securityaffairs.com Open in urlscan Pro
2606:4700:3031::ac43:8cd3 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
Submission: On September 25 via api (September 25th 2023, 1:01:18 pm UTC) from TR — Scanned from DE

Summary HTTP 125 Redirects Links 13 Behaviour Indicators

Summary

This website contacted 31 IPs in 3 countries across 19 domains to perform 125 HTTP transactions. The main IP is 2606:4700:3031::ac43:8cd3, located in United States and belongs to CLOUDFLARENET, US. The main domain is securityaffairs.com.
TLS certificate: Issued by GTS CA 1P5 on August 20th 2023. Valid for: 3 months.

This is the only time securityaffairs.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
50	2606:4700:303... 2606:4700:3031::ac43:8cd3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	13.32.99.51 13.32.99.51	16509 (AMAZON-02) (AMAZON-02)
10	2a00:1450:400... 2a00:1450:4001:82b::2008	15169 (GOOGLE) (GOOGLE)
7	2a00:1450:400... 2a00:1450:4001:81c::2002	15169 (GOOGLE) (GOOGLE)
6	2606:4700:10:... 2606:4700:10::6816:3bc7	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	192.0.77.2 192.0.77.2	2635 (AUTOMATTIC) (AUTOMATTIC)
2	192.0.76.3 192.0.76.3	2635 (AUTOMATTIC) (AUTOMATTIC)
1	2a00:1450:400... 2a00:1450:4001:802::200a	15169 (GOOGLE) (GOOGLE)
1	2600:9000:206... 2600:9000:206f:6a00:c:abe:f440:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:811::2003	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:80f::200e	15169 (GOOGLE) (GOOGLE)
2	2001:4860:480... 2001:4860:4802:32::36	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c07::9b	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:81c::2003	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:812::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:803::2002	15169 (GOOGLE) (GOOGLE)
5	2600:9000:211... 2600:9000:211e:1200:9:46dc:4700:93a1	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:830::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:829::200a	15169 (GOOGLE) (GOOGLE)
2	108.138.1.25 108.138.1.25	16509 (AMAZON-02) (AMAZON-02)
1	2620:116:800d... 2620:116:800d:21:e365:4988:e8a7:3270	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:225... 2600:9000:225e:9200:3:a4cd:8380:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:223... 2600:9000:223c:f000:6:44e3:f8c0:93a1	16509 (AMAZON-02) (AMAZON-02)
1	99.86.4.30 99.86.4.30	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700::68... 2606:4700::6810:5514	13335 (CLOUDFLAR...) (CLOUDFLARENET)
7	2606:4700:303... 2606:4700:3037::ac43:9e3b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	52.222.209.4 52.222.209.4	16509 (AMAZON-02) (AMAZON-02)
1	18.197.180.30 18.197.180.30	16509 (AMAZON-02) (AMAZON-02)
3	2a00:1450:400... 2a00:1450:4001:829::2001	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:802::2004	15169 (GOOGLE) (GOOGLE)
125	31

50 2606:4700:3031::ac43:8cd3 (United States)

ASN13335 (CLOUDFLARENET, US)

securityaffairs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.32.99.51 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-99-51.fra60.r.cloudfront.net

platform-api.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2a00:1450:4001:82b::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:81c::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2606:4700:10::6816:3bc7 (United States)

ASN13335 (CLOUDFLARENET, US)

services.vlitag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
assets.vlitag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 192.0.77.2 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
PTR: i1.wp.com

i0.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 192.0.76.3 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)

stats.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:802::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:206f:6a00:c:abe:f440:93a1 (United States)

ASN16509 (AMAZON-02, US)

buttons-config.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:811::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80f::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)

region1.analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
region1.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c07::9b (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81c::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:812::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:803::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2600:9000:211e:1200:9:46dc:4700:93a1 (United States)

ASN16509 (AMAZON-02, US)

cmp.quantcast.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:830::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:829::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

imasdk.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 108.138.1.25 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-138-1-25.fra56.r.cloudfront.net

c.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:116:800d:21:e365:4988:e8a7:3270 (United States)

ASN16509 (AMAZON-02, US)

secure.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:225e:9200:3:a4cd:8380:93a1 (United States)

ASN16509 (AMAZON-02, US)

test.cmp.quantcast.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:223c:f000:6:44e3:f8c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

rules.quantcount.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 99.86.4.30 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-86-4-30.fra6.r.cloudfront.net

config.aps.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:5514 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2606:4700:3037::ac43:9e3b (United States)

ASN13335 (CLOUDFLARENET, US)

px.vliplatform.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 52.222.209.4 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-209-4.fra56.r.cloudfront.net

aax.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.197.180.30 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-197-180-30.eu-central-1.compute.amazonaws.com

audit-tcfv2.cmp.quantcast.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:829::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:802::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
50	securityaffairs.com securityaffairs.com	1004 KB
10	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 122 tpc.googlesyndication.com — Cisco Umbrella Rank: 169	217 KB
10	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 111	227 KB
7	vliplatform.com px.vliplatform.com — Cisco Umbrella Rank: 31754	2 KB
7	amazon-adsystem.com c.amazon-adsystem.com — Cisco Umbrella Rank: 404 config.aps.amazon-adsystem.com — Cisco Umbrella Rank: 945 aax.amazon-adsystem.com — Cisco Umbrella Rank: 541	69 KB
7	quantcast.com cmp.quantcast.com — Cisco Umbrella Rank: 3498 test.cmp.quantcast.com — Cisco Umbrella Rank: 11024 audit-tcfv2.cmp.quantcast.com — Cisco Umbrella Rank: 12686	205 KB
6	vlitag.com services.vlitag.com — Cisco Umbrella Rank: 37074 assets.vlitag.com — Cisco Umbrella Rank: 46483	341 KB
5	doubleclick.net stats.g.doubleclick.net — Cisco Umbrella Rank: 175 googleads.g.doubleclick.net — Cisco Umbrella Rank: 66 securepubads.g.doubleclick.net — Cisco Umbrella Rank: 235	164 KB
4	wp.com i0.wp.com — Cisco Umbrella Rank: 4566 stats.wp.com — Cisco Umbrella Rank: 3500 pixel.wp.com — Cisco Umbrella Rank: 3212	261 KB
3	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 96 region1.google-analytics.com — Cisco Umbrella Rank: 1878	21 KB
3	sharethis.com platform-api.sharethis.com — Cisco Umbrella Rank: 5575 buttons-config.sharethis.com — Cisco Umbrella Rank: 6495 l.sharethis.com Failed	92 KB
2	google.com region1.analytics.google.com — Cisco Umbrella Rank: 2225 www.google.com — Cisco Umbrella Rank: 11	1 KB
2	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 113 imasdk.googleapis.com — Cisco Umbrella Rank: 657	125 KB
1	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 558	2 KB
1	quantcount.com rules.quantcount.com — Cisco Umbrella Rank: 1617	633 B
1	quantserve.com secure.quantserve.com — Cisco Umbrella Rank: 1803	9 KB
1	googleadservices.com partner.googleadservices.com — Cisco Umbrella Rank: 1368	611 B
1	google.de www.google.de — Cisco Umbrella Rank: 3974	408 B
1	gstatic.com fonts.gstatic.com	48 KB
125	19

	Domain	Requested by
50	securityaffairs.com	securityaffairs.com
10	www.googletagmanager.com	securityaffairs.com www.googletagmanager.com
7	px.vliplatform.com	securityaffairs.com
7	pagead2.googlesyndication.com	securityaffairs.com pagead2.googlesyndication.com tpc.googlesyndication.com
5	cmp.quantcast.com	services.vlitag.com cmp.quantcast.com
4	aax.amazon-adsystem.com	c.amazon-adsystem.com
4	services.vlitag.com	securityaffairs.com services.vlitag.com
3	tpc.googlesyndication.com	pagead2.googlesyndication.com tpc.googlesyndication.com
2	c.amazon-adsystem.com	services.vlitag.com c.amazon-adsystem.com
2	securepubads.g.doubleclick.net	services.vlitag.com securepubads.g.doubleclick.net
2	assets.vlitag.com	services.vlitag.com
2	googleads.g.doubleclick.net	pagead2.googlesyndication.com
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
2	i0.wp.com	securityaffairs.com
2	platform-api.sharethis.com	securityaffairs.com
1	www.google.com	tpc.googlesyndication.com
1	audit-tcfv2.cmp.quantcast.com	cmp.quantcast.com
1	cdn.jsdelivr.net	assets.vlitag.com
1	config.aps.amazon-adsystem.com	c.amazon-adsystem.com
1	rules.quantcount.com	secure.quantserve.com
1	test.cmp.quantcast.com	cmp.quantcast.com
1	secure.quantserve.com	cmp.quantcast.com
1	imasdk.googleapis.com	services.vlitag.com
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	region1.google-analytics.com	www.googletagmanager.com
1	pixel.wp.com	securityaffairs.com
1	www.google.de	securityaffairs.com
1	stats.g.doubleclick.net	www.googletagmanager.com
1	region1.analytics.google.com	www.googletagmanager.com
1	fonts.gstatic.com	fonts.googleapis.com
1	buttons-config.sharethis.com	platform-api.sharethis.com
1	fonts.googleapis.com	securityaffairs.com
1	stats.wp.com	securityaffairs.com
0	l.sharethis.com Failed	platform-api.sharethis.com
125	34

This site contains links to these domains. Also see Links.

Domain
www.facebook.com
twitter.com
blog.360totalsecurity.com
research.checkpoint.com
i0.wp.com
thn.news
infosec.exchange
www.linkedin.com
securityaffairs.co

Subject Issuer	Validity	Valid
securityaffairs.com GTS CA 1P5	`2023-08-20` - `2023-11-18`	3 months	crt.sh
sharethis.com Amazon RSA 2048 M02	`2023-05-20` - `2024-06-17`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-09-04` - `2023-11-27`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-09-04` - `2023-11-27`	3 months	crt.sh
vlitag.com GTS CA 1P5	`2023-07-31` - `2023-10-29`	3 months	crt.sh
*.wp.com Sectigo ECC Domain Validation Secure Server CA	`2022-11-14` - `2023-12-15`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2023-09-04` - `2023-11-27`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-09-04` - `2023-11-27`	3 months	crt.sh
www.google.de GTS CA 1C3	`2023-09-04` - `2023-11-27`	3 months	crt.sh
*.googleadservices.com GTS CA 1C3	`2023-09-04` - `2023-11-27`	3 months	crt.sh
cmp.quantcast.com R3	`2023-08-29` - `2023-11-27`	3 months	crt.sh
c.amazon-adsystem.com Amazon RSA 2048 M01	`2023-02-28` - `2024-02-17`	a year	crt.sh
quantserve.com R3	`2023-08-29` - `2023-11-27`	3 months	crt.sh
config.aps.amazon-adsystem.com Amazon RSA 2048 M02	`2023-02-20` - `2024-03-20`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-05-02` - `2024-05-01`	a year	crt.sh
aax-dtb-mobile-cf.amazon-adsystem.com Amazon RSA 2048 M01	`2023-03-16` - `2024-03-08`	a year	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2023-09-04` - `2023-11-27`	3 months	crt.sh
www.google.com GTS CA 1C3	`2023-09-04` - `2023-11-27`	3 months	crt.sh

This page contains 5 frames:

Primary Page: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
Frame ID: 77D209D625E59F437EE52078A3048FA3
Requests: 118 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20230920/r20190131/zrt_lookup.html
Frame ID: 667537E4DA29C65CF1B396BA13080846
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4918072057181794&output=html&adk=1812271804&adf=3025194257&lmt=1695639673&plat=1%3A16777216%2C3%3A16%2C4%3A16%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&format=0x0&url=https%3A%2F%2Fsecurityaffairs.com%2F151360%2Fmalware%2Fbbtok-trojan-latam.html%3F_gl%3D1&ea=0&pra=5&wgl=1&easpi=0&asro=0&asiscm=1&aslmt=0.4&asamt=-1&asedf=0&asefa=1&aseiel=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695646872794&bpp=3&bdt=464&idt=251&shv=r20230920&mjsv=m202309140101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=7376192788661&frm=20&pv=2&ga_vid=1615253632.1695646873&ga_sid=1695646873&ga_hid=1989497489&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31078144%2C31076995%2C31061690&oid=2&pvsid=12328078764537&tmod=235013682&uas=0&nvt=1&fsapi=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=285
Frame ID: 1C4356ED7B9B41E60CB534C777B877D4
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 8E1B54DE5B31444CF8D2E906366CEB8C
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: C6CA45365BBC56C32A8CEA34EC8C1F38
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

New variant of BBTok Trojan targets users of +40 banks in LATAM

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

Moment.js (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

moment(?:\.min)?\.js

Quantcast Measure (Analytics) Expand

Overall confidence: 100%
Detected patterns

\.quantserve\.com/quant\.js

Select2 (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

select2(?:\.min|\.full)?\.js

Slick (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

(?:/([\d.]+))?/slick(?:\.min)?\.js

Twitter Emoji (Twemoji) (Miscellaneous) Expand

Overall confidence: 100%
Detected patterns

twemoji(?:\.min)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

Page Statistics

125
Requests

98 %
HTTPS

77 %
IPv6

19
Domains

34
Subdomains

31
IPs

3
Countries

2788 kB
Transfer

7358 kB
Size

11
Cookies

13 Outgoing links

These are links going to different origins than the main page.

URL: https://www.facebook.com/sec.affairs/

Search URL Search Domain Scan URL

URL: https://twitter.com/securityaffairs

Search URL Search Domain Scan URL

URL: https://blog.360totalsecurity.com/en/360-file-less-attack-protection-intercepts-the-banker-trojan-bbtok-active-in-mexico/
Title: first appeared

Search URL Search Domain Scan URL

URL: https://research.checkpoint.com/2023/behind-the-scenes-of-bbtok-analyzing-a-bankers-server-side-components/
Title: report

Search URL Search Domain Scan URL

URL: https://i0.wp.com/securityaffairs.com/wp-content/uploads/2023/09/image-40.png?ssl=1

Search URL Search Domain Scan URL

URL: https://thn.news/o6a5Vxgy

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sec.affairs
Title: Facebook

Search URL Search Domain Scan URL

URL: https://infosec.exchange/@securityaffairs
Title: Mastodon

Search URL Search Domain Scan URL

URL: http://www.linkedin.com/pub/pierluigi-paganini/b/742/559
Title: Pierluigi Paganini

Search URL Search Domain Scan URL

URL: http://securityaffairs.co/wordpress/
Title: SecurityAffairs

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fsecurityaffairs.com%2F151360%2Fmalware%2Fbbtok-trojan-latam.html
Title: facebook

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fsecurityaffairs.com%2F151360%2Fmalware%2Fbbtok-trojan-latam.html
Title: linkedin

Search URL Search Domain Scan URL

URL: https://twitter.com/share?text=New+variant+of+BBTok+Trojan+targets+users+of+%2B40+banks+in+LATAM+-&url=https%3A%2F%2Fsecurityaffairs.com%2F151360%2Fmalware%2Fbbtok-trojan-latam.html&counturl=https%3A%2F%2Fsecurityaffairs.com%2F151360%2Fmalware%2Fbbtok-trojan-latam.html
Title: twitter

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

125 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request bbtok-trojan-latam.html Show response
securityaffairs.com/151360/malware/ 112 KB
26 KB 694ms
553ms Document
text/html 2606:4700:3031::ac43:8cd3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:8cd3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d6a3066ca2a24d754f139cc7d4f852d50e6751b2618fa1507c26f194a651bcc4

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-edge-cache: cache,platform=wordpress
cf-ray: 80c37454bc0f8684-MAD
content-encoding: br
content-type: text/html; charset=UTF-8
date: Mon, 25 Sep 2023 13:01:12 GMT
link: <https://securityaffairs.com/wp-json/>; rel="https://api.w.org/" <https://securityaffairs.com/wp-json/wp/v2/posts/151360>; rel="alternate"; type="application/json" <https://securityaffairs.com/?p=151360>; rel=shortlink
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bNbbs2ro4NMBL31FrndTNyrx2ZcqsvSSrVJ7LeSX9sBRjLHBJ%2F3rFOVQdSCJ6RP1pr3l6KTMBn6KnTBW4kdQp6iFfcv9Za2%2Fgn452JiO7mAMjxJ1eBP4dTanKgNMHm%2BuL5wNl62V2qW5P9g6zrD58VNY"}],"group":"cf-nel","max_age":604800}
server: cloudflare
x-pingback: https://securityaffairs.com/xmlrpc.php

GET
H2 200 style.css
securityaffairs.com/wp-includes/css/dist/block-library/ 102 KB
14 KB 78ms
75ms Stylesheet
text/css 2606:4700:3031::ac43:8cd3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.com/wp-includes/css/dist/block-library/style.css?ver=cc93dd60bf1bcc2ebb77dacd7f181ef3
Requested by: Host: securityaffairs.com
URL: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:8cd3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 32a42197dc440d45716dd692e63b89b7023bdd66b43d60de83e4de5750c83988

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:12 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 279057
cf-polished: origSize=112251
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Tue, 08 Aug 2023 22:36:33 GMT
server: cloudflare
etag: W/"64d2c371-1b67b"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4AAqVDZks5ytBif8wWiF1xUjuwD%2B%2FkAEr5Ev3rpX8aaL9PoH6nkGVsOdb93UliH7yxJ4sfNDBbfUOPBRe%2FVZnR2X4YXWzN4eFtA3IR2RFqQPmSV5OgSAyU7OM277rQzNekMLhe8EXi%2BlVH9brvu2GbEj"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: public, max-age=604800
cf-ray: 80c37458398b8684-MAD
expires: Fri, 29 Sep 2023 07:30:15 GMT

GET
H2 200 mediaelementplayer-legacy.min.css
securityaffairs.com/wp-includes/js/mediaelement/ 11 KB
3 KB 85ms
80ms Stylesheet
text/css 2606:4700:3031::ac43:8cd3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.com/wp-includes/js/mediaelement/mediaelementplayer-legacy.min.css?ver=4.2.17
Requested by: Host: securityaffairs.com
URL: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:8cd3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b7908a015a567ec2363011df2475368dbff34360e9da3fdff50604d6395fb646

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:12 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 09 Dec 2020 23:31:00 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 192010
etag: W/"5fd15e34-2bf8"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TrTI4KxEH%2BS2dCHUXigR6Q%2FxLRPz3nCnpPzVe6g2sm3K6WtuN99YnAQEiseP1ZSjgb7FxpAhXeQjuHUH55e02GQRiAvclsQ%2FbMA45I0Q2%2BP6GoaClBUMoTfHqGutfDAbkFtVmVdAoaZD1iwt4CKhj6Ze"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: public, max-age=604800
cf-ray: 80c37458398e8684-MAD
alt-svc: h3=":443"; ma=86400
expires: Sat, 30 Sep 2023 07:41:02 GMT

