www.malwarebytes.com Open in urlscan Pro
192.0.66.233  Public Scan

33 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 92

• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2594100&time=1733037624367&li_adsId=aca84cfd-1683-4e55-bf7d-e54077637d63&url=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fnews%2F2018%2F07%2Fhidden-bee-miner-delivered-via-improved-drive-by-download-toolkit HTTP 302
• https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=2594100&time=1733037624367&li_adsId=aca84cfd-1683-4e55-bf7d-e54077637d63&url=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fnews%2F2018%2F07%2Fhidden-bee-miner-delivered-via-improved-drive-by-download-toolkit&e_ipv6=AQIfL2c7l6UDcQAAAZOBF4zJEDUCbiF-FWuHXH-oPeJsZrGlqiVtXxB-Z4uZoy6gphCY9ofBSA

101 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
4 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Show response www.malwarebytes.com/blog/news/2018/07/	152 KB 36 KB	650ms 579ms	Document text/html	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 4d3a9335f492187574e07745c3b4881f96a4028510327a38add25bc5c5e9b1b5 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options DENY Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers accept-ranges bytes cache-control max-age=300, must-revalidate content-encoding br content-type text/html; charset=UTF-8 date Sun, 01 Dec 2024 07:20:22 GMT host-header a9130478a60e5f9135f765b23f26593b link <https://www.malwarebytes.com/wp-json/>; rel="https://api.w.org/" <https://www.malwarebytes.com/wp-json/wp/v2/posts/65746>; rel="alternate"; type="application/json" <https://www.malwarebytes.com/?p=65746>; rel=shortlink referrer-policy strict-origin-when-cross-origin server nginx strict-transport-security max-age=31536000 vary Accept-Encoding, Origin x-cache EXPIRED x-content-type-options nosniff x-frame-options DENY x-pingback https://www.malwarebytes.com/xmlrpc.php x-rq yyz2 85 187 443
GET H2	200	RobotoSerif-Medium.a8a104b1.woff2 www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/	172 KB 172 KB	28ms 24ms	Font application/font-woff2	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/RobotoSerif-Medium.a8a104b1.woff2 Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 71e7d96e0b15924a58f28b82f88627957a5ea25f7a23930c295186f3412cca2c Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Response headers strict-transport-security max-age=31536000 cache-control max-age=300, must-revalidate x-rq yyz2 85 188 443 etag "664d0ce2-2afa7" access-control-allow-methods GET, HEAD accept-ranges bytes access-control-allow-origin * x-cache HIT content-length 176039 date Sun, 01 Dec 2024 07:20:22 GMT content-type application/font-woff2 last-modified Tue, 21 May 2024 21:06:42 GMT server nginx
GET H2	200	RobotoSerif-Medium.00ec4109.woff www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/	125 KB 126 KB	29ms 25ms	Font application/font-woff	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/RobotoSerif-Medium.00ec4109.woff Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash bbf5ef817d938f8bbb1bada103e55f96170f62fe6cf7b54b4019071e7072ee15 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Response headers strict-transport-security max-age=31536000 cache-control max-age=300, must-revalidate x-rq yyz2 85 187 443 etag "664d0ce2-1f5e4" access-control-allow-methods GET, HEAD accept-ranges bytes access-control-allow-origin * x-cache HIT content-length 128484 date Sun, 01 Dec 2024 07:20:22 GMT content-type application/font-woff last-modified Tue, 21 May 2024 21:06:42 GMT server nginx
GET H2	200	RobotoSerif-light.725d86a1.woff2 www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/	174 KB 174 KB	29ms 25ms	Font application/font-woff2	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/RobotoSerif-light.725d86a1.woff2 Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 7dfe96249d73eae447d1edadecd5cc098ab76099647c9e2cf8f3b616d5fe5ee7 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Response headers strict-transport-security max-age=31536000 cache-control max-age=300, must-revalidate x-rq yyz2 85 187 443 etag "6740a383-2b790" access-control-allow-methods GET, HEAD accept-ranges bytes access-control-allow-origin * x-cache HIT content-length 178064 date Sun, 01 Dec 2024 07:20:22 GMT content-type application/font-woff2 last-modified Fri, 22 Nov 2024 15:30:11 GMT server nginx
GET H2	200	RobotoSerif-light.bbcf9d54.woff www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/	121 KB 121 KB	29ms 26ms	Font application/font-woff	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/RobotoSerif-light.bbcf9d54.woff Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 2d71a55f5dad7cda17ce63dd9d673c81550681f90d9c059ca23e3be81967c602 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Response headers strict-transport-security max-age=31536000 cache-control max-age=300, must-revalidate x-rq yyz2 85 188 443 etag "6740a383-1e24c" access-control-allow-methods GET, HEAD accept-ranges bytes access-control-allow-origin * x-cache HIT content-length 123468 date Sun, 01 Dec 2024 07:20:22 GMT content-type application/font-woff last-modified Fri, 22 Nov 2024 15:30:11 GMT server nginx
GET H2	200	Roboto-Regular.b009a76a.woff2 www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/	15 KB 16 KB	30ms 26ms	Font application/font-woff2	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/Roboto-Regular.b009a76a.woff2 Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Response headers strict-transport-security max-age=31536000 cache-control max-age=300, must-revalidate x-rq yyz2 85 188 443 etag "64e62668-3d80" access-control-allow-methods GET, HEAD accept-ranges bytes access-control-allow-origin * x-cache HIT content-length 15744 date Sun, 01 Dec 2024 07:20:22 GMT content-type application/font-woff2 last-modified Wed, 23 Aug 2023 15:31:52 GMT server nginx
GET H2	200	Roboto-Regular.f1e2a767.woff www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/	20 KB 20 KB	30ms 27ms	Font application/font-woff	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/Roboto-Regular.f1e2a767.woff Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash f2abf7fbabe298e5823d257e48f5dc2138c6d5e0c210066f76b0067e8eda194f Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Response headers strict-transport-security max-age=31536000 cache-control max-age=300, must-revalidate x-rq yyz2 85 187 443 etag "64e62668-4f78" access-control-allow-methods GET, HEAD accept-ranges bytes access-control-allow-origin * x-cache HIT content-length 20344 date Sun, 01 Dec 2024 07:20:22 GMT content-type application/font-woff last-modified Wed, 23 Aug 2023 15:31:52 GMT server nginx
GET H2	200	Roboto-Bold.227c9319.woff2 www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/	15 KB 16 KB	30ms 27ms	Font application/font-woff2	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/Roboto-Bold.227c9319.woff2 Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Response headers strict-transport-security max-age=31536000 cache-control max-age=300, must-revalidate x-rq yyz2 85 187 443 etag "64e62668-3df4" access-control-allow-methods GET, HEAD accept-ranges bytes access-control-allow-origin * x-cache HIT content-length 15860 date Sun, 01 Dec 2024 07:20:22 GMT content-type application/font-woff2 last-modified Wed, 23 Aug 2023 15:31:52 GMT server nginx
GET H2	200	Roboto-Bold.77ecb942.woff www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/	20 KB 20 KB	60ms 57ms	Font application/font-woff	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/Roboto-Bold.77ecb942.woff Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash e0fd57c0d9537d9c9884b6a8ad8c1823800d94dcfb6a2cc988780fe65a592fe6 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Response headers strict-transport-security max-age=31536000 cache-control max-age=300, must-revalidate x-rq yyz2 85 187 443 etag "64e62668-4fb8" access-control-allow-methods GET, HEAD accept-ranges bytes access-control-allow-origin * x-cache HIT content-length 20408 date Sun, 01 Dec 2024 07:20:22 GMT content-type application/font-woff last-modified Wed, 23 Aug 2023 15:31:52 GMT server nginx
GET H2	200	Roboto-Black.2e8becfc.woff2 www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/	15 KB 16 KB	58ms 55ms	Font application/font-woff2	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/Roboto-Black.2e8becfc.woff2 Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 7e262106f82cc52663e403f5b73795bbeab9ca0630c33c03579354fbcd4fae1e Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Response headers strict-transport-security max-age=31536000 cache-control max-age=300, must-revalidate x-rq yyz2 85 188 443 etag "64e62668-3d88" access-control-allow-methods GET, HEAD accept-ranges bytes access-control-allow-origin * x-cache HIT content-length 15752 date Sun, 01 Dec 2024 07:20:22 GMT content-type application/font-woff2 last-modified Wed, 23 Aug 2023 15:31:52 GMT server nginx
GET H2	200	Roboto-Black.f5677eb2.woff www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/	20 KB 20 KB	58ms 56ms	Font application/font-woff	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/Roboto-Black.f5677eb2.woff Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash f6537e32263e6c49bf59bd6e4952b6bf06c8f09152c5b016365fef70e35856cf Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Response headers strict-transport-security max-age=31536000 cache-control max-age=300, must-revalidate x-rq yyz2 85 188 443 etag "64e62668-4fc8" access-control-allow-methods GET, HEAD accept-ranges bytes access-control-allow-origin * x-cache HIT content-length 20424 date Sun, 01 Dec 2024 07:20:22 GMT content-type application/font-woff last-modified Wed, 23 Aug 2023 15:31:52 GMT server nginx
GET H2	200	shape-challenger-2.307bef30.png www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/images/	10 KB 10 KB	29ms 27ms	Image image/png	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/images/shape-challenger-2.307bef30.png Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 9493ef8d4ffa2372bc105ae6ff98c9d169c465255578e5ddb4a8a48d56e453aa Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Response headers strict-transport-security max-age=31536000 cache-control max-age=31536000 x-rq yyz2 85 187 443 etag "65045c32-27b9" accept-ranges bytes x-cache HIT content-length 10169 date Sun, 01 Dec 2024 07:20:23 GMT content-type image/png last-modified Fri, 15 Sep 2023 13:29:22 GMT server nginx
GET H2	200	ajax-loader.6f9ac78c.gif www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/images/	19 KB 19 KB	28ms 25ms	Image image/gif	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/images/ajax-loader.6f9ac78c.gif Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 24ed9db3eb0d97ecf1f0832cbd30bd37744e0d2b520ccdad5af60f7a08a45b90 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Response headers strict-transport-security max-age=31536000 cache-control max-age=31536000 x-rq yyz2 85 187 443 etag "64e62668-4aa6" accept-ranges bytes x-cache HIT content-length 19110 date Sun, 01 Dec 2024 07:20:23 GMT content-type image/gif last-modified Wed, 23 Aug 2023 15:31:52 GMT server nginx
GET H2	200	app-play.5ed26b30.png www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/images/	54 KB 54 KB	28ms 26ms	Image image/png	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/images/app-play.5ed26b30.png Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 1fc4302f08484cb4df0a32e6cf6ce58cc057de2eed9c645cfdabebef1d3306d1 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Response headers strict-transport-security max-age=31536000 cache-control max-age=31536000 x-rq yyz2 85 187 443 etag "664d0ce2-d830" accept-ranges bytes x-cache HIT content-length 55344 date Sun, 01 Dec 2024 07:20:23 GMT content-type image/png last-modified Tue, 21 May 2024 21:06:42 GMT server nginx
GET H2	200	app-store.0d6e625d.png www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/images/	53 KB 53 KB	29ms 27ms	Image image/png	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/images/app-store.0d6e625d.png Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 837bb391f879a1edd4521ce965b614bb760c6a2eeacde80329a57631196bea73 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Response headers strict-transport-security max-age=31536000 cache-control max-age=31536000 x-rq yyz2 85 188 443 etag "664d0ce2-d2eb" accept-ranges bytes x-cache HIT content-length 53995 date Sun, 01 Dec 2024 07:20:23 GMT content-type image/png last-modified Tue, 21 May 2024 21:06:42 GMT server nginx
GET H2	200	/ www.malwarebytes.com/_static/	163 KB 13 KB	48ms 46ms	Stylesheet text/css	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://www.malwarebytes.com/_static/??-eJyFjMEKwkAMRH/IbVxQqgfxW9Y1DYE0G7opi3/vUi89FLwN8+YNNAu5qKM6mKzEWoGweFoInZWaga0v4Qy57kj4lcPMOnRwgoObhiTF4c3VN3la+iD09M9IZlD9I1hBsYVJEm3Oc37EMV7j7T6eL1/NZETr Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 24c613a2bb6db3e4b670cd5ab76d56edd869f3472bc463d8e8431421deb324d3 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Response headers strict-transport-security max-age=31536000 cache-control max-age=31536000 content-encoding br x-rq yyz2 85 187 443 accept-ranges bytes x-cache HIT date Sun, 01 Dec 2024 07:20:22 GMT content-type text/css;charset=utf-8 vary Accept-Encoding server nginx last-modified Wed, 08 May 2024 17:35:04 GMT
