www.malwaretech.com Open in urlscan Pro
2606:4700:10::6814:5037 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
Submission: On August 19 via api (August 19th 2019, 8:08:45 pm UTC) from US

Summary HTTP 98 Redirects Links 14 Behaviour Indicators

Summary

This website contacted 17 IPs in 3 countries across 13 domains to perform 98 HTTP transactions. The main IP is 2606:4700:10::6814:5037, located in United States and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is www.malwaretech.com.
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on February 10th 2019. Valid for: a year.

This is the only time www.malwaretech.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
50	2606:4700:10:... 2606:4700:10::6814:5037	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
4	2a00:1450:400... 2a00:1450:4001:808::2002	15169 (GOOGLE) (GOOGLE - Google LLC)
4	2a00:1450:400... 2a00:1450:4001:808::200e	15169 (GOOGLE) (GOOGLE - Google LLC)
1 2	2a00:1450:400... 2a00:1450:4001:80b::200e	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2a00:1450:400... 2a00:1450:4001:806::200a	15169 (GOOGLE) (GOOGLE - Google LLC)
3	2a00:1450:400... 2a00:1450:4001:809::200e	15169 (GOOGLE) (GOOGLE - Google LLC)
4	2a00:1450:400... 2a00:1450:4001:817::2003	15169 (GOOGLE) (GOOGLE - Google LLC)
9	2a00:1450:400... 2a00:1450:4001:81b::2002	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2a00:1450:400... 2a00:1450:400c:c04::9a	15169 (GOOGLE) (GOOGLE - Google LLC)
2	151.101.112.134 151.101.112.134	54113 (FASTLY) (FASTLY - Fastly)
4	2606:4700:30:... 2606:4700:30::681c:726	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	2a00:1450:400... 2a00:1450:4001:81b::200d	15169 (GOOGLE) (GOOGLE - Google LLC)
1	151.101.0.134 151.101.0.134	54113 (FASTLY) (FASTLY - Fastly)
5	2a00:1450:400... 2a00:1450:4001:814::2003	15169 (GOOGLE) (GOOGLE - Google LLC)
3	2606:4700::68... 2606:4700::6810:4da6	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	151.101.12.64 151.101.12.64	54113 (FASTLY) (FASTLY - Fastly)
98	17

50 2606:4700:10::6814:5037 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

www.malwaretech.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
malwaretech.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:808::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:808::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

apis.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80b::200e (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE - Google LLC, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:806::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:809::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

www.youtube.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:817::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a00:1450:4001:81b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c04::9a (Brussels, Belgium)

ASN15169 (GOOGLE - Google LLC, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.112.134 (Frankfurt am Main, Germany)

ASN54113 (FASTLY - Fastly, US)

malwaretech2.disqus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700:30::681c:726 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

lab.subinsb.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81b::200d (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

accounts.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.0.134 (United States)

ASN54113 (FASTLY - Fastly, US)

disqus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:814::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

ssl.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700::6810:4da6 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

c.disquscdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.12.64 (Frankfurt am Main, Germany)

ASN54113 (FASTLY - Fastly, US)

links.services.disqus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
50	malwaretech.com www.malwaretech.com malwaretech.com	672 KB
9	gstatic.com fonts.gstatic.com ssl.gstatic.com	54 KB
7	doubleclick.net googleads.g.doubleclick.net stats.g.doubleclick.net	303 B
6	google.com apis.google.com adservice.google.com accounts.google.com	109 KB
4	subinsb.com lab.subinsb.com	8 KB
4	disqus.com malwaretech2.disqus.com disqus.com Failed links.services.disqus.com	24 KB
4	googlesyndication.com pagead2.googlesyndication.com	255 KB
3	disquscdn.com c.disquscdn.com Failed	7 KB
3	youtube.com www.youtube.com
2	google-analytics.com 1 redirects www.google-analytics.com	18 KB
1	googletagservices.com www.googletagservices.com	28 KB
1	google.de adservice.google.de	476 B
1	googleapis.com fonts.googleapis.com	828 B
98	13

	Domain	Requested by
47	www.malwaretech.com	www.malwaretech.com
6	googleads.g.doubleclick.net	pagead2.googlesyndication.com
5	ssl.gstatic.com	www.malwaretech.com
4	lab.subinsb.com	www.malwaretech.com
4	fonts.gstatic.com	www.malwaretech.com
4	apis.google.com	www.malwaretech.com apis.google.com
4	pagead2.googlesyndication.com	www.malwaretech.com pagead2.googlesyndication.com
3	c.disquscdn.com	malwaretech2.disqus.com
3	malwaretech.com	www.malwaretech.com malwaretech.com
3	www.youtube.com	www.malwaretech.com apis.google.com
2	malwaretech2.disqus.com	www.malwaretech.com
2	www.google-analytics.com	1 redirects www.malwaretech.com
1	links.services.disqus.com	c.disquscdn.com
1	disqus.com	malwaretech2.disqus.com
1	accounts.google.com	apis.google.com
1	www.googletagservices.com	pagead2.googlesyndication.com
1	stats.g.doubleclick.net	www.malwaretech.com
1	adservice.google.com	pagead2.googlesyndication.com
1	adservice.google.de	pagead2.googlesyndication.com
1	fonts.googleapis.com	www.malwaretech.com
98	20

This site contains links to these domains. Also see Links.

Domain
discord.gg
www.facebook.com
twitter.com
plus.google.com
www.pinterest.com
www.linkedin.com
www.tumblr.com
youtube.com
twitch.tv
www.instagram.com
www.patreon.com
demos.subinsb.com

Subject Issuer	Validity	Valid
malwaretech.com CloudFlare Inc ECC CA-2	`2019-02-10` - `2020-02-10`	a year	crt.sh
*.g.doubleclick.net Google Internet Authority G3	`2019-07-29` - `2019-10-21`	3 months	crt.sh
*.apis.google.com Google Internet Authority G3	`2019-07-29` - `2019-10-21`	3 months	crt.sh
*.google-analytics.com Google Internet Authority G3	`2019-07-29` - `2019-10-21`	3 months	crt.sh
*.googleapis.com Google Internet Authority G3	`2019-07-29` - `2019-10-21`	3 months	crt.sh
*.google.com Google Internet Authority G3	`2019-07-29` - `2019-10-21`	3 months	crt.sh
*.disqus.com DigiCert SHA2 Secure Server CA	`2018-03-28` - `2020-04-27`	2 years	crt.sh
sni23361.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2019-04-13` - `2019-10-20`	6 months	crt.sh
accounts.google.com Google Internet Authority G3	`2019-07-29` - `2019-10-21`	3 months	crt.sh
ssl565697.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2019-03-17` - `2019-09-23`	6 months	crt.sh
f.ssl.fastly.net GlobalSign Organization Validation CA - SHA256 - G2	`2018-08-30` - `2020-12-02`	2 years	crt.sh

This page contains 15 frames:

Primary Page: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
Frame ID: E6BCBBE75170D08A03C791E05E22277C
Requests: 84 HTTP requests in this frame

Frame: https://www.youtube.com/embed/oDlgFWJ33rI?feature=oembed
Frame ID: 366A2E8AE9A6769C2329AD9AC0988A2D
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/r20190815/r20190131/show_ads_impl.js
Frame ID: 53BF2350E747BED881A8DD4CBB33AAAC
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20190815/r20190131/zrt_lookup.html
Frame ID: 5277029C655C60C334DFB792BE1611C0
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3337609182489974&output=html&adk=1812271804&adf=3025194257&lmt=1566245306&plat=1%3A32776%2C2%3A32776%2C8%3A32776%2C9%3A32776%2C16%3A8388608%2C30%3A1081344&guci=1.2.0.0.2.2.0.0&format=0x0&url=https%3A%2F%2Fwww.malwaretech.com%2F2019%2F08%2Fdejablue-analyzing-a-rdp-heap-overflow.html&ea=0&flash=0&pra=5&wgl=1&dt=1566245306020&bpp=10&bdt=183&fdt=94&idt=94&shv=r20190815&cbv=r20190131&saldr=aa&abxe=1&nras=1&correlator=4110676402966&frm=20&pv=2&ga_vid=540226228.1566245306&ga_sid=1566245306&ga_hid=1747954838&ga_fc=0&iag=0&icsg=1048227&dssz=23&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=0&ady=0&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=20199336%2C21061795%2C410075105&oid=3&rx=0&eae=2&fc=1936&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=16&bc=31&osw_key=1937533335&ifi=0&uci=0.rag6csr6yvqb&fsb=1&dtd=108
Frame ID: 375C8CCFC619E9B26937FBD45FA7FCEB
Requests: 1 HTTP requests in this frame

Frame: https://www.youtube.com/subscribe_embed?usegapi=1&channelid=UCLDnEn-TxejaDB8qm2AUhHQ&layout=full&count=default&origin=https%3A%2F%2Fwww.malwaretech.com&gsrc=3p&ic=1&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.tkLGB8oygGw.O%2Fam%3DwQE%2Fd%3D1%2Frs%3DAGLTcCOVrdiUrdoKYhlUTq9WIvZT-VXTAA%2Fm%3D__features__
Frame ID: F92E3EB08A229BB452A67679BF77B380
Requests: 1 HTTP requests in this frame

Frame: https://accounts.google.com/o/oauth2/postmessageRelay?parent=https%3A%2F%2Fwww.malwaretech.com&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.tkLGB8oygGw.O%2Fam%3DwQE%2Fd%3D1%2Frs%3DAGLTcCOVrdiUrdoKYhlUTq9WIvZT-VXTAA%2Fm%3D__features__
Frame ID: 4FB550701934C2DEB7B6A70770BC0C82
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3337609182489974&output=html&h=600&adk=3579329306&adf=3454879259&w=263&fwrn=4&fwrnh=100&lmt=1566245306&rafmt=1&to=qs&pwprc=4087771549&guci=1.2.0.0.2.2.0.0&format=263x600&url=https%3A%2F%2Fwww.malwaretech.com%2F2019%2F08%2Fdejablue-analyzing-a-rdp-heap-overflow.html&flash=0&fwr=0&resp_fmts=4&wgl=1&adsid=NT&dt=1566245306662&bpp=4&bdt=824&fdt=5&idt=5&shv=r20190815&cbv=r20190131&saldr=aa&abxe=1&prev_fmts=0x0%2C847x200%2C847x200&nras=3&correlator=4110676402966&frm=20&pv=1&ga_vid=540226228.1566245306&ga_sid=1566245306&ga_hid=1747954838&ga_fc=0&iag=0&icsg=2256196384849919&dssz=43&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1100&ady=1127&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=20199336%2C21061795%2C410075105&oid=3&rx=0&eae=0&fc=1936&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=144&bc=31&osw_key=579800346&ifi=3&uci=3.tbtf2zatm9g4&fsb=1&xpc=NzrcFjSH57&p=https%3A//www.malwaretech.com&dtd=9
Frame ID: 6871FB2D98E57467F83ECC6C99DE960C
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3337609182489974&output=html&h=90&adk=4250213621&adf=1553529706&w=848&fwrn=4&fwrnh=100&lmt=1566245306&rafmt=1&to=qs&pwprc=4087771549&guci=1.2.0.0.2.2.0.0&format=848x90&url=https%3A%2F%2Fwww.malwaretech.com%2F2019%2F08%2Fdejablue-analyzing-a-rdp-heap-overflow.html&flash=0&fwr=0&resp_fmts=3&wgl=1&adsid=NT&dt=1566245306679&bpp=3&bdt=841&fdt=4&idt=4&shv=r20190815&cbv=r20190131&saldr=aa&abxe=1&prev_fmts=0x0%2C847x200%2C847x200%2C263x600&nras=3&correlator=4110676402966&frm=20&pv=1&ga_vid=540226228.1566245306&ga_sid=1566245306&ga_hid=1747954838&ga_fc=0&iag=0&icsg=2256196384849919&dssz=43&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=223&ady=5797&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=20199336%2C21061795%2C410075105&oid=3&rx=0&eae=0&fc=1936&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=144&bc=31&osw_key=2012387053&ifi=4&uci=4.n2rzqzo7s80m&fsb=1&xpc=CtUQVc5uSq&p=https%3A//www.malwaretech.com&dtd=6
Frame ID: 8D42CC129AA5F8E998600F4D8F580EF2
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3337609182489974&output=html&h=200&adk=2728076285&adf=1959655354&w=847&lmt=1566245306&num_ads=1&sem=mc&pwprc=4087771549&guci=1.2.0.0.2.2.0.0&ad_type=text_image&format=847x200&url=https%3A%2F%2Fwww.malwaretech.com%2F2019%2F08%2Fdejablue-analyzing-a-rdp-heap-overflow.html&flash=0&pra=3&wgl=1&fa=27&adsid=NT&dt=1566245306645&bpp=3&bdt=807&fdt=4&idt=4&shv=r20190815&cbv=r20190131&saldr=aa&abxe=1&prev_fmts=0x0&nras=2&correlator=4110676402966&frm=20&pv=1&ga_vid=540226228.1566245306&ga_sid=1566245306&ga_hid=1747954838&ga_fc=0&iag=0&icsg=2256196384849919&dssz=42&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=223&ady=1862&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=20199336%2C21061795%2C410075105&oid=3&rx=0&eae=0&fc=1424&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=16&bc=31&osw_key=5992713&ifi=1&uci=1.56mkcsyio35q&xpc=SHKrNwOKo3&p=https%3A//www.malwaretech.com&dtd=6
Frame ID: 1A04D018306858B076C4A786DF55B05C
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3337609182489974&output=html&h=200&adk=2728076285&adf=2440601624&w=847&lmt=1566245306&num_ads=1&sem=mc&pwprc=4087771549&guci=1.2.0.0.2.2.0.0&ad_type=text_image&format=847x200&url=https%3A%2F%2Fwww.malwaretech.com%2F2019%2F08%2Fdejablue-analyzing-a-rdp-heap-overflow.html&flash=0&pra=3&wgl=1&fa=27&adsid=NT&dt=1566245306654&bpp=2&bdt=817&fdt=3&idt=3&shv=r20190815&cbv=r20190131&saldr=aa&abxe=1&prev_fmts=0x0%2C847x200&nras=3&correlator=4110676402966&frm=20&pv=1&ga_vid=540226228.1566245306&ga_sid=1566245306&ga_hid=1747954838&ga_fc=0&iag=0&icsg=2256196384849919&dssz=43&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=223&ady=2625&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=20199336%2C21061795%2C410075105&oid=3&rx=0&eae=0&fc=1424&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=16&bc=31&osw_key=5992713&ifi=2&uci=2.92svq51g1ty4&xpc=J2EzpT9v9S&p=https%3A//www.malwaretech.com&dtd=5
Frame ID: 5AFF0249EDB99E8113470F991FA3A5CA
Requests: 1 HTTP requests in this frame

Frame: https://disqus.com/embed/comments/?base=default&f=malwaretech2&t_i=2205%20https%3A%2F%2Fwww.malwaretech.com%2F%3Fp%3D2205&t_u=https%3A%2F%2Fwww.malwaretech.com%2F2019%2F08%2Fdejablue-analyzing-a-rdp-heap-overflow.html&t_e=DejaBlue%3A%20Analyzing%20a%20RDP%20Heap%20Overflow&t_d=DejaBlue%3A%20Analyzing%20a%20RDP%20Heap%20Overflow%20-%20MalwareTech&t_t=DejaBlue%3A%20Analyzing%20a%20RDP%20Heap%20Overflow&s_o=default
Frame ID: 57ADFD2791A7D5D048611E3080D2A7AB
Requests: 1 HTTP requests in this frame

Frame: https://www.youtube.com/subscribe_embed?channelid=UCLDnEn-TxejaDB8qm2AUhHQ&action_card=1&usegapi=1&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.tkLGB8oygGw.O%2Fam%3DwQE%2Fd%3D1%2Frs%3DAGLTcCOVrdiUrdoKYhlUTq9WIvZT-VXTAA%2Fm%3D__features__
Frame ID: 656E0BE852302A9B56F569E5DB22DBF5
Requests: 1 HTTP requests in this frame

Frame: https://c.disquscdn.com/next/embed/styles/realtime.af77184dec69e96e69aff958ae2bb738.css
Frame ID: 7EEB261C907CB16F6B5F4EF08FD73876
Requests: 1 HTTP requests in this frame

Frame: https://c.disquscdn.com/next/embed/styles/realtime.af77184dec69e96e69aff958ae2bb738.css
Frame ID: 6B820FAA0E460F1C8D65C548CD4D787D
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

script /\/wp-(?:content|includes)\//i
headers link /rel="https:\/\/api\.w\.org\/"/i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

script /\/wp-(?:content|includes)\//i
headers link /rel="https:\/\/api\.w\.org\/"/i

MySQL (Databases) Expand

Overall confidence: 100%
Detected patterns

script /\/wp-(?:content|includes)\//i
headers link /rel="https:\/\/api\.w\.org\/"/i

React (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

script /react.*\.js/i

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

script /googlesyndication\.com\//i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Page Statistics

98
Requests

96 %
HTTPS

81 %
IPv6

13
Domains

20
Subdomains

17
IPs

3
Countries

1177 kB
Transfer

2411 kB
Size

10
Cookies

14 Outgoing links

These are links going to different origins than the main page.