GET
H2 200 wp-mediaelement.css
securityaffairs.com/wp-includes/js/mediaelement/ 4 KB
1 KB 74ms
70ms Stylesheet
text/css 2606:4700:3031::ac43:8cd3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.com/wp-includes/js/mediaelement/wp-mediaelement.css?ver=cc93dd60bf1bcc2ebb77dacd7f181ef3
Requested by: Host: securityaffairs.com
URL: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:8cd3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4485dc3684588728bba3e5fbbe902c36ad1ec1b47480cc62c911a9403bafecc3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:12 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 455986
cf-polished: origSize=4960
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Wed, 13 Nov 2019 23:52:08 GMT
server: cloudflare
etag: W/"5dcc9728-1360"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gTzvKR0iNgTf4B4TBklOlFihA%2FDbzUMPiLmRPWSp1k5m1GnymnMOD3FdUwlEFflwLyShgsy3kB4CAvROZUDL%2FgHJyY09lPnb2LJxz4Jve6gZXXWZZe9%2Fx531dnTnGWKvbR6kdn5qKlwix2ZyzGyI7x8k"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: public, max-age=604800
cf-ray: 80c3745839908684-MAD
expires: Wed, 27 Sep 2023 06:21:26 GMT

GET
H2 200 styles.css
securityaffairs.com/wp-content/plugins/contact-form-7/includes/css/ 2 KB
1 KB 70ms
65ms Stylesheet
text/css 2606:4700:3031::ac43:8cd3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.com/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.8
Requested by: Host: securityaffairs.com
URL: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:8cd3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6e7c083e0e173f849fa0582a9332bf40a3567c49ff818f28b0e4dca93930c6e5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:12 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 448107
cf-polished: origSize=2859
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Tue, 08 Aug 2023 22:37:50 GMT
server: cloudflare
etag: W/"64d2c3be-b2b"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kUZ7Xe%2FclrtHdEfPQDFGLVG17pa315OPekvH43VpjD%2BtiCciQmDOS5UDqSTvHI62g4dcZySgkdZAAOqMDPaYgzBaHW%2Fu0Tr9cwwGW1gnypQNeGrWQrBoO40ihhNGPlcxXPW2IpVtWXmMuAWggdHJ5svA"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: public, max-age=604800
cf-ray: 80c3745839928684-MAD
expires: Wed, 27 Sep 2023 08:32:45 GMT

GET
H2 200 cookie-law-info-public.css
securityaffairs.com/wp-content/plugins/cookie-law-info/legacy/public/css/ 3 KB
1 KB 71ms
67ms Stylesheet
text/css 2606:4700:3031::ac43:8cd3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.com/wp-content/plugins/cookie-law-info/legacy/public/css/cookie-law-info-public.css?ver=3.1.4
Requested by: Host: securityaffairs.com
URL: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:8cd3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1f4247657f994f6c9520c982ab95f953ee1c052706594d74f521cae670cf8be

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:12 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 192010
cf-polished: origSize=3106
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Fri, 22 Sep 2023 21:58:31 GMT
server: cloudflare
etag: W/"650e0e07-c22"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zwLKqngR4O4jjIEwWKRJMyonf7Ir74%2BWskJNGH5Vu%2F3RzPG61fSFCIkEkrWHf0GomOT4vmOjGmE1hMfkpEX79UfwjZkVOsDKU62qyCuEYZIZvMVp%2BKBtPVrsB1MYSEf7e%2FfqnpgF9bRQtkJsz8bre0bE"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: public, max-age=604800
cf-ray: 80c3745839938684-MAD
expires: Sat, 30 Sep 2023 07:41:02 GMT

GET
H2 200 cookie-law-info-gdpr.css
securityaffairs.com/wp-content/plugins/cookie-law-info/legacy/public/css/ 22 KB
4 KB 75ms
71ms Stylesheet
text/css 2606:4700:3031::ac43:8cd3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.com/wp-content/plugins/cookie-law-info/legacy/public/css/cookie-law-info-gdpr.css?ver=3.1.4
Requested by: Host: securityaffairs.com
URL: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:8cd3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2d0ee8b9f5976ae2dc3eefb7aace301d8540ad3d5f01c88f5049b3b7257a1d2f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:12 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 192010
cf-polished: origSize=27249
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Fri, 22 Sep 2023 21:58:31 GMT
server: cloudflare
etag: W/"650e0e07-6a71"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=33P5lkHhGsZYzKojqOB%2F0k8YncoWzKYKONkLyiQojl0kyagOOFe6ehFEIgKgtUJHLoSSaPPjcb8khk1owr022t6hNIqJvKAFUouG2NOexb18wz9Znp%2BIqt5HvCfs4bEBJv4FUqjoSnt0m8ZIAWukRA8e"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: public, max-age=604800
cf-ray: 80c3745839948684-MAD
expires: Sat, 30 Sep 2023 07:41:02 GMT

GET
H2 200 mu-style.css
securityaffairs.com/wp-content/plugins/sharethis-share-buttons/css/ 0
435 B 76ms
72ms Stylesheet
text/css 2606:4700:3031::ac43:8cd3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.com/wp-content/plugins/sharethis-share-buttons/css/mu-style.css?ver=1690839156
Requested by: Host: securityaffairs.com
URL: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:8cd3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:12 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 282926
cf-polished: origSize=26
alt-svc: h3=":443"; ma=86400
content-length: 0
cf-bgj: minify
last-modified: Mon, 31 Jul 2023 21:32:36 GMT
server: cloudflare
etag: "64c82874-1a"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UxEJ9060LQCpKnkJSXiJvXbQixdQ%2FqiWs9NrNet79qJYigXmQeQ8Y7wGBNsSwJtHVnWHcW58ArJIrOkYRQv3IIqLSvs6AJRYM34olpxKdA0djiVDmKvtoI9Vj7LLIpGjb%2BmyH1Ovp5v1C2g8JqlazQ9d"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: public, max-age=604800
accept-ranges: bytes
cf-ray: 80c3745839958684-MAD
expires: Fri, 29 Sep 2023 06:25:46 GMT

GET
H2 200 form-basic.css
securityaffairs.com/wp-content/plugins/mailchimp-for-wp/assets/css/ 2 KB
902 B 77ms
73ms Stylesheet
text/css 2606:4700:3031::ac43:8cd3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.com/wp-content/plugins/mailchimp-for-wp/assets/css/form-basic.css?ver=4.9.7
Requested by: Host: securityaffairs.com
URL: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:8cd3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 90bed464813fbd721e4991e83fe323e763f91294f98018462c2698d16e60ae5f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:12 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 282926
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Sat, 02 Sep 2023 21:15:15 GMT
server: cloudflare
etag: W/"64f3a5e3-654"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xEb6w3U3rsWKeUR5Bhl7WFxTgjf%2FTod65L%2B7hMQ8d9Oj%2FU64%2BSZwcqwjMMnxOI0QuV6Sj%2BLEQ9TyvXLWlQlK9UX3un9lxJk7JsAGPTlPhaqBsnjyGw%2Bt20amlB6IqzF2rkNPNIcL8Tm3oFMEjNzQiCXX"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: public, max-age=604800
cf-ray: 80c3745839978684-MAD
expires: Fri, 29 Sep 2023 06:25:46 GMT

GET
H2 200 bootstrap.min.css
securityaffairs.com/wp-content/themes/security_affairs/css/ 152 KB
24 KB 85ms
81ms Stylesheet
text/css 2606:4700:3031::ac43:8cd3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.com/wp-content/themes/security_affairs/css/bootstrap.min.css?ver=1.0.0
Requested by: Host: securityaffairs.com
URL: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:8cd3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7633b7c0c97d19e682feee8afa2738523fcb2a14544a550572caeecd2eefe66b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:12 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 15 Feb 2023 07:47:00 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 21074
etag: W/"63ec8df4-260c5"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qFGcoq0GPXoT%2Bjw2IaGK9FXAPPysQD1qZWNssmB%2Bvn45O2ULp3JMMDY94hw91Hcxue2BrlP1EKg5sbWbmqj6cIqh5o9xuaBqFpBx1QXRbrZZlNkudZVTUOKFpctPwLUo%2FGhOyQAZMcYo3Bgi3p4BUf3W"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: public, max-age=604800
cf-ray: 80c3745839998684-MAD
alt-svc: h3=":443"; ma=86400
expires: Mon, 02 Oct 2023 07:09:58 GMT

GET
H2 200 plugins.css
securityaffairs.com/wp-content/themes/security_affairs/css/ 30 KB
7 KB 71ms
67ms Stylesheet
text/css 2606:4700:3031::ac43:8cd3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.com/wp-content/themes/security_affairs/css/plugins.css?ver=1.0.0
Requested by: Host: securityaffairs.com
URL: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:8cd3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bfbb02b2f82750344aa2bc6329085a7550de92926a22a951db6f1629fab862f0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:12 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 25372
cf-polished: origSize=31000
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Wed, 15 Feb 2023 07:47:01 GMT
server: cloudflare
etag: W/"63ec8df5-7918"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xCD7ZaMb6Iwcx9ltXKkDZk0Scoaua7SNzuSY3hYCXWhdDB%2BJC5HovvTs2S7uEjKwwRLPXCacI7EgnElYheOT0fmS%2BtST2Rz%2FacIx4FD0pIwRgPCoMLffN%2FpHp%2BxBETKSlg5DRa6hMSFuzousCzVlBzNV"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: public, max-age=604800
cf-ray: 80c37458399b8684-MAD
expires: Mon, 02 Oct 2023 05:58:20 GMT

GET
H2 200 animation.css
securityaffairs.com/wp-content/themes/security_affairs/css/ 44 KB
4 KB 124ms
121ms Stylesheet
text/css 2606:4700:3031::ac43:8cd3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.com/wp-content/themes/security_affairs/css/animation.css?ver=1.0.0
Requested by: Host: securityaffairs.com
URL: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:8cd3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: eaade0e5f063f06ba9ec0303b6e2cf134e7e7ddedce6b51813880fe52bbb5de2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:12 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 25372
cf-polished: origSize=45516
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Wed, 15 Feb 2023 07:47:00 GMT
server: cloudflare
etag: W/"63ec8df4-b1cc"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hnADMu%2BZx28DOnv7KysdpGjEXuYLi7f4rJGKQ0s5H5YHQqc2UA9aH2su5Pd1uif8l9PGjbYAJakImS1cSq0tpfyqtnxPCwt9OLyCUqIZxXtMEM%2F4THNHfzuZRwelLG7eTj7YqCF9YgheD2zTK5gxEUXo"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: public, max-age=604800
cf-ray: 80c374588a248684-MAD
expires: Mon, 02 Oct 2023 05:58:20 GMT

GET
H2 200 select2.min.css
securityaffairs.com/wp-content/themes/security_affairs/css/ 16 KB
2 KB 123ms
120ms Stylesheet
text/css 2606:4700:3031::ac43:8cd3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.com/wp-content/themes/security_affairs/css/select2.min.css?ver=1.0.0
Requested by: Host: securityaffairs.com
URL: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:8cd3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cda4a81c187015d95ed2c71f1841540b08203cdec5fa2a7d5d1825a3c2166f8c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:12 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 15 Feb 2023 07:47:01 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 25372
etag: W/"63ec8df5-3f88"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LL6LfboYy77DhsWc9ULwCKUU4Dibk%2Fn%2FBy53%2BmKbSAEDusuAWMfZ%2BNjeOE3lU41DC%2BIx39%2B7fNw5NR9CMsfl32IscLH5nJL2bh5J4NOf13mrgQ5pdmXY4JDbL7YOLiC6bamfbUPY3u%2FAlQTOYSxJUVR8"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: public, max-age=604800
cf-ray: 80c374588a288684-MAD
alt-svc: h3=":443"; ma=86400
expires: Mon, 02 Oct 2023 05:58:20 GMT

GET
H2 200 bootstrap-datetimepicker.min.css
securityaffairs.com/wp-content/themes/security_affairs/css/ 5 KB
1 KB 121ms
118ms Stylesheet
text/css 2606:4700:3031::ac43:8cd3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.com/wp-content/themes/security_affairs/css/bootstrap-datetimepicker.min.css?ver=1.0.0
Requested by: Host: securityaffairs.com
URL: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:8cd3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 165d6cf0440273d98a7ff9e3a3c996af430f251f139ce41bd21d2b995291a0ff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:12 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 15 Feb 2023 07:47:01 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 25372
etag: W/"63ec8df5-13c2"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ojRoINEhk1eVHeMxVQ4dkBIanDfuV9REfgaqFYH%2BHQFtPChCp9XtZK0lklCtghGHxcp%2FJTwAtMYkp0xc838xJQXFUn76TLWmE3UFkX%2BiZqefPLcZlMGZTw8WNlkL27FLy9eoYJgveb%2F8TOprK4nbum4V"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: public, max-age=604800
cf-ray: 80c374588a2b8684-MAD
alt-svc: h3=":443"; ma=86400
expires: Mon, 02 Oct 2023 05:58:20 GMT

GET
H2 200 style.css
securityaffairs.com/wp-content/themes/security_affairs/css/ 62 KB
10 KB 126ms
123ms Stylesheet
text/css 2606:4700:3031::ac43:8cd3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.com/wp-content/themes/security_affairs/css/style.css?ver=1.0.0
Requested by: Host: securityaffairs.com
URL: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:8cd3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ac825c2e7eb874cfe862111097aa63158b575df11b0ea342814a5bc55f450b66

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:12 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 167292
cf-polished: origSize=63687
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Wed, 16 Aug 2023 19:58:52 GMT
server: cloudflare
etag: W/"64dd2a7c-f8c7"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MxdlCKFJYIywouL51rmS8u8ojLJpnFPTZC8C43sFu2dl40MS0OomApy7AVX%2FPjFsJteI7Z1ELP1rr1cSQMzonu8H1JD%2FCVO7YmdJ%2BBlJxsY61qBcwdc4IvZ4nSJ4p%2B1jWbBS9iSzcLVsEKmto%2FL9Xbjh"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: public, max-age=604800
cf-ray: 80c374588a2c8684-MAD
expires: Sat, 30 Sep 2023 14:33:00 GMT

GET
H2 200 slick.css
securityaffairs.com/wp-content/themes/security_affairs/slick/ 4 KB
1 KB 148ms
145ms Stylesheet
text/css 2606:4700:3031::ac43:8cd3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.com/wp-content/themes/security_affairs/slick/slick.css?ver=1.0.0
Requested by: Host: securityaffairs.com
URL: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:8cd3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a21e3d4b193d36cbfab4d9cb007c5f531c86b7c3d5fbadc0ea2a20296330d536

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:12 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 167292
cf-polished: origSize=4922
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Wed, 15 Feb 2023 07:45:55 GMT
server: cloudflare
etag: W/"63ec8db3-133a"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=U8BG97Z89OvWBkTOj1S7MUeixbRG%2FV2OvbQnNvrMOPIYCg%2FrgF2S3PceZMrcC9CpCexJCRnvBiuGjTEuO5fsZEIvqBeRsf8FxmZ68ep1cD5WiD%2BsHzxCK2TjL%2FVDm%2BJDERgLlvjXuV%2FL2IB%2BUzTtU4Zk"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: public, max-age=604800
cf-ray: 80c374588a308684-MAD
expires: Sat, 30 Sep 2023 14:33:00 GMT

GET
H2 200 jquery.js Show response
securityaffairs.com/wp-includes/js/jquery/ 138 KB
41 KB 130ms
128ms Script
application/javascript 2606:4700:3031::ac43:8cd3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.com/wp-includes/js/jquery/jquery.js?ver=3.7.0
Requested by: Host: securityaffairs.com
URL: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:8cd3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 42638cf7ce147ae414ebf639d0c94c85b08018380903afb94e2190b1d4adb317

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:12 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 451083
cf-polished: origSize=285016
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Tue, 08 Aug 2023 22:36:33 GMT
server: cloudflare
etag: W/"64d2c371-45958"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=f3FJS6%2Fv9j6r4jmpL9DgZpxco%2FYlfHyMDOiXr2HBurfWiaDLSKBI3jyviZRwLZCfA2j6FvYuOLqxOh5ulMEA9Dap2qiAhJXVS6gjZ2OcfQD%2Fhu6EYwdCAkgAvdJihFoaGc2u3WQnebXx39i3nIIe36Sk"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=604800
cf-ray: 80c374588a328684-MAD
expires: Wed, 27 Sep 2023 07:43:09 GMT

GET
H2 200 jquery-migrate.js Show response
securityaffairs.com/wp-includes/js/jquery/ 19 KB
6 KB 154ms
152ms Script
application/javascript 2606:4700:3031::ac43:8cd3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.com/wp-includes/js/jquery/jquery-migrate.js?ver=3.4.1
Requested by: Host: securityaffairs.com
URL: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:8cd3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 82815a7dba0c18a1092121e80005ee37b0390b8b755a6dc8ba03e199ed3a2501

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:12 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 448107
cf-polished: origSize=31978
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Tue, 08 Aug 2023 22:36:33 GMT
server: cloudflare
etag: W/"64d2c371-7cea"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=joscOxgp%2F0ptASO%2FC9%2BVkmVtmSHSq%2FeuIN7Zeuu%2BxsbhGiz9OMW6iRhdezU%2B%2FUpkdhncPxcfscPkSjiXb8rmSLli8atW%2Btq6SWGgBiGLSu5delsB57IIj4fPQecWomq8TGuXfu91GrvMZ2r1WYQOulDm"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=604800
cf-ray: 80c374588a338684-MAD
expires: Wed, 27 Sep 2023 08:32:45 GMT

GET
H2 200 cookie-law-info-public.js Show response
securityaffairs.com/wp-content/plugins/cookie-law-info/legacy/public/js/ 27 KB
7 KB 148ms
145ms Script
application/javascript 2606:4700:3031::ac43:8cd3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.com/wp-content/plugins/cookie-law-info/legacy/public/js/cookie-law-info-public.js?ver=3.1.4
Requested by: Host: securityaffairs.com
URL: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:8cd3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9701e3cc721b444361494b8586b90ce11a0a0fc7964c0220e2263dd836d0a254

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:12 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 206100
cf-polished: origSize=34179
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Fri, 22 Sep 2023 21:58:31 GMT
server: cloudflare
etag: W/"650e0e07-8583"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Sd%2BPnTh3B7zbpPmwQjDxXssoQXXFOS2zQerUKCwGmjCQjjGJTPmNVWTX%2FqRyWwP%2FkGIfSNUDnlwZsfPHLj%2FcRC%2BvGOc8%2BHySEtrAYN7ce8OrqSrSMkIH5SiR0%2BdH6Z%2BB0Lmy14GMM5RqCVH0CHNlXc6S"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=604800
cf-ray: 80c374588a348684-MAD
expires: Sat, 30 Sep 2023 03:46:12 GMT

GET
H2 200 sharethis.js Show response
platform-api.sharethis.com/js/ 203 KB
45 KB 73ms
26ms Script
text/javascript 13.32.99.51
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://platform-api.sharethis.com/js/sharethis.js?ver=2.1.8

Requested by

Host: securityaffairs.com
URL: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.32.99.51 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-32-99-51.fra60.r.cloudfront.net

Software

Resource Hash

4be2e4cc6c402759c5835e32ab13cbb8bffd2f5dfd5fd269667c6b91ed10e875

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 12:58:00 GMT
content-encoding: gzip
via: 1.1 39e6266db143f6443f194d8c60e22480.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: FRA60-P3
age: 192
etag: W/"32bd5-yv+UNe3R/RtaAi3tpXP1SOqodAw"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
edge-control: cache-maxage=60m,downstream-ttl=60m
cache-control: max-age=600, public
x-cache: Hit from cloudfront
x-amz-cf-id: eCcgznK-44S6gndAGD57VLGBPuS6fB2RavFT8qQ857l0HO-QwF742w==

