urlscan.io logo urlscan.io
SecurityTrails logo

blog.malwarebytes.com Open in urlscan Pro
130.211.198.3  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://t.co/JeGMk0Fi9l
Effective URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot...
Submission: On July 23 via api from CA
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 40 IPs in 7 countries across 34 domains to perform 144 HTTP transactions. The main IP is 130.211.198.3, located in Mountain View, United States and belongs to GOOGLE, US. The main domain is blog.malwarebytes.com.
TLS certificate: Issued by DigiCert SHA2 High Assurance Server CA on April 2nd 2019. Valid for: 2 years.
This is the only time blog.malwarebytes.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 104.244.42.197 13414 (TWITTER)
1 1 108.174.10.10 14413 (LINKEDIN)
2 2 2620:1ec:21::14 8068 (MICROSOFT...)
72 130.211.198.3 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
10 2600:9000:214... 16509 (AMAZON-02)
2 52.239.137.4 8075 (MICROSOFT...)
1 2a04:fa87:fff... 2635 (AUTOMATTIC)
1 192.0.77.32 2635 (AUTOMATTIC)
2 2a00:1450:400... 15169 (GOOGLE)
5 151.101.112.134 54113 (FASTLY)
1 2600:1f18:21a... 14618 (AMAZON-AES)
1 3 2a00:1450:400... 15169 (GOOGLE)
1 2 216.58.205.230 15169 (GOOGLE)
2 2620:1ec:c11:... 8068 (MICROSOFT...)
1 151.101.112.157 54113 (FASTLY)
2 2606:4700::68... 13335 (CLOUDFLAR...)
1 143.204.206.235 16509 (AMAZON-02)
1 143.204.202.73 16509 (AMAZON-02)
1 2a02:26f0:6c0... 20940 (AKAMAI-ASN1)
6 2606:4700::68... 13335 (CLOUDFLAR...)
4 151.101.128.134 54113 (FASTLY)
1 1 2a00:1450:400... 15169 (GOOGLE)
1 2 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
1 172.217.23.98 15169 (GOOGLE)
1 2 2a05:f500:11:... 14413 (LINKEDIN)
1 143.204.202.60 16509 (AMAZON-02)
2 2 52.49.185.203 16509 (AMAZON-02)
1 2 143.204.202.127 16509 (AMAZON-02)
1 2a00:1450:400... 15169 (GOOGLE)
1 2 172.217.21.230 15169 (GOOGLE)
2 2a03:2880:f01... 32934 (FACEBOOK)
1 151.101.113.2 54113 (FASTLY)
2 3 52.211.33.154 16509 (AMAZON-02)
2 2a00:1288:f03... 10310 (YAHOO-1)
2 95.101.176.176 16625 (AKAMAI-AS)
1 104.244.42.3 13414 (TWITTER)
2 52.215.9.203 16509 (AMAZON-02)
1 34.194.150.218 14618 (AMAZON-AES)
1 212.82.100.181 34010 (YAHOO-IRD)
1 192.28.144.124 15224 (OMNITURE)
2 2a03:2880:f11... 32934 (FACEBOOK)
144 40
2    104.244.42.197 (United States)

ASN13414 (TWITTER, US)
t.co
1    108.174.10.10 (United States)

ASN14413 (LINKEDIN, US)
lnkd.in
2    2620:1ec:21::14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
www.linkedin.com
72    130.211.198.3 (Mountain View, United States)

ASN15169 (GOOGLE, US)
blog.malwarebytes.com
1    2a00:1450:4001:81f::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
10    2600:9000:214f:6000:8:d3fb:39c0:93a1 (United States)

ASN16509 (AMAZON-02, US)
www.malwarebytes.com
2    52.239.137.4 (Dublin, Ireland)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
optanon.blob.core.windows.net
1    2a04:fa87:fffe::c000:4902 (Ireland)

ASN2635 (AUTOMATTIC, US)
secure.gravatar.com
1    192.0.77.32 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
s0.wp.com
2    2a00:1450:4001:80b::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
5    151.101.112.134 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)
malwarebytesunpacked.disqus.com
1    2600:1f18:21ae:6701:9be3:f3d4:fc54:ed52 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
genesis.malwarebytes.com
3    2a00:1450:4001:816::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
2    216.58.205.230 (Mountain View, United States)

ASN15169 (GOOGLE, US)
9812475.fls.doubleclick.net
2    2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
bat.bing.com
1    151.101.112.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)
static.ads-twitter.com
2    2606:4700::6813:9308 (United States)

ASN13335 (CLOUDFLARENET, US)
script.crazyegg.com
1    143.204.206.235 (Seattle, United States)

ASN16509 (AMAZON-02, US)
js.adsrvr.org
1    143.204.202.73 (Seattle, United States)

ASN16509 (AMAZON-02, US)
scripts.demandbase.com
1    2a02:26f0:6c00:296::25ea (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)
snap.licdn.com
6    2606:4700::6812:a913 (United States)

ASN13335 (CLOUDFLARENET, US)
c.disquscdn.com
4    151.101.128.134 (United States)

ASN54113 (FASTLY, US)
disqus.com
1    2a00:1450:400c:c00::9a (Brussels, Belgium)

ASN15169 (GOOGLE, US)
stats.g.doubleclick.net
2    2a00:1450:4001:801::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
2    2a00:1450:4001:801::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.de
1    172.217.23.98 (United States)

ASN15169 (GOOGLE, US)
www.googleadservices.com
2    2a05:f500:11:101::b93f:9005 (Ireland)

ASN14413 (LINKEDIN, US)
px.ads.linkedin.com
1    143.204.202.60 (Seattle, United States)

ASN16509 (AMAZON-02, US)
api.company-target.com
2    52.49.185.203 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
match.prod.bidr.io
2    143.204.202.127 (Seattle, United States)

ASN16509 (AMAZON-02, US)
segments.company-target.com
1    2a00:1450:4001:81c::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
googleads.g.doubleclick.net
2    172.217.21.230 (United States)

ASN15169 (GOOGLE, US)
5118230.fls.doubleclick.net
2    2a03:2880:f01c:8012:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK, US)
connect.facebook.net
1    151.101.113.2 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)
a.quora.com
3    52.211.33.154 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
ads.avocet.io
ads.avct.cloud
2    2a00:1288:f03d:1fa::4000 (United Kingdom)

ASN10310 (YAHOO-1, US)
s.yimg.com
2    95.101.176.176 (Ascension Island)

ASN16625 (AKAMAI-AS, US)
munchkin.marketo.net
1    104.244.42.3 (United States)

ASN13414 (TWITTER, US)
analytics.twitter.com
2    52.215.9.203 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
insight.adsrvr.org
1    34.194.150.218 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
q.quora.com
1    212.82.100.181 (Switzerland)

ASN34010 (YAHOO-IRD, GB)
sp.analytics.yahoo.com
1    192.28.144.124 (United States)

ASN15224 (OMNITURE, US)
805-usg-300.mktoresp.com
2    2a03:2880:f11c:8183:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK, US)
www.facebook.com
Apex Domain
Subdomains		 Transfer
83 malwarebytes.com
blog.malwarebytes.com
www.malwarebytes.com
genesis.malwarebytes.com
4 MB
9 disqus.com
malwarebytesunpacked.disqus.com
disqus.com
85 KB
6 disquscdn.com
c.disquscdn.com
446 KB
6 doubleclick.net
9812475.fls.doubleclick.net
stats.g.doubleclick.net
googleads.g.doubleclick.net
5118230.fls.doubleclick.net
4 KB
4 linkedin.com
www.linkedin.com
px.ads.linkedin.com
3 KB
3 company-target.com
api.company-target.com
segments.company-target.com
2 KB
3 adsrvr.org
js.adsrvr.org
insight.adsrvr.org
4 KB
3 google-analytics.com
www.google-analytics.com
19 KB
2 facebook.com
www.facebook.com
492 B
2 marketo.net
munchkin.marketo.net
6 KB
2 yimg.com
s.yimg.com
7 KB
2 avct.cloud
ads.avct.cloud
750 B
2 quora.com
a.quora.com
q.quora.com
14 KB
2 facebook.net
connect.facebook.net
167 KB
2 bidr.io
match.prod.bidr.io
1019 B
2 google.de
www.google.de
667 B
2 google.com
www.google.com
754 B
2 crazyegg.com
script.crazyegg.com
25 KB
2 bing.com
bat.bing.com
8 KB
2 googletagmanager.com
www.googletagmanager.com
81 KB
2 windows.net
optanon.blob.core.windows.net
27 KB
2 t.co
t.co
851 B
1 mktoresp.com
805-usg-300.mktoresp.com
304 B
1 yahoo.com
sp.analytics.yahoo.com
530 B
1 twitter.com
analytics.twitter.com
652 B
1 avocet.io
ads.avocet.io
156 B
1 googleadservices.com
www.googleadservices.com
12 KB
1 licdn.com
snap.licdn.com
2 KB
1 demandbase.com
scripts.demandbase.com
16 KB
1 ads-twitter.com
static.ads-twitter.com
2 KB
1 wp.com
s0.wp.com
3 KB
1 gravatar.com
secure.gravatar.com
11 KB
1 googleapis.com
fonts.googleapis.com
2 KB
1 lnkd.in
lnkd.in
525 B
144 34
Domain Requested by
72 blog.malwarebytes.com t.co
blog.malwarebytes.com
www.malwarebytes.com
10 www.malwarebytes.com blog.malwarebytes.com
www.googletagmanager.com
6 c.disquscdn.com malwarebytesunpacked.disqus.com
5 malwarebytesunpacked.disqus.com blog.malwarebytes.com
malwarebytesunpacked.disqus.com
www.malwarebytes.com
4 disqus.com malwarebytesunpacked.disqus.com
3 www.google-analytics.com 1 redirects t.co
blog.malwarebytes.com
2 www.facebook.com connect.facebook.net
2 insight.adsrvr.org js.adsrvr.org
2 munchkin.marketo.net t.co
munchkin.marketo.net
2 s.yimg.com t.co
s.yimg.com
2 ads.avct.cloud 1 redirects
2 connect.facebook.net t.co
connect.facebook.net
2 5118230.fls.doubleclick.net 1 redirects www.malwarebytes.com
2 segments.company-target.com 1 redirects blog.malwarebytes.com
2 match.prod.bidr.io 2 redirects
2 px.ads.linkedin.com 1 redirects blog.malwarebytes.com
2 www.google.de blog.malwarebytes.com
2 www.google.com 1 redirects blog.malwarebytes.com
2 script.crazyegg.com www.googletagmanager.com
script.crazyegg.com
2 bat.bing.com t.co
blog.malwarebytes.com
2 9812475.fls.doubleclick.net 1 redirects www.googletagmanager.com
2 www.googletagmanager.com blog.malwarebytes.com
www.googletagmanager.com
2 optanon.blob.core.windows.net blog.malwarebytes.com
optanon.blob.core.windows.net
2 www.linkedin.com 2 redirects
2 t.co blog.malwarebytes.com
1 805-usg-300.mktoresp.com munchkin.marketo.net
1 sp.analytics.yahoo.com s.yimg.com
1 q.quora.com
1 analytics.twitter.com static.ads-twitter.com
1 ads.avocet.io 1 redirects
1 a.quora.com t.co
1 googleads.g.doubleclick.net www.googleadservices.com
1 api.company-target.com scripts.demandbase.com
1 www.googleadservices.com www.googletagmanager.com
1 stats.g.doubleclick.net 1 redirects
1 snap.licdn.com t.co
1 scripts.demandbase.com t.co
1 js.adsrvr.org www.googletagmanager.com
1 static.ads-twitter.com t.co
1 genesis.malwarebytes.com www.malwarebytes.com
1 s0.wp.com blog.malwarebytes.com
1 secure.gravatar.com blog.malwarebytes.com
1 fonts.googleapis.com blog.malwarebytes.com
1 lnkd.in 1 redirects
144 44
Subject Issuer Validity Valid
t.co
DigiCert SHA2 High Assurance Server CA		 2020-03-05 -
2021-03-02		 a year crt.sh
blog.malwarebytes.com
DigiCert SHA2 High Assurance Server CA		 2019-04-02 -
2021-07-05		 2 years crt.sh
upload.video.google.com
GTS CA 1O1		 2020-06-30 -
2020-09-22		 3 months crt.sh
*.malwarebytes.com
DigiCert SHA2 High Assurance Server CA		 2018-12-06 -
2020-12-09		 2 years crt.sh
*.blob.core.windows.net
Microsoft IT TLS CA 5		 2020-07-16 -
2022-07-16		 2 years crt.sh
*.gravatar.com
COMODO RSA Domain Validation Secure Server CA		 2018-09-06 -
2020-09-05		 2 years crt.sh
*.wp.com
Sectigo RSA Domain Validation Secure Server CA		 2020-04-02 -
2022-07-05		 2 years crt.sh
*.google-analytics.com
GTS CA 1O1		 2020-07-07 -
2020-09-29		 3 months crt.sh
*.disqus.com
DigiCert SHA2 Secure Server CA		 2020-04-20 -
2022-05-09		 2 years crt.sh
*.doubleclick.net
GTS CA 1O1		 2020-06-30 -
2020-09-22		 3 months crt.sh
www.bing.com
Microsoft IT TLS CA 2		 2019-04-30 -
2021-04-30		 2 years crt.sh
ads-twitter.com
DigiCert SHA2 High Assurance Server CA		 2019-08-14 -
2020-08-18		 a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2020-06-09 -
2021-06-09		 a year crt.sh
*.adsrvr.org
Trustwave Organization Validation SHA256 CA, Level 1		 2019-03-07 -
2021-04-19		 2 years crt.sh
*.demandbase.com
Go Daddy Secure Certificate Authority - G2		 2018-09-20 -
2020-11-19		 2 years crt.sh
*.licdn.com
DigiCert SHA2 Secure Server CA		 2019-04-01 -
2021-05-07		 2 years crt.sh
www.google.de
GTS CA 1O1		 2020-06-30 -
2020-09-22		 3 months crt.sh
www.googleadservices.com
GTS CA 1O1		 2020-07-07 -
2020-09-29		 3 months crt.sh
px.ads.linkedin.com
DigiCert SHA2 Secure Server CA		 2020-03-04 -
2020-09-04		 6 months crt.sh
*.company-target.com
Go Daddy Secure Certificate Authority - G2		 2019-06-19 -
2021-08-18		 2 years crt.sh
*.g.doubleclick.net
GTS CA 1O1		 2020-07-07 -
2020-09-29		 3 months crt.sh
www.google.com
GTS CA 1O1		 2020-06-30 -
2020-09-22		 3 months crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2020-05-14 -
2020-08-05		 3 months crt.sh
quora.com
Let's Encrypt Authority X3		 2020-07-12 -
2020-10-10		 3 months crt.sh
*.avct.cloud
Let's Encrypt Authority X3		 2020-06-04 -
2020-09-02		 3 months crt.sh
*.yahoo.com
DigiCert SHA2 High Assurance Server CA		 2020-07-02 -
2020-08-16		 a month crt.sh
*.marketo.net
DigiCert SHA2 Secure Server CA		 2020-03-14 -
2021-04-13		 a year crt.sh
*.twitter.com
DigiCert SHA2 High Assurance Server CA		 2020-03-05 -
2021-03-02		 a year crt.sh
*.quora.com
Let's Encrypt Authority X3		 2020-07-12 -
2020-10-10		 3 months crt.sh
*.analytics.yahoo.com
DigiCert SHA2 High Assurance Server CA		 2020-03-04 -
2020-08-31		 6 months crt.sh
*.mktoresp.com
DigiCert SHA2 Secure Server CA		 2020-01-17 -
2022-01-21		 2 years crt.sh

This page contains 8 frames:

Primary Page: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Frame ID: 44ED10B4F45B8D0A55EE56205942FD08
Requests: 137 HTTP requests in this frame

Frame: https://9812475.fls.doubleclick.net/activityi;dc_pre=CO-R09_F5OoCFUqadwoda6EF1w;src=9812475;type=conve0;cat=forms000;ord=1;num=4606248325355;gtm=2wg7f0;auiddc=1249630020.1595547533;~oref=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-analysis%2F2020%2F07%2Fchinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware%2F
Frame ID: 407B476D63D26622B7ECC9E8FF7860D5
Requests: 1 HTTP requests in this frame

Frame: https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=43728%20https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D43728&t_u=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-analysis%2F2020%2F07%2Fchinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware%2F&t_e=Chinese%20APT%20group%20targets%20India%20and%20Hong%20Kong%20using%20new%20variant%20of%20MgBot%20malware&t_d=%0A%09%09%09%09%09Chinese%20APT%20group%20targets%20India%20and%20Hong%20Kong%20using%20new%20variant%20of%20MgBot%20malware%09%09%09%09&t_t=Chinese%20APT%20group%20targets%20India%20and%20Hong%20Kong%20using%20new%20variant%20of%20MgBot%20malware&s_o=default
Frame ID: 16329255D7195DAAB008ACA06FA221B1
Requests: 1 HTTP requests in this frame

Frame: https://5118230.fls.doubleclick.net/activityi;dc_pre=CLOGiODF5OoCFSjjuwgduX4DvA;src=5118230;type=count0;cat=secur00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1;num=3393624226158.951
Frame ID: 49D353738CE333319ED1AEBB3D329C12
Requests: 1 HTTP requests in this frame

Frame: https://insight.adsrvr.org/track/up?adv=8mirph5&ref=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-analysis%2F2020%2F07%2Fchinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware%2F&upid=r8yigtp&upv=1.1.0
Frame ID: 05D96FEA1940A46EDBC51F3B52100B8D
Requests: 1 HTTP requests in this frame

Frame: https://insight.adsrvr.org/track/up?adv=8mirph5&ref=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-analysis%2F2020%2F07%2Fchinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware%2F&upid=r8yigtp&upv=1.1.0
Frame ID: 050FF38272A26ECCD6EF03C8073A8B45
Requests: 1 HTTP requests in this frame

Frame: https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=43728%20https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D43728&t_u=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-analysis%2F2020%2F07%2Fchinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware%2F&t_e=Chinese%20APT%20group%20targets%20India%20and%20Hong%20Kong%20using%20new%20variant%20of%20MgBot%20malware&t_d=%0A%09%09%09%09%09Chinese%20APT%20group%20targets%20India%20and%20Hong%20Kong%20using%20new%20variant%20of%20MgBot%20malware%09%09%09%09&t_t=Chinese%20APT%20group%20targets%20India%20and%20Hong%20Kong%20using%20new%20variant%20of%20MgBot%20malware&s_o=default
Frame ID: 271E96345CFE364326657A5080771115
Requests: 1 HTTP requests in this frame

