blog.netlab.360.com Open in urlscan Pro
101.199.252.231 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/
Submission: On September 18 via api (September 18th 2024, 3:35:08 pm UTC) from IN — Scanned from DE

Summary HTTP 26 Redirects Links 32 Behaviour Indicators

Summary

This website contacted 9 IPs in 2 countries across 6 domains to perform 26 HTTP transactions. The main IP is 101.199.252.231, located in China and belongs to CHINA169-BJ China Unicom Beijing Province Network, CN. The main domain is blog.netlab.360.com.
TLS certificate: Issued by WoTrus DV Server CA [Run by the Issuer] on December 15th 2023. Valid for: a year.

This is the only time blog.netlab.360.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
15	101.199.252.231 101.199.252.231	4808 (CHINA169-...) (CHINA169-BJ China Unicom Beijing Province Network)
1	2606:4700::68... 2606:4700::6812:bb1f	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a04:4e42:400... 2a04:4e42:400::649	54113 (FASTLY) (FASTLY)
1	199.232.196.134 199.232.196.134	54113 (FASTLY) (FASTLY)
1	151.101.192.134 151.101.192.134	54113 (FASTLY) (FASTLY)
1	2600:9000:20b... 2600:9000:20b4:ec00:6:8656:f5c0:93a1	16509 (AMAZON-02) (AMAZON-02)
2	143.204.215.42 143.204.215.42	16509 (AMAZON-02) (AMAZON-02)
3	199.232.192.64 199.232.192.64	54113 (FASTLY) (FASTLY)
26	9

15 101.199.252.231 (China)

ASN4808 (CHINA169-BJ China Unicom Beijing Province Network, CN)

blog.netlab.360.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:bb1f (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:400::649 (United States)

ASN54113 (FASTLY, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 199.232.196.134 (United States)

ASN54113 (FASTLY, US)

blog-netlab-360.disqus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.192.134 (San Francisco, United States)

ASN54113 (FASTLY, US)

disqus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:20b4:ec00:6:8656:f5c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

c.disquscdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 143.204.215.42 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-215-42.fra53.r.cloudfront.net

cdn.viglink.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 199.232.192.64 (United States)

ASN54113 (FASTLY, US)

links.services.disqus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
15	360.com blog.netlab.360.com	1 MB
5	disqus.com blog-netlab-360.disqus.com disqus.com — Cisco Umbrella Rank: 1275 links.services.disqus.com — Cisco Umbrella Rank: 19409	28 KB
2	viglink.com cdn.viglink.com — Cisco Umbrella Rank: 13145	774 B
1	disquscdn.com c.disquscdn.com — Cisco Umbrella Rank: 6915	27 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 808	31 KB
1	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 314	65 KB
26	6

	Domain	Requested by
15	blog.netlab.360.com	blog.netlab.360.com
3	links.services.disqus.com	c.disquscdn.com
2	cdn.viglink.com	blog.netlab.360.com
1	c.disquscdn.com	blog-netlab-360.disqus.com
1	disqus.com	blog-netlab-360.disqus.com
1	blog-netlab-360.disqus.com	blog.netlab.360.com
1	code.jquery.com	blog.netlab.360.com
1	cdn.jsdelivr.net	blog.netlab.360.com
26	8

This site contains links to these domains. Also see Links.

Domain
twitter.com
feedly.com
www.facebook.com
thisissecurity.stormshield.com
155.94.154.170
154.82.110.5
205.185.113.59
agent.apacheorg.top
185.250.148.157
sites.google.com
31.220.58.29
18.228.7.109
172.105.241.146
54.210.230.186
pool.supportxmr.com
129.226.180.53
47.243.78.246
170.178.196.41
141.98.83.139
ghost.org

Subject Issuer	Validity	Valid
netlab.360.com WoTrus DV Server CA [Run by the Issuer]	`2023-12-15` - `2025-01-14`	a year	crt.sh
*.jsdelivr.net Sectigo RSA Domain Validation Secure Server CA	`2024-05-04` - `2025-05-04`	a year	crt.sh
*.jquery.com Sectigo ECC Domain Validation Secure Server CA	`2024-06-25` - `2025-06-25`	a year	crt.sh
*.disqus.com Sectigo RSA Domain Validation Secure Server CA	`2024-04-16` - `2025-04-16`	a year	crt.sh
a.disquscdn.com Amazon RSA 2048 M02	`2024-07-30` - `2025-08-27`	a year	crt.sh
viglink.com Amazon RSA 2048 M03	`2024-08-13` - `2025-09-10`	a year	crt.sh
*.services.disqus.com GlobalSign Atlas R3 DV TLS CA 2024 Q2	`2024-06-10` - `2025-07-12`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/
Frame ID: 5AD1E638AECD60C7C3EE1D1921B22D37
Requests: 25 HTTP requests in this frame

Frame: https://disqus.com/embed/comments/?base=default&f=blog-netlab-360&t_i=ghost-61b7655d3819e50007636f1b&t_u=https%3A%2F%2Fblog.netlab.360.com%2Ften-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now%2F&t_d=Ten%20families%20of%20malicious%20samples%20are%20spreading%20using%20the%20Log4j2%20vulnerability%20Now&t_t=Ten%20families%20of%20malicious%20samples%20are%20spreading%20using%20the%20Log4j2%20vulnerability%20Now&s_o=default
Frame ID: 65AF4284DD98B319383FF923C201F7C5
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Ten families of malicious samples are spreading using the Log4j2 vulnerability Now

Detected technologies

AMP (JavaScript frameworks) Expand

Overall confidence: 100%
Detected patterns

<link rel="amphtml"

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

Page Statistics

26
Requests

96 %
HTTPS

38 %
IPv6

6
Domains

8
Subdomains

9
IPs

2
Countries

1250 kB
Transfer

1638 kB
Size

0
Cookies

32 Outgoing links

These are links going to different origins than the main page.