GET
H2 200 sharethis.js Show response
platform-api.sharethis.com/js/ 203 KB
45 KB 95ms
48ms Script
text/javascript 13.32.99.51
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://platform-api.sharethis.com/js/sharethis.js?ver=8.4.6

Requested by

Host: securityaffairs.com
URL: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.32.99.51 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-32-99-51.fra60.r.cloudfront.net

Software

Resource Hash

4be2e4cc6c402759c5835e32ab13cbb8bffd2f5dfd5fd269667c6b91ed10e875

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 12:59:39 GMT
content-encoding: gzip
via: 1.1 39e6266db143f6443f194d8c60e22480.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: FRA60-P3
age: 94
etag: W/"32bd5-yv+UNe3R/RtaAi3tpXP1SOqodAw"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
edge-control: cache-maxage=60m,downstream-ttl=60m
cache-control: max-age=600, public
x-cache: Hit from cloudfront
x-amz-cf-id: jpU0kQO3H870_ALOW1wxMNoHQmqOxHVWaEIs4IiaR61zLEBo2zgIkQ==

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 172 KB
64 KB 89ms
36ms Script
application/javascript 2a00:1450:4001:82b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-59069958-1

Requested by

Host: securityaffairs.com
URL: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

6d282eb785d0434a702ea33d88680d078aacde89efb3346c36798dba0bdc5d5c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:12 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 64911
x-xss-protection: 0
last-modified: Mon, 25 Sep 2023 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 25 Sep 2023 13:01:12 GMT

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 144 KB
50 KB 130ms
75ms Script
text/javascript 2a00:1450:4001:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-4918072057181794

Requested by

Host: securityaffairs.com
URL: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f30c624dd8830ceecd352e38b9a0129eaae7184a03050e1f870ccd1f97a5c191

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://securityaffairs.com/
Origin: https://securityaffairs.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:12 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 50579
x-xss-protection: 0
server: cafe
etag: 565641925454922757
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Mon, 25 Sep 2023 13:01:12 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 265 KB
89 KB 118ms
65ms Script
application/javascript 2a00:1450:4001:82b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-NPN4VEKBTY

Requested by

Host: securityaffairs.com
URL: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

b70fc51a1d9bf86eec231ca0cc01654a581000900ac0d143a350af36cdeed63b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:12 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 91292
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 25 Sep 2023 13:01:12 GMT

GET
H2 200 / Show response
services.vlitag.com/adv1/ 574 KB
147 KB 294ms
204ms Script
application/javascript 2606:4700:10::6816:3bc7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://services.vlitag.com/adv1/?q=221a5a398da89ace8729d1cd3c481ec7
Requested by: Host: securityaffairs.com
URL: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3bc7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f294eb188a59c61d3d3d6462cfb0b9c3e8559aaf4f95ab3fc9b010b4e1c20418

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:12 GMT
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
server: cloudflare
cf-polished: origSize=587646
etag: W/"221a5a398da89ace8729d1cd3c481ec7 2023-09-11T22:19:40 v1 default"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=900, stale-while-revalidate=3600
x-robots-tag: noindex, nofollow, noarchive, nosnippet
cf-ray: 80c3745a3f54c012-WAW
alt-svc: h3=":443"; ma=86400

GET
H3 200 menu-icon.svg
securityaffairs.com/wp-content/themes/security_affairs/images/ 467 B
860 B 240ms
237ms Image
image/svg+xml 2606:4700:3031::ac43:8cd3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securityaffairs.com/wp-content/themes/security_affairs/images/menu-icon.svg
Requested by: Host: securityaffairs.com
URL: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:8cd3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 79ef2c493105913ae8a012433b49e73fec9f4e3dfaf70723bcf66c3e3e0e09e9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:12 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 15 Feb 2023 07:46:27 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 167659
etag: W/"63ec8dd3-1d3"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1%2FnARio0y0v7PcbgutqVs7RqYBENdRKDQsucbUGOfh8GXe%2Fch4lrCZaZTo8l%2Fh%2BQdOstG6ELgMD4vjImuEtvWYtu2pIZSgRCxH6J95F%2B%2FyvY3F%2F3DR4CWcpBCT1C83%2FiF4DIvCVx7ZlkdzUTWSd6NPRu"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
cache-control: public, max-age=315360000
cf-ray: 80c37459ae316a02-MAD
alt-svc: h3=":443"; ma=86400
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 logo.png
securityaffairs.com/wp-content/uploads/2023/08/ 5 KB
5 KB 240ms
237ms Image
image/png 2606:4700:3031::ac43:8cd3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securityaffairs.com/wp-content/uploads/2023/08/logo.png
Requested by: Host: securityaffairs.com
URL: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:8cd3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 51e18fa3a179268df5763ae93f237dfa9ab4733b4e2791fe3cfeecca702a8832

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:12 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 167659
alt-svc: h3=":443"; ma=86400
content-length: 4751
last-modified: Sun, 27 Aug 2023 14:33:01 GMT
server: cloudflare
etag: "64eb5e9d-128f"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TiakJBUiRQq4g%2FQQLHciqa6CMLHJPhk8o6yfiDzr944mscYO7XQ1wwYfsJwjgOHD0XmESWSkKm3%2BUo7hS1qKjLzz8b%2F6KuvRB1DyF49byOBd56omLOaX4FYnPtxLeTozP9pILeC7DhyDel4bUzJjySjd"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: public, max-age=315360000
accept-ranges: bytes
cf-ray: 80c37459ae346a02-MAD
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 user-icon.svg
securityaffairs.com/wp-content/themes/security_affairs/images/ 987 B
1 KB 241ms
238ms Image
image/svg+xml 2606:4700:3031::ac43:8cd3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securityaffairs.com/wp-content/themes/security_affairs/images/user-icon.svg
Requested by: Host: securityaffairs.com
URL: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:8cd3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1e0352c858984ddb68c11c0b8265ea2ae72ab8d29b4471f888d4cbd95fe881ef

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:12 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 15 Feb 2023 07:46:29 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 167659
etag: W/"63ec8dd5-3db"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HETW%2BotFxuqBrrpgs05ewoZv7M1Ujrc%2FJJ0Zh3FO0D8XEQRNJuvXqoBMgCVCapcIbGYJeHhe66%2Bgi%2Bp5xYNNLHc9RvNZpr2IUpSKq%2FKQSA1CQyPwb76f4fPIFKKTe2xzoEqBM9NPW1Wv341yiU%2FMDMJZ"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
cache-control: public, max-age=315360000
cf-ray: 80c37459ae376a02-MAD
alt-svc: h3=":443"; ma=86400
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 clock-icon.svg
securityaffairs.com/wp-content/themes/security_affairs/images/ 947 B
1 KB 241ms
238ms Image
image/svg+xml 2606:4700:3031::ac43:8cd3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securityaffairs.com/wp-content/themes/security_affairs/images/clock-icon.svg
Requested by: Host: securityaffairs.com
URL: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:8cd3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 61b5d4f52ec96a0aef85f731e618cb627749775534ae86976446f42350757392

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:12 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 15 Feb 2023 07:46:29 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 167659
etag: W/"63ec8dd5-3b3"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FBtV5wsGZmu1WdwEF5KCY4SORibUH7EV65TkZSYcms%2FIDFzXmUveL4PWk8DwvpEi2OYN%2FUZUzqB235GHCYz9L2nxO4Y9ATsPhPX%2Fa7qRKXmL9pNWasZePphQOB%2FNqs5rX03hbpPylbngfphHDu5AfMis"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
cache-control: public, max-age=315360000
cf-ray: 80c37459ae396a02-MAD
alt-svc: h3=":443"; ma=86400
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 image-40.png
i0.wp.com/securityaffairs.com/wp-content/uploads/2023/09/ 141 KB
141 KB 23ms
20ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i0.wp.com/securityaffairs.com/wp-content/uploads/2023/09/image-40.png?fit=880%2C686&ssl=1

Requested by

Host: securityaffairs.com
URL: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i1.wp.com

Software

nginx /

Resource Hash

188f666c866c08197c9f3a2dd19aba2a106db032181d29837c4fcf8757826516

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:12 GMT
x-content-type-options: nosniff
x-optim-disabled: true
content-length: 144348
x-nc: HIT hhn 2
last-modified: Mon, 25 Sep 2023 05:31:57 GMT
server: nginx
etag: "8008d69fd889e41d"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
timing-allow-origin: *
link: <https://securityaffairs.com/wp-content/uploads/2023/09/image-40.png>; rel="canonical"
expires: Wed, 24 Sep 2025 17:31:57 GMT

GET
H2 200 image-40.png
i0.wp.com/securityaffairs.com/wp-content/uploads/2023/09/ 116 KB
117 KB 62ms
20ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i0.wp.com/securityaffairs.com/wp-content/uploads/2023/09/image-40.png?resize=768%2C599&ssl=1

Requested by

Host: securityaffairs.com
URL: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i1.wp.com

Software

nginx /

Resource Hash

d4cfb7cee285d40426858880b1aefd55d82066c18f3a435521309ff24ba65a7f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:12 GMT
x-content-type-options: nosniff
x-optim-disabled: true
content-length: 119204
x-nc: HIT hhn 2
last-modified: Mon, 25 Sep 2023 05:31:57 GMT
server: nginx
etag: "e23ee8c600b08cb4"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
timing-allow-origin: *
link: <https://securityaffairs.com/wp-content/uploads/2023/09/image-40.png>; rel="canonical"
expires: Wed, 24 Sep 2025 17:31:57 GMT

GET
H3 200 teamcity-logo.png
securityaffairs.com/wp-content/uploads/2023/09/ 19 KB
20 KB 241ms
238ms Image
image/png 2606:4700:3031::ac43:8cd3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securityaffairs.com/wp-content/uploads/2023/09/teamcity-logo.png
Requested by: Host: securityaffairs.com
URL: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:8cd3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f23f3ee7c34a55b964f90260ca679b32af5084b6c9a9d1e187346a38c6fb411d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:12 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1690
alt-svc: h3=":443"; ma=86400
content-length: 19795
last-modified: Mon, 25 Sep 2023 11:40:27 GMT
server: cloudflare
etag: "651171ab-4d53"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jIL2K%2BcE%2FpDnQvKtZ76Y2LEt3ba7tiYWEUcX915Sm02X05HCnn03fX400Kc4yFxnvGLgLnacO5QQpz3KPcVP1hYtYy4B5O3QNTrsHpZC59f2Mu9VOY6seThYAErylx3lgbguzI88Nfi089R5GAQ4Wsdq"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: public, max-age=315360000
accept-ranges: bytes
cf-ray: 80c37459ae3b6a02-MAD
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 Gelsemium-APT.png
securityaffairs.com/wp-content/uploads/2023/09/ 166 KB
167 KB 259ms
256ms Image
image/png 2606:4700:3031::ac43:8cd3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securityaffairs.com/wp-content/uploads/2023/09/Gelsemium-APT.png
Requested by: Host: securityaffairs.com
URL: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:8cd3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5b8751f4062c58b8cef16f45a2287aeff3a4b7776c65d70538cca246e203d92f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:12 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 11474
alt-svc: h3=":443"; ma=86400
content-length: 169925
last-modified: Mon, 25 Sep 2023 08:38:03 GMT
server: cloudflare
etag: "651146eb-297c5"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sgvlaODK6HWQqbEo3P2kzOKHM9iY8K90jyoE8LVd4YidUmLpBiUckIO2LTn8P7jfQNUwijxBQ5Fke0g0Vjafrq6xvhuPZTr1oYJ%2BH6%2Ftnx%2BcwEK6%2FlxFTlHDzC6f2Va1AlRmCPcyW9Chr0KuEnd%2Bn800"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: public, max-age=315360000
accept-ranges: bytes
cf-ray: 80c37459ae3e6a02-MAD
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 DoJ.jpg
securityaffairs.com/wp-content/uploads/2015/03/ 51 KB
52 KB 342ms
339ms Image
image/jpeg 2606:4700:3031::ac43:8cd3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securityaffairs.com/wp-content/uploads/2015/03/DoJ.jpg
Requested by: Host: securityaffairs.com
URL: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:8cd3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 698efec41dc5a5946ae4a26a456cad7646bb9cb56a479ee89b76160cccba142e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:12 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 72284
alt-svc: h3=":443"; ma=86400
content-length: 52674
last-modified: Wed, 16 Dec 2015 11:43:09 GMT
server: cloudflare
etag: "56714e4d-cdc2"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XNqdrUcnfb%2FQYkQwvqM9WjBTpRLVOtKhrZ%2B7SogIQxHvJ2BVJC%2BquOiaJEv31tod37ivpO8fSW13nhC5Ebt26O6vYsUBDf1dY5gsSI%2BaojEdvMIygslhc3jm4bq3auy5Udpx92vDtAlEE%2BDY4NFZFO%2B7"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=315360000
accept-ranges: bytes
cf-ray: 80c37459ae416a02-MAD
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 image-40.png
securityaffairs.com/wp-content/uploads/2023/09/ 240 KB
240 KB 347ms
344ms Image
image/png 2606:4700:3031::ac43:8cd3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securityaffairs.com/wp-content/uploads/2023/09/image-40.png
Requested by: Host: securityaffairs.com
URL: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:8cd3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8509250d4ad723588dd0e0d8261f070ee36fe13b326a9897593707378c50ad66

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:12 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 25324
alt-svc: h3=":443"; ma=86400
content-length: 245510
last-modified: Sun, 24 Sep 2023 21:37:18 GMT
server: cloudflare
etag: "6510ac0e-3bf06"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HQnFXnX66e4Ce%2FSafza1vyqsjX6TwYMHyU72e9g4Jf57fGQj%2FfJapZaJ1p3wDn0qiR7li8gI4X11SZr18Bft3Ha8FcuaWjluNGwF2Nb5pYSjykmZsBvZlMdfiaU20mLhym9yz0ZNVtLMwDcX3rXLBnuc"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: public, max-age=315360000
accept-ranges: bytes
cf-ray: 80c37459ae456a02-MAD
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 image-39.png
securityaffairs.com/wp-content/uploads/2023/09/ 147 KB
147 KB 397ms
394ms Image
image/png 2606:4700:3031::ac43:8cd3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securityaffairs.com/wp-content/uploads/2023/09/image-39.png
Requested by: Host: securityaffairs.com
URL: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:8cd3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d16103602deca71a3e0c919c7296b6473fefc06fbaa1560fad441fa2af1d5715

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:12 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 32060
alt-svc: h3=":443"; ma=86400
content-length: 150352
last-modified: Sun, 24 Sep 2023 16:39:03 GMT
server: cloudflare
etag: "65106627-24b50"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=x5upc%2BjQsnKirRF3bsbVGvKA4V1zY2A11FepfZ8W%2BI28DJ%2BN%2FNUaWZjYbIHLsjNjKd9FRHFAJXtrEozYFFJd7EzDPRblMhJHWsgq0yyB%2FRrpYYKjwYW6Cj0GT%2F9bY4u5XOQJDESJ6pTqeUf1fPxYdBy5"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: public, max-age=315360000
accept-ranges: bytes
cf-ray: 80c37459ae4a6a02-MAD
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 footer-logo.png
securityaffairs.com/wp-content/uploads/2023/08/ 4 KB
4 KB 402ms
400ms Image
image/png 2606:4700:3031::ac43:8cd3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securityaffairs.com/wp-content/uploads/2023/08/footer-logo.png
Requested by: Host: securityaffairs.com
URL: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:8cd3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b253964206a6ce075557f8735e7b57268338885e821f317bc63c6616e75c7b60

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:12 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 167659
alt-svc: h3=":443"; ma=86400
content-length: 3916
last-modified: Sun, 27 Aug 2023 14:33:08 GMT
server: cloudflare
etag: "64eb5ea4-f4c"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gqk6kGZbcw9zHlh%2FINJL5GnzpRsFmCcP8JVC%2Bb4cHp414HzXOevOFatTge8DNsy8VSiJQcsqty%2F%2B4SNsrhmpv7JnCKdKI9%2FL9pbzYj4uJPaHH0IzREPW%2BnUy%2BOboKrCys9uj4y93rqKK8zBdnHzhlJYd"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: public, max-age=315360000
accept-ranges: bytes
cf-ray: 80c37459ae4d6a02-MAD
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 email-decode.min.js Show response
securityaffairs.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 1 KB
1 KB 58ms
58ms Script
application/javascript 2606:4700:3031::ac43:8cd3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://securityaffairs.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js

Requested by

Host: securityaffairs.com
URL: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3031::ac43:8cd3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 20 Sep 2023 08:17:07 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"650aaa83-4d7"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=c9TWjQ1mHw60rxAdF2YHpjdc3U%2BXPMYG6Q5lH05%2BQcp%2F%2BF9szFftJjjwI8DDNQCP9ThL1fc5I6pe9jSuSLcBJbC79LRM6943cBmkMohgOYWlIBYnthrWCAsrKiws%2BFD0zBh1WODXtE%2Bk7p7iWbBZsqG6"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
x-frame-options: DENY
cache-control: max-age=172800, public
cf-ray: 80c374593d456a02-MAD
expires: Wed, 27 Sep 2023 13:01:12 GMT

GET
H3 200 image-cdn.js Show response
securityaffairs.com/wp-content/plugins/jetpack/jetpack_vendor/automattic/jetpack-image-cdn/dist/ 701 B
865 B 78ms
78ms Script
application/javascript 2606:4700:3031::ac43:8cd3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.com/wp-content/plugins/jetpack/jetpack_vendor/automattic/jetpack-image-cdn/dist/image-cdn.js?minify=false&ver=132249e245926ae3e188
Requested by: Host: securityaffairs.com
URL: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:8cd3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 27dd9b075cc59cf5f3c0f6ee075f4bd113782d81ce30a4f16aac669ecfdc4fa2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:12 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 167659
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Fri, 22 Sep 2023 21:58:34 GMT
server: cloudflare
etag: W/"650e0e0a-2bd"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UTi%2BdHT0Dv2esDr5xw83YBy%2BpqNDjHzLCzVgt2vd796vZH23AQf%2Beb0GjydbCstK77lPT25Wz6kPt5%2FaASLNYrKucm96DB1xcfagAqKuYx0ewwABr6kLvPCaWCnnF6VXHAxEK%2FO%2Fof%2B89kRk6JrQjUJY"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=604800
cf-ray: 80c374599e016a02-MAD
expires: Sat, 30 Sep 2023 14:26:53 GMT

GET
H3 200 index.js Show response
securityaffairs.com/wp-content/plugins/contact-form-7/includes/swv/js/ 11 KB
4 KB 72ms
72ms Script
application/javascript 2606:4700:3031::ac43:8cd3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.com/wp-content/plugins/contact-form-7/includes/swv/js/index.js?ver=5.8
Requested by: Host: securityaffairs.com
URL: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:8cd3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5fe46d2da01452067736578431f6c6e8116a24e616f58c72d9d81fdb2c7c9569

