urlscan.io logo urlscan.io
SecurityTrails logo

forums.malwarebytes.com Open in urlscan Pro
143.204.101.86  Public Scan

Go To Rescan Add Verdict Report
URL: https://forums.malwarebytes.com/topic/171022-got-infected/
Submission: On January 15 via api from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 14 IPs in 3 countries across 13 domains to perform 39 HTTP transactions. The main IP is 143.204.101.86, located in Seattle, United States and belongs to AMAZON-02 - Amazon.com, Inc., US. The main domain is forums.malwarebytes.com.
TLS certificate: Issued by Amazon on October 15th 2019. Valid for: a year.
This is the only time forums.malwarebytes.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
4 143.204.101.86 16509 (AMAZON-02)
1 2a00:1450:400... 15169 (GOOGLE)
18 2600:9000:21f... 16509 (AMAZON-02)
1 2 104.28.1.37 13335 (CLOUDFLAR...)
4 151.101.112.193 54113 (FASTLY)
1 2a00:1450:400... 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
1 2 2a00:1450:400... 15169 (GOOGLE)
2 2620:1ec:c11:... 8068 (MICROSOFT...)
1 2 216.58.205.230 15169 (GOOGLE)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 1 2a00:1450:400... 15169 (GOOGLE)
1 1 2001:4860:480... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 54.225.70.184 14618 (AMAZON-AES)
39 14
4    143.204.101.86 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-143-204-101-86.fra50.r.cloudfront.net
forums.malwarebytes.com
1    2a00:1450:4001:825::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
fonts.googleapis.com
18    2600:9000:21f3:6a00:1e:ebe7:1480:93a1 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
content.invisioncic.com
2    104.28.1.37 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
forums.whatthetech.com
4    151.101.112.193 (Frankfurt am Main, Germany)

ASN54113 (FASTLY - Fastly, US)
i.imgur.com
1    2a00:1450:4001:821::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
www.googletagmanager.com
3    2a00:1450:4001:817::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
fonts.gstatic.com
2    2a00:1450:4001:816::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
www.google-analytics.com
2    2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)
bat.bing.com
2    216.58.205.230 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra15s24-in-f230.1e100.net
8019375.fls.doubleclick.net
1    2606:4700::6813:9308 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
script.crazyegg.com
1    2a00:1450:400c:c00::9c (Brussels, Belgium)

ASN15169 (GOOGLE - Google LLC, US)
stats.g.doubleclick.net
1    2001:4860:4802:36::75 (United States)

ASN15169 (GOOGLE - Google LLC, US)
www.google.com
1    2a00:1450:4001:825::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
www.google.de
1    54.225.70.184 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-54-225-70-184.compute-1.amazonaws.com
sample-api-v2.crazyegg.com
Domain Requested by
18 content.invisioncic.com forums.malwarebytes.com
content.invisioncic.com
4 i.imgur.com forums.malwarebytes.com
4 forums.malwarebytes.com forums.malwarebytes.com
3 fonts.gstatic.com forums.malwarebytes.com
2 8019375.fls.doubleclick.net 1 redirects www.googletagmanager.com
2 bat.bing.com forums.malwarebytes.com
2 www.google-analytics.com 1 redirects forums.malwarebytes.com
2 forums.whatthetech.com 1 redirects forums.malwarebytes.com
1 sample-api-v2.crazyegg.com script.crazyegg.com
1 www.google.de forums.malwarebytes.com
1 www.google.com 1 redirects
1 stats.g.doubleclick.net 1 redirects
1 script.crazyegg.com www.googletagmanager.com
1 www.googletagmanager.com forums.malwarebytes.com
1 fonts.googleapis.com forums.malwarebytes.com
39 15
Subject Issuer Validity Valid
forums.malwarebytes.com
Amazon		 2019-10-15 -
2020-11-15		 a year crt.sh
*.storage.googleapis.com
GTS CA 1O1		 2019-12-10 -
2020-03-03		 3 months crt.sh
content.invisioncic.com
Amazon		 2019-10-14 -
2020-11-14		 a year crt.sh
sni.cloudflaressl.com
CloudFlare Inc ECC CA-2		 2019-08-19 -
2020-08-18		 a year crt.sh
*.google-analytics.com
GTS CA 1O1		 2019-12-10 -
2020-03-03		 3 months crt.sh
*.google.com
GTS CA 1O1		 2019-12-20 -
2020-03-13		 3 months crt.sh
www.bing.com
Microsoft IT TLS CA 2		 2019-04-30 -
2021-04-30		 2 years crt.sh
*.doubleclick.net
GTS CA 1O1		 2019-12-10 -
2020-03-03		 3 months crt.sh
ssl945600.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2		 2019-08-20 -
2020-02-26		 6 months crt.sh
www.google.de
GTS CA 1O1		 2019-12-10 -
2020-03-03		 3 months crt.sh
*.crazyegg.com
DigiCert SHA2 Secure Server CA		 2018-06-08 -
2020-08-05		 2 years crt.sh

This page contains 2 frames:

Primary Page: https://forums.malwarebytes.com/topic/171022-got-infected/
Frame ID: DEB5933344B09D417CD662A2B1A03122
Requests: 41 HTTP requests in this frame

Frame: https://8019375.fls.doubleclick.net/activityi;dc_pre=CPyygbzAhecCFQfHdwodI84Nog;src=8019375;type=malwa000;cat=malwa0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=3001780436746.797
Frame ID: 13AE8C3AF120EC22C96CF0205B174222
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /php\/?([\d.]+)?/i
Overall confidence: 100%
Detected patterns
  • headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i
Overall confidence: 100%
Detected patterns
  • headers server /\(Amazon\)/i
Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
Overall confidence: 100%
Detected patterns
  • headers via /\(CloudFront\)$/i
  • headers server /\(Amazon\)/i
Overall confidence: 100%
Detected patterns
  • headers via /\(CloudFront\)$/i
Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i
Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i
Overall confidence: 100%
Detected patterns
  • html /googletagmanager\.com\/ns\.html[^>]+><\/iframe>/i
  • html /<!-- (?:End )?Google Tag Manager -->/i

Page Statistics

39
Requests

90 %
HTTPS

67 %
IPv6

13
Domains

15
Subdomains

14
IPs

3
Countries

597 kB
Transfer

2004 kB
Size

18
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 9
  • http://forums.whatthetech.com/public/style_emoticons/default/smile.png HTTP 301
  • https://forums.whatthetech.com/public/style_emoticons/default/smile.png
Request Chain 35
  • https://8019375.fls.doubleclick.net/activityi;src=8019375;type=malwa000;cat=malwa0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=3001780436746.797 HTTP 302
  • https://8019375.fls.doubleclick.net/activityi;dc_pre=CPyygbzAhecCFQfHdwodI84Nog;src=8019375;type=malwa000;cat=malwa0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=3001780436746.797
Request Chain 37
  • https://www.google-analytics.com/r/collect?v=1&_v=j79&a=1871138128&t=pageview&_s=1&dl=https%3A%2F%2Fforums.malwarebytes.com%2Ftopic%2F171022-got-infected%2F&ul=en-us&de=UTF-8&dt=Got%20infected.%20-%20Resolved%20Malware%20Removal%20Logs%20-%20Malwarebytes%20Forums&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=IEBAAEAB~&jid=1842920160&gjid=2079269106&cid=936509791.1579087802&tid=UA-3347303-10&_gid=1885712220.1579087802&_r=1&z=616229360 HTTP 302
  • https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-3347303-10&cid=936509791.1579087802&jid=1842920160&_gid=1885712220.1579087802&gjid=2079269106&_v=j79&z=616229360 HTTP 302
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-3347303-10&cid=936509791.1579087802&jid=1842920160&_v=j79&z=616229360 HTTP 302
  • https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-3347303-10&cid=936509791.1579087802&jid=1842920160&_v=j79&z=616229360&slf_rd=1&random=487636520

39 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
forums.malwarebytes.com/topic/171022-got-infected/ 		247 KB
44 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://forums.malwarebytes.com/topic/171022-got-infected/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.101.86 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-143-204-101-86.fra50.r.cloudfront.net
Software
Apache/2.4.41 (Amazon) OpenSSL/1.0.2k-fips PHP/7.1.33 / PHP/7.1.33
Resource Hash
1be8808fef6189e0ac4f98c0dc85d7e102f699305a557ace57b0b8587ae747de
Security Headers
Name Value
X-Frame-Options sameorigin
X-Xss-Protection 0