GET H2	200	base-fonts.css www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/	2 KB 577 B	46ms 44ms	Stylesheet text/css	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/base-fonts.css?ver=1732292781 Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 30590261823ba5df8c6c0e2ea141c474a9532d2ebb9d4ccbc45324fb902423b3 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Response headers strict-transport-security max-age=31536000 cache-control max-age=31536000 content-encoding br x-rq yyz2 85 188 443 etag W/"6740b0ad-6b1" accept-ranges bytes x-cache HIT date Sun, 01 Dec 2024 07:20:22 GMT content-type text/css last-modified Fri, 22 Nov 2024 16:26:21 GMT server nginx vary Accept-Encoding
GET H2	200	base-blog.css www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/	64 KB 12 KB	47ms 45ms	Stylesheet text/css	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/base-blog.css?ver=1732294374 Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 63bf4337537f6f4c363fd1bac1d5a7e0eb0d1468a1ad766e463f0075675cab08 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Response headers strict-transport-security max-age=31536000 cache-control max-age=31536000 content-encoding br x-rq yyz2 85 188 443 etag W/"6740b6e6-10074" accept-ranges bytes x-cache HIT date Sun, 01 Dec 2024 07:20:22 GMT content-type text/css last-modified Fri, 22 Nov 2024 16:52:54 GMT server nginx vary Accept-Encoding
GET H2	200	base.css www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/	166 KB 29 KB	55ms 53ms	Stylesheet text/css	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/base.css?ver=1.0 Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash a89b37fb8a2c2cb333b4f787b8f730de25a9bfbd10fcfcea3185b813c6231e09 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Response headers strict-transport-security max-age=31536000 cache-control max-age=31536000 content-encoding br x-rq yyz2 85 188 443 etag W/"6740a383-29929" accept-ranges bytes x-cache HIT date Sun, 01 Dec 2024 07:20:22 GMT content-type text/css last-modified Fri, 22 Nov 2024 15:30:11 GMT server nginx vary Accept-Encoding
GET H2	200	font-awesome.min.css www.malwarebytes.com/wp-content/themes/malwarebytes/assets/library/css/	30 KB 7 KB	56ms 54ms	Stylesheet text/css	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://www.malwarebytes.com/wp-content/themes/malwarebytes/assets/library/css/font-awesome.min.css?m=1692804712g Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Response headers strict-transport-security max-age=31536000 cache-control max-age=31536000 content-encoding br x-rq yyz2 85 188 443 etag W/"64e62668-7918" accept-ranges bytes x-cache HIT date Sun, 01 Dec 2024 07:20:22 GMT content-type text/css last-modified Wed, 23 Aug 2023 15:31:52 GMT server nginx vary Accept-Encoding
GET H2	200	front-js.js Show response www.malwarebytes.com/wp-content/plugins/weglot/dist/	5 KB 2 KB	58ms 57ms	Script application/javascript	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://www.malwarebytes.com/wp-content/plugins/weglot/dist/front-js.js?m=1730848674g Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 0aa10e1d078fcba8a8c9c654650d01b1e9562fb419ca536ad23fcb960bad9b2b Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Response headers strict-transport-security max-age=31536000 cache-control max-age=31536000 content-encoding br x-rq yyz2 85 187 443 etag W/"672aa7a2-1244" accept-ranges bytes x-cache HIT date Sun, 01 Dec 2024 07:20:22 GMT content-type application/javascript last-modified Tue, 05 Nov 2024 23:17:54 GMT server nginx vary Accept-Encoding
GET H2	200	Malwarebytes_Labs_logo_Color-2.png www.malwarebytes.com/wp-content/uploads/sites/2/2023/07/	962 B 1 KB	30ms 28ms	Image image/webp	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://www.malwarebytes.com/wp-content/uploads/sites/2/2023/07/Malwarebytes_Labs_logo_Color-2.png?resize=150,19 Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash a163f2ca5ba23ca9f8e4a6c3d27665160a63fb7379e4504ca0b05cd676149afb Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Response headers strict-transport-security max-age=31536000 cache-control max-age=31536000 x-rq yyz2 80 86 443 etag "b89d1f000f6c81f3" accept-ranges bytes, bytes x-cache HIT content-length 962 date Sun, 01 Dec 2024 07:20:23 GMT content-type image/webp last-modified Wed, 23 Oct 2024 20:36:57 GMT server nginx vary Accept
GET H2	200	shutterstock_762053431.jpg www.malwarebytes.com/wp-content/uploads/sites/2/2018/07/	346 KB 347 KB	423ms 422ms	Image image/webp	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://www.malwarebytes.com/wp-content/uploads/sites/2/2018/07/shutterstock_762053431.jpg Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 95ec732f1bba6024953d74a8bb83eecc807efcd0f48e399567b5019af2bf7681 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Response headers strict-transport-security max-age=31536000 cache-control max-age=31536000 x-rq yyz2 91 52 443 etag "4daa105d85d9ad80" accept-ranges bytes, bytes x-cache MISS content-length 354342 date Sun, 01 Dec 2024 07:20:23 GMT content-type image/webp last-modified Sun, 01 Dec 2024 07:20:23 GMT server nginx vary Accept
GET H2	200	j.php Show response dev.visualwebsiteoptimizer.com/	29 KB 9 KB	88ms 39ms	XHR application/javascript	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://dev.visualwebsiteoptimizer.com/j.php?a=622914&u=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fnews%2F2018%2F07%2Fhidden-bee-miner-delivered-via-improved-drive-by-download-toolkit&vn=2.1&x=true Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software gnv2 / Resource Hash 679237c29f0a26e36186b8721f4249b3199a0479396ef37b62ebf7afb46bd90b Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers cache-control public, max-age=0, no-cache, must-revalidate timing-allow-origin * content-encoding gzip access-control-allow-credentials true via 1.1 google access-control-allow-origin https://www.malwarebytes.com alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Sun, 01 Dec 2024 07:20:22 GMT content-type application/javascript; charset=UTF-8 vary Accept-Encoding server gnv2
GET H2	200	gtm.js Show response www.googletagmanager.com/	494 KB 149 KB	122ms 57ms	Script application/javascript	2607:f8b0:4004:c17::61 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-MKSKW3 Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4004:c17::61 Washington, United States, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash da754702d782843c7c97ff80005ca88f2a55c99438ba67633ffe498625280e92 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers content-encoding br report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1080:0"}],} expires Sun, 01 Dec 2024 07:20:23 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Sun, 01 Dec 2024 07:20:23 GMT content-type application/javascript; charset=UTF-8 vary Accept-Encoding last-modified Sun, 01 Dec 2024 06:00:00 GMT access-control-allow-headers Cache-Control strict-transport-security max-age=31536000; includeSubDomains cache-control private, max-age=900 cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1080:0 access-control-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 151673 x-xss-protection 0 server Google Tag Manager
GET H2	200	script.js Show response plausible.io/js/	1 KB 1 KB	165ms 40ms	Script application/javascript	2400:52e0:1a00::1207:2 BunnyCDN BUNNYWAY
General Check archive.org Show headers Download Go to Full URL https://plausible.io/js/script.js Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2400:52e0:1a00::1207:2 Chicago, United States, ASN200325 (BunnyCDN BUNNYWAY, informacijske storitve d.o.o., SI), Reverse DNS Software BunnyCDN-IL1-1207 / Resource Hash e3409ac09af396e35fd67c5e024386d36c52138b7541e6a4644c31a94a2d33a4 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers cdn-status 200 content-encoding br x-content-type-options nosniff date Sun, 01 Dec 2024 07:20:23 GMT content-type application/javascript vary Accept-Encoding cdn-cachedat 11/30/2024 16:50:43 cdn-cache HIT cdn-requestpullcode 200 cache-control public, must-revalidate, max-age=86400 cdn-requestpullsuccess True cdn-requesttime 1 cdn-uid 153cb5b1-399a-48ef-b5bf-098c03770254 cdn-requestid 88e3f8a7fdf1755fe8bbaee86cd684c6 cross-origin-resource-policy cross-origin cdn-pullzone 682664 cdn-proxyver 1.06 application 127.0.0.1 permissions-policy interest-cohort=() access-control-allow-origin * cdn-edgestorageid 1068 server BunnyCDN-IL1-1207 cdn-requestcountrycode CA
GET H2	200	iframe.png www.malwarebytes.com/wp-content/uploads/sites/2/2018/07/	76 KB 76 KB	464ms 463ms	Image image/webp	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://www.malwarebytes.com/wp-content/uploads/sites/2/2018/07/iframe.png Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash e20506eac3e701ab20060dc13be33badb852148c3bb4d336867659ba7c71751a Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Response headers strict-transport-security max-age=31536000 cache-control max-age=31536000 x-rq yyz2 80 130 443 etag "fd51b559907485b5" accept-ranges bytes, bytes x-cache MISS content-length 77800 date Sun, 01 Dec 2024 07:20:23 GMT content-type image/webp last-modified Sun, 01 Dec 2024 07:20:23 GMT server nginx vary Accept
GET H2	200	base64_rabbit.png www.malwarebytes.com/wp-content/uploads/sites/2/2018/07/	40 KB 40 KB	295ms 295ms	Image image/webp	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://www.malwarebytes.com/wp-content/uploads/sites/2/2018/07/base64_rabbit.png Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash c8fd62ec3fa3eb53dd8fa49a7b4e7e74020dc1c8d2aa2027e6225bf1547b8abf Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Response headers strict-transport-security max-age=31536000 cache-control max-age=31536000 x-rq yyz2 80 86 443 etag "73f0b242b5d9c1e6" accept-ranges bytes, bytes x-cache MISS content-length 40918 date Sun, 01 Dec 2024 07:20:23 GMT content-type image/webp last-modified Sun, 01 Dec 2024 07:20:23 GMT server nginx vary Accept
GET H/1.1	200 OK	embed.js Show response malwarebytesunpacked.disqus.com/	80 KB 26 KB	180ms 54ms	Script application/javascript	199.232.192.134 FASTLY
General Check archive.org Show headers Download Go to Full URL https://malwarebytesunpacked.disqus.com/embed.js Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 199.232.192.134 , United States, ASN54113 (FASTLY, US), Reverse DNS Software openresty / Resource Hash 89bc923b8835c4aa30f227bbde248429a3b302a0d4f8b892e3ccf4ef016e7830 Security Headers Name Value Strict-Transport-Security max-age=300; includeSubdomains Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers Strict-Transport-Security max-age=300; includeSubdomains Link <https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect Cache-Control private, max-age=60 x-service router content-encoding gzip Age 0 Connection keep-alive Cross-Origin-Resource-Policy cross-origin Content-Length 26443 Date Sun, 01 Dec 2024 07:20:23 GMT content-type application/javascript; charset=utf-8 Vary Accept-Encoding server openresty
GET H2	200	ThreatDown_Horizontal_Reverse-2-2.svg www.malwarebytes.com/wp-content/uploads/sites/2/2023/11/	28 KB 11 KB	27ms 22ms	Image image/svg+xml	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://www.malwarebytes.com/wp-content/uploads/sites/2/2023/11/ThreatDown_Horizontal_Reverse-2-2.svg?w=1024 Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 6eac02b1761c62ace94875848fb6cf12728c936a19384a7758b07be6c3b86446 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Response headers strict-transport-security max-age=31536000 cache-control max-age=31536000 content-encoding br x-rq yyz2 80 130 443 etag W/"69fc36375b7bd7a5" accept-ranges bytes x-cache HIT date Sun, 01 Dec 2024 07:20:23 GMT content-type image/svg+xml vary Accept-Encoding server nginx last-modified Tue, 21 Nov 2023 01:13:30 GMT
GET H/1.1	200 OK	count.js Show response malwarebytesunpacked.disqus.com/	1 KB 2 KB	144ms 19ms	Script application/javascript	199.232.192.134 FASTLY
General Check archive.org Show headers Download Go to Full URL https://malwarebytesunpacked.disqus.com/count.js Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 199.232.192.134 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 3487ef2baf0c08ba660a8a143cdeb8ebeec961eea04bccd7c49096b4eb26b875 Security Headers Name Value Strict-Transport-Security max-age=300; includeSubdomains X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers Content-Encoding gzip ETag "67449562-367" Age 188 X-Content-Type-Options nosniff X-Amz-Cf-Id xIm1QarjApcLkbPXkykkN5m-r0Fmmlfn55X34aDlA7QGwzi3A4PBfA== Date Sun, 01 Dec 2024 07:20:23 GMT Content-Type application/javascript; charset=utf-8 Last-Modified Mon, 25 Nov 2024 15:18:58 GMT Vary Accept-Encoding Strict-Transport-Security max-age=300; includeSubdomains Link <https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect Cache-Control public, max-age=300 Connection keep-alive Cross-Origin-Resource-Policy cross-origin Content-Length 871 X-XSS-Protection 1; mode=block X-Amz-Cf-Pop DFW56-P9 Server nginx