URL: https://discord.gg/4tUrsPu
Title: Discord

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html

Search URL Search Domain Scan URL

URL: http://twitter.com/home?status=https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html

Search URL Search Domain Scan URL

URL: https://plus.google.com/share?url=https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html

Search URL Search Domain Scan URL

URL: https://www.pinterest.com/pin/create/button/?url=https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html&media=&description=DejaBlue:%20Analyzing%20a%20RDP%20Heap%20Overflow

Search URL Search Domain Scan URL

URL: http://www.linkedin.com/shareArticle?mini=true&url=https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html&title=DejaBlue:%20Analyzing%20a%20RDP%20Heap%20Overflow&source=https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html

Search URL Search Domain Scan URL

URL: http://www.tumblr.com/share/link?url=https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html

Search URL Search Domain Scan URL

URL: https://twitter.com/MalwareTechBlog
Title:

Search URL Search Domain Scan URL

URL: https://youtube.com/c/MalwareTechBlog
Title:

Search URL Search Domain Scan URL

URL: https://twitch.tv/MalwareTechBlog
Title:

Search URL Search Domain Scan URL

URL: https://www.instagram.com/malwaretech/
Title:

Search URL Search Domain Scan URL

URL: https://www.facebook.com/MarcusJHutchins/
Title:

Search URL Search Domain Scan URL

URL: https://www.patreon.com/bePatron?u=8204812

Search URL Search Domain Scan URL

URL: https://demos.subinsb.com/Francium/CryptoDonate/
Title: CryptoDonate

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 60

https://www.google-analytics.com/r/collect?v=1&_v=j78&a=1747954838&t=pageview&_s=1&dl=https%3A%2F%2Fwww.malwaretech.com%2F2019%2F08%2Fdejablue-analyzing-a-rdp-heap-overflow.html&ul=en-us&de=UTF-8&dt=DejaBlue%3A%20Analyzing%20a%20RDP%20Heap%20Overflow%20-%20MalwareTech&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=IEBAAEAB~&jid=290988776&gjid=640312254&cid=540226228.1566245306&tid=UA-56814785-2&_gid=56930925.1566245306&_r=1&z=562159133 HTTP 302
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-56814785-2&cid=540226228.1566245306&jid=290988776&_gid=56930925.1566245306&gjid=640312254&_v=j78&z=562159133

98 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request dejablue-analyzing-a-rdp-heap-overflow.html Show response
www.malwaretech.com/2019/08/ 68 KB
14 KB 73ms
44ms Document
text/html 2606:4700:10::6814:5037
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6814:5037 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 21e5084203bd04a0ff2744dade5fd99ee7fb61071d3d1de9b252f6298ab677b9

Request headers

:method: GET
:authority: www.malwaretech.com
:scheme: https
:path: /2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode: navigate
sec-fetch-user: ?1
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: none
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1

Response headers

status: 200
date: Mon, 19 Aug 2019 20:08:25 GMT
content-type: text/html; charset=UTF-8
set-cookie: __cfduid=d72fbdec7655664a6b236487703be4fee1566245305; expires=Tue, 18-Aug-20 20:08:25 GMT; path=/; domain=.malwaretech.com; HttpOnly; Secure
link: <https://www.malwaretech.com/wp-json/>; rel="https://api.w.org/" <https://www.malwaretech.com/?p=2205>; rel=shortlink
cf-cache-status: HIT
age: 6108
expires: Mon, 19 Aug 2019 22:08:25 GMT
cache-control: public, max-age=7200
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
server: cloudflare
cf-ray: 508ec2693803971e-FRA
content-encoding: gzip

GET
H2 200 n9TF-6GWbkpYTiDSgDnrjC9AIZM.js Show response
www.malwaretech.com/cdn-cgi/apps/head/ 6 KB
2 KB 19ms
16ms Script
application/javascript 2606:4700:10::6814:5037
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://www.malwaretech.com/cdn-cgi/apps/head/n9TF-6GWbkpYTiDSgDnrjC9AIZM.js
Requested by: Host: www.malwaretech.com
URL: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6814:5037 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3685d730d5d09bf4ccf8f33281ed51d4935f4a8ab3d43a61f6aac8aeacbb32b0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 19 Aug 2019 20:08:25 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 13247
cf-ray: 508ec2698894971e-FRA
status: 200
content-length: 2027
x-amz-id-2: S0adt44KEa+AvH62uu7EpdqMj4TMKwxxw+bFww0LTHmtYNpN7lTNckSR4BjhYERNOPeR63HGxg0=
last-modified: Mon, 24 Jul 2017 18:55:19 GMT
server: cloudflare
etag: "c4bd684d33313ebe7a7cf71f089b92a8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-request-id: 8BD8ECD058BEC03B
cache-control: public, max-age=31536000
x-amz-version-id: j1YSFYax2pcSNYJDFUkV6sMPxa3w4gKF
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
expires: Tue, 18 Aug 2020 20:08:25 GMT

GET
H2 200 crayon.min.css
www.malwaretech.com/wp-content/plugins/crayon-syntax-highlighter/css/min/ 20 KB
4 KB 32ms
29ms Stylesheet
text/css 2606:4700:10::6814:5037
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://www.malwaretech.com/wp-content/plugins/crayon-syntax-highlighter/css/min/crayon.min.css?ver=_2.7.2_beta
Requested by: Host: www.malwaretech.com
URL: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6814:5037 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3d961493e244e06bf91a9857442891e2e2ad8d49cf8e0a7781c53f0707443d7

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 19 Aug 2019 20:08:25 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Wed, 25 Jul 2018 16:19:00 GMT
server: cloudflare
age: 5975
etag: W/"5b58a2f4-4ecc"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: public, max-age=7200
cf-ray: 508ec269888f971e-FRA
expires: Mon, 19 Aug 2019 22:08:25 GMT

GET
H2 200 style.min.css
www.malwaretech.com/wp-includes/css/dist/block-library/ 29 KB
5 KB 22ms
18ms Stylesheet
text/css 2606:4700:10::6814:5037
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://www.malwaretech.com/wp-includes/css/dist/block-library/style.min.css?ver=5.2.2
Requested by: Host: www.malwaretech.com
URL: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6814:5037 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4b8fe5c3d0e5ef7a6582185cbf5c535b5d369c8df1da98c03ed69833e55f474d

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 19 Aug 2019 20:08:25 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Wed, 08 May 2019 21:48:16 GMT
server: cloudflare
age: 5975
etag: W/"5cd34ea0-726f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: public, max-age=7200
cf-ray: 508ec2698891971e-FRA
expires: Mon, 19 Aug 2019 22:08:25 GMT

GET
H2 200 styles.css
www.malwaretech.com/wp-content/plugins/contact-form-7/includes/css/ 1 KB
716 B 23ms
20ms Stylesheet
text/css 2606:4700:10::6814:5037
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://www.malwaretech.com/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.1.3
Requested by: Host: www.malwaretech.com
URL: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6814:5037 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 382fe3dd880202e9e2971b7ae531720bc1bf2bb68decbc507d04e64b62531f44

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 19 Aug 2019 20:08:25 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 5975
cf-polished: origSize=1685
status: 200
last-modified: Thu, 30 May 2019 17:05:03 GMT
cf-bgj: minify
server: cloudflare
etag: W/"5cf00d3f-695"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=7200
cf-ray: 508ec2698892971e-FRA
expires: Mon, 19 Aug 2019 22:08:25 GMT

GET
H2 200 font-awesome.min.css
www.malwaretech.com/wp-content/themes/imnewspro/css/ 30 KB
7 KB 37ms
34ms Stylesheet
text/css 2606:4700:10::6814:5037
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://www.malwaretech.com/wp-content/themes/imnewspro/css/font-awesome.min.css?ver=4.7.0
Requested by: Host: www.malwaretech.com
URL: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6814:5037 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 19 Aug 2019 20:08:25 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Wed, 25 Jul 2018 16:22:42 GMT
server: cloudflare
age: 5975
etag: W/"5b58a3d2-7918"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: public, max-age=7200
cf-ray: 508ec2698893971e-FRA
expires: Mon, 19 Aug 2019 22:08:25 GMT

GET
H2 200 animate.css
www.malwaretech.com/wp-content/themes/imnewspro/css/ 55 KB
4 KB 23ms
20ms Stylesheet
text/css 2606:4700:10::6814:5037
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://www.malwaretech.com/wp-content/themes/imnewspro/css/animate.css?ver=5.2.2
Requested by: Host: www.malwaretech.com
URL: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6814:5037 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 06d5a77f098b6b2451dfa88134800ca4c98d3262f92ed3c6e1dac1fb89ff5a8f

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 19 Aug 2019 20:08:25 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 5975
cf-polished: origSize=79159
status: 200
last-modified: Wed, 25 Jul 2018 16:22:42 GMT
cf-bgj: minify
server: cloudflare
etag: W/"5b58a3d2-13537"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=7200
cf-ray: 508ec2698895971e-FRA
expires: Mon, 19 Aug 2019 22:08:25 GMT

GET
H2 200 stellarnav.css
www.malwaretech.com/wp-content/themes/imnewspro/css/ 5 KB
1 KB 28ms
25ms Stylesheet
text/css 2606:4700:10::6814:5037
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://www.malwaretech.com/wp-content/themes/imnewspro/css/stellarnav.css?ver=1.1
Requested by: Host: www.malwaretech.com
URL: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6814:5037 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4b4810564b571191a09dd7dcaf40d08b02f51cdbbd6f97227a08f417cb7e09e4

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 19 Aug 2019 20:08:25 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 5975
cf-polished: origSize=5722
status: 200
last-modified: Wed, 25 Jul 2018 16:22:42 GMT
cf-bgj: minify
server: cloudflare
etag: W/"5b58a3d2-165a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=7200
cf-ray: 508ec2698896971e-FRA
expires: Mon, 19 Aug 2019 22:08:25 GMT

GET
H2 200 owl.carousel.min.css
www.malwaretech.com/wp-content/themes/imnewspro/css/ 3 KB
974 B 37ms
34ms Stylesheet
text/css 2606:4700:10::6814:5037
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://www.malwaretech.com/wp-content/themes/imnewspro/css/owl.carousel.min.css?ver=2.2.1
Requested by: Host: www.malwaretech.com
URL: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6814:5037 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 016ab0bd0de4839680e4a717a57db9b182a8c2c5fdeec4c24db7a8df761fca4d

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 19 Aug 2019 20:08:25 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Wed, 25 Jul 2018 16:22:42 GMT
server: cloudflare
age: 5975
etag: W/"5b58a3d2-b78"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: public, max-age=7200
cf-ray: 508ec2698897971e-FRA
expires: Mon, 19 Aug 2019 22:08:25 GMT

GET
H2 200 bootstrap.min.css
www.malwaretech.com/wp-content/themes/imnewspro/css/ 118 KB
19 KB 30ms
27ms Stylesheet
text/css 2606:4700:10::6814:5037
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://www.malwaretech.com/wp-content/themes/imnewspro/css/bootstrap.min.css?ver=3.3.7
Requested by: Host: www.malwaretech.com
URL: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6814:5037 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 81fb74b605de7c59fe465ea0b15dbf963e5d7fa719834ae6e96240848d7dd9f8

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 19 Aug 2019 20:08:25 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Wed, 25 Jul 2018 16:22:42 GMT
server: cloudflare
age: 5975
etag: W/"5b58a3d2-1d959"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: public, max-age=7200
cf-ray: 508ec2698899971e-FRA
expires: Mon, 19 Aug 2019 22:08:25 GMT

GET
H2 200 owl.theme.css
www.malwaretech.com/wp-content/themes/imnewspro/css/ 1 KB
491 B 27ms
24ms Stylesheet
text/css 2606:4700:10::6814:5037
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://www.malwaretech.com/wp-content/themes/imnewspro/css/owl.theme.css?ver=1.3.3
Requested by: Host: www.malwaretech.com
URL: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6814:5037 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 412752ed1c97f0aef8acf02f8ced68186ecdf81b8182f11c981b1e3436748c52

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 19 Aug 2019 20:08:25 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 5975
cf-polished: origSize=1665
status: 200
last-modified: Wed, 25 Jul 2018 16:22:42 GMT
cf-bgj: minify
server: cloudflare
etag: W/"5b58a3d2-681"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=7200
cf-ray: 508ec269889a971e-FRA
expires: Mon, 19 Aug 2019 22:08:25 GMT

GET
H2 200 jquery.simplyscroll.css
www.malwaretech.com/wp-content/themes/imnewspro/css/ 3 KB
747 B 19ms
17ms Stylesheet
text/css 2606:4700:10::6814:5037
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://www.malwaretech.com/wp-content/themes/imnewspro/css/jquery.simplyscroll.css?ver=5.2.2
Requested by: Host: www.malwaretech.com
URL: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6814:5037 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 965e4348118ecf7960a924654b0a7572056dc55fb4f03f8c143f8d6b7d38f0d1

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 19 Aug 2019 20:08:25 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 5974
cf-polished: origSize=4971
status: 200
last-modified: Wed, 25 Jul 2018 16:22:42 GMT
cf-bgj: minify
server: cloudflare
etag: W/"5b58a3d2-136b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=7200
cf-ray: 508ec269889b971e-FRA
expires: Mon, 19 Aug 2019 22:08:25 GMT

GET
H2 200 default.css
www.malwaretech.com/wp-content/themes/imnewspro/css/ 31 KB
7 KB 22ms
19ms Stylesheet
text/css 2606:4700:10::6814:5037
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://www.malwaretech.com/wp-content/themes/imnewspro/css/default.css?ver=5.2.2
Requested by: Host: www.malwaretech.com
URL: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6814:5037 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: b62a40906eeaa1e1d6c1d220801a6ff2ee420d94193d768d65f43a7aa5c840f1

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 19 Aug 2019 20:08:25 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 5975
cf-polished: origSize=43557
status: 200
last-modified: Thu, 04 Jul 2019 16:26:34 GMT
cf-bgj: minify
server: cloudflare
etag: W/"5d1e28ba-aa25"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=7200
cf-ray: 508ec269889c971e-FRA
expires: Mon, 19 Aug 2019 22:08:25 GMT

GET
H2 200 style.css
www.malwaretech.com/wp-content/themes/imnewspro/ 0
91 B 23ms
20ms Stylesheet
text/css 2606:4700:10::6814:5037
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://www.malwaretech.com/wp-content/themes/imnewspro/style.css?ver=5.2.2
Requested by: Host: www.malwaretech.com
URL: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6814:5037 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 19 Aug 2019 20:08:25 GMT
cf-cache-status: HIT
age: 5975
cf-polished: origSize=724
status: 200
last-modified: Wed, 25 Jul 2018 16:22:38 GMT
content-length: 0
cf-bgj: minify
server: cloudflare
etag: "5b58a3ce-2d4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=7200
accept-ranges: bytes
cf-ray: 508ec269889d971e-FRA
expires: Mon, 19 Aug 2019 22:08:25 GMT