URL: https://twitter.com/360Netlab

Search URL Search Domain Scan URL

URL: https://feedly.com/i/subscription/feed/https://blog.netlab.360.com/rss/

Search URL Search Domain Scan URL

URL: https://twitter.com/share?text=Ten%20families%20of%20malicious%20samples%20are%20spreading%20using%20the%20Log4j2%20vulnerability%20Now&url=https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/

Search URL Search Domain Scan URL

URL: https://twitter.com/360Netlab?ref=blog.netlab.360.com
Title: our twitter handle

Search URL Search Domain Scan URL

URL: https://thisissecurity.stormshield.com/2015/09/30/when-elf-billgates-met-windows/?ref=blog.netlab.360.com
Title: [4]

Search URL Search Domain Scan URL

URL: http://155.94.154.170/aaa
Title: http://155.94.154.170/aaa

Search URL Search Domain Scan URL

URL: http://155.94.154.170/log4j
Title: http://155.94.154.170/log4j

Search URL Search Domain Scan URL

URL: http://154.82.110.5:1234/win.exe
Title: http://154.82.110.5:1234/win.exe

Search URL Search Domain Scan URL

URL: http://205.185.113.59:1234/xmss
Title: http://205.185.113.59:1234/xmss

Search URL Search Domain Scan URL

URL: http://agent.apacheorg.top:1234/xmss
Title: http://agent.apacheorg.top:1234/xmss

Search URL Search Domain Scan URL

URL: http://205.185.113.59:1234/.rsyslogds
Title: http://205.185.113.59:1234/.rsyslogds

Search URL Search Domain Scan URL

URL: http://205.185.113.59:1234/.inis
Title: http://205.185.113.59:1234/.inis

Search URL Search Domain Scan URL

URL: http://205.185.113.59:1234/xms
Title: http://205.185.113.59:1234/xms

Search URL Search Domain Scan URL

URL: http://185.250.148.157:8005/acc
Title: http://185.250.148.157:8005/acc

Search URL Search Domain Scan URL

URL: http://185.250.148.157:8005/index
Title: http://185.250.148.157:8005/index

Search URL Search Domain Scan URL

URL: https://sites.google.com/view/maintest01
Title: https://sites.google.com/view/maintest01

Search URL Search Domain Scan URL

URL: http://31.220.58.29/Exploit.class
Title: http://31.220.58.29/Exploit.class

Search URL Search Domain Scan URL

URL: http://18.228.7.109/.log/log
Title: http://18.228.7.109/.log/log

Search URL Search Domain Scan URL

URL: http://172.105.241.146/wp-content/themes/twentysixteen/s.cmd
Title: http://172.105.241.146:80/wp-content/themes/twentysixteen/s.cmd

Search URL Search Domain Scan URL

URL: http://54.210.230.186/wp-content/themes/twentyfourteen/xmrig.exe','xmrig.exe
Title: http://54.210.230.186:80/wp-content/themes/twentyfourteen/xmrig.exe','xmrig.exe

Search URL Search Domain Scan URL

URL: http://pool.supportxmr.com/
Title: pool.supportxmr.com

Search URL Search Domain Scan URL

URL: http://129.226.180.53/xmrig_setup/raw/master/xmrig.tar.gz
Title: http://129.226.180.53/xmrig_setup/raw/master/xmrig.tar.gz

Search URL Search Domain Scan URL

URL: http://129.226.180.53/xmrig_setup/raw/master/setup_c3pool_miner.sh
Title: http://129.226.180.53/xmrig_setup/raw/master/setup_c3pool_miner.sh

Search URL Search Domain Scan URL

URL: http://47.243.78.246/12
Title: http://47.243.78.246/12

Search URL Search Domain Scan URL

URL: http://170.178.196.41:1111/pglQLHfm
Title: http://170.178.196.41:1111/pglQLHfm

Search URL Search Domain Scan URL

URL: http://170.178.196.41:35244/qIoPIauO
Title: http://170.178.196.41:35244/qIoPIauO

Search URL Search Domain Scan URL

URL: http://170.178.196.41:8080/UKTPAnRvns
Title: http://170.178.196.41:8080/UKTPAnRvns

Search URL Search Domain Scan URL

URL: http://141.98.83.139:9883/exp.class
Title: http://141.98.83.139:9883/exp.class

Search URL Search Domain Scan URL

URL: http://141.98.83.139:18080/nG60k1/RWjxFwxCBE
Title: http://141.98.83.139:18080/nG60k1/RWjxFwxCBE

Search URL Search Domain Scan URL

URL: http://141.98.83.139:18080/nG60k1
Title: http://141.98.83.139:18080/nG60k1

Search URL Search Domain Scan URL

URL: https://ghost.org/
Title: Powered by Ghost

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

26 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/ 47 KB
16 KB 2267ms
521ms Document
text/html 101.199.252.231
CHINA169-BJ China...