Request headers

:method
GET
:authority
forums.malwarebytes.com
:scheme
https
:path
/topic/171022-got-infected/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
sec-fetch-user
?1
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
none
sec-fetch-mode
navigate
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Sec-Fetch-User
?1

Response headers

status
200
content-type
text/html;charset=UTF-8
content-length
44572
date
Wed, 15 Jan 2020 11:28:48 GMT
server
Apache/2.4.41 (Amazon) OpenSSL/1.0.2k-fips PHP/7.1.33
x-powered-by
PHP/7.1.33
set-cookie
SimpleSAMLSessionID=6cc2f92992ffdc2f28d1b7575158315c; path=/; HttpOnly ips4_IPSSessionFront=e261i4v8r37g5inst6bhvpknlc; path=/; secure; HttpOnly ips4_guestTime=1579087727; path=/; secure; HttpOnly ct_cookies_test=%7B%22cookies_names%22%3A%5B%5D%2C%22check_value%22%3A%229533b808c1c1d7b1afde9a8986ca2daf%22%7D; path=/
expires
Wed, 15 Jan 2020 11:43:48 GMT
cache-control
max-age=900, public
pragma
public
x-ips-loggedin
0
content-encoding
gzip
x-xss-protection
0
x-frame-options
sameorigin
last-modified
Wed, 15 Jan 2020 11:28:48 GMT
vary
cookie,Accept-Encoding
x-cache
Hit from cloudfront
via
1.1 a394c864b23364262af48fed4e7e9fad.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA50-C1
x-amz-cf-id
z8CJ9vOYJm5YTYDHho1Im8r_6gI7jUykaSAtwiL82RQQ-yXAqv_Zjw==
age
73
css
fonts.googleapis.com/ 		14 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i
Requested by
Host: forums.malwarebytes.com
URL: https://forums.malwarebytes.com/topic/171022-got-infected/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:825::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
ESF /
Resource Hash
61c330480d49d2c9c9caf0dbf4822c469c4fbe83ed5d216edec83617b45bcd43
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://forums.malwarebytes.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Wed, 15 Jan 2020 11:30:01 GMT
server
ESF
access-control-allow-origin
*
date
Wed, 15 Jan 2020 11:30:01 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
x-xss-protection
0
expires
Wed, 15 Jan 2020 11:30:01 GMT
341e4a57816af3ba440d891ca87450ff_framework.css.6c7743120892f4e32255580886ede065.css.gz
content.invisioncic.com/Mmalware/css_built_18/ 		242 KB
45 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://content.invisioncic.com/Mmalware/css_built_18/341e4a57816af3ba440d891ca87450ff_framework.css.6c7743120892f4e32255580886ede065.css.gz?v=eda510d912
Requested by
Host: forums.malwarebytes.com
URL: https://forums.malwarebytes.com/topic/171022-got-infected/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:6a00:1e:ebe7:1480:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
9eae644b41d78c64dbbaf4b4579441e4f7c5e8665786876ec9c3f04eb356214a

Request headers

Referer
https://forums.malwarebytes.com/topic/171022-got-infected/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Thu, 02 Jan 2020 15:36:24 GMT
content-encoding
gzip
last-modified
Thu, 02 Jan 2020 15:33:04 GMT
server
AmazonS3
age
1108418
etag
"c8cb81bf0d099786fd5133a0bfbdbf5b"
x-cache
Hit from cloudfront
content-type
text/css
status
200
cache-control
public, max-age=31536000
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
content-length
45387
via
1.1 71dbd5706c5b0c7b733248e1171f2d4f.cloudfront.net (CloudFront)
x-amz-cf-id
zZezhbs8N-vrIKoAAjlxjP9BrBlYHxFu7MKPgEU2vOI-BfCUJs_z1A==
05e81b71abe4f22d6eb8d1a929494829_responsive.css.fd5a3cb35506baaa4333acf9f4801309.css.gz
content.invisioncic.com/Mmalware/css_built_18/ 		39 KB
7 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://content.invisioncic.com/Mmalware/css_built_18/05e81b71abe4f22d6eb8d1a929494829_responsive.css.fd5a3cb35506baaa4333acf9f4801309.css.gz?v=eda510d912
Requested by
Host: forums.malwarebytes.com
URL: https://forums.malwarebytes.com/topic/171022-got-infected/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:6a00:1e:ebe7:1480:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
c003d5a094e07dd4b93f9cb7dc877814ce3563c0d72f27c630759d2eaac69b3f

Request headers

Referer
https://forums.malwarebytes.com/topic/171022-got-infected/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Thu, 02 Jan 2020 15:36:24 GMT
content-encoding
gzip
last-modified
Thu, 02 Jan 2020 15:33:00 GMT
server
AmazonS3
age
1108418
etag
"8419f6746deb2d3d65832d46cd8637e6"
x-cache
Hit from cloudfront
content-type
text/css
status
200
cache-control
public, max-age=31536000
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
content-length
6954
via
1.1 71dbd5706c5b0c7b733248e1171f2d4f.cloudfront.net (CloudFront)
x-amz-cf-id
ZF_pCioITGUOip6wY-1n5NCbf-sMXoCnsoZlVUSYZRACoBlcZVe-QA==
90eb5adf50a8c640f633d47fd7eb1778_core.css.29f50f37ae67cc88d6f74d7e404f0b36.css.gz
content.invisioncic.com/Mmalware/css_built_18/ 		17 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://content.invisioncic.com/Mmalware/css_built_18/90eb5adf50a8c640f633d47fd7eb1778_core.css.29f50f37ae67cc88d6f74d7e404f0b36.css.gz?v=eda510d912
Requested by
Host: forums.malwarebytes.com
URL: https://forums.malwarebytes.com/topic/171022-got-infected/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:6a00:1e:ebe7:1480:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
2ed0ba5e0544b1811d2c647208a28b5ffd310aa67663f1dd55c06f9e394ff211

Request headers

Referer
https://forums.malwarebytes.com/topic/171022-got-infected/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Thu, 02 Jan 2020 15:36:24 GMT
content-encoding
gzip
last-modified
Thu, 02 Jan 2020 15:33:00 GMT
server
AmazonS3
age
1108418
etag
"14aec3c3bde091f6390f3d4b7c7b6d2f"
x-cache
Hit from cloudfront
content-type
text/css
status
200
cache-control
public, max-age=31536000
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
content-length
4279
via
1.1 71dbd5706c5b0c7b733248e1171f2d4f.cloudfront.net (CloudFront)
x-amz-cf-id
mWb8bZQhe_b5c96iQbeiCGac1HZyiM5kbt1crSBmyRHbWc6nqJAEaQ==
5a0da001ccc2200dc5625c3f3934497d_core_responsive.css.bba8a3d650c7598c9abcbba98b3f64c8.css.gz
content.invisioncic.com/Mmalware/css_built_18/ 		3 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://content.invisioncic.com/Mmalware/css_built_18/5a0da001ccc2200dc5625c3f3934497d_core_responsive.css.bba8a3d650c7598c9abcbba98b3f64c8.css.gz?v=eda510d912
Requested by
Host: forums.malwarebytes.com
URL: https://forums.malwarebytes.com/topic/171022-got-infected/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:6a00:1e:ebe7:1480:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
159308ebb6cd30326aa68872f9a327c7b99ec1a2d167d509ff333bec2e098b79

Request headers

Referer
https://forums.malwarebytes.com/topic/171022-got-infected/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Thu, 02 Jan 2020 15:36:24 GMT
content-encoding
gzip
last-modified
Thu, 02 Jan 2020 15:33:00 GMT
server
AmazonS3
age
1108418
etag
"13f5acdedbe072ab728bfa6a66911ac5"
x-cache
Hit from cloudfront
content-type
text/css
status
200
cache-control
public, max-age=31536000
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
content-length
861
via
1.1 71dbd5706c5b0c7b733248e1171f2d4f.cloudfront.net (CloudFront)
x-amz-cf-id
nssC1wi6vRBnPbbAvPBoC0hnnmOJLHyP3qX-H16OZiG10HaUgR4Ejw==
62e269ced0fdab7e30e026f1d30ae516_forums.css.9c83ecaa7a54d618e51bebcef963f62e.css.gz
content.invisioncic.com/Mmalware/css_built_18/ 		9 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://content.invisioncic.com/Mmalware/css_built_18/62e269ced0fdab7e30e026f1d30ae516_forums.css.9c83ecaa7a54d618e51bebcef963f62e.css.gz?v=eda510d912
Requested by
Host: forums.malwarebytes.com
URL: https://forums.malwarebytes.com/topic/171022-got-infected/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:6a00:1e:ebe7:1480:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
f60e704278243c82c28bc263d0ad6f0fbda6f71099c6e72b799e0b719dba5d50