GET
H2 200 jquery.js Show response
www.malwaretech.com/wp-includes/js/jquery/ 95 KB
33 KB 45ms
42ms Script
application/javascript 2606:4700:10::6814:5037
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://www.malwaretech.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Requested by: Host: www.malwaretech.com
URL: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6814:5037 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8c7ee0238fa5cd80a02ef9870a7fff498ef52097181cb73edb9219dc022fd919

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 19 Aug 2019 20:08:25 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 5975
cf-polished: origSize=96873
status: 200
last-modified: Tue, 21 May 2019 20:16:51 GMT
cf-bgj: minify
server: cloudflare
etag: W/"5ce45cb3-17a69"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=7200
cf-ray: 508ec269889e971e-FRA
expires: Mon, 19 Aug 2019 22:08:25 GMT

GET
H2 200 jquery-migrate.min.js Show response
www.malwaretech.com/wp-includes/js/jquery/ 10 KB
4 KB 28ms
25ms Script
application/javascript 2606:4700:10::6814:5037
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://www.malwaretech.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1
Requested by: Host: www.malwaretech.com
URL: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6814:5037 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 19 Aug 2019 20:08:25 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Wed, 25 Jul 2018 16:11:20 GMT
server: cloudflare
age: 5975
etag: W/"5b58a128-2748"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=7200
cf-ray: 508ec269889f971e-FRA
expires: Mon, 19 Aug 2019 22:08:25 GMT

GET
H2 200 crayon.min.js Show response
www.malwaretech.com/wp-content/plugins/crayon-syntax-highlighter/js/min/ 22 KB
7 KB 29ms
27ms Script
application/javascript 2606:4700:10::6814:5037
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://www.malwaretech.com/wp-content/plugins/crayon-syntax-highlighter/js/min/crayon.min.js?ver=_2.7.2_beta
Requested by: Host: www.malwaretech.com
URL: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6814:5037 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 193fbb968733b8a7049da19274546e6b80b76e9a8f1b837fee9a5fdeb8f97c7b

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 19 Aug 2019 20:08:25 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Wed, 25 Jul 2018 16:18:56 GMT
server: cloudflare
age: 5975
etag: W/"5b58a2f0-5741"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=7200
cf-ray: 508ec26988a0971e-FRA
expires: Mon, 19 Aug 2019 22:08:25 GMT

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 93 KB
35 KB 46ms
23ms Script
text/javascript 2a00:1450:4001:808::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: www.malwaretech.com
URL: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

3c2f2fa12fc82afd7546cb3388373e6db70f2efbbf10bea80cc0022a59097739

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 19 Aug 2019 20:08:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length: 34876
x-xss-protection: 0
server: cafe
etag: 10579382991258129178
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Mon, 19 Aug 2019 20:08:25 GMT

GET
H2 200 BinDiff.png
www.malwaretech.com/wp-content/uploads/2019/08/ 150 KB
151 KB 32ms
31ms Image
image/png 2606:4700:10::6814:5037
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.malwaretech.com/wp-content/uploads/2019/08/BinDiff.png
Requested by: Host: www.malwaretech.com
URL: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6814:5037 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 78c93f86b272e0ecf91d3d971d84b849cb5b3db353b5abba05e9dde267b71e25

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 19 Aug 2019 20:08:25 GMT
cf-cache-status: HIT
last-modified: Mon, 19 Aug 2019 07:32:57 GMT
server: cloudflare
age: 5975
etag: "5d5a50a9-259bd"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
cache-control: public, max-age=7200
accept-ranges: bytes
cf-ray: 508ec26988a1971e-FRA
content-length: 154045
expires: Mon, 19 Aug 2019 22:08:25 GMT

GET
H2 200 CodeComparison.png
www.malwaretech.com/wp-content/uploads/2019/08/ 18 KB
18 KB 27ms
22ms Image
image/png 2606:4700:10::6814:5037
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.malwaretech.com/wp-content/uploads/2019/08/CodeComparison.png
Requested by: Host: www.malwaretech.com
URL: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6814:5037 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: f2ef04d3356690d40fc7096a1801e1dd005397cfb882270c7aa290a4574d94f4

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 19 Aug 2019 20:08:25 GMT
cf-cache-status: HIT
last-modified: Mon, 19 Aug 2019 07:36:30 GMT
server: cloudflare
age: 5972
etag: "5d5a517e-46c2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
cache-control: public, max-age=7200
accept-ranges: bytes
cf-ray: 508ec26a1967971e-FRA
content-length: 18114
expires: Mon, 19 Aug 2019 22:08:25 GMT

GET
H2 200 SendDvcData.png
www.malwaretech.com/wp-content/uploads/2019/08/ 7 KB
7 KB 37ms
32ms Image
image/png 2606:4700:10::6814:5037
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.malwaretech.com/wp-content/uploads/2019/08/SendDvcData.png
Requested by: Host: www.malwaretech.com
URL: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6814:5037 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 89e96008193966d58394c0b2f5f26a35253c62b2e570e5798fda2f2e1ed730ae

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 19 Aug 2019 20:08:25 GMT
cf-cache-status: HIT
last-modified: Mon, 19 Aug 2019 14:52:12 GMT
server: cloudflare
age: 5972
etag: "5d5ab79c-1c51"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
cache-control: public, max-age=7200
accept-ranges: bytes
cf-ray: 508ec26a1968971e-FRA
content-length: 7249
expires: Mon, 19 Aug 2019 22:08:25 GMT

GET
H2 200 DecompressBreakpoint.png
www.malwaretech.com/wp-content/uploads/2019/08/ 9 KB
9 KB 22ms
17ms Image
image/png 2606:4700:10::6814:5037
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.malwaretech.com/wp-content/uploads/2019/08/DecompressBreakpoint.png
Requested by: Host: www.malwaretech.com
URL: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6814:5037 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: c38b8d4ff32e4a904d092790c6bf9b6a9d49b93965cdf0bdd1b3067223019bef

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 19 Aug 2019 20:08:25 GMT
cf-cache-status: HIT
last-modified: Mon, 19 Aug 2019 08:30:24 GMT
server: cloudflare
age: 5972
etag: "5d5a5e20-2252"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
cache-control: public, max-age=7200
accept-ranges: bytes
cf-ray: 508ec26a196a971e-FRA
content-length: 8786
expires: Mon, 19 Aug 2019 22:08:25 GMT

GET
H2 200 DecompressFunction-1.png
www.malwaretech.com/wp-content/uploads/2019/08/ 36 KB
36 KB 32ms
28ms Image
image/png 2606:4700:10::6814:5037
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.malwaretech.com/wp-content/uploads/2019/08/DecompressFunction-1.png
Requested by: Host: www.malwaretech.com
URL: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6814:5037 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 010a4854f11c4738089abe0567654439f605bec8305246d3ac634c1c97325a86

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 19 Aug 2019 20:08:25 GMT
cf-cache-status: HIT
last-modified: Mon, 19 Aug 2019 09:00:42 GMT
server: cloudflare
age: 5972
etag: "5d5a653a-9063"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
cache-control: public, max-age=7200
accept-ranges: bytes
cf-ray: 508ec26a196b971e-FRA
content-length: 36963
expires: Mon, 19 Aug 2019 22:08:25 GMT

GET
H2 200 SendDvcCrash.png
www.malwaretech.com/wp-content/uploads/2019/08/ 4 KB
4 KB 34ms
29ms Image
image/png 2606:4700:10::6814:5037
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.malwaretech.com/wp-content/uploads/2019/08/SendDvcCrash.png
Requested by: Host: www.malwaretech.com
URL: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6814:5037 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: f23a3dff942b95a36089b6dc564b77f155b6d2e2ad90b7f9ed825b8ca1556fdf

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 19 Aug 2019 20:08:25 GMT
cf-cache-status: HIT
last-modified: Mon, 19 Aug 2019 16:11:16 GMT
server: cloudflare
age: 5972
etag: "5d5aca24-1119"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
cache-control: public, max-age=7200
accept-ranges: bytes
cf-ray: 508ec26a196c971e-FRA
content-length: 4377
expires: Mon, 19 Aug 2019 22:08:25 GMT

GET
H2 200 VTableCall.png
www.malwaretech.com/wp-content/uploads/2019/08/ 4 KB
4 KB 21ms
17ms Image
image/png 2606:4700:10::6814:5037
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.malwaretech.com/wp-content/uploads/2019/08/VTableCall.png
Requested by: Host: www.malwaretech.com
URL: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6814:5037 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: b48c53daf18dc285b68ff15daa58d93daee9272cbcdf80775ba4c092a9d45d48

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 19 Aug 2019 20:08:25 GMT
cf-cache-status: HIT
last-modified: Mon, 19 Aug 2019 15:20:05 GMT
server: cloudflare
age: 5972
etag: "5d5abe25-f87"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
cache-control: public, max-age=7200
accept-ranges: bytes
cf-ray: 508ec26a196e971e-FRA
content-length: 3975
expires: Mon, 19 Aug 2019 22:08:25 GMT

GET
H2 200 Bugcheck.png
www.malwaretech.com/wp-content/uploads/2019/05/ 36 KB
36 KB 24ms
20ms Image
image/png 2606:4700:10::6814:5037
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.malwaretech.com/wp-content/uploads/2019/05/Bugcheck.png
Requested by: Host: www.malwaretech.com
URL: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6814:5037 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3516cb5a0b1574cd3677a224061d2ef16d87babc5480847a92fb213880706b7a

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 19 Aug 2019 20:08:25 GMT
cf-cache-status: HIT
last-modified: Fri, 31 May 2019 20:23:28 GMT
server: cloudflare
age: 5972
etag: "5cf18d40-8e42"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
cache-control: public, max-age=7200
accept-ranges: bytes
cf-ray: 508ec26a196f971e-FRA
content-length: 36418
expires: Mon, 19 Aug 2019 22:08:25 GMT

GET
H2 200 internet_explorer_crash.png
www.malwaretech.com/wp-content/uploads/2019/04/ 39 KB
39 KB 23ms
19ms Image
image/png 2606:4700:10::6814:5037
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.malwaretech.com/wp-content/uploads/2019/04/internet_explorer_crash.png
Requested by: Host: www.malwaretech.com
URL: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6814:5037 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: c588b393ad9aa361b184c08aeaea3fbb5b1bad5cf11d737c63ebddaf69f13322

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 19 Aug 2019 20:08:25 GMT
cf-cache-status: HIT
last-modified: Wed, 03 Apr 2019 00:19:43 GMT
server: cloudflare
age: 5972
etag: "5ca3fc1f-9d45"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
cache-control: public, max-age=7200
accept-ranges: bytes
cf-ray: 508ec26a1970971e-FRA
content-length: 40261
expires: Mon, 19 Aug 2019 22:08:25 GMT

GET
H2 200 matched_functions.png
www.malwaretech.com/wp-content/uploads/2019/02/ 121 KB
121 KB 27ms
22ms Image
image/png 2606:4700:10::6814:5037
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.malwaretech.com/wp-content/uploads/2019/02/matched_functions.png
Requested by: Host: www.malwaretech.com
URL: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6814:5037 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 12ec6c4742fa7dd777d77f2d3e64a8c0e5164aaec454fc247ff01aa2f0fdb8af

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 19 Aug 2019 20:08:25 GMT
cf-cache-status: HIT
last-modified: Tue, 26 Feb 2019 22:02:25 GMT
server: cloudflare
age: 5972
etag: "5c75b771-1e38d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
cache-control: public, max-age=7200
accept-ranges: bytes
cf-ray: 508ec26a1971971e-FRA
content-length: 123789
expires: Mon, 19 Aug 2019 22:08:25 GMT

GET
H2 200 platform.js Show response
apis.google.com/js/ 43 KB
17 KB 46ms
25ms Script
application/javascript 2a00:1450:4001:808::200e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/js/platform.js

Requested by

Host: www.malwaretech.com
URL: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

7e1a6b135745c61308f5cd57dbd23562f34361f94c8eb49ebc034b03449f029b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 19 Aug 2019 20:08:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: script-src 'report-sample' 'nonce-xQsWVGrove6Q+B6jRb9y9g' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
x-xss-protection: 0
x-ua-compatible: IE=edge, chrome=1
server: ESF
x-frame-options: SAMEORIGIN
etag: "703b5ef6bed3c2f7eee6f77fb3251396"
strict-transport-security: max-age=31536000
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=1800, stale-while-revalidate=1800
timing-allow-origin: *
expires: Mon, 19 Aug 2019 20:08:25 GMT

GET
H2 200 twitter.png
www.malwaretech.com/wp-content/themes/mt/includes/images/ 3 KB
3 KB 33ms
28ms Image
image/png 2606:4700:10::6814:5037
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.malwaretech.com/wp-content/themes/mt/includes/images/twitter.png
Requested by: Host: www.malwaretech.com
URL: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6814:5037 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3a3409c07f69b58691261f7706f3c7f7aab5875fcb27f6314d306631722c90aa

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 19 Aug 2019 20:08:25 GMT
cf-cache-status: HIT
last-modified: Wed, 25 Jul 2018 16:22:36 GMT
server: cloudflare
age: 5972
etag: "5b58a3cc-c3e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
cache-control: public, max-age=7200
accept-ranges: bytes
cf-ray: 508ec26a1972971e-FRA
content-length: 3134
expires: Mon, 19 Aug 2019 22:08:25 GMT

GET
H2 200 youtube.png
www.malwaretech.com/wp-content/themes/mt/includes/images/ 4 KB
4 KB 34ms
30ms Image
image/png 2606:4700:10::6814:5037
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.malwaretech.com/wp-content/themes/mt/includes/images/youtube.png
Requested by: Host: www.malwaretech.com
URL: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6814:5037 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 57a9f18341bdc109eb19087061ed0c36563cd726fdd2cfe82becabe62c3e8bb9

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 19 Aug 2019 20:08:25 GMT
cf-cache-status: HIT
last-modified: Wed, 25 Jul 2018 16:22:36 GMT
server: cloudflare
age: 5972
etag: "5b58a3cc-e94"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
cache-control: public, max-age=7200
accept-ranges: bytes
cf-ray: 508ec26a1974971e-FRA
content-length: 3732
expires: Mon, 19 Aug 2019 22:08:25 GMT

GET
H2 200 twitch.png
www.malwaretech.com/wp-content/themes/mt/includes/images/ 1 KB
2 KB 34ms
30ms Image
image/png 2606:4700:10::6814:5037
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.malwaretech.com/wp-content/themes/mt/includes/images/twitch.png
Requested by: Host: www.malwaretech.com
URL: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6814:5037 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6772c7abf5a3cc7794b7eedc385be0f2a64ff5bf358ab0ca85c846e7d8998f40

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 19 Aug 2019 20:08:25 GMT
cf-cache-status: HIT
last-modified: Wed, 25 Jul 2018 16:22:36 GMT
server: cloudflare
age: 5972
etag: "5b58a3cc-5cd"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
cache-control: public, max-age=7200
accept-ranges: bytes
cf-ray: 508ec26a1975971e-FRA
content-length: 1485
expires: Mon, 19 Aug 2019 22:08:25 GMT

GET
H2 200 discord.png
www.malwaretech.com/wp-content/themes/mt/includes/images/ 2 KB
2 KB 26ms
22ms Image
image/png 2606:4700:10::6814:5037
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.malwaretech.com/wp-content/themes/mt/includes/images/discord.png
Requested by: Host: www.malwaretech.com
URL: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6814:5037 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 710636751a9f8b74353c03e68f515926978f48c6cbda1242842608071a750b8c

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 19 Aug 2019 20:08:25 GMT
cf-cache-status: HIT
last-modified: Sun, 04 Aug 2019 21:03:28 GMT
server: cloudflare
age: 5972
etag: "5d474820-80a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
cache-control: public, max-age=7200
accept-ranges: bytes
cf-ray: 508ec26a1977971e-FRA
content-length: 2058
expires: Mon, 19 Aug 2019 22:08:25 GMT