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

101.199.252.231 , China, ASN4808 (CHINA169-BJ China Unicom Beijing Province Network, CN),

Reverse DNS

Software

nginx/1.23.2 / Express

Resource Hash

76c2c380f2ad33b6eb8a75c63c200924825381488117f8b22ad7def619621714

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

Cache-Control: public, max-age=0
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=utf-8
Date: Wed, 18 Sep 2024 15:35:02 GMT
ETag: W/"bbed-vDeYFEMGsJrWgACNoZF9koRG1o4"
Server: nginx/1.23.2
Strict-Transport-Security: max-age=31536000; includeSubDomains
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Powered-By: Express

GET
H/1.1 200
OK screen.css
blog.netlab.360.com/assets/built/ 41 KB
9 KB 241ms
240ms Stylesheet
text/css 101.199.252.231
CHINA169-BJ China...

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.netlab.360.com/assets/built/screen.css?v=42b57cac00

Requested by

Host: blog.netlab.360.com
URL: https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

101.199.252.231 , China, ASN4808 (CHINA169-BJ China Unicom Beijing Province Network, CN),

Reverse DNS

Software

nginx/1.23.2 / Express

Resource Hash

5efdf963abe8da99b03f3f69ca80c435fe63d6ea08f9e909622c15d834e560ed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/

Response headers

Transfer-Encoding: chunked
Strict-Transport-Security: max-age=31536000; includeSubDomains
Cache-Control: public, max-age=31536000
Content-Encoding: gzip
ETag: W/"a364-19205c37ab0"
Connection: keep-alive
Accept-Ranges: bytes
Date: Wed, 18 Sep 2024 15:35:02 GMT
Content-Type: text/css; charset=UTF-8
X-Powered-By: Express
Server: nginx/1.23.2
Last-Modified: Wed, 18 Sep 2024 15:32:30 GMT
Vary: Accept-Encoding

GET
H2 200 sodo-search.min.js Show response
cdn.jsdelivr.net/ghost/sodo-search@~1.1/umd/ 197 KB
65 KB 138ms
46ms Script
application/javascript 2606:4700::6812:bb1f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/ghost/sodo-search@~1.1/umd/sodo-search.min.js

Requested by

Host: blog.netlab.360.com
URL: https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:bb1f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

73e90bca3350ae511b91bb029abfdc78760e164530c9cfd8f1f5e5d007a254b4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://blog.netlab.360.com
Referer: https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/

Response headers

access-control-expose-headers: *
content-encoding: gzip
cf-cache-status: HIT
etag: W/"313b2-PGFkfSo33Bwphw9PaHfsB1kMn/Y"
age: 35376
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Sd9xj66XRxfSTVaZ8iEjQ1iDkCo3aMeF0yS0aEwmEtbJbnuW%2F8wKetOwo9Q%2BiIceneczLfiEWlSubnykHpFoMoi6B3UrV6JgD2bSanghV8th2fw%2FDbKUgHq97XM0ZCa4g%2F6acLhdpkNZ8Pq501Q%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
x-jsd-version-type: version
alt-svc: h3=":443"; ma=86400
x-cache: HIT, HIT
date: Wed, 18 Sep 2024 15:35:02 GMT
content-type: application/javascript; charset=utf-8
x-served-by: cache-fra-etou8220075-FRA, cache-lga21950-LGA
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=600, s-maxage=43200, stale-while-revalidate=600, stale-if-error=86400
timing-allow-origin: *
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy: cross-origin
cf-ray: 8c526752ceffd3bc-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 65539
server: cloudflare
x-jsd-version: 1.1.1

GET
H/1.1 200
OK cards.min.js Show response
blog.netlab.360.com/public/ 7 KB
2 KB 220ms
219ms Script
application/javascript 101.199.252.231
CHINA169-BJ China...

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.netlab.360.com/public/cards.min.js?v=42b57cac00

Requested by

Host: blog.netlab.360.com
URL: https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

101.199.252.231 , China, ASN4808 (CHINA169-BJ China Unicom Beijing Province Network, CN),

Reverse DNS

Software

nginx/1.23.2 / Express

Resource Hash

7b9c762be52fed9737a319df953c29ad448a7713a31a4ba0f76ab15013512ee6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/

Response headers

Transfer-Encoding: chunked
Strict-Transport-Security: max-age=31536000; includeSubDomains
Cache-Control: public, max-age=31536000
Content-Encoding: gzip
ETag: "431228c753b74a6958600d170f921e6d"
Connection: keep-alive
Date: Wed, 18 Sep 2024 15:35:03 GMT
Content-Type: application/javascript
X-Powered-By: Express
Server: nginx/1.23.2
Vary: Accept-Encoding

GET
H/1.1 200
OK cards.min.css
blog.netlab.360.com/public/ 39 KB
7 KB 478ms
232ms Stylesheet
text/css 101.199.252.231
CHINA169-BJ China...

