzaW9uIjogIjIuMzIuMCIsImhpc3RvcnlfbGVuZ3RoIjogMiwiZXZlbnRfbG9jYWxfdGltZXN0YW1wIjogMTU4MjI2ODYzMTk0NSwicG9zaXRpb24iOiBudWxsLCJpc1VzZXJJZGVudGlmaWVkIjogZmFsc2V9Cl19
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.241.45.82 , Ascension Island, ASN15169 (GOOGLE, US),
Reverse DNS
82.45.241.35.bc.googleusercontent.com
Software
Jetty(9.2.11.v20150529) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

x-me
prod-instance-gatewayservice-green-422l
date
Fri, 21 Feb 2020 07:03:52 GMT
via
1.1 google
alt-svc
clear
server
Jetty(9.2.11.v20150529)
access-control-allow-origin
*
access-control-max-age
1800
access-control-allow-methods
GET, POST, PUT, DELETE
content-type
image/gif; charset=UTF-8
status
200
access-control-allow-credentials
true
access-control-allow-headers
X-Requested-With, Origin, Content-Type, Accept
content-length
0
x-application-context
application:9090
monitor
conductor.clicktale.net/
1 B
260 B
XHR
General
Full URL
https://conductor.clicktale.net/monitor?t=auth&p=112&2=5298823325765428&v=1.5.5
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/symantec/aemprod/Bootstrap.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.0.147.218 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-0-147-218.compute-1.amazonaws.com
Software
/
Resource Hash
36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
Origin
https://us.norton.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

Date
Fri, 21 Feb 2020 07:03:52 GMT
Vary
*
Content-Type
text/plain
Access-Control-Allow-Origin
https://us.norton.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
*
Content-Length
1
pixel
tr.outbrain.com/
43 B
333 B
Image
General
Full URL
https://tr.outbrain.com/pixel?marketerId=001f961bd9b051a2818b4058353fda92bf&obApiVersion=1.1&obtpVersion=1.1.8&name=PAGE_VIEW&dl=https%3A%2F%2Fus.norton.com%2Fonline-threats%2Fbackdoor.cobalt!gen1-2018-121403-1729-99-writeup.html&optOut=false&bust=08871848852628481
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
70.42.32.31 , United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS
ny.outbrain.com
Software
/
Resource Hash
33ca751ed175a163bef530ebdcdbd0a2d15997ccbcbf8d50a6f504e8ffac5a5c
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains;

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

Date
Fri, 21 Feb 2020 07:03:52 GMT
content-encoding
gzip
Strict-Transport-Security
max-age=0; includeSubDomains;
Content-Type
image/gif;
Cache-Control
no-cache
Connection
close
X-TraceId
e04340236b87db1cac6c246af8b0612b
Content-Length
60
pixel
amplifypixel.outbrain.com/
43 B
312 B
Image
General
Full URL
https://amplifypixel.outbrain.com/pixel?mid=001f961bd9b051a2818b4058353fda92bf&dl=https%3A%2F%2Fus.norton.com%2Fonline-threats%2Fbackdoor.cobalt!gen1-2018-121403-1729-99-writeup.html&bust=04126563662022107
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
70.42.32.31 , United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS
ny.outbrain.com
Software
/
Resource Hash
33ca751ed175a163bef530ebdcdbd0a2d15997ccbcbf8d50a6f504e8ffac5a5c
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains;

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

Date
Fri, 21 Feb 2020 07:03:52 GMT
Cache-Control
no-cache
X-TraceId
5fb9bf06d10b617f16656670eeec4c
content-encoding
gzip
Content-Length
60
Strict-Transport-Security
max-age=0; includeSubDomains;
Content-Type
image/gif;
monitor
conductor.clicktale.net/
1 B
251 B
XHR
General
Full URL
https://conductor.clicktale.net/monitor?t=init&p=112&2=5298823325765428&v=1.5.5
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/symantec/aemprod/Bootstrap.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.0.147.218 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-0-147-218.compute-1.amazonaws.com
Software
/
Resource Hash
36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
Origin
https://us.norton.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