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:12 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 307007
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Tue, 08 Aug 2023 22:37:50 GMT
server: cloudflare
etag: W/"64d2c3be-2a12"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zl6k8HfwSPZ%2FvoGsbOwwOasDMZu6hRB5EyeI%2FDVzO2alHmj5Z7NApVc3dL7asDPsrJBkub4NzjG5aNfxc0WxLFaiDRlLBG1XGys%2FoeBE0CnOh930VzYVFXD7b3Fc1wQt%2BY0hdTfObjVV%2BhszLBSRl5A0"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=604800
cf-ray: 80c37459ae146a02-MAD
expires: Thu, 28 Sep 2023 23:44:25 GMT

GET
H3 200 index.js Show response
securityaffairs.com/wp-content/plugins/contact-form-7/includes/js/ 13 KB
5 KB 127ms
123ms Script
application/javascript 2606:4700:3031::ac43:8cd3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.com/wp-content/plugins/contact-form-7/includes/js/index.js?ver=5.8
Requested by: Host: securityaffairs.com
URL: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:8cd3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1060091178cbd6c843b802f516f230f1a3a1e85f1afbd6ef84d80e5430ba457e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:12 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 167659
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Tue, 08 Aug 2023 22:37:50 GMT
server: cloudflare
etag: W/"64d2c3be-328f"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cKvvk5oY9wiYlWjWNTjlXTcktEAtLwEVexZK688X824rB7DjqGWrfiiX3T4svM9S9HpWwBIg2X6G8bMDzG5GOfDMyD5JTn%2F5w0ch6dDs4uE1NmRqbMT7UOLXZYkvi60N4w402oNtqckpZQUnH3BgrHj1"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=604800
cf-ray: 80c37459ae166a02-MAD
expires: Sat, 30 Sep 2023 14:26:53 GMT

GET
H3 200 ssba.js Show response
securityaffairs.com/wp-content/plugins/simple-share-buttons-adder/js/ 2 KB
1 KB 127ms
123ms Script
application/javascript 2606:4700:3031::ac43:8cd3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.com/wp-content/plugins/simple-share-buttons-adder/js/ssba.js?ver=1686486772
Requested by: Host: securityaffairs.com
URL: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:8cd3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 90b1f6082b0cf09c59ad2a5b87d3e0ab87eadf37c9b0b791318adfaae1a4b0d4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:12 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 167659
cf-polished: origSize=3110
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Sun, 11 Jun 2023 12:32:52 GMT
server: cloudflare
etag: W/"6485bef4-c26"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=35fApghFnaJa7MNrkqTeszgaO5TpryLIcT6SXykZxgqW0MeEyGKinjt8YuF6ENn6%2FJakkSJOleHjSlT%2F8GiAtKNHCi567UVOoLpG8wZaeXYfonX17Y0NQ9%2F7t%2BScgN2YzYqrBdsSGRMi6o9nmnHm8AB7"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=604800
cf-ray: 80c37459ae196a02-MAD
expires: Sat, 30 Sep 2023 14:26:53 GMT

GET
H3 200 jquery-3.5.1.min.js Show response
securityaffairs.com/wp-content/themes/security_affairs/js/ 87 KB
32 KB 128ms
123ms Script
application/javascript 2606:4700:3031::ac43:8cd3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.com/wp-content/themes/security_affairs/js/jquery-3.5.1.min.js?ver=1.0.0
Requested by: Host: securityaffairs.com
URL: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:8cd3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:12 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 15 Feb 2023 07:46:02 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 167659
etag: W/"63ec8dba-15d84"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=D7aSm0XLcUZbYilRhAOzThdQq2kQLK9iJcQOXPQfN5H5cJFcKPUD477A7%2FCqvG4QkdMJZ5vFGPz6tYO91WlCMO2tfo69ZzJRn1k5ZOzB51WrWTczAHaZff9tryZlyon8ARErG2rRpspxImiBPF8O%2Bdip"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=604800
cf-ray: 80c37459ae1b6a02-MAD
alt-svc: h3=":443"; ma=86400
expires: Sat, 30 Sep 2023 14:26:53 GMT

GET
H3 200 bootstrap.bundle.min.js Show response
securityaffairs.com/wp-content/themes/security_affairs/js/ 77 KB
23 KB 73ms
69ms Script
application/javascript 2606:4700:3031::ac43:8cd3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.com/wp-content/themes/security_affairs/js/bootstrap.bundle.min.js?ver=1.0.0
Requested by: Host: securityaffairs.com
URL: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:8cd3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7e1f1503df765cca5e099891b94e318a2ef95081ba2af1eb6d417cc884bfdbfe

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:12 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 15 Feb 2023 07:46:01 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 167659
etag: W/"63ec8db9-13397"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=o7zqJ0WRsCie4Tqf%2F%2FwJ3VPRpgXNAXzedpuKiOyyOR6daE6Neznpx%2F7%2FJ5uAHY9zJsUKRAyTBhOb7aSK%2FmMiy01bEiG1d15fsxfv5SK860NoTnCixZKIkxXU9ashHmhwollRdm586CGkG%2FJDNQIb5crB"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=604800
cf-ray: 80c37459ae1c6a02-MAD
alt-svc: h3=":443"; ma=86400
expires: Sat, 30 Sep 2023 14:26:53 GMT

GET
H3 200 animation.js Show response
securityaffairs.com/wp-content/themes/security_affairs/js/ 3 KB
2 KB 74ms
70ms Script
application/javascript 2606:4700:3031::ac43:8cd3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.com/wp-content/themes/security_affairs/js/animation.js?ver=1.0.0
Requested by: Host: securityaffairs.com
URL: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:8cd3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2c03404e75c3b5dd3190080d5b678433a88aed86b17fba7685f8a36950414fb8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:12 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 167659
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Wed, 15 Feb 2023 07:46:02 GMT
server: cloudflare
etag: W/"63ec8dba-b93"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=48GgJ3j0v1DECtyj1dX4Vsa0rmwr%2B8zt6cGHcswNc8Nnjef2MO5IyB1z7rAeMcSpCg3eBapAmSwpaFh7K48pVDPVvdRLGhdr6taxQ3l9JEzhQZdNpEKo6IcEb%2F%2BcahtmSDPIRfHFmjHqOBHZzYP1ivZP"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=604800
cf-ray: 80c37459ae1e6a02-MAD
expires: Sat, 30 Sep 2023 14:26:53 GMT

GET
H3 200 slick.min.js Show response
securityaffairs.com/wp-content/themes/security_affairs/slick/ 42 KB
11 KB 184ms
181ms Script
application/javascript 2606:4700:3031::ac43:8cd3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.com/wp-content/themes/security_affairs/slick/slick.min.js?ver=1.0.0
Requested by: Host: securityaffairs.com
URL: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:8cd3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0c7178cc6ca34fb18e30f070a5e7a1c287b2d7ccfcba2cfdf06e0f46eda55740

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:12 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 15 Feb 2023 07:45:55 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 167659
etag: W/"63ec8db3-a76f"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6CdHpjATV5srV%2FzLMqzHTf22rPJDRWl%2B0wDx5DEX3WiPv%2B%2BZ3NpDRlZdRnpAVzQkdiKwpWvl6IIvisExZG1pU5ScisDOwafOkJYEjdwJnvNtqV3Fm11uqGqLkDSPpubt1Vg0PJfX0hwTnAEa3vhNABd9"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=604800
cf-ray: 80c37459ae206a02-MAD
alt-svc: h3=":443"; ma=86400
expires: Sat, 30 Sep 2023 14:26:53 GMT

GET
H3 200 select2.min.js Show response
securityaffairs.com/wp-content/themes/security_affairs/js/ 71 KB
20 KB 207ms
203ms Script
application/javascript 2606:4700:3031::ac43:8cd3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.com/wp-content/themes/security_affairs/js/select2.min.js?ver=1.0.0
Requested by: Host: securityaffairs.com
URL: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:8cd3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f7244fff610595b944f76bf3080d74e3af42b5dd234f8f079e698cc39ac966b0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:12 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 15 Feb 2023 07:46:01 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 344789
etag: W/"63ec8db9-11dcb"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6eROGYDA1xnZae5pHfZDDPHAlvv18el1FrqNc3v0OChntZZjpJDqLEvnCgmcdcnvG71zztnChnSqOfJJxtVyp390Ih%2FKTZLKC8ch%2FqyHtdM1mOM4ZR%2FY8nu82DvU87%2BlGrbTgMCbaA5C8N46tX7H9lU4"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=604800
cf-ray: 80c37459ae236a02-MAD
alt-svc: h3=":443"; ma=86400
expires: Thu, 28 Sep 2023 13:14:43 GMT

GET
H3 200 moment.min.js Show response
securityaffairs.com/wp-content/themes/security_affairs/js/ 33 KB
13 KB 235ms
231ms Script
application/javascript 2606:4700:3031::ac43:8cd3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.com/wp-content/themes/security_affairs/js/moment.min.js?ver=1.0.0
Requested by: Host: securityaffairs.com
URL: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:8cd3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4b5dcd8c4de34bf3e2bbbb1499ef55172ca6a8c7124c5aaa04cc6ea48a084b8b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:12 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 15 Feb 2023 07:46:02 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 167659
etag: W/"63ec8dba-857b"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=W4Z8%2F3WG%2BG%2BMOON82d0TFozVjDC8vGJTbqmPDu%2FYw4sTDesKU5sO%2BDcK5UUzO1CbouEZJbYaMC6QEx%2BGsB%2FmHVbgIBF2n1ZiDVLYOFoqbJuDWWogbfTp9aafFphsGxK%2B4CXGVUdTs0UyB0KRnjMiBjH%2F"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=604800
cf-ray: 80c37459ae256a02-MAD
alt-svc: h3=":443"; ma=86400
expires: Sat, 30 Sep 2023 14:26:53 GMT

GET
H3 200 bootstrap-datetimepicker.min.js Show response
securityaffairs.com/wp-content/themes/security_affairs/js/ 23 KB
7 KB 240ms
236ms Script
application/javascript 2606:4700:3031::ac43:8cd3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.com/wp-content/themes/security_affairs/js/bootstrap-datetimepicker.min.js?ver=1.0.0
Requested by: Host: securityaffairs.com
URL: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:8cd3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5220bfc9416c5b55c41b39baaf1744ed2ce2bec1b0e77382067dea40eec68ba2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:12 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 15 Feb 2023 07:46:02 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 167659
etag: W/"63ec8dba-5a28"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wu3uEnXc7HwA4LkFn6Bsco3cVhmmOTpWEtNItAcu0PlyB3Wi23R74lN6FxDG2iTXD9Lvcj7651XD7sKatV0U8ziI765JfZvwjcYuxPNdNXl0HFBAl2tVuGq%2B2FbpuVRgdTPD1L7Xz564D9jpw7LnCtU5"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=604800
cf-ray: 80c37459ae276a02-MAD
alt-svc: h3=":443"; ma=86400
expires: Sat, 30 Sep 2023 14:26:53 GMT

GET
H3 200 script-datepicker.js Show response
securityaffairs.com/wp-content/themes/security_affairs/js/ 236 B
672 B 240ms
236ms Script
application/javascript 2606:4700:3031::ac43:8cd3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.com/wp-content/themes/security_affairs/js/script-datepicker.js?ver=1.0.0
Requested by: Host: securityaffairs.com
URL: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:8cd3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 84e1de7132433ebaa0845af00ce1812287ba004d8288bf78b455f1d9f494f2ab

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:12 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 167659
cf-polished: origSize=552
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Wed, 15 Feb 2023 07:46:02 GMT
server: cloudflare
etag: W/"63ec8dba-228"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=j6%2F%2FM%2B3NlkucP0pgxx%2FldnHuwrbX3y9EiCtJODDkdLuhiRga9aF4BD10u6Lqh9DAzf3OnWWVBZjEwxQyo0NVCX99HTQu3%2FCuHitC9%2FrxvMADqZYGjSt7koGI%2FZu7B4bU9AZh8FUyPlWzZAhxPH9sTwOC"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=604800
cf-ray: 80c37459ae296a02-MAD
expires: Sat, 30 Sep 2023 14:26:53 GMT

GET
H3 200 script.js Show response
securityaffairs.com/wp-content/themes/security_affairs/js/ 4 KB
2 KB 240ms
237ms Script
application/javascript 2606:4700:3031::ac43:8cd3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.com/wp-content/themes/security_affairs/js/script.js?ver=1.0.0
Requested by: Host: securityaffairs.com
URL: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:8cd3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7a65e356551523b3a3222147ddb49ea4dad9b21d38a9b590effd45d55fc94d03

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:12 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 167659
cf-polished: origSize=6278
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Wed, 15 Feb 2023 07:46:01 GMT
server: cloudflare
etag: W/"63ec8db9-1886"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=z2b6Tvvkbj3GpPozgwnZnYRUkr496n8XEC0kPa3OO5hsiPJIWPeIZ3bBR6ra05O7%2FaNXqopZ7rbcCEttOGMPffarETmqgqEbsk2SnVgiqMGuppWnol2p7VJHrbTgnkGF7rkieGqz125eCd98%2BRpYtxr3"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=604800
cf-ray: 80c37459ae2e6a02-MAD
expires: Sat, 30 Sep 2023 14:26:53 GMT

GET
H2 200 e-202339.js Show response
stats.wp.com/ 7 KB
3 KB 70ms
22ms Script
application/javascript 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.wp.com/e-202339.js
Requested by: Host: securityaffairs.com
URL: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ca7752fb33cf3a98c0f29bc4eec563112025da4109a0dcc69dabf5f861751258

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

x-minify-cache: hit
x-nc: HIT hhn
date: Mon, 25 Sep 2023 13:01:12 GMT
content-encoding: br
server: nginx
x-minify: t
etag: W/13576-1684461103136.7104
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
expires: Sun, 22 Sep 2024 23:30:25 GMT

GET
BLOB 200
OK a087a0b0-4e1a-4f44-9a96-6fcb440d7286
https://securityaffairs.com/ 5 KB
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://securityaffairs.com/a087a0b0-4e1a-4f44-9a96-6fcb440d7286
Requested by: Host: securityaffairs.com
URL: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 09587fd0b4c984573371a553f082e27c4e4ba98f65130e1b1eb7c0b7699509e5

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Content-Length: 5047
Content-Type: text/javascript

GET
H2 200 css2
fonts.googleapis.com/ 17 KB
1 KB 80ms
30ms Stylesheet
text/css 2a00:1450:4001:802::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Open+Sans:wght@300;400;500;600;700;800&display=swap

Requested by

Host: securityaffairs.com
URL: https://securityaffairs.com/wp-content/themes/security_affairs/css/style.css?ver=1.0.0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

170d329a585de03caa379e0e068e08b529ba2d693608db4166c3996328185c06

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Mon, 25 Sep 2023 13:01:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Mon, 25 Sep 2023 11:24:30 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 25 Sep 2023 13:01:12 GMT

GET
H2 200 64b5cd2fd23b930012608ffb.js Show response
buttons-config.sharethis.com/js/ 927 B
1 KB 71ms
23ms Script
text/javascript 2600:9000:206f:6a00:c:abe:f440:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://buttons-config.sharethis.com/js/64b5cd2fd23b930012608ffb.js

Requested by

Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js?ver=2.1.8

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:206f:6a00:c:abe:f440:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

52f5e657405d02f0ab9761d8c352e50ddf0329275461a34ad512267f3b06c4db

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:11 GMT
via: 1.1 df7c0ba7857d5300ae11e7566c926f16.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: FRA56-C1
age: 29
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 927
last-modified: Mon, 17 Jul 2023 23:22:28 GMT
server: AmazonS3
etag: "56f01d1dc4635d0cd55fc8c794bbe43b"
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=60
accept-ranges: bytes
x-amz-cf-id: CERgB4jTIu26RMMZuBe6b9y1Mw8lZzLO7Apt45Pf_VQ38QehciZLgw==

GET pview
l.sharethis.com/ 0
0

GET
H3 200 search-icon.svg
securityaffairs.com/wp-content/themes/security_affairs/images/ 940 B
1 KB 385ms
385ms Image
image/svg+xml 2606:4700:3031::ac43:8cd3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securityaffairs.com/wp-content/themes/security_affairs/images/search-icon.svg
Requested by: Host: securityaffairs.com
URL: https://securityaffairs.com/wp-content/themes/security_affairs/css/style.css?ver=1.0.0
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:8cd3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1df70b268a34a8036eca2f536d670f59e142b877bf09ad993aec61417c7a4870

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/wp-content/themes/security_affairs/css/style.css?ver=1.0.0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:12 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 15 Feb 2023 07:46:24 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 167659
etag: W/"63ec8dd0-3ac"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UvX0DTzdEHsYiLhJq5CrlXb3Yl2%2BR2sKXQdmwa0o1ScPj5fFgLofVmhMzltsEZxA0i2zFPyyGIStGn0sON1VRQ8JM5G%2FX%2FoJ843LmxvRCqTWF39Fv0G6nEOGlrYWaBuPAOjPeq9zS214y9oKiDi5DQQK"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
cache-control: public, max-age=315360000
cf-ray: 80c37459de786a02-MAD
alt-svc: h3=":443"; ma=86400
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 b-arrow.svg
securityaffairs.com/wp-content/themes/security_affairs/images/ 903 B
1 KB 382ms
381ms Image
image/svg+xml 2606:4700:3031::ac43:8cd3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securityaffairs.com/wp-content/themes/security_affairs/images/b-arrow.svg
Requested by: Host: securityaffairs.com
URL: https://securityaffairs.com/wp-content/themes/security_affairs/css/style.css?ver=1.0.0
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:8cd3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 732fe1ff87d948c44d6d26af7aa89d8e1eb9eb8e00c372dadbacb51c0ba5865d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/wp-content/themes/security_affairs/css/style.css?ver=1.0.0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:12 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 15 Feb 2023 07:46:32 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 25324
etag: W/"63ec8dd8-387"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TahNJjzSLcQ6bn7CqplbhVYn%2BixdiQ9elkKittcLMCw%2FTuKJLhEyjjfAUb5yU5yMxkfn6gsJcSUIlC%2BW3DarO1unZ5FBiUkAZkDmRiX1z9PUNcp5JCEKSkQuICboXNP5eAXo8LlB4pO22TdCpoEPSHwr"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
cache-control: public, max-age=315360000
cf-ray: 80c37459de7b6a02-MAD
alt-svc: h3=":443"; ma=86400
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v36/ 47 KB
48 KB 71ms
21ms Font
font/woff2 2a00:1450:4001:811::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v36/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Open+Sans:wght@300;400;500;600;700;800&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9b1b9d7cb74a9923d83f36f0026f421940b861fd6e1a51b8f79af45492ed4ed5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://securityaffairs.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Thu, 21 Sep 2023 18:17:53 GMT
x-content-type-options: nosniff
age: 326599
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 48432
x-xss-protection: 0
last-modified: Thu, 14 Sep 2023 00:40:31 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 20 Sep 2024 18:17:53 GMT

GET
H3 200 fontawesome-webfont.woff2
securityaffairs.com/wp-content/themes/security_affairs/fonts/ 75 KB
76 KB 376ms
376ms Font
application/octet-stream 2606:4700:3031::ac43:8cd3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.com/wp-content/themes/security_affairs/fonts/fontawesome-webfont.woff2?v=4.7.0
Requested by: Host: securityaffairs.com
URL: https://securityaffairs.com/wp-content/themes/security_affairs/css/plugins.css?ver=1.0.0
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:8cd3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Request headers