Frame: https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=43728%20https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D43728&t_u=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-analysis%2F2020%2F07%2Fchinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware%2F&t_e=Chinese%20APT%20group%20targets%20India%20and%20Hong%20Kong%20using%20new%20variant%20of%20MgBot%20malware&t_d=%0A%09%09%09%09%09Chinese%20APT%20group%20targets%20India%20and%20Hong%20Kong%20using%20new%20variant%20of%20MgBot%20malware%09%09%09%09&t_t=Chinese%20APT%20group%20targets%20India%20and%20Hong%20Kong%20using%20new%20variant%20of%20MgBot%20malware&s_o=default
Frame ID: E2762E373DF8BEED6874D2D1C5B31FA2
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://t.co/JeGMk0Fi9l Page URL
  2. https://lnkd.in/ecTgwaA HTTP 301
    https://www.linkedin.com/slink?code=ecTgwaA HTTP 301
    https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-... Page URL

Page Statistics

144
Requests

99 %
HTTPS

44 %
IPv6

34
Domains

44
Subdomains

40
IPs

7
Countries

4828 kB
Transfer

6437 kB
Size

8
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://t.co/JeGMk0Fi9l Page URL
  2. https://lnkd.in/ecTgwaA HTTP 301
    https://www.linkedin.com/slink?code=ecTgwaA HTTP 301
    https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 92
  • https://9812475.fls.doubleclick.net/activityi;src=9812475;type=conve0;cat=forms000;ord=1;num=4606248325355;gtm=2wg7f0;auiddc=1249630020.1595547533;~oref=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-analysis%2F2020%2F07%2Fchinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware%2F HTTP 302
  • https://9812475.fls.doubleclick.net/activityi;dc_pre=CO-R09_F5OoCFUqadwoda6EF1w;src=9812475;type=conve0;cat=forms000;ord=1;num=4606248325355;gtm=2wg7f0;auiddc=1249630020.1595547533;~oref=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-analysis%2F2020%2F07%2Fchinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware%2F
Request Chain 105
  • https://www.google-analytics.com/r/collect?v=1&_v=j83&a=454402035&t=pageview&_s=1&dl=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-analysis%2F2020%2F07%2Fchinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware%2F&dr=https%3A%2F%2Ft.co%2FJeGMk0Fi9l&ul=en-us&de=UTF-8&dt=Chinese%20APT%20group%20targets%20India%20and%20Hong%20Kong%20using%20new%20variant%20of%20MgBot%20malware%20%7C%20Malwarebytes%20Labs&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEAB~&jid=1565795180&gjid=1773934943&cid=443604896.1595547534&tid=UA-3347303-10&_gid=2014966214.1595547534&_r=1&z=1735567041 HTTP 302
  • https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-3347303-10&cid=443604896.1595547534&jid=1565795180&_gid=2014966214.1595547534&gjid=1773934943&_v=j83&z=1735567041 HTTP 302
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-3347303-10&cid=443604896.1595547534&jid=1565795180&_v=j83&z=1735567041 HTTP 302
  • https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-3347303-10&cid=443604896.1595547534&jid=1565795180&_v=j83&z=1735567041&slf_rd=1&random=3408842852
Request Chain 111
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1056361&url=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-analysis%2F2020%2F07%2Fchinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware%2F&time=1595547533697 HTTP 302
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D1056361%26url%3Dhttps%253A%252F%252Fblog.malwarebytes.com%252Fthreat-analysis%252F2020%252F07%252Fchinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware%252F%26time%3D1595547533697%26liSync%3Dtrue HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1056361&url=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-analysis%2F2020%2F07%2Fchinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware%2F&time=1595547533697&liSync=true
Request Chain 113
  • https://match.prod.bidr.io/cookie-sync/demandbase HTTP 303
  • https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1 HTTP 303
  • https://segments.company-target.com/log?vendor=choca&user_id=AAJ5Ck6-ND8AAA-B26RpAA HTTP 303
  • https://segments.company-target.com/validateCookie?vendor=choca&user_id=AAJ5Ck6-ND8AAA-B26RpAA&verifyHash=e650e85596099e286a1b0b07cec17d6697447df6
Request Chain 118
  • https://5118230.fls.doubleclick.net/activityi;src=5118230;type=count0;cat=secur00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1;num=3393624226158.951 HTTP 302
  • https://5118230.fls.doubleclick.net/activityi;dc_pre=CLOGiODF5OoCFSjjuwgduX4DvA;src=5118230;type=count0;cat=secur00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1;num=3393624226158.951
Request Chain 123
  • https://ads.avocet.io/s?add=5b8e9b462be173e55d6569fc&ty=j&_=1595547532702 HTTP 301
  • https://ads.avct.cloud/s?r=1&add=5b8e9b462be173e55d6569fc&ty=j&_=1595547532702 HTTP 302
  • https://ads.avct.cloud/s?bounce=true&r=1&add=5b8e9b462be173e55d6569fc&ty=j&_=1595547532702

144 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
JeGMk0Fi9l
t.co/ 		224 B
481 B 		Document
General
Check archive.org
Download Go to
Full URL
https://t.co/JeGMk0Fi9l
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.42.197 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
1eee843357d4e318953115f64f268ec75c1482606dcdd934389a7bb4855c719b
Security Headers
Name Value
Strict-Transport-Security max-age=0
X-Xss-Protection 0

Request headers

:method
GET
:authority
t.co
:scheme
https
:path
/JeGMk0Fi9l
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
200
cache-control
private,max-age=300
content-encoding
gzip
content-length
172
content-type
text/html; charset=utf-8
date
Thu, 23 Jul 2020 23:38:51 GMT
expires
Thu, 23 Jul 2020 23:43:51 GMT
server
tsa_o
set-cookie
muc=cc611699-02fd-4942-9f6d-52f1b86f089e; Max-Age=63072000; Expires=Sat, 23 Jul 2022 23:38:51 GMT; Domain=t.co; Secure; SameSite=None
strict-transport-security
max-age=0
vary
Origin
x-connection-hash
d598a70b8ad601c538f3e75c578384a4
x-response-time
119
x-xss-protection
0
Primary Request /
blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Redirect Chain
  • https://lnkd.in/ecTgwaA
  • https://www.linkedin.com/slink?code=ecTgwaA
  • https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
169 KB
33 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Requested by
Host: t.co
URL: https://t.co/JeGMk0Fi9l
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx / WP Engine
Resource Hash
4daee42a0ec7be4f50cef0de6d180fa8d5488d0e4616124c669758e340bde6de
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

:method
GET
:authority
blog.malwarebytes.com
:scheme
https
:path
/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
document
referer
https://t.co/JeGMk0Fi9l
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://t.co/JeGMk0Fi9l

Response headers

status
200
server
nginx
date
Thu, 23 Jul 2020 23:38:52 GMT
content-type
text/html; charset=UTF-8
vary
Accept-Encoding Accept-Encoding Accept-Encoding,Cookie
x-pingback
https://blog.malwarebytes.com/xmlrpc.php
link
<https://blog.malwarebytes.com/wp-json/>; rel="https://api.w.org/" <https://blog.malwarebytes.com/?p=43728>; rel=shortlink
x-powered-by
WP Engine
x-cacheable
SHORT
cache-control
max-age=600, must-revalidate
x-cache
HIT: 1
x-cache-group
normal
x-frame-options
SAMEORIGIN
content-encoding
br

Redirect headers

status
301
cache-control
no-cache, no-store
pragma
no-cache
content-encoding
gzip
expires
Thu, 01 Jan 1970 00:00:00 GMT
location
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
vary
Accept-Encoding
set-cookie
bcookie="v=2&4b0f96b0-16d5-401b-8f6f-5b5a8e3dd86f"; domain=.linkedin.com; Path=/; Secure; Expires=Sun, 24-Jul-2022 11:16:23 GMT; SameSite=None bscookie="v=1&2020072323385139bbaa37-a58a-4cc2-8247-061d2dbe6340AQHLpNhXQJEr1xDxRfRgGzBt6WCJaOuN"; domain=.www.linkedin.com; Path=/; Secure; Expires=Sun, 24-Jul-2022 11:16:23 GMT; HttpOnly; SameSite=None lissc=1; domain=.linkedin.com; Path=/; Secure; Expires=Fri, 23-Jul-2021 23:38:51 GMT; SameSite=None lidc="b=VGST06:g=1850:u=1:i=1595547531:t=1595633931:s=AQHYlot1XHhF-w-1u2kKdj3TIR3fOQCu"; Expires=Fri, 24 Jul 2020 23:38:51 GMT; domain=.linkedin.com; Path=/; SameSite=None; Secure
expect-ct
max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct"
x-xss-protection
1; mode=block
content-security-policy
default-src *; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id https://lnkd.demdex.net/event blob: https://accounts.google.com/gsi/status https://linkedin.sc.omtrdc.net/b/ss/ static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com https://snap.licdn.com/li.lms-analytics/insight.min.js platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'
x-frame-options
sameorigin
x-content-type-options
nosniff
strict-transport-security
max-age=2592000
x-li-fabric
prod-lva1
x-li-pop
afd-prod-lva1
x-li-proto
http/2
x-li-uuid
ILiGyQaGJBZQmQ8tsyoAAA==
x-msedge-ref
Ref A: C422AD3D5D0546B9969B8530A1B314D5 Ref B: FRAEDGE1414 Ref C: 2020-07-23T23:38:51Z
date
Thu, 23 Jul 2020 23:38:51 GMT
style.min.css
blog.malwarebytes.com/wp-includes/css/dist/block-library/ 		52 KB
8 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://blog.malwarebytes.com/wp-includes/css/dist/block-library/style.min.css?ver=5.4.2
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
bca7af0b45b6fc6a2064e8e7a34f2041f3e77261e63f0257209bcde6bc40545d

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:52 GMT
content-encoding
br
last-modified
Fri, 24 Apr 2020 15:32:14 GMT
server
nginx
status
200
etag
W/"5ea3067e-d159"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
prettyPhoto.css
blog.malwarebytes.com/wp-content/plugins/responsive-lightbox/assets/prettyphoto/css/ 		19 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://blog.malwarebytes.com/wp-content/plugins/responsive-lightbox/assets/prettyphoto/css/prettyPhoto.css?ver=1.7.2
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
1f504f86bc8f301e4041e744f681cce164e9ac5e8e5dfacc984a012e95e1a7cd

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:52 GMT
content-encoding
br
last-modified
Wed, 28 Feb 2018 21:17:34 GMT
server
nginx
status
200
etag
W/"5a971c6e-4db5"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
css
fonts.googleapis.com/ 		17 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Source+Sans+Pro%3A300%2C400%2C700%2C300italic%2C400italic%2C700italic%7CBitter%3A400%2C700&subset=latin%2Clatin-ext
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
edda03990c5d77149008225a15938e07aa1998d2cdff56f693273a498214d600
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
status
200
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Thu, 23 Jul 2020 23:38:52 GMT
server
ESF
date
Thu, 23 Jul 2020 23:38:52 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Thu, 23 Jul 2020 23:38:52 GMT
genericons.css
blog.malwarebytes.com/wp-content/plugins/jetpack/_inc/genericons/genericons/ 		28 KB
16 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://blog.malwarebytes.com/wp-content/plugins/jetpack/_inc/genericons/genericons/genericons.css?ver=3.1
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
4ed10d0d64bb1515397e8666a63f484d640dbc5678fa62574e077b7aef1c3af2

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:52 GMT
content-encoding
br
last-modified
Wed, 28 Feb 2018 21:17:31 GMT
server
nginx
status
200
etag
W/"5a971c6b-6e6a"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
style.css
blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/ 		92 KB
16 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/style.css?ver=2013-07-18
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
21566c5bf140021872a218e16bd8d32d6ee52869d918d75fca0e3f396319fa9a

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:52 GMT
content-encoding
br
last-modified
Tue, 12 May 2020 20:50:39 GMT
server
nginx
status
200
etag
W/"5ebb0c1f-16f4e"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
jquery.js
blog.malwarebytes.com/wp-includes/js/jquery/ 		95 KB
34 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.malwarebytes.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:52 GMT
content-encoding
br
last-modified
Fri, 17 May 2019 04:25:54 GMT
server
nginx
status
200
etag
W/"5cde37d2-17a69"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
jquery-migrate.min.js
blog.malwarebytes.com/wp-includes/js/jquery/ 		10 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.malwarebytes.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:52 GMT
content-encoding
br
last-modified
Fri, 20 May 2016 06:11:28 GMT
server
nginx
status
200
etag
W/"573eaa90-2748"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
jquery.prettyPhoto.js
blog.malwarebytes.com/wp-content/plugins/responsive-lightbox/assets/prettyphoto/js/ 		37 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.malwarebytes.com/wp-content/plugins/responsive-lightbox/assets/prettyphoto/js/jquery.prettyPhoto.js?ver=1.7.2
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
e5087adff56cd9077a7b21a01d78e2a97177cbf4872935bbf3049d06ee884826

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:52 GMT
content-encoding
br
last-modified
Wed, 28 Feb 2018 21:17:34 GMT
server
nginx
status
200
etag
W/"5a971c6e-94b4"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
front.js
blog.malwarebytes.com/wp-content/plugins/responsive-lightbox/js/ 		18 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.malwarebytes.com/wp-content/plugins/responsive-lightbox/js/front.js?ver=1.7.2
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
95a2c350aabb2955eaaf7a8bbfb494c2533cc20207ac4a026a0100dbac0a554a

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:52 GMT
content-encoding
br
last-modified
Wed, 28 Feb 2018 21:17:34 GMT
server
nginx
status
200
etag
W/"5a971c6e-4711"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
style.css
www.malwarebytes.com/css/ 		220 KB
33 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.malwarebytes.com/css/style.css?12-20-2016
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:214f:6000:8:d3fb:39c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
dc42fce6a19644a91580fca515239623b6b818439b830f9af5392787de4e397f

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:53 GMT
content-encoding
gzip
last-modified
Wed, 22 Jul 2020 01:18:44 GMT
server
AmazonS3
x-amz-cf-pop
FRA53-C1
vary
Accept-Encoding
x-cache
RefreshHit from cloudfront
content-type
text/css
status
200
x-amz-cf-id
DmLgkBElA2Qdyq96kZApfJ5Epeng6OrsGpeXgJu9LPdfujr86DLwlg==
via
1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
style.css
blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/ 		92 KB
16 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/style.css
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
21566c5bf140021872a218e16bd8d32d6ee52869d918d75fca0e3f396319fa9a

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:52 GMT
content-encoding
br
last-modified
Tue, 12 May 2020 20:50:39 GMT
server
nginx
status
200
etag
W/"5ebb0c1f-16f4e"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
jquery-1.11.3.min.js
www.malwarebytes.com/js/ 		94 KB
33 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.malwarebytes.com/js/jquery-1.11.3.min.js
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:214f:6000:8:d3fb:39c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
ecb916133a9376911f10bc5c659952eb0031e457f5df367cde560edbfba38fb8

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:17 GMT
content-encoding
gzip
last-modified
Thu, 09 Jul 2020 20:58:51 GMT
server
AmazonS3
age
35
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
status
200
x-amz-cf-pop
FRA53-C1
x-amz-cf-id
HD8_ooTO5dBI19HSWztQggwdyOdHg-ofBM87mKuIkHBMwQIuNmU94g==
via
1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
9530a107-0af8-4204-a2c2-217efb78222b.js
optanon.blob.core.windows.net/consent/ 		140 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://optanon.blob.core.windows.net/consent/9530a107-0af8-4204-a2c2-217efb78222b.js
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.239.137.4 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
b28678c51b4397abc7951fe8a69a8aec0fa299159d5eb4ced487aabbb89f44b5

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
Date
Thu, 23 Jul 2020 23:38:52 GMT
Content-Encoding
GZIP
Last-Modified
Thu, 27 Feb 2020 21:48:10 GMT
Server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Content-MD5
ufyNfC1IAg9j/Ir1yJGMGA==
ETag
0x8D7BBCEBD00AC67
Content-Type
application/x-javascript
Access-Control-Allow-Origin
*
x-ms-request-id
7ac28724-601e-0081-754a-617ab1000000
Access-Control-Expose-Headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
Cache-Control
public, max-age=14400
x-ms-version
2009-09-19
Content-Length
20612
bootstrap.js
www.malwarebytes.com/js/ 		67 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.malwarebytes.com/js/bootstrap.js
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:214f:6000:8:d3fb:39c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
425328ed7a60e35938fa92fc7ba5f5af96b53f9608bb41b8a07c0f91e8bdefcd

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:53 GMT
content-encoding
gzip
last-modified
Thu, 09 Jul 2020 20:58:51 GMT
server
AmazonS3
x-amz-cf-pop
FRA53-C1
vary
Accept-Encoding
x-cache
RefreshHit from cloudfront
content-type
application/javascript
status
200
x-amz-cf-id
4vsBLqgfjYhgyfN9nhwXIvLqsbjBPCEj_vmN1msq4Jf0iOd7pTkiAg==
via
1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
respond.min.js
www.malwarebytes.com/js/ie-fixes/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.malwarebytes.com/js/ie-fixes/respond.min.js
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:214f:6000:8:d3fb:39c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
75f9768f79e42df5aa6183372a4b067f02682606cca5f242e06d1e07f3614c94

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:53 GMT
content-encoding
gzip
last-modified
Thu, 09 Jul 2020 20:58:51 GMT
server
AmazonS3
x-amz-cf-pop
FRA53-C1
vary
Accept-Encoding
x-cache
RefreshHit from cloudfront
content-type
application/javascript
status
200
x-amz-cf-id
4ggZgFU0kIumDIfx-ItbFIaLnFrEtydM39QDztalHV-mUqLP_hSbAQ==
via
1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
modernizr.js
blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/ 		17 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/modernizr.js
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
da819542692b3f1c2a667ba34eff3465a82d9756953a1446ab7d0772f9b1edd5

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:52 GMT
content-encoding
br
last-modified
Tue, 12 May 2020 20:50:39 GMT
server
nginx
status
200
etag
W/"5ebb0c1f-434b"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
nav-resize.js
www.malwarebytes.com/js/ 		11 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.malwarebytes.com/js/nav-resize.js
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:214f:6000:8:d3fb:39c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
527f5743db62b7f9d19fb4b1910eb56d63f76f50b0e0180b63eb67d374642099