POST H3	200	pageviews Show response api.weglot.com/	2 B 2 KB	259ms 177ms	XHR application/json	172.64.149.114 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://api.weglot.com/pageviews?api_key=wg_ab7feeaf115f3476db3eec82a65b414c4 Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Protocol H3 Security QUIC, , AES_128_GCM Server 172.64.149.114 San Francisco, United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945 Security Headers Name Value Content-Security-Policy default-src 'self' *.weglot.com; base-uri 'self'; connect-src 'self' *; font-src 'self' cdn.jsdelivr.net https://fonts.gstatic.com data:; form-action 'self' *.weglot.com api.workos.com error.workos.com announcekit.app https://accounts.google.com https://login.microsoftonline.com https://pi.zebra.com https://*.okta.com https://*.jumpcloud.com; frame-src 'self' *.weglot.io announcekit.app code.gist.build renderer.gist.build https://www.google.com https://js.stripe.com https://app.goentri.com https://www.youtube.com https://www.youtube-nocookie.com https://td.doubleclick.net https://js.refiner.io blob: https://weglot.nolt.io; img-src 'self' * data: blob:; object-src 'none'; media-src 'self' blob:; script-src 'nonce-1aa36e90ad56e96b8eb5b1f2e220bb23' 'strict-dynamic'; style-src 'self' 'unsafe-inline' *.weglot.com https://app.productfruits.com; worker-src 'self' blob:; block-all-mixed-content;report-uri https://csp-report.browser-intake-datadoghq.com/api/v2/logs?dd-api-key=pub3bd6aeebbc69014092e8cc554aa628f3&dd-evp-origin=content-security-policy&ddsource=csp-report&ddtags=env:prod;frame-ancestors 'none'; Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Content-Type text/plain;charset=UTF-8 Referer https://www.malwarebytes.com/ Response headers content-encoding gzip cf-cache-status DYNAMIC access-control-allow-methods GET,POST,PUT,PATCH,DELETE x-content-type-options nosniff expires Sun, 01 Dec 2024 07:20:23 GMT alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Sun, 01 Dec 2024 07:20:23 GMT content-type application/json priority u=1,i x-frame-options SAMEORIGIN access-control-allow-headers Content-Type, Weglot-Source, Authorization strict-transport-security max-age=31536000; includeSubDomains; preload content-security-policy default-src 'self' *.weglot.com; base-uri 'self'; connect-src 'self' *; font-src 'self' cdn.jsdelivr.net https://fonts.gstatic.com data:; form-action 'self' *.weglot.com api.workos.com error.workos.com announcekit.app https://accounts.google.com https://login.microsoftonline.com https://pi.zebra.com https://*.okta.com https://*.jumpcloud.com; frame-src 'self' *.weglot.io announcekit.app code.gist.build renderer.gist.build https://www.google.com https://js.stripe.com https://app.goentri.com https://www.youtube.com https://www.youtube-nocookie.com https://td.doubleclick.net https://js.refiner.io blob: https://weglot.nolt.io; img-src 'self' * data: blob:; object-src 'none'; media-src 'self' blob:; script-src 'nonce-1aa36e90ad56e96b8eb5b1f2e220bb23' 'strict-dynamic'; style-src 'self' 'unsafe-inline' *.weglot.com https://app.productfruits.com; worker-src 'self' blob:; block-all-mixed-content;report-uri https://csp-report.browser-intake-datadoghq.com/api/v2/logs?dd-api-key=pub3bd6aeebbc69014092e8cc554aa628f3&dd-evp-origin=content-security-policy&ddsource=csp-report&ddtags=env:prod;frame-ancestors 'none'; cache-control max-age=0, must-revalidate, no-store, private referrer-policy strict-origin-when-cross-origin cf-ray 8eb150792bfeaaa4-YYZ permissions-policy accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), fullscreen=(self), geolocation=(), gyroscope=(self), magnetometer=(), microphone=(), midi=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), usb=(), xr-spatial-tracking=(), clipboard-read=(self), clipboard-write=(self), hid=(), idle-detection=(), serial=() access-control-allow-origin * x-xss-protection 1; mode=block server cloudflare
GET H2	200	jquery.min.js Show response www.malwarebytes.com/wp-includes/js/jquery/	86 KB 31 KB	26ms 23ms	Script application/javascript	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://www.malwarebytes.com/wp-includes/js/jquery/jquery.min.js?ver=1.0 Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Response headers strict-transport-security max-age=31536000 cache-control max-age=31536000 content-encoding br x-rq yyz2 85 188 443 etag W/"673f5db3-15601" accept-ranges bytes x-cache HIT date Sun, 01 Dec 2024 07:20:23 GMT content-type application/javascript last-modified Thu, 21 Nov 2024 16:20:03 GMT server nginx vary Accept-Encoding
GET H2	200	/ Show response www.malwarebytes.com/_static/	80 KB 25 KB	27ms 25ms	Script application/javascript	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://www.malwarebytes.com/_static/??-eJyVjEsOwjAMBS9Ea6hKWSHOkgQrOHLcqHYUldMTwQaxYznvM9DKEFYxFIPCNZIoRFzNbRGNJLYCpXqmAOmrGD7ZmPQA/wgyCSgyBqMnjp1+DfbAjH3nuLkN/W4dnCqagq/E9968T7d8PV2mZTofl3lOL1lASdA= Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 83ec965817cc644f3583df6524a72f6632f3ed0ecb311cf9eca63a2f440e5a77 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Response headers strict-transport-security max-age=31536000 cache-control max-age=31536000 content-encoding br x-rq yyz2 85 187 443 accept-ranges bytes x-cache HIT date Sun, 01 Dec 2024 07:20:23 GMT content-type application/javascript vary Accept-Encoding server nginx last-modified Fri, 13 Sep 2024 18:04:04 GMT
GET H2	200	main-vwo-personalization-threatdown.js Show response www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/	698 B 662 B	26ms 24ms	Script application/javascript	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/main-vwo-personalization-threatdown.js?ver=1.4 Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 2e7a03672c8aee8a48a7b996bcbb820055e4ebffe37f197849e801dc2660d8c8 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Response headers strict-transport-security max-age=31536000 cache-control max-age=31536000 content-encoding br x-rq yyz2 85 188 443 etag W/"6740a383-2ba" accept-ranges bytes x-cache HIT date Sun, 01 Dec 2024 07:20:23 GMT content-type application/javascript last-modified Fri, 22 Nov 2024 15:30:11 GMT server nginx vary Accept-Encoding
GET H2	200	/ Show response www.malwarebytes.com/_static/	2 KB 1 KB	26ms 24ms	Script application/javascript	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://www.malwarebytes.com/_static/??-eJyVjMENwjAMABciGApSxQMxi5ua4jSxq9hVBNOTFfo86e6gbSGqOImDf6iQQcHcsNL09Q5oRm5gNUIyoKilUI0Eu3Nm525E1ZXpnOwEh14bVVPBzD90VulqXclZlhCxbMiL2IHptHOe4V2JwqxNsuLc61d5XsfhMQ6X+21MfzNkWUM= Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash a52f68095f3d06ee602c5137a535b020173e2c63f76e9d39c7a36c50e022f680 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Response headers strict-transport-security max-age=31536000 cache-control max-age=31536000 content-encoding br x-rq yyz2 85 188 443 accept-ranges bytes x-cache HIT date Sun, 01 Dec 2024 07:20:23 GMT content-type application/javascript vary Accept-Encoding server nginx last-modified Wed, 23 Oct 2024 21:53:57 GMT
GET H2	200	e-202448.js Show response stats.wp.com/	7 KB 3 KB	93ms 23ms	Script application/javascript	192.0.76.3 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://stats.wp.com/e-202448.js Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 5badd609a51ede5bab5b89534fc3011a4dd1ab487cc7081d7cf38479bcbab855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers cache-control max-age=31536000 content-encoding br x-nc HIT yyz etag W/14421-1717166113433.13 x-minify t x-minify-cache hit access-control-allow-methods GET, HEAD expires Sun, 23 Nov 2025 19:03:15 GMT access-control-allow-origin * alt-svc h3=":443"; ma=86400 date Sun, 01 Dec 2024 07:20:23 GMT content-type application/javascript vary Accept-Encoding server nginx
GET DATA	200 OK	truncated /	577 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash b556aa0c99a333220bef9718a277f81139f356534c0c707430252f445f769b8b Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	436 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 242aa88120783594cb0c56ff247407db601e2a09c4f598f7c7d40b9b2ba6369e Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	1 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 63ccbd40f783b34fe6bc9ef9e971de08e32012b91ee81dd54b325ecf527c1dac Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	1 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash c2bf4235c36480dd023ae5a3161be4b1d3c5f4728c753788d43530cece558812 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer Response headers Content-Type image/svg+xml
GET H2	200	08d5edde926eb9c13cb36804ee5e5316 secure.gravatar.com/avatar/	8 KB 8 KB	84ms 27ms	Image image/png	2a04:fa87:fffe::c000:4902 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://secure.gravatar.com/avatar/08d5edde926eb9c13cb36804ee5e5316?s=300&d=identicon&r=g Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 016866ad938900c3dbcd4b1c23e3db3b800d3a53381c9afa315fa8c1a952710f Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers link <https://gravatar.com/avatar/08d5edde926eb9c13cb36804ee5e5316?s=300&d=identicon&r=g>; rel="canonical" cache-control max-age=300 x-nc HIT yyz 1 expires Sun, 01 Dec 2024 07:25:23 GMT accept-ranges bytes access-control-allow-origin * alt-svc h3=":443"; ma=86400 content-length 7985 date Sun, 01 Dec 2024 07:20:23 GMT content-type image/png last-modified Tue, 14 Jun 2016 22:00:20 GMT server nginx content-disposition inline; filename="08d5edde926eb9c13cb36804ee5e5316.png"
GET H3	200	worker-c3cc14a6c3dc9d613887420c3a8068efbr.js Show response dev.visualwebsiteoptimizer.com/cdn/edrv/	264 KB 64 KB	39ms 18ms	XHR text/javascript	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://dev.visualwebsiteoptimizer.com/cdn/edrv/worker-c3cc14a6c3dc9d613887420c3a8068efbr.js Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Protocol H3 Security QUIC, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software UploadServer / Resource Hash ae0f5f0a2b8fc13e4dbd08e586090db070b2a3375ec1cc3f92f05f3613495d70 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers x-goog-metageneration 1 content-encoding br x-goog-hash crc32c=j6x60Q==, md5=VtMUXT3sdX3VMgMfCn2K2g== etag "56d3145d3dec757dd532031f0a7d8ada" age 278607 x-goog-stored-content-encoding br alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-goog-stored-content-length 65275 date Thu, 28 Nov 2024 01:56:56 GMT last-modified Wed, 27 Nov 2024 10:42:19 GMT content-type text/javascript; charset=UTF-8 x-guploader-uploadid AFiumC7SPPmDqOH_KRhNdtGdtL62hO3yPdqkf0G8952yVXeNOZOTBhF59mTUhtUD31wtZ_5HmL91iK34uA cdn_cache_status hit cache-control public, max-age=31536000 x-goog-storage-class STANDARD accept-ranges bytes access-control-allow-origin * x-goog-generation 1732704139883925 content-length 65275 content-language en server UploadServer
GET H3	200	va_gq-43b3f943d713f757307d146d82ddbfeebr.js Show response dev.visualwebsiteoptimizer.com/cdn/edrv/	276 KB 72 KB	44ms 23ms	XHR text/javascript	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://dev.visualwebsiteoptimizer.com/cdn/edrv/va_gq-43b3f943d713f757307d146d82ddbfeebr.js Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Protocol H3 Security QUIC, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software UploadServer / Resource Hash ea0015308d6f22a419684d2a8ab788047f5aecba35a6e882dfc01d67cdf74599 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers x-goog-metageneration 1 content-encoding br x-goog-hash crc32c=gjauUQ==, md5=M3Mx9IZm88zoK4UQRmzB9A== etag "337331f48666f3cce82b8510466cc1f4" age 88447 x-goog-stored-content-encoding br alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-goog-stored-content-length 73214 date Sat, 30 Nov 2024 06:46:16 GMT last-modified Thu, 28 Nov 2024 13:53:09 GMT content-type text/javascript; charset=UTF-8 x-guploader-uploadid AFiumC60UwajldVZizYGxdxm_BHt4ryUE20maWYPY67yMODEcKKfOZ9u62UFNpeZMKJv3xdaQdM2vCi-Hg cdn_cache_status hit cache-control public, max-age=31536000 x-goog-storage-class STANDARD accept-ranges bytes access-control-allow-origin * x-goog-generation 1732801989033156 content-length 73214 content-language en server UploadServer
GET H2	200	v.gif dev.visualwebsiteoptimizer.com/	35 B 146 B	35ms 32ms	Image image/gif	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://dev.visualwebsiteoptimizer.com/v.gif?cd=0&a=622914&d=malwarebytes.com&u=DA3A0C5F46DD79D765AE694595A6D73D8&h=2095b35f966faa455998088b9c6653f9&t=false Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software gnv01c / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers cache-control public, max-age=43200 x-content-type-options nosniff via 1.1 google access-control-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 35 date Sun, 01 Dec 2024 07:20:22 GMT content-type image/gif server gnv01c
GET H2	200	locate Show response genesis.malwarebytes.com/api/v1/	391 B 573 B	180ms 33ms	XHR application/json	34.200.6.132 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://genesis.malwarebytes.com/api/v1/locate Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/_static/??-eJyVjEsOwjAMBS9Ea6hKWSHOkgQrOHLcqHYUldMTwQaxYznvM9DKEFYxFIPCNZIoRFzNbRGNJLYCpXqmAOmrGD7ZmPQA/wgyCSgyBqMnjp1+DfbAjH3nuLkN/W4dnCqagq/E9968T7d8PV2mZTofl3lOL1lASdA= Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.200.6.132 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-200-6-132.compute-1.amazonaws.com Software / Resource Hash 025c5aa5bad992e0bbdc209b80da1ae7556536ec3027b5378b4da37fcae42dd6 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers access-control-allow-origin https://www.malwarebytes.com content-length 391 date Sun, 01 Dec 2024 07:20:23 GMT content-type application/json vary Origin, Access-Control-Request-Method, Access-Control-Request-Headers
GET H2	200	g.gif pixel.wp.com/	50 B 177 B	49ms 28ms	Image image/gif	192.0.76.3 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://pixel.wp.com/g.gif?v=ext&blog=227197325&post=65746&tz=-8&srv=www.malwarebytes.com&hp=vip&j=1%3A14.0&host=www.malwarebytes.com&ref=&fcp=0&rand=0.2164563713097496 Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers cache-control no-cache access-control-allow-origin * content-length 50 alt-svc h3=":443"; ma=86400 date Sun, 01 Dec 2024 07:20:23 GMT content-type image/gif server nginx