GET
H2 200 instagram2.png
www.malwaretech.com/wp-content/themes/mt/includes/images/ 3 KB
3 KB 29ms
25ms Image
image/png 2606:4700:10::6814:5037
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.malwaretech.com/wp-content/themes/mt/includes/images/instagram2.png
Requested by: Host: www.malwaretech.com
URL: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6814:5037 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: e34a6af51bb4d4f14eb8a61a56affc7708eae7aea45cca6a70e36dd118793b70

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 19 Aug 2019 20:08:25 GMT
cf-cache-status: HIT
last-modified: Sun, 04 Aug 2019 21:31:44 GMT
server: cloudflare
age: 5972
etag: "5d474ec0-a50"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
cache-control: public, max-age=7200
accept-ranges: bytes
cf-ray: 508ec26a1979971e-FRA
content-length: 2640
expires: Mon, 19 Aug 2019 22:08:25 GMT

GET
H2 200 facebook.png
www.malwaretech.com/wp-content/themes/mt/includes/images/ 3 KB
3 KB 32ms
29ms Image
image/png 2606:4700:10::6814:5037
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.malwaretech.com/wp-content/themes/mt/includes/images/facebook.png
Requested by: Host: www.malwaretech.com
URL: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6814:5037 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: ef0a5361093f5bb5f4f4343248b6d37490bc26f6dd125430998cce5e9082a0c2

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 19 Aug 2019 20:08:25 GMT
cf-cache-status: HIT
last-modified: Wed, 25 Jul 2018 16:22:38 GMT
server: cloudflare
age: 5972
etag: "5b58a3ce-a65"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
cache-control: public, max-age=7200
accept-ranges: bytes
cf-ray: 508ec26a197a971e-FRA
content-length: 2661
expires: Mon, 19 Aug 2019 22:08:25 GMT

GET
H2 200 rss.png
www.malwaretech.com/wp-content/themes/mt/includes/images/ 3 KB
3 KB 39ms
35ms Image
image/png 2606:4700:10::6814:5037
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.malwaretech.com/wp-content/themes/mt/includes/images/rss.png
Requested by: Host: www.malwaretech.com
URL: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6814:5037 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: ab4529baacdbbc2917b158b1ec42ef35bf04d2ef0b5a1236a74561d4364e62c4

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 19 Aug 2019 20:08:25 GMT
cf-cache-status: HIT
last-modified: Wed, 25 Jul 2018 16:22:36 GMT
server: cloudflare
age: 5972
etag: "5b58a3cc-d9b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
cache-control: public, max-age=7200
accept-ranges: bytes
cf-ray: 508ec26a197c971e-FRA
content-length: 3483
expires: Mon, 19 Aug 2019 22:08:25 GMT

GET
H2 200 become_a_patron_button.png
www.malwaretech.com/wp-content/themes/mt/includes/images/ 3 KB
3 KB 28ms
25ms Image
image/png 2606:4700:10::6814:5037
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.malwaretech.com/wp-content/themes/mt/includes/images/become_a_patron_button.png
Requested by: Host: www.malwaretech.com
URL: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6814:5037 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: adedb4d78780884e3d7848c921f4c9bf2511c4bae25bb4cbc466c7d4d96a4884

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 19 Aug 2019 20:08:25 GMT
cf-cache-status: HIT
last-modified: Wed, 25 Jul 2018 16:22:36 GMT
server: cloudflare
age: 5972
etag: "5b58a3cc-c0e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
cache-control: public, max-age=7200
accept-ranges: bytes
cf-ray: 508ec26a197d971e-FRA
content-length: 3086
expires: Mon, 19 Aug 2019 22:08:25 GMT

GET
H2 200 scripts.js Show response
www.malwaretech.com/wp-content/plugins/contact-form-7/includes/js/ 11 KB
3 KB 18ms
17ms Script
application/javascript 2606:4700:10::6814:5037
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://www.malwaretech.com/wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=5.1.3
Requested by: Host: www.malwaretech.com
URL: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6814:5037 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 32d9329d48ccd5a058fc1f4a6be8b010c4c9afb03d046ffe8a211ce474db2b6a

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 19 Aug 2019 20:08:25 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 5973
cf-polished: origSize=14440
status: 200
last-modified: Thu, 30 May 2019 17:05:03 GMT
cf-bgj: minify
server: cloudflare
etag: W/"5cf00d3f-3868"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=7200
cf-ray: 508ec269d915971e-FRA
expires: Mon, 19 Aug 2019 22:08:25 GMT

GET
H2 200 comment_count.js Show response
www.malwaretech.com/wp-content/plugins/disqus-comment-system/public/js/ 708 B
511 B 18ms
18ms Script
application/javascript 2606:4700:10::6814:5037
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://www.malwaretech.com/wp-content/plugins/disqus-comment-system/public/js/comment_count.js?ver=3.0.17
Requested by: Host: www.malwaretech.com
URL: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6814:5037 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: b385fd0614f2927f0e7fdc03ccdb2428e3a93de0c7fe467149b34213cc32c0f6

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 19 Aug 2019 20:08:25 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 5973
cf-polished: origSize=889
status: 200
last-modified: Mon, 04 Mar 2019 22:45:18 GMT
cf-bgj: minify
server: cloudflare
etag: W/"5c7daa7e-379"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=7200
cf-ray: 508ec269f938971e-FRA
expires: Mon, 19 Aug 2019 22:08:25 GMT

GET
H2 200 comment_embed.js Show response
www.malwaretech.com/wp-content/plugins/disqus-comment-system/public/js/ 828 B
627 B 230ms
225ms Script
application/javascript 2606:4700:10::6814:5037
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://www.malwaretech.com/wp-content/plugins/disqus-comment-system/public/js/comment_embed.js?ver=3.0.17
Requested by: Host: www.malwaretech.com
URL: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6814:5037 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: e7f5a831ead8920451598097754bb1d4fbf16fff1fd90794b950724867345794

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 19 Aug 2019 20:08:26 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 5973
cf-polished: origSize=1150
status: 200
last-modified: Mon, 04 Mar 2019 22:45:18 GMT
cf-bgj: minify
server: cloudflare
etag: W/"5c7daa7e-47e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=7200
cf-ray: 508ec26a195b971e-FRA
expires: Mon, 19 Aug 2019 22:08:26 GMT

GET
H2 200 comment-reply.min.js Show response
www.malwaretech.com/wp-includes/js/ 2 KB
1 KB 38ms
32ms Script
application/javascript 2606:4700:10::6814:5037
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://www.malwaretech.com/wp-includes/js/comment-reply.min.js?ver=5.2.2
Requested by: Host: www.malwaretech.com
URL: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6814:5037 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 31cb76c05cbf5d71466f93078e8ba0f6e39cd92d0acc86d385b8cf2899963695

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 19 Aug 2019 20:08:25 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Wed, 13 Mar 2019 08:28:34 GMT
server: cloudflare
age: 5972
etag: W/"5c88bf32-8ba"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=7200
cf-ray: 508ec26a195d971e-FRA
expires: Mon, 19 Aug 2019 22:08:25 GMT

GET
H2 200 bootstrap.min.js Show response
www.malwaretech.com/wp-content/themes/imnewspro/js/ 36 KB
10 KB 35ms
29ms Script
application/javascript 2606:4700:10::6814:5037
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://www.malwaretech.com/wp-content/themes/imnewspro/js/bootstrap.min.js?ver=5.2.2
Requested by: Host: www.malwaretech.com
URL: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6814:5037 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 19 Aug 2019 20:08:25 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Wed, 25 Jul 2018 16:22:42 GMT
server: cloudflare
age: 5972
etag: W/"5b58a3d2-90b5"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=7200
cf-ray: 508ec26a195e971e-FRA
expires: Mon, 19 Aug 2019 22:08:25 GMT

GET
H2 200 owl.carousel.min.js Show response
www.malwaretech.com/wp-content/themes/imnewspro/js/ 42 KB
11 KB 31ms
26ms Script
application/javascript 2606:4700:10::6814:5037
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://www.malwaretech.com/wp-content/themes/imnewspro/js/owl.carousel.min.js?ver=5.2.2
Requested by: Host: www.malwaretech.com
URL: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6814:5037 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: b394d33b2a7ec654a6b037ebfda6618341b3f897a362be624c923c2711b54a43

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 19 Aug 2019 20:08:25 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Wed, 25 Jul 2018 16:22:40 GMT
server: cloudflare
age: 5972
etag: W/"5b58a3d0-a70e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=7200
cf-ray: 508ec26a1960971e-FRA
expires: Mon, 19 Aug 2019 22:08:25 GMT

GET
H2 200 stellarnav.js Show response
www.malwaretech.com/wp-content/themes/imnewspro/js/ 2 KB
902 B 26ms
21ms Script
application/javascript 2606:4700:10::6814:5037
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://www.malwaretech.com/wp-content/themes/imnewspro/js/stellarnav.js?ver=5.2.2
Requested by: Host: www.malwaretech.com
URL: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6814:5037 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: ae088365040d1cd3d2656c8504d90719f44added660f44517b57b81c86560f1d

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 19 Aug 2019 20:08:25 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 5972
cf-polished: origSize=3468
status: 200
last-modified: Wed, 25 Jul 2018 16:22:42 GMT
cf-bgj: minify
server: cloudflare
etag: W/"5b58a3d2-d8c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=7200
cf-ray: 508ec26a1962971e-FRA
expires: Mon, 19 Aug 2019 22:08:25 GMT

GET
H2 200 jquery.simplyscroll.js Show response
www.malwaretech.com/wp-content/themes/imnewspro/js/ 8 KB
2 KB 30ms
25ms Script
application/javascript 2606:4700:10::6814:5037
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://www.malwaretech.com/wp-content/themes/imnewspro/js/jquery.simplyscroll.js?ver=5.2.2
Requested by: Host: www.malwaretech.com
URL: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6814:5037 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: e27b22c6660c123d106669f3c72e66629ea0b7f05fcedb10ba081ed9483dbb3c

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 19 Aug 2019 20:08:25 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 5972
cf-polished: origSize=12455
status: 200
last-modified: Wed, 25 Jul 2018 16:22:40 GMT
cf-bgj: minify
server: cloudflare
etag: W/"5b58a3d0-30a7"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=7200
cf-ray: 508ec26a1963971e-FRA
expires: Mon, 19 Aug 2019 22:08:25 GMT

GET
H2 200 custom.js Show response
www.malwaretech.com/wp-content/themes/imnewspro/js/ 2 KB
635 B 33ms
27ms Script
application/javascript 2606:4700:10::6814:5037
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://www.malwaretech.com/wp-content/themes/imnewspro/js/custom.js?ver=5.2.2
Requested by: Host: www.malwaretech.com
URL: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6814:5037 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1cfb51f3a30a24d0db22abf4f09eb7ca19b7773c2b97baea77233fb367046bf1

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 19 Aug 2019 20:08:25 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 5972
cf-polished: origSize=3376
status: 200
last-modified: Wed, 25 Jul 2018 16:22:40 GMT
cf-bgj: minify
server: cloudflare
etag: W/"5b58a3d0-d30"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=7200
cf-ray: 508ec26a1965971e-FRA
expires: Mon, 19 Aug 2019 22:08:25 GMT

GET
H2 200 wp-embed.min.js Show response
www.malwaretech.com/wp-includes/js/ 1 KB
857 B 20ms
15ms Script
application/javascript 2606:4700:10::6814:5037
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://www.malwaretech.com/wp-includes/js/wp-embed.min.js?ver=5.2.2
Requested by: Host: www.malwaretech.com
URL: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6814:5037 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2152557cac69e2bd7d6debef5037a9f554f9209cc305b8141b3329acb10c42b7

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 19 Aug 2019 20:08:25 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 13 Dec 2018 03:35:37 GMT
server: cloudflare
age: 5972
etag: W/"5c11d389-57b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=7200
cf-ray: 508ec26a1966971e-FRA
expires: Mon, 19 Aug 2019 22:08:25 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 43 KB
18 KB 33ms
5ms Script
text/javascript 2a00:1450:4001:80b::200e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.malwaretech.com
URL: https://www.malwaretech.com/cdn-cgi/apps/head/n9TF-6GWbkpYTiDSgDnrjC9AIZM.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

cec3748d0c3da4700300d5424aaea375b03550b0ee8b3dd38e242c4022261446

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 29 Jul 2019 21:35:27 GMT
server: Golfe2
age: 1915
date: Mon, 19 Aug 2019 19:36:30 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 17724
expires: Mon, 19 Aug 2019 21:36:30 GMT

GET
H2 200 wp-emoji-release.min.js Show response
www.malwaretech.com/wp-includes/js/ 14 KB
5 KB 34ms
31ms Script
application/javascript 2606:4700:10::6814:5037
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://www.malwaretech.com/wp-includes/js/wp-emoji-release.min.js?ver=5.2.2
Requested by: Host: www.malwaretech.com
URL: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6814:5037 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: f4799ef2939b8377cf33f07b07b6d90a4a245adbf1c6eaf47ee3b0fcefcc07fe

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 19 Aug 2019 20:08:25 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Wed, 08 May 2019 21:48:16 GMT
server: cloudflare
age: 5972
etag: W/"5cd34ea0-3610"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=7200
cf-ray: 508ec26a197e971e-FRA
expires: Mon, 19 Aug 2019 22:08:25 GMT

GET
H2 200 css
fonts.googleapis.com/ 5 KB
828 B 40ms
17ms Stylesheet
text/css 2a00:1450:4001:806::200a
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Raleway:300,400,500,600,700,800,900

Requested by

Host: www.malwaretech.com
URL: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

b201330b6a5955aacdf0559e994fbe042bab220ca32d6cfd16d4b387f659dcd3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Mon, 19 Aug 2019 20:08:25 GMT
server: ESF
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
status: 200
date: Mon, 19 Aug 2019 20:08:25 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
x-xss-protection: 0
expires: Mon, 19 Aug 2019 20:08:25 GMT

GET
H2 200 oDlgFWJ33rI
www.youtube.com/embed/ Frame 366A 0
0 170ms
141ms Document
text/html 2a00:1450:4001:809::200e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/embed/oDlgFWJ33rI?feature=oembed

Requested by

Host: www.malwaretech.com
URL: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

YouTube Frontend Proxy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.youtube.com
:scheme: https
:path: /embed/oDlgFWJ33rI?feature=oembed
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode: nested-navigate
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html

Response headers

status: 200
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
expires: Tue, 27 Apr 1971 19:44:06 EST
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=de for more info."
cache-control: no-cache
content-type: text/html; charset=utf-8
date: Mon, 19 Aug 2019 20:08:26 GMT
server: YouTube Frontend Proxy
x-xss-protection: 0
set-cookie: VISITOR_INFO1_LIVE=DelA6TlXFgE; path=/; domain=.youtube.com; expires=Sat, 15-Feb-2020 20:08:25 GMT; httponly GPS=1; path=/; domain=.youtube.com; expires=Mon, 19-Aug-2019 20:38:25 GMT PREF=f1=50000000; path=/; domain=.youtube.com; expires=Sun, 19-Apr-2020 08:01:26 GMT VISITOR_INFO1_LIVE=DelA6TlXFgE; path=/; domain=.youtube.com; expires=Sat, 15-Feb-2020 20:08:25 GMT; httponly YSC=4pQiPz6xnjA; path=/; domain=.youtube.com; httponly
alt-svc: quic=":443"; ma=2592000; v="46,43,39"

GET
H2 200 1Ptrg8zYS_SKggPNwK4vWqZPANqczVs.woff2
fonts.gstatic.com/s/raleway/v14/ 13 KB
13 KB 34ms
4ms Font
font/woff2 2a00:1450:4001:817::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/raleway/v14/1Ptrg8zYS_SKggPNwK4vWqZPANqczVs.woff2

Requested by

Host: www.malwaretech.com
URL: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