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:53 GMT
content-encoding
gzip
last-modified
Thu, 09 Jul 2020 20:58:52 GMT
server
AmazonS3
x-amz-cf-pop
FRA53-C1
vary
Accept-Encoding
x-cache
RefreshHit from cloudfront
content-type
application/javascript
status
200
x-amz-cf-id
A2uRdsGBAWFc_NloZ9uPcBSFIOglyw5EzR4e8V651v45iFWmJr9ElA==
via
1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
flexibility.js
www.malwarebytes.com/js/ 		17 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.malwarebytes.com/js/flexibility.js
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:214f:6000:8:d3fb:39c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
58c13e24cdfb6384c26836e3eac52d17701cd9d686c56ebf93efbbe9426f8cd6

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:53 GMT
content-encoding
gzip
last-modified
Thu, 09 Jul 2020 20:58:51 GMT
server
AmazonS3
x-amz-cf-pop
FRA53-C1
vary
Accept-Encoding
x-cache
RefreshHit from cloudfront
content-type
application/javascript
status
200
x-amz-cf-id
IJj-5Y8aBZSnRaJ95exSxDrU9SOyKdNfu3MSqrfU24IRK4mNLDrl0g==
via
1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
global.js
www.malwarebytes.com/js/ 		19 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.malwarebytes.com/js/global.js
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:214f:6000:8:d3fb:39c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
84415c35f6869b6b17590d6ba8f3115751f14d54adecbb27123008c416e4556d

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:53 GMT
content-encoding
gzip
last-modified
Thu, 09 Jul 2020 20:58:51 GMT
server
AmazonS3
x-amz-cf-pop
FRA53-C1
vary
Accept-Encoding
x-cache
RefreshHit from cloudfront
content-type
application/javascript
status
200
x-amz-cf-id
m-X8p0TqpM47Wit1VPR43_3fWhQNUmJtBdpHzCnWDUfeX075B_crYQ==
via
1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
xs.js
www.malwarebytes.com/js/ 		9 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.malwarebytes.com/js/xs.js
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:214f:6000:8:d3fb:39c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
a182e45f051c3b540f4e10ea2b38b08db2ba43d38ff33686de11b23e56df7a1b

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:53 GMT
via
1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
last-modified
Thu, 09 Jul 2020 20:58:53 GMT
server
AmazonS3
x-amz-cf-pop
FRA53-C1
etag
"9096c411f523c580aec8069027170501"
vary
Accept-Encoding
x-cache
RefreshHit from cloudfront
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
8936
x-amz-cf-id
fzF0E9MvIhJWADtVqoyXpWE2YJnDCeEKt3aqJVwvReCkjsQAX_OX6g==
search.js
blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/js/ 		1 KB
712 B 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/js/search.js
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
1dc2b8fb26c1a74260a66519a2a5fdf37a938d1b43bbe4d8da7fcd652acc61b9

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:52 GMT
content-encoding
br
last-modified
Tue, 12 May 2020 20:50:39 GMT
server
nginx
status
200
etag
W/"5ebb0c1f-55e"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
NEW-NAV.css
www.malwarebytes.com/css/ 		22 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.malwarebytes.com/css/NEW-NAV.css
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:214f:6000:8:d3fb:39c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
72622641b79819e5c8b5c0543d105a45e30f13b1a6c0b5c3701e72de5b57e427

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:53 GMT
content-encoding
gzip
last-modified
Thu, 09 Jul 2020 20:56:59 GMT
server
AmazonS3
x-amz-cf-pop
FRA53-C1
vary
Accept-Encoding
x-cache
RefreshHit from cloudfront
content-type
text/css
status
200
x-amz-cf-id
cR65D5gWoSbUQ2GXg1Cnnbsft0p-3uFdnm_Oqx657bNhP1hx2vaGUQ==
via
1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
new-nav.js
blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/js/ 		6 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/js/new-nav.js
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
a2b3f57762f2932505c6fa9b43932cb13856966074febc5bb048052f17100bf6

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:52 GMT
content-encoding
br
last-modified
Tue, 12 May 2020 20:50:39 GMT
server
nginx
status
200
etag
W/"5ebb0c1f-1703"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
search.svg
blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/images/ 		296 B
438 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/images/search.svg
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
8f796d398e512c5d19a2fecc943d19a204927ff3cf9ec2cb3f75a025535268cd

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:52 GMT
content-encoding
br
last-modified
Tue, 12 May 2020 20:50:39 GMT
server
nginx
status
200
etag
W/"5ebb0c1f-128"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
shutterstock_211879096.png
blog.malwarebytes.com/wp-content/uploads/2020/07/ 		646 KB
647 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2020/07/shutterstock_211879096.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
cbaa38189100f63524edc0c56f02837d40b324092fb1c81d1d58ea81c9fdf0c2

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:52 GMT
last-modified
Thu, 16 Jul 2020 23:37:02 GMT
server
nginx
status
200
etag
"5f10e49e-a16d3"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
661203
mailsecuritycheck-1.png
blog.malwarebytes.com/wp-content/uploads/2020/07/ 		81 KB
82 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2020/07/mailsecuritycheck-1.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
95c7f143520240d6ddd08776c754b96ba709e42593003ebb552d44416d4f2906

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:52 GMT
last-modified
Tue, 21 Jul 2020 22:58:16 GMT
server
nginx
status
200
etag
"5f177308-14556"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
83286
remoteTemplate-1.png
blog.malwarebytes.com/wp-content/uploads/2020/07/ 		21 KB
22 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2020/07/remoteTemplate-1.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
e6c0b8dbdb837d061061130cf8ac71861f0983dcbd935e8f5efe895d0b7e19b0

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:52 GMT
last-modified
Tue, 21 Jul 2020 22:58:49 GMT
server
nginx
status
200
etag
"5f177329-5551"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
21841
dde-1.png
blog.malwarebytes.com/wp-content/uploads/2020/07/ 		98 KB
98 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2020/07/dde-1.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
7f241b243217cbb0dec56966b1352349b74d6516ce764b7ca01e3d45a0483f13

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:52 GMT
last-modified
Tue, 21 Jul 2020 22:59:20 GMT
server
nginx
status
200
etag
"5f177348-1879c"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
100252
dde-decoded-1.png
blog.malwarebytes.com/wp-content/uploads/2020/07/ 		15 KB
15 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2020/07/dde-decoded-1.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
9b07fa54e76c45b97d3a8224c641338f28981f05b93158ea6beb637613591490

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:52 GMT
last-modified
Tue, 21 Jul 2020 22:59:55 GMT
server
nginx
status
200
etag
"5f17736b-3c65"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
15461
sct-file-1.png
blog.malwarebytes.com/wp-content/uploads/2020/07/ 		66 KB
66 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2020/07/sct-file-1.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
ac89084ed8ff309c9302cda7a550a0f679a9a34a3b420de2a87567f1089bb51e

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:52 GMT
last-modified
Tue, 21 Jul 2020 23:00:19 GMT
server
nginx
status
200
etag
"5f177383-10753"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
67411
Screen-Shot-2020-07-07-at-12.29.43-PM.png
blog.malwarebytes.com/wp-content/uploads/2020/07/ 		95 KB
95 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2020/07/Screen-Shot-2020-07-07-at-12.29.43-PM.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
0389971a85fb3695b9ea3e242cdb83601342d3bf8f9d853f85b7a408d01acb35

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:52 GMT
last-modified
Tue, 07 Jul 2020 16:38:50 GMT
server
nginx
status
200
etag
"5f04a51a-17a4c"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
96844
wp-emoji-release.min.js
blog.malwarebytes.com/wp-includes/js/ 		14 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.malwarebytes.com/wp-includes/js/wp-emoji-release.min.js?ver=5.4.2
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
96d33f532112177ede6bf262dcf6d0140dbe29f05a4595d17b0be4743205b5ea

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:52 GMT
content-encoding
br
last-modified
Tue, 05 Nov 2019 22:04:02 GMT
server
nginx
status
200
etag
W/"5dc1f1d2-364d"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
dde-2-1.png
blog.malwarebytes.com/wp-content/uploads/2020/07/ 		146 KB
146 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2020/07/dde-2-1.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
0987c7d80d4a820adf5a8b31aaac86ee6851ebc6db30f85e51b0dedf58187ebb

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:52 GMT
last-modified
Tue, 21 Jul 2020 23:00:41 GMT
server
nginx
status
200
etag
"5f177399-24659"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
149081
dde-decoded-2-1.png
blog.malwarebytes.com/wp-content/uploads/2020/07/ 		20 KB
20 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2020/07/dde-decoded-2-1.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
3fad9ac7120a5c25be31604882141046a6af4801e7f3e737f471ec85a31eed2a

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:52 GMT
last-modified
Tue, 21 Jul 2020 23:01:00 GMT
server
nginx
status
200
etag
"5f1773ac-501f"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
20511
Screen-Shot-2020-07-07-at-12.30.07-PM-600x365.png
blog.malwarebytes.com/wp-content/uploads/2020/07/ 		40 KB
41 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2020/07/Screen-Shot-2020-07-07-at-12.30.07-PM-600x365.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
7edb235d4485d2b65bb9f2cd203519456eb3c68aa8d310692873370b00310258

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:52 GMT
last-modified
Tue, 07 Jul 2020 17:03:48 GMT
server
nginx
status
200
etag
"5f04aaf4-a1db"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
41435
boris-1-600x272.png
blog.malwarebytes.com/wp-content/uploads/2020/07/ 		101 KB
101 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2020/07/boris-1-600x272.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
556039e99c2003586da0956a06249f81088f4d770fb32ee1520fc8847dc53369

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:52 GMT
last-modified
Tue, 21 Jul 2020 23:01:16 GMT
server
nginx
status
200
etag
"5f1773bc-1924c"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
102988
remoteTemplteBoris-1.png
blog.malwarebytes.com/wp-content/uploads/2020/07/ 		18 KB
19 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2020/07/remoteTemplteBoris-1.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
4de8225a3fcdf1ba33ac5c087576fc7895e29eb38b61d78a03090c13607a483e

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:52 GMT
last-modified
Tue, 21 Jul 2020 23:01:29 GMT
server
nginx
status
200
etag
"5f1773c9-49af"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
18863
Screen-Shot-2020-07-07-at-5.07.25-PM-300x115-1.png
blog.malwarebytes.com/wp-content/uploads/2020/07/ 		15 KB
15 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2020/07/Screen-Shot-2020-07-07-at-5.07.25-PM-300x115-1.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
7e0e6534aaf81d8e89e452e105647a47176d856b29700b4bd7a53d6a25e1ff90

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:52 GMT
last-modified
Tue, 21 Jul 2020 23:01:51 GMT
server
nginx
status
200
etag
"5f1773df-3a70"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
14960
Screen-Shot-2020-07-07-at-5.07.58-PM-2-2048x350.png
blog.malwarebytes.com/wp-content/uploads/2020/07/ 		202 KB
203 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2020/07/Screen-Shot-2020-07-07-at-5.07.58-PM-2-2048x350.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
fbe40e7eb98f817ec0314b26ed607e404b3801f610ff4ff2ec53d331825d41ba

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:52 GMT
last-modified
Tue, 21 Jul 2020 23:02:30 GMT
server
nginx
status
200
etag
"5f177406-329e5"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
207333
virutalizationChecks-1.png
blog.malwarebytes.com/wp-content/uploads/2020/07/ 		153 KB
154 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2020/07/virutalizationChecks-1.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
3a034532b3989207e563a25b94e567e6b51247994b08fa5259e1414390a864d7

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:52 GMT
last-modified
Tue, 21 Jul 2020 23:02:47 GMT
server
nginx
status
200
etag
"5f177417-264cc"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
156876
av-1.png
blog.malwarebytes.com/wp-content/uploads/2020/07/ 		104 KB
105 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2020/07/av-1.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
cfa4a4e7bddabbf32a465874ca2396a5efb96554c29b460d971930033cc8f7a2

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:52 GMT
last-modified
Tue, 21 Jul 2020 23:03:08 GMT
server
nginx
status
200
etag
"5f17742c-1a1b8"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
106936
apis-1.png
blog.malwarebytes.com/wp-content/uploads/2020/07/ 		73 KB
74 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2020/07/apis-1.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
9095640221be2b81b98395dbd641fa001f65b8ddda73be005e331cc2f78fed54

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:52 GMT
last-modified
Tue, 21 Jul 2020 23:03:36 GMT
server
nginx
status
200
etag
"5f177448-124ec"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
74988
winexec-1.png
blog.malwarebytes.com/wp-content/uploads/2020/07/ 		18 KB
18 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2020/07/winexec-1.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
d78c7c2df9ae3de0ee35443fa0edfd12d1f94e7c1bf6cc446a152ab2e29b0a1a

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:52 GMT
last-modified
Tue, 21 Jul 2020 23:03:56 GMT
server
nginx
status
200
etag
"5f17745c-46d0"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
18128
expand-1.png
blog.malwarebytes.com/wp-content/uploads/2020/07/ 		29 KB
29 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2020/07/expand-1.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
ea745edf3b12b505f9a6ffc05927aec58134c98f4d7b2a5f4c53c39449a0306f

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:52 GMT
last-modified
Tue, 21 Jul 2020 23:04:20 GMT
server
nginx
status
200
etag
"5f177474-7408"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
29704
reg2new-1.png
blog.malwarebytes.com/wp-content/uploads/2020/07/ 		63 KB
63 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2020/07/reg2new-1.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
dbb3f45c95eda5dfbb4ec5f9db45d8385f78d6dcf380e4eaf07f19e753804942

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:52 GMT
last-modified
Tue, 21 Jul 2020 23:04:38 GMT
server
nginx
status
200
etag
"5f177486-fb75"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
64373
regnew1-1.png
blog.malwarebytes.com/wp-content/uploads/2020/07/ 		82 KB
82 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2020/07/regnew1-1.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
db00899dec60287f05cbee4d6e185d92d49300e2cc229f2cca3ec73ce0cd9850

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:52 GMT
last-modified
Tue, 21 Jul 2020 23:04:54 GMT
server
nginx
status
200
etag
"5f177496-1481f"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
83999
cmdnew-1.png
blog.malwarebytes.com/wp-content/uploads/2020/07/ 		14 KB
14 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2020/07/cmdnew-1.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
32aa657c37799bedc062cbc95765b5a51cecbe24168625e56cb21d41701ab53d

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:52 GMT
last-modified
Tue, 21 Jul 2020 23:05:16 GMT
server
nginx
status
200
etag
"5f1774ac-370a"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
14090
Screen-Shot-2020-07-13-at-4.05.06-PM-1.png
blog.malwarebytes.com/wp-content/uploads/2020/07/ 		23 KB
24 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2020/07/Screen-Shot-2020-07-13-at-4.05.06-PM-1.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
75576560e22fd4d4c913f4c8ba3372e09a073e75ebc34e956b4e93254f88e74d

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:52 GMT
last-modified
Tue, 21 Jul 2020 23:05:57 GMT
server
nginx
status
200
etag
"5f1774d5-5d2e"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
23854
rich-header-1.png
blog.malwarebytes.com/wp-content/uploads/2020/07/ 		66 KB
67 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2020/07/rich-header-1.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
ede2fb9fcd66ca3fb915267a07ebd54fb330c5924bad7b7051735b3cb6260aa0

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:52 GMT
last-modified
Tue, 21 Jul 2020 23:06:15 GMT
server
nginx
status
200
etag
"5f1774e7-1095e"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
67934
wmicode-1.png
blog.malwarebytes.com/wp-content/uploads/2020/07/ 		91 KB
92 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2020/07/wmicode-1.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
d0b70e9284f50b10ae83339964ef179bbd31e1918f220fe3e668680fef20c1b8

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:52 GMT
last-modified
Tue, 21 Jul 2020 23:06:38 GMT
server
nginx
status
200
etag
"5f1774fe-16d64"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
93540
wmi-1.png
blog.malwarebytes.com/wp-content/uploads/2020/07/ 		87 KB
87 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2020/07/wmi-1.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
27746d8f30f7d5d665c6e70dfa1aab08476daec038ce0fd5c1d4ba21ab6bde77

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:52 GMT
last-modified
Tue, 21 Jul 2020 23:06:51 GMT
server
nginx
status
200
etag
"5f17750b-15a8c"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
88716
type-510x600-1.png
blog.malwarebytes.com/wp-content/uploads/2020/07/ 		97 KB
97 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2020/07/type-510x600-1.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
24830366dd34f6f8eb08135dd0bf59795c7311d14d9265ef0d033241977798ea

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:52 GMT
last-modified
Tue, 21 Jul 2020 23:07:08 GMT
server
nginx
status
200
etag
"5f17751c-1849e"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
99486
VT-1-1.png
blog.malwarebytes.com/wp-content/uploads/2020/07/ 		197 KB
198 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2020/07/VT-1-1.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
e345b8b70569822ac6512a71256a8b29a6836b20a1c8b31043b6e3431db13ac9

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:52 GMT
last-modified
Tue, 21 Jul 2020 23:07:25 GMT
server
nginx
status
200
etag
"5f17752d-31547"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
202055
android-1.png
blog.malwarebytes.com/wp-content/uploads/2020/07/ 		176 KB
176 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2020/07/android-1.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
106941a0835c23647fa021b02ae9f0edb9b055ac0129e07847833426c521eefa

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:52 GMT
last-modified
Tue, 21 Jul 2020 23:07:38 GMT
server
nginx
status
200
etag
"5f17753a-2bef6"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
179958
contacts-1.png
blog.malwarebytes.com/wp-content/uploads/2020/07/ 		86 KB
87 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2020/07/contacts-1.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
3a0b747d5c485e2786bb3ad33439080539fcb903f74e61bb0bb67748e7c72a5e

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:52 GMT
last-modified
Tue, 21 Jul 2020 23:08:00 GMT
server
nginx
status
200
etag
"5f177550-15982"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
88450
nebula_.png
blog.malwarebytes.com/wp-content/uploads/2020/07/ 		59 KB
59 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2020/07/nebula_.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
3df3409edbf5a97d5a05bb81002a02fdd200d7fa3000e231e91ddbdf8641b573