Request headers

Referer
https://forums.malwarebytes.com/topic/171022-got-infected/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Thu, 02 Jan 2020 15:36:24 GMT
content-encoding
gzip
last-modified
Thu, 02 Jan 2020 15:33:02 GMT
server
AmazonS3
age
1108417
etag
"c5c0ecf9e679269ae395745b4bc18968"
x-cache
Hit from cloudfront
content-type
text/css
status
200
cache-control
public, max-age=31536000
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
content-length
2318
via
1.1 71dbd5706c5b0c7b733248e1171f2d4f.cloudfront.net (CloudFront)
x-amz-cf-id
ZVbvnYaFH1dmSJSZAtjaUCksviZ2PNRnp4lP5xM379Pm9U3QzwucEg==
76e62c573090645fb99a15a363d8620e_forums_responsive.css.81d3e76e86c3a240fe8e7f95e4bf76d0.css.gz
content.invisioncic.com/Mmalware/css_built_18/ 		7 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://content.invisioncic.com/Mmalware/css_built_18/76e62c573090645fb99a15a363d8620e_forums_responsive.css.81d3e76e86c3a240fe8e7f95e4bf76d0.css.gz?v=eda510d912
Requested by
Host: forums.malwarebytes.com
URL: https://forums.malwarebytes.com/topic/171022-got-infected/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:6a00:1e:ebe7:1480:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
f0bec4e20bc4af56f95159be1e6dd93c1150eae46e1aabd71db1b5d937af44bb

Request headers

Referer
https://forums.malwarebytes.com/topic/171022-got-infected/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Thu, 02 Jan 2020 15:36:24 GMT
content-encoding
gzip
last-modified
Thu, 02 Jan 2020 15:33:02 GMT
server
AmazonS3
age
1108418
etag
"9fb695e8d405bd590a1236d4ccfd0c07"
x-cache
Hit from cloudfront
content-type
text/css
status
200
cache-control
public, max-age=31536000
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
content-length
1463
via
1.1 71dbd5706c5b0c7b733248e1171f2d4f.cloudfront.net (CloudFront)
x-amz-cf-id
nKs5tFWD8ExwXvGIqY4c0M5ETdRWOIvt056Xu4oObxf8ZHbLI5VGXA==
258adbb6e4f3e83cd3b355f84e3fa002_custom.css.c94af11ac86d807c47507600bbf58289.css.gz
content.invisioncic.com/Mmalware/css_built_18/ 		421 B
664 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://content.invisioncic.com/Mmalware/css_built_18/258adbb6e4f3e83cd3b355f84e3fa002_custom.css.c94af11ac86d807c47507600bbf58289.css.gz?v=eda510d912
Requested by
Host: forums.malwarebytes.com
URL: https://forums.malwarebytes.com/topic/171022-got-infected/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:6a00:1e:ebe7:1480:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
b205e1f29eb67183b5c3008c3de8446373fe9bfcfed7b08ab0f1ec84ab81e28c

Request headers

Referer
https://forums.malwarebytes.com/topic/171022-got-infected/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Thu, 02 Jan 2020 15:36:25 GMT
content-encoding
gzip
last-modified
Thu, 02 Jan 2020 15:33:03 GMT
server
AmazonS3
age
1108417
etag
"331987caa62d2971f39e2db1d41f034b"
x-cache
Hit from cloudfront
content-type
text/css
status
200
cache-control
public, max-age=31536000
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
content-length
293
via
1.1 71dbd5706c5b0c7b733248e1171f2d4f.cloudfront.net (CloudFront)
x-amz-cf-id
OoWiyhrd9ueJx35Y93j2thFZWuPhDxYl0FK7sUb07jt7OHH0pqODJQ==
post-190602-0-35645400-1438017345.png
forums.malwarebytes.com/uploads/monthly_07_2015/ 		112 B
112 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://forums.malwarebytes.com/uploads/monthly_07_2015/post-190602-0-35645400-1438017345.png
Requested by
Host: forums.malwarebytes.com
URL: https://forums.malwarebytes.com/topic/171022-got-infected/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.101.86 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-143-204-101-86.fra50.r.cloudfront.net
Software
Apache/2.4.41 (Amazon) OpenSSL/1.0.2k-fips PHP/7.1.33 / PHP/7.1.33
Resource Hash
79da3943e20c1f50e3074a81eedb21af15f2fe0a9c04d0fab70caf1bf1dfc4e3

Request headers

Referer
https://forums.malwarebytes.com/topic/171022-got-infected/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Wed, 15 Jan 2020 11:28:48 GMT
via
1.1 a394c864b23364262af48fed4e7e9fad.cloudfront.net (CloudFront)
server
Apache/2.4.41 (Amazon) OpenSSL/1.0.2k-fips PHP/7.1.33
x-amz-cf-pop
FRA50-C1
x-powered-by
PHP/7.1.33
x-cache
Error from cloudfront
content-type
text/html; charset=UTF-8
status
404
content-length
112
x-amz-cf-id
LAVp0R7OFx_pJat1KKIhlbuB_p_nbpLrpUmgQTNAIHvuXlZJMMN3-Q==
smile.png
forums.whatthetech.com/public/style_emoticons/default/
Redirect Chain
  • http://forums.whatthetech.com/public/style_emoticons/default/smile.png
  • https://forums.whatthetech.com/public/style_emoticons/default/smile.png
1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://forums.whatthetech.com/public/style_emoticons/default/smile.png
Requested by
Host: forums.malwarebytes.com
URL: https://forums.malwarebytes.com/topic/171022-got-infected/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.28.1.37 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
12eaa6a5503c3b6eab18e46afdbbbdd0575d8d111edf8e64ada3058e38900165

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Wed, 15 Jan 2020 11:30:01 GMT
cf-cache-status
HIT
last-modified
Sat, 23 May 2015 17:51:39 GMT
server
cloudflare
age
391254
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
555783e89cc1c85f-AMS
content-length
1042
expires
Sun, 09 Feb 2020 22:49:05 GMT

Redirect headers

Date
Wed, 15 Jan 2020 11:30:01 GMT
Server
cloudflare
Vary
Accept-Encoding
Location
https://forums.whatthetech.com/public/style_emoticons/default/smile.png
Cache-Control
max-age=3600
Transfer-Encoding
chunked
Connection
keep-alive
CF-RAY
555783e7ed89d8e9-AMS
Expires
Wed, 15 Jan 2020 12:30:01 GMT
etYzdbu.png
i.imgur.com/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://i.imgur.com/etYzdbu.png
Requested by
Host: forums.malwarebytes.com
URL: https://forums.malwarebytes.com/topic/171022-got-infected/
Protocol
HTTP/1.1
Server
151.101.112.193 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cat factory 1.0 /
Resource Hash
9010a4681ec9df0ca926a55361090e76154ea89103f373694f5ba44194c7d229

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date
Wed, 15 Jan 2020 11:30:01 GMT
Age
3181927
X-Cache
HIT, HIT
Connection
keep-alive
Content-Length
1619
X-Served-By
cache-bwi5125-BWI, cache-hhn4061-HHN
Last-Modified
Fri, 12 Sep 2014 10:46:56 GMT
Server
cat factory 1.0
X-Timer
S1579087802.566986,VS0,VE1
ETag
"d5fbd5c8daa3bb5ec61d6c1ed82a5236"
Access-Control-Allow-Methods
GET, OPTIONS
Content-Type
image/png
Access-Control-Allow-Origin
*
cache-control
public, max-age=31536000
Accept-Ranges
bytes
X-Cache-Hits
1, 1
xlK5Hdb.png
i.imgur.com/ 		646 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://i.imgur.com/xlK5Hdb.png
Requested by
Host: forums.malwarebytes.com
URL: https://forums.malwarebytes.com/topic/171022-got-infected/
Protocol
HTTP/1.1
Server
151.101.112.193 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cat factory 1.0 /
Resource Hash
8074f6b09257dd0b1831a69a0956d74950c032e31df10708bd376b4ae9f5d3f4