Access-Control-Allow-Origin
https://us.norton.com
Date
Fri, 21 Feb 2020 07:03:52 GMT
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
*
Content-Length
1
Content-Type
text/plain
1.gif
nexus.ensighten.com/privacy/v1/b/
0
106 B
Other
General
Full URL
https://nexus.ensighten.com/privacy/v1/b/1.gif?n=0&c=21&i=5a4r1i&p=aemprod&d=N4IgbgpgTgzglgewHYgFwgIwDoAMuQA0IA5gIYAuEA7qQJ5ogBMWAzK4wGyEgDGANnAhJyASQAmaRhiIAHAK4AjATAAWABQoqGpCAFsZUBBKJwkMcqSQ8I4hgFZSAFigY43GaR4BrCOTQ4iXSMIBiEAMwQoa24eBAQvQRg0YABfIiEwOEMkXSE-dABVAGUAAgA5SPJkbigIAEc5CHMk1ABtUDEm8lMKRBR0FXJyGRhUAHoxpAQqLBhaXVIYGF8YLFjdMdjhPLGxUg2pqCqkMeI+BAVSPjG4BeImyeQAWgMjOR5yMfPiBBhd0igXi+CB+AH0ygAZADyAGlQRgWIwAB6cWZgYjcci0GQhdC3DFEcwA-IYOwADkYnDJHBYOEcAHYAiAhBJUKSKVSaXSAJyOQkIORRXEgXRyCzdZBQhTLKCQKAAYQh3CJ5DkLRA51IxhAtUWyBarQAukQ9hYNENoGY0EaiMp8jaQHBWUwcIwcE9XU8pAAVHD01A4FioOx4Bk4ABaIDSHS6PQl-RAg2Gowmaqwh2OawQGwE0tOUEscEomxgUDCYyqPiQWAAVjBqkQsTiGEiVFBlRYjmh2ZSONTaXYMEyWd3yb3+zhB0z64LougABoACQASqCALIAQTKG4A4gBRZcdihq7R8c5UCDa3X1q1tY0gU2kc2UKC3h12633p0MN1uj2ML0MF9f1A2DPAp0jaMH1jJBemqAYhhGcZJggJE0yEeBiEGIQsw2OYFm2HgxhgWJOmI0FSIgUEM2QUFdFMWskkbbFhRIqA4BkPxCU7Ekx05AcEXSJBWR7fjJwwMl+VnYVRXFPopRlOVFSPVV1U1K8ID1N970fZ9LQNe8PzvExnV-d1PR9P0AyDEMsEHFhIIIGNzDjPoGCTJCJiQVD0LMOAsMoat1mI+ZLEoIidH0QwxE2YIxhYMkWEcHBuUpCAcAwCB6UYUhJ0RScFA4OwQwUHgMFIUgOEYgB+LYxCLPpxBwABeRwyRDHBXUxFiGDYjiuJAIkuzZPi+y5OxuWkZlhNHDkxoHVKpKFBhZLgpAFOgOUNxUk90HUmpNJvAyTQoJ8KBfbTbTgcxPxMn9XXMgDLJAmzwMmxznO6WD43cxCU2IuSeCwLUYCecgqCLF9cLGOQqHIRjuubdA+s4o9htE+acA4SchJE0aJ2xuwlrnEUxTWjbZWgbbuOPNSEC1A6tOOh9Tr019maMh1v3QMz-0A4DrLArBCY+6CXO+tyEOTZCtm8j4sDCTwIAUOIvHTXwxiEUFijGMIFAgSBhFWOtEdYnh2NRmn0fxrlsck6a8bmgmUuJmSyfjCmtp2umGaIa99VulmzXO-TA85r9TIevnnsF2y7dFzpxbW37pYmKh06wH4QT4XxSGIAi8+gaHiAsYgxjraqnWagAReUnjJBEODa+lTd683+rR3indtjA+Qd2bxx7vuZ2W9BVo96VNqp72GH2v3DoD4yg7Oi12bD677Qj+6-wsoCrNAuPe4TmDk6lzyxhVuQrAgVCeBUSx7mh0uxjdOkbgR5ikcG9vLcGniB7EhwCSuMAGYyAdyV2K13byUnpTKA1M-601nvTDSTNA66RDmvJe4c7o8yjrvAWB88BALJMfJOP0z7-R4LoLABtoBdHCiodWnxqG7DENVMQoI5ByCrvSbkdhHCpUYAyRKnBuSTQktyFgHAaRAPpBgfh9I+EsFpIwekjhW54l0ASRB1tu60g4IwIm-cRr6KxkYyBWjiCgmrlCTcQwoBriMHAMIghtQql2iAK455LyMyOug1mmDLoag3oHbmLod5PT3i9IWhi7BkK+qfRMf1kLZlWDRIK2YbjsM4ZkeAuToCtSwI4XAAAyThriIB8DEMQQwcgZDNQ3KU3QsQoDECrhwek8p5EcGrvSQce47CdIAGKMg3IInA1dHDygAKTJQ3GIC4EAoRtOabwqRvI2qpUZNyMkvJGSOEcNIsMCiZEZXEalMa9JSnkBgM1DGBNOCaJAK2dsVsu6DwMZwEBpjPnmPpJYkAS5Vybm3PuQ8NNVKnh8ag-xS8MGr2CTgx0kdIn833q9YWnAEmuXgsk1OYxFjLHhj8IISJBCzAQHwMUfQ-hbB4IINpEBHhHGQJsAQOx6WMvuE8fgghhAfxAE2M2FsBpDQ+YAlgAKTEPNtglQF48YGKWnpCzxc8dQL2CQii6HNQlL3CbzAhGLYlSpxRLPFHl-rECoLocgBZvCmGINDGQYwwBjAwGMCapUUpSLCGSRkDcCpqIgNyBQYQPURCgAsT4+JnmxveaAgmyUfmyoMcmwaApR6Om0TYuxG4HFOPqpU9x4pPHeOmL4+eaD4WBMRbqm6+rUWPXRTEuOyUzVJMtcha1tr7UJCQE64KLq3Ueq9TwH1LA-UBqHHYBQwbQ3ht1pEaNNxtFxrXQm35gDHBTRHFusBO6FXQMlLAr2qqfawsXg6bVodsF6q5k26O0TY7EJ3R2ih+Lz6ywgPLRW1gVbxGYcRfysE+B0uQK4subohz0n9eAjATcenVTAM1Zg3IsCklKVAZqRIlAhE-iKjum7U1Y3JCmm2BiyMZuklAuSJ7lXwJnntFBfir06VrTq9eDaH3b2bTHIhwtyTvslp+-66cZhZzOJpMQik4DWFWEOwuWpYpIDlPAWiixaBWEFcKtuorO6JttvI8jZjOlTRHiTRV9Gp6MfPcg32Grq3Xo47e9896t54LRfxzFZnhMWpSRMeGsQbiEpkx8aqMhQRV29BDVepTItqmgFFsQzUcA3KREgZLzUkByAAF4cVKXQo2zUZl2AAEKlYq5SDw9xMjUBmZSBr8octnlK9XNrNyqCghgFcKi+wBTCFS510EkROhQFBA0MKRZaBDfBlFsIBZcjddLXcnA66dHisMwY9RJm-mdOHpmkm+Jc32LtYWlxbimNeLPBWy9WqXNYLc9xjzES+PPoE-tvzCYu1pwzn+5Wqsn5QDGJXFL0G-RwYUQhhkCHCsoY0PcAAaoIKg5S+DNUtTMlgG4GvDNx2mDJuFcfIAEN5MGbZNK3Nx5cbwizIhZkuHwcgABCe4SAMBegymSJ4GApDJRYDz7K3InjiKeFQdilB6lYEGLoPgWH0elJcc1RWYGIA3LuSRjgvJSkwCoPc7GaXVD3NfqUlDaGMN2CwzhiweHSmkGauQXIfkApCEKzwIbCBUPclKXrBpesMMW9M1IrA7U+GdTiYr8g9yKOkeubET3KvlhYbqLoZq+5vTrYM-ugm-DduANz9RrNx3bGnccc44tV3y0Xju8zG9j3DLudwa9p9hCfP8K+ync+4mFZKwA2rYKdqQdV3B7B+k8HEOw4Ns1BHEBkfUDRxjv6WOceMDx6vgnlRkBE9XyT0wEBye6ip6vmnXg6dQAZ1cFnbOOfQe57z3ugZBeMGF6L8XRYIBS5l3LqACuleJ7V7ctHkHo4Drnrghp1DrioMbhAWblgOhphthrhjnHbg7k7phNhEgG7h7l7j7goH7goAHprsHqHtyOHkYpHkAXtnYHHnEMrlcEnlACnmnnuBngRgwPGrohKmAtyBwHntwbwYXpZseutKeiqoglCsxg5v7PdsHHWlxpvE3oalEq3rEjwR3pQt2nEFJiDJnFgIsooDnHyt4EBjVtJq6ijuQG2AKFhFsGpn0O6nSCogYu1CDgWMJNmJQWJAGqUjwCht7mEOYJ4ZjN4TlqnhgKUgoMQMrmEDETEaUsQDwillCGUFhk0A0juFoTnLoDCN6LQAoAAIoqDygwBQilJyCghQG84QHlFgEG5lGgikCVEm7lGkC1HVEURg4gHlEqDXSob1HkC5bNTYz1E1ikBgD27-71FIAyDUpRFpblE5C3AQBDYlyp6MBGCMDjo64sgKD3KK5RHhGPjNRFbkBY7Vwlx5xZhICQY+5RpDaCjo6Y7Y64747pKb6ZK6DE5ICk776WGH4wDU6eCn5xDn6xCM5X5CA35c48586P4YBC4i7C5v6S4yDS6O5y7dCXDNRlZAln5YDygXCX6s6QkNY4AzJdKkneg-oqBIByZXCknVy5xwBgaknkmzJujLh6AICZADqkmLhVIyCklPCkmclBDjF8CskUlugVCsqYE0nNTd6SY5wgybRyZNC4R25zBWB7Fli2rNQsA+56kaJsHIw-xir-zZ5cjyIsB8ETjyIHY0ZjzCGezQDKR2aSE14BKyGcZ3rPaKH4LKHGq2TWnqGibISKmZEQDOpKYxQYAyBPCJZQBPB2gOFHIqJYwuHVRuGLJhEx7eG+HNT+GBEPLJSdQQGhF7GRHRGxFhDxGJHNTJH1FNHtFtHzENHNltmtH67tE8CdFNm9GMD9GDHDHlGjHjF0Gq5TEzFyBzFTH0S5ArGO6oYbFbHLDCS7GHGnTHGGynEsDnGlxXE3ELap7zE-6L7JjL4vHr5vGynb7DK75k5-GU4AnH64kgkX5M7Ens6c4SQwkP4C7wnP6Ili4S4f6olf43JwBYk4m07vkEnglfkYCSnsk4BUl3y0k8D0luiMkWDMkvlklSk4CincmOp8kClCkilcninIWkkynHCalabu7hFhB6kGnXSghgDkBMVYaWA5nR44CJQ9je61AwDpGRnZG5EFFFElFYa2qgjkDVJDYcTYb0AmnZobYWkkb0i0i2lWksDmaHbCjF55oFrl6XbunXYwqsYyErw+lPYKEoq8Yt5Bl4DaURhRhORiyJIfo-ZjARnZxRlkSmHKZxkJkyjJkbyplOEZl2CuG8UeFaUCU+F+E+7Fn4ylllmlIVnhFVk1lxEJFVyNndHQFtmtn1GNElXlVlXlG9moZdEVEDlDlDFtljkTH0Fq4LHTmzkLHznLFparHLliCbGG47F7FHEnFnEXGDoQb+S3EnllFnlPEr5r7DIb63nrBfE-EH7PmAmwX05glEnX4-l36wkAUImv6gWf7omQXQVvn07wWHUkluhsmUnUkYVYWTJMksnPWEXEU8nEBkV8CCl-iUVikfUvXSnvEMXanMWsWK4wAcVcU6nxW5kCX6VjjCVpFp7iU5F5GFHFGlFRrkDyWKXhHKXNSqVCo9RWJZ5aWIi6W0jaXSoWZGU5ol75pnZmWVriGeJKAIDeDc3SEGggAADqPRlAH47G3prmDe3Got4tVSoSL2ShLaL6WA2ljAoZvl-lUm0Z9wIV8ZiZEV5gUV6ZfYsVWZKNQRdpSVBZRZUeJZZZ5ZcgYRERUReVtZBVSRKRxVVRpV3ZnZHZVVAd9RtVwi-Zdyg55RAxzVIxYxbVk5nVsx9x1EvVi5axK5I165Y1W5E1e5U1h5s1x59xi1S+zxq+rx6Y7xd5D5vxFOFAL5wyJ+eJB1n5R1t+f5-OT+L+SJl14F11mJ9uMFwJ91hJbdT1BFKFaFNJdJEp2FX1+FENRFVFpFbo-JQNFFHJVF4NhFdFyA0N3FLFUebFCNnF3F2ZCVIYglGNqRol2NAVEleN0lhNclClKWaW5NlNumNNxGeZ8qMqf9ECghbsdGIhDGCCHiF61lteD2SKjejlnmb2KhwZCUWtAWhKSwKwWAl818t898A6UZwURKKwxECwRwYMecrq0A6m3kMUcAdYDRZ4dEbwOcCNPADD9EmWOgMi3I9IYQnUdgl4CgvOAijIroO6+sGACG9IvZBBJsalKM5pxIW2AlWuDNAlxmwDtG5MohtmPNUDVacKzm0t9eV0fpCDzeRqraeA1I3IaDBKxDty2DA21geDD8hDWSjjfwOD1gwImFfAy2kQhcoIC2+wEApIWAnDaJsuAAxK-MaVTV-C4otvhpwVtkOJ1AzRk9OIZQwIuN6GuBCCIMMsuBuGuHuKCEUCwRuN6N6MuCIGVgUN6HuJXjdtXtA16bZTLWYw5QagGarQfNgGWfY+fPhGFD+lgEMFgNmHamIEDN5J8LoIwCFAROFGMLoCrEiISqMUiNVBswgEiIuL8FHmtZmOsM0pszPsbhAEcoI3sJNElO1BwE4EovSENSwAoO1DwJhdyGIDrubDfEgPyf5IMJVWxICyLU6JYSHQoIYFQDKJC2INC+AWlrC9MDKMCwFJVWi-C9AN6EsVCDEcSrHbEOcFAIyZxFAeHfs0iEUE0DQ9c7c5eKQA821EMi80ou8583YN8yy38zSwSVfFHoOTS-iwuaJNlIwLSIct7lsIFMTd0ApcsciWBT4YKLUMIN1ooHfJYN5OjlCN8XvqSQABQYDmAACUpSe45K4sxA8oaoVQuQ2GqEG8jqFEDr2Y0Al5kNVrNrX0drHrTrEIG8zU9ESwjqpSkQ-kPQATMA2r+DerDZhr3kJrZr5AlrrwYg7wxNsEC5V8nQritD8WhgriOcaw6reQWrpUCbVSSbPxqbFrxbCApbUZ1rrrA69r5gnrzrfrbrPAgbXr5dOAFQTbLb0z7E7SoGVbOrSAibBr9bboprjbrwY7mb2b1EYTzU+bEAhbl4o7zJUZrwtS+w8lLEW7SAXgUwVAmBK7B7sw7+FEyA8r8lRYOcCpfd+7Zb8AlAj7QrUAM2aon7UZ37VEfAD8cghcxxN7Jbd7IH3WP68Y2W1d5zt7X7D7cbCg8HHwfQzUpgF0KwP6go02QHWA3o8oO4zUluqHUZdqpAMRcm3WhlOG8wKHMHZbhsiy42wqSHspy+YzhETbx7ugp7OI57l70wmBcHsQf7AHMAOuD7YHA6EH9wUH8nP7yw2HyAPHZz2YanVEGHWHiHeHloBH-bEutANyBY9HPAjH0kzHLSunHHkQInyxGSfHoUAnNLag8ojLLAdzLLCIbLzzDInLUr3LvLvzWAnAoIaWNL2nyA6woIZwY9dEmzFzBz4gQ2NLa48oRQ1cIg1cqGUg-Ce42MjAG4ZIZW8ovDdgTwfCG4RURy8Jwy5I8ojgg46XSIOXO4iOBXzUyimyeyaiKUeyYYhyxyjIpy2MCi4inI1yYA5gkzgIzU2YVd61jni3dqXgdyaSa3OnugnXBQy4EI55Iw3rK1pzW+G1O+ybdd-xu1I9oJY9EJ35Hd9+XdgFPdIF7+V1sunXnJYQ0AtQ2GnXiO1DOHNIzyijtNMe-C9se6qaQ4CiR6oDLpejkD9mnpNaJjcD5jfTXm72mKcPkEhoKQQAA
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/symantec/aemprod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
Origin
https://us.norton.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