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:52 GMT
last-modified
Fri, 17 Jul 2020 00:01:00 GMT
server
nginx
status
200
etag
"5f10ea3c-eaf3"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
60147
shutterstock_720388555-604x270.png
blog.malwarebytes.com/wp-content/uploads/2020/06/ 		100 KB
100 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2020/06/shutterstock_720388555-604x270.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
276addee7d845ec184d2792eb94930a30e017a95a3e4bc2c1ef29a187b6aaa3d

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:52 GMT
last-modified
Wed, 17 Jun 2020 02:03:15 GMT
server
nginx
status
200
etag
"5ee979e3-18ebe"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
102078
shutterstock_362747861-604x270.jpg
blog.malwarebytes.com/wp-content/uploads/2020/06/ 		42 KB
42 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2020/06/shutterstock_362747861-604x270.jpg
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
446f32d3a05972e084384fe34db2a544bd915e75e7214a7d1ea077835ef3b9fc

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:52 GMT
last-modified
Tue, 02 Jun 2020 19:31:22 GMT
server
nginx
status
200
etag
"5ed6a90a-a65a"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
42586
macbook-1280687_1920-604x270.jpg
blog.malwarebytes.com/wp-content/uploads/2016/09/ 		8 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2016/09/macbook-1280687_1920-604x270.jpg
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
6f2119e2ee27e3f616f499ae99d6bd5cfcf2b5ebcbbf92c143baee8d0fa14125

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:52 GMT
last-modified
Thu, 26 Jan 2017 03:05:39 GMT
server
nginx
status
200
etag
"58896783-20e3"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
8419
shutterstock_610335074-604x270.jpg
blog.malwarebytes.com/wp-content/uploads/2018/01/ 		27 KB
27 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2018/01/shutterstock_610335074-604x270.jpg
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
20e0c33005383c34dfcfc883e3d1638bde3a97733800e9cc7fc76a15b48299d7

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:52 GMT
last-modified
Mon, 15 Jan 2018 11:33:47 GMT
server
nginx
status
200
etag
"5a5c919b-6ace"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
27342
shutterstock_508344517-604x270.png
blog.malwarebytes.com/wp-content/uploads/2020/03/ 		299 KB
299 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/uploads/2020/03/shutterstock_508344517-604x270.png
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
b54cc529878005a6a68b1403d8a962bb0087a1ed0a1b8de4a9e4113d9f334613

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:52 GMT
last-modified
Fri, 13 Mar 2020 19:11:05 GMT
server
nginx
status
200
etag
"5e6bdac9-4aad1"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
305873
147cd7280d6ece931e4488a3a10809d9
secure.gravatar.com/avatar/ 		11 KB
11 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://secure.gravatar.com/avatar/147cd7280d6ece931e4488a3a10809d9?s=96&d=identicon&r=g
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1f462c2a1a60b244e8901d78293b03c6f554ea0364b57e7412550cd842484b90

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc
HIT fra 1
date
Thu, 23 Jul 2020 23:38:52 GMT
last-modified
Thu, 18 Jul 2019 15:17:37 GMT
server
nginx
status
200
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=300
content-disposition
inline; filename="147cd7280d6ece931e4488a3a10809d9.png"
accept-ranges
bytes
link
<https://www.gravatar.com/avatar/147cd7280d6ece931e4488a3a10809d9?s=96&d=identicon&r=g>; rel="canonical"
content-length
11084
expires
Thu, 23 Jul 2020 23:43:52 GMT
labs-nav.js
blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/js/ 		493 B
413 B 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/js/labs-nav.js
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
19333622f176d68bc17e307d8df96b15447864fbb0bbaac495e507fa64d96077

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:52 GMT
content-encoding
br
last-modified
Tue, 12 May 2020 20:50:39 GMT
server
nginx
status
200
etag
W/"5ebb0c1f-1ed"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
contributors.svg
blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/images/footer/ 		910 B
743 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/images/footer/contributors.svg
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
6429fe0ed81fca5f6bb18cb0a0aacae3bd9de79192635aeed4cbda438139d75d

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:52 GMT
content-encoding
br
last-modified
Tue, 12 May 2020 20:50:39 GMT
server
nginx
status
200
etag
W/"5ebb0c1f-38e"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
threat-center.svg
blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/images/footer/ 		2 KB
852 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/images/footer/threat-center.svg
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
32d4b293bb7f25a21cc44e81184d4bbcb3bdd1837e026b98ed0ad85b3b1a5292

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:52 GMT
content-encoding
br
last-modified
Tue, 12 May 2020 20:50:39 GMT
server
nginx
status
200
etag
W/"5ebb0c1f-812"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
glossary.svg
blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/images/footer/ 		760 B
654 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/images/footer/glossary.svg
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
b4e6efb587f3fdfb8155148201d0c51ac95d249a6727e8256acdfe624ade69af

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:52 GMT
content-encoding
br
last-modified
Tue, 12 May 2020 20:50:39 GMT
server
nginx
status
200
etag
W/"5ebb0c1f-2f8"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
scams.svg
blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/images/footer/ 		842 B
698 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/images/footer/scams.svg
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
05a173cb58022e81eb499529ac56df6ad7bafe1c61b8128dca8b76f300b5b60e

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:52 GMT
content-encoding
br
last-modified
Tue, 12 May 2020 20:50:39 GMT
server
nginx
status
200
etag
W/"5ebb0c1f-34a"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
write.svg
blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/images/footer/ 		615 B
585 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/images/footer/write.svg
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
a6a97c4046257c7e4e063c9f76434c7ce2c1f105e46b07424fabfc054f2d4d24

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:52 GMT
content-encoding
br
last-modified
Tue, 12 May 2020 20:50:39 GMT
server
nginx
status
200
etag
W/"5ebb0c1f-267"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
jetpack-carousel.css
blog.malwarebytes.com/wp-content/plugins/jetpack/modules/carousel/ 		25 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://blog.malwarebytes.com/wp-content/plugins/jetpack/modules/carousel/jetpack-carousel.css?ver=20120629
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
886f70c3e30343eb48a987ba13f995c122f17d8cd5b90094369cbe42924c3e91

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:52 GMT
content-encoding
br
last-modified
Wed, 28 Feb 2018 21:17:32 GMT
server
nginx
status
200
etag
W/"5a971c6c-6483"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
comment_count.js
blog.malwarebytes.com/wp-content/plugins/disqus-comment-system/public/js/ 		889 B
620 B 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.malwarebytes.com/wp-content/plugins/disqus-comment-system/public/js/comment_count.js?ver=3.0.12
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
cea0a05c5af6e21a409875328ed2e3dba79131b7c41f8ea07d0e0e02c7b7b59e

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:52 GMT
content-encoding
br
last-modified
Wed, 28 Feb 2018 21:17:30 GMT
server
nginx
status
200
etag
W/"5a971c6a-379"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
comment_embed.js
blog.malwarebytes.com/wp-content/plugins/disqus-comment-system/public/js/ 		1 KB
686 B 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.malwarebytes.com/wp-content/plugins/disqus-comment-system/public/js/comment_embed.js?ver=3.0.12
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
f055e217bde76d711bd8b42af773f9f99b8a29d81ad9ed10b6379cc7e6c60452

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:52 GMT
content-encoding
br
last-modified
Wed, 28 Feb 2018 21:17:30 GMT
server
nginx
status
200
etag
W/"5a971c6a-47e"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
devicepx-jetpack.js
s0.wp.com/wp-content/js/ 		10 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/wp-content/js/devicepx-jetpack.js?ver=202030
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
f32d41f2099a0be20e6b57c5e0d1b71c079d3e1345827b0f5c5b97c6e5e3f78d

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc
HIT fra 2
date
Thu, 23 Jul 2020 23:38:52 GMT
content-encoding
gzip
server
nginx
etag
W/"5867460b-52b6"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=31536000
x-ac
4.fra _dfw
expires
Mon, 19 Jul 2021 15:18:30 GMT
functions.js
blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/js/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/js/functions.js?ver=2013-07-18
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
9fcb181721162ce0d395b7b9b1e5bb5ca82c5f79bde749d4d0467ec2e65fcb4a

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:52 GMT
content-encoding
br
last-modified
Tue, 12 May 2020 20:50:39 GMT
server
nginx
status
200
etag
W/"5ebb0c1f-8f9"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
wp-embed.min.js
blog.malwarebytes.com/wp-includes/js/ 		1 KB
951 B 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.malwarebytes.com/wp-includes/js/wp-embed.min.js?ver=5.4.2
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
6ebcda7a3a41ef97f0b4071160ceb1020e540fdc0f790079a5c2ef01ab654fe0

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:52 GMT
content-encoding
br
last-modified
Sat, 26 Oct 2019 00:17:07 GMT
server
nginx
status
200
etag
W/"5db39083-59a"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
spin.min.js
blog.malwarebytes.com/wp-content/plugins/jetpack/_inc/build/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.malwarebytes.com/wp-content/plugins/jetpack/_inc/build/spin.min.js?ver=1.3
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
36e3052355fd8aa03431efa1940b95f1424f6ff56a06d660a1add952c9339861

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:52 GMT
content-encoding
br
last-modified
Wed, 28 Feb 2018 21:17:31 GMT
server
nginx
status
200
etag
W/"5a971c6b-11aa"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
jquery.spin.min.js
blog.malwarebytes.com/wp-content/plugins/jetpack/_inc/build/ 		2 KB
916 B 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.malwarebytes.com/wp-content/plugins/jetpack/_inc/build/jquery.spin.min.js?ver=1.3
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
b10a8b01476da3fc060041be45e92a42f65c24115f1c64eff444735de47f2a54

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:52 GMT
content-encoding
br
last-modified
Wed, 28 Feb 2018 21:17:31 GMT
server
nginx
status
200
etag
W/"5a971c6b-70e"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
jetpack-carousel.min.js
blog.malwarebytes.com/wp-content/plugins/jetpack/_inc/build/carousel/ 		27 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.malwarebytes.com/wp-content/plugins/jetpack/_inc/build/carousel/jetpack-carousel.min.js?ver=20170209
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
df73bd6bed3e91e18f6100fbfbf4324ec49aadfc49681facb35d700f0f5bb893

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:52 GMT
content-encoding
br
last-modified
Wed, 28 Feb 2018 21:17:31 GMT
server
nginx
status
200
etag
W/"5a971c6b-6da9"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
standard-search-results-footer.js
blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/js/ 		2 KB
772 B 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/js/standard-search-results-footer.js
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
1532b16aa9cd1fef51c097aaf1abeac6cb6f239b026660e7105e49f4ae6549ff

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:52 GMT
content-encoding
br
last-modified
Tue, 12 May 2020 20:50:39 GMT
server
nginx
status
200
etag
W/"5ebb0c1f-704"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
optanon.css
optanon.blob.core.windows.net/skins/5.12.0/default_flat_bottom_two_button_white/v2/css/ 		23 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://optanon.blob.core.windows.net/skins/5.12.0/default_flat_bottom_two_button_white/v2/css/optanon.css
Requested by
Host: optanon.blob.core.windows.net
URL: https://optanon.blob.core.windows.net/consent/9530a107-0af8-4204-a2c2-217efb78222b.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.239.137.4 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
8c20518cd7e51066b82e8a8a1e8035210741cf808c02268915747960f531061c

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
Date
Thu, 23 Jul 2020 23:38:52 GMT
Content-Encoding
gzip
Last-Modified
Fri, 21 Feb 2020 20:12:28 GMT
Server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Content-MD5
Z4rsumi9rT/2HntFCbwLpA==
ETag
0x8D7B70A5FCD741F
Content-Type
text/css
Access-Control-Allow-Origin
*
x-ms-request-id
7ac2878e-601e-0081-534a-617ab1000000
Access-Control-Expose-Headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version
2009-09-19
Content-Length
5561
Locator-Light.woff
blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/css/fonts/ 		29 KB
29 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/css/fonts/Locator-Light.woff
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/modernizr.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
ed2491fc7526ff0b5cfec3fe6f4cf8153796520fc845b735286b0f42183da98a

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/style.css?ver=2013-07-18
Origin
https://blog.malwarebytes.com

Response headers

date
Thu, 23 Jul 2020 23:38:52 GMT
last-modified
Tue, 12 May 2020 20:50:39 GMT
server
nginx
status
200
etag
"5ebb0c1f-7330"
vary
Accept-Encoding
content-type
font/woff
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
29488
gtm.js
www.googletagmanager.com/ 		189 KB
47 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-MKSKW3
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
de5b72a65846090132693ae1cdaa29cbaf08933b5045abc33abbc142122c9e57
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:52 GMT
content-encoding
br
vary
Accept-Encoding
status
200
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
48076
x-xss-protection
0
last-modified
Thu, 23 Jul 2020 21:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Thu, 23 Jul 2020 23:38:52 GMT
Locator-Medium.woff
blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/css/fonts/ 		29 KB
29 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/css/fonts/Locator-Medium.woff
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
a52bbdb7b132e850fdaf5740012fcc0bc3f6ef0be520bc4b987d8761d40d015a

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/style.css?ver=2013-07-18
Origin
https://blog.malwarebytes.com

Response headers

date
Thu, 23 Jul 2020 23:38:52 GMT
last-modified
Tue, 12 May 2020 20:50:39 GMT
server
nginx
status
200
etag
"5ebb0c1f-734c"
vary
Accept-Encoding
content-type
font/woff
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
29516
socicon.woff
blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/css/fonts/ 		20 KB
20 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/css/fonts/socicon.woff
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
0ed37960a59a6ec6b443f9ef043864d09a51db6fd276ae578d9166467bf986d1

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/style.css?ver=2013-07-18
Origin
https://blog.malwarebytes.com

Response headers

date
Thu, 23 Jul 2020 23:38:52 GMT
last-modified
Tue, 12 May 2020 20:50:39 GMT
server
nginx
status
200
etag
"5ebb0c1f-4ff8"
vary
Accept-Encoding
content-type
font/woff
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
20472
num-comments.svg
blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/images/ 		1 KB
810 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/images/num-comments.svg
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
da1c1ad273854673c3a3f7e8f76aae5d7c9c73f3ebd224c2be1f93106680b1d4

Request headers

Referer
https://blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/style.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:52 GMT
content-encoding
br
last-modified
Tue, 12 May 2020 20:50:39 GMT
server
nginx
status
200
etag
W/"5ebb0c1f-4d3"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
Locator-LightItalic.woff
blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/css/fonts/ 		30 KB
30 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/css/fonts/Locator-LightItalic.woff
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx /
Resource Hash
ad2cc26b0fdde8f4eb637ed12b25364e85af0bfba227dad42cb997ff4ad23eeb

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/style.css?ver=2013-07-18
Origin
https://blog.malwarebytes.com

Response headers

date
Thu, 23 Jul 2020 23:38:52 GMT
last-modified
Tue, 12 May 2020 20:50:39 GMT
server
nginx
status
200
etag
"5ebb0c1f-7888"
vary
Accept-Encoding
content-type
font/woff
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
30856
count.js
malwarebytesunpacked.disqus.com/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://malwarebytesunpacked.disqus.com/count.js
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/wp-content/plugins/disqus-comment-system/public/js/comment_count.js?ver=3.0.12
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.112.134 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
3487ef2baf0c08ba660a8a143cdeb8ebeec961eea04bccd7c49096b4eb26b875
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 23 Jul 2020 23:38:53 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Age
825072
P3P
CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Connection
keep-alive
Vary
Accept-Encoding
Content-Length
871
X-XSS-Protection
1; mode=block
Last-Modified
Fri, 10 Jul 2020 00:55:10 GMT
Server
nginx
ETag
"5f07bc6e-367"
Strict-Transport-Security
max-age=300; includeSubdomains
Content-Type
application/javascript; charset=utf-8
Cache-Control
public, max-age=300
Link
<https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
embed.js
malwarebytesunpacked.disqus.com/ 		70 KB
23 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://malwarebytesunpacked.disqus.com/embed.js
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/wp-content/plugins/disqus-comment-system/public/js/comment_embed.js?ver=3.0.12
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.112.134 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
openresty /
Resource Hash
50730a9b15322c696fcf7acfee22e1493325ec306239e82cb57bb73338a43828
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 23 Jul 2020 23:38:53 GMT
Content-Encoding
gzip
Server
openresty
Age
0
Vary
Accept-Encoding
Connection
keep-alive
Content-Type
application/javascript; charset=utf-8
Cache-Control
private, max-age=60
X-Service
router
Strict-Transport-Security
max-age=300; includeSubdomains
Link
<https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
Content-Length
23010
wai.gif
genesis.malwarebytes.com/api/v1/ 		396 B
618 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://genesis.malwarebytes.com/api/v1/wai.gif
Requested by
Host: www.malwarebytes.com
URL: https://www.malwarebytes.com/js/jquery-1.11.3.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:1f18:21ae:6701:9be3:f3d4:fc54:ed52 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
b9d8e51ffd9da1d06ec0405452ac38723cddd71b1028542b6112b27931506bbc

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:53 GMT
server
Apache-Coyote/1.1
status
200
access-control-allow-methods
GET, POST
content-type
application/json
access-control-allow-origin
*
access-control-allow-credentials
true
access-control-allow-headers
origin, content-type, accept, authorization
pillarpages.json
blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/ 		22 KB
6 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://blog.malwarebytes.com/wp-content/themes/labs.malwarebytes.org-3.4.1.6/pillarpages.json
Requested by
Host: www.malwarebytes.com
URL: https://www.malwarebytes.com/js/jquery-1.11.3.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
130.211.198.3 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
nginx / WP Engine
Resource Hash
05337ff085af3f1ace7b8f1aa32500579060b3d6217a5b07fcdc3f1c1599c9cc
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:53 GMT
content-encoding
gzip
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding,Cookie
last-modified
Thu, 23 Jul 2020 23:38:03 GMT
server
nginx
x-cacheable
SHORT
x-powered-by
WP Engine
etag
W/"5969-5ab2458f86dae"
x-frame-options
SAMEORIGIN
x-cache
HIT: 11
content-type
application/json
status
200
cache-control
max-age=600, must-revalidate
x-cache-group
normal
demandbase-forms.js
www.malwarebytes.com/js/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.malwarebytes.com/js/demandbase-forms.js?d=2020-02-04-15-03-08--0800
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKSKW3
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:214f:6000:8:d3fb:39c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
5576e25dd8a4d45e90da43e0f127c4efb4d16eebcb7a1bc55fbb66e7cf504f9d