9c695acb1fb9e1a8739e6ae5621d41fc1ff3d13bbf370ea9c1fc95e879109890

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://fonts.googleapis.com/css?family=Raleway:300,400,500,600,700,800,900
Origin: https://www.malwaretech.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 12 Aug 2019 17:47:28 GMT
x-content-type-options: nosniff
last-modified: Tue, 23 Jul 2019 03:47:41 GMT
server: sffe
age: 613257
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 13564
x-xss-protection: 0
expires: Tue, 11 Aug 2020 17:47:28 GMT

GET
H2 200 1Ptug8zYS_SKggPNyC0IT4ttDfA.woff2
fonts.gstatic.com/s/raleway/v14/ 13 KB
13 KB 40ms
11ms Font
font/woff2 2a00:1450:4001:817::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/raleway/v14/1Ptug8zYS_SKggPNyC0IT4ttDfA.woff2

Requested by

Host: www.malwaretech.com
URL: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

7e347b66fb1145f780600551e06778b33ecaca5c45897ac90eb96eb4b6afd082

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://fonts.googleapis.com/css?family=Raleway:300,400,500,600,700,800,900
Origin: https://www.malwaretech.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 23 Jul 2019 03:56:28 GMT
x-content-type-options: nosniff
last-modified: Tue, 23 Jul 2019 03:48:04 GMT
server: sffe
age: 2391117
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 13428
x-xss-protection: 0
expires: Wed, 22 Jul 2020 03:56:28 GMT

GET
H2 200 1Ptrg8zYS_SKggPNwJYtWqZPANqczVs.woff2
fonts.gstatic.com/s/raleway/v14/ 13 KB
13 KB 38ms
10ms Font
font/woff2 2a00:1450:4001:817::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/raleway/v14/1Ptrg8zYS_SKggPNwJYtWqZPANqczVs.woff2

Requested by

Host: www.malwaretech.com
URL: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

5c1dde4cdc5c608da53737233f02219a7421ab6870d5d90bc0b7b294d571942c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://fonts.googleapis.com/css?family=Raleway:300,400,500,600,700,800,900
Origin: https://www.malwaretech.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 12 Aug 2019 17:28:21 GMT
x-content-type-options: nosniff
last-modified: Tue, 23 Jul 2019 03:47:42 GMT
server: sffe
age: 614404
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 13228
x-xss-protection: 0
expires: Tue, 11 Aug 2020 17:28:21 GMT

GET
H2 200 fontawesome-webfont.woff2
www.malwaretech.com/wp-content/themes/imnewspro/fonts/ 75 KB
76 KB 34ms
34ms Font
application/octet-stream 2606:4700:10::6814:5037
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://www.malwaretech.com/wp-content/themes/imnewspro/fonts/fontawesome-webfont.woff2?v=4.7.0
Requested by: Host: www.malwaretech.com
URL: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6814:5037 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.malwaretech.com/wp-content/themes/imnewspro/css/font-awesome.min.css?ver=4.7.0
Origin: https://www.malwaretech.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 19 Aug 2019 20:08:25 GMT
cf-cache-status: HIT
last-modified: Wed, 25 Jul 2018 16:22:40 GMT
server: cloudflare
age: 5971
etag: "5b58a3d0-12d68"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/octet-stream
status: 200
cache-control: public, max-age=7200
accept-ranges: bytes
cf-ray: 508ec26a1984971e-FRA
content-length: 77160
expires: Mon, 19 Aug 2019 22:08:25 GMT

GET
H2 200 1Ptrg8zYS_SKggPNwN4rWqZPANqczVs.woff2
fonts.gstatic.com/s/raleway/v14/ 13 KB
14 KB 34ms
6ms Font
font/woff2 2a00:1450:4001:817::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/raleway/v14/1Ptrg8zYS_SKggPNwN4rWqZPANqczVs.woff2

Requested by

Host: www.malwaretech.com
URL: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

046fa5c62e3b17b46ea2f8c601465dacfd5c153aee7a71754a9be582de74a385

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://fonts.googleapis.com/css?family=Raleway:300,400,500,600,700,800,900
Origin: https://www.malwaretech.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 23 Jul 2019 04:09:26 GMT
x-content-type-options: nosniff
last-modified: Tue, 23 Jul 2019 03:47:47 GMT
server: sffe
age: 2390339
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 13752
x-xss-protection: 0
expires: Wed, 22 Jul 2020 04:09:26 GMT

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 109 B
476 B 36ms
16ms Script
application/javascript 2a00:1450:4001:81b::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.malwaretech.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 19 Aug 2019 20:08:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length: 104
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 109 B
476 B 36ms
15ms Script
application/javascript 2a00:1450:4001:81b::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.malwaretech.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 19 Aug 2019 20:08:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length: 104
x-xss-protection: 0

GET
H2 200 show_ads_impl.js Show response
pagead2.googlesyndication.com/pagead/js/r20190815/r20190131/ 220 KB
81 KB 27ms
27ms Script
text/javascript 2a00:1450:4001:808::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20190815/r20190131/show_ads_impl.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ed736578b79bd4b2af62f3f546a66a5c5448e499ab1fe5e2fe35f7b164e7e511

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 19 Aug 2019 20:08:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length: 83122
x-xss-protection: 0
server: cafe
etag: 8984116047639390428
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Aug 2019 20:08:26 GMT

GET
H2 200 show_ads_impl.js Show response
pagead2.googlesyndication.com/pagead/js/r20190815/r20190131/ Frame 53BF 220 KB
81 KB 28ms
28ms Script
text/javascript 2a00:1450:4001:808::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20190815/r20190131/show_ads_impl.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ed736578b79bd4b2af62f3f546a66a5c5448e499ab1fe5e2fe35f7b164e7e511

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 19 Aug 2019 20:08:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length: 83122
x-xss-protection: 0
server: cafe
etag: 8984116047639390428
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Aug 2019 20:08:26 GMT

GET
H2 200 zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20190815/r20190131/ Frame 5277 0
0 29ms
6ms Document
text/html 2a00:1450:4001:81b::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20190815/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/html/r20190815/r20190131/zrt_lookup.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode: nested-navigate
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
vary: Accept-Encoding
date: Thu, 15 Aug 2019 14:06:01 GMT
expires: Thu, 29 Aug 2019 14:06:01 GMT
content-type: text/html; charset=UTF-8
etag: 4817175036427020965
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 7274
x-xss-protection: 0
cache-control: public, max-age=1209600
age: 367345
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"

GET
H2

200

collect
stats.g.doubleclick.net/r/
Redirect Chain

https://www.google-analytics.com/r/collect?v=1&_v=j78&a=1747954838&t=pageview&_s=1&dl=https%3A%2F%2Fwww.malwaretech.com%2F2019%2F08%2Fdejablue-analyzing-a-rdp-heap-overflow.html&ul=en-us&de=UTF-8&d...
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-56814785-2&cid=540226228.1566245306&jid=290988776&_gid=56930925.1566245306&gjid=640312254&_v=j78&z=562159133

35 B
303 B

48ms
15ms

Image
image/gif

2a00:1450:400c:c04::9a
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-56814785-2&cid=540226228.1566245306&jid=290988776&_gid=56930925.1566245306&gjid=640312254&_v=j78&z=562159133

Requested by

Host: www.malwaretech.com
URL: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c04::9a Brussels, Belgium, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Mon, 19 Aug 2019 20:08:26 GMT
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 19 Aug 2019 20:08:26 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
status: 302
location: https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-56814785-2&cid=540226228.1566245306&jid=290988776&_gid=56930925.1566245306&gjid=640312254&_v=j78&z=562159133
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 414
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 widget.js Show response
malwaretech.com/wp-content/plugins/cryptodonate/ 895 B
640 B 28ms
19ms Script
application/javascript 2606:4700:10::6814:5037
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://malwaretech.com/wp-content/plugins/cryptodonate/widget.js
Requested by: Host: www.malwaretech.com
URL: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6814:5037 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: f7a843066ece31f30d69ddf42e687855fe094150c782e7f06a96857d3efc506e

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 19 Aug 2019 20:08:26 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 5972
cf-polished: origSize=1463
status: 200
last-modified: Wed, 25 Jul 2018 16:13:20 GMT
cf-bgj: minify
server: cloudflare
etag: W/"5b58a1a0-5b7"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=7200
cf-ray: 508ec26b3af9971e-FRA
expires: Mon, 19 Aug 2019 22:08:26 GMT

GET
H2 200 ads
googleads.g.doubleclick.net/pagead/ Frame 375C 0
0 80ms
78ms Document
text/html 2a00:1450:4001:81b::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3337609182489974&output=html&adk=1812271804&adf=3025194257&lmt=1566245306&plat=1%3A32776%2C2%3A32776%2C8%3A32776%2C9%3A32776%2C16%3A8388608%2C30%3A1081344&guci=1.2.0.0.2.2.0.0&format=0x0&url=https%3A%2F%2Fwww.malwaretech.com%2F2019%2F08%2Fdejablue-analyzing-a-rdp-heap-overflow.html&ea=0&flash=0&pra=5&wgl=1&dt=1566245306020&bpp=10&bdt=183&fdt=94&idt=94&shv=r20190815&cbv=r20190131&saldr=aa&abxe=1&nras=1&correlator=4110676402966&frm=20&pv=2&ga_vid=540226228.1566245306&ga_sid=1566245306&ga_hid=1747954838&ga_fc=0&iag=0&icsg=1048227&dssz=23&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=0&ady=0&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=20199336%2C21061795%2C410075105&oid=3&rx=0&eae=2&fc=1936&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=16&bc=31&osw_key=1937533335&ifi=0&uci=0.rag6csr6yvqb&fsb=1&dtd=108

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20190815/r20190131/show_ads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-3337609182489974&output=html&adk=1812271804&adf=3025194257&lmt=1566245306&plat=1%3A32776%2C2%3A32776%2C8%3A32776%2C9%3A32776%2C16%3A8388608%2C30%3A1081344&guci=1.2.0.0.2.2.0.0&format=0x0&url=https%3A%2F%2Fwww.malwaretech.com%2F2019%2F08%2Fdejablue-analyzing-a-rdp-heap-overflow.html&ea=0&flash=0&pra=5&wgl=1&dt=1566245306020&bpp=10&bdt=183&fdt=94&idt=94&shv=r20190815&cbv=r20190131&saldr=aa&abxe=1&nras=1&correlator=4110676402966&frm=20&pv=2&ga_vid=540226228.1566245306&ga_sid=1566245306&ga_hid=1747954838&ga_fc=0&iag=0&icsg=1048227&dssz=23&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=0&ady=0&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=20199336%2C21061795%2C410075105&oid=3&rx=0&eae=2&fc=1936&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=16&bc=31&osw_key=1937533335&ifi=0&uci=0.rag6csr6yvqb&fsb=1&dtd=108
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode: nested-navigate
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Mon, 19 Aug 2019 20:08:26 GMT
server: cafe
content-length: 1063
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Mon, 19-Aug-2019 20:23:26 GMT; path=/; domain=.doubleclick.net
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
expires: Mon, 19 Aug 2019 20:08:26 GMT
cache-control: private

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 75 KB
28 KB 41ms
39ms Script
text/javascript 2a00:1450:4001:81b::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20190815/r20190131/show_ads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

0989a55075d46fb65315319f31af78fcf90a991699e17292ca403b1790533cfa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 19 Aug 2019 20:08:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1565953966135968"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length: 28317
x-xss-protection: 0
expires: Mon, 19 Aug 2019 20:08:26 GMT

GET
H/1.1 200
OK count.js Show response
malwaretech2.disqus.com/ 1 KB
2 KB 132ms
37ms Script
application/javascript 151.101.112.134
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://malwaretech2.disqus.com/count.js

Requested by

Host: www.malwaretech.com
URL: https://www.malwaretech.com/wp-content/plugins/disqus-comment-system/public/js/comment_count.js?ver=3.0.17

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.112.134 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

nginx /

Resource Hash

3487ef2baf0c08ba660a8a143cdeb8ebeec961eea04bccd7c49096b4eb26b875

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 19 Aug 2019 20:08:26 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 30 Jul 2019 19:01:35 GMT
Server: nginx
Age: 1544031
ETag: "5d40940f-5ed"
Strict-Transport-Security: max-age=300; includeSubdomains
P3P: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Cache-Control: max-age=2592000
Connection: keep-alive
Content-Type: application/javascript; charset=utf-8
Link: <https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
Content-Length: 1517
X-XSS-Protection: 1; mode=block
Expires: Sat, 31 Aug 2019 23:14:34 GMT

GET
H2 200 cryptodonate.css
malwaretech.com/wp-content/plugins/cryptodonate//css/ 2 KB
802 B 15ms
14ms Stylesheet
text/css 2606:4700:10::6814:5037
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://malwaretech.com/wp-content/plugins/cryptodonate//css/cryptodonate.css
Requested by: Host: malwaretech.com
URL: https://malwaretech.com/wp-content/plugins/cryptodonate/widget.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6814:5037 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2563f05f9585ce46cf6dc648049b0ef3e0a5f9c038c45c732b2bdbc7de8bf71f

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 19 Aug 2019 20:08:26 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 5970
cf-polished: origSize=2687
status: 200
last-modified: Wed, 25 Jul 2018 16:13:20 GMT
cf-bgj: minify
server: cloudflare
etag: W/"5b58a1a0-a7f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=7200
cf-ray: 508ec26b6b32971e-FRA
expires: Mon, 19 Aug 2019 22:08:26 GMT

GET
H2 200 cryptodonate.js Show response
malwaretech.com/wp-content/plugins/cryptodonate/ 4 KB
1 KB 18ms
18ms Script
application/javascript 2606:4700:10::6814:5037
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://malwaretech.com/wp-content/plugins/cryptodonate/cryptodonate.js
Requested by: Host: malwaretech.com
URL: https://malwaretech.com/wp-content/plugins/cryptodonate/widget.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6814:5037 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1d9a99f2605112c60740456c379042f17041e4f678f083c659874f1748fcb124

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 19 Aug 2019 20:08:26 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 5970
cf-polished: origSize=6980
status: 200
last-modified: Wed, 25 Jul 2018 16:13:20 GMT
cf-bgj: minify
server: cloudflare
etag: W/"5b58a1a0-1b44"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=7200
cf-ray: 508ec26b6b33971e-FRA
expires: Mon, 19 Aug 2019 22:08:26 GMT

GET
H/1.1 200
OK embed.js Show response
malwaretech2.disqus.com/ 64 KB
21 KB 374ms
295ms Script
application/javascript 151.101.112.134
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://malwaretech2.disqus.com/embed.js

Requested by

Host: www.malwaretech.com
URL: https://www.malwaretech.com/wp-content/plugins/disqus-comment-system/public/js/comment_embed.js?ver=3.0.17

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.112.134 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

openresty /

Resource Hash

f1ed16c584262b10a2554d4e19386eecb929ce4747aab37ae123bf2d06a3df29

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 19 Aug 2019 20:08:26 GMT
Content-Encoding: gzip
Server: openresty
Age: 0
Vary: Accept-Encoding
Connection: keep-alive
Content-Type: application/javascript; charset=utf-8
Cache-Control: private, max-age=60
X-Service: router
Strict-Transport-Security: max-age=300; includeSubdomains
Link: <https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
Content-Length: 21528

GET
H2 200 icon_ethereum.png
lab.subinsb.com/projects/francium/cryptodonate/img/ 1 KB
1 KB 70ms
19ms Image
image/png 2606:4700:30::681c:726
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://lab.subinsb.com/projects/francium/cryptodonate/img/icon_ethereum.png
Requested by: Host: www.malwaretech.com
URL: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681c:726 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 523756a966da1c8dde3cc1e0d5f4018161819dd0e94cc0f45c2845e366112dce

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-fastly-request-id: cb709e185c3bcfd975f0af3dd295f2f1938febb3
date: Mon, 19 Aug 2019 20:08:26 GMT
via: 1.1 varnish
cf-cache-status: HIT
age: 386
x-cache: MISS
status: 200
x-cache-hits: 0
content-length: 1151
x-served-by: cache-fra19130-FRA
last-modified: Thu, 25 Jul 2019 17:15:10 GMT
server: cloudflare
x-github-request-id: 6A8C:3BC0:1CDB5A:22F414:5D39E569
x-timer: S1564075371.733005,VS0,VE97
etag: "5d39e39e-47f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=691200
accept-ranges: bytes
cf-ray: 508ec26bde22d6d1-FRA
x-proxy-cache: HIT
expires: Tue, 27 Aug 2019 20:08:26 GMT