status
204
date
Fri, 21 Feb 2020 07:03:52 GMT
cache-control
no-cache, no-store
server
nginx
expires
Fri, 21 Feb 2020 07:03:51 GMT
1.gif
nexus.ensighten.com/privacy/v1/b/
0
106 B
Other
General
Full URL
https://nexus.ensighten.com/privacy/v1/b/1.gif?n=1&c=21&i=5a4r1i&p=aemprod&d=N4IgbgpgTgzglgewHYgFwgIwDoAMuQA0IA5gIYAuEA7qQJ5ogBMWAzK4wGyEgDGANnAhJyASQAmaRhiIAHAK4AjATAAWABQoqGpCAFsZUBBKJwkMcqSQ8I4hgFZSAFigY43GaR4BrCOTTSQXSMIBiEAMwQoa24eBAQvQRg0YABfIiEwOEMkXSE-dABVAGUAAgA5SPJkbigIAEc5CHMk1ABtUDEm8lMKRBR0FXJyGRhUAHox0hk4LAUEOSsICAAPHhVLYggsWN0xninyOVqxuRkxCggAfVj4wQB+G4SrpFJcgF45hesAYQE8gDU4PByIwcDhHAAyR6CN4AUgA7AAhWGMRhgFGMWEsACCCORqLEQNiC3Il1e82EGKx2JwKO+GJg8yiV3ItBkECpOIxAHkkAIkBzQQAKDDmACUVPhABEEVLuKz2Qw4LpiNxzKQoPkMHYAByojg6jgsDAYDiMdJICSobV6ziG42mlhERlHaLoZXES5S7kAWWxQygPqMcDCgmMIHVhxaIFIfD4CCoEHDtVIjLMaFaAF0iOcLBohtB021syBlPksyYrUwcKCALQ12tSAAqOHhqBwLFQdmwpsYAC0QGkOl0et1qgMhiNxpNprMKdYVmsNlsdnsDkcICczhdrnEng894JLi93p9Fr9BMJAcDQeCoYeIHCkRj0ajqXiMYSYMThGSgiTORpOkGSZaxLgVQVMS5VFeX5QUcBFcUqUYekCToGBwIQS4VmmKBemQQCwljGBBVQxhTB2UxPQMIxLhgRRLj4IRiHIFRCOI0iMTgShdAw0xrg1chANpFCMX2TVwLw7wqMY0wvHYvgSOA1FxKEt8cSIxTONROAFGWcCugUpTRIJCA+DkZYri-H81KgoCTMYUNYFJVTLm4vQjO0xysnMASJPc3RLlDZZPOUxgIEgKBGIQYhNjENykFChy+A1TZfOsilbOpJA5DjWVZXlNkQndFU1QsTV-F1fV7RNDg7AtK0bWqo1ao4Z1QOKkAPS9X1-XIQNg1DJMyooORo1jeNE2TCBU2QFoKxAXNSHzSgoCLBaywzEs4CrUE6wbZtW3bTtuywU07AHIdFpHF4x36EBBmGUYJimGYzwXVZ1iQTZtgQXZ9hkQ5jlOXMrmhCAD1uZ5Xkfd6IAvAEgW429IXBp98TRQCPwJIlMr-TLhLCl1mXAoqsZgvlTHgxDyAlN8HPOWgMKqbDllw-DEvU7FNOMsiKL+mSaPi+iFEY5jWKSvmeL4pA-KynERLI1z+s8BJvtkpB5K5nmvNUyWuL0gzzH10zzMsy4MoArnFYxJzfNcgKTe85y5bcnigrgELtY4sKIugaLYqTBKnZSqA0tJS3KS5nK8ocoW5B4Ulah2XJLQ5wmHNIMJQwEHcIKdrOc7gPOisuTYBTwvgndiBQ8MtQXBIrgvs7gFLKEuDw8KgXjm6Lnc-ajuydbCwvW+L9vO9eDCACtLF7sed0n3jLmn3LaHn3OJ41KeyQMVuN-Hq4l4wpRGjEOIot0DVQQwABOJ3DcocwqIPvOpLV4gC-IHgNa1oefYcq5GQ5lK7cVoJcBolhuisnJpiN80oCpEAgkqUqzpypaiqnaFqGB4ROhAEIRqmCDTYPhG1CMHUUGem9H6AMQZCRDXDJGMa2g4wJmGkQFMaZ5oliWitQs3CiCbWLJWBge0cD1kYI2DALY2wdi7D2XBl0CDDmfrdPoDBHpTherOOGi4vo-VXADIGm4QY7nBpDJ4x4YYfHnPDP4V4kYgjBKjB86MXxY2fDjb8eNyRWzsjbVExMwL5y5jySmAoUQIVFLTZCZFGbMywjhLI6dvZaTCvzXQgtDDCwYkxb6EtUm8y4tLBKcsM5K0EpJVWMl+R-2pMPQBgkna6X0k-eW3MAFxLMhZKyuM-HUgCc7e2lTHaFK8nbFyIz3bBSdn7KK8ZA7xVMCHVKXQLZ9MHtlXKVc47ZITknCAKcCEpP8SPFum8WRkzGWcvu7cIJlyENAWM1cEC10sISdWndyBN2uZnc5i9t7dxgK-duA92kNLIqPC5Hdt7L1npzf+aS-m3KPrCmea8QWorwsvKYUB96-Mhecw+MLsUn3MkmC+lwr5QBvvfAlGJH43U-vS1EULiUq2kt9L+P9anV0qcAo4sYwEQLkFAsBsDYliX5SAoVrIRVCrCOvUJqJ46J0lDKaUhVFQlVVGgwSlVbTEIdPCHUDUDXNWNbfdqrpOrdWoX1Aa9CwwjSjCwya7CQCcLmltHMFBloUFWutEsQiFo7VETWcRB1pFHTkadHBOolEqO6Go8cD1JzPRnG9Wxejly-X+uuYG2527mPBlY08tiEYOJvM4+8UM3GolfHZbGjBI6kl8ZshWRMOqk3ZLA2CVNIk0zpnAuJ6FMKs3ZndZpVgBafOyXRXJ4s2IsvIiU-ietrZhWVu-Gpck+WamaYy42K7Ohm16d4-pnaHITNdqMxFRTUQ3odtMz2szIoBzisHFdodw7rIvR27EMcdlkVVQco5acp2buRQvO5Vz71eTZSXdkDyK7PJXTXOuHzqKN2gBvAFXce4rsQ6CyAAGIUYmI1ine8LMUkuoxiojRL8M71xfi+DNyYNUeXqfClkQqXXxwHfB+rSmW0Y5R-blv992kgFaAuVkDhDiuVXAkdUqJKydleAyBAhFWwNA5K1ECzP38R2nkEMYZaPH13G8+uXLGMoro8vDD7yZKmMoNJjuMqBAwOU3e-KmqkFFUoSNCq1oiE1QwDqAIBDzVYIdHqa1zJKE9Rof1Oh5mPVMPGqwqaNQZpcJ9YtP1fC1oCNLECcs21doRokVImRx15FnSi4m66qiOYaPTdOV6c4vhLE+rmwxBaTFFrBg+CxR4TywwrfY8g15kY1rRs2xt75PEto2W2-8AHBlBMub25T-aInCmicOsK8Tx1JLwpB9jDkMlZNoiLMW+Tl3XalnoGWZSoMVIkuJ3dmtpOHpE8el7n5unm1beU22PlJn+R4k7J9Uy9Aey9sD1EcyP1B2Wd+1Z6V1uASA2FUDlxk5-VTrmPoEPWVMdg3tlHjBKM9quOXJ5OzafOds9hzUPzadQuY0C2jYLLNopXnPeznHHPor4Eq7nVOuMYVYyz+pnSKMy-F5cHj58+PUtpcJo2ybmXS4cz9uz3Pv5SfQ9KwV3mtOisUz5pt9NVMqQt3J63CqpfvhVXstV9MyJGYx7LUzimGGC9JdZzDL9RfQqs2zrDlw3OQUV0ir7MmvNKft6ujyPvIe1DJCr5A1gPMkXBUrp3EkwCxkaITBBAWQDIJ1SFjBhqIs6kcGasLTfsGGkS26LqKoUsOvSwwl1zD0ATTYdNWaQbfV5gDfwwrIaqvhv2pIw6siTo9hby1zobW7odael1nR2b+vfRXH9NcgMNxblBruKG43oblt65W2bjiUa1qePWzGoTVutvxpe+yZEdsGc+1wlqZjsDMW0x0WYLsTlE8H1yIZ1Mk517tF0ntmk11ZYN1TlGlvsd11ZeVzcD0V0WldcnZT0ek-0bIKchlodSQ-MNIS9qDb0X1kdYCvI0c-clkEVWCwof01lwdo5tkCcvcwMSdjkrsBkONoUQkDcxd7kmdK4XkbNY8vkuduDoM24qM+dI9iUBdtDmM4URcZCo8hdV5JcQ8WM94Fd6Ck9lcHMrN1dKUtdBM6Vacj09cxNcD9c1DIVTd8DWdndNN5Vbd3doIVMt0Aird5UdMQjcRPcjB9lwCODSlA9uhg89Ct5Q8Y8I8jDiVo9Xlw91Z48PMNMrdYE-Nr0sgrh6d88E9rC4DXIi8PNy9yUq8NU5RAttVe9dUIx0FYsjUTRb4yEYt28LUBirVyEbUGBdA5ALA7puQFASIoBIpsRh9ox4xSAJ8CthEisZ8CxSt58KtCsw10AxFatV8Gs41Bit8bp2sJx98Jg-oYAsAkBKhkA80xgFAxgYAYAvjaAr5hBDlVwMAxgAApIoRsM6eEXAL47BRgW+cEHUW+eEw0O4bEAARURDeAwAhEtBUCxIhBkDCHxPIDeCkBRAADEMAKSxFIkdRqQWBqRuxIk7BIlawOAcAIQYBCQxBSSpBb47AABRdkxgbEHUREb4W+eEOwWseEW+bEOqRwY0eEck3Ub4RwbsCETJHk2UlgW+RwRwRExgeEHAW+RExwY0-UlgDgc05wjgdku+JErBeECEUgV4PgPEjgKER8AoJsck2sHUAk0gTYMoaxF4zUN4nYakMaakUwQNXwEiHgI4cVHEZAOCWsViFMcgYFHEKgPFSgU4akBQVWDXKAX6IsvgNSDAcubE4gN4TRbM2I8kiksaZ414pAPNCk1MqmdMlQTM4FRgckos7wEsss2MSs6sxsQTHUWsDAKQRwDsGc+EOE2sJE2sXM9yU4LAQYXQPgTk6ASKN4MMqoJACEMFGAN4MFWUrEKUDgOkMFDgW+F014BQN4AAJQAGkVAZBXyAAvHULwMORgcgAAGW5A4BkGIDkAAA0AB1GQOwBAPgLwbEHgAoJAOANEgATTUAAAlSAfQYKYLiAxAQSWBlgfy1AYK0TdAxBp4cBaAoRGA3gxooQWALyTywA7BDy2zqQYA-ioFDkoQMBHA3gZQWApQwBTQIRJKOBuLwzEocQ+LdAdhpLItRLryPBgyYZpKpB1LxKeApAdL4Q9KpQDKdKdQTKeAWBpKWA2KxLTKcFWKuL7LNKIAQzcgoRHAMA5Ljy81pKvLLKvLPLZLtzdyeBzS3hXL-LjKMJYhOhjw2zPKLL1z8yZB-KLL7LwrHysq3hYzCx4zDkkzWR-Lb5AqAzOLjKdS9SDTb4jSTSzSLTFTrTjS747TnDHTiFnTOKLKuyBQey+yoQ7BSqjyIy-oYyAS1oCrEy8z14UyQD+qZoszqQUqIACycQhyvARya4xyUQqyhBsTOLSrMqhrpK7TmLNYXiqAOKlyfLRrdAoQpSTKKrpL4SLzlgKsZJEzzA-pcNoIcAKgXqQr00PcmyByWyRr2zIyBzeqIAFqKB+zBziyL5RyKzdqJyb5pzZzhKFycFlzVyVrNzQrOSsT2ScBlhZywQoRSTIRp4sSsBPSwA3gygIQvA3hMKIQFAqASbKaFA8SKaOTlLIhiAdo3gOB4Rvh4RTQpQpSMABS7AxbyTjTsRHB4SpRHB6R5zsRz4FAIBuQw4IR0SBSsStVbVUEej9URi4ttROA28mora7BGBTUJiksdV+9aFBpnU9VXVR8csPUvUp8dj-U9iA6F8RETiaso16tY1sAHaOBrid91E7itExhHjWz5L3jPjvjfj-jKAeAgTQTwTmAcFoSYBYT4SarkSOBUSMT8TcT8TCTiTSSqSBzm7ySaTQQ6ScQGScQmTQQWS6x2TOTuTeS75BThTRTxTJTpTZT5S7BFScEVSdQ1SNStS3gqr9TDTjTTS9TGqrSbTWr7SkTarOqnydyPSvS3gfS-SAzXL3LHwIaOycRoycQ8rJqszCqZrqQYa4alqcy8zVqZBCykbIgUbxz9qIRaz6yQbmyniH6obyTv6MzFqEaNqtrXkdqpB0apyZy5ycalzb4VyCGCaZAtzyAdy9yljoBbqTyzyLzSNyArzxLbyUJ7zHzXTdAXyPyvzfz-zAKQKwKILoK4KEKkKUK0KMLsK8KCKiKSKyKKKqKaK6KGKDLmKYBWL2LpKuKIbeL+KASeAhKRL7KZLVLZLtHFK-iVLJKMqNKgy3LtKwBdLMrDKHHjKnHzLLLrKwBbLLLHKrLnKbGtKPLwrvK4G-p-LvLMqgrwqgbyHwrjKoqwAIrYrggEr5Kkq3hiH0rArsqVbcqJqBR37pqwESqyrNHKrb5dSN7aqt6GrwQmr97BjD6OrDQurdQ3hEHezkHBrhq2zH7sRX6CmEyirZrsQOm+zlr-61rsRUHkbtrUbMHwHDrLKTqwAzqFgvBLrrqmLQn7qeBHqjG7AurXqVgPr1YvqqhcgoAPd-qEBAa6zgboJQbyTwben4GxnkGKSZmQG5mwGkAMBJzIscHsaWBFy8aiHJmSGibzzTQwRybbwqbGAaa6aGamaWa2aOauaYWOTeasT4XBaw4RaxaJapaZa5aFalaVacA1aNacAtbXldb9bDbjaOjTbuj1RQs7b+i7BjRbbwsWpJb6pnae9pjZi+h5jFjljViGB1jNjvVtjeFZ99jtjQ6upqtl86sY118sBuWMB47k1bi017ixgH6EwHBnjfAxhlgjgxh9ScA7ATaGBlheyG8+iaolzotLRXX+WpBu9OooKcLXzLg-QyhsQABxAU18qVn291WVgOhV4OsrFV446sdV846OrAd1vV0cROw15OwGLAIEGQBAcgLAcgMAMYBxsYJsb4WsFgHAQ0CE4WsIO4CCN4TIYECEWoUMHkzJb4qiKEMaC5paN4JSnYB1+vPVDlvlpU1EXljvGdvBHbZLe1d2p1TLWYkfGMX22NsreNwNRNw47Y5N04yOzVxrJc-sQcZRVrfV3fJOjNI4PgToMIIQEiLAGiBAMIIt2M94ytx9u4OQe5p6Wt7ES4SSDZrAMaDuT2MyXcJAMADuQGWtqUOe0hWtxEYgZD4EagUzdD4WsQZDqQbsDgdDyIAj8S2sOwREBYOABoCAHaSjqUCEHkqUKgEQUN7EYgKm0N74f6vsPsdYAUqgDgUN7kNEooaeH0HCkQRgYgbULwC2KAAUvgV8hANQXQbkTCuAd8xgLwHACAPsAMqAN4AUiAdk4gRgEQf4GCnCxwVuZYOwOof4cgMoOwIoGClQPsC2GQHUFgEQdYMAHgd88gNEsQV8nC-4V8gW0WzwPigoKgXQV80gW+GQbENQHW6eHCmC8k14bEb4BQV85YMQW+PsOQJsHCn86eJLmALwKUPgbwYm74YgHAOQEFqUrWuoGQMAKALwcgKgH0f4IoW+f4EQMENQNQLwMoMoNQTLooBYbEEQMAAoMIAodmx8cdrol1y2-opcp24Yzlt1uE315d3qVdjLRhDd7LGNvLSfXd4rRVkOw90NNVyNFfaNNfc9x2rNlNe6es6caYSyPgLAK+ViCwYgd4sFMYaeGAO4XQGTGQfEsFBnN4fYb+dYOMCEUwMQQdqAWgN4WoCwVuTU2gnkjAetjsGsYnskYenBRU+twMzYMte+15v6VAMaVAAZqa4Z1Ad5+G1AYh1AL50sn5gAQmrM5O8phsHWOw2+-DxUBi24O-5aizndGJNTISXfQBFY5nFf3OgBWK9s3ZlZu62IWj3bn2Vae8X3DtTfe4uOwBNV1avaTWzdTT+4mGIDiGICYg2KePB-PkUCYn4DgG8HNfIDGFco2IrcECoAzPmGIBUFiHg+gHgGQDGDJ8VNspwANDsDGDuEwz+jeAdsRLsEE2EqhEZsfLCHMDeAACocS5BdB8SUoda+AR3YwIAObazs4e+wgIG5ARbuRmbagYAEfQ2vemJdB3ymxaAFA0SVBvgYBuQIQ5BLg+b4XV-MXSaV+yR1-KbV-SAt-9-rgeTEWd+VAgRSSd-yAfzRaOTV-Z5y83gdYd+kABVaz7-jxMl3gOSWIm-GAjAjAHgByRIiWgXy2JOALWWxLDsBc+lZAJFFT4KVEQY+KgNcEHZ-Q6IPAeXr-SlD9RK8LAREIchJwwpy4MMa8sQyAbDlZm6DCsmL32pYhCBKcKpC3B-g7Zryo7MagQKIG6BAo01WoL+BFhLgkAAoKuOJQOygFxQEIMIN3DeD38oAbfd3icFgYs9dgvPLMh8WAbC8aB5AOgX8wBaY1cGILXGgQ3xoQtSG5DboEWTeDICqBIDb4NoN0HN1aQ4tSJE2EOQqB0K+wHZFS18CkBW4-ZZwahBwCvk9ACATIHZhwA4UzIgDOsJEhCFBBmikSBEEEIqBpMPBGTKgFQCwCe8YoPvMQBKxD5NA-KqYWgFYHxJhA4ebwayonB-gi1vgC3f4Jx2xDNDEQOAeoc0OxBQgXID4DuCPzyDP8OIEIBADwBkBuRSejgREGoCgp4oqAwFBQEUGU5okIA-wKAI4CKCYUpQaJTkt+EoD4ksBPJCBuQB5IbcPQivadvGnhCq8raJqJ2pry6Ju00sHtddqNCu7j4TecrM3vdwTYHFzARxF7mcTt7psTU8Ib7ga0UE5DveM0fIdkKwAB8lAhyAQKHwKYR9bGUfTINQDj5yAE+SfBAX0HT7ghbKdbHPnnwL5N9i+-JMvqjEr5SCa+9fHKE32xIt8zI7fJiF32f698++kFQfsPyaBj8J+egafrP3n6L9l+q-Pfp-yP6f9SA4onfof25qf8eAp-SEGKMv6MBr+t-Qeg-1IBP8X+q-N-uZA-6v9v+j4X-mQ1JKADgBe5MAfiUgH4kYB9Da8jiJT7k4CBKAtAd9UChy84AgMbMrgKgD4DGBxA1ypNnIEQtKBm1ageWR0HVkGB3AwKCrBYF0QOo7AixpwMDE8C0BUAfgaSEEFfQRB15cQdL0kHSCm+cghQZ1gmAvN06q4NQT8SF6gNHB+goFvOSMH4NCGa5MwUTUsGkBrBmgrAPYKjGOCkhLg0EG4LWCeC0MPgwnopGHFBD4hYQiPJEOiGsk4hoQxIaCGSGRJUhx5CEOkMyFZCIReQgodYCeIqUShZQ7EhUJJLVDTcdQhoU0JaFtCOhnQxODfksQGAmg-Ql-sMNGEi1hKkw6YXAFmHzDFhyw1YesM2HbDE4j4bEvsLeCHDjhLLYLJO0bxq8dQe3T1ttzdbwljuWvGYjrwWJ68oABvc2t7VLAIANi7wuNl8P3Y-DKsYdFNq9w1YfdToNw0EXe1zYZpFRZgGAED2D7eALATEMPmMH3FjAYKr5WsBoXMBYBoesvLAd6L8AoSvWSpU0lcJ25IlcJgQfCXMUImUMoA3wYClG3ImUSOE+WD4TwhokW8NoVvBiSeze5R0tWspBNM7xvau9fuFYkSZkKwBERrAcweIO8X6h58RaN8VsDqFIR3xTQ5pKShFDeCAhqA9ggEsIGY7lino0DMGsoOrFjVoa81JBvDU+Z9jReWDQFljRbGgsTB4LDcpCzIa7l5B8EkMAMK0gQgsyWJc4VFgDKKjWgSfSgL+EmyZgMmYY9agVIcHi8OpXUvIAzj6mgZOSkozkjKMZrMBb4Z0OwJ2xHYWB4RLpN4GQ1faQDBgQgU8jwHxIIBSSVfBQAjzCAKAzoS0+dtnwqZYAdQhzeEtn0YDLTuILU66XVGdI3AGpJEJqQyM7Z1Am+4bJsCcLNrstUJVtNqWpJqhRZxidwu1Kd0eFrsLuLwt1G8NMm3dCs5vJVtZN+FHt-hp7FidgDansSc2ig-cd5M8AQA-JXgAKVACCmn9BMoU8KbfEimS1PSMUuKVQASndTyAyUoDiMDSnPMMpvlN5jlM6Z5SBy9YwqftSbElS8GYLDsZVPME1S2+mPIki-2alK9jQbUqEGIE6nIAeZTPPqRQMGm2CtBg4kaXrLGm-gIIk04QtNPlGzTcWlNeaVgEWnagVp6odaT2K2lmAdp3U-aYdOOlSDTpz-C6T2GnY3S2A902UmCDNAvSSSWs7Poc1rTfTO+Zo7ElAABlvAgZIMtlr0SwktQYZUMouc9M0na8dJErfXkZON7ozTeFk3YrRMt64znuS+JiWmy1YwySZbvDyUn2x6JxvmiI3rh32ElBB0KVQKAC20iq1BTA3EAkliVnIQgmKDtU0nqFsrPTSEc9R2tJTpp2BtWEIYylA0eYwM06IsrKQgzFnjNJZQ0i2TLIxrNj5Z5UxWalWVkQg2KuCFWvCHCl71R6drCECJR1DZ86oRpYSo4ERbzlt5XFHALLwISEDPA1QJSYXO1m2US5yCxdhQnQALCygUoREAKTy5D8g22IENuG0jaG9XhuWOueZOnxB0m5OM+iaqzbkAiHJjWXziwG7nuSjWfc-ZIPJD7DyhJyIsedxEiBTzSAMxFQPPJNBqjl5cJdCYwHXmHMFS28xmjHW1YbcnWUAM4fO0iwsBW8+CTCVrO0W6K7h-rQNsGzDYRsjJKAv2mZOomNyrJwaGyQwpt7tzARncnRewr3zJ1uJ3xPiUPMElbBkRok74PoggBBhx5kQSSRcGkmySkJ6AL0Qr0QUGKwpeCfbq1NwTlztJYrXSZKzIXSsKJO7TGZZOxkOKW51vRiUwrPanRklHi+9tOAFAKBcopAWsNxKwBeBXgMgWgEJNXBUA5ANrXUHaw4Ap0-ZlAMYPIRD520rSLAOwNy2ekySkgsSiMPJISXm0p2WisKeMVSVrLZSGS0VsgF156SSJWWPJSZM9Q2K7udi4pYIkcXHsI69kypUTNlI1LOJ04A0I4DEBiA62F00gF4EjAFsEAYwGBZaDgVJ9NFoxdCRhMIRrL0JmkrBTgrwXfACFZikhZYu3ZUTzlNC+xVctKW2TblzE+3ndPQlPLFBAPMyMD00Bg8Ie9DKHjDzh6Icr+tKjYn+PhB08AyMASXiARRAO0HaUSSQUj1bao8lwGPVykz2oYdlnpT9fsty36b5Muen9cVaM0vkfN5VFA+VVLOGngMCgBQEQFKDeC3xSAHAUgHYAgCOAwg-pHAGIHhC1gbS4iBQAK0bCKjXSgxeEOcCLKY9LQOPPHgTz8G7laVAgf-gLRJ5YlyedbNUSlG+iipNg7FWsMUGY7DDG+406BExF7Fmz+x6qv5rONcHuCJx3gqUL4P8EZrQQ848IcyiXF8AYh4iVcQkMnGbjQQ245ABCHjCo8+g-MhshSRPk7NOyiqiWYjRTXSy9B98uWa2IVnENX558RMqnBkyaA4Q2UtMrlKWrXze1aa-5gOsMFlT2xI6omrSp4DgDzhLMxgHJOwGgqraLMoYvot3U4IdlBEqucRJrn5K0VhSi5Y92xVOLylBM-FSeqJUeT6ljS5pWIHbJtL9AnS0-LsBH4dQfic0dyNSr2BxA+AEJCOcD1MBzKD1Cko9f0R3qoK74BpS9ZXKImHLLuxygpfKyKVPr6FNy23swtOg71LomYFIEAA
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/symantec/aemprod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
Origin
https://us.norton.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