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:22 GMT
content-encoding
gzip
last-modified
Thu, 09 Jul 2020 20:58:51 GMT
server
AmazonS3
age
32
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
status
200
x-amz-cf-pop
FRA53-C1
x-amz-cf-id
cPHh4KqX7dLuhewJtwV4pwME4-j5ZTMJHOiyggzKIExJOC3sKK8PXw==
via
1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
analytics.js
www.google-analytics.com/ 		45 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: t.co
URL: https://t.co/JeGMk0Fi9l
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
fd361b57998c76f86335afa28b8a62527d88a8200fb5c428d6f0fff73383e955
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 04 Jun 2020 23:38:14 GMT
server
Golfe2
age
4994
date
Thu, 23 Jul 2020 22:15:39 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
18469
expires
Fri, 24 Jul 2020 00:15:39 GMT
activityi;dc_pre=CO-R09_F5OoCFUqadwoda6EF1w;src=9812475;type=conve0;cat=forms000;ord=1;num=4606248325355;gtm=2wg7f0;auiddc=1249630020.1595547533;~oref=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-a...
9812475.fls.doubleclick.net/ Frame 407B
Redirect Chain
  • https://9812475.fls.doubleclick.net/activityi;src=9812475;type=conve0;cat=forms000;ord=1;num=4606248325355;gtm=2wg7f0;auiddc=1249630020.1595547533;~oref=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat...
  • https://9812475.fls.doubleclick.net/activityi;dc_pre=CO-R09_F5OoCFUqadwoda6EF1w;src=9812475;type=conve0;cat=forms000;ord=1;num=4606248325355;gtm=2wg7f0;auiddc=1249630020.1595547533;~oref=https%3A%2...
0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://9812475.fls.doubleclick.net/activityi;dc_pre=CO-R09_F5OoCFUqadwoda6EF1w;src=9812475;type=conve0;cat=forms000;ord=1;num=4606248325355;gtm=2wg7f0;auiddc=1249630020.1595547533;~oref=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-analysis%2F2020%2F07%2Fchinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware%2F?
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKSKW3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.205.230 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=21600
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
9812475.fls.doubleclick.net
:scheme
https
:path
/activityi;dc_pre=CO-R09_F5OoCFUqadwoda6EF1w;src=9812475;type=conve0;cat=forms000;ord=1;num=4606248325355;gtm=2wg7f0;auiddc=1249630020.1595547533;~oref=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-analysis%2F2020%2F07%2Fchinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware%2F?
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
about:blank

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
date
Thu, 23 Jul 2020 23:38:53 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
cache-control
no-cache, must-revalidate
strict-transport-security
max-age=21600
content-type
text/html; charset=UTF-8
pragma
no-cache
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
460
x-xss-protection
0
set-cookie
test_cookie=CheckForPermission; expires=Thu, 23-Jul-2020 23:53:53 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

status
302
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
date
Thu, 23 Jul 2020 23:38:53 GMT
pragma
no-cache
expires
Fri, 01 Jan 1990 00:00:00 GMT
cache-control
no-cache, must-revalidate
follow-only-when-prerender-shown
1
strict-transport-security
max-age=21600
location
https://9812475.fls.doubleclick.net/activityi;dc_pre=CO-R09_F5OoCFUqadwoda6EF1w;src=9812475;type=conve0;cat=forms000;ord=1;num=4606248325355;gtm=2wg7f0;auiddc=1249630020.1595547533;~oref=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-analysis%2F2020%2F07%2Fchinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware%2F?
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
server
cafe
content-length
0
x-xss-protection
0
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
bat.js
bat.bing.com/ 		26 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://bat.bing.com/bat.js
Requested by
Host: t.co
URL: https://t.co/JeGMk0Fi9l
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
5c622f5433cbb6ea1df5c0dd8671e55ef7d1464366074730473c453de50a579b

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:52 GMT
content-encoding
gzip
last-modified
Thu, 16 Jul 2020 20:00:00 GMT
x-msedge-ref
Ref A: 29CC668DE7FE4653A1701E74D4EC4E43 Ref B: FRAEDGE1317 Ref C: 2020-07-23T23:38:53Z
status
200
etag
"0e0bdafab5bd61:0"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
private,max-age=1800
accept-ranges
bytes
content-length
8022
uwt.js
static.ads-twitter.com/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.ads-twitter.com/uwt.js
Requested by
Host: t.co
URL: https://t.co/JeGMk0Fi9l
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.112.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
319949c8c08b86e9c35ea542c0dc0c30cedaa9b8d3d3c3327a36c91aefbd8af5

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:53 GMT
content-encoding
gzip
age
7616
x-cache
HIT
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status
200
content-length
1954
x-served-by
cache-hhn4035-HHN
last-modified
Tue, 23 Jan 2018 20:09:00 GMT
x-timer
S1595547533.480174,VS0,VE0
etag
"b7b33882a4f3ffd5cbf07434f3137166+gzip"
vary
Accept-Encoding,Host
content-type
application/javascript; charset=utf-8
via
1.1 varnish
cache-control
no-cache
accept-ranges
bytes
js
www.googletagmanager.com/gtag/ 		85 KB
34 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-930356311
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKSKW3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
539871ff2e44a36b5fa14c16c0a47fabb5b385dc43c981677c91aafdba712365
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:53 GMT
content-encoding
br
vary
Accept-Encoding
status
200
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
34228
x-xss-protection
0
last-modified
Thu, 23 Jul 2020 21:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Thu, 23 Jul 2020 23:38:53 GMT
2893.js
script.crazyegg.com/pages/scripts/0081/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://script.crazyegg.com/pages/scripts/0081/2893.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKSKW3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9308 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9679c4502c0ad31d3bc9f152a7473b850b09d4b7745010bf2a72811510ce768b

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:53 GMT
content-encoding
gzip
cf-cache-status
HIT
ce-version
11.1.68
age
39600
cf-polished
origSize=4064
status
200
cf-request-id
041fa4588c0000befbcb21d200000001
last-modified
Thu, 23 Jul 2020 12:38:53 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
access-control-expose-headers
CE-Version
cache-control
max-age=300
cf-ray
5b793cd41810befb-FRA
cf-bgj
minify
up_loader.1.1.0.js
js.adsrvr.org/ 		4 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.adsrvr.org/up_loader.1.1.0.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKSKW3
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.206.235 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
0615974c40d602afdbf9759533e352bc17b0458c85aad6694b1a1ad20659625b

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 23 Jul 2020 00:39:29 GMT
Via
1.1 d01ad8df731d3f120823f9e20df55147.cloudfront.net (CloudFront)
Last-Modified
Mon, 13 Jan 2020 19:16:48 GMT
Server
AmazonS3
Age
82765
ETag
"45bb7a1f2878be0c29077f7329fca766"
Vary
Accept-Encoding
X-Cache
Hit from cloudfront
Content-Type
application/x-javascript
Connection
keep-alive
X-Amz-Cf-Pop
FRA53-C1
Accept-Ranges
bytes
Content-Length
4091
X-Amz-Cf-Id
rgBytLOJNCsn9d68rVGiGl0c7N31RBtJ2Xy8xXK3ZbjjgaHa1l7XLg==
count-data.js
malwarebytesunpacked.disqus.com/ 		560 B
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://malwarebytesunpacked.disqus.com/count-data.js?1=42670%20https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D42670&1=43096%20https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D43096&1=43163%20https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D43163&1=43361%20https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D43361&1=43475%20https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D43475
Requested by
Host: malwarebytesunpacked.disqus.com
URL: https://malwarebytesunpacked.disqus.com/count.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.112.134 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
b7cd93e343242e75632b5126a990fe73bbf1243d9976393772457b4edb8bffc9
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 23 Jul 2020 23:38:53 GMT
X-Content-Type-Options
nosniff
Server
nginx
Age
770
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=300; includeSubdomains
p3p
CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Vary
Accept-Encoding
Cache-Control
public, max-age=600
Connection
keep-alive
Content-Type
application/javascript; charset=UTF-8
Link
<https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
Content-Length
560
X-XSS-Protection
1; mode=block
HWyTnY16.min.js
scripts.demandbase.com/ 		59 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://scripts.demandbase.com/HWyTnY16.min.js
Requested by
Host: t.co
URL: https://t.co/JeGMk0Fi9l
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.202.73 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
c016b45a43dc83a578f6d3dfd2f7746392c21f544ae89d22e25964a938c8c51f

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id
1PO9cRc5aUC36JySSTk84v06NmDu.vZL
content-encoding
gzip
last-modified
Sat, 11 Jul 2020 16:48:00 GMT
server
AmazonS3
age
2039
date
Thu, 23 Jul 2020 23:04:55 GMT
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript; charset=utf-8
status
200
cache-control
public, max-age=3600
x-amz-cf-pop
FRA53-C1
x-amz-cf-id
4qjk7pxtXQRYbSTWLWvdGGnECrUeSMJKV7J3dnunc2vBr7xKA0yTEA==
via
1.1 660f4277d8fbef27985e8a4a97e362cc.cloudfront.net (CloudFront)
insight.min.js
snap.licdn.com/li.lms-analytics/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by
Host: t.co
URL: https://t.co/JeGMk0Fi9l
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:6c00:296::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software
/
Resource Hash
41dd5e421fe221a7d2921d6fa2b36e8b01a9f2c054aaef5fad866fe896c1d1e0

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 23 Jul 2020 23:38:53 GMT
Content-Encoding
gzip
Last-Modified
Mon, 07 Oct 2019 16:41:31 GMT
X-CDN
AKAM
Vary
Accept-Encoding
Content-Type
application/x-javascript;charset=utf-8
Cache-Control
max-age=39200
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1576
lounge.6525595c7a9874fa10bd041275e40f17.css
c.disquscdn.com/next/embed/styles/ 		0
22 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://c.disquscdn.com/next/embed/styles/lounge.6525595c7a9874fa10bd041275e40f17.css
Requested by
Host: malwarebytesunpacked.disqus.com
URL: https://malwarebytesunpacked.disqus.com/embed.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:a913 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:53 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
193048
status
200
strict-transport-security
max-age=300; includeSubdomains
content-length
22092
x-xss-protection
1; mode=block
timing-allow-origin
*
last-modified
Mon, 20 Jul 2020 23:36:39 GMT
server
cloudflare
etag
"5f162a87-564c"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000, public, immutable, no-transform
cf-request-id
041fa4591b000005dcba391200000001
accept-ranges
bytes
cf-ray
5b793cd4fe3305dc-FRA
expires
Wed, 21 Jul 2021 18:01:24 GMT
common.bundle.f9de3d662c5d03c937747411c45f2ea2.js
c.disquscdn.com/next/embed/ 		0
88 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://c.disquscdn.com/next/embed/common.bundle.f9de3d662c5d03c937747411c45f2ea2.js
Requested by
Host: malwarebytesunpacked.disqus.com
URL: https://malwarebytesunpacked.disqus.com/embed.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:a913 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:53 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
193048
status
200
strict-transport-security
max-age=300; includeSubdomains
content-length
89946
x-xss-protection
1; mode=block
timing-allow-origin
*
last-modified
Mon, 20 Jul 2020 23:36:39 GMT
server
cloudflare
etag
"5f162a87-15f5a"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000, public, immutable, no-transform
cf-request-id
041fa4591c000005dcba392200000001
accept-ranges
bytes
cf-ray
5b793cd4fe3505dc-FRA
expires
Wed, 21 Jul 2021 18:01:24 GMT
lounge.bundle.c32f18973ccddcdedfa44f2602cdb867.js
c.disquscdn.com/next/embed/ 		0
113 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://c.disquscdn.com/next/embed/lounge.bundle.c32f18973ccddcdedfa44f2602cdb867.js
Requested by
Host: malwarebytesunpacked.disqus.com
URL: https://malwarebytesunpacked.disqus.com/embed.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:a913 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:53 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
9076
status
200
strict-transport-security
max-age=300; includeSubdomains
content-length
115356
x-xss-protection
1; mode=block
timing-allow-origin
*
last-modified
Thu, 23 Jul 2020 20:57:22 GMT
server
cloudflare
etag
"5f19f9b2-1c29c"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000, public, immutable, no-transform
cf-request-id
041fa4591c000005dcba393200000001
accept-ranges
bytes
cf-ray
5b793cd4fe3705dc-FRA
expires
Fri, 23 Jul 2021 21:07:37 GMT
config.js
disqus.com/next/ 		0
7 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://disqus.com/next/config.js
Requested by
Host: malwarebytesunpacked.disqus.com
URL: https://malwarebytesunpacked.disqus.com/embed.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.128.134 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 23 Jul 2020 23:38:53 GMT
X-Content-Type-Options
nosniff
Content-Type
application/javascript; charset=UTF-8
Server
nginx
Age
30
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=300; includeSubdomains
p3p
CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Access-Control-Allow-Origin
*
Cache-Control
public, stale-while-revalidate=300, s-stalewhilerevalidate=3600, max-age=60
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
6275
X-XSS-Protection
1; mode=block
ga-audiences
www.google.de/ads/
Redirect Chain
  • https://www.google-analytics.com/r/collect?v=1&_v=j83&a=454402035&t=pageview&_s=1&dl=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-analysis%2F2020%2F07%2Fchinese-apt-group-targets-india-and-hong-kon...
  • https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-3347303-10&cid=443604896.1595547534&jid=1565795180&_gid=2014966214.1595547534&gjid=1773934943&_v=j83&z=1735567041
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-3347303-10&cid=443604896.1595547534&jid=1565795180&_v=j83&z=1735567041
  • https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-3347303-10&cid=443604896.1595547534&jid=1565795180&_v=j83&z=1735567041&slf_rd=1&random=3408842852
42 B
513 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-3347303-10&cid=443604896.1595547534&jid=1565795180&_v=j83&z=1735567041&slf_rd=1&random=3408842852
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 23 Jul 2020 23:38:53 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Thu, 23 Jul 2020 23:38:53 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
302
content-type
text/html; charset=UTF-8
location
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-3347303-10&cid=443604896.1595547534&jid=1565795180&_v=j83&z=1735567041&slf_rd=1&random=3408842852
cache-control
no-cache, no-store, must-revalidate
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
0
bat.bing.com/action/ 		0
172 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bat.bing.com/action/0?ti=4072696&Ver=2&mid=f18b7ec6-7cf9-909a-b62b-0c968a5c2d4c&sid=c7c7d1bf160097eef2bcf15a70799530&vid=bc39547fe46937e60b13c7c0dbddc9ab&vids=1&pi=0&lg=en-US&sw=1600&sh=1200&sc=24&tl=Chinese%20APT%20group%20targets%20India%20and%20Hong%20Kong%20using%20new%20variant%20of%20MgBot%20malware%20%7C%20Malwarebytes%20Labs&p=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-analysis%2F2020%2F07%2Fchinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware%2F&r=https%3A%2F%2Ft.co%2FJeGMk0Fi9l&lt=2107&evt=pageLoad&msclkid=N&sv=1&rn=273255
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
204
pragma
no-cache
date
Thu, 23 Jul 2020 23:38:53 GMT
cache-control
no-cache, must-revalidate
x-msedge-ref
Ref A: AFABE2E4459D4290AEE1DE1DC5432417 Ref B: FRAEDGE1317 Ref C: 2020-07-23T23:38:53Z
access-control-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
conversion_async.js
www.googleadservices.com/pagead/ 		29 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googleadservices.com/pagead/conversion_async.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-930356311
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.23.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
6718a07fa13fa05273a15a3442277d187b1b712d9eccef98fba120ef9442e975
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:53 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
11328
x-xss-protection
0
server
cafe
etag
4229961699705442162
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Thu, 23 Jul 2020 23:38:53 GMT
11.1.68.js
script.crazyegg.com/pages/versioned/common-scripts/ 		70 KB
23 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://script.crazyegg.com/pages/versioned/common-scripts/11.1.68.js
Requested by
Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0081/2893.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9308 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
48d02d1758575a3ee0e7ba8a0a1c29666b4f55a00d1bf15fd1703897febf4cdb

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:53 GMT
content-encoding
gzip
cf-cache-status
HIT
age
39601
cf-polished
origSize=71592
status
200
cf-request-id
041fa4596e0000befbcb220200000001
last-modified
Fri, 17 Jul 2020 16:40:52 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
5b793cd57886befb-FRA
cf-bgj
minify
adsct
t.co/i/ 		43 B
370 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://t.co/i/adsct?p_id=Twitter&p_user_id=0&txn_id=o1m5j&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.42.197 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=0
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:53 GMT
content-encoding
gzip
x-content-type-options
nosniff
status
200, 200 OK
x-twitter-response-tags
BouncerCompliant
content-length
65
x-xss-protection
0
x-response-time
113
pragma
no-cache
last-modified
Thu, 23 Jul 2020 23:38:53 GMT
server
tsa_o
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=0
content-type
image/gif;charset=utf-8
cache-control
no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash
d598a70b8ad601c538f3e75c578384a4
x-transaction
00f255c5009af35a
expires
Tue, 31 Mar 1981 05:00:00 GMT
/
disqus.com/embed/comments/ Frame 1632 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=43728%20https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D43728&t_u=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-analysis%2F2020%2F07%2Fchinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware%2F&t_e=Chinese%20APT%20group%20targets%20India%20and%20Hong%20Kong%20using%20new%20variant%20of%20MgBot%20malware&t_d=%0A%09%09%09%09%09Chinese%20APT%20group%20targets%20India%20and%20Hong%20Kong%20using%20new%20variant%20of%20MgBot%20malware%09%09%09%09&t_t=Chinese%20APT%20group%20targets%20India%20and%20Hong%20Kong%20using%20new%20variant%20of%20MgBot%20malware&s_o=default
Requested by
Host: malwarebytesunpacked.disqus.com
URL: https://malwarebytesunpacked.disqus.com/embed.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.128.134 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src https://*.twitter.com:* https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://*.services.disqus.com:* https://cdn.boomtrain.com/p13n/ https://apis.google.com https://cdn.syndication.twimg.com/tweets.json https://connect.facebook.net/en_US/sdk.js https://referrer.disqus.com/juggler/ 'unsafe-inline' https://com-disqus.netmng.com:* https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Host
disqus.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/