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.netlab.360.com/public/cards.min.css?v=42b57cac00

Requested by

Host: blog.netlab.360.com
URL: https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

101.199.252.231 , China, ASN4808 (CHINA169-BJ China Unicom Beijing Province Network, CN),

Reverse DNS

Software

nginx/1.23.2 / Express

Resource Hash

54682e379031e7d89b632f95f6ce239060db2a9d7fce9f92638dc4a8cbd1ae41

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/

Response headers

Transfer-Encoding: chunked
Strict-Transport-Security: max-age=31536000; includeSubDomains
Cache-Control: public, max-age=31536000
Content-Encoding: gzip
ETag: "d3c677de6b672445cc6386191937cf9b"
Connection: keep-alive
Date: Wed, 18 Sep 2024 15:35:03 GMT
Content-Type: text/css
X-Powered-By: Express
Server: nginx/1.23.2
Vary: Accept-Encoding

GET
H/1.1 200
OK netlab-brand-5.png
blog.netlab.360.com/content/images/2019/02/ 21 KB
21 KB 894ms
450ms Image
image/png 101.199.252.231
CHINA169-BJ China...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.netlab.360.com/content/images/2019/02/netlab-brand-5.png

Requested by

Host: blog.netlab.360.com
URL: https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

101.199.252.231 , China, ASN4808 (CHINA169-BJ China Unicom Beijing Province Network, CN),

Reverse DNS

Software

nginx/1.23.2 / Express

Resource Hash

d47ffdd0ca768158458845a42c746c6058867c5ce02cdb01c1858bb29aedc630

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Cache-Control: public, max-age=31536000
ETag: W/"5286-19205c39608"
Connection: keep-alive
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Length: 21126
Date: Wed, 18 Sep 2024 15:35:03 GMT
Content-Type: image/png
X-Powered-By: Express
Server: nginx/1.23.2
Last-Modified: Wed, 18 Sep 2024 15:32:37 GMT

GET
H/1.1 200
OK netlab_xs-2.png
blog.netlab.360.com/content/images/size/w30/2019/02/ 2 KB
2 KB 681ms
225ms Image
image/png 101.199.252.231
CHINA169-BJ China...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.netlab.360.com/content/images/size/w30/2019/02/netlab_xs-2.png

Requested by

Host: blog.netlab.360.com
URL: https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

101.199.252.231 , China, ASN4808 (CHINA169-BJ China Unicom Beijing Province Network, CN),

Reverse DNS

Software

nginx/1.23.2 / Express

Resource Hash

4b5a3702b2a13d962a0998ce7b341e19198e5b9278bf67f9ec3db979ee942e86

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Cache-Control: public, max-age=31536000
ETag: W/"825-19205c39608"
Connection: keep-alive
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Length: 2085
Date: Wed, 18 Sep 2024 15:35:03 GMT
Content-Type: image/png
X-Powered-By: Express
Server: nginx/1.23.2
Last-Modified: Wed, 18 Sep 2024 15:32:37 GMT

GET
H/1.1 200
OK log4j2_source_ip.png
blog.netlab.360.com/content/images/2021/12/ 322 KB
323 KB 915ms
475ms Image
image/png 101.199.252.231
CHINA169-BJ China...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.netlab.360.com/content/images/2021/12/log4j2_source_ip.png

Requested by

Host: blog.netlab.360.com
URL: https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

101.199.252.231 , China, ASN4808 (CHINA169-BJ China Unicom Beijing Province Network, CN),

Reverse DNS

Software

nginx/1.23.2 / Express

Resource Hash

cbbc60ca02563f0daabb338d2bec3aa4580b4c39f6a3be608b571647301f1634

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Cache-Control: public, max-age=31536000
ETag: W/"508ec-1920252d178"
Connection: keep-alive
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Length: 329964
Date: Wed, 18 Sep 2024 15:35:03 GMT
Content-Type: image/png
X-Powered-By: Express
Server: nginx/1.23.2
Last-Modified: Tue, 17 Sep 2024 23:30:35 GMT

GET
H/1.1 200
OK log4j2_ports.png
blog.netlab.360.com/content/images/2021/12/ 129 KB
129 KB 922ms
472ms Image
image/png 101.199.252.231
CHINA169-BJ China...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.netlab.360.com/content/images/2021/12/log4j2_ports.png

Requested by

Host: blog.netlab.360.com
URL: https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

101.199.252.231 , China, ASN4808 (CHINA169-BJ China Unicom Beijing Province Network, CN),

Reverse DNS

Software

nginx/1.23.2 / Express

Resource Hash

7cecd5b0651c1a0ae81cb848d1f03af91fe45da47593b5c577d6acc29b127f26

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Cache-Control: public, max-age=31536000
ETag: W/"2033f-191f8c5f2c0"
Connection: keep-alive
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Length: 131903
Date: Wed, 18 Sep 2024 15:35:03 GMT
Content-Type: image/png
X-Powered-By: Express
Server: nginx/1.23.2
Last-Modified: Mon, 16 Sep 2024 03:00:08 GMT

GET
H/1.1 200
OK log4j2_asn.png
blog.netlab.360.com/content/images/2021/12/ 141 KB
141 KB 713ms
493ms Image
image/png 101.199.252.231
CHINA169-BJ China...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.netlab.360.com/content/images/2021/12/log4j2_asn.png

Requested by

Host: blog.netlab.360.com
URL: https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

101.199.252.231 , China, ASN4808 (CHINA169-BJ China Unicom Beijing Province Network, CN),