Referer: https://securityaffairs.com/wp-content/themes/security_affairs/css/plugins.css?ver=1.0.0
Origin: https://securityaffairs.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:12 GMT
cf-cache-status: REVALIDATED
last-modified: Wed, 15 Feb 2023 07:46:48 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "63ec8de8-12d68"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SSWjX1CtaKz2LvGdDDbsTgdILMkxXXtlmITQoz8k4kOTX4uFkKMCw%2BuyN0K%2BQ8HQHk2SCBiQfXh5xzrc14%2FQLwu9Mua20Try9I6p57wsLjQ%2FnRN48W7WgoEKKUmEQHrqfAAN4eXjrqI%2FvAYta6M4szkI"}],"group":"cf-nel","max_age":604800}
content-type: application/octet-stream
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 80c37459de7c6a02-MAD
alt-svc: h3=":443"; ma=86400
content-length: 77160

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 85ms
22ms Script
text/javascript 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-59069958-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 25 Sep 2023 11:44:21 GMT
last-modified: Mon, 12 Jun 2023 18:23:07 GMT
server: Golfe2
age: 4611
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Mon, 25 Sep 2023 13:44:21 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 201 KB
74 KB 44ms
40ms Script
application/javascript 2a00:1450:4001:82b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-8ZWTX5HC4Z&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-59069958-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

6b43f0dbd831c384a0e5b33a93d763fc96c91cb912f9d97bb30fb13374449d76

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:12 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 75526
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 25 Sep 2023 13:01:12 GMT

GET
H2 200 a
www.googletagmanager.com/ 0
59 B 37ms
34ms Image
text/html 2a00:1450:4001:82b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.googletagmanager.com/a?id=UA-59069958-1&v=3&t=t&pid=353859422&cv=1&rv=39k2&tc=1&es=1&e=gtm.init_consent&eid=0&ut=AABA&h=Ag&dl=securityaffairs.com%2F151360%2Fmalware%2Fbbtok-trojan-latam.html&tdp=UA-59069958-1;;0;0;0&z=0

Requested by

Host: securityaffairs.com
URL: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:12 GMT
server: Google Tag Manager
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 204 td
www.googletagmanager.com/ 0
128 B 154ms
151ms Image
image/gif 2a00:1450:4001:82b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.googletagmanager.com/td?id=UA-59069958-1&v=3&t=t&pid=353859422&cv=1&rv=39k2&tc=1&es=1&e=gtm.init_consent&eid=0&ut=AABA&h=Ag&dl=securityaffairs.com%2F151360%2Fmalware%2Fbbtok-trojan-latam.html&tdp=UA-59069958-1;;0;0;0&z=0
Requested by: Host: securityaffairs.com
URL: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:82b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Sep 2023 13:01:12 GMT
server: Golfe2
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 a
www.googletagmanager.com/ 0
49 B 54ms
51ms Image
text/html 2a00:1450:4001:82b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.googletagmanager.com/a?id=UA-59069958-1&v=3&t=t&pid=353859422&cv=1&rv=39k2&tc=1&es=1&e=gtm.init&eid=1&ut=AABA&h=Ag&z=0

Requested by

Host: securityaffairs.com
URL: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:12 GMT
server: Google Tag Manager
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 a
www.googletagmanager.com/ 0
49 B 53ms
51ms Image
text/html 2a00:1450:4001:82b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.googletagmanager.com/a?id=UA-59069958-1&v=3&t=t&pid=353859422&cv=1&rv=39k2&tc=1&es=1&e=gtm.js&eid=2&ut=AABA&h=Ag&tr=1rep&ti=1rep&z=0

Requested by

Host: securityaffairs.com
URL: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:12 GMT
server: Google Tag Manager
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 a
www.googletagmanager.com/ 0
40 B 54ms
52ms Image
text/html 2a00:1450:4001:82b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.googletagmanager.com/a?id=UA-59069958-1&v=3&t=t&pid=353859422&cv=1&rv=39k2&tc=1&es=1&e=gtag.config&eid=4&ut=AABA&h=Ag&epr=1UA&z=0

Requested by

Host: securityaffairs.com
URL: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:12 GMT
server: Google Tag Manager
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 a
www.googletagmanager.com/ 0
49 B 60ms
57ms Image
text/html 2a00:1450:4001:82b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.googletagmanager.com/a?id=UA-59069958-1&v=3&t=t&pid=353859422&cv=1&rv=39k2&tc=1&es=1&e=gtag.config&eid=5&ut=AABA&h=Ag&z=0

Requested by

Host: securityaffairs.com
URL: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:12 GMT
server: Google Tag Manager
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

POST
H2 204 collect
region1.analytics.google.com/g/ 0
256 B 78ms
28ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-NPN4VEKBTY&gtm=45je39k2&_p=1989497489&_gaz=1&gdid=dZTNiMT&cid=1615253632.1695646873&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1695646872&sct=1&seg=0&dl=https%3A%2F%2Fsecurityaffairs.com%2F151360%2Fmalware%2Fbbtok-trojan-latam.html%3F_gl%3D1&dt=New%20variant%20of%20BBTok%20Trojan%20targets%20users%20of%20%2B40%20banks%20in%20LATAM&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-NPN4VEKBTY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Sep 2023 13:01:12 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://securityaffairs.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
256 B 88ms
28ms Ping
text/plain 2a00:1450:400c:c07::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-NPN4VEKBTY&cid=1615253632.1695646873&gtm=45je39k2&aip=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-NPN4VEKBTY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c07::9b Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Sep 2023 13:01:12 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://securityaffairs.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
408 B 99ms
48ms Image
image/gif 2a00:1450:4001:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-NPN4VEKBTY&cid=1615253632.1695646873&gtm=45je39k2&aip=1&z=1304764342

Requested by

Host: securityaffairs.com
URL: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Sep 2023 13:01:12 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 show_ads_impl_with_ama_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202309140101/ 379 KB
129 KB 128ms
85ms Script
text/javascript 2a00:1450:4001:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202309140101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-4918072057181794&plah=securityaffairs.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-4918072057181794

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6128e51fab5cf5607409dbe621a4f3dd8dad1527ad7bacd550ffad09b1fcabee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:12 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 131563
x-xss-protection: 0
server: cafe
etag: 5184413144385494418
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Mon, 25 Sep 2023 13:01:12 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20230920/r20190131/ Frame 6675 10 KB
5 KB 75ms
21ms Document
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20230920/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-4918072057181794

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

041fe6e516177e777c651a95708ee4961723db34a974e8be9e6ba597a1313e51

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://securityaffairs.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 84660
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4471
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 24 Sep 2023 13:30:12 GMT
etag: 2603938475786422795
expires: Sun, 08 Oct 2023 13:30:12 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 g.gif
pixel.wp.com/ 50 B
93 B 22ms
21ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?v=ext&blog=29506073&post=151360&tz=0&srv=securityaffairs.com&j=1%3A12.6.1&host=securityaffairs.com&ref=&fcp=1021&rand=0.7776808516685263
Requested by: Host: securityaffairs.com
URL: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

access-control-allow-origin: *
date: Mon, 25 Sep 2023 13:01:12 GMT
cache-control: no-cache
server: nginx
content-length: 50
content-type: image/gif

GET
H3 200 twemoji.js Show response
securityaffairs.com/wp-includes/js/ 17 KB
5 KB 107ms
107ms Script
application/javascript 2606:4700:3031::ac43:8cd3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.com/wp-includes/js/twemoji.js?ver=cc93dd60bf1bcc2ebb77dacd7f181ef3
Requested by: Host: securityaffairs.com
URL: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:8cd3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8a8c0bd86eee0230682ed29c5e30936b6b14ab02e1586692840ef8ea4de9dda6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:12 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 167659
cf-polished: origSize=33089
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Wed, 29 Mar 2023 22:54:43 GMT
server: cloudflare
etag: W/"6424c1b3-8141"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yCmhcqIVz0V6NsONSahZrn99Pk3H49Hb3qkKIldklJgSg5eRmX25QOrDeDIUpDfUpXqLDGJWB1cVWq%2FRIUffQLwpiCP3n5ruutQUh7y2faw37OxBmxo6H%2F2MGSlNYUoP5nPn%2Fw%2BGfPLK4n3S2roVDOHJ"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=604800
cf-ray: 80c3745b889f6a02-MAD
expires: Sat, 30 Sep 2023 14:26:53 GMT

GET
H3 200 wp-emoji.js Show response
securityaffairs.com/wp-includes/js/ 4 KB
2 KB 107ms
107ms Script
application/javascript 2606:4700:3031::ac43:8cd3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://securityaffairs.com/wp-includes/js/wp-emoji.js?ver=cc93dd60bf1bcc2ebb77dacd7f181ef3
Requested by: Host: securityaffairs.com
URL: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:8cd3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1528c535d339849cea1f4b18416229bd962819949c62574dcd184cdfa6d056b2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:12 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 167659
cf-polished: origSize=8969
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Wed, 29 Mar 2023 22:54:43 GMT
server: cloudflare
etag: W/"6424c1b3-2309"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aCYHMhqpTYjDnWuAGNWqrJ6SfUGjVPHrGJuhTQBxOuwSCYtvJ1iDR1Pmm2IlvlzGG%2Bj44cRp%2BkAxtjQ5TSmD%2FjiFgz0gZ1GVnlCa9C3oWJhdk1z7uVSTiUCylQ4jdvDi07xTyi%2BdAZRta1UGoSoW2vGx"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=604800
cf-ray: 80c3745b88a36a02-MAD
expires: Sat, 30 Sep 2023 14:26:53 GMT

GET
H3 200 schema Show response
securityaffairs.com/wp-json/contact-form-7/v1/contact-forms/149934/feedback/ 232 B
774 B 217ms
216ms Fetch
application/json 2606:4700:3031::ac43:8cd3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://securityaffairs.com/wp-json/contact-form-7/v1/contact-forms/149934/feedback/schema

Requested by

Host: securityaffairs.com
URL: https://securityaffairs.com/wp-content/plugins/contact-form-7/includes/js/index.js?ver=5.8

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3031::ac43:8cd3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

804aa2016958413450a7751d3d63ea718f0ed5c5af48b65d765adf9ab2f1b139

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, */*;q=0.1
Referer: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

cf-edge-cache: cache,platform=wordpress
date: Mon, 25 Sep 2023 13:01:13 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server: cloudflare
allow: GET
vary: Origin
content-type: application/json; charset=UTF-8
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dqrtBtRDVEAK0cnZslrK2nvuFGPtlCSczqJ3gys%2FJY7UlZ%2BGhgKqCzOApjaZBeEZLkAdMHZc6rJdVolliSKeNR%2Fvuw0HqFERK9anmcoUcir%2FJDcUHDGixl47CeiAQmWZP4iRbC0decgnT6LbkkU4Zxf%2B"}],"group":"cf-nel","max_age":604800}
access-control-expose-headers: X-WP-Total, X-WP-TotalPages, Link
x-robots-tag: noindex
link: <https://securityaffairs.com/wp-json/>; rel="https://api.w.org/"
access-control-allow-headers: Authorization, X-WP-Nonce, Content-Disposition, Content-MD5, Content-Type
cf-ray: 80c3745b98b06a02-MAD

POST
H2 204 collect
region1.google-analytics.com/g/ 0
54 B 29ms
28ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-8ZWTX5HC4Z&gtm=45je39k2&_p=1989497489&gdid=dZTNiMT&cid=1615253632.1695646873&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1695646872&sct=1&seg=0&dl=https%3A%2F%2Fsecurityaffairs.com%2F151360%2Fmalware%2Fbbtok-trojan-latam.html%3F_gl%3D1&dt=New%20variant%20of%20BBTok%20Trojan%20targets%20users%20of%20%2B40%20banks%20in%20LATAM&en=page_view&_fv=1&_ss=1&_ee=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-8ZWTX5HC4Z&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Sep 2023 13:01:12 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://securityaffairs.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 1 B
208 B 33ms
33ms XHR
text/plain 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&aip=1&a=1989497489&t=pageview&_s=1&dl=https%3A%2F%2Fsecurityaffairs.com%2F151360%2Fmalware%2Fbbtok-trojan-latam.html%3F_gl%3D1&ul=en-us&de=UTF-8&dt=New%20variant%20of%20BBTok%20Trojan%20targets%20users%20of%20%2B40%20banks%20in%20LATAM&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YCDACUABBAAAACAAI~&jid=1295105892&gjid=1145789287&cid=1615253632.1695646873&tid=UA-59069958-1&_gid=1046921585.1695646873&_r=1&gtm=457e39k2&did=dZTNiMT&gdid=dZTNiMT&jsscut=1&z=629971257

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://securityaffairs.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 25 Sep 2023 13:01:12 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://securityaffairs.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 221a5a398da89ace8729d1cd3c481ec7.json Show response
services.vlitag.com/cli/ 42 B
366 B 213ms
162ms XHR
application/json 2606:4700:10::6816:3bc7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://services.vlitag.com/cli/221a5a398da89ace8729d1cd3c481ec7.json?hn=https://securityaffairs.com
Requested by: Host: services.vlitag.com
URL: https://services.vlitag.com/adv1/?q=221a5a398da89ace8729d1cd3c481ec7
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:10::6816:3bc7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a8aceed77aa5379a8c0aa967d53ca428b56a32b222795f7940c3988c8d76c014

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Sep 2023 13:01:13 GMT
cf-cache-status: BYPASS
server: cloudflare
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://securityaffairs.com
cache-control: private, no-cache, no-store, must-revalidate
accept-ranges: bytes
x-robots-tag: noindex, nofollow, noarchive, nosnippet
cf-ray: 80c3745caba9697b-FRA
content-length: 42
alt-svc: h3=":443"; ma=86400
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 405 B
611 B 82ms
30ms Script
text/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=securityaffairs.com&callback=_gfp_s_&client=ca-pub-4918072057181794

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202309140101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-4918072057181794&plah=securityaffairs.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

61ab87dcaed48490bcfc166bebecc8b4cab7ae713a7ad21af1726ca0da0b83d9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 259
x-xss-protection: 0

GET
H2 403 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 1C43 603 B
218 B 196ms
195ms Document
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4918072057181794&output=html&adk=1812271804&adf=3025194257&lmt=1695639673&plat=1%3A16777216%2C3%3A16%2C4%3A16%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&format=0x0&url=https%3A%2F%2Fsecurityaffairs.com%2F151360%2Fmalware%2Fbbtok-trojan-latam.html%3F_gl%3D1&ea=0&pra=5&wgl=1&easpi=0&asro=0&asiscm=1&aslmt=0.4&asamt=-1&asedf=0&asefa=1&aseiel=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695646872794&bpp=3&bdt=464&idt=251&shv=r20230920&mjsv=m202309140101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=7376192788661&frm=20&pv=2&ga_vid=1615253632.1695646873&ga_sid=1695646873&ga_hid=1989497489&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31078144%2C31076995%2C31061690&oid=2&pvsid=12328078764537&tmod=235013682&uas=0&nvt=1&fsapi=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=285

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

00daef3b4a945d15f73efa05e0ce2ca51f2f8252e1da8fae5c2efb0f6dddacce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://securityaffairs.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 46
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 25 Sep 2023 13:01:13 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 123ms
122ms Image
image/gif 2a00:1450:4001:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ach_evt&tn=DIV&id=cookie-law-info-bar&ign=false&pw=1600&ph=1200&x=0&y=1130.4

Requested by

Host: securityaffairs.com
URL: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Sep 2023 13:01:13 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 vl.json Show response
services.vlitag.com/vld/1695614586/ 13 B
274 B 154ms
154ms XHR
application/json 2606:4700:10::6816:3bc7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://services.vlitag.com/vld/1695614586/vl.json?page_url=https%3A%2F%2Fsecurityaffairs.com%2F151360%2Fmalware%2Fbbtok-trojan-latam.html%3F_gl%3D1
Requested by: Host: services.vlitag.com
URL: https://services.vlitag.com/adv1/?q=221a5a398da89ace8729d1cd3c481ec7
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:10::6816:3bc7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 76aacba4eece592e3a3281e69a5762c6f10b527a29fbba5eae5ac091f47ae554

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:13 GMT
cf-cache-status: HIT
last-modified: Mon, 25 Sep 2023 13:01:00 GMT
server: cloudflare
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://securityaffairs.com
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
x-robots-tag: noindex, nofollow, noarchive, nosnippet
cf-ray: 80c3745dac9f697b-FRA
content-length: 13
alt-svc: h3=":443"; ma=86400

GET
H3 200 221a5a398da89ace8729d1cd3c481ec7.json Show response
services.vlitag.com/obj/1695614586/ 38 KB
5 KB 32ms
31ms XHR
application/json 2606:4700:10::6816:3bc7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://services.vlitag.com/obj/1695614586/221a5a398da89ace8729d1cd3c481ec7.json?cc=DE&hn=https://securityaffairs.com
Requested by: Host: services.vlitag.com
URL: https://services.vlitag.com/adv1/?q=221a5a398da89ace8729d1cd3c481ec7
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:10::6816:3bc7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 556a8ad21710d89029a18d9ca6a14ae9d3b7c7d6de10328ab2426da30683f422

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:13 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 25 Sep 2023 04:04:59 GMT
server: cloudflare
age: 26819
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://securityaffairs.com
cache-control: public, immutable, max-age=31536000
x-robots-tag: noindex, nofollow, noarchive, nosnippet
cf-ray: 80c3745daca0697b-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 choice.js Show response
cmp.quantcast.com/choice/pCNAReJk6bG2R/soamaps.com/ 4 KB
2 KB 69ms
22ms Script
application/javascript 2600:9000:211e:1200:9:46dc:4700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cmp.quantcast.com/choice/pCNAReJk6bG2R/soamaps.com/choice.js?tag_version=V2
Requested by: Host: services.vlitag.com
URL: https://services.vlitag.com/adv1/?q=221a5a398da89ace8729d1cd3c481ec7
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:211e:1200:9:46dc:4700:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f2ed80b537e658858b2ebe3ebb7a8ff5fdb21089766a68419c0fc28153daac66

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:00:32 GMT
content-encoding: br
via: 1.1 e6959f77d21557f69683da8f0cd5578a.cloudfront.net (CloudFront)
last-modified: Mon, 11 Sep 2023 08:21:18 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-C2
age: 42
x-amz-server-side-encryption: AES256
etag: W/"80be8c66218699faf47d6f2ee2c359c1"
vary: Access-Control-Request-Headers,Access-Control-Request-Method,Origin,Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=3600
cross-origin-resource-policy: cross-origin
x-amz-cf-id: r5y8zfdXaEEH4jxr-0lnzBjgpsxIJGDkF0WWx69mH6l4kGmjU70eLw==

GET
H2 200 prebid-7.48.0.js Show response
assets.vlitag.com/prebid/default/ 561 KB
172 KB 62ms
61ms Script
application/javascript 2606:4700:10::6816:3bc7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.vlitag.com/prebid/default/prebid-7.48.0.js
Requested by: Host: services.vlitag.com
URL: https://services.vlitag.com/adv1/?q=221a5a398da89ace8729d1cd3c481ec7
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3bc7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 95dbbacaaa6b78654b2b74da75fa16e9986ff82fe674aea184b07e643295c871