status
204
date
Fri, 21 Feb 2020 07:03:55 GMT
cache-control
no-cache, no-store
server
nginx
expires
Fri, 21 Feb 2020 07:03:54 GMT
monitor
conductor.clicktale.net/
1 B
251 B
XHR
General
Full URL
https://conductor.clicktale.net/monitor?t=chunk&p=112&2=5298823325765428&v=1.5.5
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/symantec/aemprod/Bootstrap.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.0.147.218 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-0-147-218.compute-1.amazonaws.com
Software
/
Resource Hash
36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
Origin
https://us.norton.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

Access-Control-Allow-Origin
https://us.norton.com
Date
Fri, 21 Feb 2020 07:03:55 GMT
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
*
Content-Length
1
Content-Type
text/plain
1.gif
nexus.ensighten.com/privacy/v1/b/
0
106 B
Other
General
Full URL
https://nexus.ensighten.com/privacy/v1/b/1.gif?n=2&c=21&i=5a4r1i&p=aemprod&d=N4IgbgpgTgzglgewHYgFwgIwDoAMuQA0IA5gIYAuEA7qQJ5ogBMWAzK4wGyEgDGANnAhJyASQAmaRhiIAHAK4AjATAAWABQoqGpCAFsZUBBKJwkMcqSQ8I4hgFZSAFigY43GaR4BrCOUlFdIwgGIQAzBChrbh4EBC9BGDRgAF8iITA4QyRdIT90AFUAZQACADkI8mRuKAgARzkIc0TUAG1QMUbyUwpEFHQVcnIZGFQAelGZOAAPCD4sXU0LYiwY3VHdOBgeUbhdYgB+XV0AfQUrADIFHjEwAF4cbnJaGWD0XeJuc1IoPIw7AA5GJx-hwWBgAJwcOxpJASVB-QHA0EQjgcIgwBBySKvEDvY4AEQA8gBZACCgygxKMcFCgmMIC+5DkzRApD4fAQVAg9JqpAxZjQLQAukQxBRSBpBtABa0RSBlHlhSY4UwcIwcABaNUaqQAFRwAHZUDgWKg7NhIXYAFogVLtTrdLpVfqDYZjUZyMQ8DVICAKLBeUj6Wh8CArBBrCDEKijOyjWrWORgf6ORzgsQAL2IAJkgwwChUYvBxH+DQhPANMFG5Cgni8o2OxxiCDmxBp+zFFluEFoACk+GJdAA1T0ACWJcEJcAAQgoAMJwUnEERz6cGkRIUp8HgsUoyBSMOyhHiMUq0K0AdRHAA1dy9dPlJ4u4MTdQBNKjE0fEKbEgBWpJUCIcBUHAJ5DhmJ58GASjgl4YgXgAok+pJwLqF6QqQF5TDAb6FP8GAADIAcQADSiEYCob6MHwnoAOLghmpD4jAxCFBedg4JeVDEOhABif4iIh4K6iIfHEMQr7TqEr4AEqhKUhReMQACK17TlQCh0UO16Xr2hGkNeKlgKUurEiwxHEowK4qIRhR8bJplzjxWl8FAVqFNOo6XqUUAKLQykqYwKi0AeGB8IRkE4MRpJyMSkG0IShSOFMpR-sp+SMHxuhvtevYyJF+QZmejjFXAIgwBuW47nuB5HjwdFTIWdFWmAPC6DgKFoXRtFiNeEkQPixCMNeGZvjgwGgWIo69lRjDkNufDgjgEDqXwIh-ggy76IWuh8WNLD5Two4qXAhFzr2ODtQJpCMEOtC3la26bvujCOF1E4pcRFGTXAVq6XwZzyQoe3kB5IgcCuvZyHp+Z0Xxx7w0gVpDuCjBYUOLC-f9T1A6EYg9WD16lDgb4XhgVDXndmmnggG1bRtFGEviIi0Glw3xYhdilBmqHnf2g4jmIfHLVh4V6OCMOo2AVq6FaGb-adU6klM-MYOBD00V49PLn+iEsMS+LUYSdHjW+uiIVQb5-vk0W6tOuilPiiFcfi04qLLIi-rq-aEWZu5-ipLBWrqpIZn7fFeKUdHEp+c44KlvOnn+KiO3Rs3EhescThVIjDp6uh8KFUiA0gSvPsdvYy3xEG6odfBWowku-WTaUKCwQuIXw2ubcQTv5I4hu22r7WgcrcCkKOslXeOHCEbQ4Lq7QdiKIdOAHo4cjUeC5CEU3ig9TDhQYDgk-9rlsnh4ws3UeQXgHuCtCEY7YDm3xMBiHOfHIxeX2iZ+upiDkFfF7J2Yc-b63-F4cghJdTQLEIdGQBMhzqznHYIwdEMCVRAnAMQd0wI0S4vkbuOt+6D3xJlfmcsrxeDfn+UgEIMAIRIb3M4Q4YDzlArLR+ChiE9y2mwjhzk-q6B4UOWStAsJiGRnlfIq1pzrVYUgdhnCJ5ZXIMdPgMAUZwQvioHWPZezEhUkOUo+Rrw4D4ISIcXg+D5BMbJXs+ojw2L4DXWgEMVzAX5ohWS+RSjEkKPkOwDkRaIQcXxHWwFc66HICoBQ6k7BaSHL2M4VokHaRUu1CCl5OKXnLqhX6t0+IaNHFonR6s7qSIvAUuAb5dRiD4MSOcGA-yEhqY4P258LbkCdl4DAb44A4GKowKyhErxNN0CIGBdEVJTDfLQHA54alARwcU0p5Shw5Lyrqf6PMsLN17ozDAzNWbs1GRmLmTtvEXSgGTCmEBsJ8B0tVPgCj2pbiBvuOij5x6-XyBgIcc5dTEPyEORC4KLGyWnOC35z4Nw4Eqi-A8QwdFMWvDIRRW14oiFPIUUC6zNHaNRowf6vYmIYTkFEwScUMwiDinOGJKgZA7lkm1JAfBQjJJhiwWSdNe4Ti4QDPGWlwR-jJlMfGhM9mk3JkBAVILB6CUYMzN8GZXxeBwIpUCDVGKGVkq9d6U5pyemwjAfmLLAUKzyr2K02l6J8AWDQnWst37gXBHOPgEJHjPBxO8T4FgfhoARECDgIIwTggNCwGEcIQ1IgjQaf46JMTYgYHiIkZIKRUjEDSOkAaKDMm0OyTk3JqgQD5MgZoSoQCdglBQSgUAZTVoVIKOUuCGDqnVFqRgOoMD6iNCaM0Foo02jtDWh0SAejOhAAMIYIxxiem9L6f0gZgyhnDJGaMsZ4yJmTKmdMWYcx5gLEWEsZZwQVirDWOsDYmyxFbO2Wt3Y+wDnztNCcxr5yLmXKudcm5tx3jqseU8yybx3j0HC1Cr4Pxfh-P+QCv1wKQRojBJa8EkJdXQphM1eECIxTIhROavUGJMRYmxDiXELw8X4oJYSolxKSXtjJXU8lFKBXUppbSukLz6UMsZUy5lLLWTnLZeyjldTOWIK5dynlvIXl8v5QKwVi7hUijwaKAFaU8ESslVK6ViCZWyrlfKhViq0FKqUcqlV-01VevVRqzVWrtU6uPXUh8+oDSGiNMaE0cHTRvvNRay15FYu2jIXa+03yIOOqdfmV09r0KqY9Z6tU3ofTgF9PWGBsbCqQMDUG4NIYXRhjxuGCMGrfx0ejK8WMcE41LvJAmfAiYk3uZTamB5yjUqZizNmf4OaXO5rzM6F1X1CxFqfcmoZRFS3BDLOW1qCmqwupU+6VMWEMz1gbI2KrTakwtlbG2dsHZOxdlaN2Hspne19v7NKQcQ7gN1JHaO2d46J1JMnVO0cM5Z0-FZvOQtC4qdLrUyu1da710bs3HBrc-zt07htvuFDyHDxW6PLqk9p7HWJHPBeS8V7t0uhvLeTdd771ckfE+Z8+AXyvgFu+D8n4vzfh-L+P8-4iAAUAkBqV8SPcgelGBcDyAIPysg1B6CCZYN+ngocBC+BEMR2QoejAqGXhsXQhhi9mH8Kk8ooRXDRGhT4TrQRqjuGhXEdU6RZK5FrVN-r1RhKynEt0deWS+je6GOMaY8xljrG2PseIpxOAXG2PcZ4xlI3ey+P8YE4JoTwThPEZEo5-3YnxMSck1JyMMlDiycOBWFH8ldSKeoolFSNZYVqfUxpzTWntJUp0n2NOel9IGUMkZYyJnEimTMuZCyln5NWQS8vLuUbbKcXsilhzNs9bOf1i5VyWbR7uXKx5UxnnE0Wu8x2DXvmQfKjggFQKQV2PBZCnA0LYWl6QIivOpQYLzRkGiwymKdY4rxaPkpFeSVkpn1SkcjSjigykyiyryuypytylaLyvytinVrlsDAxOKthFKs1jKm1h-oqv+LiqquqnAlqvimBCRvqoak+CaghDhBajwFamSravak1k6jYi6ntFsHdB6l6uCD6i8GmnsPmkGvCACKGuGhCAaOCDGsGkIfGhCP8NGgyCmlEOgLoHIBYE6EgISAoDANAJAFAKSPmkyCyByKQDyOWvyFWnKLWpKA2k2nKC2rKMqB2mqJqNqHqIaMaKaOaFgJGuCKOgQPaOYI6L0AwLOm6OMDELCHIDwJUFACsAIN4BYOur6OQOsMgHANEfsOQLcKQCoSoOcDILcBgBgIwOcIwLcHYE3P8ICCwCwIeAaFCI4IwP8OcHcNgHYFgHYNwTiE1FAPwb8FIWGqCECOCEmiAEILGv0eGkMeIfIViIoSANeFPMcGSKUKSHRL4voYWugGyByFyCYRWjYaKOKFYdKOYUQHYdWu2ugJ2s4T2q4QOh4cwBUb4f4V0JOmocEa6POtWDEZiOQAoLWKYBuhMNMLMIcN8D4A2uIPcDgBgKEJCPmGIOCAoKHhgLdARP8AoI4KHrIXYCwPjKQGjAoKEOcAgAoKSJMEONAPAMgAUVgBgCSQoEMJSbAL0LSdgE0ZOjkLcGoKsYhMcEOEJBeOcI0rcCETAAAKQsCkjilZQyl8TMhYBIAVDIAbpynIACC+gahxK8jkASlZQKB1hiCxAxExAGnNYACExAQgGAOoMJ-wGoRRGAWJLADpBoTcGo4I4IGoVAUAaREAcgMgWAAwhcJJuYhIKhtwoQbIWhlwzImROAlRBoGAKYlR5RHAjRjgBEnRvBHw6IgafRiIAxNRNRBoEhghhZkxNR0xGIsxfqewBIJI5INY2auapaeZBaLI2xJaexZhrahxFgxxjapx8omwiobaKo1x3ava-a7hZozAJZzx46ARbxQRLoc67oQYmKNIzwIJcwvx-xpAgJqwwJMwfAhwuC0JsJ8JCgiJyJ5oaJyZmJ2JLAuJ+JhJxJIpYpkp0pspWUCpSpPwKpqwapHKpgEAWpKgOpepfEBp3gRpEQ4YZp5Alp1ptpyZDpUgzprp7pnp3pvplAAZQZ5AIZCgcZ9wjgRRUIoIqInaUgho2ZbwfB7ZAhcaRZjA1ROAZZrFlZYIyatZOZDZmazZ1ItIbZDIqhmxrIxauxZa+xw5lh9aJxfZI55gyllxqoXaLhfabhg65RrALAXEtofhS5rxU6fQM6nx7o4RYgkR0RsRYE0CbIYYSRKRSAaREQGRtwpgaReRBRRRJRZRFRVRNRdgdRdgDRTRLR7R7RDFIA3RvRkhFZgxL5IxYxiVwhyVdg1ZChOICxskSxpIKxaxskGxnZ0lYlvIvZ9hNaRxilQ5yl5x45jhmltx2l9xc5rAAIi5HQy5ZlHx65YRyANlURCF-ADlCRzlvgrl7lUAnlPAKgcgSAXgvlhRxRpR5RwxwVtR9RjRzRtJbRHRRATwPB6A8VzFBZGVKVCZXFExoIAIOA2V-F6AeVBVRV6x7ZBhRaOxFVphlaylClUo9V1VjVDhVxThU5dxs5dgbR-wCZo6QoyQQAA
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/symantec/aemprod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
Origin
https://us.norton.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