Reverse DNS

Software

nginx/1.23.2 / Express

Resource Hash

6a0fbe19b5743c458940c4f83a019e142c63c119fdf9ea06ffbbda7eaa168918

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Cache-Control: public, max-age=31536000
ETag: W/"23412-191f8c5f2c0"
Connection: keep-alive
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Length: 144402
Date: Wed, 18 Sep 2024 15:35:03 GMT
Content-Type: image/png
X-Powered-By: Express
Server: nginx/1.23.2
Last-Modified: Mon, 16 Sep 2024 03:00:08 GMT

GET
H/1.1 200
OK log4j2_country.png
blog.netlab.360.com/content/images/2021/12/ 108 KB
108 KB 256ms
255ms Image
image/png 101.199.252.231
CHINA169-BJ China...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.netlab.360.com/content/images/2021/12/log4j2_country.png

Requested by

Host: blog.netlab.360.com
URL: https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

101.199.252.231 , China, ASN4808 (CHINA169-BJ China Unicom Beijing Province Network, CN),

Reverse DNS

Software

nginx/1.23.2 / Express

Resource Hash

9b62e06253840297019b3cddea73b2144f93ae99a16487ff15b98b49721aef3c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Cache-Control: public, max-age=31536000
ETag: W/"1aea6-191f8c5f6a8"
Connection: keep-alive
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Length: 110246
Date: Wed, 18 Sep 2024 15:35:03 GMT
Content-Type: image/png
X-Powered-By: Express
Server: nginx/1.23.2
Last-Modified: Mon, 16 Sep 2024 03:00:09 GMT

GET
H/1.1 200
OK log4j2_actor.png
blog.netlab.360.com/content/images/2021/12/ 48 KB
48 KB 233ms
233ms Image
image/png 101.199.252.231
CHINA169-BJ China...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.netlab.360.com/content/images/2021/12/log4j2_actor.png

Requested by

Host: blog.netlab.360.com
URL: https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

101.199.252.231 , China, ASN4808 (CHINA169-BJ China Unicom Beijing Province Network, CN),

Reverse DNS

Software

nginx/1.23.2 / Express

Resource Hash

024160a8623a8d6496900f5d4977668ac55031b488c8fa2588203e93981fe837

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Cache-Control: public, max-age=31536000
ETag: W/"c01c-191fe914d08"
Connection: keep-alive
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Length: 49180
Date: Wed, 18 Sep 2024 15:35:03 GMT
Content-Type: image/png
X-Powered-By: Express
Server: nginx/1.23.2
Last-Modified: Tue, 17 Sep 2024 06:00:21 GMT

GET
H/1.1 200
OK log4j2_cloud_vendor.png
blog.netlab.360.com/content/images/2021/12/ 58 KB
58 KB 464ms
463ms Image
image/png 101.199.252.231
CHINA169-BJ China...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.netlab.360.com/content/images/2021/12/log4j2_cloud_vendor.png

Requested by

Host: blog.netlab.360.com
URL: https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

101.199.252.231 , China, ASN4808 (CHINA169-BJ China Unicom Beijing Province Network, CN),

Reverse DNS

Software

nginx/1.23.2 / Express

Resource Hash

e09352c48ffaae579847150338ececaf34e1549c4d0a24aa50337819d899fb65

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Cache-Control: public, max-age=31536000
ETag: W/"e6de-191f8c5f6a8"
Connection: keep-alive
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Length: 59102
Date: Wed, 18 Sep 2024 15:35:03 GMT
Content-Type: image/png
X-Powered-By: Express
Server: nginx/1.23.2
Last-Modified: Mon, 16 Sep 2024 03:00:09 GMT

GET
H2 200 jquery-3.5.1.min.js Show response
code.jquery.com/ 87 KB
31 KB 169ms
61ms Script
application/javascript 2a04:4e42:400::649
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.5.1.min.js
Requested by: Host: blog.netlab.360.com
URL: https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:400::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://blog.netlab.360.com
Referer: https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/

Response headers

content-encoding: gzip
etag: W/"28feccc0-15d84"
age: 3103765
x-cache: HIT, HIT
date: Wed, 18 Sep 2024 15:35:02 GMT
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
x-cache-hits: 162736, 143039
x-served-by: cache-lga21981-LGA, cache-mxp6946-MXP
vary: Accept-Encoding
cache-control: public, max-age=31536000, stale-while-revalidate=604800
x-timer: S1726673703.878894,VS0,VE0
cross-origin-resource-policy: cross-origin
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
content-length: 30879
server: nginx

GET
H/1.1 200
OK casper.js Show response
blog.netlab.360.com/assets/built/ 3 KB
2 KB 233ms
233ms Script
application/javascript 101.199.252.231
CHINA169-BJ China...