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:13 GMT
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Mon, 08 May 2023 07:36:47 GMT
server: cloudflare
age: 1650710
cf-polished: origSize=575587
etag: W/"6458a68f-8c863"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=16070400
cf-ray: 80c3745e0bcec012-WAW
alt-svc: h3=":443"; ma=86400
expires: Wed, 06 Sep 2023 10:59:22 GMT

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 98 KB
29 KB 163ms
113ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: services.vlitag.com
URL: https://services.vlitag.com/adv1/?q=221a5a398da89ace8729d1cd3c481ec7

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

68699e8f6bf49d7c61ef39e4cf20a7eb89a4efde06cfedb6548ca23bde6cae0c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:13 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29332
x-xss-protection: 0
server: cafe
etag: 248 / 19625 / 31078107 / config-hash: 2049490335680743254
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
expires: Mon, 25 Sep 2023 13:01:13 GMT

GET
H2 200 ima3.js Show response
imasdk.googleapis.com/js/sdkloader/ 358 KB
123 KB 83ms
32ms Script
text/javascript 2a00:1450:4001:829::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/sdkloader/ima3.js

Requested by

Host: services.vlitag.com
URL: https://services.vlitag.com/adv1/?q=221a5a398da89ace8729d1cd3c481ec7

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0bfbbc57a6a01182f738b9d582dd16a6b1075954a501f8c995af2a7e5b40d56e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 125688
x-xss-protection: 0
expires: Mon, 25 Sep 2023 13:01:13 GMT

GET
H2 200 sf_host.min.js Show response
assets.vlitag.com/plugins/safeframe/src/js/ 38 KB
17 KB 53ms
53ms Script
application/javascript 2606:4700:10::6816:3bc7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.vlitag.com/plugins/safeframe/src/js/sf_host.min.js
Requested by: Host: services.vlitag.com
URL: https://services.vlitag.com/adv1/?q=221a5a398da89ace8729d1cd3c481ec7
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3bc7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1916cf4455a526aadafd82710bf7304154905dcdf69dd9e0b516a63cc82e27e0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:13 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 01 Nov 2019 05:04:50 GMT
server: cloudflare
age: 1650710
etag: W/"5dbbbcf2-9806"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=16070400
cf-ray: 80c3745e0bcfc012-WAW
alt-svc: h3=":443"; ma=86400
expires: Wed, 06 Sep 2023 10:59:22 GMT

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 255 KB
63 KB 72ms
25ms Script
application/javascript 108.138.1.25
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: services.vlitag.com
URL: https://services.vlitag.com/adv1/?q=221a5a398da89ace8729d1cd3c481ec7
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.1.25 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-1-25.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 241df04a32e1a0a4da58eb35f672c5f0b4e1fa131475803ce3222bf493632d5e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 12:15:31 GMT
content-encoding: gzip
via: 1.1 490f651effcacfa7d80143d3047d794e.cloudfront.net (CloudFront), 1.1 5c0a79476717d213b9c559bafee1c65e.cloudfront.net (CloudFront)
last-modified: Thu, 21 Sep 2023 19:18:12 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P1, FRA56-P6
age: 2743
x-amz-server-side-encryption: AES256
etag: W/"e1caada96468a3b669d0d0cc6ec9a23c"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=3600
x-amz-cf-id: QDTmjhXOxbmgol2OUSy_544O-UOyQhlUWvLt0oXXPolXCNrgonjUeQ==

GET
H2 200 quant.js Show response
secure.quantserve.com/ 22 KB
9 KB 71ms
23ms Script
application/javascript 2620:116:800d:21:e365:4988:e8a7:3270
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.quantserve.com/quant.js
Requested by: Host: cmp.quantcast.com
URL: https://cmp.quantcast.com/choice/pCNAReJk6bG2R/soamaps.com/choice.js?tag_version=V2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:116:800d:21:e365:4988:e8a7:3270 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 7c1b0b0523c8cd715c6a906f13a121cd27392d8e61d58c38c7ceb32ec22e59f4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:13 GMT
content-encoding: gzip
etag: "6ioqmyHWSWLYz5hkRjy8Uw=="
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, max-age=604800
accept-ranges: bytes
expires: Mon, 02 Oct 2023 13:01:13 GMT

GET
H2 200 cmp2.js Show response
cmp.quantcast.com/tcfv2/ 161 KB
42 KB 25ms
25ms Script
text/javascript 2600:9000:211e:1200:9:46dc:4700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cmp.quantcast.com/tcfv2/cmp2.js?referer=soamaps.com
Requested by: Host: cmp.quantcast.com
URL: https://cmp.quantcast.com/choice/pCNAReJk6bG2R/soamaps.com/choice.js?tag_version=V2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:211e:1200:9:46dc:4700:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 8f993d3fed8916a4cfc354833e10d76661047c70c173b348ca2466fcae9a226a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 12:54:20 GMT
content-encoding: br
via: 1.1 e6959f77d21557f69683da8f0cd5578a.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C2
age: 414
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Fri, 22 Sep 2023 18:53:19 GMT
server: AmazonS3
etag: W/"3e6ba8ca7d26dee03bf8acd45a75aa5c"
access-control-max-age: 86400
access-control-allow-methods: GET
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=3600
x-amz-meta-qc-ineu: True
vary: Accept-Encoding
x-amz-cf-id: gHYaxo-LU_xS4Z_-CyXR8FjjowZQOB8hWr6NfLvCogjwFmLNc5WyZA==

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 65ms
22ms XHR
application/javascript 108.138.1.25
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.1.25 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-1-25.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

x-amz-version-id: 9yABOonr2HqHtwbarUcdbIqN0f4A8Qog
content-encoding: gzip
via: 1.1 8d07edb8bf98788bf512d51f8cc554f6.cloudfront.net (CloudFront)
date: Mon, 25 Sep 2023 05:44:56 GMT
x-amz-cf-pop: FRA56-P6
age: 26310
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Tue, 29 Aug 2023 08:30:37 GMT
server: AmazonS3
etag: W/"a4d296427fc806b21335359e398c025c"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
vary: Accept-Encoding,Origin
x-amz-cf-id: bZmgqZvlj5B6-CMvrBjAzb61EJ5Qh9uQZbZHA50jPcnh7I62EdXIxg==

GET
H2 200 cmp-list.json Show response
test.cmp.quantcast.com/GVL-v2/ 10 KB
3 KB 69ms
22ms XHR
application/json 2600:9000:225e:9200:3:a4cd:8380:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://test.cmp.quantcast.com/GVL-v2/cmp-list.json
Requested by: Host: cmp.quantcast.com
URL: https://cmp.quantcast.com/tcfv2/cmp2.js?referer=soamaps.com
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:225e:9200:3:a4cd:8380:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: a1adb5bbcadca48bb4602674363217012a5bf58c50e307c17b4ee6686fac975f

Request headers

Accept: application/json, text/plain, */*
Referer: https://securityaffairs.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 03:00:40 GMT
x-amz-version-id: 3004IbA0w7seFKQa3F_D1Quhyo4HyxHo
content-encoding: gzip
via: 1.1 a3c1615d6bdfc01a05a0b3a742d10d38.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P4
age: 36034
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Mon, 11 Sep 2023 19:52:29 GMT
server: AmazonS3
etag: W/"f53c470cca15f4883cb7c656c8403121"
access-control-max-age: 86400
access-control-allow-methods: GET
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=172800
vary: Accept-Encoding
x-amz-cf-id: QbQs1VZrYTkBk0qn9r3ykcVfjKrHfniiAjPzzgDWl5tDQgQKioHfJA==

GET
H2 200 rules-p-pCNAReJk6bG2R.js Show response
rules.quantcount.com/ 160 B
633 B 70ms
22ms Script
application/javascript 2600:9000:223c:f000:6:44e3:f8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-pCNAReJk6bG2R.js
Requested by: Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223c:f000:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f76335e8788f66c0efc72c2d0db22496f8983e7ce66aaaa7c179f65fa08e5dae

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 12:15:35 GMT
via: 1.1 4d0ae7ca3bb5e2d6eaa1450e1906adb4.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P2
age: 2738
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 160
last-modified: Mon, 11 Sep 2023 08:08:12 GMT
server: AmazonS3
etag: "6436459cd8f96c5ded3826f77d21a550"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=3600
accept-ranges: bytes
x-amz-cf-id: CUG36o-KOvCd7hO0hUOU-gP9QJeoUgv4CkvSNL0C06ARpSPzaOmjxA==

GET
H2 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202309210101/ 409 KB
129 KB 21ms
21ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202309210101/pubads_impl.js?cb=31078107

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

17a60971acd82c65cd57863f07cbc2fc9124483c6fb6f9bfa270019c058a479c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 10:38:01 GMT
content-encoding: br
x-content-type-options: nosniff
age: 8592
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 132106
x-xss-protection: 0
server: cafe
etag: 17184539905708832606
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
expires: Tue, 24 Sep 2024 10:38:01 GMT

GET
H2 200 9cf0c4f1-7630-476b-9141-f4472e005192 Show response
config.aps.amazon-adsystem.com/configs/ 537 B
801 B 85ms
23ms Script
application/javascript 99.86.4.30
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://config.aps.amazon-adsystem.com/configs/9cf0c4f1-7630-476b-9141-f4472e005192
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.30 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-30.fra6.r.cloudfront.net
Software: CloudFront /
Resource Hash: 8cb19dd370d8a0dd9ee570e546a789c88840bd443082943f099e4c87cdfff2bf

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 12:19:30 GMT
via: 1.1 35c75b7f0ca8c787d67c8ebd22bc7fc2.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: FRA6-C1
age: 2503
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=3600
content-length: 537
x-amz-cf-id: 3N_nTHop2rNEsnsfg-w38KSIFAu1Or5e8BauJC901JQlU55Vo-MpcA==

GET config
c.amazon-adsystem.com/cdn/prod/ 0
0

GET
H2 200 latest.json Show response
cdn.jsdelivr.net/gh/prebid/currency-file@1/ 2 KB
2 KB 75ms
27ms XHR
application/json 2606:4700::6810:5514
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/prebid/currency-file@1/latest.json?date=20230925

Requested by

Host: assets.vlitag.com
URL: https://assets.vlitag.com/prebid/default/prebid-7.48.0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5514 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0178865b3be274d0714e61b7af67ee681df3a384f4dde03ea85d61ec97942567

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://securityaffairs.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 25 Sep 2023 13:01:13 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 32424
x-jsd-version: 1.0.1823
content-encoding: br
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-eddf8230103-FRA, cache-jnb7022-JNB
x-jsd-version-type: version
server: cloudflare
etag: W/"63f-9RDZGmVvcyaQiKO+uc/puC3XVIE"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gtQqTINbeO7hBPq1DniQjnzuo%2BoAapkQh0oy6R2%2BBmZfuK4OKZGOndCKmgY8RoW0JSuCZfC3ZdmD4eNBh8YgGe6r6y9tiej3Mx4U3aCUC5CJJj5LMWoz2%2F9kS2%2FIRkUBkczrupMwCehznhh3mCI%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
cf-ray: 80c3745f9eac373d-FRA

GET
H2 200 tf-v1.jpeg
px.vliplatform.com/ 0
275 B 197ms
148ms Image
image/jpeg 2606:4700:3037::ac43:9e3b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.vliplatform.com/tf-v1.jpeg?e=rNYPPaBRrtNrtl0zghRzodtgxzNTAAAR_qkyNBAAAAR_ksdNloufqsR_hgeNgfR_cysNgfR_udgrNofcotvR_qszNsqmn_sgqrR_hwkNoykqdtR_wktjNryhR_cktjNryhR_qdmNgfRzdNYqBYAUUU-ZTTP-PBAa-weeB-UKKtBtUAYUtBRzyzNhqut_cotvRws0NA
Requested by: Host: securityaffairs.com
URL: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3037::ac43:9e3b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:13 GMT
cf-cache-status: MISS
last-modified: Mon, 25 Sep 2023 13:01:13 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=O%2BZ6OSE9fFQEY9OUwv0Xu9fxsftZNvGKXLec%2BsxnUiKV%2F0gZb1vbO1U%2FxKMvC46dmIaFaPiN3lnyrMXlbVIqPcsqLnXUSLHhZ%2FoY45g5c7GTyHMh1UEPAO9EzWHognamBDXmWlkfFeD7mVOU%2BrmZmA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=864000, immutable
accept-ranges: bytes
x-robots-tag: noindex, nofollow, noarchive, nosnippet
cf-ray: 80c3745fdd964dc4-FRA
content-length: 0
alt-svc: h3=":443"; ma=86400

GET
H2 200 cc.jpeg
px.vliplatform.com/bi-v4/ 0
268 B 197ms
148ms Image
image/jpeg 2606:4700:3037::ac43:9e3b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.vliplatform.com/bi-v4/cc.jpeg?e=rNYPPaBRrtNrtl0zghRzodtgxzNTAAAR_qkyNBAAAAR_ksdNloufqsR_hgeNgfR_cysNgfR_udgrNofcotvR_qszNsqmn_sgqrR_hwkNoykqdtR_wktjNryhR_cktjNryhR_qdmNgfRzdNaBBrwZqa-ZMBP-PZBK-aBKY-rKKrYtKKTawMRdzNcortg%20oflzktqdRlmNUPAbPMARwlNqdqmgfRkjmNUPAbPMARrdzNqdqmgfRwkjNARmNTAaPYTRleNplR_yszuNyqslt
Requested by: Host: securityaffairs.com
URL: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3037::ac43:9e3b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:13 GMT
cf-cache-status: MISS
last-modified: Mon, 25 Sep 2023 13:01:13 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9ktAJ121rknuYWgEcFDMvdkM1qYlIcVAniV0rrAxiQnwo4thyG7VZDzxmW0xm0tVouvv%2BhX96HDpDR8ys4TNtHJ3vMglCyXERhmasDNxBuchbi7vrMDQeQwQwoWvtjauhZdak%2BdXcsIvKAw%2FufCgag%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=864000, immutable
accept-ranges: bytes
x-robots-tag: noindex, nofollow, noarchive, nosnippet
cf-ray: 80c3745fdd9c4dc4-FRA
content-length: 0
alt-svc: h3=":443"; ma=86400

GET
H2 200 cc.jpeg
px.vliplatform.com/bi-v4/ 0
268 B 199ms
151ms Image
image/jpeg 2606:4700:3037::ac43:9e3b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.vliplatform.com/bi-v4/cc.jpeg?e=rNYPPaBRrtNrtl0zghRzodtgxzNTAAAR_qkyNBAAAAR_ksdNloufqsR_hgeNgfR_cysNgfR_udgrNofcotvR_qszNsqmn_sgqrR_hwkNoykqdtR_wktjNryhR_cktjNryhR_qdmNgfRzdNrABTtBZq-BaTt-PPaT-qAyZ-tZAeqtZUYParRdzNwqfftkRlmNBBUbPMARwlNqdqmgfRkjmNBBUbYMA,BAAbYZARrdzNqdqmgfRwkjNARmNTAaPYTRleNplR_yszuNyqslt
Requested by: Host: securityaffairs.com
URL: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3037::ac43:9e3b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:13 GMT
cf-cache-status: MISS
last-modified: Mon, 25 Sep 2023 13:01:13 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0y7hrY5HahONPBFjYSF19HR6NC7R6CANZ909tsQIwZ5UB%2FmwSmPFhnXWFWMpxotFlGRDZMm1o2s7rVz15Qi11MtfXlat2glLW3pAPiis9x6EPM9yGwNfKCriTT49Y86iQ8OFhP5gE%2F%2FeovFgzNSvGw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=864000, immutable
accept-ranges: bytes
x-robots-tag: noindex, nofollow, noarchive, nosnippet
cf-ray: 80c3745fdd994dc4-FRA
content-length: 0
alt-svc: h3=":443"; ma=86400

GET
H2 200 cc.jpeg
px.vliplatform.com/bi-v4/ 0
269 B 192ms
151ms Image
image/jpeg 2606:4700:3037::ac43:9e3b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.vliplatform.com/bi-v4/cc.jpeg?e=rNYPPaBRrtNrtl0zghRzodtgxzNTAAAR_qkyNBAAAAR_ksdNloufqsR_hgeNgfR_cysNgfR_udgrNofcotvR_qszNsqmn_sgqrR_hwkNoykqdtR_wktjNryhR_cktjNryhR_qdmNgfRzdNArTPtyMZ-ZMUt-PMPK-MZUM-twPtTZeqeUtKRdzNwqfftkRlmNaKAbaARwlNqdqmgfRkjmNaKAbaARrdzNqdqmgfRwkjNARmNTAMBMBRleNplR_yszuNyqslt
Requested by: Host: securityaffairs.com
URL: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3037::ac43:9e3b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:13 GMT
cf-cache-status: MISS
last-modified: Mon, 25 Sep 2023 13:01:13 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PrnJxwa9CojJ0zq4uRkjUbXAiWOCX6aLtIcWmKJCuOFQzfOFJ3bfx9orjRRpp2bFqU09%2FEAdJVrmq51CqpaNxy0tK%2FcTSzIIfKvnOY80GPobZX3AMyUkxGQjdEyhLWOGBIDOWmQt9Gyw0pR2oAtPzQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=864000, immutable
accept-ranges: bytes
x-robots-tag: noindex, nofollow, noarchive, nosnippet
cf-ray: 80c3745fdd974dc4-FRA
content-length: 0
alt-svc: h3=":443"; ma=86400

GET
H2 200 cc.jpeg
px.vliplatform.com/bi-v4/ 0
269 B 190ms
149ms Image
image/jpeg 2606:4700:3037::ac43:9e3b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.vliplatform.com/bi-v4/cc.jpeg?e=rNYPPaBRrtNrtl0zghRzodtgxzNTAAAR_qkyNBAAAAR_ksdNloufqsR_hgeNgfR_cysNgfR_udgrNofcotvR_qszNsqmn_sgqrR_hwkNoykqdtR_wktjNryhR_cktjNryhR_qdmNgfRzdNeAerrBwM-MMrY-PYTa-qPUq-ByarMyZqMZryRdzNwqfftkRlmNKYMbaARwlNqdqmgfRkjmNKYMbaARrdzNqdqmgfRwkjNARmNTAMBMBRleNplR_yszuNyqslt
Requested by: Host: securityaffairs.com
URL: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3037::ac43:9e3b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:13 GMT
cf-cache-status: MISS
last-modified: Mon, 25 Sep 2023 13:01:13 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0uYAFd8njcryps%2F2cmmXrejIwkuC6h4GotHrmEeTy8gmE8zWR25AaDUg8EL%2BsWtmuLICOW1mpjMkLA6njTuWtzScrls36VzDjf9P8qh%2Fmkgv8O%2FC3Y3cg84NUxvVnzpUodm6SenZirELdnlIZ6TBKA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=864000, immutable
accept-ranges: bytes
x-robots-tag: noindex, nofollow, noarchive, nosnippet
cf-ray: 80c3745fdd9a4dc4-FRA
content-length: 0
alt-svc: h3=":443"; ma=86400