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date
Wed, 15 Jan 2020 11:30:01 GMT
Age
14523243
X-Cache
HIT, HIT
Connection
keep-alive
Content-Length
646
X-Served-By
cache-bwi5120-BWI, cache-hhn4055-HHN
Last-Modified
Wed, 23 Apr 2014 13:22:41 GMT
Server
cat factory 1.0
X-Timer
S1579087802.567161,VS0,VE1
ETag
"5a6ecf109954c0b7670400a860a0f145"
Access-Control-Allow-Methods
GET, OPTIONS
Content-Type
image/png
Access-Control-Allow-Origin
*
cache-control
public, max-age=31536000
Accept-Ranges
bytes
X-Cache-Hits
1, 1
AVOiBNU.jpg
i.imgur.com/ 		589 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://i.imgur.com/AVOiBNU.jpg
Requested by
Host: forums.malwarebytes.com
URL: https://forums.malwarebytes.com/topic/171022-got-infected/
Protocol
HTTP/1.1
Server
151.101.112.193 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cat factory 1.0 /
Resource Hash
b3bb440d767dfddecedbefd9b9f374b69ab2fcd7979766317cd9c9095684d8d2

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date
Wed, 15 Jan 2020 11:30:01 GMT
Age
7172843
X-Cache
HIT, HIT
Connection
keep-alive
Content-Length
589
X-Served-By
cache-bwi5124-BWI, cache-hhn4071-HHN
Last-Modified
Fri, 06 Sep 2013 11:55:39 GMT
Server
cat factory 1.0
X-Timer
S1579087802.566955,VS0,VE1
ETag
"c41c2fd09380662cd12af022a55f4b63"
Access-Control-Allow-Methods
GET, OPTIONS
Content-Type
image/jpeg
Access-Control-Allow-Origin
*
cache-control
public, max-age=31536000
Accept-Ranges
bytes
X-Cache-Hits
1, 1
pfNZP4A.png
i.imgur.com/ 		667 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://i.imgur.com/pfNZP4A.png
Requested by
Host: forums.malwarebytes.com
URL: https://forums.malwarebytes.com/topic/171022-got-infected/
Protocol
HTTP/1.1
Server
151.101.112.193 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cat factory 1.0 /
Resource Hash
ffbaa8a62d135868509cc51e7a0ffecefa63b633a4fbdbac46d832ee287740bf

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date
Wed, 15 Jan 2020 11:30:01 GMT
Age
13062823
X-Cache
HIT, HIT
Connection
keep-alive
Content-Length
667
X-Served-By
cache-bwi5139-BWI, cache-hhn4030-HHN
Last-Modified
Wed, 23 Apr 2014 13:24:03 GMT
Server
cat factory 1.0
X-Timer
S1579087802.566618,VS0,VE1
ETag
"ae19dd4e1792e17ca53d7c915877581f"
Access-Control-Allow-Methods
GET, OPTIONS
Content-Type
image/png
Access-Control-Allow-Origin
*
cache-control
public, max-age=31536000
Accept-Ranges
bytes
X-Cache-Hits
1, 1
gtm.js
www.googletagmanager.com/ 		166 KB
37 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-MKSKW3
Requested by
Host: forums.malwarebytes.com
URL: https://forums.malwarebytes.com/topic/171022-got-infected/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:821::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
17033b694ddfe3b2942c4f92aa894c58d652ec331355a5904cb54d0e165ddb26
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://forums.malwarebytes.com/topic/171022-got-infected/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Wed, 15 Jan 2020 11:30:01 GMT
content-encoding
br
last-modified
Wed, 15 Jan 2020 09:00:00 GMT
server
Google Tag Manager
access-control-allow-origin
http://www.googletagmanager.com
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
content-length
37336
x-xss-protection
0
expires
Wed, 15 Jan 2020 11:30:01 GMT
truncated
/ 		283 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
2c283b1a1573316f070502598d3af0e55917604ee347317fdfd62c0d583f37f7

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		283 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
39270e0c063b6b5afa9bd8ab4a569b33a1ac41a9c651828a82df2e3f9b6bd620

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Content-Type
image/svg+xml
tiger-face.thumb.jpg.4ed7b5ef81b5cb4e0b1c2dd22dd149eb.jpg
content.invisioncic.com/Mmalware/monthly_2020_01/ 		5 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://content.invisioncic.com/Mmalware/monthly_2020_01/tiger-face.thumb.jpg.4ed7b5ef81b5cb4e0b1c2dd22dd149eb.jpg
Requested by
Host: forums.malwarebytes.com
URL: https://forums.malwarebytes.com/topic/171022-got-infected/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:6a00:1e:ebe7:1480:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
61ef9e2455bcee7609ca7c4da041b7d72f66df99f2cd7f8fab98c0cd0235c318

Request headers

Referer
https://forums.malwarebytes.com/topic/171022-got-infected/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Tue, 07 Jan 2020 06:51:15 GMT
via
1.1 71dbd5706c5b0c7b733248e1171f2d4f.cloudfront.net (CloudFront)
last-modified
Tue, 07 Jan 2020 04:56:26 GMT
server
AmazonS3
age
707927
etag
"24bc925ef2f96026e815750413384edf"
x-cache
Hit from cloudfront
content-type
image/jpeg
status
200
cache-control
public, max-age=31536000
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
content-length
4749
x-amz-cf-id
CXgl_R0U3yK97tJ7YQGE9TPpnKu7s0FR6-RwKs2e8cnTC9U6KFXxrA==
84c1e40ea0e759e3f1505eb1788ddf3c_default_photo.png
content.invisioncic.com/Mmalware/set_resources_18/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://content.invisioncic.com/Mmalware/set_resources_18/84c1e40ea0e759e3f1505eb1788ddf3c_default_photo.png
Requested by
Host: forums.malwarebytes.com
URL: https://forums.malwarebytes.com/topic/171022-got-infected/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:6a00:1e:ebe7:1480:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
c9b19667188a7a142b2f9e0841928d3a2137bf476d158c86fa58f6bfb05a5f68

Request headers

Referer
https://forums.malwarebytes.com/topic/171022-got-infected/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Sat, 28 Dec 2019 23:43:34 GMT
via
1.1 71dbd5706c5b0c7b733248e1171f2d4f.cloudfront.net (CloudFront)
last-modified
Fri, 13 Dec 2019 16:23:40 GMT
server
AmazonS3
age
1511188
etag
"22160b0ae87b0e3c12254f1115fb7bfd"
x-cache
Hit from cloudfront
content-type
image/png
status
200
cache-control
public, max-age=31536000
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
content-length
1290
x-amz-cf-id
TjPs0GNFwimKPG9TnwnBI2tdfp6uKEmAwHrOvZv1YMQZC461YeQ1qA==
root_library.js.2e95e327a81aaf0a9b618b8e657b73dd.js.gz
content.invisioncic.com/Mmalware/javascript_global/ 		365 KB
121 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://content.invisioncic.com/Mmalware/javascript_global/root_library.js.2e95e327a81aaf0a9b618b8e657b73dd.js.gz
Requested by
Host: forums.malwarebytes.com
URL: https://forums.malwarebytes.com/topic/171022-got-infected/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:6a00:1e:ebe7:1480:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
6a1f8f243c85f0023dcf30a77a626a1885076cbcc5e268129f6e1f978713df3f

Request headers

Referer
https://forums.malwarebytes.com/topic/171022-got-infected/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Sat, 11 Jan 2020 22:20:44 GMT
content-encoding
gzip
last-modified
Sat, 11 Jan 2020 22:13:25 GMT
server
AmazonS3
age
306558
etag
"ecfedf47bc19b2c47e4861ee6f11ece7"
x-cache
Hit from cloudfront
content-type
text/javascript
status
200
cache-control
public, max-age=31536000
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
content-length
123459
via
1.1 71dbd5706c5b0c7b733248e1171f2d4f.cloudfront.net (CloudFront)
x-amz-cf-id
E8-WE_OKQHdzeqxrRpOI2ePBqKYKhU505a1N9R8i81l836gqHAJqaA==
root_js_lang_1.js.1df17764168b689c4d2b50f867db40a2.js.gz
content.invisioncic.com/Mmalware/javascript_global/ 		90 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://content.invisioncic.com/Mmalware/javascript_global/root_js_lang_1.js.1df17764168b689c4d2b50f867db40a2.js.gz
Requested by
Host: forums.malwarebytes.com
URL: https://forums.malwarebytes.com/topic/171022-got-infected/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:6a00:1e:ebe7:1480:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
576abb2fcd75b6372bccc6c8f308c0f0ed8b8de4420a8d3aedab1d6a650589a5