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.netlab.360.com/assets/built/casper.js?v=42b57cac00

Requested by

Host: blog.netlab.360.com
URL: https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

101.199.252.231 , China, ASN4808 (CHINA169-BJ China Unicom Beijing Province Network, CN),

Reverse DNS

Software

nginx/1.23.2 / Express

Resource Hash

be0c9e729f48da26ec8510c4f44184681022a8e406cec4e67993374b5464fd78

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/

Response headers

Transfer-Encoding: chunked
Strict-Transport-Security: max-age=31536000; includeSubDomains
Cache-Control: public, max-age=31536000
Content-Encoding: gzip
ETag: W/"b29-19205c376c8"
Connection: keep-alive
Accept-Ranges: bytes
Date: Wed, 18 Sep 2024 15:35:03 GMT
Content-Type: application/javascript; charset=UTF-8
X-Powered-By: Express
Server: nginx/1.23.2
Last-Modified: Wed, 18 Sep 2024 15:32:29 GMT
Vary: Accept-Encoding

GET
H/1.1 200
OK embed.js Show response
blog-netlab-360.disqus.com/ 80 KB
26 KB 330ms
226ms Script
application/javascript 199.232.196.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://blog-netlab-360.disqus.com/embed.js

Requested by

Host: blog.netlab.360.com
URL: https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

199.232.196.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

openresty /

Resource Hash

29c81666ca42ca811d8f6c74fb6eb7c919199264e9e56eab9493a0f742c0e40f

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/

Response headers

Strict-Transport-Security: max-age=300; includeSubdomains
Link: <https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
Cache-Control: private, max-age=60
x-service: router
content-encoding: gzip
Age: 0
Connection: keep-alive
Cross-Origin-Resource-Policy: cross-origin
Content-Length: 26331
Date: Wed, 18 Sep 2024 15:35:03 GMT
content-type: application/javascript; charset=utf-8
Vary: Accept-Encoding
server: openresty

GET
H/1.1 200
OK astronomy-constellation-dark-998641-4.jpg
blog.netlab.360.com/content/images/2019/02/ 228 KB
229 KB 225ms
225ms Image
image/jpeg 101.199.252.231
CHINA169-BJ China...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.netlab.360.com/content/images/2019/02/astronomy-constellation-dark-998641-4.jpg

Requested by

Host: blog.netlab.360.com
URL: https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

101.199.252.231 , China, ASN4808 (CHINA169-BJ China Unicom Beijing Province Network, CN),

Reverse DNS

Software

nginx/1.23.2 / Express

Resource Hash

755be8423acd2b49eda72ff8bf2a246cf45a99f239c6750ee179a45997ae400c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Cache-Control: public, max-age=31536000
ETag: W/"390ec-19205c39220"
Connection: keep-alive
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Length: 233708
Date: Wed, 18 Sep 2024 15:35:04 GMT
Content-Type: image/jpeg
X-Powered-By: Express
Server: nginx/1.23.2
Last-Modified: Wed, 18 Sep 2024 15:32:36 GMT

GET
H/1.1 200
OK /
disqus.com/embed/comments/ Frame 65AF 0
0 245ms
164ms Document
text/html 151.101.192.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://disqus.com/embed/comments/?base=default&f=blog-netlab-360&t_i=ghost-61b7655d3819e50007636f1b&t_u=https%3A%2F%2Fblog.netlab.360.com%2Ften-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now%2F&t_d=Ten%20families%20of%20malicious%20samples%20are%20spreading%20using%20the%20Log4j2%20vulnerability%20Now&t_t=Ten%20families%20of%20malicious%20samples%20are%20spreading%20using%20the%20Log4j2%20vulnerability%20Now&s_o=default

Requested by

Host: blog-netlab-360.disqus.com
URL: https://blog-netlab-360.disqus.com/embed.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

151.101.192.134 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src https://.twitter.com: https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://.services.disqus.com: https://cdn.boomtrain.com/p13n/ https://com-disqus.netmng.com:* 'unsafe-inline' https://referrer.disqus.com/juggler/ https://connect.facebook.net/en_US/sdk.js https://cdn.syndication.twimg.com/tweets.json https://apis.google.com https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

Age: 0
Cache-Control: stale-if-error=3600, s-stalewhilerevalidate=3600, stale-while-revalidate=30, no-cache, must-revalidate, public, s-maxage=5
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 2909
Content-Security-Policy: script-src https://*.twitter.com:* https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://*.services.disqus.com:* https://cdn.boomtrain.com/p13n/ https://com-disqus.netmng.com:* 'unsafe-inline' https://referrer.disqus.com/juggler/ https://connect.facebook.net/en_US/sdk.js https://cdn.syndication.twimg.com/tweets.json https://apis.google.com https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com
Content-Type: text/html; charset=utf-8
Cross-Origin-Resource-Policy: cross-origin
Date: Wed, 18 Sep 2024 15:35:03 GMT
ETag: W/"lounge:view:8924365297.c2d6ddcdbd4a6373e8b4d04fae8bc0f8.2"
Last-Modified: Mon, 13 Dec 2021 15:39:27 GMT
Link: <https://c.disquscdn.com>;rel=preconnect,<https://c.disquscdn.com>;rel=dns-prefetch
Referrer-Policy: no-referrer-when-downgrade
Server: nginx
Strict-Transport-Security: max-age=300; includeSubdomains
Timing-Allow-Origin: *
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"

GET
H2 200 alfie_v4.63f1ab6d6b9d5807dc0c94ef3fe0b851.js Show response
c.disquscdn.com/next/embed/ 78 KB
27 KB 128ms
47ms Script
application/javascript 2600:9000:20b4:ec00:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/alfie_v4.63f1ab6d6b9d5807dc0c94ef3fe0b851.js

Requested by

Host: blog-netlab-360.disqus.com
URL: https://blog-netlab-360.disqus.com/embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:20b4:ec00:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