GET		bd80d09a-3635-4ddc-892f-d1d1c949aafa https://www.malwarebytes.com/ Frame	0 0
GET H3	200	nc-7cdb3b78ccbe56ba7289374b6886a83ebr.js Show response dev.visualwebsiteoptimizer.com/cdn/edrv/	18 KB 6 KB	18ms 18ms	XHR text/javascript	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://dev.visualwebsiteoptimizer.com/cdn/edrv/nc-7cdb3b78ccbe56ba7289374b6886a83ebr.js Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Protocol H3 Security QUIC, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software UploadServer / Resource Hash 6299dee13c0035049e19a5a1ed77829246c7a85923144e9899bddc70f142d800 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers x-goog-metageneration 1 content-encoding br x-goog-hash crc32c=fhHsaA==, md5=jcYOQzAgcmpGVuJOP6oNeg== etag "8dc60e433020726a4656e24e3faa0d7a" age 88445 x-goog-stored-content-encoding br alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-goog-stored-content-length 5654 date Sat, 30 Nov 2024 06:46:18 GMT last-modified Thu, 28 Nov 2024 13:54:02 GMT content-type text/javascript; charset=UTF-8 x-guploader-uploadid AFiumC7CnS1cQmI4WVJxxmGf3LSR7w5zl6JSRTMmKiyQuWpsl8Y6guA4e2vyJm_nz2KcXEW3ifARx0q2Sw cdn_cache_status hit cache-control public, max-age=31536000 x-goog-storage-class STANDARD accept-ranges bytes access-control-allow-origin * x-goog-generation 1732802042380769 content-length 5654 content-language en server UploadServer
POST H2	202	event Show response plausible.io/api/	2 B 493 B	228ms 149ms	XHR text/plain	2400:52e0:1a00::1207:2 BunnyCDN BUNNYWAY
General Check archive.org Show headers Download Go to Full URL https://plausible.io/api/event Requested by Host: plausible.io URL: https://plausible.io/js/script.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2400:52e0:1a00::1207:2 Chicago, United States, ASN200325 (BunnyCDN BUNNYWAY, informacijske storitve d.o.o., SI), Reverse DNS Software BunnyCDN-IL1-1207 / Resource Hash 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Content-Type text/plain Referer https://www.malwarebytes.com/ Response headers x-request-id GAz8iWQRPNwLzDFx4aCR date Sun, 01 Dec 2024 07:20:23 GMT content-type text/plain; charset=utf-8 cdn-cachedat 12/01/2024 07:20:23 cdn-requestpullcode 202 cache-control must-revalidate, max-age=0, private cdn-requestpullsuccess True cdn-requesttime 0 cdn-uid 153cb5b1-399a-48ef-b5bf-098c03770254 cdn-requestid 0e249f784eaed11ff1fc37cd26748686 access-control-allow-credentials true cdn-pullzone 682664 cdn-proxyver 1.06 application 127.0.0.1 permissions-policy interest-cohort=() access-control-allow-origin * content-length 2 cdn-edgestorageid 1207 server BunnyCDN-IL1-1207 cdn-requestcountrycode CA
GET H/1.1	200 OK	count-data.js Show response malwarebytesunpacked.disqus.com/	355 B 938 B	18ms 17ms	Script application/javascript	199.232.192.134 FASTLY
General Check archive.org Show headers Download Go to Full URL https://malwarebytesunpacked.disqus.com/count-data.js?1=122797&1=123636&1=123860&1=123966&1=124027 Requested by Host: malwarebytesunpacked.disqus.com URL: https://malwarebytesunpacked.disqus.com/count.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 199.232.192.134 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash b83c44a9f6f0c8c87fe45d17f546ee17e4e438304e77577817f6b9e34ae9b60e Security Headers Name Value Strict-Transport-Security max-age=300; includeSubdomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers Strict-Transport-Security max-age=300; includeSubdomains Link <https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect Cache-Control public, max-age=600 Age 734 Connection keep-alive Cross-Origin-Resource-Policy cross-origin X-Content-Type-Options nosniff Content-Length 355 p3p CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM" X-XSS-Protection 1; mode=block Date Sun, 01 Dec 2024 07:20:23 GMT Content-Type application/javascript; charset=UTF-8 Vary Accept-Encoding Server nginx X-Frame-Options SAMEORIGIN
GET H3	200	s.gif dev.visualwebsiteoptimizer.com/	35 B 53 B	36ms 36ms	Image image/gif	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://dev.visualwebsiteoptimizer.com/s.gif?account_id=622914&u=DA3A0C5F46DD79D765AE694595A6D73D8&s=1733037622&ed=%7B%22sr%22%3A%221600x1200%22%2C%22sc%22%3A24%2C%22de%22%3A%22UTF-8%22%2C%22ul%22%3A%22en-ca%22%2C%22r%22%3A%22%22%2C%22lt%22%3A1733037623538%2C%22tO%22%3A8%2C%22tz%22%3A%22America%2FVancouver%22%7D&cu=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fnews%2F2018%2F07%2Fhidden-bee-miner-delivered-via-improved-drive-by-download-toolkit&r=0&p=1&cq=0&vn=undefined&vns=undefined&vno=undefined&eTime=1733037622551&v=06a8cd236 Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Protocol H3 Security QUIC, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software gnv01c / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate pragma no-cache x-content-type-options nosniff via 1.1 google expires Mon, 10 Jan 2005 00:00:01 GMT access-control-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 35 date Sun, 01 Dec 2024 07:20:22 GMT content-type image/gif server gnv01c
GET H2	200	otSDKStub.js Show response cdn.cookielaw.org/scripttemplates/	22 KB 8 KB	78ms 28ms	Script application/javascript	2606:4700::6812:572a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/otSDKStub.js Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ade920fd5b00cd298aae7978673a9a64d0bb3fa593d23e91994ec6b6723ebace Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers content-md5 I15No2k5QFmqh89BwOau4g== access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding content-encoding gzip x-ms-version 2009-09-19 etag 0x8DD0F9105A60415 x-ms-lease-status unlocked cf-cache-status HIT age 5839 x-content-type-options nosniff date Sun, 01 Dec 2024 07:20:23 GMT content-type application/javascript last-modified Thu, 28 Nov 2024 09:42:49 GMT vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control max-age=86400 cross-origin-resource-policy cross-origin x-ms-request-id 625ec09f-001e-002e-0e10-42134d000000 cf-ray 8eb1507ba80da24e-YUL accept-ranges bytes access-control-allow-origin * content-length 7212 x-ms-blob-type BlockBlob server cloudflare
GET H/1.1	200 OK	/ disqus.com/embed/comments/ Frame D1ED	0 0	149ms 93ms	Document text/html	151.101.128.134 FASTLY
General Check archive.org Show headers Download Go to Full URL https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=230422&t_u=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fnews%2F2018%2F07%2Fhidden-bee-miner-delivered-via-improved-drive-by-download-toolkit&t_d=%E2%80%98Hidden%20Bee%E2%80%99%20miner%20delivered%20via%20improved%20drive-by%20download%20toolkit&t_t=%E2%80%98Hidden%20Bee%E2%80%99%20miner%20delivered%20via%20improved%20drive-by%20download%20toolkit&s_o=default Requested by Host: malwarebytesunpacked.disqus.com URL: https://malwarebytesunpacked.disqus.com/embed.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 151.101.128.134 San Francisco, United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash Security Headers Name Value Content-Security-Policy script-src https://*.twitter.com:* https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://*.services.disqus.com:* https://cdn.boomtrain.com/p13n/ https://com-disqus.netmng.com:* 'unsafe-inline' https://referrer.disqus.com/juggler/ https://connect.facebook.net/en_US/sdk.js https://cdn.syndication.twimg.com/tweets.json https://apis.google.com https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com Strict-Transport-Security max-age=300; includeSubdomains X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://www.malwarebytes.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers Age 0 Cache-Control stale-if-error=3600, s-stalewhilerevalidate=3600, stale-while-revalidate=30, no-cache, must-revalidate, public, s-maxage=5 Connection keep-alive Content-Encoding gzip Content-Length 4060 Content-Security-Policy script-src https://*.twitter.com:* https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://*.services.disqus.com:* https://cdn.boomtrain.com/p13n/ https://com-disqus.netmng.com:* 'unsafe-inline' https://referrer.disqus.com/juggler/ https://connect.facebook.net/en_US/sdk.js https://cdn.syndication.twimg.com/tweets.json https://apis.google.com https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com Content-Type text/html; charset=utf-8 Cross-Origin-Resource-Policy cross-origin Date Sun, 01 Dec 2024 07:20:23 GMT ETag W/"lounge:view:9918121321.3e654e0f07e13acf32846033d23d5dc3.2" Last-Modified Thu, 01 Feb 2024 09:08:53 GMT Link <https://c.disquscdn.com>;rel=preconnect,<https://c.disquscdn.com>;rel=dns-prefetch Referrer-Policy no-referrer-when-downgrade Server nginx Strict-Transport-Security max-age=300; includeSubdomains Timing-Allow-Origin * Vary Accept-Encoding X-Content-Type-Options nosniff X-XSS-Protection 1; mode=block p3p CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
GET H3	200	track-eb77ef60884291c678179663e7024027br.js Show response dev.visualwebsiteoptimizer.com/cdn/7.0/	17 KB 5 KB	19ms 18ms	Script text/javascript	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://dev.visualwebsiteoptimizer.com/cdn/7.0/track-eb77ef60884291c678179663e7024027br.js Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Protocol H3 Security QUIC, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software UploadServer / Resource Hash b93b8bc30d7116c14216723b9f3f9021a1eb15ce3c44987c138c73a1e2bb068b Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers x-goog-metageneration 1 content-encoding br x-goog-hash crc32c=ZjPV4Q==, md5=KVTT9bP41CHixIfOkbcFtw== etag "2954d3f5b3f8d421e2c487ce91b705b7" age 70150 x-goog-stored-content-encoding br alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-goog-stored-content-length 4845 date Sat, 30 Nov 2024 11:51:13 GMT last-modified Sat, 30 Nov 2024 10:20:16 GMT content-type text/javascript; charset=UTF-8 x-guploader-uploadid AFiumC6EDiBL2orvf72gYCs0ZrJejIP-InFyc9YIndptynORWSWew7fJDlUgGgZkDFTqwIbiUaN0AEy6ug cdn_cache_status hit cache-control public, max-age=31536000 x-goog-storage-class STANDARD accept-ranges bytes access-control-allow-origin * x-goog-generation 1732962016128347 content-length 4845 content-language en server UploadServer
GET H3	200	opa-ecf25b21ebb11aef88a2f98af67e5f85br.js Show response dev.visualwebsiteoptimizer.com/cdn/analysis/4.0/	157 KB 40 KB	20ms 19ms	Script text/javascript	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://dev.visualwebsiteoptimizer.com/cdn/analysis/4.0/opa-ecf25b21ebb11aef88a2f98af67e5f85br.js Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Protocol H3 Security QUIC, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software UploadServer / Resource Hash 32f40b8bc8e2ca8b2a2822d6378716b9b130575afe39b51e764bcaa5d357575a Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers x-goog-metageneration 1 content-encoding br x-goog-hash crc32c=Md5CSQ==, md5=BY3q3XFcoJRgei/SQSwWMA== etag "058deadd715ca094607a2fd2412c1630" age 650257 x-goog-stored-content-encoding br alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-goog-stored-content-length 40448 date Sat, 23 Nov 2024 18:42:46 GMT last-modified Mon, 18 Nov 2024 15:33:22 GMT content-type text/javascript; charset=UTF-8 x-guploader-uploadid AFiumC5WPgHsSfiH-7nHiPLvkHyPJYxCPYzbnaLPC-uvzGThYFazP9ZFpj8ub9yd81sBEO-l7FNIK5WE7Q cdn_cache_status hit cache-control public, max-age=31536000 x-goog-storage-class STANDARD accept-ranges bytes access-control-allow-origin * x-goog-generation 1731944002067936 content-length 40448 content-language en server UploadServer
GET H2	200	82971089-2677-4e1e-8fab-44444f76330b.json Show response cdn.cookielaw.org/consent/82971089-2677-4e1e-8fab-44444f76330b/	7 KB 3 KB	69ms 33ms	XHR application/json	2606:4700::6812:572a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/consent/82971089-2677-4e1e-8fab-44444f76330b/82971089-2677-4e1e-8fab-44444f76330b.json Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e1076e28bf1095b534cec675b71f48f79e71571b0d1e0b6299bfc1598a16b8b3 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers content-md5 LOjydsZgVdt5i4x1RnXibg== access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding content-encoding gzip cf-cache-status HIT etag 0x8DC420742BB00AF age 39867 x-ms-lease-status unlocked x-content-type-options nosniff x-ms-version 2009-09-19 expires Mon, 02 Dec 2024 07:20:23 GMT date Sun, 01 Dec 2024 07:20:23 GMT content-type application/json last-modified Mon, 11 Mar 2024 20:10:13 GMT vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=86400 cross-origin-resource-policy cross-origin, cross-origin x-ms-request-id a522fa5c-101e-0018-144c-26be1f000000 cf-ray 8eb1507c18d4a29e-YUL accept-ranges bytes access-control-allow-origin * content-length 1953 x-ms-blob-type BlockBlob server cloudflare
POST H3	200	s.gif dev.visualwebsiteoptimizer.com/	35 B 53 B	35ms 35ms	Ping image/gif	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://dev.visualwebsiteoptimizer.com/s.gif?account_id=622914&u=DA3A0C5F46DD79D765AE694595A6D73D8&s=1733037622&p=1&update=1&cq=1&ttl=90&vn=undefined&vns=undefined&vno=undefined&eTime=1733037622666&v=06a8cd236&_cu=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fnews%2F2018%2F07%2Fhidden-bee-miner-delivered-via-improved-drive-by-down&random=0.03169416468628916 Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Protocol H3 Security QUIC, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software gnv01c / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate pragma no-cache x-content-type-options nosniff via 1.1 google expires Mon, 10 Jan 2005 00:00:01 GMT access-control-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 35 date Sun, 01 Dec 2024 07:20:23 GMT content-type image/gif server gnv01c