GET
H2 200 wallet.png
lab.subinsb.com/projects/francium/cryptodonate/img/ 2 KB
3 KB 84ms
32ms Image
image/png 2606:4700:30::681c:726
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://lab.subinsb.com/projects/francium/cryptodonate/img/wallet.png
Requested by: Host: www.malwaretech.com
URL: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681c:726 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 082d133f7e02e15049decb21330faf910885ab023204c60f0613bbbfea3edc1a

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-fastly-request-id: d1c4e64d0cd37d8c52e332b50f86c08f1ffaa2f4
date: Mon, 19 Aug 2019 20:08:26 GMT
via: 1.1 varnish
cf-cache-status: HIT
age: 386
x-cache: HIT
status: 200
x-cache-hits: 1
content-length: 2395
x-served-by: cache-hhn4023-HHN
last-modified: Thu, 25 Jul 2019 17:15:10 GMT
server: cloudflare
x-github-request-id: A46C:637E:682AD:8331B:5D39E3C9
x-timer: S1564075371.732845,VS0,VE0
etag: "5d39e39e-95b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=691200
accept-ranges: bytes
cf-ray: 508ec26bde2ad6d1-FRA
x-proxy-cache: MISS
expires: Tue, 27 Aug 2019 20:08:26 GMT

GET
H2 200 icon_bitcoin.png
lab.subinsb.com/projects/francium/cryptodonate/img/ 2 KB
2 KB 82ms
32ms Image
image/png 2606:4700:30::681c:726
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://lab.subinsb.com/projects/francium/cryptodonate/img/icon_bitcoin.png
Requested by: Host: www.malwaretech.com
URL: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681c:726 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 20b37ded4e153d334d44fb14ae8a9179e7b28cf7aa75951631dd4d38fdbecc6f

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-fastly-request-id: 0939b94b79ab55e9a4cf3366c432dae69432d187
date: Mon, 19 Aug 2019 20:08:26 GMT
via: 1.1 varnish
cf-cache-status: HIT
age: 386
x-cache: MISS
status: 200
x-cache-hits: 0
content-length: 1786
x-served-by: cache-fra19158-FRA
last-modified: Thu, 25 Jul 2019 17:15:10 GMT
server: cloudflare
x-github-request-id: FF04:2152:AE28F9:D9CF8B:5D39E6DD
x-timer: S1564075743.694401,VS0,VE103
etag: "5d39e39e-6fa"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=691200
accept-ranges: bytes
cf-ray: 508ec26bde25d6d1-FRA
x-proxy-cache: HIT
expires: Tue, 27 Aug 2019 20:08:26 GMT

GET
H2 200 icon_litecoin.png
lab.subinsb.com/projects/francium/cryptodonate/img/ 2 KB
2 KB 64ms
14ms Image
image/png 2606:4700:30::681c:726
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://lab.subinsb.com/projects/francium/cryptodonate/img/icon_litecoin.png
Requested by: Host: www.malwaretech.com
URL: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681c:726 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 118ef07563848a2b497c416852714497e942cb8dd15eff3fd5495d2462eaf2d3

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-fastly-request-id: f5c2238ea4a759e84eac12591f91f31f7a58d9e1
date: Mon, 19 Aug 2019 20:08:26 GMT
via: 1.1 varnish
cf-cache-status: HIT
age: 386
x-cache: MISS
status: 200
x-cache-hits: 0
content-length: 1907
x-served-by: cache-fra19135-FRA
last-modified: Thu, 25 Jul 2019 17:15:10 GMT
server: cloudflare
x-github-request-id: E3EA:5EE8:108522:142367:5D39EDC2
x-timer: S1564077507.832077,VS0,VE98
etag: "5d39e39e-773"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=691200
accept-ranges: bytes
cf-ray: 508ec26bde26d6d1-FRA
x-proxy-cache: MISS
expires: Tue, 27 Aug 2019 20:08:26 GMT

GET
H2 200 cb=gapi.loaded_0 Show response
apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.tkLGB8oygGw.O/m=ytsubscribe/rt=j/sv=1/d=1/ed=1/am=wQE/rs=AGLTcCOVrdiUrdoKYhlUTq9WIvZT-VXTAA/ 115 KB
41 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:808::200e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.tkLGB8oygGw.O/m=ytsubscribe/rt=j/sv=1/d=1/ed=1/am=wQE/rs=AGLTcCOVrdiUrdoKYhlUTq9WIvZT-VXTAA/cb=gapi.loaded_0

Requested by

Host: apis.google.com
URL: https://apis.google.com/js/platform.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

ccaa064a2f6f23664941ddea352d79666dfab708570d14f5082d05d21a7feb0e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 15 Aug 2019 10:26:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 31 Jul 2019 18:42:34 GMT
server: sffe
age: 380487
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
status: 200
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 42286
x-xss-protection: 0
expires: Fri, 14 Aug 2020 10:26:59 GMT

GET
H2 200 cb=gapi.loaded_1 Show response
apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.tkLGB8oygGw.O/m=auth/exm=ytsubscribe/rt=j/sv=1/d=1/ed=1/am=wQE/rs=AGLTcCOVrdiUrdoKYhlUTq9WIvZT-VXTAA/ 115 KB
40 KB 9ms
9ms Script
text/javascript 2a00:1450:4001:808::200e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.tkLGB8oygGw.O/m=auth/exm=ytsubscribe/rt=j/sv=1/d=1/ed=1/am=wQE/rs=AGLTcCOVrdiUrdoKYhlUTq9WIvZT-VXTAA/cb=gapi.loaded_1

Requested by

Host: apis.google.com
URL: https://apis.google.com/js/platform.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

ba9d1d05dbbf153dbc2e68b3fcaf8343440039c7794fec3136286508a94ce9d0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 12 Aug 2019 20:19:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 31 Jul 2019 18:42:34 GMT
server: sffe
age: 604142
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
status: 200
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 40654
x-xss-protection: 0
expires: Tue, 11 Aug 2020 20:19:24 GMT

GET
H2 200 subscribe_embed
www.youtube.com/ Frame F92E 0
0 59ms
58ms Document
text/html 2a00:1450:4001:809::200e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/subscribe_embed?usegapi=1&channelid=UCLDnEn-TxejaDB8qm2AUhHQ&layout=full&count=default&origin=https%3A%2F%2Fwww.malwaretech.com&gsrc=3p&ic=1&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.tkLGB8oygGw.O%2Fam%3DwQE%2Fd%3D1%2Frs%3DAGLTcCOVrdiUrdoKYhlUTq9WIvZT-VXTAA%2Fm%3D__features__

Requested by

Host: apis.google.com
URL: https://apis.google.com/js/platform.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

YouTube Frontend Proxy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.youtube.com
:scheme: https
:path: /subscribe_embed?usegapi=1&channelid=UCLDnEn-TxejaDB8qm2AUhHQ&layout=full&count=default&origin=https%3A%2F%2Fwww.malwaretech.com&gsrc=3p&ic=1&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.tkLGB8oygGw.O%2Fam%3DwQE%2Fd%3D1%2Frs%3DAGLTcCOVrdiUrdoKYhlUTq9WIvZT-VXTAA%2Fm%3D__features__
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode: nested-navigate
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
accept-encoding: gzip, deflate, br
cookie: VISITOR_INFO1_LIVE=DelA6TlXFgE; GPS=1; PREF=f1=50000000; YSC=4pQiPz6xnjA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html

Response headers

status: 200
content-type: text/html; charset=utf-8
cache-control: no-cache
content-encoding: br
expires: Tue, 27 Apr 1971 19:44:06 EST
strict-transport-security: max-age=31536000
content-length: 1761
x-content-type-options: nosniff
date: Mon, 19 Aug 2019 20:08:26 GMT
server: YouTube Frontend Proxy
x-xss-protection: 0
alt-svc: quic=":443"; ma=2592000; v="46,43,39"

GET
H2 200 postmessageRelay
accounts.google.com/o/oauth2/ Frame 4FB5 0
0 39ms
19ms Document
text/html 2a00:1450:4001:81b::200d
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.google.com/o/oauth2/postmessageRelay?parent=https%3A%2F%2Fwww.malwaretech.com&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.tkLGB8oygGw.O%2Fam%3DwQE%2Fd%3D1%2Frs%3DAGLTcCOVrdiUrdoKYhlUTq9WIvZT-VXTAA%2Fm%3D__features__

Requested by

Host: apis.google.com
URL: https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.tkLGB8oygGw.O/m=auth/exm=ytsubscribe/rt=j/sv=1/d=1/ed=1/am=wQE/rs=AGLTcCOVrdiUrdoKYhlUTq9WIvZT-VXTAA/cb=gapi.loaded_1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::200d Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-+c5ZhnojJk1VcO9x90OV7w' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /o/cspreport
X-Xss-Protection	0

Request headers

:method: GET
:authority: accounts.google.com
:scheme: https
:path: /o/oauth2/postmessageRelay?parent=https%3A%2F%2Fwww.malwaretech.com&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.tkLGB8oygGw.O%2Fam%3DwQE%2Fd%3D1%2Frs%3DAGLTcCOVrdiUrdoKYhlUTq9WIvZT-VXTAA%2Fm%3D__features__
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode: nested-navigate
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
accept-encoding: gzip, deflate, br
cookie: NID=188=YgaTL20dD8F24Ttk7vDIFsQPooPmLUxcWNLz5clF_Y_fIHwA-ZgQZ2oNF4GPGrd_pGCZ_6UayZ21fTu6WgLT-As_zP7om0CpCB8i42VA4D0UrM-kII8GQ5Qd_2tABUJWIWI6jccnosVfXe98KvRfSKa8pjTEfM20QhNXrEp-P6E
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html

Response headers

status: 200
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Mon, 19 Aug 2019 20:08:26 GMT
content-security-policy: script-src 'report-sample' 'nonce-+c5ZhnojJk1VcO9x90OV7w' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /o/cspreport
content-encoding: gzip
server: ESF
x-xss-protection: 0
alt-svc: quic=":443"; ma=2592000; v="46,43,39"

GET
H2 200 reactive_library.js Show response
pagead2.googlesyndication.com/pagead/js/r20190815/r20190131/ 162 KB
57 KB 31ms
31ms Script
text/javascript 2a00:1450:4001:808::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20190815/r20190131/reactive_library.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20190815/r20190131/show_ads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

3096e409457036c6cba9c925b4d069234482b07957a74224e92f7d77346286d7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 19 Aug 2019 20:08:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length: 58735
x-xss-protection: 0
server: cafe
etag: 15730932441974303210
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Aug 2019 20:08:26 GMT

GET
H2 200 ads
googleads.g.doubleclick.net/pagead/ Frame 6871 0
0 253ms
253ms Document
text/html 2a00:1450:4001:81b::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3337609182489974&output=html&h=600&adk=3579329306&adf=3454879259&w=263&fwrn=4&fwrnh=100&lmt=1566245306&rafmt=1&to=qs&pwprc=4087771549&guci=1.2.0.0.2.2.0.0&format=263x600&url=https%3A%2F%2Fwww.malwaretech.com%2F2019%2F08%2Fdejablue-analyzing-a-rdp-heap-overflow.html&flash=0&fwr=0&resp_fmts=4&wgl=1&adsid=NT&dt=1566245306662&bpp=4&bdt=824&fdt=5&idt=5&shv=r20190815&cbv=r20190131&saldr=aa&abxe=1&prev_fmts=0x0%2C847x200%2C847x200&nras=3&correlator=4110676402966&frm=20&pv=1&ga_vid=540226228.1566245306&ga_sid=1566245306&ga_hid=1747954838&ga_fc=0&iag=0&icsg=2256196384849919&dssz=43&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1100&ady=1127&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=20199336%2C21061795%2C410075105&oid=3&rx=0&eae=0&fc=1936&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=144&bc=31&osw_key=579800346&ifi=3&uci=3.tbtf2zatm9g4&fsb=1&xpc=NzrcFjSH57&p=https%3A//www.malwaretech.com&dtd=9

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20190815/r20190131/show_ads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-3337609182489974&output=html&h=600&adk=3579329306&adf=3454879259&w=263&fwrn=4&fwrnh=100&lmt=1566245306&rafmt=1&to=qs&pwprc=4087771549&guci=1.2.0.0.2.2.0.0&format=263x600&url=https%3A%2F%2Fwww.malwaretech.com%2F2019%2F08%2Fdejablue-analyzing-a-rdp-heap-overflow.html&flash=0&fwr=0&resp_fmts=4&wgl=1&adsid=NT&dt=1566245306662&bpp=4&bdt=824&fdt=5&idt=5&shv=r20190815&cbv=r20190131&saldr=aa&abxe=1&prev_fmts=0x0%2C847x200%2C847x200&nras=3&correlator=4110676402966&frm=20&pv=1&ga_vid=540226228.1566245306&ga_sid=1566245306&ga_hid=1747954838&ga_fc=0&iag=0&icsg=2256196384849919&dssz=43&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1100&ady=1127&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=20199336%2C21061795%2C410075105&oid=3&rx=0&eae=0&fc=1936&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=144&bc=31&osw_key=579800346&ifi=3&uci=3.tbtf2zatm9g4&fsb=1&xpc=NzrcFjSH57&p=https%3A//www.malwaretech.com&dtd=9
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode: nested-navigate
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUlwXvEnQKSOKR5aNY0fjwKPvglB1f6GyAK0pLd2MjNmxtNtVvvClRryJwp-
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Mon, 19 Aug 2019 20:08:26 GMT
server: cafe
content-length: 209
x-xss-protection: 0
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"

GET
H2 200 ads
googleads.g.doubleclick.net/pagead/ Frame 8D42 0
0 213ms
210ms Document
text/html 2a00:1450:4001:81b::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3337609182489974&output=html&h=90&adk=4250213621&adf=1553529706&w=848&fwrn=4&fwrnh=100&lmt=1566245306&rafmt=1&to=qs&pwprc=4087771549&guci=1.2.0.0.2.2.0.0&format=848x90&url=https%3A%2F%2Fwww.malwaretech.com%2F2019%2F08%2Fdejablue-analyzing-a-rdp-heap-overflow.html&flash=0&fwr=0&resp_fmts=3&wgl=1&adsid=NT&dt=1566245306679&bpp=3&bdt=841&fdt=4&idt=4&shv=r20190815&cbv=r20190131&saldr=aa&abxe=1&prev_fmts=0x0%2C847x200%2C847x200%2C263x600&nras=3&correlator=4110676402966&frm=20&pv=1&ga_vid=540226228.1566245306&ga_sid=1566245306&ga_hid=1747954838&ga_fc=0&iag=0&icsg=2256196384849919&dssz=43&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=223&ady=5797&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=20199336%2C21061795%2C410075105&oid=3&rx=0&eae=0&fc=1936&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=144&bc=31&osw_key=2012387053&ifi=4&uci=4.n2rzqzo7s80m&fsb=1&xpc=CtUQVc5uSq&p=https%3A//www.malwaretech.com&dtd=6

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20190815/r20190131/show_ads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-3337609182489974&output=html&h=90&adk=4250213621&adf=1553529706&w=848&fwrn=4&fwrnh=100&lmt=1566245306&rafmt=1&to=qs&pwprc=4087771549&guci=1.2.0.0.2.2.0.0&format=848x90&url=https%3A%2F%2Fwww.malwaretech.com%2F2019%2F08%2Fdejablue-analyzing-a-rdp-heap-overflow.html&flash=0&fwr=0&resp_fmts=3&wgl=1&adsid=NT&dt=1566245306679&bpp=3&bdt=841&fdt=4&idt=4&shv=r20190815&cbv=r20190131&saldr=aa&abxe=1&prev_fmts=0x0%2C847x200%2C847x200%2C263x600&nras=3&correlator=4110676402966&frm=20&pv=1&ga_vid=540226228.1566245306&ga_sid=1566245306&ga_hid=1747954838&ga_fc=0&iag=0&icsg=2256196384849919&dssz=43&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=223&ady=5797&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=20199336%2C21061795%2C410075105&oid=3&rx=0&eae=0&fc=1936&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=144&bc=31&osw_key=2012387053&ifi=4&uci=4.n2rzqzo7s80m&fsb=1&xpc=CtUQVc5uSq&p=https%3A//www.malwaretech.com&dtd=6
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode: nested-navigate
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUlwXvEnQKSOKR5aNY0fjwKPvglB1f6GyAK0pLd2MjNmxtNtVvvClRryJwp-
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Mon, 19 Aug 2019 20:08:26 GMT
server: cafe
content-length: 209
x-xss-protection: 0
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"