GET
H2 200 cmp2ui-en.js Show response
cmp.quantcast.com/tcfv2/48/ 280 KB
69 KB 24ms
24ms Script
text/javascript 2600:9000:211e:1200:9:46dc:4700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cmp.quantcast.com/tcfv2/48/cmp2ui-en.js
Requested by: Host: cmp.quantcast.com
URL: https://cmp.quantcast.com/tcfv2/cmp2.js?referer=soamaps.com
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:211e:1200:9:46dc:4700:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 50734506a34b0e426971e5d9c3ed835819150112fe4f58c981f94ed4502c92c0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 18:54:20 GMT
content-encoding: br
via: 1.1 e6959f77d21557f69683da8f0cd5578a.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C2
age: 65214
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
last-modified: Fri, 22 Sep 2023 18:52:46 GMT
server: AmazonS3
etag: W/"d64dd4280705bd236d787bc9397cdadc"
access-control-max-age: 604800
access-control-allow-methods: GET
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=172800
vary: Accept-Encoding
x-amz-cf-id: XehbMPSXwRTNXLNObjtNsbEIAyxCUa306oVkDF26ZFSOZG462LnUyw==

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 23 B
465 B 106ms
59ms XHR
text/javascript 52.222.209.4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fsecurityaffairs.com%2F151360%2Fmalware%2Fbbtok-trojan-latam.html%3F_gl%3D1&pid=QYKXj3Kv1kVA1&cb=0&ws=1600x1200&v=23.919.1525&t=1000&slots=%5B%7B%22fc%22%3A%22USD%22%2C%22fp%22%3A1%2C%22id%22%3A%22Interdog_Media_RON_Instream%22%2C%22mt%22%3A%22v%22%2C%22s%22%3A%5B%22640x480%22%5D%7D%2C%7B%22sd%22%3A%22vi_24493109421_banner%22%2C%22s%22%3A%5B%22336x280%22%2C%22300x250%22%5D%2C%22sn%22%3A109421%2C%22fc%22%3A%22USD%22%2C%22fp%22%3A1%7D%5D&schain=1.0%2C1!pubpower.io%2C2108%2C1%2C%2C%2C&pubid=9cf0c4f1-7630-476b-9141-f4472e005192&gdpre=1&gdprl=%7B%22status%22%3A%22tcfv2-success%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.209.4 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-209-4.fra56.r.cloudfront.net

Software

Server /

Resource Hash

745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:13 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 102d8cf947b68167e34dd1299c206242.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA56-P3
x-amz-rid: 0BYNP3VJWQFE1G9Q6ERE
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://securityaffairs.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 23
x-amz-cf-id: 4NvTrFURVQZELrN1w6YBizs7Va6r0OZQGdY06vVHcbzS8S5t1okFtQ==

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 23 B
464 B 106ms
63ms XHR
text/javascript 52.222.209.4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fsecurityaffairs.com%2F151360%2Fmalware%2Fbbtok-trojan-latam.html%3F_gl%3D1&pid=QYKXj3Kv1kVA1&cb=1&ws=1600x1200&v=23.919.1525&t=1000&slots=%5B%7B%22sd%22%3A%22vi_24493108383_7%22%2C%22s%22%3A%5B%22970x90%22%5D%2C%22sn%22%3A108383%2C%22fc%22%3A%22USD%22%2C%22fp%22%3A1%7D%2C%7B%22sd%22%3A%22vi_24493108383_8%22%2C%22s%22%3A%5B%22728x90%22%5D%2C%22sn%22%3A108383%2C%22fc%22%3A%22USD%22%2C%22fp%22%3A1%7D%5D&schain=1.0%2C1!pubpower.io%2C2108%2C1%2C%2C%2C&pubid=9cf0c4f1-7630-476b-9141-f4472e005192&gdpre=1&gdprl=%7B%22status%22%3A%22tcfv2-success%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.209.4 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-209-4.fra56.r.cloudfront.net

Software

Server /

Resource Hash

89b4aa9e9bf8516c2ab7b5134f65d47b02071637259a14c9f60dccc207e05ce4

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:13 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 102d8cf947b68167e34dd1299c206242.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA56-P3
x-amz-rid: JZM1W66QAYGVR06TC8YD
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://securityaffairs.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 23
x-amz-cf-id: gq4rwZj4Y0UJGoq4FbYRd0fHJX0EygY1KzqTBrRV_677bnwccC6v4g==

GET
H2 200 vendor-list-trimmed-v1.json Show response
cmp.quantcast.com/GVL-v3/ 499 KB
56 KB 74ms
26ms XHR
application/json 2600:9000:211e:1200:9:46dc:4700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cmp.quantcast.com/GVL-v3/vendor-list-trimmed-v1.json
Requested by: Host: cmp.quantcast.com
URL: https://cmp.quantcast.com/tcfv2/cmp2.js?referer=soamaps.com
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:211e:1200:9:46dc:4700:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f7b42826dba0d886667e61ebac93496e4d14c3b2b4975cc4af442d9e907e3c92

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 23:59:16 GMT
content-encoding: br
via: 1.1 0d5d2d408eb42296c7636196e25ef8a2.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C2
age: 46918
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Thu, 21 Sep 2023 23:59:11 GMT
server: AmazonS3
etag: W/"8007d563ec28960639287a14ae66aac8"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=86400
access-control-allow-credentials: true
vary: Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
x-amz-cf-id: VG8Ws_HXaJLU9klzy0V4ywfB5KfzD-t34wIHpW62jEvJfXgyy6JXQw==

GET
H2 200 google-atp-list.json Show response
cmp.quantcast.com/tcfv2/ 140 KB
33 KB 97ms
51ms XHR
application/json 2600:9000:211e:1200:9:46dc:4700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cmp.quantcast.com/tcfv2/google-atp-list.json
Requested by: Host: cmp.quantcast.com
URL: https://cmp.quantcast.com/tcfv2/cmp2.js?referer=soamaps.com
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:211e:1200:9:46dc:4700:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 2815fd327b4409bd949048381f5b18e77b6ee064058d833607680a1fe7097acc

Request headers

Accept: application/json, text/plain, */*
Referer: https://securityaffairs.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 03:00:29 GMT
content-encoding: br
via: 1.1 0d5d2d408eb42296c7636196e25ef8a2.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C2
age: 36045
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Mon, 25 Sep 2023 03:00:26 GMT
server: AmazonS3
etag: W/"167efbfe1ee5e358ec48d7d6839b4afb"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=172800
access-control-allow-credentials: true
vary: Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
x-amz-cf-id: pRkCvmGNU8Yfyj5MJEcsYq-5cL2voEwEgvzAge5Op4qA5GlDjX0fBw==

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 23 B
465 B 93ms
63ms XHR
text/javascript 52.222.209.4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fsecurityaffairs.com%2F151360%2Fmalware%2Fbbtok-trojan-latam.html%3F_gl%3D1&pid=QYKXj3Kv1kVA1&cb=2&ws=1600x1200&v=23.919.1525&t=1000&slots=%5B%7B%22sd%22%3A%22vi_24493107667_1%22%2C%22s%22%3A%5B%22300x250%22%2C%22250x250%22%5D%2C%22sn%22%3A107667%2C%22fc%22%3A%22USD%22%2C%22fp%22%3A1%7D%5D&schain=1.0%2C1!pubpower.io%2C2108%2C1%2C%2C%2C&pubid=9cf0c4f1-7630-476b-9141-f4472e005192&gdpre=1&gdprl=%7B%22status%22%3A%22tcfv2-success%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.209.4 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-209-4.fra56.r.cloudfront.net

Software

Server /

Resource Hash

5d7c7d25a0da74c0dd466120c3c09bd94cb982fc66ebc4a78675339f37323bf5

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:13 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 102d8cf947b68167e34dd1299c206242.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA56-P3
x-amz-rid: XA47ETG48YEJFWG3HV1M
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://securityaffairs.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 23
x-amz-cf-id: mbH_RkJXKRBWCBQ5ABoFBFLut47wWy9YcHDkTlsnHYPD1VwF8OLZoA==

GET
H2 200 cc.jpeg
px.vliplatform.com/bi-v4/ 0
276 B 157ms
150ms Image
image/jpeg 2606:4700:3037::ac43:9e3b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.vliplatform.com/bi-v4/cc.jpeg?e=rNYPPaBRrtNrtl0zghRzodtgxzNTAAAR_qkyNBAAAAR_ksdNloufqsR_hgeNgfR_cysNgfR_udgrNofcotvR_qszNsqmn_sgqrR_hwkNoykqdtR_wktjNryhR_cktjNryhR_qdmNgfRzdNayrAyPAy-yTUt-PTYt-aUMK-TKKZrywPPTewRdzNwqfftkRlmNBAAbYZARwlNqdqmgfRkjmNBAAbYZA,YZAbYZARrdzNqdqmgfRwkjNARmNTAKUUKRleNplR_yszuNyqsltRedhNgfRedh_ygkdqzNtdhznRedh_lgxketNcsoRedh_znhtNurhkRxltk_qeethzNfgRzey_ctkNcY
Requested by: Host: securityaffairs.com
URL: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3037::ac43:9e3b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:13 GMT
cf-cache-status: MISS
last-modified: Mon, 25 Sep 2023 13:01:13 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8%2BZ9z8W%2FJwVOC%2FJE61D7nF3JmN9c2R6ACkSGoFn0X%2Fw32jVDAwKrs2GM3yX4IYmuhiWtp2zcODZ%2BcXLQc3SxIN%2FqBvv3WXOMd5X7L4henDlAPCUk1Dw5ye1GW7BwCxb%2FpdzeTfTTAjmg8ERF3f3akg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=864000, immutable
accept-ranges: bytes
x-robots-tag: noindex, nofollow, noarchive, nosnippet
cf-ray: 80c3745fdd984dc4-FRA
content-length: 0
alt-svc: h3=":443"; ma=86400

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 23 B
465 B 81ms
60ms XHR
text/javascript 52.222.209.4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fsecurityaffairs.com%2F151360%2Fmalware%2Fbbtok-trojan-latam.html%3F_gl%3D1&pid=QYKXj3Kv1kVA1&cb=3&ws=1600x1200&v=23.919.1525&t=1000&slots=%5B%7B%22sd%22%3A%22vi_24493111310_1%22%2C%22s%22%3A%5B%22970x90%22%2C%22728x90%22%2C%22468x60%22%5D%2C%22sn%22%3A111310%2C%22fc%22%3A%22USD%22%2C%22fp%22%3A1%7D%5D&schain=1.0%2C1!pubpower.io%2C2108%2C1%2C%2C%2C&pubid=9cf0c4f1-7630-476b-9141-f4472e005192&gdpre=1&gdprl=%7B%22status%22%3A%22tcfv2-success%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.209.4 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-209-4.fra56.r.cloudfront.net

Software

Server /

Resource Hash

1c4777fe3a673a05492e27d08032cc91c23ac5389897c9235b09b8b0f5a74db3

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:13 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 102d8cf947b68167e34dd1299c206242.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA56-P3
x-amz-rid: TENP55QTFKJV3CA73YHM
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://securityaffairs.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 23
x-amz-cf-id: WvjB2bVU80rxcL78NjzXwRALr5XRANpiXoO-jXQNvrRCP9fqcDzNtg==

GET
H2 200 cc.jpeg
px.vliplatform.com/bi-v4/ 0
528 B 147ms
147ms Image
image/jpeg 2606:4700:3037::ac43:9e3b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.vliplatform.com/bi-v4/cc.jpeg?e=rNYPPaBRrtNrtl0zghRzodtgxzNTAAAR_qkyNBAAAAR_ksdNloufqsR_hgeNgfR_cysNgfR_udgrNofcotvR_qszNsqmn_sgqrR_hwkNoykqdtR_wktjNryhR_cktjNryhR_qdmNgfRzdNeKUKAetY-tara-Pwqy-qBrr-KTZwYeMZwaTURdzNwqfftkRlmNaKAbaARwlNqdqmgfRkjmNaKAbaA,KYMbaA,PUMbUARrdzNqdqmgfRwkjNARmNTTTBTARleNplR_yszuNyqsltRedhNgfRedh_ygkdqzNtdhznRedh_lgxketNcsoRedh_znhtNurhkRxltk_qeethzNfgRzey_ctkNcY
Requested by: Host: securityaffairs.com
URL: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3037::ac43:9e3b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:13 GMT
cf-cache-status: MISS
last-modified: Mon, 25 Sep 2023 13:01:13 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7koMNT2qQuL75zSQiAu5mf15iju1alCTzPd%2FiCdrUBTlB46QvNk2mUkwCJ6TFRLnWaYWLlqdmJOZMa2mMC14x0eyG7ROmFL%2BDrEwKRWAaKpPyYmBhpcbEC59ck7%2B4FX20%2BK%2BIdD2QWxAmg4tSTQr%2Bw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=864000, immutable
accept-ranges: bytes
x-robots-tag: noindex, nofollow, noarchive, nosnippet
cf-ray: 80c3745fdd9d4dc4-FRA
content-length: 0
alt-svc: h3=":443"; ma=86400

GET
H2 200 / Show response
audit-tcfv2.cmp.quantcast.com/ 2 B
101 B 73ms
23ms XHR
text/plain 18.197.180.30
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://audit-tcfv2.cmp.quantcast.com/?log=%7B%22accountId%22%3A%22pCNAReJk6bG2R%22%2C%22domain%22%3A%22securityaffairs.com%22%2C%22publisher%22%3A%22Privacy%22%2C%22cmpId%22%3A10%2C%22cmpVersion%22%3A%222.48%22%2C%22displayType%22%3A%22tcfui%3Amandatory%22%2C%22configurationHashCode%22%3A%22r%2BMOJ0bEosHXO9%2BmuMZCZA%22%2C%22tagVersion%22%3A%22V2%22%2C%22clientTimestamp%22%3A1695646873625%2C%22operationType%22%3A%22init%22%2C%22sessionId%22%3A%22GDPR-0rlnypdksse2fhz4pw1t%22%7D
Requested by: Host: cmp.quantcast.com
URL: https://cmp.quantcast.com/tcfv2/48/cmp2ui-en.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.197.180.30 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-197-180-30.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Accept: application/json, text/plain, */*
Referer: https://securityaffairs.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

access-control-allow-origin: *
date: Mon, 25 Sep 2023 13:01:13 GMT
content-length: 2
content-type: text/plain; charset=utf-8

GET
H3 200 refill Show response
securityaffairs.com/wp-json/contact-form-7/v1/contact-forms/149934/ 2 B
631 B 112ms
112ms Fetch
application/json 2606:4700:3031::ac43:8cd3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://securityaffairs.com/wp-json/contact-form-7/v1/contact-forms/149934/refill

Requested by

Host: securityaffairs.com
URL: https://securityaffairs.com/wp-content/plugins/contact-form-7/includes/js/index.js?ver=5.8

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3031::ac43:8cd3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, */*;q=0.1
Referer: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

cf-edge-cache: cache,platform=wordpress
date: Mon, 25 Sep 2023 13:01:13 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server: cloudflare
allow: GET
vary: Origin
content-type: application/json; charset=UTF-8
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iQurNzXumnryXqEobCDNG3u%2B4L2wSM7S%2BIWq4cjkB9zrUdaAzXOZpNSV%2BPFP99AhyJMn10EjxuTsXWi2NYn22QZAI1kVWDM2A9a8FMYWAsR84CZqpWpE3Dl4zJptCSJNvaEl14HJxO0yVqW%2BouGAe%2FjR"}],"group":"cf-nel","max_age":604800}
access-control-expose-headers: X-WP-Total, X-WP-TotalPages, Link
x-robots-tag: noindex
link: <https://securityaffairs.com/wp-json/>; rel="https://api.w.org/"
access-control-allow-headers: Authorization, X-WP-Nonce, Content-Disposition, Content-MD5, Content-Type
cf-ray: 80c37460d8216a02-MAD

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 16 KB
12 KB 82ms
82ms XHR
application/json 2a00:1450:4001:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20230920&st=env

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4293e3413e191b0d37d827129822fad3ba2e35edc2ffb3d086021cb8206d418a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:13 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12129
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 95ms
43ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 25 Sep 2023 13:01:13 GMT

GET
H2 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 8E1B 13 KB
5 KB 23ms
22ms Document
text/html 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://securityaffairs.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 4721
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 25 Sep 2023 11:42:32 GMT
expires: Tue, 24 Sep 2024 11:42:32 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame C6CA 829 B
1 KB 82ms
32ms Document
text/html 2a00:1450:4001:802::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

83c766afcb10d107921e5178ad471583ce980018dccb1c58bf9d1f272e647c77

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-A9JGKo4TMxz48eNK3oRq_A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://securityaffairs.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-A9JGKo4TMxz48eNK3oRq_A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Mon, 25 Sep 2023 13:01:13 GMT
expires: Mon, 25 Sep 2023 13:01:13 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 tGcDLxZnxcZjneq6ZTfMhLSKmVRaNAcBIKHxIKG0fIc.js Show response
pagead2.googlesyndication.com/bg/ Frame 8E1B 37 KB
14 KB 22ms
21ms Script
text/javascript 2a00:1450:4001:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/tGcDLxZnxcZjneq6ZTfMhLSKmVRaNAcBIKHxIKG0fIc.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b467032f1667c5c6639deaba6537cc84b48a99545a34070120a1f120a1b47c87

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 11:42:33 GMT
content-encoding: br
x-content-type-options: nosniff
age: 4720
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14772
x-xss-protection: 0
last-modified: Mon, 18 Sep 2023 15:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 24 Sep 2024 11:42:33 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame C6CA 0
0 123ms
122ms Image
text/html 2a00:1450:4001:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20230920&jk=12328078764537&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 8E1B 0
10 B 22ms
21ms Image
text/plain 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?Bsl9vg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:14 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3 200 a
www.googletagmanager.com/ 0
11 B 29ms
29ms Image
text/html 2a00:1450:4001:82b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.googletagmanager.com/a?id=UA-59069958-1&v=3&t=t&pid=353859422&cv=1&rv=39k2&tc=1&es=1&e=gtm.load&eid=14&u=Ag&ut=AABA&h=Ag&z=0