Response headers

Connection
keep-alive
Content-Length
2898
Server
nginx
Content-Security-Policy
script-src https://*.twitter.com:* https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://*.services.disqus.com:* https://cdn.boomtrain.com/p13n/ https://apis.google.com https://cdn.syndication.twimg.com/tweets.json https://connect.facebook.net/en_US/sdk.js https://referrer.disqus.com/juggler/ 'unsafe-inline' https://com-disqus.netmng.com:* https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com
Link
<https://c.disquscdn.com>;rel=preconnect,<https://c.disquscdn.com>;rel=dns-prefetch
Cache-Control
stale-if-error=3600, s-stalewhilerevalidate=3600, stale-while-revalidate=30, no-cache, must-revalidate, public, s-maxage=5
p3p
CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Timing-Allow-Origin
*
X-Content-Type-Options
nosniff
X-XSS-Protection
1; mode=block
Content-Type
text/html; charset=utf-8
Last-Modified
Tue, 21 Jul 2020 15:05:07 GMT
ETag
W/"lounge:view:8135446909.c8cc55e65cd6faa10fb89d2aaa893aa4.2"
Content-Encoding
gzip
Date
Thu, 23 Jul 2020 23:38:53 GMT
Age
0
Vary
Accept-Encoding
Strict-Transport-Security
max-age=300; includeSubdomains
collect
px.ads.linkedin.com/
Redirect Chain
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1056361&url=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-analysis%2F2020%2F07%2Fchinese-apt-group-targets-india-and-hong-kong-using-new-variant-of...
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D1056361%26url%3Dhttps%253A%252F%252Fblog.malwarebytes.com%252Fthreat-analysis%252...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1056361&url=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-analysis%2F2020%2F07%2Fchinese-apt-group-targets-india-and-hong-kong-using-new-variant-of...
0
81 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1056361&url=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-analysis%2F2020%2F07%2Fchinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware%2F&time=1595547533697&liSync=true
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a05:f500:11:101::b93f:9005 , Ireland, ASN14413 (LINKEDIN, US),
Reverse DNS
Software
Play /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:54 GMT
server
Play
linkedin-action
1
x-li-fabric
prod-lor1
status
200
x-li-proto
http/2
x-li-pop
prod-tln1
content-type
application/javascript
content-length
0
x-li-uuid
SRkKWgeGJBYgbgeVuCoAAA==

Redirect headers

content-security-policy
default-src *; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id https://lnkd.demdex.net/event blob: https://accounts.google.com/gsi/status https://linkedin.sc.omtrdc.net/b/ss/ static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com https://snap.licdn.com/li.lms-analytics/insight.min.js platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'
x-content-type-options
nosniff
linkedin-action
1
status
302
content-length
0
x-li-uuid
dszXUgeGJBagM00plisAAA==
pragma
no-cache
x-li-pop
afd-prod-esv5
x-msedge-ref
Ref A: CFF375AD42E54A9D9D499F577B4A393B Ref B: FRAEDGE1414 Ref C: 2020-07-23T23:38:53Z
x-frame-options
sameorigin
date
Thu, 23 Jul 2020 23:38:53 GMT
expect-ct
max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct"
strict-transport-security
max-age=2592000
x-li-fabric
prod-lor1
location
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1056361&url=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-analysis%2F2020%2F07%2Fchinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware%2F&time=1595547533697&liSync=true
x-xss-protection
1; mode=block
cache-control
no-cache, no-store
x-li-proto
http/2
expires
Thu, 01 Jan 1970 00:00:00 GMT
ip.json
api.company-target.com/api/v2/ 		429 B
942 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.company-target.com/api/v2/ip.json?referrer=https%3A%2F%2Ft.co%2FJeGMk0Fi9l&page=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-analysis%2F2020%2F07%2Fchinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware%2F&page_title=Chinese%20APT%20group%20targets%20India%20and%20Hong%20Kong%20using%20new%20variant%20of%20MgBot%20malware%20%7C%20Malwarebytes%20Labs&key=5527c2aa519592df7d44a24d0105731b&src=tag
Requested by
Host: scripts.demandbase.com
URL: https://scripts.demandbase.com/HWyTnY16.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.202.60 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
c23ebf2c0ec8e37a6a0a179720c9763bf4e1f0ed993fe7d0ad41d4d9774fe957

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:53 GMT
identification-source
CENTRAL
vary
Accept-Encoding, Origin
x-amz-cf-pop
FRA53-C1
x-cache
Miss from cloudfront
status
200
request-id
eef66a48-481e-46cc-bd09-d3a41653068d
content-encoding
gzip
pragma
no-cache
access-control-allow-origin
https://blog.malwarebytes.com
server
nginx
access-control-max-age
7200
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/json;charset=utf-8
via
1.1 c714e4f593454d65f62cf3fecf756a4c.cloudfront.net (CloudFront)
access-control-expose-headers
cache-control
no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials
true
api-version
v2
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
dNs3xIIeSVXOQgprXJYz0ekeTx9DGcK_rvDcn_HuuKXGirhS356jrw==
expires
Wed, 22 Jul 2020 23:38:53 GMT
validateCookie
segments.company-target.com/
Redirect Chain
  • https://match.prod.bidr.io/cookie-sync/demandbase
  • https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1
  • https://segments.company-target.com/log?vendor=choca&user_id=AAJ5Ck6-ND8AAA-B26RpAA
  • https://segments.company-target.com/validateCookie?vendor=choca&user_id=AAJ5Ck6-ND8AAA-B26RpAA&verifyHash=e650e85596099e286a1b0b07cec17d6697447df6
26 B
409 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://segments.company-target.com/validateCookie?vendor=choca&user_id=AAJ5Ck6-ND8AAA-B26RpAA&verifyHash=e650e85596099e286a1b0b07cec17d6697447df6
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.202.127 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 23 Jul 2020 23:38:54 GMT
Via
1.1 16dc09493f48bbc1fd2cdd6e175a94f7.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA53-C1
Vary
Origin
X-Cache
Miss from cloudfront
Content-Type
image/gif
Transfer-Encoding
chunked
Connection
keep-alive
trace-id
e9574b0df6b2dfea
X-Amz-Cf-Id
EvQc8xaTSrrhYyMuq_GAw4MwM1xw2DV-oeejC8PPtHdfJ-hK8Simtw==

Redirect headers

Date
Thu, 23 Jul 2020 23:38:54 GMT
Via
1.1 16dc09493f48bbc1fd2cdd6e175a94f7.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA53-C1
Vary
Origin
X-Cache
Miss from cloudfront
Location
/validateCookie?vendor=choca&user_id=AAJ5Ck6-ND8AAA-B26RpAA&verifyHash=e650e85596099e286a1b0b07cec17d6697447df6
Connection
keep-alive
trace-id
22d6f866529e55ba
Content-Length
0
X-Amz-Cf-Id
LKARLY5W_H8rqUQwB3ywalzVo0maeblL7QaPF-VbRd64g6mDuNkY7g==
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/930356311/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/930356311/?random=1595547533763&cv=9&fst=1595547533763&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa7f0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-analysis%2F2020%2F07%2Fchinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware%2F&ref=https%3A%2F%2Ft.co%2FJeGMk0Fi9l&tiba=Chinese%20APT%20group%20targets%20India%20and%20Hong%20Kong%20using%20new%20variant%20of%20MgBot%20malware%20%7C%20Malwarebytes%20Labs&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
c95d99452b4466523bf6c87a91085840ecf0fe08e8355106dd60e6fe6b40b770
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 23 Jul 2020 23:38:53 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
no-cache, must-revalidate
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
1170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/930356311/ 		42 B
165 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/930356311/?random=1595547533763&cv=9&fst=1595545200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa7f0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-analysis%2F2020%2F07%2Fchinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware%2F&ref=https%3A%2F%2Ft.co%2FJeGMk0Fi9l&tiba=Chinese%20APT%20group%20targets%20India%20and%20Hong%20Kong%20using%20new%20variant%20of%20MgBot%20malware%20%7C%20Malwarebytes%20Labs&async=1&fmt=3&is_vtc=1&random=1975154549&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 23 Jul 2020 23:38:53 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/930356311/ 		42 B
154 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/pagead/1p-user-list/930356311/?random=1595547533763&cv=9&fst=1595545200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa7f0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-analysis%2F2020%2F07%2Fchinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware%2F&ref=https%3A%2F%2Ft.co%2FJeGMk0Fi9l&tiba=Chinese%20APT%20group%20targets%20India%20and%20Hong%20Kong%20using%20new%20variant%20of%20MgBot%20malware%20%7C%20Malwarebytes%20Labs&async=1&fmt=3&is_vtc=1&random=1975154549&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 23 Jul 2020 23:38:53 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/ 		35 B
131 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/collect?v=1&_v=j83&a=454402035&t=event&ni=1&_s=2&dl=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-analysis%2F2020%2F07%2Fchinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware%2F&dr=https%3A%2F%2Ft.co%2FJeGMk0Fi9l&ul=en-us&de=UTF-8&dt=Chinese%20APT%20group%20targets%20India%20and%20Hong%20Kong%20using%20new%20variant%20of%20MgBot%20malware%20%7C%20Malwarebytes%20Labs&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Demandbase&ea=API%20Resolution&el=IP%20API&_u=aHBAAEAB~&jid=&gjid=&cid=443604896.1595547534&tid=UA-3347303-10&_gid=2014966214.1595547534&cd2=(Non-Company%20Visitor)&cd3=Bot&cd4=(Non-Company%20Visitor)&cd5=(Non-Company%20Visitor)&cd6=(Non-Company%20Visitor)&cd7=(Non-Company%20Visitor)&cd8=(Non-Company%20Visitor)&cd9=(Non-Company%20Visitor)&cd10=(Non-Company%20Visitor)&cd11=Zurich&cd12=ZH&cd13=(Non-Company%20Visitor)&cd14=(Non-Company%20Visitor)&cd15=(Non-Company%20Visitor)&cd16=(Non-Company%20Visitor)&cd17=CH&cd18=(Non-Company%20Visitor)&z=1959269015
Requested by
Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 12 Jun 2020 21:25:45 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
3550388
status
200
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
activityi;dc_pre=CLOGiODF5OoCFSjjuwgduX4DvA;src=5118230;type=count0;cat=secur00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1;num=3393624226158.951
5118230.fls.doubleclick.net/ Frame 49D3
Redirect Chain
  • https://5118230.fls.doubleclick.net/activityi;src=5118230;type=count0;cat=secur00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1;num=3393624226158.951?
  • https://5118230.fls.doubleclick.net/activityi;dc_pre=CLOGiODF5OoCFSjjuwgduX4DvA;src=5118230;type=count0;cat=secur00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1;num=3393624226158.951?
0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://5118230.fls.doubleclick.net/activityi;dc_pre=CLOGiODF5OoCFSjjuwgduX4DvA;src=5118230;type=count0;cat=secur00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1;num=3393624226158.951?
Requested by
Host: www.malwarebytes.com
URL: https://www.malwarebytes.com/js/jquery-1.11.3.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.21.230 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=21600
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
5118230.fls.doubleclick.net
:scheme
https
:path
/activityi;dc_pre=CLOGiODF5OoCFSjjuwgduX4DvA;src=5118230;type=count0;cat=secur00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1;num=3393624226158.951?
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
IDE=AHWqTUlm_d7O69AuBVd6NbFiXV-iL5tiuZoYuaZ3h-2CeywqKofc1KsRqII3wK1a
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
date
Thu, 23 Jul 2020 23:38:54 GMT
expires
Thu, 23 Jul 2020 23:38:54 GMT
cache-control
private, max-age=0
strict-transport-security
max-age=21600
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
376
x-xss-protection
0
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

status
302
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
date
Thu, 23 Jul 2020 23:38:54 GMT
pragma
no-cache
expires
Fri, 01 Jan 1990 00:00:00 GMT
cache-control
no-cache, must-revalidate
follow-only-when-prerender-shown
1
strict-transport-security
max-age=21600
location
https://5118230.fls.doubleclick.net/activityi;dc_pre=CLOGiODF5OoCFSjjuwgduX4DvA;src=5118230;type=count0;cat=secur00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1;num=3393624226158.951?
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
server
cafe
content-length
0
x-xss-protection
0
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
embed.js
malwarebytesunpacked.disqus.com/ 		70 KB
23 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://malwarebytesunpacked.disqus.com/embed.js?_=1595547532700
Requested by
Host: www.malwarebytes.com
URL: https://www.malwarebytes.com/js/jquery-1.11.3.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.112.134 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
openresty /
Resource Hash
cab329bb4dac7ce9c9c295f71b26e2b11aecf60f7420768887653f189ec5fcce
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 23 Jul 2020 23:38:54 GMT
Content-Encoding
gzip
Server
openresty
Age
0
Vary
Accept-Encoding
Connection
keep-alive
Content-Type
application/javascript; charset=utf-8
Cache-Control
private, max-age=60
X-Service
router
Strict-Transport-Security
max-age=300; includeSubdomains
Link
<https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
Content-Length
23010
embed.js
malwarebytesunpacked.disqus.com/ 		70 KB
23 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://malwarebytesunpacked.disqus.com/embed.js?_=1595547532701
Requested by
Host: www.malwarebytes.com
URL: https://www.malwarebytes.com/js/jquery-1.11.3.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.112.134 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
openresty /
Resource Hash
cab329bb4dac7ce9c9c295f71b26e2b11aecf60f7420768887653f189ec5fcce
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 23 Jul 2020 23:38:54 GMT
Content-Encoding
gzip
Server
openresty
Age
0
Vary
Accept-Encoding
Connection
keep-alive
Content-Type
application/javascript; charset=utf-8
Cache-Control
private, max-age=60
X-Service
router
Strict-Transport-Security
max-age=300; includeSubdomains
Link
<https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
Content-Length
23010
fbevents.js
connect.facebook.net/en_US/ 		134 KB
34 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: t.co
URL: https://t.co/JeGMk0Fi9l
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
f630c6ea4e44c35a93c0ee2950e68857311d9500d6025abe4a5db3ecaf270e3c
Security Headers
Name Value
Content-Security-Policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
status
200
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
34220
x-xss-protection
0
pragma
public
x-fb-debug
Pvm3TXxXTmtDCleBz8aEwN7lroQeY6xuWg3CB4ZkVnBduQrwUskZXeNdCvJAgv1ah88tVVTcMZXABq4iJ19KCg==
x-fb-trip-id
664085054
x-frame-options
DENY
date
Thu, 23 Jul 2020 23:38:54 GMT
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
cache-control
public, max-age=1200
content-security-policy
default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires
Sat, 01 Jan 2000 00:00:00 GMT
qevents.js
a.quora.com/ 		39 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://a.quora.com/qevents.js
Requested by
Host: t.co
URL: https://t.co/JeGMk0Fi9l
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.113.2 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
ef6de6beb1cf5bf809eccfe10f99aea0e0969c71d4eab5446410fef72695679f

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id
s3LlaOWABX1LUjiLldBNr49lVAylKDRo
content-encoding
gzip
etag
"f32ebb1e93a72c0a57add6d07f688510"
age
876
x-cache
HIT, HIT
status
200
content-length
13681
x-amz-id-2
NphWt6yfMtMqhybpGKfgfXud59h8uO+m9CG3e7rT05unlqZQpjin4KwpplIGFnz2L2JuSPX2/+E=
x-served-by
cache-bwi5138-BWI, cache-hhn4025-HHN
last-modified
Fri, 25 Oct 2019 19:28:38 GMT
server
AmazonS3
x-amz-meta-s3cmd-attrs
atime:1572031715/ctime:1572031714/gid:1000000/gname:employee/md5:f32ebb1e93a72c0a57add6d07f688510/mode:33188/mtime:1149709104/uid:1000332/uname:tzhou
x-timer
S1595547534.356757,VS0,VE0
date
Thu, 23 Jul 2020 23:38:54 GMT
vary
Accept-Encoding
x-amz-request-id
55A6A60AB524075A
via
1.1 varnish, 1.1 varnish
cache-control
max-age=7200
accept-ranges
bytes
content-type
text/plain
x-cache-hits
1, 79
s
ads.avct.cloud/
Redirect Chain
  • https://ads.avocet.io/s?add=5b8e9b462be173e55d6569fc&ty=j&_=1595547532702
  • https://ads.avct.cloud/s?r=1&add=5b8e9b462be173e55d6569fc&ty=j&_=1595547532702
  • https://ads.avct.cloud/s?bounce=true&r=1&add=5b8e9b462be173e55d6569fc&ty=j&_=1595547532702
0
336 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ads.avct.cloud/s?bounce=true&r=1&add=5b8e9b462be173e55d6569fc&ty=j&_=1595547532702
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
52.211.33.154 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
200
date
Thu, 23 Jul 2020 23:38:54 GMT
p3p
policyref="http://cdn.avocet.io/w3c/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length
0
content-type
application/javascript

Redirect headers

status
302
date
Thu, 23 Jul 2020 23:38:54 GMT
p3p
policyref="http://cdn.avocet.io/w3c/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length
107
location
/s?bounce=true&r=1&add=5b8e9b462be173e55d6569fc&ty=j&_=1595547532702
content-type
text/html; charset=utf-8
ytc.js
s.yimg.com/wi/ 		14 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s.yimg.com/wi/ytc.js
Requested by
Host: t.co
URL: https://t.co/JeGMk0Fi9l
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1288:f03d:1fa::4000 , United Kingdom, ASN10310 (YAHOO-1, US),
Reverse DNS
Software
ATS /
Resource Hash
a3ce11e17464ae96ee2f1245fbf3c6cffa1aa6e7f6460fb6f8cbe95cfe1874cc
Security Headers
Name Value
Strict-Transport-Security max-age=15552000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:14:37 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
1458
x-amz-server-side-encryption
AES256
status
200
vary
Origin, Accept-Encoding
x-amz-request-id
9RDM0HEJ8K4VDG1T
x-amz-id-2
yTbxDnkoU/Uh5bnqTIcneUxYw8XLvpiFdqeRxkz+VLPOMtdvUs5xBuK9U8HD7HBAPraQZjTzvug=
referrer-policy
no-referrer-when-downgrade
x-amz-expiration
expiry-date="Wed, 18 Aug 2021 00:00:00 GMT", rule-id="oath-standard-lifecycle"
last-modified
Mon, 13 Jul 2020 09:52:56 GMT
server
ATS
etag
"c83019cecf523f1903b97d476c683822-df"
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=15552000
x-amz-version-id
ANdKZB5CZM6v65L5sAW33.1KG2ruBZ8a
x-xss-protection
1; mode=block
cache-control
public,max-age=3600
accept-ranges
bytes
content-type
application/javascript
munchkin.js
munchkin.marketo.net/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://munchkin.marketo.net/munchkin.js
Requested by
Host: t.co
URL: https://t.co/JeGMk0Fi9l
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.101.176.176 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
e33257e40a5420d325cbdd826a42403d63e4fa3c32efb3d7a4b3596aa0541a64