GET H3	200	worker-70faafffa0475802f5ee03ca5ff74179br.js Show response dev.visualwebsiteoptimizer.com/cdn/analysis/4.0/	46 KB 13 KB	19ms 19ms	XHR text/javascript	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://dev.visualwebsiteoptimizer.com/cdn/analysis/4.0/worker-70faafffa0475802f5ee03ca5ff74179br.js Requested by Host: dev.visualwebsiteoptimizer.com URL: https://dev.visualwebsiteoptimizer.com/cdn/analysis/4.0/opa-ecf25b21ebb11aef88a2f98af67e5f85br.js Protocol H3 Security QUIC, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software UploadServer / Resource Hash 09b67475f266dbf552159ca9f6b44d9dc3ea04842b2bd6e8b09d74f6b21897d0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers x-goog-metageneration 1 content-encoding br x-goog-hash crc32c=t9nekA==, md5=OTBW++nqbotSERjfhuer5A== etag "393056fbe9ea6e8b521118df86e7abe4" age 730278 x-goog-stored-content-encoding br alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-goog-stored-content-length 13401 date Fri, 22 Nov 2024 20:29:05 GMT last-modified Mon, 18 Nov 2024 15:33:36 GMT content-type text/javascript; charset=UTF-8 x-guploader-uploadid AFiumC7MiA0MiBngXivIjff72h-EQegeX4fue1uuEXhay9qKBxpMXktgQZH9vdPpMjdumdAuLU0 cdn_cache_status hit cache-control public, max-age=31536000 x-goog-storage-class STANDARD accept-ranges bytes access-control-allow-origin * x-goog-generation 1731944016327387 content-length 13401 content-language en server UploadServer
GET H3	200	s.gif dev.visualwebsiteoptimizer.com/	35 B 53 B	34ms 33ms	Image image/gif	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://dev.visualwebsiteoptimizer.com/s.gif?account_id=622914&u=DA3A0C5F46DD79D765AE694595A6D73D8&s=1733037622&p=1&tags={%22si%22:{%221%22:%221%22}}&eg=1&update=1&cq=1&ttl=90&vn=undefined&vns=undefined&vno=undefined&eTime=1733037622704&v=06a8cd236&_cu=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fnews%2F2018%2F07%2Fhidden-bee-miner-delivered-via-improved-drive-by-down Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Protocol H3 Security QUIC, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software gnv01c / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate pragma no-cache x-content-type-options nosniff via 1.1 google expires Mon, 10 Jan 2005 00:00:01 GMT access-control-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 35 date Sun, 01 Dec 2024 07:20:23 GMT content-type image/gif server gnv01c
GET H2	200	location Show response geolocation.onetrust.com/cookieconsentpub/v1/geo/	59 B 295 B	86ms 36ms	XHR application/json	2606:4700:4400::6812:2089 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:2089 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash db0da7efe3ac5fc9e598f71e291326f137ea7bbbf97fed4fee0e86b717b0d9a8 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 accept application/json Referer https://www.malwarebytes.com/ Response headers strict-transport-security max-age=31536000; includeSubDomains; preload content-encoding gzip access-control-allow-methods GET, OPTIONS cf-ray 8eb1507caccfa272-YUL access-control-allow-origin * date Sun, 01 Dec 2024 07:20:23 GMT content-type application/json vary Accept-Encoding server cloudflare access-control-allow-headers Content-Type
GET H3	200	s.gif dev.visualwebsiteoptimizer.com/	35 B 53 B	35ms 35ms	Image image/gif	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://dev.visualwebsiteoptimizer.com/s.gif?account_id=622914&u=DA3A0C5F46DD79D765AE694595A6D73D8&s=1733037622&p=1&tags={%22si%22:{%22161%22:%221%22,%22472%22:%221%22}}&eg=19,22&update=1&cq=1&ttl=90&vn=undefined&vns=undefined&vno=undefined&eTime=1733037622745&v=06a8cd236&_cu=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fnews%2F2018%2F07%2Fhidden-bee-miner-delivered-via-improved-drive-by-down Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Protocol H3 Security QUIC, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software gnv01c / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate pragma no-cache x-content-type-options nosniff via 1.1 google expires Mon, 10 Jan 2005 00:00:01 GMT access-control-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 35 date Sun, 01 Dec 2024 07:20:23 GMT content-type image/gif server gnv01c
GET H2	200	otBannerSdk.js Show response cdn.cookielaw.org/scripttemplates/202402.1.0/	430 KB 105 KB	28ms 28ms	Script application/javascript	2606:4700::6812:572a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/202402.1.0/otBannerSdk.js Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e912efba4dd82b798fb061f872b0016687932d1648098f501dff644a7ad77a35 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers content-md5 XwXx/WxMZ+UJJ5CmkZRGfQ== access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding content-encoding gzip x-ms-version 2009-09-19 etag 0x8DCA5DEBBF484DE x-ms-lease-status unlocked cf-cache-status HIT age 82392 x-content-type-options nosniff date Sun, 01 Dec 2024 07:20:23 GMT content-type application/javascript last-modified Tue, 16 Jul 2024 21:32:03 GMT vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control max-age=86400 cross-origin-resource-policy cross-origin x-ms-request-id f24cf9b1-701e-0008-0372-3288f9000000 cf-ray 8eb1507ce8d6a24e-YUL accept-ranges bytes access-control-allow-origin * content-length 106948 x-ms-blob-type BlockBlob server cloudflare
GET H2	200	en.json Show response cdn.cookielaw.org/consent/82971089-2677-4e1e-8fab-44444f76330b/018e2f1e-12b2-7a41-ab63-6c6e010fa4d9/	108 KB 26 KB	33ms 33ms	Fetch application/json	2606:4700::6812:572a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/consent/82971089-2677-4e1e-8fab-44444f76330b/018e2f1e-12b2-7a41-ab63-6c6e010fa4d9/en.json Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/202402.1.0/otBannerSdk.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c8bd9aa9a411bd3248cea9f41fa191e5b57a31528dbb92663fb5191375938bcd Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers content-md5 BhZPJjb/noHRZ0epWvH2Fw== access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding content-encoding gzip cf-cache-status HIT etag 0x8DC420751763AC1 age 38615 x-ms-lease-status unlocked x-content-type-options nosniff x-ms-version 2009-09-19 expires Mon, 02 Dec 2024 07:20:23 GMT date Sun, 01 Dec 2024 07:20:23 GMT content-type application/json last-modified Mon, 11 Mar 2024 20:10:37 GMT vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=86400 cross-origin-resource-policy cross-origin, cross-origin x-ms-request-id 559d7544-d01e-00a4-694c-26a96e000000 cf-ray 8eb1507d496ca29e-YUL accept-ranges bytes access-control-allow-origin * content-length 26286 x-ms-blob-type BlockBlob server cloudflare
POST H3	200	collect www.google.com/ccm/	0 0	116ms 47ms	Ping text/plain	142.251.167.106 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google.com/ccm/collect?en=page_view&dl=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fnews%2F2018%2F07%2Fhidden-bee-miner-delivered-via-improved-drive-by-download-toolkit&scrsrc=www.googletagmanager.com&frm=0&rnd=1762119216.1733037624&auid=1294949687.1733037624&npa=0&gtm=45He4bk0v6688972za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101925629~102067555~102067808~102077855~102081485&tft=1733037623947&tfd=1669&apve=1 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKSKW3 Protocol H3 Security QUIC, , AES_128_GCM Server 142.251.167.106 Farmingdale, United States, ASN15169 (GOOGLE, US), Reverse DNS ww-in-f106.1e100.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers
GET H2	200	js Show response www.googletagmanager.com/gtag/	447 KB 134 KB	42ms 41ms	Script application/javascript	2607:f8b0:4004:c17::61 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=G-K8KCHE3KSC&l=dataLayer&cx=c&gtm=45He4bk0v6688972za200 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKSKW3 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4004:c17::61 Washington, United States, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 4130c66385823a5191100e6b676ce5b773371b513502a0ad8fcba75701104319 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers content-encoding br report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],} expires Sun, 01 Dec 2024 07:20:23 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Sun, 01 Dec 2024 07:20:23 GMT content-type application/javascript; charset=UTF-8 vary Accept-Encoding access-control-allow-headers Cache-Control strict-transport-security max-age=31536000; includeSubDomains cache-control private, max-age=900 cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0 access-control-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 136910 x-xss-protection 0 server Google Tag Manager
GET H2	200	malwarebytes.min.js Show response d2jjzw81hqbuqv.cloudfront.net/integration/clients/	48 KB 12 KB	108ms 30ms	Script text/javascript	18.173.132.16 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://d2jjzw81hqbuqv.cloudfront.net/integration/clients/malwarebytes.min.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKSKW3 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.173.132.16 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-173-132-16.jfk52.r.cloudfront.net Software AmazonS3 / Resource Hash 1736caa3ec3624ef03489ccb312c41dbc3297ecb219b767f03fe12f5eedbebc0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers vary accept-encoding, Origin cache-control max-age=600, public content-encoding gzip etag W/"1ccb86b54f7636df0108da8892b28e31" age 20 via 1.1 79985f6b7b9f366996e2a85ef814999e.cloudfront.net (CloudFront) expires Sat, 30 Nov 2024 07:05:05 GMT x-cache Hit from cloudfront x-amz-cf-id HwgWiZ7FwM4V2OzABuECRYerJuvAtEaWohdsrKKL7O1hVJmG4ddonA== date Sun, 01 Dec 2024 07:20:05 GMT content-type text/javascript last-modified Sat, 30 Nov 2024 06:55:06 GMT server AmazonS3 x-amz-cf-pop JFK52-P2 x-amz-server-side-encryption AES256
GET H2	200	insight.min.js Show response snap.licdn.com/li.lms-analytics/	1 KB 981 B	144ms 32ms	Script application/javascript	2600:1408:c400:5::17c7:3719 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Full URL https://snap.licdn.com/li.lms-analytics/insight.min.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKSKW3 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2600:1408:c400:5::17c7:3719 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS Software / Resource Hash 3628be465ec3d28413b23bd425c36d30ab28016eb5f6d2f702ca7f5ae883e93f Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers cache-control max-age=27013 content-encoding gzip x-cdn AKAM x-content-type-options nosniff accept-ranges bytes content-length 771 date Sun, 01 Dec 2024 07:20:24 GMT last-modified Tue, 26 Nov 2024 13:42:29 GMT content-type application/javascript;charset=utf-8 vary Accept-Encoding x-amz-server-side-encryption AES256
GET H2	200	bat.js Show response bat.bing.com/	50 KB 15 KB	128ms 47ms	Script application/javascript	2620:1ec:33:1::10 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://bat.bing.com/bat.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKSKW3 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash aabc88a6db8b22022f96ca88e4f0a7be426abef2b35169a71515a2d55246402a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers strict-transport-security max-age=31536000; includeSubDomains; preload cache-control private,max-age=1800 content-encoding gzip etag "028e0691d20db1:0" accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: 2D17F145709D4C2396CD3B2E638475EF Ref B: YMQ01EDGE0814 Ref C: 2024-12-01T07:20:24Z accept-ranges bytes x-cache CONFIG_NOCACHE content-length 14570 date Sun, 01 Dec 2024 07:20:23 GMT content-type application/javascript last-modified Wed, 16 Oct 2024 22:47:44 GMT vary Accept-Encoding
GET H2	200	destination Show response www.googletagmanager.com/gtag/	296 KB 101 KB	53ms 53ms	Script application/javascript	2607:f8b0:4004:c17::61 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/destination?id=AW-407675570&l=dataLayer&cx=c&gtm=45He4bk0v6688972za200 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKSKW3 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4004:c17::61 Washington, United States, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 3bdfd2e4182d741be5594970542157f9b1b63ce6e89a00ebd7a0d9e64eebbf90 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers content-encoding br report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcysghrgc:42:0"}],} expires Sun, 01 Dec 2024 07:20:23 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Sun, 01 Dec 2024 07:20:23 GMT content-type application/javascript; charset=UTF-8 vary Accept-Encoding last-modified Sun, 01 Dec 2024 06:00:00 GMT access-control-allow-headers Cache-Control strict-transport-security max-age=31536000; includeSubDomains cache-control private, max-age=900 cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcysghrgc:42:0 access-control-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 102649 x-xss-protection 0 server Google Tag Manager
GET H/1.1	200 OK	munchkin.js Show response munchkin.marketo.net/	1 KB 1 KB	162ms 43ms	Script application/x-javascript	23.13.172.203 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://munchkin.marketo.net/munchkin.js Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 23.13.172.203 Ashburn, United States, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-13-172-203.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash a2091f1ff92cc073e178dca31707853e0cc6cd913a5344a8978f040fa373efa6 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers Content-Encoding gzip ETag "e75e5ba140b1c7e6ea79786633c1ba0d:1731465879.778595" Connection keep-alive Accept-Ranges bytes P3P policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR" Content-Length 741 Date Sun, 01 Dec 2024 07:20:24 GMT Content-Type application/x-javascript Last-Modified Wed, 13 Nov 2024 02:44:39 GMT Server AkamaiNetStorage Vary Accept-Encoding