status
204
date
Fri, 21 Feb 2020 07:03:58 GMT
cache-control
no-cache, no-store
server
nginx
expires
Fri, 21 Feb 2020 07:03:57 GMT
monitor
conductor.clicktale.net/
1 B
251 B
XHR
General
Full URL
https://conductor.clicktale.net/monitor?t=chunk&p=112&2=5298823325765428&v=1.5.5
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/symantec/aemprod/Bootstrap.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.0.147.218 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-0-147-218.compute-1.amazonaws.com
Software
/
Resource Hash
36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
Origin
https://us.norton.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain

Response headers

Access-Control-Allow-Origin
https://us.norton.com
Date
Fri, 21 Feb 2020 07:04:00 GMT
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
*
Content-Length
1
Content-Type
text/plain
img
pixel.mathtag.com/misc/
43 B
634 B
Image
General
Full URL
https://pixel.mathtag.com/misc/img?mm_bnc&bcdv=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.21.37.45 , France, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-21-37-45.deploy.static.akamaitechnologies.com
Software
MT3 2129 8dd2d16 master zrh-pixel-x7 /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://us.norton.com/online-threats/backdoor.cobalt!gen1-2018-121403-1729-99-writeup.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

Date
Fri, 21 Feb 2020 07:04:01 GMT
Server
MT3 2129 8dd2d16 master zrh-pixel-x7
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Fri, 21 Feb 2020 07:04:00 GMT