Request headers

Referer
https://forums.malwarebytes.com/topic/171022-got-infected/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Sat, 11 Jan 2020 22:20:44 GMT
content-encoding
gzip
last-modified
Sat, 11 Jan 2020 22:13:25 GMT
server
AmazonS3
age
306558
etag
"212dfcac6ad10cca906c3e068add1bf8"
x-cache
Hit from cloudfront
content-type
text/javascript
status
200
cache-control
public, max-age=31536000
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
content-length
28380
via
1.1 71dbd5706c5b0c7b733248e1171f2d4f.cloudfront.net (CloudFront)
x-amz-cf-id
ob7u2JnvhdE4qPKpH0WiLJuTnLmzlqZXKlAZiFscsHIf17oPkSzfdw==
root_framework.js.acb0393dfe1ea3f0220ceff9fa083aec.js.gz
content.invisioncic.com/Mmalware/javascript_global/ 		393 KB
91 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://content.invisioncic.com/Mmalware/javascript_global/root_framework.js.acb0393dfe1ea3f0220ceff9fa083aec.js.gz
Requested by
Host: forums.malwarebytes.com
URL: https://forums.malwarebytes.com/topic/171022-got-infected/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:6a00:1e:ebe7:1480:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
2d1d098eba61a6a846f1201570f3e690408acadff667df0c705f4044cc9bb5fd

Request headers

Referer
https://forums.malwarebytes.com/topic/171022-got-infected/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Sat, 11 Jan 2020 22:20:44 GMT
content-encoding
gzip
last-modified
Sat, 11 Jan 2020 22:13:27 GMT
server
AmazonS3
age
306558
etag
"145592a17cf8228e18990e679f5a6d3d"
x-cache
Hit from cloudfront
content-type
text/javascript
status
200
cache-control
public, max-age=31536000
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
content-length
92594
via
1.1 71dbd5706c5b0c7b733248e1171f2d4f.cloudfront.net (CloudFront)
x-amz-cf-id
guXjp_2NB0L8lU-dPzPjjy-37n37gfQRJGFu4mKks4HiE2192NcRog==
global_global_core.js.db2cb1c1ee61fda8eb38ac4c62f554c2.js.gz
content.invisioncic.com/Mmalware/javascript_core/ 		34 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://content.invisioncic.com/Mmalware/javascript_core/global_global_core.js.db2cb1c1ee61fda8eb38ac4c62f554c2.js.gz
Requested by
Host: forums.malwarebytes.com
URL: https://forums.malwarebytes.com/topic/171022-got-infected/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:6a00:1e:ebe7:1480:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
c451e968e926da4739ed2dd2a66a18f7b7c072235da7db7bce15a8ddb7acfaf8

Request headers

Referer
https://forums.malwarebytes.com/topic/171022-got-infected/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Sat, 11 Jan 2020 22:20:44 GMT
content-encoding
gzip
last-modified
Sat, 11 Jan 2020 22:13:27 GMT
server
AmazonS3
age
306558
etag
"8aedff1c302c2965351c87aad97e8131"
x-cache
Hit from cloudfront
content-type
text/javascript
status
200
cache-control
public, max-age=31536000
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
content-length
8284
via
1.1 71dbd5706c5b0c7b733248e1171f2d4f.cloudfront.net (CloudFront)
x-amz-cf-id
ZwOo77OIDT9vfz3CZnPaK04zLbhU2qKNr_30kKxCFV5daAsAS1UeTg==
root_front.js.6f5424bcac70fe8bd64034ee9e6d9379.js.gz
content.invisioncic.com/Mmalware/javascript_global/ 		100 KB
22 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://content.invisioncic.com/Mmalware/javascript_global/root_front.js.6f5424bcac70fe8bd64034ee9e6d9379.js.gz
Requested by
Host: forums.malwarebytes.com
URL: https://forums.malwarebytes.com/topic/171022-got-infected/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:6a00:1e:ebe7:1480:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
fb1a5c8f738456fc3d945fa837c7f2ea7d5f4f8ced2af58481c03fb7c57661ee

Request headers

Referer
https://forums.malwarebytes.com/topic/171022-got-infected/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Sat, 11 Jan 2020 22:20:44 GMT
content-encoding
gzip
last-modified
Sat, 11 Jan 2020 22:14:20 GMT
server
AmazonS3
age
306558
etag
"64915024cfba77586652213fe8e19812"
x-cache
Hit from cloudfront
content-type
text/javascript
status
200
cache-control
public, max-age=31536000
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
content-length
22030
via
1.1 71dbd5706c5b0c7b733248e1171f2d4f.cloudfront.net (CloudFront)
x-amz-cf-id
qnj_LeL1Ja7SPf1aYEq92FqdW1wj3B3viYVgaquiEyhxpV0-UVsy2g==
front_front_topic.js.42cee06d42f350accdaea3acbcd05e2a.js.gz
content.invisioncic.com/Mmalware/javascript_forums/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://content.invisioncic.com/Mmalware/javascript_forums/front_front_topic.js.42cee06d42f350accdaea3acbcd05e2a.js.gz
Requested by
Host: forums.malwarebytes.com
URL: https://forums.malwarebytes.com/topic/171022-got-infected/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:6a00:1e:ebe7:1480:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
e7bc15fa24b8f81c4ed4c49bf751a5ae00c7e470503947d650b794b970f46df8

Request headers

Referer
https://forums.malwarebytes.com/topic/171022-got-infected/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Sat, 11 Jan 2020 22:20:44 GMT
content-encoding
gzip
last-modified
Sat, 11 Jan 2020 22:14:22 GMT
server
AmazonS3
age
306558
etag
"21af9ce01d5f1a3dbd7188fe99b9536f"
x-cache
Hit from cloudfront
content-type
text/javascript
status
200
cache-control
public, max-age=31536000
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
content-length
926
via
1.1 71dbd5706c5b0c7b733248e1171f2d4f.cloudfront.net (CloudFront)
x-amz-cf-id
OaJeSu_0AKTlLBqNvg-KrZjjgWJuiVjRj_MqI2RdsQ_QGRrkX_SYnw==
front_front_core.js.a15f15a99a567437f74d38ba36c2c895.js.gz
content.invisioncic.com/Mmalware/javascript_core/ 		26 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://content.invisioncic.com/Mmalware/javascript_core/front_front_core.js.a15f15a99a567437f74d38ba36c2c895.js.gz
Requested by
Host: forums.malwarebytes.com
URL: https://forums.malwarebytes.com/topic/171022-got-infected/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:6a00:1e:ebe7:1480:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
c90dd4aa28a47571696f2cdbe5aff456de88a9cc3b6a0865e7524761696070ab

Request headers

Referer
https://forums.malwarebytes.com/topic/171022-got-infected/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Sat, 11 Jan 2020 22:20:44 GMT
content-encoding
gzip
last-modified
Sat, 11 Jan 2020 22:14:20 GMT
server
AmazonS3
age
306558
etag
"e6cce38b6595ead37aae5cb6c158a5b0"
x-cache
Hit from cloudfront
content-type
text/javascript
status
200
cache-control
public, max-age=31536000
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
content-length
6341
via
1.1 71dbd5706c5b0c7b733248e1171f2d4f.cloudfront.net (CloudFront)
x-amz-cf-id
2I-vkaCNdQ2Dxt7BYeTnkNKnjVDSws9I_C-Q5N98cFPQCvfUE8qHag==
root_map.js.f5d35ada31c94b85811df92e54a46c73.js.gz
content.invisioncic.com/Mmalware/javascript_global/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://content.invisioncic.com/Mmalware/javascript_global/root_map.js.f5d35ada31c94b85811df92e54a46c73.js.gz
Requested by
Host: forums.malwarebytes.com
URL: https://forums.malwarebytes.com/topic/171022-got-infected/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:6a00:1e:ebe7:1480:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
09c999bfb113a7db5f0ecf8e6bafe64a8058830c3a1322eb0a1702f87ae30a32