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 13:01:14 GMT
server: Google Tag Manager
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 127ms
127ms Image
text/html 2a00:1450:4001:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20230920&jk=12328078764537&bg=!xMelx4jNAAYrDsWMCw47ADQBe5WfOAvhd_Xo9ygEvl3kHa2vEGLRckJTHZ3jR9vIo2Q4CVU225Rhsf09ZBKC7bvZaxe-AgAAAFtSAAAAB2gBB5kCtWawpTkJ7nv7ihdw9w3USOGp6VAouoJ3uytsyLhkv_Jm_WsI6Nb-i0Z4p9FINA4EqOUOvZlE9BahElqqUmq3guwz39uJgYUF4JUP7Ri0fPNK5BJ_jmbkY8WU2LB-IP5ViuVYv1DyrUM3Pum4UJiWkJMUBCvALCE3PI7nowDnbE5H8Up6nuSW37UWQgEpvYsSFkyQXmeoPJWVIeLo_zKuq0XQyPsDiJOGruaeMXqcaP9yxDcdjv6kq-0RRuvKGK4HNbcKsKUvv-OR3Reu7R2hVtUKwHYVeBKcz-k-dQvarg_Vk0Yr1vOtwaHtTAVIVAEioHFweV6-RAW8AFbbL6EVA9uuV3L5USP3DRv8DvKLu-W64LRy1nrHmAWzWdw9UKbw0IUPCGRnqASK4aABHQkGiUy1shSssFCxpAHlFhUSygHAv983dgJtBreHmG-Dv3rcPxZdFcSgwEr99OF5TTn3DON-7f5AjS6MLGP-9xYBR1GbV5rIA9ebc7y3xgx53vLCNPhLPEMFA-f75uPNU6zPU5oDotSvQYhXNG-JFXsX2SyiGQuH4R43O0dPS7TP95yPOmRxsxIwHgj7bVNPZVWpM5jBCzcd_A4ZlBIuOWiZ-TL-dfAGEfnDIOGbXjEciJk2UG6yzgAHzk-lICeOEd3Rh5Pcf5H6sr7gd6vSvyAZ61TuU8XFBzTjfqHwVJ5uuKnEiPwT7koG2Hz17Zn1S6Vl8S80Kda6MO9aEb1erMHeQsREYMxB0R9MzB56sG7gAyX9-79AKxtgqSFqnrOz2waHRACmLwI-Ro5q3fhN_Jkg-JTb9FzZDiNI9nCVcQ1XM336AhNbdJMkCNWAEcZ_U8YJQgBIXOVOpkLpR-K5Eow8cwVKKY2GL68q-hWSX7-qIXPlSDRRb9QMv82aVRRZlD919UsWK1SJUQ
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://securityaffairs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: l.sharethis.com
URL: https://l.sharethis.com/pview?event=pview&hostname=securityaffairs.com&location=%2F151360%2Fmalware%2Fbbtok-trojan-latam.html&product=unknown&url=https%3A%2F%2Fsecurityaffairs.com%2F151360%2Fmalware%2Fbbtok-trojan-latam.html%3F_gl%3D1&source=sharethis-share-buttons-wordpress&fcmp=false&fcmpv2=false&has_segmentio=false&title=New%20variant%20of%20BBTok%20Trojan%20targets%20users%20of%20%2B40%20banks%20in%20LATAM&cms=unknown&publisher=64b5cd2fd23b930012608ffb&sop=true&version=st_sop.js&lang=en&description=A%20new%20variant%20of%20a%20banking%20trojan%2C%20called%C2%A0BBTok%2C%20targets%20users%20of%20over%2040%20banks%20in%20Latin%20America%2C%20particularly%20Brazil%20and%20Mexico.&ua=&ua_mobile=false&ua_full_version_list=

Domain: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fsecurityaffairs.com&pubid=9cf0c4f1-7630-476b-9141-f4472e005192

Verdicts & Comments Add Verdict or Comment

131 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

11 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.securityaffairs.com/	1970-01-21 00:36:46	Name: _ga_NPN4VEKBTY Value: GS1.1.1695646872.1.0.1695646872.60.0.0
.securityaffairs.com/	1970-01-21 00:36:46	Name: _ga_8ZWTX5HC4Z Value: GS1.1.1695646872.1.0.1695646872.0.0.0
.securityaffairs.com/	1970-01-21 00:36:46	Name: _ga Value: GA1.2.1615253632.1695646873
.securityaffairs.com/	1970-01-20 15:02:13	Name: _gid Value: GA1.2.1046921585.1695646873
.securityaffairs.com/	1970-01-20 15:00:46	Name: _gat_gtag_UA_59069958_1 Value: 1
securityaffairs.com/	1970-01-20 23:46:22	Name: cookielawinfo-checkbox-necessary Value: yes
securityaffairs.com/	1970-01-20 23:46:22	Name: cookielawinfo-checkbox-non-necessary Value: yes
.securityaffairs.com/	1970-01-21 00:22:22	Name: __gads Value: ID=35921e76a3a6059b-22e126c30fe40024:T=1695646873:RT=1695646873:S=ALNI_MbwZZWzpAS1L8JxcSYLwtzqTnnUGA
.securityaffairs.com/	1970-01-21 00:22:22	Name: __gpi Value: UID=00000c86e6675ebe:T=1695646873:RT=1695646873:S=ALNI_Mb2gjHdClH0ttyVm2w1m-EcWo-pWw
securityaffairs.com/	1970-01-20 16:27:10	Name: __ppIdCC Value: aexuritywddwira_xon210.5040873655
.doubleclick.net/	1970-01-20 15:00:47	Name: test_cookie Value: CheckForPermission

5 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4918072057181794&output=html&adk=1812271804&adf=3025194257&lmt=1695639673&plat=1%3A16777216%2C3%3A16%2C4%3A16%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&format=0x0&url=https%3A%2F%2Fsecurityaffairs.com%2F151360%2Fmalware%2Fbbtok-trojan-latam.html%3F_gl%3D1&ea=0&pra=5&wgl=1&easpi=0&asro=0&asiscm=1&aslmt=0.4&asamt=-1&asedf=0&asefa=1&aseiel=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695646872794&bpp=3&bdt=464&idt=251&shv=r20230920&mjsv=m202309140101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=7376192788661&frm=20&pv=2&ga_vid=1615253632.1695646873&ga_sid=1695646873&ga_hid=1989497489&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31078144%2C31076995%2C31061690&oid=2&pvsid=12328078764537&tmod=235013682&uas=0&nvt=1&fsapi=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=285 Message: Failed to load resource: the server responded with a status of 403 ()
javascript	error	URL: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1 Message: Access to XMLHttpRequest at 'https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fsecurityaffairs.com&pubid=9cf0c4f1-7630-476b-9141-f4472e005192' from origin 'https://securityaffairs.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fsecurityaffairs.com&pubid=9cf0c4f1-7630-476b-9141-f4472e005192 Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://securityaffairs.com/151360/malware/bbtok-trojan-latam.html?_gl=1 Message: Access to XMLHttpRequest at 'https://l.sharethis.com/pview?event=pview&hostname=securityaffairs.com&location=%2F151360%2Fmalware%2Fbbtok-trojan-latam.html&product=unknown&url=https%3A%2F%2Fsecurityaffairs.com%2F151360%2Fmalware%2Fbbtok-trojan-latam.html%3F_gl%3D1&source=sharethis-share-buttons-wordpress&fcmp=false&fcmpv2=false&has_segmentio=false&title=New%20variant%20of%20BBTok%20Trojan%20targets%20users%20of%20%2B40%20banks%20in%20LATAM&cms=unknown&publisher=64b5cd2fd23b930012608ffb&sop=true&version=st_sop.js&lang=en&description=A%20new%20variant%20of%20a%20banking%20trojan%2C%20called%C2%A0BBTok%2C%20targets%20users%20of%20over%2040%20banks%20in%20Latin%20America%2C%20particularly%20Brazil%20and%20Mexico.&ua=&ua_mobile=false&ua_full_version_list=' from origin 'https://securityaffairs.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://l.sharethis.com/pview?event=pview&hostname=securityaffairs.com&location=%2F151360%2Fmalware%2Fbbtok-trojan-latam.html&product=unknown&url=https%3A%2F%2Fsecurityaffairs.com%2F151360%2Fmalware%2Fbbtok-trojan-latam.html%3F_gl%3D1&source=sharethis-share-buttons-wordpress&fcmp=false&fcmpv2=false&has_segmentio=false&title=New%20variant%20of%20BBTok%20Trojan%20targets%20users%20of%20%2B40%20banks%20in%20LATAM&cms=unknown&publisher=64b5cd2fd23b930012608ffb&sop=true&version=st_sop.js&lang=en&description=A%20new%20variant%20of%20a%20banking%20trojan%2C%20called%C2%A0BBTok%2C%20targets%20users%20of%20over%2040%20banks%20in%20Latin%20America%2C%20particularly%20Brazil%20and%20Mexico.&ua=&ua_mobile=false&ua_full_version_list= Message: Failed to load resource: net::ERR_FAILED

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aax.amazon-adsystem.com
assets.vlitag.com
audit-tcfv2.cmp.quantcast.com
buttons-config.sharethis.com
c.amazon-adsystem.com
cdn.jsdelivr.net
cmp.quantcast.com
config.aps.amazon-adsystem.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
i0.wp.com
imasdk.googleapis.com
l.sharethis.com
pagead2.googlesyndication.com
partner.googleadservices.com
pixel.wp.com
platform-api.sharethis.com
px.vliplatform.com
region1.analytics.google.com
region1.google-analytics.com
rules.quantcount.com
secure.quantserve.com
securepubads.g.doubleclick.net
securityaffairs.com
services.vlitag.com
stats.g.doubleclick.net
stats.wp.com
test.cmp.quantcast.com
tpc.googlesyndication.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
c.amazon-adsystem.com
l.sharethis.com
108.138.1.25
13.32.99.51
18.197.180.30
192.0.76.3
192.0.77.2
2001:4860:4802:32::36
2600:9000:206f:6a00:c:abe:f440:93a1
2600:9000:211e:1200:9:46dc:4700:93a1
2600:9000:223c:f000:6:44e3:f8c0:93a1
2600:9000:225e:9200:3:a4cd:8380:93a1
2606:4700:10::6816:3bc7
2606:4700:3031::ac43:8cd3
2606:4700:3037::ac43:9e3b
2606:4700::6810:5514
2620:116:800d:21:e365:4988:e8a7:3270
2a00:1450:4001:802::2004
2a00:1450:4001:802::200a
2a00:1450:4001:803::2002
2a00:1450:4001:80f::200e
2a00:1450:4001:811::2003
2a00:1450:4001:812::2002
2a00:1450:4001:81c::2002
2a00:1450:4001:81c::2003
2a00:1450:4001:829::2001
2a00:1450:4001:829::200a
2a00:1450:4001:82b::2008
2a00:1450:4001:830::2002
2a00:1450:400c:c07::9b
52.222.209.4
99.86.4.30
00daef3b4a945d15f73efa05e0ce2ca51f2f8252e1da8fae5c2efb0f6dddacce
0178865b3be274d0714e61b7af67ee681df3a384f4dde03ea85d61ec97942567
041fe6e516177e777c651a95708ee4961723db34a974e8be9e6ba597a1313e51
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
09587fd0b4c984573371a553f082e27c4e4ba98f65130e1b1eb7c0b7699509e5
0bfbbc57a6a01182f738b9d582dd16a6b1075954a501f8c995af2a7e5b40d56e
0c7178cc6ca34fb18e30f070a5e7a1c287b2d7ccfcba2cfdf06e0f46eda55740
1060091178cbd6c843b802f516f230f1a3a1e85f1afbd6ef84d80e5430ba457e
1528c535d339849cea1f4b18416229bd962819949c62574dcd184cdfa6d056b2
165d6cf0440273d98a7ff9e3a3c996af430f251f139ce41bd21d2b995291a0ff
170d329a585de03caa379e0e068e08b529ba2d693608db4166c3996328185c06
17a60971acd82c65cd57863f07cbc2fc9124483c6fb6f9bfa270019c058a479c
188f666c866c08197c9f3a2dd19aba2a106db032181d29837c4fcf8757826516
1916cf4455a526aadafd82710bf7304154905dcdf69dd9e0b516a63cc82e27e0
1c4777fe3a673a05492e27d08032cc91c23ac5389897c9235b09b8b0f5a74db3
1df70b268a34a8036eca2f536d670f59e142b877bf09ad993aec61417c7a4870
1e0352c858984ddb68c11c0b8265ea2ae72ab8d29b4471f888d4cbd95fe881ef
241df04a32e1a0a4da58eb35f672c5f0b4e1fa131475803ce3222bf493632d5e
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
27dd9b075cc59cf5f3c0f6ee075f4bd113782d81ce30a4f16aac669ecfdc4fa2
2815fd327b4409bd949048381f5b18e77b6ee064058d833607680a1fe7097acc
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
2c03404e75c3b5dd3190080d5b678433a88aed86b17fba7685f8a36950414fb8
2d0ee8b9f5976ae2dc3eefb7aace301d8540ad3d5f01c88f5049b3b7257a1d2f
32a42197dc440d45716dd692e63b89b7023bdd66b43d60de83e4de5750c83988
42638cf7ce147ae414ebf639d0c94c85b08018380903afb94e2190b1d4adb317
4293e3413e191b0d37d827129822fad3ba2e35edc2ffb3d086021cb8206d418a
4485dc3684588728bba3e5fbbe902c36ad1ec1b47480cc62c911a9403bafecc3
4b5dcd8c4de34bf3e2bbbb1499ef55172ca6a8c7124c5aaa04cc6ea48a084b8b
4be2e4cc6c402759c5835e32ab13cbb8bffd2f5dfd5fd269667c6b91ed10e875
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
50734506a34b0e426971e5d9c3ed835819150112fe4f58c981f94ed4502c92c0
51e18fa3a179268df5763ae93f237dfa9ab4733b4e2791fe3cfeecca702a8832
5220bfc9416c5b55c41b39baaf1744ed2ce2bec1b0e77382067dea40eec68ba2
52f5e657405d02f0ab9761d8c352e50ddf0329275461a34ad512267f3b06c4db
556a8ad21710d89029a18d9ca6a14ae9d3b7c7d6de10328ab2426da30683f422
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
5b8751f4062c58b8cef16f45a2287aeff3a4b7776c65d70538cca246e203d92f
5d7c7d25a0da74c0dd466120c3c09bd94cb982fc66ebc4a78675339f37323bf5
5fe46d2da01452067736578431f6c6e8116a24e616f58c72d9d81fdb2c7c9569
6128e51fab5cf5607409dbe621a4f3dd8dad1527ad7bacd550ffad09b1fcabee
61ab87dcaed48490bcfc166bebecc8b4cab7ae713a7ad21af1726ca0da0b83d9
61b5d4f52ec96a0aef85f731e618cb627749775534ae86976446f42350757392
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
68699e8f6bf49d7c61ef39e4cf20a7eb89a4efde06cfedb6548ca23bde6cae0c
698efec41dc5a5946ae4a26a456cad7646bb9cb56a479ee89b76160cccba142e
6b43f0dbd831c384a0e5b33a93d763fc96c91cb912f9d97bb30fb13374449d76
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6d282eb785d0434a702ea33d88680d078aacde89efb3346c36798dba0bdc5d5c
6e7c083e0e173f849fa0582a9332bf40a3567c49ff818f28b0e4dca93930c6e5
732fe1ff87d948c44d6d26af7aa89d8e1eb9eb8e00c372dadbacb51c0ba5865d
745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8
7633b7c0c97d19e682feee8afa2738523fcb2a14544a550572caeecd2eefe66b
76aacba4eece592e3a3281e69a5762c6f10b527a29fbba5eae5ac091f47ae554
79ef2c493105913ae8a012433b49e73fec9f4e3dfaf70723bcf66c3e3e0e09e9
7a65e356551523b3a3222147ddb49ea4dad9b21d38a9b590effd45d55fc94d03
7c1b0b0523c8cd715c6a906f13a121cd27392d8e61d58c38c7ceb32ec22e59f4
7e1f1503df765cca5e099891b94e318a2ef95081ba2af1eb6d417cc884bfdbfe
804aa2016958413450a7751d3d63ea718f0ed5c5af48b65d765adf9ab2f1b139
82815a7dba0c18a1092121e80005ee37b0390b8b755a6dc8ba03e199ed3a2501
83c766afcb10d107921e5178ad471583ce980018dccb1c58bf9d1f272e647c77
84e1de7132433ebaa0845af00ce1812287ba004d8288bf78b455f1d9f494f2ab
8509250d4ad723588dd0e0d8261f070ee36fe13b326a9897593707378c50ad66
89b4aa9e9bf8516c2ab7b5134f65d47b02071637259a14c9f60dccc207e05ce4
8a8c0bd86eee0230682ed29c5e30936b6b14ab02e1586692840ef8ea4de9dda6
8cb19dd370d8a0dd9ee570e546a789c88840bd443082943f099e4c87cdfff2bf
8f993d3fed8916a4cfc354833e10d76661047c70c173b348ca2466fcae9a226a
90b1f6082b0cf09c59ad2a5b87d3e0ab87eadf37c9b0b791318adfaae1a4b0d4
90bed464813fbd721e4991e83fe323e763f91294f98018462c2698d16e60ae5f
95dbbacaaa6b78654b2b74da75fa16e9986ff82fe674aea184b07e643295c871
9701e3cc721b444361494b8586b90ce11a0a0fc7964c0220e2263dd836d0a254
9b1b9d7cb74a9923d83f36f0026f421940b861fd6e1a51b8f79af45492ed4ed5
a1adb5bbcadca48bb4602674363217012a5bf58c50e307c17b4ee6686fac975f
a21e3d4b193d36cbfab4d9cb007c5f531c86b7c3d5fbadc0ea2a20296330d536
a8aceed77aa5379a8c0aa967d53ca428b56a32b222795f7940c3988c8d76c014
ac825c2e7eb874cfe862111097aa63158b575df11b0ea342814a5bc55f450b66
b1f4247657f994f6c9520c982ab95f953ee1c052706594d74f521cae670cf8be
b253964206a6ce075557f8735e7b57268338885e821f317bc63c6616e75c7b60
b467032f1667c5c6639deaba6537cc84b48a99545a34070120a1f120a1b47c87
b70fc51a1d9bf86eec231ca0cc01654a581000900ac0d143a350af36cdeed63b
b7908a015a567ec2363011df2475368dbff34360e9da3fdff50604d6395fb646
bfbb02b2f82750344aa2bc6329085a7550de92926a22a951db6f1629fab862f0
ca7752fb33cf3a98c0f29bc4eec563112025da4109a0dcc69dabf5f861751258
cda4a81c187015d95ed2c71f1841540b08203cdec5fa2a7d5d1825a3c2166f8c
d16103602deca71a3e0c919c7296b6473fefc06fbaa1560fad441fa2af1d5715
d4cfb7cee285d40426858880b1aefd55d82066c18f3a435521309ff24ba65a7f
d6a3066ca2a24d754f139cc7d4f852d50e6751b2618fa1507c26f194a651bcc4
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eaade0e5f063f06ba9ec0303b6e2cf134e7e7ddedce6b51813880fe52bbb5de2
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f23f3ee7c34a55b964f90260ca679b32af5084b6c9a9d1e187346a38c6fb411d
f294eb188a59c61d3d3d6462cfb0b9c3e8559aaf4f95ab3fc9b010b4e1c20418
f2ed80b537e658858b2ebe3ebb7a8ff5fdb21089766a68419c0fc28153daac66
f30c624dd8830ceecd352e38b9a0129eaae7184a03050e1f870ccd1f97a5c191
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
f7244fff610595b944f76bf3080d74e3af42b5dd234f8f079e698cc39ac966b0
f76335e8788f66c0efc72c2d0db22496f8983e7ce66aaaa7c179f65fa08e5dae
f7b42826dba0d886667e61ebac93496e4d14c3b2b4975cc4af442d9e907e3c92
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

securityaffairs.com Open in urlscan Pro 2606:4700:3031::ac43:8cd3 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

125 Requests

98 %HTTPS

77 %IPv6

19 Domains

34 Subdomains

31 IPs

3 Countries

2788 kBTransfer

7358 kBSize

11 Cookies

13 Outgoing links

Redirected requests

125 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

securityaffairs.com Open in urlscan Pro
2606:4700:3031::ac43:8cd3 Public Scan

Screenshot
Live screenshot

Full Image

125
Requests

98 %
HTTPS

77 %
IPv6

19
Domains

34
Subdomains

31
IPs

3
Countries

2788 kB
Transfer

7358 kB
Size

11
Cookies

125 HTTP transactions
0 data transactions