Verdicts & Comments Add Verdict or Comment

328 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate object| Sym function| $namespace function| $type function| $ function| Exception function| RuntimeException function| IllegalArgumentException function| DateFormat object| $ESAPI number| c object| entityToCharacterMap object| characterToEntityMap string| entity object| ESAPI_Standard_en_US function| jQuery function| log object| org number| OFF number| FATAL number| ERROR number| WARNING number| INFO number| DEBUG number| TRACE number| ALL object| Base object| globalVariables string| pageURL string| removeINID string| queryparam object| nortonAnalytics function| nortonAnalyticsData function| reportSuite object| xmlhttp object| metaData object| mboxParams function| targetPageParams object| CQ_Analytics string| mboxCopyright object| TNT function| se function| we function| ye function| Re function| mboxTrack function| mboxTrackLink object| oldTandT string| prop number| tt_readyStateCheckInterval function| mboxUrlBuilder function| mboxStandardFetcher function| mboxAjaxFetcher function| mboxMap function| mboxList function| mboxSignaler function| mboxLocatorDefault function| mboxLocatorNode function| mboxOfferContent function| mboxOfferAjax function| mboxOfferDefault function| mboxCookieManager function| mboxSession function| mboxPC function| mboxGetPageParameter function| mboxCookiePageDomain function| mboxShiftArray function| mboxGenerateId function| mboxScreenHeight function| mboxScreenWidth function| mboxBrowserWidth function| mboxBrowserHeight function| mboxBrowserTimeOffset function| mboxScreenColorDepth function| mbox function| mboxFactory function| mboxScPluginFetcher object| mboxFactories object| mboxFactoryDefault number| mboxVersion function| mboxCreate function| mboxDefine function| mboxUpdate function| mboxVizTargetUrl function| mboxSetCookie function| mboxGetCookie function| mboxLoadSCPlugin object| _AT function| getSizzleForTarget object| mboxCurrent object| ensBootstraps object| Bootstrapper function| $data string| _siteCode function| populateDataArray function| testSiteCode object| adobe function| Visitor object| s_c_il number| s_c_in object| visitor function| getMboxSessionID function| mboxTrackForm function| mboxTrackDefer function| mboxSetClientCode function| mboxNested object| ruleMETA object| ensClientConfig string| tag object| ensLogger boolean| ensBrowserSupported function| __cmp string| bannerMarkup object| testElements object| gateway string| tagName string| k object| Global object| GlobalPromocode object| Norton boolean| allowSuggest boolean| isOpen object| search function| getSearchPage function| searchSuggestResults function| searchSuggestShow function| searchSuggestHide object| entitlement function| Dropdown boolean| ieonly string| getua number| oldie number| newie object| html5 object| Modernizr object| jQuery1113024856483421921705 object| picturefillCFG function| picturefill undefined| objectFitPolyfill object| platform object| device object| Granite function| s_getLoadTime function| s_doPlugins function| AppMeasurement_Module_Integrate function| AppMeasurement_Module_Media function| AppMeasurement_Module_ActivityMap function| AppMeasurement function| s_gi function| s_pgicq boolean| enableAdobeAnalytics string| s_account object| s number| s_loadT object| _numeric_ object| expiration_date function| trackCustomDownload function| trackPageView object| uStudio number| s_objectID number| s_giq undefined| jQuery1113024856483421921705_1582268630168 object| val string| s_tnt string| tntVal object| ttMETA function| debugttMETA function| twq function| fbq function| _fbq string| ire_o function| ire object| dataLayer function| gtag number| BOOMR_lstart object| conciergeReadyDeferred object| conciergeReady object| twttr object| google_tag_manager function| ImpactRadiusEvent object| irEvent function| GooglemKTybQhCsO function| google_trackConversion object| GooglebQhCsO object| BOOMR object| BOOMR_mq string| category number| BOOMR_configt function| GoMoxiePromise object| bouncex object| bxgraph function| reload_campaigns object| _bmrEvents function| setBounceCookie function| getBounceCookie function| getBounceVisitCookie function| setBounceVisitCookie function| clearBounceCookie function| MultiCookie object| GLANCE string| tmp object| s_i_symanteccom number| WRInitTime function| obApi number| BOOMR_onload string| bcx_vars function| UET object| autoMonitorConfig string| ct_pdc_qs_val object| ClickTaleGlobal object| ClickTaleMonitor object| ClickTaleSettings object| ct_dispatcher function| ClickTaleCreateDOMElement function| ClickTaleAppendInHead function| ClickTaleXHTMLCompliantScriptTagCreate function| deleteIrrelevantUIDCookies function| clickTaleATIntegration function| clickTaleCheckIfATExists function| clickTaleMedalliaIntegration function| clickTaleCheckIfMedalliaExists function| ClickTaleOnRecording boolean| isHttps undefined| scriptSource undefined| pccSource string| pccSrc object| pccScriptElement function| ClickTaleEnableCS object| ctVEconfig object| ClickTaleOnReadyList boolean| ClickTaleIsXHTMLCompliant object| CEC boolean| ClickTaleIncludedOnWindowLoad boolean| ClickTaleIncludedOnDOMReady string| ClickTaleCookieDomain string| ClickTaleUIDCookieName string| ClickTaleScriptSource function| onloaded undefined| ClickTalePrevOnReady function| ClickTaleOnReady object| _uxa object| ctRules_PrePCC object| ctCustomCode_PrePCC function| doOnlyWhen object| ct function| handleKeyCancel function| handleKeySave function| saveCookies function| handleTabFocus string| WRFi number| WRFk number| WRFh number| WRFj object| WRFw number| ClickTaleUnloadPause number| ClickTaleEventsMask string| ClickTaleIgnoreCookieName function| ClickTaleLog function| ClickTale function| ClickTaleUploadPage function| ClickTaleDelayUploadPage function| ClickTaleIsUploadPage function| ClickTaleSetAllSensitive function| ClickTaleResetAllSensitive function| ClickTaleSetSomeSensitive function| ClickTaleResetSomeSensitive function| ClickTaleIgnore function| ClickTaleRegisterFormSubmitFailure function| ClickTaleGetVersion function| ClickTaleSetCustomElementID function| ClickTaleRegisterFormSubmitSuccess function| ClickTaleExec function| ClickTaleField function| ClickTaleNote function| ClickTaleTag function| ClickTaleEvent function| ClickTaleGetPID function| ClickTaleSetUID function| ClickTaleGetUID function| ClickTaleGetSID function| ClickTaleUnsubscribe function| ClickTaleSubscribe function| ClickTaleLogical function| ClickTaleDetectAgent function| ClickTaleIsPlayback number| ClickTaleCookieExpiryDays function| ClickTaleIsSavedRecording function| ClickTaleIsRecording function| ClickTaleSendJsonMessage function| ClickTaleDispatchPersistedMessages function| ClickTaleUploadPageNow function| ClickTaleAddAugmentElementPathHandler function| ClickTaleGetAuthResponse function| ClickTaleGetSubscriberId function| ClickTaleGetPartition function| ClickTaleGetWRIgnoreExpiry object| ClickTaleFetchFromWithCookies object| KAMPYLE_EMBED function| MutationSummary object| ClickTaleOnUploadPageContentFetched object| ClickTaleOnStop string| KAMPYLE_REVISION object| MDIGITAL object| KAMPYLE_CONSTANT object| KAMPYLE_FUNC object| KAMPYLE_DATA object| KAMPYLE_TARGETING object| KAMPYLE_ANIMATION object| KAMPYLE_VIEW object| KAMPYLE_MESSAGE object| KAMPYLE_UTILS object| KAMPYLE_EVENT_DISPATCHER object| MDIGITAL_OnPrem object| KAMPYLE_COOLADATA object| KAMPYLE_COMMON object| KAMPYLE_THERMO_TEALEAF_FUNC object| KAMPYLE_CLICKTALE_FUNC object| KAMPYLE_SESSIONCAM object| KAMPYLE_SCREEN_CAPTURE object| KAMPYLE_ONSITE_SDK undefined| KAMPYLE_POLYFILLS object| KAMPYLE_INTEGRATION object| cooladata function| metric function| clickTaleStartEventSignal function| clickTaleEndEventSignal function| ClicktaleIntegrationExperienceHandler

37 Cookies

Domain/Path Name / Value
.bounceexchange.com/ Name: bounceClientVisit2004
Value: %7B%22v%22%3A%7B%22discount_amount%22%3A0%2C%22source_type%22%3A%22Online+%281st%29%22%2C%22days_to_expiration%22%3Afalse%2C%22incoming_prod_sub_length%22%3Afalse%2C%22items_in_cart%22%3A0%2C%22cart_tracking_link%22%3Afalse%2C%22cart%22%3Afalse%2C%22ibx_test%22%3Afalse%2C%22deluxe_discount%22%3A0%2C%22first_cart_item%22%3Afalse%2C%22first_cart_item_fix%22%3Afalse%2C%22ever_logged_in%22%3Afalse%2C%22largest_discount%22%3Anull%2C%22product_recommendation%22%3A0%2C%22affiliate_type%22%3Afalse%2C%22affiliate_type_general%22%3Afalse%2C%22cobranding_partner%22%3Afalse%2C%22affilate_pararms%22%3Afalse%2C%22affiliate_event%22%3Afalse%2C%22affiliate_params_jan%22%3Afalse%2C%22affiliate_params_july%22%3Afalse%2C%22affiliate_params_april%22%3Afalse%2C%22affiliate_params_bluedoor_mar2019%22%3Afalse%2C%22bx_testing%22%3Afalse%2C%22affiliate_tracking%22%3Afalse%2C%22atc_link%22%3Afalse%2C%22cart_plurality_quantity%22%3A%22%22%2C%22cart_plurality_qualify%22%3A%22product%22%7D%7D
.norton.com/ Name: bounceClientVisit2004
Value: {}
.norton.com/ Name: IR_4405
Value: 1582268630701%7C0%7C1582268630701%7C%7C
.norton.com/ Name: AMCV_67C716D751E567F70A490D4C%40AdobeOrg
Value: 1585540135%7CMCIDTS%7C18314%7CMCMID%7C79394489270989470443647019660199926867%7CMCAAMLH-1582873430%7C6%7CMCAAMB-1582873430%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1582275831s%7CNONE%7CMCSYNCSOP%7C411-18321%7CMCAID%7CNONE%7CvVersion%7C4.4.0
.norton.com/ Name: s_cc
Value: true
.norton.com/ Name: s_gpv
Value: norton.com%3Aus%3Ainternetsecurity%3Aonline-threats%3Awriteup%3Abackdoor.cobalt%21gen1
.norton.com/ Name: event69
Value: event69
.norton.com/ Name: SSE
Value: 555323656e2353796d616e7465635f73796d457056656e646f72
.norton.com/ Name: storetimeout
Value: 30
.norton.com/ Name: IR_gbd
Value: norton.com
.norton.com/ Name: pr
Value: 5043443d30322d32312d323032307c5049443d7c5349443d7c5054593d554e4b4e4f574e
.norton.com/ Name: COUNTRY
Value: US
.norton.com/ Name: RT
Value: "sl=1&ss=1582268629783&tt=1973&obo=0&bcn=%2F%2F684dd30b.akstat.io%2F&sh=1582268631758%3D1%3A0%3A1973&dm=norton.com&si=d5e44f1d-8705-4f64-9259-104fb6a37e57&ld=1582268631759"
.norton.com/ Name: s_nr
Value: 1582268631521-New
.norton.com/ Name: bounceClientVisit2004v
Value: N4IgNgDiBcIBYBcEQM4FIDMBBNAmAYnvgK4oB0AdgPYBOCVFZAxlQLZENgCWFApgLQI4NXgEME6AgCNRTANYATKrWZUZYBAEIA5rwoBGfrgAM+gBz99ufQBZjGSwHZcATn4u3AdxpcEvYhBkiKxgIAA0IDQwICAAvkA
.norton.com/ Name: ttControl
Value: 5443473d35
.norton.com/ Name: storetimeoutpopup
Value: 3
.norton.com/ Name: tp
Value: 5452533d7472665f69643a73796d636f6d7c4f53433d4f6e6c696e652028317374297c4353433d4f6e6c696e652028317374297c4950533d7c4459523d307c4445583d30322f32312f323032307c4950433d7c4950463d7c4950563d7c4955433d7c4950443d53796d616e7465637c49504c3d656e7c4944503d7c5043493d7c534b543d7c454e503d7c4954443d7c50534e3d7c4447463d7c4c49433d7c4d49443d7c52554c3d7c4653563d
.norton.com/ Name: _gcl_au
Value: 1.1.233027241.1582268631
.norton.com/ Name: PROGRAMID
Value:
.norton.com/ Name: mbox
Value: check#true#1582268691|session#12e435eda9134856a4777d23b85cca9d#1582270491|PC#12e435eda9134856a4777d23b85cca9d.26_0#1590044631
.norton.com/ Name: es
Value: 4643443d4665622d32302d323032302031313a30333a35307c4e4c543d30322d32312d323032302030373a30333a35307c4e56533d327c4c43443d4665622d32302d323032302032333a30333a35307c4e46543d30322d32312d323032302030373a30333a35307c5054523d6e6f72746f6e3a73796d616e7465637c5353473d31354144374641462d373641362d374134322d343442342d453439384131314436304343
.norton.com/ Name: promocode
Value: DEFAULTWEB
us.norton.com/ Name: 53038
Value: Criteo
.demdex.net/ Name: demdex
Value: 79549224783269911893663617195779330274
.norton.com/ Name: channelStack
Value: s_eVar72~norton.com
.norton.com/ Name: s_ecid
Value: MCMID%7C79394489270989470443647019660199926867
.norton.com/ Name: ae
Value: 68747470733a2f2f6275792e6e6f72746f6e2e636f6d3a3434332f72656469726563746f722f73656f3f63616c6c6261636b3d6a5175657279313131333032343835363438333432313932313730355f313538323236383633303136382670747970653d63617274706f706f766572267472665f69643d73796d636f6d26736373677569643d3026434f554e5452593d5553264c414e47554147453d656e265f3d31353832323638363330313639
.norton.com/ Name: criteo_mm
Value: Criteo
.norton.com/ Name: SHOPPERID
Value:
.norton.com/ Name: AMCVS_67C716D751E567F70A490D4C%40AdobeOrg
Value: 1
.norton.com/ Name: _fbp
Value: fb.1.1582268630693.857900625
.norton.com/ Name: cv
Value: exist
us.norton.com/ Name: JSESSIONID
Value: 15ngzkfk0lo5ziau83aetp0d7
.norton.com/ Name: TLID
Value: N15ngzkfk0lo5ziau83aetp0d7
.norton.com/ Name: PROGRAM_TYPE
Value: UNKNOWN
.norton.com/ Name: LANGUAGE
Value: en