Request headers

Referer
https://forums.malwarebytes.com/topic/171022-got-infected/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Mon, 13 Jan 2020 17:37:51 GMT
content-encoding
gzip
last-modified
Mon, 13 Jan 2020 17:25:10 GMT
server
AmazonS3
age
150731
etag
"d676afaae27bfd97a1b92dc5ad302d76"
x-cache
Hit from cloudfront
content-type
text/javascript
status
200
cache-control
public, max-age=31536000
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
content-length
652
via
1.1 71dbd5706c5b0c7b733248e1171f2d4f.cloudfront.net (CloudFront)
x-amz-cf-id
h4WdA3zE7fdwz4NkeyHoCc-7k-x9DrEnhcHst5jCBdS_fVgD_mGj5A==
truncated
/ 		42 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Content-Type
image/gif
KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
fonts.gstatic.com/s/roboto/v20/ 		11 KB
11 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
Requested by
Host: forums.malwarebytes.com
URL: https://forums.malwarebytes.com/topic/171022-got-infected/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:817::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer
https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i
Origin
https://forums.malwarebytes.com

Response headers

date
Thu, 21 Nov 2019 15:36:21 GMT
x-content-type-options
nosniff
last-modified
Wed, 24 Jul 2019 01:18:50 GMT
server
sffe
age
4737220
content-type
font/woff2
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-origin
*
content-length
11016
x-xss-protection
0
expires
Fri, 20 Nov 2020 15:36:21 GMT
fontawesome-webfont.woff2
forums.malwarebytes.com/applications/core/interface/font/ 		75 KB
76 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://forums.malwarebytes.com/applications/core/interface/font/fontawesome-webfont.woff2?v=4.7.0
Requested by
Host: forums.malwarebytes.com
URL: https://forums.malwarebytes.com/topic/171022-got-infected/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.101.86 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-143-204-101-86.fra50.r.cloudfront.net
Software
Apache/2.4.39 (Amazon) OpenSSL/1.0.2k-fips PHP/7.1.32 /
Resource Hash
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer
https://content.invisioncic.com/Mmalware/css_built_18/341e4a57816af3ba440d891ca87450ff_framework.css.6c7743120892f4e32255580886ede065.css.gz?v=eda510d912
Origin
https://forums.malwarebytes.com

Response headers

date
Wed, 16 Oct 2019 19:01:27 GMT
via
1.1 a394c864b23364262af48fed4e7e9fad.cloudfront.net (CloudFront)
last-modified
Wed, 02 Oct 2019 16:12:39 GMT
server
Apache/2.4.39 (Amazon) OpenSSL/1.0.2k-fips PHP/7.1.32
age
2204397
etag
"12d68-593efbce2cbc0"
x-cache
Hit from cloudfront
status
200
cache-control
max-age=31536000, public
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
content-length
77160
x-amz-cf-id
E8iGOOL0TJwDU5zFgQFsCxNYky4H0Re9IIAlQ60okhDTUqkU8psJTQ==
KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v20/ 		11 KB
11 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2
Requested by
Host: forums.malwarebytes.com
URL: https://forums.malwarebytes.com/topic/171022-got-infected/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:817::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
0d9fd7ccabde9b202de45ee6b65878ce9594975d8e8810b0878d3f3fa3637d0e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer
https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i
Origin
https://forums.malwarebytes.com

Response headers

date
Wed, 20 Nov 2019 18:56:52 GMT
x-content-type-options
nosniff
last-modified
Wed, 24 Jul 2019 01:18:58 GMT
server
sffe
age
4811589
content-type
font/woff2
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-origin
*
content-length
11020
x-xss-protection
0
expires
Thu, 19 Nov 2020 18:56:52 GMT
icomoon.woff
forums.malwarebytes.com/applications/core/interface/font/ 		3 KB
3 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://forums.malwarebytes.com/applications/core/interface/font/icomoon.woff?v=-29n77j
Requested by
Host: forums.malwarebytes.com
URL: https://forums.malwarebytes.com/topic/171022-got-infected/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.101.86 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-143-204-101-86.fra50.r.cloudfront.net
Software
Apache/2.4.39 (Amazon) OpenSSL/1.0.2k-fips PHP/7.1.32 /
Resource Hash
c4dc92b008688c213242cfaf0cbe2bfd0fc689326a7b878cbc1cfa8afd87b763

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer
https://content.invisioncic.com/Mmalware/css_built_18/341e4a57816af3ba440d891ca87450ff_framework.css.6c7743120892f4e32255580886ede065.css.gz?v=eda510d912
Origin
https://forums.malwarebytes.com

Response headers

date
Wed, 16 Oct 2019 19:16:43 GMT
via
1.1 a394c864b23364262af48fed4e7e9fad.cloudfront.net (CloudFront)
last-modified
Wed, 02 Oct 2019 16:12:39 GMT
server
Apache/2.4.39 (Amazon) OpenSSL/1.0.2k-fips PHP/7.1.32
age
7833778
etag
"a74-593efbce2cbc0"
x-cache
Hit from cloudfront
status
200
cache-control
max-age=31536000, public
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
content-length
2676
x-amz-cf-id
bRmaFRrUUG81qIGaMIdqV7F9W9YaF0O3Z-OPPoLaPrUE6cwRHZkLcQ==
KFOkCnqEu92Fr1Mu51xIIzIXKMny.woff2
fonts.gstatic.com/s/roboto/v20/ 		12 KB
12 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v20/KFOkCnqEu92Fr1Mu51xIIzIXKMny.woff2
Requested by
Host: forums.malwarebytes.com
URL: https://forums.malwarebytes.com/topic/171022-got-infected/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:817::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
3be0a916496d7936bb83ce60a4de9f10ef400f16c38e7dd7c65449c795e7739b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer
https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i
Origin
https://forums.malwarebytes.com

Response headers

date
Thu, 19 Dec 2019 18:22:27 GMT
x-content-type-options
nosniff
last-modified
Wed, 24 Jul 2019 01:19:00 GMT
server
sffe
age
2308054
content-type
font/woff2
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-origin
*
content-length
12680
x-xss-protection
0
expires
Fri, 18 Dec 2020 18:22:27 GMT
analytics.js
www.google-analytics.com/ 		43 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: forums.malwarebytes.com
URL: https://forums.malwarebytes.com/topic/171022-got-infected/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://forums.malwarebytes.com/topic/171022-got-infected/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 19 Aug 2019 17:22:41 GMT
server
Golfe2
age
6707
date
Wed, 15 Jan 2020 09:38:14 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
17803
expires
Wed, 15 Jan 2020 11:38:14 GMT
bat.js
bat.bing.com/ 		23 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://bat.bing.com/bat.js
Requested by
Host: forums.malwarebytes.com
URL: https://forums.malwarebytes.com/topic/171022-got-infected/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
/
Resource Hash
b139982ce002c53ddfb65aec1e90704c0a3704fc5aa35247f9323b74a1d3f721

Request headers

Referer
https://forums.malwarebytes.com/topic/171022-got-infected/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Wed, 15 Jan 2020 11:30:01 GMT
content-encoding
gzip
last-modified
Tue, 10 Sep 2019 18:57:28 GMT
x-msedge-ref
Ref A: 2B004A3360B8478A93F745784CD2060F Ref B: FRAEDGE0912 Ref C: 2020-01-15T11:30:01Z
access-control-allow-origin
*
etag
"09c5197968d51:0"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
private,max-age=1800
accept-ranges
bytes
content-length
7148
activityi;dc_pre=CPyygbzAhecCFQfHdwodI84Nog;src=8019375;type=malwa000;cat=malwa0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=3001780436746.797
8019375.fls.doubleclick.net/ Frame 13AE
Redirect Chain
  • https://8019375.fls.doubleclick.net/activityi;src=8019375;type=malwa000;cat=malwa0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=3001780436746.797?
  • https://8019375.fls.doubleclick.net/activityi;dc_pre=CPyygbzAhecCFQfHdwodI84Nog;src=8019375;type=malwa000;cat=malwa0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=3001780436746....
0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://8019375.fls.doubleclick.net/activityi;dc_pre=CPyygbzAhecCFQfHdwodI84Nog;src=8019375;type=malwa000;cat=malwa0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=3001780436746.797?
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKSKW3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.205.230 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s24-in-f230.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=21600
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
8019375.fls.doubleclick.net
:scheme
https
:path
/activityi;dc_pre=CPyygbzAhecCFQfHdwodI84Nog;src=8019375;type=malwa000;cat=malwa0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=3001780436746.797?
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
sec-fetch-mode
nested-navigate
referer
https://forums.malwarebytes.com/topic/171022-got-infected/
accept-encoding
gzip, deflate, br
cookie
test_cookie=CheckForPermission
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer
https://forums.malwarebytes.com/topic/171022-got-infected/