GET lounge.c46a5b3df6acec9d5cde6bf8b61aaf6e.css
c.disquscdn.com/next/embed/styles/ 0
0

GET common.bundle.57d935b03ca64a8fc2ae95b8d550f132.js
c.disquscdn.com/next/embed/ 0
0

GET lounge.bundle.f70f445d7ac0ff2c79eeb2d0e8586ac6.js
c.disquscdn.com/next/embed/ 0
0

GET config.js
disqus.com/next/ 0
0

GET
H2 200 ads
googleads.g.doubleclick.net/pagead/ Frame 1A04 0
0 163ms
163ms Document
text/html 2a00:1450:4001:81b::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3337609182489974&output=html&h=200&adk=2728076285&adf=1959655354&w=847&lmt=1566245306&num_ads=1&sem=mc&pwprc=4087771549&guci=1.2.0.0.2.2.0.0&ad_type=text_image&format=847x200&url=https%3A%2F%2Fwww.malwaretech.com%2F2019%2F08%2Fdejablue-analyzing-a-rdp-heap-overflow.html&flash=0&pra=3&wgl=1&fa=27&adsid=NT&dt=1566245306645&bpp=3&bdt=807&fdt=4&idt=4&shv=r20190815&cbv=r20190131&saldr=aa&abxe=1&prev_fmts=0x0&nras=2&correlator=4110676402966&frm=20&pv=1&ga_vid=540226228.1566245306&ga_sid=1566245306&ga_hid=1747954838&ga_fc=0&iag=0&icsg=2256196384849919&dssz=42&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=223&ady=1862&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=20199336%2C21061795%2C410075105&oid=3&rx=0&eae=0&fc=1424&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=16&bc=31&osw_key=5992713&ifi=1&uci=1.56mkcsyio35q&xpc=SHKrNwOKo3&p=https%3A//www.malwaretech.com&dtd=6

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20190815/r20190131/show_ads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-3337609182489974&output=html&h=200&adk=2728076285&adf=1959655354&w=847&lmt=1566245306&num_ads=1&sem=mc&pwprc=4087771549&guci=1.2.0.0.2.2.0.0&ad_type=text_image&format=847x200&url=https%3A%2F%2Fwww.malwaretech.com%2F2019%2F08%2Fdejablue-analyzing-a-rdp-heap-overflow.html&flash=0&pra=3&wgl=1&fa=27&adsid=NT&dt=1566245306645&bpp=3&bdt=807&fdt=4&idt=4&shv=r20190815&cbv=r20190131&saldr=aa&abxe=1&prev_fmts=0x0&nras=2&correlator=4110676402966&frm=20&pv=1&ga_vid=540226228.1566245306&ga_sid=1566245306&ga_hid=1747954838&ga_fc=0&iag=0&icsg=2256196384849919&dssz=42&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=223&ady=1862&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=20199336%2C21061795%2C410075105&oid=3&rx=0&eae=0&fc=1424&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=16&bc=31&osw_key=5992713&ifi=1&uci=1.56mkcsyio35q&xpc=SHKrNwOKo3&p=https%3A//www.malwaretech.com&dtd=6
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode: nested-navigate
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUlwXvEnQKSOKR5aNY0fjwKPvglB1f6GyAK0pLd2MjNmxtNtVvvClRryJwp-
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Mon, 19 Aug 2019 20:08:26 GMT
server: cafe
content-length: 209
x-xss-protection: 0
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"

GET
H2 200 ads
googleads.g.doubleclick.net/pagead/ Frame 5AFF 0
0 159ms
159ms Document
text/html 2a00:1450:4001:81b::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3337609182489974&output=html&h=200&adk=2728076285&adf=2440601624&w=847&lmt=1566245306&num_ads=1&sem=mc&pwprc=4087771549&guci=1.2.0.0.2.2.0.0&ad_type=text_image&format=847x200&url=https%3A%2F%2Fwww.malwaretech.com%2F2019%2F08%2Fdejablue-analyzing-a-rdp-heap-overflow.html&flash=0&pra=3&wgl=1&fa=27&adsid=NT&dt=1566245306654&bpp=2&bdt=817&fdt=3&idt=3&shv=r20190815&cbv=r20190131&saldr=aa&abxe=1&prev_fmts=0x0%2C847x200&nras=3&correlator=4110676402966&frm=20&pv=1&ga_vid=540226228.1566245306&ga_sid=1566245306&ga_hid=1747954838&ga_fc=0&iag=0&icsg=2256196384849919&dssz=43&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=223&ady=2625&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=20199336%2C21061795%2C410075105&oid=3&rx=0&eae=0&fc=1424&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=16&bc=31&osw_key=5992713&ifi=2&uci=2.92svq51g1ty4&xpc=J2EzpT9v9S&p=https%3A//www.malwaretech.com&dtd=5

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20190815/r20190131/show_ads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-3337609182489974&output=html&h=200&adk=2728076285&adf=2440601624&w=847&lmt=1566245306&num_ads=1&sem=mc&pwprc=4087771549&guci=1.2.0.0.2.2.0.0&ad_type=text_image&format=847x200&url=https%3A%2F%2Fwww.malwaretech.com%2F2019%2F08%2Fdejablue-analyzing-a-rdp-heap-overflow.html&flash=0&pra=3&wgl=1&fa=27&adsid=NT&dt=1566245306654&bpp=2&bdt=817&fdt=3&idt=3&shv=r20190815&cbv=r20190131&saldr=aa&abxe=1&prev_fmts=0x0%2C847x200&nras=3&correlator=4110676402966&frm=20&pv=1&ga_vid=540226228.1566245306&ga_sid=1566245306&ga_hid=1747954838&ga_fc=0&iag=0&icsg=2256196384849919&dssz=43&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=223&ady=2625&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=20199336%2C21061795%2C410075105&oid=3&rx=0&eae=0&fc=1424&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=16&bc=31&osw_key=5992713&ifi=2&uci=2.92svq51g1ty4&xpc=J2EzpT9v9S&p=https%3A//www.malwaretech.com&dtd=5
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode: nested-navigate
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUlwXvEnQKSOKR5aNY0fjwKPvglB1f6GyAK0pLd2MjNmxtNtVvvClRryJwp-
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Mon, 19 Aug 2019 20:08:26 GMT
server: cafe
content-length: 209
x-xss-protection: 0
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"

GET
H/1.1 200
OK /
disqus.com/embed/comments/ Frame 57AD 0
0 170ms
127ms Document
text/html 151.101.0.134
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://disqus.com/embed/comments/?base=default&f=malwaretech2&t_i=2205%20https%3A%2F%2Fwww.malwaretech.com%2F%3Fp%3D2205&t_u=https%3A%2F%2Fwww.malwaretech.com%2F2019%2F08%2Fdejablue-analyzing-a-rdp-heap-overflow.html&t_e=DejaBlue%3A%20Analyzing%20a%20RDP%20Heap%20Overflow&t_d=DejaBlue%3A%20Analyzing%20a%20RDP%20Heap%20Overflow%20-%20MalwareTech&t_t=DejaBlue%3A%20Analyzing%20a%20RDP%20Heap%20Overflow&s_o=default

Requested by

Host: malwaretech2.disqus.com
URL: https://malwaretech2.disqus.com/embed.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.0.134 , United States, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src https://.twitter.com: https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://.services.disqus.com: https://cdn.boomtrain.com/p13n/ 'unsafe-inline' https://cdn.syndication.twimg.com/tweets.json https://connect.facebook.net/en_US/sdk.js https://referrer.disqus.com/juggler/ https://apis.google.com https://www.google.com/recaptcha/ https://disqus.com
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Host: disqus.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: cross-site
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html

Response headers

Server: nginx
Content-Security-Policy: script-src https://*.twitter.com:* https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://*.services.disqus.com:* https://cdn.boomtrain.com/p13n/ 'unsafe-inline' https://cdn.syndication.twimg.com/tweets.json https://connect.facebook.net/en_US/sdk.js https://referrer.disqus.com/juggler/ https://apis.google.com https://www.google.com/recaptcha/ https://disqus.com
Link: <https://c.disquscdn.com>;rel=preconnect,<https://c.disquscdn.com>;rel=dns-prefetch
Cache-Control: stale-if-error=3600, s-stalewhilerevalidate=3600, stale-while-revalidate=30, no-cache, must-revalidate, public, s-maxage=5
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Content-Type: text/html; charset=utf-8
Last-Modified: Mon, 19 Aug 2019 16:23:20 GMT
ETag: W/"lounge:view:7594999054.2f922d1ec1ae57b91ebc962ff2b569ce.2"
Content-Encoding: gzip
Content-Length: 2550
Date: Mon, 19 Aug 2019 20:08:26 GMT
Age: 35
Connection: keep-alive
Vary: Accept-Encoding
Strict-Transport-Security: max-age=300; includeSubdomains

GET
H2 200 cb=gapi.loaded_2 Show response
apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.tkLGB8oygGw.O/m=gapi_iframes_style_bubble/exm=auth,ytsubscribe/rt=j/sv=1/d=1/ed=1/am=wQE/rs=AGLTcCOVrdiUrdoKYhlUTq9WIvZT-VXTAA/ 28 KB
10 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:808::200e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.tkLGB8oygGw.O/m=gapi_iframes_style_bubble/exm=auth,ytsubscribe/rt=j/sv=1/d=1/ed=1/am=wQE/rs=AGLTcCOVrdiUrdoKYhlUTq9WIvZT-VXTAA/cb=gapi.loaded_2

Requested by

Host: apis.google.com
URL: https://apis.google.com/js/platform.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

0d40995e8c582a6b8dd909517a08b2b1d9fb4d696fde735d57f215d0304831a5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 11 Jul 2019 00:34:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 10 Jul 2019 03:40:20 GMT
server: sffe
age: 3440025
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
status: 200
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 9871
x-xss-protection: 0
expires: Fri, 10 Jul 2020 00:34:41 GMT

GET
H2 200 subscribe_embed
www.youtube.com/ Frame 656E 0
0 57ms
57ms Document
text/html 2a00:1450:4001:809::200e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/subscribe_embed?channelid=UCLDnEn-TxejaDB8qm2AUhHQ&action_card=1&usegapi=1&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.tkLGB8oygGw.O%2Fam%3DwQE%2Fd%3D1%2Frs%3DAGLTcCOVrdiUrdoKYhlUTq9WIvZT-VXTAA%2Fm%3D__features__

Requested by

Host: apis.google.com
URL: https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.tkLGB8oygGw.O/m=ytsubscribe/rt=j/sv=1/d=1/ed=1/am=wQE/rs=AGLTcCOVrdiUrdoKYhlUTq9WIvZT-VXTAA/cb=gapi.loaded_0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

YouTube Frontend Proxy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.youtube.com
:scheme: https
:path: /subscribe_embed?channelid=UCLDnEn-TxejaDB8qm2AUhHQ&action_card=1&usegapi=1&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.tkLGB8oygGw.O%2Fam%3DwQE%2Fd%3D1%2Frs%3DAGLTcCOVrdiUrdoKYhlUTq9WIvZT-VXTAA%2Fm%3D__features__
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode: nested-navigate
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
accept-encoding: gzip, deflate, br
cookie: VISITOR_INFO1_LIVE=DelA6TlXFgE; GPS=1; PREF=f1=50000000; YSC=4pQiPz6xnjA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html

Response headers

status: 200
expires: Tue, 27 Apr 1971 19:44:06 EST
x-content-type-options: nosniff
content-encoding: br
content-length: 347
content-type: text/html; charset=utf-8
cache-control: no-cache
strict-transport-security: max-age=31536000
date: Mon, 19 Aug 2019 20:08:26 GMT
server: YouTube Frontend Proxy
x-xss-protection: 0
alt-svc: quic=":443"; ma=2592000; v="46,43,39"

GET
H2 200 border_3.gif
ssl.gstatic.com/s2/oz/images/stars/po/bubblev1/ 43 B
130 B 6ms
6ms Image
image/gif 2a00:1450:4001:814::2003
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ssl.gstatic.com/s2/oz/images/stars/po/bubblev1/border_3.gif

Requested by

Host: www.malwaretech.com
URL: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

c8de81a1acb5f3788959ecc04eaa6526d5bdb29991157cecbef71042268c0374

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 12 Aug 2019 22:14:34 GMT
x-content-type-options: nosniff
last-modified: Thu, 21 Apr 2016 03:17:22 GMT
server: sffe
age: 597232
content-type: image/gif
status: 200
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 43
x-xss-protection: 0
expires: Tue, 11 Aug 2020 22:14:34 GMT

GET
H2 200 spacer.gif
ssl.gstatic.com/s2/oz/images/stars/po/bubblev1/ 43 B
165 B 6ms
6ms Image
image/gif 2a00:1450:4001:814::2003
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ssl.gstatic.com/s2/oz/images/stars/po/bubblev1/spacer.gif

Requested by

Host: www.malwaretech.com
URL: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

ed1b73c6b4690cde9b521865b58e031293209bc0b2ba2b5716ecf4bf9885ee4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 11 Jul 2019 12:35:14 GMT
x-content-type-options: nosniff
last-modified: Thu, 21 Apr 2016 03:17:22 GMT
server: sffe
age: 3396792
content-type: image/gif
status: 200
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 43
x-xss-protection: 0
expires: Fri, 10 Jul 2020 12:35:14 GMT

GET
H2 200 bubbleSprite_3.png
ssl.gstatic.com/s2/oz/images/stars/po/bubblev1/ 318 B
417 B 6ms
5ms Image
image/png 2a00:1450:4001:814::2003
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ssl.gstatic.com/s2/oz/images/stars/po/bubblev1/bubbleSprite_3.png

Requested by

Host: www.malwaretech.com
URL: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

232334d177f358c07f8271994e6fc0c018abfce7c8910deb604de1440d741c45

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 12 Aug 2019 23:23:02 GMT
x-content-type-options: nosniff
last-modified: Thu, 21 Apr 2016 03:17:22 GMT
server: sffe
age: 593124
content-type: image/png
status: 200
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 318
x-xss-protection: 0
expires: Tue, 11 Aug 2020 23:23:02 GMT

GET
H2 200 bubbleDropR_3.png
ssl.gstatic.com/s2/oz/images/stars/po/bubblev1/ 116 B
207 B 8ms
7ms Image
image/png 2a00:1450:4001:814::2003
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ssl.gstatic.com/s2/oz/images/stars/po/bubblev1/bubbleDropR_3.png

Requested by

Host: www.malwaretech.com
URL: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

6c7884164b248cb8d87de9edf64dc810e5753bb8ec0cd015800d7f39e08371c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 26 Jun 2019 18:02:33 GMT
x-content-type-options: nosniff
last-modified: Thu, 21 Apr 2016 03:17:22 GMT
server: sffe
age: 4673153
content-type: image/png
status: 200
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 116
x-xss-protection: 0
expires: Thu, 25 Jun 2020 18:02:33 GMT

GET
H2 200 bubbleDropB_3.png
ssl.gstatic.com/s2/oz/images/stars/po/bubblev1/ 117 B
208 B 7ms
7ms Image
image/png 2a00:1450:4001:814::2003
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ssl.gstatic.com/s2/oz/images/stars/po/bubblev1/bubbleDropB_3.png

Requested by

Host: www.malwaretech.com
URL: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