GET H2	200	js Show response www.googletagmanager.com/gtag/	296 KB 100 KB	62ms 62ms	Script application/javascript	2607:f8b0:4004:c17::61 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=AW-930356311 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKSKW3 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4004:c17::61 Washington, United States, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 79211a218c32d3cd5e9883b2c02c7333f0e348be99efec2cdb2a99888a00e5b9 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers content-encoding br report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],} expires Sun, 01 Dec 2024 07:20:23 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Sun, 01 Dec 2024 07:20:23 GMT content-type application/javascript; charset=UTF-8 vary Accept-Encoding last-modified Sun, 01 Dec 2024 06:00:00 GMT access-control-allow-headers Cache-Control strict-transport-security max-age=31536000; includeSubDomains cache-control private, max-age=900 cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0 access-control-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 102678 x-xss-protection 0 server Google Tag Manager
GET H2	200	otPcPanel.json Show response cdn.cookielaw.org/scripttemplates/202402.1.0/assets/v2/	64 KB 13 KB	29ms 28ms	Fetch application/json	2606:4700::6812:572a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/202402.1.0/assets/v2/otPcPanel.json Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/202402.1.0/otBannerSdk.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0ed759f9b0f407aa73df997bddf186c37a1927d2b0f8d2f7031067ecacf7581d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers content-md5 Hx2FPnZ0+GDc+xiJF4si9A== access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding content-encoding gzip x-ms-version 2009-09-19 etag 0x8DCA5DEB854B960 x-ms-lease-status unlocked cf-cache-status HIT age 70630 x-content-type-options nosniff date Sun, 01 Dec 2024 07:20:23 GMT content-type application/json last-modified Tue, 16 Jul 2024 21:31:57 GMT vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control max-age=86400 cross-origin-resource-policy cross-origin x-ms-request-id cee9b637-d01e-0005-0e02-2467f5000000 cf-ray 8eb1507de9c1a29e-YUL accept-ranges bytes access-control-allow-origin * content-length 12960 x-ms-blob-type BlockBlob server cloudflare
GET H2	200	otCommonStyles.css Show response cdn.cookielaw.org/scripttemplates/202402.1.0/assets/	21 KB 4 KB	29ms 29ms	Fetch text/css	2606:4700::6812:572a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/202402.1.0/assets/otCommonStyles.css Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/202402.1.0/otBannerSdk.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d3f7b0ec4de079928a999641e781e80f33597a392a561bc460276dfb4efb6eec Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers content-md5 c7xAZ9MSGAobGaTYg/Qtag== access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding x-ms-version 2009-09-19 x-ms-lease-status unlocked cf-cache-status HIT age 72399 content-encoding gzip x-content-type-options nosniff date Sun, 01 Dec 2024 07:20:23 GMT content-type text/css last-modified Tue, 16 Jul 2024 21:32:07 GMT vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control max-age=86400 cross-origin-resource-policy cross-origin x-ms-request-id ea71daef-f01e-00de-6d20-30c323000000 cf-ray 8eb1507de9c2a29e-YUL access-control-allow-origin * x-ms-blob-type BlockBlob server cloudflare
GET H2	200	sw_iframe.html www.googletagmanager.com/static/service_worker/4bj0/ Frame 8F45	0 0	93ms 32ms	Document text/html	2607:f8b0:4004:c17::61 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/static/service_worker/4bj0/sw_iframe.html?origin=https%3A%2F%2Fwww.malwarebytes.com Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKSKW3 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4004:c17::61 Washington, United States, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers accept-ranges bytes age 210088 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 cache-control public, max-age=31536000 content-encoding br content-length 1476 content-type text/html cross-origin-opener-policy same-origin; report-to="analytics-container-tag-serving" cross-origin-resource-policy cross-origin date Thu, 28 Nov 2024 20:58:56 GMT expires Fri, 28 Nov 2025 20:58:56 GMT last-modified Tue, 19 Nov 2024 10:38:00 GMT report-to {"group":"analytics-container-tag-serving","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/analytics-container-tag-serving"}]} server sffe service-worker-allowed /static/service_worker vary Accept-Encoding x-content-type-options nosniff x-xss-protection 0
GET H2	200	ot_guard_logo.svg Show response cdn.cookielaw.org/logos/static/	497 B 518 B	25ms 25ms	Fetch image/svg+xml	2606:4700::6812:572a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/logos/static/ot_guard_logo.svg Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/202402.1.0/otBannerSdk.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 691dcdb24853a0f5ce4e6597e5713dea66799b57ffe2c2a10f28f98e0b569b19 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers content-md5 tXyZydHjxQshFMbbBT1/8A== access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding x-ms-version 2009-09-19 x-ms-lease-status unlocked cf-cache-status HIT age 24309 content-encoding gzip x-content-type-options nosniff date Sun, 01 Dec 2024 07:20:24 GMT content-type image/svg+xml last-modified Thu, 28 Nov 2024 09:42:51 GMT vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control max-age=86400 cross-origin-resource-policy cross-origin x-ms-request-id b5a3faf1-d01e-00c9-231e-420340000000 cf-ray 8eb1507e39e6a29e-YUL access-control-allow-origin * x-ms-blob-type BlockBlob server cloudflare
GET H2	200	MWB_logo_horizontal_RGB.png cdn.cookielaw.org/logos/4e1c8bc8-2743-413b-8699-aad2216e8616/3be7f101-47f0-48ab-ae22-e34efabb8a62/9b43fe5c-b22b-40eb-9d38-57e36d038e98/	46 KB 46 KB	30ms 29ms	Image image/png	2606:4700::6812:572a CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.cookielaw.org/logos/4e1c8bc8-2743-413b-8699-aad2216e8616/3be7f101-47f0-48ab-ae22-e34efabb8a62/9b43fe5c-b22b-40eb-9d38-57e36d038e98/MWB_logo_horizontal_RGB.png Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash fdf7a139210ad25e0576a0721d45086e047dee38f88ba2995ce745643212c532 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers content-md5 g65E4kh32bbdSPqSevAl8Q== access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding x-ms-version 2009-09-19 x-ms-lease-status unlocked etag 0x8DA459D0252D23C age 67689 cf-cache-status HIT x-content-type-options nosniff date Sun, 01 Dec 2024 07:20:24 GMT content-type image/png last-modified Fri, 03 Jun 2022 20:09:47 GMT vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control max-age=86400 cross-origin-resource-policy cross-origin x-ms-request-id 04442ed1-701e-0008-4453-cd88f9000000 cf-ray 8eb1507e4999a24e-YUL accept-ranges bytes access-control-allow-origin * content-length 47111 x-ms-blob-type BlockBlob server cloudflare
GET H2	200	powered_by_logo.svg cdn.cookielaw.org/logos/static/	5 KB 2 KB	31ms 30ms	Image image/svg+xml	2606:4700::6812:572a CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.cookielaw.org/logos/static/powered_by_logo.svg Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers content-md5 Y+c301RBZNK39PvKQWrIBw== access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding x-ms-version 2009-09-19 x-ms-lease-status unlocked cf-cache-status HIT age 84936 content-encoding gzip x-content-type-options nosniff date Sun, 01 Dec 2024 07:20:24 GMT content-type image/svg+xml last-modified Thu, 28 Nov 2024 09:42:52 GMT vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control max-age=86400 cross-origin-resource-policy cross-origin x-ms-request-id 43620a73-701e-008b-2eea-412854000000 cf-ray 8eb1507e499aa24e-YUL access-control-allow-origin * x-ms-blob-type BlockBlob server cloudflare
POST H2	204	collect analytics.google.com/g/	0 0	97ms 42ms	Fetch text/plain	2001:4860:4802:34::181 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://analytics.google.com/g/collect?v=2&tid=G-K8KCHE3KSC&gtm=45je4bk0v872204243z86688972za200zb6688972&_p=1733037623101&_gaz=1&gcs=G1--&gcd=13l3l3R3l5l1&npa=0&dma=0&tag_exp=101925629~102067555~102067808~102077855~102081485&gdid=dYWJhMj&cid=655095388.1733037624&ul=en-ca&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&pae=1&frm=0&pscdl=noapi&_eu=EA&_s=1&dl=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fnews%2F2018%2F07%2Fhidden-bee-miner-delivered-via-improved-drive-by-download-toolkit&sid=1733037624&sct=1&seg=0&dt=%27Hidden%20Bee%27%20miner%20delivered%20via%20improved%20drive-by%20download%20toolkit%20%7C%20Malwarebytes%20Labs&en=page_view&_fv=1&_nsi=1&_ss=1&ep.content_group=Blog&tfd=1866 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-K8KCHE3KSC&l=dataLayer&cx=c&gtm=45He4bk0v6688972za200 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4860:4802:34::181 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers cache-control no-cache, no-store, must-revalidate pragma no-cache cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0 report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0"}],} expires Fri, 01 Jan 1990 00:00:00 GMT access-control-allow-origin https://www.malwarebytes.com cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Sun, 01 Dec 2024 07:20:24 GMT content-type text/plain server Golfe2
POST H2	204	collect stats.g.doubleclick.net/g/	0 558 B	107ms 39ms	Ping text/plain	2607:f8b0:4004:c1b::9d GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/g/collect?v=2&tid=G-K8KCHE3KSC&cid=655095388.1733037624&gtm=45je4bk0v872204243z86688972za200zb6688972&aip=1&dma=0&gcs=G1--&gcd=13l3l3R3l5l1&npa=0&frm=0&tag_exp=101925629~102067555~102067808~102077855~102081485 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-K8KCHE3KSC&l=dataLayer&cx=c&gtm=45He4bk0v6688972za200 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4004:c1b::9d Washington, United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers cache-control no-cache, no-store, must-revalidate pragma no-cache cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:111:0 report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:111:0"}],} expires Fri, 01 Jan 1990 00:00:00 GMT access-control-allow-origin https://www.malwarebytes.com cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Sun, 01 Dec 2024 07:20:24 GMT content-type text/plain server Golfe2
GET H2	200	rul td.doubleclick.net/td/ga/ Frame 5FD7	0 0	113ms 50ms	Document text/html	2607:f8b0:4004:c21::9d GOOGLE
General Check archive.org Show headers Download Go to Full URL https://td.doubleclick.net/td/ga/rul?tid=G-K8KCHE3KSC&gacid=655095388.1733037624&gtm=45je4bk0v872204243z86688972za200zb6688972&dma=0&gcs=G1--&gcd=13l3l3R3l5l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=101925629~102067555~102067808~102077855~102081485&z=2106674726 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-K8KCHE3KSC&l=dataLayer&cx=c&gtm=45He4bk0v6688972za200 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4004:c21::9d Washington, United States, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.malwarebytes.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 cache-control no-cache, must-revalidate content-encoding br content-length 16 content-type text/html; charset=UTF-8 cross-origin-resource-policy cross-origin date Sun, 01 Dec 2024 07:20:24 GMT expires Fri, 01 Jan 1990 00:00:00 GMT p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" pragma no-cache server cafe timing-allow-origin * x-content-type-options nosniff x-xss-protection 0
GET H3	200	ga-audiences www.google.ca/ads/	42 B 63 B	92ms 48ms	Image image/gif	142.251.16.94 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.ca/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-K8KCHE3KSC&cid=655095388.1733037624&gtm=45je4bk0v872204243z86688972za200zb6688972&aip=1&dma=0&gcs=G1--&gcd=13l3l3R3l5l1&npa=0&frm=0&tag_exp=101925629~102067555~102067808~102077855~102081485&tag_exp=101925629~102067555~102067808~102077855~102081485&z=1236932227 Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Protocol H3 Security QUIC, , AES_128_GCM Server 142.251.16.94 Farmingdale, United States, ASN15169 (GOOGLE, US), Reverse DNS bl-in-f94.1e100.net Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers cache-control no-cache, no-store, must-revalidate timing-allow-origin * pragma no-cache cross-origin-resource-policy cross-origin x-content-type-options nosniff expires Fri, 01 Jan 1990 00:00:00 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" content-length 42 date Sun, 01 Dec 2024 07:20:24 GMT x-xss-protection 0 content-type image/gif server cafe
POST H3	200	407675570 google.com/pagead/form-data/	0 0	126ms 43ms	Ping text/html	142.250.31.101 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://google.com/pagead/form-data/407675570?gtm=45be4bk0pfv9137103858z86688972za201zb6688972&gcs=G1--&gcd=13l3l3R3l5l1&dma=0&tag_exp=101925629~102067555~102067808~102077855~102081485&did=dYWJhMj&gdid=dYWJhMj&npa=0&frm=0&pscdl=noapi&auid=1294949687.1733037624&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&ec_mode=a&em=tv.1 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/destination?id=AW-407675570&l=dataLayer&cx=c&gtm=45He4bk0v6688972za200 Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.31.101 , United States, ASN15169 (GOOGLE, US), Reverse DNS bj-in-f101.1e100.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers
POST H3	204	407675570 google.com/ccm/form-data/	0 20 B	124ms 41ms	Ping text/plain	142.250.31.101 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://google.com/ccm/form-data/407675570?gtm=45be4bk0pfv9137103858z86688972za201zb6688972&gcs=G1--&gcd=13l3l3R3l5l1&dma=0&tag_exp=101925629~102067555~102067808~102077855~102081485&did=dYWJhMj&gdid=dYWJhMj&npa=0&frm=0&pscdl=noapi&auid=1294949687.1733037624&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&ec_mode=a&em=tv.1 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/destination?id=AW-407675570&l=dataLayer&cx=c&gtm=45He4bk0v6688972za200 Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.31.101 , United States, ASN15169 (GOOGLE, US), Reverse DNS bj-in-f101.1e100.net Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers cache-control no-cache, no-store, must-revalidate pragma no-cache cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:57:0 report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:57:0"}],} expires Fri, 01 Jan 1990 00:00:00 GMT access-control-allow-origin https://www.malwarebytes.com cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Sun, 01 Dec 2024 07:20:24 GMT content-type text/plain server Golfe2
GET H3	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/930356311/	6 KB 2 KB	117ms 51ms	Script text/javascript	142.251.16.156 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/930356311/?random=1733037624257&cv=11&fst=1733037624257&bg=ffffff&guid=ON&async=1&gtm=45be4bk0v9137103858za200&gcd=13l3l3R3l5l1&dma=0&tag_exp=101925629~102067555~102067808~102077855~102081485&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fnews%2F2018%2F07%2Fhidden-bee-miner-delivered-via-improved-drive-by-download-toolkit&hn=www.googleadservices.com&frm=0&tiba=%27Hidden%20Bee%27%20miner%20delivered%20via%20improved%20drive-by%20download%20toolkit%20%7C%20Malwarebytes%20Labs&did=dYWJhMj&gdid=dYWJhMj&npa=0&pscdl=noapi&auid=1294949687.1733037624&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=4 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=AW-930356311 Protocol H3 Security QUIC, , AES_128_GCM Server 142.251.16.156 Farmingdale, United States, ASN15169 (GOOGLE, US), Reverse DNS bl-in-f156.1e100.net Software cafe / Resource Hash 606c50783a22054a89b6c995a232286c1c64073b0555f008b3143e6d8b18b199 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers cache-control no-cache, must-revalidate timing-allow-origin * content-encoding br pragma no-cache cross-origin-resource-policy cross-origin x-content-type-options nosniff expires Fri, 01 Jan 1990 00:00:00 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" content-length 2450 date Sun, 01 Dec 2024 07:20:24 GMT x-xss-protection 0 content-type text/javascript; charset=UTF-8 content-disposition attachment; filename="f.txt" server cafe
GET H2	200	930356311 td.doubleclick.net/td/rul/ Frame 9B98	0 0	50ms 49ms	Document text/html	2607:f8b0:4004:c21::9d GOOGLE
General Check archive.org Show headers Download Go to Full URL https://td.doubleclick.net/td/rul/930356311?random=1733037624257&cv=11&fst=1733037624257&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4bk0v9137103858za200&gcd=13l3l3R3l5l1&dma=0&tag_exp=101925629~102067555~102067808~102077855~102081485&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fnews%2F2018%2F07%2Fhidden-bee-miner-delivered-via-improved-drive-by-download-toolkit&hn=www.googleadservices.com&frm=0&tiba=%27Hidden%20Bee%27%20miner%20delivered%20via%20improved%20drive-by%20download%20toolkit%20%7C%20Malwarebytes%20Labs&did=dYWJhMj&gdid=dYWJhMj&npa=0&pscdl=noapi&auid=1294949687.1733037624&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=AW-930356311 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4004:c21::9d Washington, United States, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.malwarebytes.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 cache-control no-cache, must-revalidate content-encoding br content-length 1130 content-type text/html; charset=UTF-8 cross-origin-resource-policy cross-origin date Sun, 01 Dec 2024 07:20:24 GMT expires Fri, 01 Jan 1990 00:00:00 GMT p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" pragma no-cache server cafe timing-allow-origin * x-content-type-options nosniff x-xss-protection 0
GET H3	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/407675570/	6 KB 2 KB	105ms 49ms	Script text/javascript	142.251.16.156 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/407675570/?random=1733037624273&cv=11&fst=1733037624273&bg=ffffff&guid=ON&async=1&gtm=45be4bk0v9137103858za200&gcd=13l3l3R3l5l1&dma=0&tag_exp=101925629~102067555~102067808~102077855~102081485&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fnews%2F2018%2F07%2Fhidden-bee-miner-delivered-via-improved-drive-by-download-toolkit&hn=www.googleadservices.com&frm=0&tiba=%27Hidden%20Bee%27%20miner%20delivered%20via%20improved%20drive-by%20download%20toolkit%20%7C%20Malwarebytes%20Labs&did=dYWJhMj&gdid=dYWJhMj&npa=0&pscdl=noapi&auid=1294949687.1733037624&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=4 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=AW-930356311 Protocol H3 Security QUIC, , AES_128_GCM Server 142.251.16.156 Farmingdale, United States, ASN15169 (GOOGLE, US), Reverse DNS bl-in-f156.1e100.net Software cafe / Resource Hash 89743a891481c39a6987ebbbb4798347a1e2067d7b3e0c63cccd4ee4d04f8da5 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers cache-control no-cache, must-revalidate timing-allow-origin * content-encoding br pragma no-cache cross-origin-resource-policy cross-origin x-content-type-options nosniff expires Fri, 01 Jan 1990 00:00:00 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" content-length 2449 date Sun, 01 Dec 2024 07:20:24 GMT x-xss-protection 0 content-type text/javascript; charset=UTF-8 content-disposition attachment; filename="f.txt" server cafe
GET H2	200	407675570 td.doubleclick.net/td/rul/ Frame DC7A	0 0	53ms 52ms	Document text/html	2607:f8b0:4004:c21::9d GOOGLE
General Check archive.org Show headers Download Go to Full URL https://td.doubleclick.net/td/rul/407675570?random=1733037624273&cv=11&fst=1733037624273&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4bk0v9137103858za200&gcd=13l3l3R3l5l1&dma=0&tag_exp=101925629~102067555~102067808~102077855~102081485&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fnews%2F2018%2F07%2Fhidden-bee-miner-delivered-via-improved-drive-by-download-toolkit&hn=www.googleadservices.com&frm=0&tiba=%27Hidden%20Bee%27%20miner%20delivered%20via%20improved%20drive-by%20download%20toolkit%20%7C%20Malwarebytes%20Labs&did=dYWJhMj&gdid=dYWJhMj&npa=0&pscdl=noapi&auid=1294949687.1733037624&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=AW-930356311 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4004:c21::9d Washington, United States, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.malwarebytes.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 cache-control no-cache, must-revalidate content-encoding br content-length 1113 content-type text/html; charset=UTF-8 cross-origin-resource-policy cross-origin date Sun, 01 Dec 2024 07:20:24 GMT expires Fri, 01 Jan 1990 00:00:00 GMT p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" pragma no-cache server cafe timing-allow-origin * x-content-type-options nosniff x-xss-protection 0
GET H2	200	insight.old.min.js Show response snap.licdn.com/li.lms-analytics/	40 KB 40 KB	32ms 31ms	Script text/javascript	2600:1408:c400:5::17c7:3719 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Full URL https://snap.licdn.com/li.lms-analytics/insight.old.min.js Requested by Host: snap.licdn.com URL: https://snap.licdn.com/li.lms-analytics/insight.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2600:1408:c400:5::17c7:3719 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS Software / Resource Hash e6b8a90a2870483ace67380ff4a64b39bfecb7952a432393470d76a6614fc62c Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers x-cdn AKAM x-content-type-options nosniff accept-ranges bytes content-length 41181 date Sun, 01 Dec 2024 07:20:24 GMT last-modified Tue, 26 Nov 2024 13:49:02 GMT content-type text/javascript x-amz-server-side-encryption AES256
GET H/1.1	200 OK	munchkin.js Show response munchkin.marketo.net/163/	11 KB 5 KB	35ms 34ms	Script application/x-javascript	23.13.172.203 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://munchkin.marketo.net/163/munchkin.js Requested by Host: munchkin.marketo.net URL: https://munchkin.marketo.net/munchkin.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 23.13.172.203 Ashburn, United States, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-13-172-203.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash 68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers Cache-Control max-age=8640000 Content-Encoding gzip ETag "ea7826f34518d7c2295738f39c7640fa:1672972000.238769" Connection keep-alive Expires Tue, 11 Mar 2025 07:20:24 GMT Accept-Ranges bytes P3P policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR" Content-Length 4741 Date Sun, 01 Dec 2024 07:20:24 GMT Content-Type application/x-javascript Last-Modified Fri, 06 Jan 2023 02:26:40 GMT Server AkamaiNetStorage Vary Accept-Encoding
GET H2	200	4072696.js Show response bat.bing.com/p/action/	363 B 422 B	49ms 47ms	Script application/javascript	2620:1ec:33:1::10 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://bat.bing.com/p/action/4072696.js Requested by Host: bat.bing.com URL: https://bat.bing.com/bat.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 4922a8859b315c354c23ad278e35483c6cf29aebf1c509c2c928c1f41634fe43 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers strict-transport-security max-age=31536000; includeSubDomains; preload cache-control private,max-age=1800 content-encoding br accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: 948F855F2FA740E99E0C5DAEA2E89958 Ref B: YMQ01EDGE0814 Ref C: 2024-12-01T07:20:24Z x-cache CONFIG_NOCACHE date Sun, 01 Dec 2024 07:20:24 GMT content-type application/javascript; charset=utf-8 vary Accept-Encoding
POST H/1.1	200 OK	visitWebPage 805-usg-300.mktoresp.com/webevents/	2 B 318 B	177ms 39ms	Ping text/plain	192.28.144.124 OMNITURE
General Check archive.org Show headers Download Go to Full URL https://805-usg-300.mktoresp.com/webevents/visitWebPage?_mchNc=1733037624365&_mchCn=&_mchId=805-USG-300&_mchTk=_mch-malwarebytes.com-1733037624364-72538&_mchHo=www.malwarebytes.com&_mchPo=&_mchRu=%2Fblog%2Fnews%2F2018%2F07%2Fhidden-bee-miner-delivered-via-improved-drive-by-download-toolkit&_mchPc=https%3A&_mchVr=163&_mchEcid=&_mchHa=&_mchRe=&_mchQp= Requested by Host: munchkin.marketo.net URL: https://munchkin.marketo.net/163/munchkin.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 192.28.144.124 , United States, ASN15224 (OMNITURE, US), Reverse DNS Software nginx/1.20.1 / Resource Hash 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers Transfer-Encoding chunked X-Request-Id b35b7e8f-593e-4386-b7ce-fe9c5dc13d3b Content-Encoding gzip Connection keep-alive Access-Control-Allow-Origin * Date Sun, 01 Dec 2024 07:20:24 GMT Content-Type text/plain; charset=UTF-8 Server nginx/1.20.1
GET H2	200	attribution_trigger Show response px.ads.linkedin.com/	2 B 811 B	155ms 64ms	XHR application/json	2620:1ec:21::14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://px.ads.linkedin.com/attribution_trigger?pid=2594100&time=1733037624367&url=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fnews%2F2018%2F07%2Fhidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Requested by Host: dev.visualwebsiteoptimizer.com URL: https://dev.visualwebsiteoptimizer.com/cdn/analysis/4.0/opa-ecf25b21ebb11aef88a2f98af67e5f85br.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept * Referer https://www.malwarebytes.com/ Response headers x-li-pop afd-prod-lva1-x content-encoding gzip x-fs-uuid 0006283043fd59a4dd6ee63f7ecbdf8b x-msedge-ref Ref A: B26464FFE69F496789979E23ADF16AC2 Ref B: YMQ01EDGE0518 Ref C: 2024-12-01T07:20:24Z x-li-fabric prod-lva1 x-restli-protocol-version 1.0.0 access-control-allow-methods GET, OPTIONS x-li-uuid AAYoMEP9WaTdbuY/fsvfiw== x-li-proto http/2 access-control-allow-origin * x-cache CONFIG_NOCACHE date Sun, 01 Dec 2024 07:20:23 GMT content-type application/json access-control-allow-headers *