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
date
Wed, 15 Jan 2020 11:30:01 GMT
expires
Wed, 15 Jan 2020 11:30:01 GMT
cache-control
private, max-age=0
strict-transport-security
max-age=21600
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
426
x-xss-protection
0
set-cookie
IDE=AHWqTUnKNAVA5SyfTGxIDU39jkppfQP_S1a6E7FD8WDxdVQMUtlgX1BlmSglVPWn; expires=Mon, 08-Feb-2021 11:30:01 GMT; path=/; domain=.doubleclick.net; HttpOnly; SameSite=none test_cookie=; domain=.doubleclick.net; path=/; expires=Mon, 21 Jul 2008 23:59:00 GMT; SameSite=none
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

Redirect headers

status
302
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
date
Wed, 15 Jan 2020 11:30:01 GMT
pragma
no-cache
expires
Fri, 01 Jan 1990 00:00:00 GMT
cache-control
no-cache, must-revalidate
follow-only-when-prerender-shown
1
strict-transport-security
max-age=21600
location
https://8019375.fls.doubleclick.net/activityi;dc_pre=CPyygbzAhecCFQfHdwodI84Nog;src=8019375;type=malwa000;cat=malwa0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=3001780436746.797?
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
server
cafe
content-length
0
x-xss-protection
0
set-cookie
test_cookie=CheckForPermission; expires=Wed, 15-Jan-2020 11:45:01 GMT; path=/; domain=.doubleclick.net; SameSite=none
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
2893.js
script.crazyegg.com/pages/scripts/0081/ 		40 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://script.crazyegg.com/pages/scripts/0081/2893.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKSKW3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9308 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
72c6cf0d7e11d85807d48374895ca48b50279aa1fe6931b7598b021e1bae2c3f

Request headers

Referer
https://forums.malwarebytes.com/topic/171022-got-infected/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Wed, 15 Jan 2020 11:30:01 GMT
via
1.1 3c429b155b4bc84bcbd72d3b916b25d2.cloudfront.net (CloudFront)
cf-cache-status
HIT
age
8230
cf-polished
origSize=40824
x-cache
Miss from cloudfront
status
200
content-encoding
gzip
last-modified
Fri, 10 Jan 2020 06:03:25 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=300
x-amz-cf-pop
LHR62-C1
cf-ray
555783e9cabadfdb-FRA
x-amz-cf-id
UQPgMwr9DE4sRvG37bmb_exzLcLrVwIaCgkQJNVvQ08S1EqkhkgBCA==
cf-bgj
minify
ga-audiences
www.google.de/ads/
Redirect Chain
  • https://www.google-analytics.com/r/collect?v=1&_v=j79&a=1871138128&t=pageview&_s=1&dl=https%3A%2F%2Fforums.malwarebytes.com%2Ftopic%2F171022-got-infected%2F&ul=en-us&de=UTF-8&dt=Got%20infected.%20-...
  • https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-3347303-10&cid=936509791.1579087802&jid=1842920160&_gid=1885712220.1579087802&gjid=2079269106&_v=j79&z=616229360
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-3347303-10&cid=936509791.1579087802&jid=1842920160&_v=j79&z=616229360
  • https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-3347303-10&cid=936509791.1579087802&jid=1842920160&_v=j79&z=616229360&slf_rd=1&random=487636520
42 B
478 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-3347303-10&cid=936509791.1579087802&jid=1842920160&_v=j79&z=616229360&slf_rd=1&random=487636520
Requested by
Host: forums.malwarebytes.com
URL: https://forums.malwarebytes.com/topic/171022-got-infected/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:825::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://forums.malwarebytes.com/topic/171022-got-infected/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 15 Jan 2020 11:30:02 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Wed, 15 Jan 2020 11:30:01 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
location
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-3347303-10&cid=936509791.1579087802&jid=1842920160&_v=j79&z=616229360&slf_rd=1&random=487636520
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
302
cache-control
no-cache, no-store, must-revalidate
content-type
text/html; charset=UTF-8
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
0
bat.bing.com/action/ 		0
148 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bat.bing.com/action/0?ti=4072696&Ver=2&mid=43c4605a-8722-b264-2f26-8d3fc6d84e3d&pi=0&lg=en-US&sw=1600&sh=1200&sc=24&tl=Got%20infected.%20-%20Resolved%20Malware%20Removal%20Logs%20-%20Malwarebytes%20Forums&p=https%3A%2F%2Fforums.malwarebytes.com%2Ftopic%2F171022-got-infected%2F&r=&lt=398&evt=pageLoad&msclkid=N&rn=291298
Requested by
Host: forums.malwarebytes.com
URL: https://forums.malwarebytes.com/topic/171022-got-infected/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://forums.malwarebytes.com/topic/171022-got-infected/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

status
204
pragma
no-cache
date
Wed, 15 Jan 2020 11:30:01 GMT
cache-control
no-cache, must-revalidate
x-msedge-ref
Ref A: 6980FBBBC7C542A7B310E7A39E1FF161 Ref B: FRAEDGE0912 Ref C: 2020-01-15T11:30:01Z
access-control-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
MzM5MjI3fDE1NzA3NTM0NDI=
sample-api-v2.crazyegg.com/n/812893/ 		51 B
578 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://sample-api-v2.crazyegg.com/n/812893/MzM5MjI3fDE1NzA3NTM0NDI=?v=7&user_script_version=1578636200
Requested by
Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0081/2893.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.225.70.184 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-225-70-184.compute-1.amazonaws.com
Software
nginx/1.12.1 /
Resource Hash
43463bdb328f880bbee8c8c4fa6cb948acc039fc4a863f4f4ec1548c7164e863
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer
https://forums.malwarebytes.com/topic/171022-got-infected/
Origin
https://forums.malwarebytes.com

Response headers

Date
Wed, 15 Jan 2020 11:30:02 GMT
X-Content-Type-Options
nosniff
Server
nginx/1.12.1
X-Frame-Options
SAMEORIGIN
Access-Control-Allow-Methods
GET
Content-Type
text/html;charset=utf-8
Access-Control-Allow-Origin
*
Cache-control
no-cache="set-cookie"
Connection
keep-alive
Content-Length
51
X-XSS-Protection
1; mode=block
front_front_widgets.js.ecbab50e1d3e08542633fda884a1bdf3.js.gz
content.invisioncic.com/Mmalware/javascript_core/ 		16 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://content.invisioncic.com/Mmalware/javascript_core/front_front_widgets.js.ecbab50e1d3e08542633fda884a1bdf3.js.gz?csrfKey=1618526c4fa06a50158a6013aa3435b7&antiCache=eda510d912
Requested by
Host: content.invisioncic.com
URL: https://content.invisioncic.com/Mmalware/javascript_global/root_library.js.2e95e327a81aaf0a9b618b8e657b73dd.js.gz
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:21f3:6a00:1e:ebe7:1480:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
6be7316f5723aa38095a52b175efa8e9048345ff88227c7e806971dc888afe3c

Request headers

Referer
https://forums.malwarebytes.com/topic/171022-got-infected/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Wed, 15 Jan 2020 11:28:50 GMT
content-encoding
gzip
last-modified
Sun, 12 Jan 2020 19:41:23 GMT
server
AmazonS3
age
73
etag
"9759bfb7c0a0b0f71a937bcb53b1582e"
x-cache
Hit from cloudfront
content-type
text/javascript
status
200
cache-control
public, max-age=31536000
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
content-length
4282
via
1.1 71dbd5706c5b0c7b733248e1171f2d4f.cloudfront.net (CloudFront)
x-amz-cf-id
75S9zFWvlPwcOIjriWxbgPqq6d6nQFvxSk3lDipE5k7tG7aDIXMhGQ==