984601230d8cbfe18370425e8e897037cc1a7adf831a691a9ede573cf44479d4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 09 Jul 2019 02:30:17 GMT
x-content-type-options: nosniff
last-modified: Thu, 21 Apr 2016 03:17:22 GMT
server: sffe
age: 3605889
content-type: image/png
status: 200
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 117
x-xss-protection: 0
expires: Wed, 08 Jul 2020 02:30:17 GMT

GET
H2 200 alfie.f51946af45e0b561c60f768335c9eb79.js Show response
c.disquscdn.com/next/embed/ 19 KB
7 KB 23ms
23ms Script
application/javascript 2606:4700::6810:4da6
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/alfie.f51946af45e0b561c60f768335c9eb79.js

Requested by

Host: malwaretech2.disqus.com
URL: https://malwaretech2.disqus.com/embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:4da6 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

eda8f00e9255746e7620848227aca122053845c9b4a90f1b3e26b4cd99af9e25

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 19 Aug 2019 20:08:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 2204444
status: 200
strict-transport-security: max-age=300; includeSubdomains
content-length: 6605
x-xss-protection: 1; mode=block
timing-allow-origin: *
last-modified: Wed, 15 May 2019 00:01:52 GMT
server: cloudflare
etag: "5cdb56f0-19cd"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable, no-transform
accept-ranges: bytes
cf-ray: 508ec2721edfd715-FRA
expires: Tue, 19 May 2020 02:07:22 GMT

GET
H2 200 realtime.af77184dec69e96e69aff958ae2bb738.css
c.disquscdn.com/next/embed/styles/ Frame 7EEB 337 B
390 B 11ms
11ms Stylesheet
text/css 2606:4700::6810:4da6
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/styles/realtime.af77184dec69e96e69aff958ae2bb738.css

Requested by

Host: malwaretech2.disqus.com
URL: https://malwaretech2.disqus.com/embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:4da6 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

c284dcb06ef882b1b45e11e0a16baa223b4117eca94e243c8e725c4ce3f909b3

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 19 Aug 2019 20:08:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 8272053
status: 200
strict-transport-security: max-age=300; includeSubdomains
content-length: 244
x-xss-protection: 1; mode=block
timing-allow-origin: *
last-modified: Thu, 27 Dec 2018 19:32:13 GMT
server: cloudflare
etag: "5c2528bd-f4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable, no-transform
accept-ranges: bytes
cf-ray: 508ec2722f1ad715-FRA
expires: Sat, 11 Jan 2020 01:16:35 GMT

GET
H2 200 realtime.af77184dec69e96e69aff958ae2bb738.css
c.disquscdn.com/next/embed/styles/ Frame 6B82 337 B
316 B 14ms
12ms Stylesheet
text/css 2606:4700::6810:4da6
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/styles/realtime.af77184dec69e96e69aff958ae2bb738.css

Requested by

Host: malwaretech2.disqus.com
URL: https://malwaretech2.disqus.com/embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:4da6 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

c284dcb06ef882b1b45e11e0a16baa223b4117eca94e243c8e725c4ce3f909b3

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 19 Aug 2019 20:08:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 8272053
status: 200
strict-transport-security: max-age=300; includeSubdomains
content-length: 244
x-xss-protection: 1; mode=block
timing-allow-origin: *
last-modified: Thu, 27 Dec 2018 19:32:13 GMT
server: cloudflare
etag: "5c2528bd-f4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable, no-transform
accept-ranges: bytes
cf-ray: 508ec2723f3dd715-FRA
expires: Sat, 11 Jan 2020 01:16:35 GMT

GET
H/1.1 200
OK ping Show response
links.services.disqus.com/api/ 223 B
852 B 152ms
73ms XHR
text/javascript 151.101.12.64
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://links.services.disqus.com/api/ping?format=jsonp&key=cfdfcf52dffd0a702a61bad27507376d&loc=https%3A%2F%2Fwww.malwaretech.com%2F2019%2F08%2Fdejablue-analyzing-a-rdp-heap-overflow.html&subId=4388049&v=1&jsonp=vglnk_jsonp_15662453072330
Requested by: Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/alfie.f51946af45e0b561c60f768335c9eb79.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.12.64 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: Apache-Coyote/1.1 /
Resource Hash: 3c0edcafe28389f81d979a5096dbac1e71d06ea80ee5f38914ad04eabee893ef

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 19 Aug 2019 20:08:27 GMT
Server: Apache-Coyote/1.1
P3P: CP="ALL IND DSP COR CUR ADM TAIo PSDo OUR COM INT NAV PUR STA UNI"
Access-Control-Allow-Origin: https://www.malwaretech.com
Cache-Control: no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/javascript;charset=UTF-8
Content-Length: 223
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.c46a5b3df6acec9d5cde6bf8b61aaf6e.css

Domain: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.57d935b03ca64a8fc2ae95b8d550f132.js

Domain: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/lounge.bundle.f70f445d7ac0ff2c79eeb2d0e8586ac6.js

Domain: disqus.com
URL: https://disqus.com/next/config.js

Verdicts & Comments Add Verdict or Comment

98 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

10 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.google.com/	1970-01-19 07:27:36	Name: NID Value: 188=YgaTL20dD8F24Ttk7vDIFsQPooPmLUxcWNLz5clF_Y_fIHwA-ZgQZ2oNF4GPGrd_pGCZ_6UayZ21fTu6WgLT-As_zP7om0CpCB8i42VA4D0UrM-kII8GQ5Qd_2tABUJWIWI6jccnosVfXe98KvRfSKa8pjTEfM20QhNXrEp-P6E
.youtube.com/	1969-12-31 23:59:59	Name: YSC Value: 4pQiPz6xnjA
.youtube.com/	1970-01-19 08:54:43	Name: PREF Value: f1=50000000
.youtube.com/	1970-01-19 03:04:07	Name: GPS Value: 1
.malwaretech.com/	1970-01-19 03:04:05	Name: _gat Value: 1
.doubleclick.net/	1970-01-19 12:25:41	Name: IDE Value: AHWqTUlwXvEnQKSOKR5aNY0fjwKPvglB1f6GyAK0pLd2MjNmxtNtVvvClRryJwp-
.malwaretech.com/	1970-01-19 03:05:31	Name: _gid Value: GA1.2.56930925.1566245306
.malwaretech.com/	1970-01-19 20:35:17	Name: _ga Value: GA1.2.540226228.1566245306
.youtube.com/	1970-01-19 07:23:17	Name: VISITOR_INFO1_LIVE Value: DelA6TlXFgE
.malwaretech.com/	1970-01-19 11:49:41	Name: __cfduid Value: d72fbdec7655664a6b236487703be4fee1566245305

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://www.malwaretech.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1(Line 2) Message: JQMIGRATE: Migrate is installed, version 1.4.1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

accounts.google.com
adservice.google.com
adservice.google.de
apis.google.com
c.disquscdn.com
disqus.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
lab.subinsb.com
links.services.disqus.com
malwaretech.com
malwaretech2.disqus.com
pagead2.googlesyndication.com
ssl.gstatic.com
stats.g.doubleclick.net
www.google-analytics.com
www.googletagservices.com
www.malwaretech.com
www.youtube.com
c.disquscdn.com
disqus.com
151.101.0.134
151.101.112.134
151.101.12.64
2606:4700:10::6814:5037
2606:4700:30::681c:726
2606:4700::6810:4da6
2a00:1450:4001:806::200a
2a00:1450:4001:808::2002
2a00:1450:4001:808::200e
2a00:1450:4001:809::200e
2a00:1450:4001:80b::200e
2a00:1450:4001:814::2003
2a00:1450:4001:817::2003
2a00:1450:4001:81b::2002
2a00:1450:4001:81b::200d
2a00:1450:400c:c04::9a
010a4854f11c4738089abe0567654439f605bec8305246d3ac634c1c97325a86
016ab0bd0de4839680e4a717a57db9b182a8c2c5fdeec4c24db7a8df761fca4d
046fa5c62e3b17b46ea2f8c601465dacfd5c153aee7a71754a9be582de74a385
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
06d5a77f098b6b2451dfa88134800ca4c98d3262f92ed3c6e1dac1fb89ff5a8f
082d133f7e02e15049decb21330faf910885ab023204c60f0613bbbfea3edc1a
0989a55075d46fb65315319f31af78fcf90a991699e17292ca403b1790533cfa
0d40995e8c582a6b8dd909517a08b2b1d9fb4d696fde735d57f215d0304831a5
118ef07563848a2b497c416852714497e942cb8dd15eff3fd5495d2462eaf2d3
12ec6c4742fa7dd777d77f2d3e64a8c0e5164aaec454fc247ff01aa2f0fdb8af
193fbb968733b8a7049da19274546e6b80b76e9a8f1b837fee9a5fdeb8f97c7b
1cfb51f3a30a24d0db22abf4f09eb7ca19b7773c2b97baea77233fb367046bf1
1d9a99f2605112c60740456c379042f17041e4f678f083c659874f1748fcb124
20b37ded4e153d334d44fb14ae8a9179e7b28cf7aa75951631dd4d38fdbecc6f
2152557cac69e2bd7d6debef5037a9f554f9209cc305b8141b3329acb10c42b7
21e5084203bd04a0ff2744dade5fd99ee7fb61071d3d1de9b252f6298ab677b9
232334d177f358c07f8271994e6fc0c018abfce7c8910deb604de1440d741c45
2563f05f9585ce46cf6dc648049b0ef3e0a5f9c038c45c732b2bdbc7de8bf71f
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
3096e409457036c6cba9c925b4d069234482b07957a74224e92f7d77346286d7
31cb76c05cbf5d71466f93078e8ba0f6e39cd92d0acc86d385b8cf2899963695
32d9329d48ccd5a058fc1f4a6be8b010c4c9afb03d046ffe8a211ce474db2b6a
3487ef2baf0c08ba660a8a143cdeb8ebeec961eea04bccd7c49096b4eb26b875
3516cb5a0b1574cd3677a224061d2ef16d87babc5480847a92fb213880706b7a
3685d730d5d09bf4ccf8f33281ed51d4935f4a8ab3d43a61f6aac8aeacbb32b0
382fe3dd880202e9e2971b7ae531720bc1bf2bb68decbc507d04e64b62531f44
3a3409c07f69b58691261f7706f3c7f7aab5875fcb27f6314d306631722c90aa
3c0edcafe28389f81d979a5096dbac1e71d06ea80ee5f38914ad04eabee893ef
3c2f2fa12fc82afd7546cb3388373e6db70f2efbbf10bea80cc0022a59097739
412752ed1c97f0aef8acf02f8ced68186ecdf81b8182f11c981b1e3436748c52
48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d
4b4810564b571191a09dd7dcaf40d08b02f51cdbbd6f97227a08f417cb7e09e4
4b8fe5c3d0e5ef7a6582185cbf5c535b5d369c8df1da98c03ed69833e55f474d
523756a966da1c8dde3cc1e0d5f4018161819dd0e94cc0f45c2845e366112dce
53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef
57a9f18341bdc109eb19087061ed0c36563cd726fdd2cfe82becabe62c3e8bb9
5c1dde4cdc5c608da53737233f02219a7421ab6870d5d90bc0b7b294d571942c
6772c7abf5a3cc7794b7eedc385be0f2a64ff5bf358ab0ca85c846e7d8998f40
6c7884164b248cb8d87de9edf64dc810e5753bb8ec0cd015800d7f39e08371c1
710636751a9f8b74353c03e68f515926978f48c6cbda1242842608071a750b8c
78c93f86b272e0ecf91d3d971d84b849cb5b3db353b5abba05e9dde267b71e25
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
7e1a6b135745c61308f5cd57dbd23562f34361f94c8eb49ebc034b03449f029b
7e347b66fb1145f780600551e06778b33ecaca5c45897ac90eb96eb4b6afd082
81fb74b605de7c59fe465ea0b15dbf963e5d7fa719834ae6e96240848d7dd9f8
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
89e96008193966d58394c0b2f5f26a35253c62b2e570e5798fda2f2e1ed730ae
8c7ee0238fa5cd80a02ef9870a7fff498ef52097181cb73edb9219dc022fd919
965e4348118ecf7960a924654b0a7572056dc55fb4f03f8c143f8d6b7d38f0d1
984601230d8cbfe18370425e8e897037cc1a7adf831a691a9ede573cf44479d4
9c695acb1fb9e1a8739e6ae5621d41fc1ff3d13bbf370ea9c1fc95e879109890
ab4529baacdbbc2917b158b1ec42ef35bf04d2ef0b5a1236a74561d4364e62c4
adedb4d78780884e3d7848c921f4c9bf2511c4bae25bb4cbc466c7d4d96a4884
ae088365040d1cd3d2656c8504d90719f44added660f44517b57b81c86560f1d
b201330b6a5955aacdf0559e994fbe042bab220ca32d6cfd16d4b387f659dcd3
b385fd0614f2927f0e7fdc03ccdb2428e3a93de0c7fe467149b34213cc32c0f6
b394d33b2a7ec654a6b037ebfda6618341b3f897a362be624c923c2711b54a43
b48c53daf18dc285b68ff15daa58d93daee9272cbcdf80775ba4c092a9d45d48
b62a40906eeaa1e1d6c1d220801a6ff2ee420d94193d768d65f43a7aa5c840f1
ba9d1d05dbbf153dbc2e68b3fcaf8343440039c7794fec3136286508a94ce9d0
c284dcb06ef882b1b45e11e0a16baa223b4117eca94e243c8e725c4ce3f909b3
c38b8d4ff32e4a904d092790c6bf9b6a9d49b93965cdf0bdd1b3067223019bef
c588b393ad9aa361b184c08aeaea3fbb5b1bad5cf11d737c63ebddaf69f13322
c8de81a1acb5f3788959ecc04eaa6526d5bdb29991157cecbef71042268c0374
ccaa064a2f6f23664941ddea352d79666dfab708570d14f5082d05d21a7feb0e
cec3748d0c3da4700300d5424aaea375b03550b0ee8b3dd38e242c4022261446
e27b22c6660c123d106669f3c72e66629ea0b7f05fcedb10ba081ed9483dbb3c
e34a6af51bb4d4f14eb8a61a56affc7708eae7aea45cca6a70e36dd118793b70
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3d961493e244e06bf91a9857442891e2e2ad8d49cf8e0a7781c53f0707443d7
e7f5a831ead8920451598097754bb1d4fbf16fff1fd90794b950724867345794
ed1b73c6b4690cde9b521865b58e031293209bc0b2ba2b5716ecf4bf9885ee4b
ed736578b79bd4b2af62f3f546a66a5c5448e499ab1fe5e2fe35f7b164e7e511
eda8f00e9255746e7620848227aca122053845c9b4a90f1b3e26b4cd99af9e25
ef0a5361093f5bb5f4f4343248b6d37490bc26f6dd125430998cce5e9082a0c2
f1ed16c584262b10a2554d4e19386eecb929ce4747aab37ae123bf2d06a3df29
f23a3dff942b95a36089b6dc564b77f155b6d2e2ad90b7f9ed825b8ca1556fdf
f2ef04d3356690d40fc7096a1801e1dd005397cfb882270c7aa290a4574d94f4
f4799ef2939b8377cf33f07b07b6d90a4a245adbf1c6eaf47ee3b0fcefcc07fe
f7a843066ece31f30d69ddf42e687855fe094150c782e7f06a96857d3efc506e

www.malwaretech.com Open in urlscan Pro 2606:4700:10::6814:5037 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

98 Requests

96 %HTTPS

81 %IPv6

13 Domains

20 Subdomains

17 IPs

3 Countries

1177 kBTransfer

2411 kBSize

10 Cookies

14 Outgoing links

Redirected requests

98 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.malwaretech.com Open in urlscan Pro
2606:4700:10::6814:5037 Public Scan

Screenshot
Live screenshot

Full Image

98
Requests

96 %
HTTPS

81 %
IPv6

13
Domains

20
Subdomains

17
IPs

3
Countries

1177 kB
Transfer

2411 kB
Size

10
Cookies

98 HTTP transactions
0 data transactions