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 23 Jul 2020 23:38:54 GMT
Content-Encoding
gzip
Last-Modified
Fri, 10 Jul 2020 02:50:40 GMT
Server
AkamaiNetStorage
ETag
"bc06a6fbc5f82b85379e5482b06ad372:1594349440.875338"
Vary
Accept-Encoding
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
application/x-javascript
Content-Length
760
adsct
analytics.twitter.com/i/ 		31 B
652 B 		Script
General
Check archive.org
Download Go to
Full URL
https://analytics.twitter.com/i/adsct?p_id=Twitter&p_user_id=0&txn_id=o1m5j&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-analysis%2F2020%2F07%2Fchinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware%2F
Requested by
Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.42.3 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status
200, 200 OK
x-twitter-response-tags
BouncerCompliant
strict-transport-security
max-age=631138519
content-length
57
x-xss-protection
0
x-response-time
120
pragma
no-cache
last-modified
Thu, 23 Jul 2020 23:38:54 GMT
server
tsa_o
x-frame-options
SAMEORIGIN
content-type
application/javascript;charset=utf-8
cache-control
no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash
cc4ca93adfaddf6e50aa0ecad49e8e8f
x-transaction
0048105d0054402c
expires
Tue, 31 Mar 1981 05:00:00 GMT
up
insight.adsrvr.org/track/ Frame 05D9 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://insight.adsrvr.org/track/up?adv=8mirph5&ref=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-analysis%2F2020%2F07%2Fchinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware%2F&upid=r8yigtp&upv=1.1.0
Requested by
Host: js.adsrvr.org
URL: https://js.adsrvr.org/up_loader.1.1.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.215.9.203 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash

Request headers

:method
GET
:authority
insight.adsrvr.org
:scheme
https
:path
/track/up?adv=8mirph5&ref=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-analysis%2F2020%2F07%2Fchinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware%2F&upid=r8yigtp&upv=1.1.0
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/

Response headers

status
200
date
Thu, 23 Jul 2020 23:38:54 GMT
content-type
text/html
cache-control
private,no-cache, must-revalidate
pragma
no-cache
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
up
insight.adsrvr.org/track/ Frame 050F 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://insight.adsrvr.org/track/up?adv=8mirph5&ref=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-analysis%2F2020%2F07%2Fchinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware%2F&upid=r8yigtp&upv=1.1.0
Requested by
Host: js.adsrvr.org
URL: https://js.adsrvr.org/up_loader.1.1.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.215.9.203 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash

Request headers

:method
GET
:authority
insight.adsrvr.org
:scheme
https
:path
/track/up?adv=8mirph5&ref=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-analysis%2F2020%2F07%2Fchinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware%2F&upid=r8yigtp&upv=1.1.0
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/

Response headers

status
200
date
Thu, 23 Jul 2020 23:38:54 GMT
content-type
text/html
cache-control
private,no-cache, must-revalidate
pragma
no-cache
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
1480959392203028
connect.facebook.net/signals/config/ 		522 KB
133 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/signals/config/1480959392203028?v=2.9.22&r=stable
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
f49907138587c1b6eda90470bd052d859ff044d99ba51466a144f3e66cfcc439
Security Headers
Name Value
Content-Security-Policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
status
200
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
x-xss-protection
0
pragma
public
x-fb-debug
Tw/YBje8Ke626A2UtTYw9B1VBBj3v8j1Wg1WaB+/axTk69R31/qN9b9N7ig6/0lz/UkNCAE4aSimWJk3Ql1JDw==
x-fb-trip-id
664085054
x-frame-options
DENY
date
Thu, 23 Jul 2020 23:38:54 GMT
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
cache-control
public, max-age=1200
content-security-policy
default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires
Sat, 01 Jan 2000 00:00:00 GMT
10110317.json
s.yimg.com/wi/config/ 		46 B
691 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://s.yimg.com/wi/config/10110317.json
Requested by
Host: s.yimg.com
URL: https://s.yimg.com/wi/ytc.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1288:f03d:1fa::4000 , United Kingdom, ASN10310 (YAHOO-1, US),
Reverse DNS
Software
ATS /
Resource Hash
51f4cf88527819ae3950b1820aa534ebf6c2fcbc0894db427ba5ab59d9efd659
Security Headers
Name Value
Strict-Transport-Security max-age=15552000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 22:50:52 GMT
x-content-type-options
nosniff
age
2883
x-amz-server-side-encryption
AES256
status
200
vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method
x-amz-request-id
F09B28BB114FE555
x-amz-id-2
8bY/1jGGcHOfGGO8jCDfhWPo2xetT8wqEshEWhXVxW6vO5kbat3IfSNMPMAqy4bygUf4pxdLfbk=
accept-ranges
bytes
referrer-policy
no-referrer-when-downgrade
x-amz-expiration
expiry-date="Thu, 29 Jul 2021 00:00:00 GMT", rule-id="oath-standard-lifecycle"
last-modified
Tue, 23 Jun 2020 16:15:29 GMT
server
ATS
etag
"cc3d0e0815ad7ef45a521c2a63b65393"
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=15552000
access-control-allow-methods
GET
x-amz-version-id
wXZ_nu_nu9aA6v9PTivxO9CdOpSassoA
access-control-allow-origin
*
x-xss-protection
1; mode=block
content-length
46
content-type
application/octet-stream
pixel
q.quora.com/_/ad/64fab857ca52427587d3bd14a8d437b7/ 		43 B
424 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://q.quora.com/_/ad/64fab857ca52427587d3bd14a8d437b7/pixel?j=1&u=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-analysis%2F2020%2F07%2Fchinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware%2F&tag=ViewContent&ts=1595547534390
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.194.150.218 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
nginx /
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 23 Jul 2020 23:38:54 GMT
Server
nginx
Connection
keep-alive
Content-Length
43
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
X-Q-Stat
,6275d866f41b1a19c19378ccdfbcf91f,10.0.0.238,35442,185.156.175.107,,23658142966,1,1595547534.823,0.002,,.,0,0,0.000,0.000,-,0,0,197,228,114,10,26847,,,,,,-,
Content-Type
image/gif
munchkin.js
munchkin.marketo.net/158/ 		11 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://munchkin.marketo.net/158/munchkin.js
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.101.176.176 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
5f967fd41346c0fc1b9b44fa69c52bf1e754420c59c8017cefb0a14a764cafa4

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 23 Jul 2020 23:38:54 GMT
Content-Encoding
gzip
Last-Modified
Tue, 28 Jan 2020 03:01:21 GMT
Server
AkamaiNetStorage
ETag
"67df7eb9e9e68638308f14367dddec10:1580180481"
Vary
Accept-Encoding
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control
max-age=8640000
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
application/x-javascript
Content-Length
4686
Expires
Sat, 31 Oct 2020 23:38:54 GMT
sp.pl
sp.analytics.yahoo.com/ 		0
530 B 		Script
General
Check archive.org
Download Go to
Full URL
https://sp.analytics.yahoo.com/sp.pl?a=10000&d=Thu%2C%2023%20Jul%202020%2023%3A38%3A54%20GMT&n=-2d&b=Chinese%20APT%20group%20targets%20India%20and%20Hong%20Kong%20using%20new%20variant%20of%20MgBot%20malware%20%7C%20Malwarebytes%20Labs&.yp=10110317&f=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-analysis%2F2020%2F07%2Fchinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware%2F&e=https%3A%2F%2Ft.co%2FJeGMk0Fi9l&enc=UTF-8&tagmgr=gtm
Requested by
Host: s.yimg.com
URL: https://s.yimg.com/wi/ytc.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
212.82.100.181 , Switzerland, ASN34010 (YAHOO-IRD, GB),
Reverse DNS
Software
ATS /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:54 GMT
x-content-type-options
nosniff
age
0
status
200
content-length
0
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
strict-origin-when-cross-origin
server
ATS
x-frame-options
DENY
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=31536000
content-type
application/x-javascript
cache-control
no-cache, private, must-revalidate
accept-ranges
bytes
expires
Thu, 23 Jul 2020 23:38:54 GMT
visitWebPage
805-usg-300.mktoresp.com/webevents/ 		2 B
304 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://805-usg-300.mktoresp.com/webevents/visitWebPage?_mchNc=1595547534453&_mchCn=&_mchId=805-USG-300&_mchTk=_mch-malwarebytes.com-1595547534452-37133&_mchHo=blog.malwarebytes.com&_mchPo=&_mchRu=%2Fthreat-analysis%2F2020%2F07%2Fchinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware%2F&_mchPc=https%3A&_mchVr=158&_mchEcid=&_mchHa=&_mchRe=https%3A%2F%2Ft.co%2FJeGMk0Fi9l&_mchQp=
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/158/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
192.28.144.124 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software
akka-http/10.1.11 /
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Thu, 23 Jul 2020 23:38:55 GMT
Content-Encoding
gzip
Server
akka-http/10.1.11
Transfer-Encoding
chunked
X-Request-Id
af800b8a-b9b7-4c6b-bb1e-a9577d3ab99e
Content-Type
text/plain; charset=UTF-8
/
www.facebook.com/tr/ 		44 B
381 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/tr/?id=1480959392203028&ev=ViewContent&dl=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-analysis%2F2020%2F07%2Fchinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware%2F&rl=https%3A%2F%2Ft.co%2FJeGMk0Fi9l&if=false&ts=1595547534492&sw=1600&sh=1200&v=2.9.22&r=stable&ec=0&o=30&fbp=fb.1.1595547534491.1985828036&it=1595547534374&coo=false&rqm=GET
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:54 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
status
200
cache-control
no-cache, must-revalidate, max-age=0
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
44
expires
Thu, 23 Jul 2020 23:38:54 GMT
lounge.6525595c7a9874fa10bd041275e40f17.css
c.disquscdn.com/next/embed/styles/ 		0
22 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://c.disquscdn.com/next/embed/styles/lounge.6525595c7a9874fa10bd041275e40f17.css
Requested by
Host: malwarebytesunpacked.disqus.com
URL: https://malwarebytesunpacked.disqus.com/embed.js?_=1595547532700
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:a913 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
193049
status
200
strict-transport-security
max-age=300; includeSubdomains
content-length
22092
x-xss-protection
1; mode=block
timing-allow-origin
*
last-modified
Mon, 20 Jul 2020 23:36:39 GMT
server
cloudflare
etag
"5f162a87-564c"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000, public, immutable, no-transform
cf-request-id
041fa45d27000005dcba3d6200000001
accept-ranges
bytes
cf-ray
5b793cdb783405dc-FRA
expires
Wed, 21 Jul 2021 18:01:24 GMT
common.bundle.f9de3d662c5d03c937747411c45f2ea2.js
c.disquscdn.com/next/embed/ 		0
88 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://c.disquscdn.com/next/embed/common.bundle.f9de3d662c5d03c937747411c45f2ea2.js
Requested by
Host: malwarebytesunpacked.disqus.com
URL: https://malwarebytesunpacked.disqus.com/embed.js?_=1595547532700
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:a913 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
193049
status
200
strict-transport-security
max-age=300; includeSubdomains
content-length
89946
x-xss-protection
1; mode=block
timing-allow-origin
*
last-modified
Mon, 20 Jul 2020 23:36:39 GMT
server
cloudflare
etag
"5f162a87-15f5a"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000, public, immutable, no-transform
cf-request-id
041fa45d28000005dcba3d7200000001
accept-ranges
bytes
cf-ray
5b793cdb783505dc-FRA
expires
Wed, 21 Jul 2021 18:01:24 GMT
lounge.bundle.c32f18973ccddcdedfa44f2602cdb867.js
c.disquscdn.com/next/embed/ 		0
113 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://c.disquscdn.com/next/embed/lounge.bundle.c32f18973ccddcdedfa44f2602cdb867.js
Requested by
Host: malwarebytesunpacked.disqus.com
URL: https://malwarebytesunpacked.disqus.com/embed.js?_=1595547532700
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:a913 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 23:38:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
9077
status
200
strict-transport-security
max-age=300; includeSubdomains
content-length
115356
x-xss-protection
1; mode=block
timing-allow-origin
*
last-modified
Thu, 23 Jul 2020 20:57:22 GMT
server
cloudflare
etag
"5f19f9b2-1c29c"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000, public, immutable, no-transform
cf-request-id
041fa45d28000005dcba3d8200000001
accept-ranges
bytes
cf-ray
5b793cdb783605dc-FRA
expires
Fri, 23 Jul 2021 21:07:37 GMT
config.js
disqus.com/next/ 		0
7 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://disqus.com/next/config.js
Requested by
Host: malwarebytesunpacked.disqus.com
URL: https://malwarebytesunpacked.disqus.com/embed.js?_=1595547532700
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.128.134 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 23 Jul 2020 23:38:54 GMT
X-Content-Type-Options
nosniff
Content-Type
application/javascript; charset=UTF-8
Server
nginx
Age
30
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=300; includeSubdomains
p3p
CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Access-Control-Allow-Origin
*
Cache-Control
public, stale-while-revalidate=300, s-stalewhilerevalidate=3600, max-age=60
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
6275
X-XSS-Protection
1; mode=block
/
disqus.com/embed/comments/ Frame 271E 		0
0
/
disqus.com/embed/comments/ Frame E276 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=43728%20https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D43728&t_u=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-analysis%2F2020%2F07%2Fchinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware%2F&t_e=Chinese%20APT%20group%20targets%20India%20and%20Hong%20Kong%20using%20new%20variant%20of%20MgBot%20malware&t_d=%0A%09%09%09%09%09Chinese%20APT%20group%20targets%20India%20and%20Hong%20Kong%20using%20new%20variant%20of%20MgBot%20malware%09%09%09%09&t_t=Chinese%20APT%20group%20targets%20India%20and%20Hong%20Kong%20using%20new%20variant%20of%20MgBot%20malware&s_o=default
Requested by
Host: malwarebytesunpacked.disqus.com
URL: https://malwarebytesunpacked.disqus.com/embed.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.128.134 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src https://*.twitter.com:* https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://*.services.disqus.com:* https://cdn.boomtrain.com/p13n/ https://apis.google.com https://cdn.syndication.twimg.com/tweets.json https://connect.facebook.net/en_US/sdk.js https://referrer.disqus.com/juggler/ 'unsafe-inline' https://com-disqus.netmng.com:* https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Host
disqus.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/

Response headers

Connection
keep-alive
Content-Length
2898
Server
nginx
Content-Security-Policy
script-src https://*.twitter.com:* https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://*.services.disqus.com:* https://cdn.boomtrain.com/p13n/ https://apis.google.com https://cdn.syndication.twimg.com/tweets.json https://connect.facebook.net/en_US/sdk.js https://referrer.disqus.com/juggler/ 'unsafe-inline' https://com-disqus.netmng.com:* https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com
Link
<https://c.disquscdn.com>;rel=preconnect,<https://c.disquscdn.com>;rel=dns-prefetch
Cache-Control
stale-if-error=3600, s-stalewhilerevalidate=3600, stale-while-revalidate=30, no-cache, must-revalidate, public, s-maxage=5
p3p
CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Timing-Allow-Origin
*
X-Content-Type-Options
nosniff
X-XSS-Protection
1; mode=block
Content-Type
text/html; charset=utf-8
Last-Modified
Tue, 21 Jul 2020 15:05:07 GMT
ETag
W/"lounge:view:8135446909.c8cc55e65cd6faa10fb89d2aaa893aa4.2"
Content-Encoding
gzip
Date
Thu, 23 Jul 2020 23:38:54 GMT
Age
1
Vary
Accept-Encoding
Strict-Transport-Security
max-age=300; includeSubdomains
/
www.facebook.com/tr/ 		0
111 B 		Other
General
Check archive.org
Download Go to
Full URL
https://www.facebook.com/tr/
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
multipart/form-data; boundary=----WebKitFormBoundaryc80Dv1e9AeGEZkP2

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
server
proxygen-bolt
date
Thu, 23 Jul 2020 23:38:55 GMT
status
200
content-type
text/plain
access-control-allow-origin
https://blog.malwarebytes.com
access-control-allow-credentials
true
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
disqus.com
URL
https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=43728%20https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D43728&t_u=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-analysis%2F2020%2F07%2Fchinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware%2F&t_e=Chinese%20APT%20group%20targets%20India%20and%20Hong%20Kong%20using%20new%20variant%20of%20MgBot%20malware&t_d=%0A%09%09%09%09%09Chinese%20APT%20group%20targets%20India%20and%20Hong%20Kong%20using%20new%20variant%20of%20MgBot%20malware%09%09%09%09&t_t=Chinese%20APT%20group%20targets%20India%20and%20Hong%20Kong%20using%20new%20variant%20of%20MgBot%20malware&s_o=default