2 Console Messages

Source Level URL
Text
console-api error URL: https://s.go-mpulse.net/boomerang/MDDJR-3RVW8-S3M46-HL4QS-RLVQ4(Line 16)
Message:
ERR_COBROWSE_NOT_SUPP
console-api error URL: https://s.go-mpulse.net/boomerang/MDDJR-3RVW8-S3M46-HL4QS-RLVQ4(Line 16)
Message:
Cannot read property 'onReady' of undefined

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

6612401.fls.doubleclick.net
684dd30b.akstat.io
ad.doubleclick.net
adservice.google.com
amplify.outbrain.com
amplifypixel.outbrain.com
analytics.twitter.com
api.bounceexchange.com
asset.gomoxie.solutions
assets.bounceexchange.com
bat.bing.com
bounceexchange.com
buy.norton.com
c.go-mpulse.net
cdn.tt.omtrdc.net
cdnssl.clicktale.net
cm.everesttech.net
conductor.clicktale.net
connect.facebook.net
cx.atdmt.com
d.impactradius-event.com
dpm.demdex.net
glancecdn.net
googleads.g.doubleclick.net
gwmtracking.com
nebula-cdn.kampyle.com
nexus.ensighten.com
norton.ow5a.net
now.symassets.com
oms.norton.com
pixel.mathtag.com
pt.ispot.tv
s.go-mpulse.net
s3.amazonaws.com
static.ads-twitter.com
symantec.demdex.net
symantec.tt.omtrdc.net
t.co
tag.bounceexchange.com
tr.outbrain.com
trkn.us
udc-neb.kampyle.com
urldefense.proofpoint.com
us.norton.com
vendorlist.consensu.org
www.facebook.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
104.244.42.197
104.244.42.67
143.204.202.96
151.101.112.157
151.101.114.109
151.101.13.175
172.217.18.102
172.217.23.98
18.140.85.34
18.195.42.228
2.16.123.243
2.20.20.197
2.21.37.45
216.200.122.11
23.0.36.169
23.100.48.86
23.210.250.44
23.37.60.173
2600:9000:214f:b400:1:af78:4c0:93a1
2620:1ec:c11::200
2a00:1450:4001:800::2002
2a00:1450:4001:81f::2008
2a00:1450:4001:821::2003
2a00:1450:4001:821::2004
2a00:1450:4001:825::2002
2a02:26f0:6c00:183::2db0
2a02:26f0:6c00:184::11a6
2a03:2880:f01c:8004:face:b00c:0:8c
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
34.230.135.71
34.98.72.95
35.153.153.196
35.186.249.72
35.227.229.34
35.241.45.82
35.241.9.210
35.244.144.168
52.0.147.218
52.209.33.201
52.213.129.52
52.216.138.213
52.50.252.134
66.117.28.86
66.117.29.3
67.231.146.66
70.42.32.31
0227e0e4dea130eb6f3163aa3ab03720dce83a0e219c282189b03bc5b8a727e3
0481c082aaafd63cf83a83bf6ba4e7b9ef1cd99fe367a218523920ad3044d7b2
0e40de2991be33c009d63512509ccbbde093042c86c3d5e27d4de5dd4b956847
0f9f35089390609110d7c2c393ad8e46474f79957f194c2c4ca8c213120445b8
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
149f1c066d9c44292f68050cf7b777238c736f6a59a972e34046e7cedb9158ed
16f2f0cba7086f8d7cedc1ea8fe8358307f4845a0bd563126c3f8ca8b43b23d2
188a6e6dac88f34b69a2e6d52f7c0d48432e092bddac2bf3fd31531bd3aeed5b
1958bb7f293956e7170f639ce93a3d628ae465fa24fd751e1a2b3cd837059ffa
19b399504472722d29b53e85751d99089d6f98c18ba73931dfbbbe251c4e07a9
24f7e397faec79e62c37ff2f00b170f6dc1557fb46ac169f9f1897a9d641dd03
266c45f1c3f781f4b2b370a92b5a901ac7c3ed9e898f98d8288aa196ebf70cfa
269c8dbed8ace9cdf488d1b5886a5a007845d7fa44e6d8e63b30f6ad83b63303
2c5c4b96d0181519469719af63b77f3bcc57a51bbd6b5541e0f95823a4c2df0e
319949c8c08b86e9c35ea542c0dc0c30cedaa9b8d3d3c3327a36c91aefbd8af5
3307151d5b444757abf22c0b40dd7ab5df26a424c29e6aac99542493fa935663
33ca751ed175a163bef530ebdcdbd0a2d15997ccbcbf8d50a6f504e8ffac5a5c
3444f8d802b147e9938653db4890915cd92bd803c14776611fc003b1c2b4f275
36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068
3e72de5de67d6d80b65a114af684eaf880c53c250155a663cb17d677ff064bc1
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
4627d7eba198458549211c2e96e214d11ea6dc182c74870f05cb86eb73fd9b68
46bfad6d9a825875b7f34dffef008715e20b0e2e968066e8731ef4b60691256a
481b6d479ef35617ffccea2e351d0801e4eae3053183191fad255b9e2435b334
49bff3da68e5bc1d3c8d51651c9a8f102db01e2e6a574c7635da27a5ff4831c3
4d8464d6001bfd6b3393bac88d3ef7b49aa2c1b100e4632b012a575b0195922a
5130b4e7d768a441b2d23a7e8e6cbd3ef5231744a011399e5fc6e43155ae46b6
583ac3341c1b1199e3813fd17c5722770d7c29474e10e7aff4554f93f9c41312
5a91c6d3e635c0bd1551a53cf0769328132151a7732039170280d500dbcb4685
61164135ac4f772076ebf25a8ac6f8cade571440c23ea3cca276171479f4a51d
6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93
7ecf3bf86151cd72036fb67feb8fcbd8c80359e0ca871e1aeb955428ed43c26d
8157d9df62aa076157f63d4bcc571ea6cc96876d845035946f7c47c19604fc8a
86cfc8acb0ad8a720e08ff3ae9d9f2983f113c042f71d0a3dd50db19f80b1908
86f3a471058986198cf3971445aa6b7997f81ccd9aa0df3ddd35f87373c4fe4b
8789124679e420a7b1a2edcfb7ce0b22b834d8b2d4a80ff045e772af3bdb01c4
89b531e78902333807b825faf77cd11cc927fe364ea2ba9307f65365f7e811f7
8b025aa2e2b21b2ac6990d09e0ce2ff7fa15d7ac2c80b65fd1a9bf5e13f0fc8b
8bd397636ecd49c36d687ad591807ea5ee621b1e11888657827902a5003fc4bb
8f22857be0fc9b8a537aed130130ef07638450809869c2f3d0ad5a939d623425
90178d10fa4b173bf46c50673c4885c80a27fb1e6f3f363f2ad9bb1bb734e446
9048cb41b012db0da6c685e116a3f687783ea13d688a42410eadf49c9056ce4d
917a13322705f8f8fb8bdbdf43778027cc2ba919c4927221ce599d458e5cfa7b
9c28255a4751f9bb7447d173b7c974f1dd50e9ce458ff10d3a6bbbb9be35f8c6
9d8a2811fe6cec544f8e4ba7915c7ee8d4caa72257d97bf4f8964dae6c621ff6
9f64ee673b2e33d78f5191a03dd873fc05ce3f0b17cb28643f41881e4aa45a36
a0a771310c3d3f2d34b576c677a5055aa8a328bd9a9601849c3f35dfa2a9e71c
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a4370188e3b8f3641ad43ef72bfa9e8bc5e519da306984c328fc1885d621c470
a9950fa5ca9cf47072770900d259bcf6778aa1119652d2e706d5eb92df254199
ac5062a26074b1f55f8fac636722017921d379703a5fed821ec29d14f16a4411
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ac91c555d84965c54dbf299e474193ac0b8f1eb07b9fa24301a87ad59a911491
acfa1f03ac087fc08ca7389b23f01c47b31c6d00d412a21d9342af3c070fff57
ae03ecaf785b33a67314d7ccdaadda6a1f9a4c9ba357ae56cacbe3c30dea0b69
b05ee17bb9cdbd78d207c4b1708627eed86d3b37585f7ffff0dfe0887f2feab4
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b17634e6bfe621446f4c0ef4cf5ea52fbd358f131c430f3a05641af11221d89d
b26f5d3bd43927960b86149951b58cee9eef0d3c454b392d75824888a5ca6f52
b2c78c910f5ea29e3a9d223dabc203c055c8708b1fe7d83788b490638126db4d
b4c7f2eef48e56bc43441c5e4e3e4c41697b8f164494c909f4df0c6cfc90e1f9
c89841c22481fc9eb58f82d340a9499b9ad7614df3c61d50ecb90ffca036efe0
ce3746cc543545bf405359f11b14b5d7f94cba1b0a4725f22d622713b771d7a9
d035405664700e6d4643eab43b006e2da9044726bd7295f77e5dcf5d273beac2
d2a224459854487475c6edd91c8124d08c679750bd9d1be5dc645a2d743acdde
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
df6435877275dfa95c0c33ff26c3f8517e21ee1cf345e1a27bc583112663b92c
e0b8436d50fb200de76d7a25cf450ea238cd100197f8e9d462e9228153da873f
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e613df9aa843851d019cc12e6184972311e2229c14299d2f6c80f4aadf2d844a
e6a252dd3dc47ec3385baa7bd0f8d08c7bf63371c0c0184f1877403d13f32604
e6d946fa7cbdfc1c66ba00393241fc5a72be76878aeeb3139a1af086000b96d2
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f3d7092e6eb6f3aa0c572e52e061a59cc88a3e9eff581c95c4bd7456800904d0
f3e8bbb0d6ab1b3ed67c3f008a596236467c8919df7b59863832f21deee4c8fb
fc4606c43c45bd8695e9df69bf34b61fba6693368cfb079a6381d3877e9da6c8
ff3814209c050228f5b76942dcec58bbac590c8ccfde770ecd1830cddd6ce71f