GET H2	200	collect px4.ads.linkedin.com/ Redirect Chain https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2594100&time=1733037624367&li_adsId=aca84cfd-1683-4e55-bf7d-e54077637d63&url=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fnews%2F2018%2F07%2Fhidden... https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=2594100&time=1733037624367&li_adsId=aca84cfd-1683-4e55-bf7d-e54077637d63&url=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fnews%2F2018%2F07%2Fhidde...	0 265 B	227ms 103ms	Image application/javascript	13.107.42.14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=2594100&time=1733037624367&li_adsId=aca84cfd-1683-4e55-bf7d-e54077637d63&url=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fnews%2F2018%2F07%2Fhidden-bee-miner-delivered-via-improved-drive-by-download-toolkit&e_ipv6=AQIfL2c7l6UDcQAAAZOBF4zJEDUCbiF-FWuHXH-oPeJsZrGlqiVtXxB-Z4uZoy6gphCY9ofBSA Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Protocol H2 Server 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers linkedin-action 1 x-li-pop afd-prod-lor1-x x-msedge-ref Ref A: 6C241BA6DE324232AECF17533E768166 Ref B: YMQ01EDGE0611 Ref C: 2024-12-01T07:20:24Z x-li-fabric prod-lor1 x-li-uuid AAYoMEQBXJrfs8b6ae8O5A== x-li-proto http/2 x-cache CONFIG_NOCACHE content-length 0 date Sun, 01 Dec 2024 07:20:24 GMT content-type application/javascript Redirect headers linkedin-action 1 x-li-pop afd-prod-lor1-x location https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=2594100&time=1733037624367&li_adsId=aca84cfd-1683-4e55-bf7d-e54077637d63&url=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fnews%2F2018%2F07%2Fhidden-bee-miner-delivered-via-improved-drive-by-download-toolkit&e_ipv6=AQIfL2c7l6UDcQAAAZOBF4zJEDUCbiF-FWuHXH-oPeJsZrGlqiVtXxB-Z4uZoy6gphCY9ofBSA x-msedge-ref Ref A: 94D83448E15B419EBD8E066A12381152 Ref B: YMQ01EDGE0308 Ref C: 2024-12-01T07:20:24Z x-li-fabric prod-lor1 x-li-uuid AAYoMEP9sfV1tGxPC8qSRw== x-li-proto http/2 x-cache CONFIG_NOCACHE content-length 0 date Sun, 01 Dec 2024 07:20:23 GMT
GET		a9be07fc-6439-4d48-bda5-44ecfcca9d36 https://www.malwarebytes.com/ Frame	0 0
GET H3	200	/ www.google.com/pagead/1p-user-list/407675570/	42 B 64 B	45ms 44ms	Image image/gif	142.251.167.106 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/407675570/?random=1733037624273&cv=11&fst=1733036400000&bg=ffffff&guid=ON&async=1&gtm=45be4bk0v9137103858za200&gcd=13l3l3R3l5l1&dma=0&tag_exp=101925629~102067555~102067808~102077855~102081485&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fnews%2F2018%2F07%2Fhidden-bee-miner-delivered-via-improved-drive-by-download-toolkit&hn=www.googleadservices.com&frm=0&tiba=%27Hidden%20Bee%27%20miner%20delivered%20via%20improved%20drive-by%20download%20toolkit%20%7C%20Malwarebytes%20Labs&did=dYWJhMj&gdid=dYWJhMj&npa=0&pscdl=noapi&auid=1294949687.1733037624&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwCa7L7dFjhVvzbJlkM7e-KxE6udCM-Kut0Phg&random=2377462544&rmt_tld=0&ipr=y Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Protocol H3 Security QUIC, , AES_128_GCM Server 142.251.167.106 Farmingdale, United States, ASN15169 (GOOGLE, US), Reverse DNS ww-in-f106.1e100.net Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers content-security-policy script-src 'none'; object-src 'none' cache-control no-cache, no-store, must-revalidate timing-allow-origin * pragma no-cache cross-origin-resource-policy cross-origin x-content-type-options nosniff expires Fri, 01 Jan 1990 00:00:00 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" content-length 42 date Sun, 01 Dec 2024 07:20:24 GMT x-xss-protection 0 content-type image/gif server cafe
GET H3	200	/ www.google.ca/pagead/1p-user-list/407675570/	42 B 64 B	50ms 49ms	Image image/gif	142.251.16.94 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.ca/pagead/1p-user-list/407675570/?random=1733037624273&cv=11&fst=1733036400000&bg=ffffff&guid=ON&async=1&gtm=45be4bk0v9137103858za200&gcd=13l3l3R3l5l1&dma=0&tag_exp=101925629~102067555~102067808~102077855~102081485&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fnews%2F2018%2F07%2Fhidden-bee-miner-delivered-via-improved-drive-by-download-toolkit&hn=www.googleadservices.com&frm=0&tiba=%27Hidden%20Bee%27%20miner%20delivered%20via%20improved%20drive-by%20download%20toolkit%20%7C%20Malwarebytes%20Labs&did=dYWJhMj&gdid=dYWJhMj&npa=0&pscdl=noapi&auid=1294949687.1733037624&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwCa7L7dFjhVvzbJlkM7e-KxE6udCM-Kut0Phg&random=2377462544&rmt_tld=1&ipr=y Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Protocol H3 Security QUIC, , AES_128_GCM Server 142.251.16.94 Farmingdale, United States, ASN15169 (GOOGLE, US), Reverse DNS bl-in-f94.1e100.net Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers content-security-policy script-src 'none'; object-src 'none' cache-control no-cache, no-store, must-revalidate timing-allow-origin * pragma no-cache cross-origin-resource-policy cross-origin x-content-type-options nosniff expires Fri, 01 Jan 1990 00:00:00 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" content-length 42 date Sun, 01 Dec 2024 07:20:24 GMT x-xss-protection 0 content-type image/gif server cafe
GET H3	200	/ www.google.com/pagead/1p-user-list/930356311/	42 B 64 B	45ms 44ms	Image image/gif	142.251.167.106 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/930356311/?random=1733037624257&cv=11&fst=1733036400000&bg=ffffff&guid=ON&async=1&gtm=45be4bk0v9137103858za200&gcd=13l3l3R3l5l1&dma=0&tag_exp=101925629~102067555~102067808~102077855~102081485&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fnews%2F2018%2F07%2Fhidden-bee-miner-delivered-via-improved-drive-by-download-toolkit&hn=www.googleadservices.com&frm=0&tiba=%27Hidden%20Bee%27%20miner%20delivered%20via%20improved%20drive-by%20download%20toolkit%20%7C%20Malwarebytes%20Labs&did=dYWJhMj&gdid=dYWJhMj&npa=0&pscdl=noapi&auid=1294949687.1733037624&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwCa7L7dIJpJOPqJ8YMyvfg74mTgE_Jc8-2EvA&random=409915060&rmt_tld=0&ipr=y Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Protocol H3 Security QUIC, , AES_128_GCM Server 142.251.167.106 Farmingdale, United States, ASN15169 (GOOGLE, US), Reverse DNS ww-in-f106.1e100.net Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers content-security-policy script-src 'none'; object-src 'none' cache-control no-cache, no-store, must-revalidate timing-allow-origin * pragma no-cache cross-origin-resource-policy cross-origin x-content-type-options nosniff expires Fri, 01 Jan 1990 00:00:00 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" content-length 42 date Sun, 01 Dec 2024 07:20:24 GMT x-xss-protection 0 content-type image/gif server cafe
GET H3	200	/ www.google.ca/pagead/1p-user-list/930356311/	42 B 64 B	46ms 45ms	Image image/gif	142.251.16.94 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.ca/pagead/1p-user-list/930356311/?random=1733037624257&cv=11&fst=1733036400000&bg=ffffff&guid=ON&async=1&gtm=45be4bk0v9137103858za200&gcd=13l3l3R3l5l1&dma=0&tag_exp=101925629~102067555~102067808~102077855~102081485&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fnews%2F2018%2F07%2Fhidden-bee-miner-delivered-via-improved-drive-by-download-toolkit&hn=www.googleadservices.com&frm=0&tiba=%27Hidden%20Bee%27%20miner%20delivered%20via%20improved%20drive-by%20download%20toolkit%20%7C%20Malwarebytes%20Labs&did=dYWJhMj&gdid=dYWJhMj&npa=0&pscdl=noapi&auid=1294949687.1733037624&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwCa7L7dIJpJOPqJ8YMyvfg74mTgE_Jc8-2EvA&random=409915060&rmt_tld=1&ipr=y Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Protocol H3 Security QUIC, , AES_128_GCM Server 142.251.16.94 Farmingdale, United States, ASN15169 (GOOGLE, US), Reverse DNS bl-in-f94.1e100.net Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers content-security-policy script-src 'none'; object-src 'none' cache-control no-cache, no-store, must-revalidate timing-allow-origin * pragma no-cache cross-origin-resource-policy cross-origin x-content-type-options nosniff expires Fri, 01 Jan 1990 00:00:00 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" content-length 42 date Sun, 01 Dec 2024 07:20:24 GMT x-xss-protection 0 content-type image/gif server cafe
GET H2	204	0 bat.bing.com/action/	0 361 B	47ms 47ms	Image text/plain	2620:1ec:33:1::10 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://bat.bing.com/action/0?ti=4072696&tm=gtm002&Ver=2&mid=a32fb04a-7b4a-42c3-aa89-3474a9c5d025&bo=1&sid=bb5b90c0afb411ef840217ccfaccdee2&vid=bb5ba220afb411ef9d34e758135fe7dd&vids=1&msclkid=N&pi=918639831&lg=en-CA&sw=1600&sh=1200&sc=24&tl=%27Hidden%20Bee%27%20miner%20delivered%20via%20improved%20drive-by%20download%20toolkit%20%7C%20Malwarebytes%20Labs&p=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fnews%2F2018%2F07%2Fhidden-bee-miner-delivered-via-improved-drive-by-download-toolkit&r=&lt=1153&evt=pageLoad&sv=1&cdb=AQET&rn=477042 Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers strict-transport-security max-age=31536000; includeSubDomains; preload cache-control no-cache, must-revalidate pragma no-cache accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: BDBA1DF1B4A7467B891C1E056D2A3E22 Ref B: YMQ01EDGE0814 Ref C: 2024-12-01T07:20:24Z expires Fri, 01 Jan 1990 00:00:00 GMT access-control-allow-origin * x-cache CONFIG_NOCACHE date Sun, 01 Dec 2024 07:20:24 GMT
POST H2	200	analyze Show response r5.visualwebsiteoptimizer.com/	0 143 B	239ms 60ms	XHR application/javascript	35.186.187.8 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://r5.visualwebsiteoptimizer.com/analyze?_a=622914&_u=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fnews%2F2018%2F07%2Fhidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Requested by Host: dev.visualwebsiteoptimizer.com URL: https://dev.visualwebsiteoptimizer.com/cdn/analysis/4.0/opa-ecf25b21ebb11aef88a2f98af67e5f85br.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 35.186.187.8 Washington, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 8.187.186.35.bc.googleusercontent.com Software r5 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Content-Type multipart/form-data; boundary=----WebKitFormBoundaryJm6Ab2M7F5YAiYFt Referer https://www.malwarebytes.com/ Response headers access-control-allow-origin * content-encoding gzip date Sun, 01 Dec 2024 07:20:24 GMT content-type application/javascript; charset=UTF-8 server r5
POST H2	204	/ Show response px.ads.linkedin.com/wa/	0 200 B	111ms 109ms	XHR text/plain	2620:1ec:21::14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://px.ads.linkedin.com/wa/ Requested by Host: dev.visualwebsiteoptimizer.com URL: https://dev.visualwebsiteoptimizer.com/cdn/analysis/4.0/opa-ecf25b21ebb11aef88a2f98af67e5f85br.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.malwarebytes.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept * Content-Type text/plain;charset=UTF-8 Response headers linkedin-action 1 x-li-pop afd-prod-lor1-x x-msedge-ref Ref A: 026CA443651D4833B7E5380D0D99A8AE Ref B: YMQ01EDGE0308 Ref C: 2024-12-01T07:20:24Z x-li-fabric prod-lor1 access-control-allow-credentials true x-li-uuid AAYoMEQDF8BnYUVgVGshEQ== x-li-proto http/2 access-control-allow-origin https://www.malwarebytes.com x-cache CONFIG_NOCACHE date Sun, 01 Dec 2024 07:20:24 GMT vary Origin
GET H3	200	settings.js Show response dev.visualwebsiteoptimizer.com/dcdn/	125 KB 15 KB	21ms 20ms	Script application/javascript	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://dev.visualwebsiteoptimizer.com/dcdn/settings.js?a=622914&settings_type=4&ts=1732967559&dt=desktop&cc=CA Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Protocol H3 Security QUIC, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software gnv2 / Resource Hash d2f4a9200206306d7419db5f7c8dcd6093ba33e32c3e0ebfdd8fe20dfce2f864 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers cdn_cache_status hit cache-control public, max-age=1800, s-maxage=1800 content-encoding gzip etag W/"1732967559_EA" age 1625 via 1.1 google not-modified true access-control-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 15817 date Sun, 01 Dec 2024 06:53:20 GMT content-type application/javascript; charset=UTF-8 server gnv2
GET H2	200	cropped-favicon-512x512-1-1.png www.malwarebytes.com/wp-content/uploads/sites/2/2023/08/	562 B 808 B	26ms 25ms	Other image/webp	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://www.malwarebytes.com/wp-content/uploads/sites/2/2023/08/cropped-favicon-512x512-1-1.png?w=32 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 6d1f878259463317e1c90fea81b4f5d842248e14d3b23fb19dc54cf62f5e7eac Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/blog/news/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Response headers strict-transport-security max-age=31536000 cache-control max-age=31536000 x-rq yyz2 80 86 443 etag "142e06f8047ecb89" accept-ranges bytes, bytes x-cache HIT content-length 562 date Sun, 01 Dec 2024 07:20:25 GMT content-type image/webp last-modified Mon, 06 May 2024 23:44:41 GMT server nginx vary Accept
POST H2	200	analyze Show response r5.visualwebsiteoptimizer.com/	0 142 B	33ms 31ms	XHR application/javascript	35.186.187.8 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://r5.visualwebsiteoptimizer.com/analyze?_a=622914&_u=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fnews%2F2018%2F07%2Fhidden-bee-miner-delivered-via-improved-drive-by-download-toolkit Requested by Host: dev.visualwebsiteoptimizer.com URL: https://dev.visualwebsiteoptimizer.com/cdn/analysis/4.0/opa-ecf25b21ebb11aef88a2f98af67e5f85br.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 35.186.187.8 Washington, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 8.187.186.35.bc.googleusercontent.com Software r5 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Content-Type multipart/form-data; boundary=----WebKitFormBoundaryAsxRYVMSSQNVAjWz Referer https://www.malwarebytes.com/ Response headers access-control-allow-origin * content-encoding gzip date Sun, 01 Dec 2024 07:20:28 GMT content-type application/javascript; charset=UTF-8 server r5

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

www.malwarebytes.com

URL

blob:https://www.malwarebytes.com/bd80d09a-3635-4ddc-892f-d1d1c949aafa

Domain

www.malwarebytes.com

URL

blob:https://www.malwarebytes.com/a9be07fc-6439-4d48-bda5-44ecfcca9d36