Verdicts & Comments Add Verdict or Comment

144 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| _wpemojiSettings function| $ function| jQuery boolean| pp_alreadyInitialized object| rlArgs number| a undefined| c function| jsonFeed object| OneTrust object| Optanon string| OnetrustActiveGroups string| OptanonActiveGroups object| dataLayer object| jQuery11130630368673804726 function| OptanonWrapper boolean| alertFallback object| respond object| Modernizr object| html5 function| yepnope object| BackgroundCheck object| flexibility function| readCookie object| acceptCookies undefined| setCookie function| overlay function| getVariable boolean| isAdw boolean| uuid boolean| uuidParam object| uuidCookie object| cookieSettings function| EventEmitter object| eventie function| imagesLoaded object| mbamFreeValues object| mbamPremiumValues object| webpageValues undefined| midCookie object| playfairLsd boolean| midValue boolean| xsourceValue boolean| playfairValue boolean| refpage boolean| mktoLs undefined| lsCookie undefined| xsourceCookie undefined| playfairCookie function| applyXSource function| modURLParam string| urlID object| google_tag_manager function| postscribe object| countVars string| disqus_shortname object| embedVars string| disqus_url string| disqus_identifier string| disqus_container_id string| disqus_title undefined| disqus_config_custom function| disqus_config object| wpcom_img_zoomer object| detectZoom string| homeLink object| wp function| Spinner object| jetpackCarouselStrings function| submitSearchFooter function| submitSearchNav function| submitSearchrightrail undefined| countryError string| country undefined| xdr function| rl_view_image function| rl_hide_image boolean| doresize object| scroll_pos object| jQuery112404492255323337735 boolean| hashtag function| closeSearchBar string| amphtml number| deviceWidth boolean| isMacLike object| preferredLanguage boolean| isMac boolean| isWindows boolean| isAndroid boolean| isiPhone boolean| isiPad boolean| isChromeOS function| showCurrentTab function| moveLabsNav number| hshInterval string| GoogleAnalyticsObject function| ga object| google_tag_data object| uetq function| twq object| twemoji object| DISQUSWIDGETS undefined| disqus_domain string| fieldIds object| fields function| expandFormFields function| showAllFields function| hideFormFields function| demandbaseLoaded string| _linkedin_partner_id object| _linkedin_data_partner_ids object| DISQUS object| gaplugins object| gaGlobal object| gaData function| UET object| twttr function| gtag number| number_of_pillar_pages_to_show object| CE2 function| ttd_dom_ready function| TTDUniversalPixelApi function| lintrk boolean| _already_called_lintrk function| __extends object| Demandbase object| __db function| DBSegment undefined| demandbaseMarketoFormId object| CE2BH function| GooglemKTybQhCsO function| google_trackConversion object| GooglebQhCsO string| axel boolean| cp function| fbq function| _fbq function| qp object| dotq object| YAHOO object| qevents function| mktoMunchkinFunction object| Munchkin function| mktoMunchkin object| MunchkinTracker

8 Cookies

Domain/Path Name / Value
.malwarebytes.com/ Name: _uetvid
Value: bc39547fe46937e60b13c7c0dbddc9ab
.doubleclick.net/ Name: IDE
Value: AHWqTUlm_d7O69AuBVd6NbFiXV-iL5tiuZoYuaZ3h-2CeywqKofc1KsRqII3wK1a
.malwarebytes.com/ Name: _gid
Value: GA1.2.2014966214.1595547534
.malwarebytes.com/ Name: OptanonConsent
Value: groups=1%3A1%2C0_165071%3A1%2C101%3A1%2C2%3A1%2C3%3A1%2C102%3A1%2C103%3A1%2C4%3A1%2C104%3A1%2C105%3A1%2C106%3A1%2C107%3A1%2C109%3A1%2C110%3A1%2C112%3A1%2C113%3A1%2C114%3A1%2C115%3A1%2C116%3A1%2C117%3A1%2C118%3A1%2C0_165051%3A1%2C0_165052%3A1%2C0_165053%3A1%2C0_165054%3A1%2C0_165055%3A1%2C0_165056%3A1%2C0_165057%3A1%2C0_165058%3A1%2C0_165059%3A1%2C0_165060%3A1%2C0_165061%3A1%2C0_165062%3A1%2C0_165063%3A1%2C0_165064%3A1%2C0_165065%3A1%2C0_165066%3A1%2C0_165067%3A1%2C0_165068%3A1%2C0_165069%3A1%2C0_165070%3A1%2C0_165072%3A1%2C0_165073%3A1%2C0_165074%3A1%2C0_168809%3A1%2C0_168810%3A1%2C0_171059%3A1%2C0_171060%3A1%2C0_171061%3A1%2C0_171062%3A1%2C0_171063%3A1%2C0_171064%3A1%2C0_172264%3A1%2C0_172327%3A1%2C0_179764%3A1%2C0_172332%3A1%2C0_172328%3A1%2C0_172329%3A1%2C108%3A1%2C111%3A1&datestamp=Fri+Jul+24+2020+01%3A38%3A54+GMT%2B0200+(Central+European+Summer+Time)&version=5.12.0
.malwarebytes.com/ Name: _uetsid
Value: c7c7d1bf160097eef2bcf15a70799530
.malwarebytes.com/ Name: _ga
Value: GA1.2.443604896.1595547534
.malwarebytes.com/ Name: _gat
Value: 1
.malwarebytes.com/ Name: _gcl_au
Value: 1.1.1249630020.1595547533

4 Console Messages

Source Level URL
Text
console-api log URL: https://blog.malwarebytes.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1(Line 2)
Message:
JQMIGRATE: Migrate is installed, version 1.4.1
console-api log URL: https://www.malwarebytes.com/js/nav-resize.js(Line 268)
Message:
There is no hero section
console-api log URL: https://malwarebytesunpacked.disqus.com/embed.js(Line 41)
Message:
Use DISQUS.reset instead of reloading embed.js please.
console-api log URL: https://malwarebytesunpacked.disqus.com/embed.js(Line 41)
Message:
See https://help.disqus.com/customer/portal/articles/472107-using-disqus-on-ajax-sites

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=0
X-Xss-Protection 0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

5118230.fls.doubleclick.net
805-usg-300.mktoresp.com
9812475.fls.doubleclick.net
a.quora.com
ads.avct.cloud
ads.avocet.io
analytics.twitter.com
api.company-target.com
bat.bing.com
blog.malwarebytes.com
c.disquscdn.com
connect.facebook.net
disqus.com
fonts.googleapis.com
genesis.malwarebytes.com
googleads.g.doubleclick.net
insight.adsrvr.org
js.adsrvr.org
lnkd.in
malwarebytesunpacked.disqus.com
match.prod.bidr.io
munchkin.marketo.net
optanon.blob.core.windows.net
px.ads.linkedin.com
q.quora.com
s.yimg.com
s0.wp.com
script.crazyegg.com
scripts.demandbase.com
secure.gravatar.com
segments.company-target.com
snap.licdn.com
sp.analytics.yahoo.com
static.ads-twitter.com
stats.g.doubleclick.net
t.co
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.linkedin.com
www.malwarebytes.com
disqus.com
104.244.42.197
104.244.42.3
108.174.10.10
130.211.198.3
143.204.202.127
143.204.202.60
143.204.202.73
143.204.206.235
151.101.112.134
151.101.112.157
151.101.113.2
151.101.128.134
172.217.21.230
172.217.23.98
192.0.77.32
192.28.144.124
212.82.100.181
216.58.205.230
2600:1f18:21ae:6701:9be3:f3d4:fc54:ed52
2600:9000:214f:6000:8:d3fb:39c0:93a1
2606:4700::6812:a913
2606:4700::6813:9308
2620:1ec:21::14
2620:1ec:c11::200
2a00:1288:f03d:1fa::4000
2a00:1450:4001:801::2003
2a00:1450:4001:801::2004
2a00:1450:4001:80b::2008
2a00:1450:4001:816::200e
2a00:1450:4001:81c::2002
2a00:1450:4001:81f::200a
2a00:1450:400c:c00::9a
2a02:26f0:6c00:296::25ea
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
2a04:fa87:fffe::c000:4902
2a05:f500:11:101::b93f:9005
34.194.150.218
52.211.33.154
52.215.9.203
52.239.137.4
52.49.185.203
95.101.176.176
0389971a85fb3695b9ea3e242cdb83601342d3bf8f9d853f85b7a408d01acb35
05337ff085af3f1ace7b8f1aa32500579060b3d6217a5b07fcdc3f1c1599c9cc
05a173cb58022e81eb499529ac56df6ad7bafe1c61b8128dca8b76f300b5b60e
0615974c40d602afdbf9759533e352bc17b0458c85aad6694b1a1ad20659625b
0987c7d80d4a820adf5a8b31aaac86ee6851ebc6db30f85e51b0dedf58187ebb
0ed37960a59a6ec6b443f9ef043864d09a51db6fd276ae578d9166467bf986d1
106941a0835c23647fa021b02ae9f0edb9b055ac0129e07847833426c521eefa
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
1532b16aa9cd1fef51c097aaf1abeac6cb6f239b026660e7105e49f4ae6549ff
19333622f176d68bc17e307d8df96b15447864fbb0bbaac495e507fa64d96077
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df
1dc2b8fb26c1a74260a66519a2a5fdf37a938d1b43bbe4d8da7fcd652acc61b9
1eee843357d4e318953115f64f268ec75c1482606dcdd934389a7bb4855c719b
1f462c2a1a60b244e8901d78293b03c6f554ea0364b57e7412550cd842484b90
1f504f86bc8f301e4041e744f681cce164e9ac5e8e5dfacc984a012e95e1a7cd
20e0c33005383c34dfcfc883e3d1638bde3a97733800e9cc7fc76a15b48299d7
21566c5bf140021872a218e16bd8d32d6ee52869d918d75fca0e3f396319fa9a
24830366dd34f6f8eb08135dd0bf59795c7311d14d9265ef0d033241977798ea
276addee7d845ec184d2792eb94930a30e017a95a3e4bc2c1ef29a187b6aaa3d
27746d8f30f7d5d665c6e70dfa1aab08476daec038ce0fd5c1d4ba21ab6bde77
319949c8c08b86e9c35ea542c0dc0c30cedaa9b8d3d3c3327a36c91aefbd8af5
32aa657c37799bedc062cbc95765b5a51cecbe24168625e56cb21d41701ab53d
32d4b293bb7f25a21cc44e81184d4bbcb3bdd1837e026b98ed0ad85b3b1a5292
3487ef2baf0c08ba660a8a143cdeb8ebeec961eea04bccd7c49096b4eb26b875
36e3052355fd8aa03431efa1940b95f1424f6ff56a06d660a1add952c9339861
3a034532b3989207e563a25b94e567e6b51247994b08fa5259e1414390a864d7
3a0b747d5c485e2786bb3ad33439080539fcb903f74e61bb0bb67748e7c72a5e
3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1
3df3409edbf5a97d5a05bb81002a02fdd200d7fa3000e231e91ddbdf8641b573
3fad9ac7120a5c25be31604882141046a6af4801e7f3e737f471ec85a31eed2a
41dd5e421fe221a7d2921d6fa2b36e8b01a9f2c054aaef5fad866fe896c1d1e0
425328ed7a60e35938fa92fc7ba5f5af96b53f9608bb41b8a07c0f91e8bdefcd
446f32d3a05972e084384fe34db2a544bd915e75e7214a7d1ea077835ef3b9fc
48d02d1758575a3ee0e7ba8a0a1c29666b4f55a00d1bf15fd1703897febf4cdb
48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d
4daee42a0ec7be4f50cef0de6d180fa8d5488d0e4616124c669758e340bde6de
4de8225a3fcdf1ba33ac5c087576fc7895e29eb38b61d78a03090c13607a483e
4ed10d0d64bb1515397e8666a63f484d640dbc5678fa62574e077b7aef1c3af2
50730a9b15322c696fcf7acfee22e1493325ec306239e82cb57bb73338a43828
51f4cf88527819ae3950b1820aa534ebf6c2fcbc0894db427ba5ab59d9efd659
527f5743db62b7f9d19fb4b1910eb56d63f76f50b0e0180b63eb67d374642099
539871ff2e44a36b5fa14c16c0a47fabb5b385dc43c981677c91aafdba712365
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
556039e99c2003586da0956a06249f81088f4d770fb32ee1520fc8847dc53369
5576e25dd8a4d45e90da43e0f127c4efb4d16eebcb7a1bc55fbb66e7cf504f9d
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
58c13e24cdfb6384c26836e3eac52d17701cd9d686c56ebf93efbbe9426f8cd6
5c622f5433cbb6ea1df5c0dd8671e55ef7d1464366074730473c453de50a579b
5f967fd41346c0fc1b9b44fa69c52bf1e754420c59c8017cefb0a14a764cafa4
6429fe0ed81fca5f6bb18cb0a0aacae3bd9de79192635aeed4cbda438139d75d
6718a07fa13fa05273a15a3442277d187b1b712d9eccef98fba120ef9442e975
6ebcda7a3a41ef97f0b4071160ceb1020e540fdc0f790079a5c2ef01ab654fe0
6f2119e2ee27e3f616f499ae99d6bd5cfcf2b5ebcbbf92c143baee8d0fa14125
72622641b79819e5c8b5c0543d105a45e30f13b1a6c0b5c3701e72de5b57e427
75576560e22fd4d4c913f4c8ba3372e09a073e75ebc34e956b4e93254f88e74d
75f9768f79e42df5aa6183372a4b067f02682606cca5f242e06d1e07f3614c94
7e0e6534aaf81d8e89e452e105647a47176d856b29700b4bd7a53d6a25e1ff90
7edb235d4485d2b65bb9f2cd203519456eb3c68aa8d310692873370b00310258
7f241b243217cbb0dec56966b1352349b74d6516ce764b7ca01e3d45a0483f13
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84415c35f6869b6b17590d6ba8f3115751f14d54adecbb27123008c416e4556d
886f70c3e30343eb48a987ba13f995c122f17d8cd5b90094369cbe42924c3e91
8c20518cd7e51066b82e8a8a1e8035210741cf808c02268915747960f531061c
8f796d398e512c5d19a2fecc943d19a204927ff3cf9ec2cb3f75a025535268cd
9095640221be2b81b98395dbd641fa001f65b8ddda73be005e331cc2f78fed54
95a2c350aabb2955eaaf7a8bbfb494c2533cc20207ac4a026a0100dbac0a554a
95c7f143520240d6ddd08776c754b96ba709e42593003ebb552d44416d4f2906
9679c4502c0ad31d3bc9f152a7473b850b09d4b7745010bf2a72811510ce768b
96d33f532112177ede6bf262dcf6d0140dbe29f05a4595d17b0be4743205b5ea
9b07fa54e76c45b97d3a8224c641338f28981f05b93158ea6beb637613591490
9fcb181721162ce0d395b7b9b1e5bb5ca82c5f79bde749d4d0467ec2e65fcb4a
a182e45f051c3b540f4e10ea2b38b08db2ba43d38ff33686de11b23e56df7a1b
a2b3f57762f2932505c6fa9b43932cb13856966074febc5bb048052f17100bf6
a3ce11e17464ae96ee2f1245fbf3c6cffa1aa6e7f6460fb6f8cbe95cfe1874cc
a52bbdb7b132e850fdaf5740012fcc0bc3f6ef0be520bc4b987d8761d40d015a
a6a97c4046257c7e4e063c9f76434c7ce2c1f105e46b07424fabfc054f2d4d24
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ac89084ed8ff309c9302cda7a550a0f679a9a34a3b420de2a87567f1089bb51e
ad2cc26b0fdde8f4eb637ed12b25364e85af0bfba227dad42cb997ff4ad23eeb
b10a8b01476da3fc060041be45e92a42f65c24115f1c64eff444735de47f2a54
b28678c51b4397abc7951fe8a69a8aec0fa299159d5eb4ced487aabbb89f44b5
b4e6efb587f3fdfb8155148201d0c51ac95d249a6727e8256acdfe624ade69af
b54cc529878005a6a68b1403d8a962bb0087a1ed0a1b8de4a9e4113d9f334613
b7cd93e343242e75632b5126a990fe73bbf1243d9976393772457b4edb8bffc9
b9d8e51ffd9da1d06ec0405452ac38723cddd71b1028542b6112b27931506bbc
bca7af0b45b6fc6a2064e8e7a34f2041f3e77261e63f0257209bcde6bc40545d
c016b45a43dc83a578f6d3dfd2f7746392c21f544ae89d22e25964a938c8c51f
c23ebf2c0ec8e37a6a0a179720c9763bf4e1f0ed993fe7d0ad41d4d9774fe957
c95d99452b4466523bf6c87a91085840ecf0fe08e8355106dd60e6fe6b40b770
cab329bb4dac7ce9c9c295f71b26e2b11aecf60f7420768887653f189ec5fcce
cbaa38189100f63524edc0c56f02837d40b324092fb1c81d1d58ea81c9fdf0c2
cea0a05c5af6e21a409875328ed2e3dba79131b7c41f8ea07d0e0e02c7b7b59e
cfa4a4e7bddabbf32a465874ca2396a5efb96554c29b460d971930033cc8f7a2
d0b70e9284f50b10ae83339964ef179bbd31e1918f220fe3e668680fef20c1b8
d78c7c2df9ae3de0ee35443fa0edfd12d1f94e7c1bf6cc446a152ab2e29b0a1a
da1c1ad273854673c3a3f7e8f76aae5d7c9c73f3ebd224c2be1f93106680b1d4
da819542692b3f1c2a667ba34eff3465a82d9756953a1446ab7d0772f9b1edd5
db00899dec60287f05cbee4d6e185d92d49300e2cc229f2cca3ec73ce0cd9850
dbb3f45c95eda5dfbb4ec5f9db45d8385f78d6dcf380e4eaf07f19e753804942
dc42fce6a19644a91580fca515239623b6b818439b830f9af5392787de4e397f
de5b72a65846090132693ae1cdaa29cbaf08933b5045abc33abbc142122c9e57
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
df73bd6bed3e91e18f6100fbfbf4324ec49aadfc49681facb35d700f0f5bb893
e33257e40a5420d325cbdd826a42403d63e4fa3c32efb3d7a4b3596aa0541a64
e345b8b70569822ac6512a71256a8b29a6836b20a1c8b31043b6e3431db13ac9
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e5087adff56cd9077a7b21a01d78e2a97177cbf4872935bbf3049d06ee884826
e6c0b8dbdb837d061061130cf8ac71861f0983dcbd935e8f5efe895d0b7e19b0
ea745edf3b12b505f9a6ffc05927aec58134c98f4d7b2a5f4c53c39449a0306f
ecb916133a9376911f10bc5c659952eb0031e457f5df367cde560edbfba38fb8
ed2491fc7526ff0b5cfec3fe6f4cf8153796520fc845b735286b0f42183da98a
edda03990c5d77149008225a15938e07aa1998d2cdff56f693273a498214d600
ede2fb9fcd66ca3fb915267a07ebd54fb330c5924bad7b7051735b3cb6260aa0
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef6de6beb1cf5bf809eccfe10f99aea0e0969c71d4eab5446410fef72695679f
f055e217bde76d711bd8b42af773f9f99b8a29d81ad9ed10b6379cc7e6c60452
f32d41f2099a0be20e6b57c5e0d1b71c079d3e1345827b0f5c5b97c6e5e3f78d
f49907138587c1b6eda90470bd052d859ff044d99ba51466a144f3e66cfcc439
f630c6ea4e44c35a93c0ee2950e68857311d9500d6025abe4a5db3ecaf270e3c
fbe40e7eb98f817ec0314b26ed607e404b3801f610ff4ff2ec53d331825d41ba
fd361b57998c76f86335afa28b8a62527d88a8200fb5c428d6f0fff73383e955