9efb3d5e1b082a66bd94908b42afb4cf6fe0e8eb8f50b8d2a18f6a5da03e6a18

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/

Response headers

content-encoding: gzip
surrogate-key: next
etag: "65130acd-67d2"
age: 30868898
x-content-type-options: nosniff
expires: Thu, 26 Sep 2024 08:53:26 GMT
x-cache: Hit from cloudfront
x-amz-cf-id: s0Z03wKu9e_FxYtsfX7voFD9iMjRvswYTQHB_ZkikFNHdJGbQeSNXg==
date: Wed, 27 Sep 2023 08:53:26 GMT
content-type: application/javascript; charset=utf-8
last-modified: Tue, 26 Sep 2023 16:46:05 GMT
x-cache-hits: 0
x-served-by: static-web-1
cache-control: max-age=31536000, public, immutable, no-transform
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
via: 1.1 c3d7a569db567dde78a645781f9949a2.cloudfront.net (CloudFront)
access-control-allow-origin: *
content-length: 26578
x-xss-protection: 1; mode=block
x-amz-cf-pop: AMS58-P4
server: nginx

GET
H2 200 pixel.gif
cdn.viglink.com/images/ 43 B
386 B 134ms
42ms Image
image/gif 143.204.215.42
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.viglink.com/images/pixel.gif?ch=1&rn=6.052736157961602
Requested by: Host: blog.netlab.360.com
URL: https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.215.42 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-215-42.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/

Response headers

cache-control: max-age=15, must-revalidate
etag: "221d8352905f2c38b3cb2bd191d630b0"
age: 1
via: 1.1 18e87eada05046c231b7f49230fa6dc4.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 43
x-amz-cf-id: 9a7DWNkA8fIPMgC3NbtB0sF1biVc_5FeoqJgX3DAXxSzVoKjc1qC2w==
date: Wed, 18 Sep 2024 15:35:04 GMT
content-type: image/gif
last-modified: Tue, 10 Feb 2015 03:29:39 GMT
server: AmazonS3
x-amz-cf-pop: FRA53-C1

GET
H2 200 pixel.gif
cdn.viglink.com/images/ 43 B
388 B 133ms
41ms Image
image/gif 143.204.215.42
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.viglink.com/images/pixel.gif?ch=2&rn=6.052736157961602
Requested by: Host: blog.netlab.360.com
URL: https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.215.42 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-215-42.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/

Response headers

cache-control: max-age=15, must-revalidate
etag: "221d8352905f2c38b3cb2bd191d630b0"
age: 1
via: 1.1 18e87eada05046c231b7f49230fa6dc4.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 43
x-amz-cf-id: sXAdDZC193lUGS3Qb-DNudwFScSK-3i5Zj01n4YAfBGng3qLVgWAUA==
date: Wed, 18 Sep 2024 15:35:04 GMT
content-type: image/gif
last-modified: Tue, 10 Feb 2015 03:29:39 GMT
server: AmazonS3
x-amz-cf-pop: FRA53-C1

GET
H/1.1 200
OK netlab_xs-2.png
blog.netlab.360.com/content/images/size/w256h256/2019/02/ 3 KB
3 KB 215ms
215ms Other
image/png 101.199.252.231
CHINA169-BJ China...

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.netlab.360.com/content/images/size/w256h256/2019/02/netlab_xs-2.png

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

101.199.252.231 , China, ASN4808 (CHINA169-BJ China Unicom Beijing Province Network, CN),

Reverse DNS

Software

nginx/1.23.2 / Express

Resource Hash

6754c6098412e281e318cc8215b1cc69f514a5f33e4d74932668f071c2293200

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Cache-Control: public, max-age=31536000
ETag: W/"c61-19205c3c4e8"
Connection: keep-alive
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Length: 3169
Date: Wed, 18 Sep 2024 15:35:04 GMT
Content-Type: image/png
X-Powered-By: Express
Server: nginx/1.23.2
Last-Modified: Wed, 18 Sep 2024 15:32:49 GMT

POST
H/1.1 200
OK ping Show response
links.services.disqus.com/api/ 299 B
736 B 174ms
71ms XHR
text/javascript 199.232.192.64
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://links.services.disqus.com/api/ping
Requested by: Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/alfie_v4.63f1ab6d6b9d5807dc0c94ef3fe0b851.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.232.192.64 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Apache-Coyote/1.1 /
Resource Hash: 1053da8c9c6503353810a4f692dfc2252c16a946ad301b255e3e1b49c1cce7aa

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/

Response headers

Cache-Control: no-cache, no-store
Pragma: no-cache
Connection: keep-alive
Access-Control-Allow-Credentials: true
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Access-Control-Allow-Origin: https://blog.netlab.360.com
Content-Length: 299
P3P: CP="ALL IND DSP COR CUR ADM TAIo PSDo OUR COM INT NAV PUR STA UNI"
Date: Wed, 18 Sep 2024 15:35:05 GMT
Content-Type: text/javascript;charset=UTF-8
Server: Apache-Coyote/1.1

GET sync.gif
links.services.disqus.com/api/ 0
0

POST
H/1.1 200
OK domains Show response
links.services.disqus.com/api/ 41 B
477 B 153ms
71ms XHR
text/javascript 199.232.192.64
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://links.services.disqus.com/api/domains
Requested by: Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/alfie_v4.63f1ab6d6b9d5807dc0c94ef3fe0b851.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.232.192.64 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Apache-Coyote/1.1 /
Resource Hash: 5dac2608d2aa72e1b7c6a3f220a4ebdf4babf5fc97c0f302d3e41a221d245beb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/