Verdicts & Comments Add Verdict or Comment

51 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate object| dataLayer boolean| ipsDebug string| CKEDITOR_BASEPATH object| ipsSettings object| google_tag_manager function| postscribe object| Debug object| ips function| _ function| $ function| jQuery function| EvEmitter function| imagesLoaded object| Mustache object| jstz object| linkify function| Hammer function| XRegExp boolean| PR_SHOULD_USE_CONTINUATION function| prettyPrintOne function| prettyPrint object| PR function| recaptcha2Callback function| escapeRegExp object| ipsJavascriptMap function| ctSetCookie function| ctMouseStopData function| ctKeyStopStopListening object| d number| ctTimeMs boolean| ctMouseEventTimerFlag string| ctMouseData number| ctMouseDataCounter number| ctMouseReadInterval number| ctMouseWriteDataInterval function| ctFunctionMouseMove function| ctFunctionFirstKey number| hshInterval string| GoogleAnalyticsObject function| ga object| uetq string| axel number| a object| google_tag_data object| gaplugins object| gaGlobal object| gaData function| UET object| CE2

18 Cookies

Domain/Path Name / Value
.mathtag.com/ Name: uuidc
Value: HHBcjXM6qJ20S6VkkYkvVdo7v5ezL/O3dkCAwGcVBlEDOxJW6/4dDf7pxGgzdXaUJJ73oZHNlT3G+1MXbUi0OQfuvjVFdEImG1U7lxScwf0=
.malwarebytes.com/ Name: _gat
Value: 1
.mathtag.com/ Name: mt_mop
Value:
.mathtag.com/ Name: uuid
Value: e1a55e1e-f30c-4b00-964a-15267a107cf8
.malwarebytes.com/ Name: _gid
Value: GA1.2.1885712220.1579087802
.mathtag.com/ Name: mt_misc
Value: mt_bt:1
.doubleclick.net/ Name: IDE
Value: AHWqTUnKNAVA5SyfTGxIDU39jkppfQP_S1a6E7FD8WDxdVQMUtlgX1BlmSglVPWn
forums.malwarebytes.com/ Name: ips4_hasJS
Value: true
forums.malwarebytes.com/ Name: ct_pointer_data
Value: 0
forums.malwarebytes.com/ Name: ips4_ipsTimezone
Value: Europe/Berlin
forums.malwarebytes.com/ Name: ct_fkp_timestamp
Value: 0
forums.malwarebytes.com/ Name: ct_ps_timestamp
Value: 1579087801
forums.malwarebytes.com/ Name: ct_timezone
Value: 0
forums.malwarebytes.com/ Name: ips4_guestTime
Value: 1579087727
forums.malwarebytes.com/ Name: ips4_IPSSessionFront
Value: e261i4v8r37g5inst6bhvpknlc
forums.malwarebytes.com/ Name: ct_cookies_test
Value: %7B%22cookies_names%22%3A%5B%5D%2C%22check_value%22%3A%229533b808c1c1d7b1afde9a8986ca2daf%22%7D
.malwarebytes.com/ Name: _ga
Value: GA1.2.936509791.1579087802
forums.malwarebytes.com/ Name: SimpleSAMLSessionID
Value: 6cc2f92992ffdc2f28d1b7575158315c

1 Console Messages

Source Level URL
Text
console-api log URL: https://content.invisioncic.com/Mmalware/javascript_global/root_library.js.2e95e327a81aaf0a9b618b8e657b73dd.js.gz(Line 18)
Message:
%cThis is a browser feature intended for developers. Do not paste any code here given to you by someone else. It may compromise your account or have other negative side effects. font-weight: bold; font-size: 14px;

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Frame-Options sameorigin
X-Xss-Protection 0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

8019375.fls.doubleclick.net
bat.bing.com
content.invisioncic.com
fonts.googleapis.com
fonts.gstatic.com
forums.malwarebytes.com
forums.whatthetech.com
i.imgur.com
sample-api-v2.crazyegg.com
script.crazyegg.com
stats.g.doubleclick.net
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
104.28.1.37
143.204.101.86
151.101.112.193
2001:4860:4802:36::75
216.58.205.230
2600:9000:21f3:6a00:1e:ebe7:1480:93a1
2606:4700::6813:9308
2620:1ec:c11::200
2a00:1450:4001:816::200e
2a00:1450:4001:817::2003
2a00:1450:4001:821::2008
2a00:1450:4001:825::2003
2a00:1450:4001:825::200a
2a00:1450:400c:c00::9c
54.225.70.184
09c999bfb113a7db5f0ecf8e6bafe64a8058830c3a1322eb0a1702f87ae30a32
0d9fd7ccabde9b202de45ee6b65878ce9594975d8e8810b0878d3f3fa3637d0e
12eaa6a5503c3b6eab18e46afdbbbdd0575d8d111edf8e64ada3058e38900165
159308ebb6cd30326aa68872f9a327c7b99ec1a2d167d509ff333bec2e098b79
17033b694ddfe3b2942c4f92aa894c58d652ec331355a5904cb54d0e165ddb26
1be8808fef6189e0ac4f98c0dc85d7e102f699305a557ace57b0b8587ae747de
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
2c283b1a1573316f070502598d3af0e55917604ee347317fdfd62c0d583f37f7
2d1d098eba61a6a846f1201570f3e690408acadff667df0c705f4044cc9bb5fd
2ed0ba5e0544b1811d2c647208a28b5ffd310aa67663f1dd55c06f9e394ff211
39270e0c063b6b5afa9bd8ab4a569b33a1ac41a9c651828a82df2e3f9b6bd620
3be0a916496d7936bb83ce60a4de9f10ef400f16c38e7dd7c65449c795e7739b
43463bdb328f880bbee8c8c4fa6cb948acc039fc4a863f4f4ec1548c7164e863
576abb2fcd75b6372bccc6c8f308c0f0ed8b8de4420a8d3aedab1d6a650589a5
5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479
61c330480d49d2c9c9caf0dbf4822c469c4fbe83ed5d216edec83617b45bcd43
61ef9e2455bcee7609ca7c4da041b7d72f66df99f2cd7f8fab98c0cd0235c318
6a1f8f243c85f0023dcf30a77a626a1885076cbcc5e268129f6e1f978713df3f
6be7316f5723aa38095a52b175efa8e9048345ff88227c7e806971dc888afe3c
72c6cf0d7e11d85807d48374895ca48b50279aa1fe6931b7598b021e1bae2c3f
79da3943e20c1f50e3074a81eedb21af15f2fe0a9c04d0fab70caf1bf1dfc4e3
8074f6b09257dd0b1831a69a0956d74950c032e31df10708bd376b4ae9f5d3f4
9010a4681ec9df0ca926a55361090e76154ea89103f373694f5ba44194c7d229
9eae644b41d78c64dbbaf4b4579441e4f7c5e8665786876ec9c3f04eb356214a
b139982ce002c53ddfb65aec1e90704c0a3704fc5aa35247f9323b74a1d3f721
b205e1f29eb67183b5c3008c3de8446373fe9bfcfed7b08ab0f1ec84ab81e28c
b3bb440d767dfddecedbefd9b9f374b69ab2fcd7979766317cd9c9095684d8d2
c003d5a094e07dd4b93f9cb7dc877814ce3563c0d72f27c630759d2eaac69b3f
c451e968e926da4739ed2dd2a66a18f7b7c072235da7db7bce15a8ddb7acfaf8
c4dc92b008688c213242cfaf0cbe2bfd0fc689326a7b878cbc1cfa8afd87b763
c90dd4aa28a47571696f2cdbe5aff456de88a9cc3b6a0865e7524761696070ab
c9b19667188a7a142b2f9e0841928d3a2137bf476d158c86fa58f6bfb05a5f68
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e7bc15fa24b8f81c4ed4c49bf751a5ae00c7e470503947d650b794b970f46df8
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f0bec4e20bc4af56f95159be1e6dd93c1150eae46e1aabd71db1b5d937af44bb
f60e704278243c82c28bc263d0ad6f0fbda6f71099c6e72b799e0b719dba5d50
fb1a5c8f738456fc3d945fa837c7f2ea7d5f4f8ced2af58481c03fb7c57661ee
ffbaa8a62d135868509cc51e7a0ffecefa63b633a4fbdbac46d832ee287740bf