Response headers

Cache-Control: no-cache, no-store
Pragma: no-cache
Connection: keep-alive
Access-Control-Allow-Credentials: true
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Access-Control-Allow-Origin: https://blog.netlab.360.com
Content-Length: 41
P3P: CP="ALL IND DSP COR CUR ADM TAIo PSDo OUR COM INT NAV PUR STA UNI"
Date: Wed, 18 Sep 2024 15:35:05 GMT
Content-Type: text/javascript;charset=UTF-8
Server: Apache-Coyote/1.1

POST
H/1.1 200
OK domains Show response
links.services.disqus.com/api/ 42 B
478 B 148ms
66ms XHR
text/javascript 199.232.192.64
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://links.services.disqus.com/api/domains
Requested by: Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/alfie_v4.63f1ab6d6b9d5807dc0c94ef3fe0b851.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.232.192.64 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Apache-Coyote/1.1 /
Resource Hash: 6dbe056648e957e02c1f8f11370ea5ad8d39189a88415d45ce9594a48eb813ab

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/

Response headers

Cache-Control: no-cache, no-store
Pragma: no-cache
Connection: keep-alive
Access-Control-Allow-Credentials: true
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Access-Control-Allow-Origin: https://blog.netlab.360.com
Content-Length: 42
P3P: CP="ALL IND DSP COR CUR ADM TAIo PSDo OUR COM INT NAV PUR STA UNI"
Date: Wed, 18 Sep 2024 15:35:05 GMT
Content-Type: text/javascript;charset=UTF-8
Server: Apache-Coyote/1.1

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: links.services.disqus.com
URL: https://links.services.disqus.com/api/sync.gif?key=cfdfcf52dffd0a702a61bad27507376d

Verdicts & Comments Add Verdict or Comment

17 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

blog-netlab-360.disqus.com
blog.netlab.360.com
c.disquscdn.com
cdn.jsdelivr.net
cdn.viglink.com
code.jquery.com
disqus.com
links.services.disqus.com
links.services.disqus.com
101.199.252.231
143.204.215.42
151.101.192.134
199.232.192.64
199.232.196.134
2600:9000:20b4:ec00:6:8656:f5c0:93a1
2606:4700::6812:bb1f
2a04:4e42:400::649
024160a8623a8d6496900f5d4977668ac55031b488c8fa2588203e93981fe837
1053da8c9c6503353810a4f692dfc2252c16a946ad301b255e3e1b49c1cce7aa
29c81666ca42ca811d8f6c74fb6eb7c919199264e9e56eab9493a0f742c0e40f
4b5a3702b2a13d962a0998ce7b341e19198e5b9278bf67f9ec3db979ee942e86
54682e379031e7d89b632f95f6ce239060db2a9d7fce9f92638dc4a8cbd1ae41
5dac2608d2aa72e1b7c6a3f220a4ebdf4babf5fc97c0f302d3e41a221d245beb
5efdf963abe8da99b03f3f69ca80c435fe63d6ea08f9e909622c15d834e560ed
6754c6098412e281e318cc8215b1cc69f514a5f33e4d74932668f071c2293200
6a0fbe19b5743c458940c4f83a019e142c63c119fdf9ea06ffbbda7eaa168918
6dbe056648e957e02c1f8f11370ea5ad8d39189a88415d45ce9594a48eb813ab
73e90bca3350ae511b91bb029abfdc78760e164530c9cfd8f1f5e5d007a254b4
755be8423acd2b49eda72ff8bf2a246cf45a99f239c6750ee179a45997ae400c
76c2c380f2ad33b6eb8a75c63c200924825381488117f8b22ad7def619621714
7b9c762be52fed9737a319df953c29ad448a7713a31a4ba0f76ab15013512ee6
7cecd5b0651c1a0ae81cb848d1f03af91fe45da47593b5c577d6acc29b127f26
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7
9b62e06253840297019b3cddea73b2144f93ae99a16487ff15b98b49721aef3c
9efb3d5e1b082a66bd94908b42afb4cf6fe0e8eb8f50b8d2a18f6a5da03e6a18
be0c9e729f48da26ec8510c4f44184681022a8e406cec4e67993374b5464fd78
cbbc60ca02563f0daabb338d2bec3aa4580b4c39f6a3be608b571647301f1634
d47ffdd0ca768158458845a42c746c6058867c5ce02cdb01c1858bb29aedc630
e09352c48ffaae579847150338ececaf34e1549c4d0a24aa50337819d899fb65
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

blog.netlab.360.com Open in urlscan Pro 101.199.252.231 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

26 Requests

96 %HTTPS

38 %IPv6

6 Domains

8 Subdomains

9 IPs

2 Countries

1250 kBTransfer

1638 kBSize

0 Cookies

32 Outgoing links

Redirected requests

26 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

17 JavaScript Global Variables

0 Cookies

Security Headers

Indicators

blog.netlab.360.com Open in urlscan Pro
101.199.252.231 Public Scan

Screenshot
Live screenshot

Full Image

26
Requests

96 %
HTTPS

38 %
IPv6

6
Domains

8
Subdomains

9
IPs

2
Countries

1250 kB
Transfer

1638 kB
Size

0
Cookies

26 HTTP transactions
0 data transactions