www.buguroo.com Open in urlscan Pro
2606:4700::6811:70b4 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.buguroo.com/en/labs/emotet-has-begun-distributing-the-qakbot-bank-malware?hs_amp=true
Submission: On August 15 via api (August 15th 2020, 7:12:28 pm UTC) from US

Summary HTTP 10 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 3 countries across 7 domains to perform 10 HTTP transactions. The main IP is 2606:4700::6811:70b4, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.buguroo.com.
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on September 17th 2019. Valid for: a year.

This is the only time www.buguroo.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
3	2606:4700::68... 2606:4700::6811:70b4	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	2a00:1450:400... 2a00:1450:4001:825::2001	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6813:9a53	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	2a00:1450:400... 2a00:1450:4001:814::200e	15169 (GOOGLE) (GOOGLE)
1 1	2a00:1450:400... 2a00:1450:400c:c0c::9c	15169 (GOOGLE) (GOOGLE)
1 1	2a00:1450:400... 2a00:1450:4001:81c::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:800::2003	15169 (GOOGLE) (GOOGLE)
10	4

3 2606:4700::6811:70b4 (United States)

ASN13335 (CLOUDFLARENET, US)

www.buguroo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:825::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

cdn.ampproject.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6813:9a53 (United States)

ASN13335 (CLOUDFLARENET, US)

track.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:814::200e (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c0c::9c (Brussels, Belgium) 1 redirects

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81c::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:800::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	ampproject.org cdn.ampproject.org	124 KB
3	buguroo.com www.buguroo.com	25 KB
1	google.de www.google.de	106 B
1	google.com 1 redirects www.google.com	191 B
1	doubleclick.net 1 redirects stats.g.doubleclick.net	190 B
1	google-analytics.com 1 redirects www.google-analytics.com	232 B
1	hubspot.com track.hubspot.com	528 B
10	7

	Domain	Requested by
5	cdn.ampproject.org	www.buguroo.com cdn.ampproject.org
3	www.buguroo.com
1	www.google.de
1	www.google.com	1 redirects
1	stats.g.doubleclick.net	1 redirects
1	www.google-analytics.com	1 redirects
1	track.hubspot.com
10	7

This site contains no links.

Subject Issuer	Validity	Valid
www.buguroo.com CloudFlare Inc ECC CA-2	`2019-09-17` - `2020-09-16`	a year	crt.sh
misc-sni.google.com GTS CA 1O1	`2020-07-15` - `2020-10-07`	3 months	crt.sh
hubspot.com Cloudflare Inc ECC CA-3	`2020-07-27` - `2021-07-27`	a year	crt.sh
www.google.de GTS CA 1O1	`2020-07-15` - `2020-10-07`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://www.buguroo.com/en/labs/emotet-has-begun-distributing-the-qakbot-bank-malware?hs_amp=true
Frame ID: 3BD75446E670BAF9ED3D043C56C1830F
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Page Statistics

10
Requests

100 %
HTTPS

100 %
IPv6

7
Domains

7
Subdomains

4
IPs

3
Countries

149 kB
Transfer

460 kB
Size

4
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 8

https://www.google-analytics.com/r/collect?v=1&_v=a1&ds=AMP&aip&_s=1&dt=Emotet%20has%20begun%20distributing%20the%20QakBot%20bank%20malware&sr=1600x1200&_utmht=1597518728473&cid=amp-vhjlUh6SMtb0MKOY8w9AVw&tid=UA-19097152-1&dl=https%3A%2F%2Fwww.buguroo.com%2Fen%2Flabs%2Femotet-has-begun-distributing-the-qakbot-bank-malware%3Fhs_amp%3Dtrue&dr=&sd=24&ul=en-us&de=UTF-8&t=pageview&jid=0.7221306517911286&_r=1&a=8212&z=0.7885416314170619 HTTP 302
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-19097152-1&cid=amp-vhjlUh6SMtb0MKOY8w9AVw&jid=0.7221306517911286&_v=a1&z=0.7885416314170619 HTTP 302
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-19097152-1&cid=amp-vhjlUh6SMtb0MKOY8w9AVw&jid=0.7221306517911286&_v=a1&z=0.7885416314170619 HTTP 302
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-19097152-1&cid=amp-vhjlUh6SMtb0MKOY8w9AVw&jid=0.7221306517911286&_v=a1&z=0.7885416314170619&slf_rd=1&random=3960599606

10 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request emotet-has-begun-distributing-the-qakbot-bank-malware Show response
www.buguroo.com/en/labs/ 14 KB
5 KB 80ms
51ms Document
text/html 2606:4700::6811:70b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.buguroo.com/en/labs/emotet-has-begun-distributing-the-qakbot-bank-malware?hs_amp=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:70b4 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / HubSpot

Resource Hash

0156f93819020ec0a436dd90d7bd67fed116c43276caa410f4cdf1c337ada92b

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

:method: GET
:authority: www.buguroo.com
:scheme: https
:path: /en/labs/emotet-has-begun-distributing-the-qakbot-bank-malware?hs_amp=true
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Sat, 15 Aug 2020 19:12:08 GMT
content-type: text/html; charset=UTF-8
set-cookie: __cfduid=d30784be4e01316892009f3065f0079801597518728; expires=Mon, 14-Sep-20 19:12:08 GMT; path=/; domain=.www.buguroo.com; HttpOnly; SameSite=Lax __cfruid=c714d92bcc24a8073400d78ba12ec713f13c0ab7-1597518728; path=/; domain=.www.buguroo.com; HttpOnly; Secure; SameSite=None
cache-control: s-maxage=30,max-age=5
etag: W/"983754d14194034716443c49b97abead"
last-modified: Sat, 15 Aug 2020 16:42:59 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-cache-status: HIT
cache-tag: CT-33235502450,P-2264844,PGS-ALL,SW-4
content-security-policy: upgrade-insecure-requests
edge-cache-tag: CT-33235502450,P-2264844,PGS-ALL,SW-4
x-hs-cache-config: BrowserCache-5s-EdgeCache-30s
x-hs-content-id: 33235502450
x-hs-hub-id: 2264844
x-powered-by: HubSpot
cf-request-id: 04952263f5000006292b9a7200000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
server: cloudflare
cf-ray: 5c3539b3288f0629-FRA
content-encoding: br

GET
H2 200 amp-analytics-0.1.js Show response
cdn.ampproject.org/v0/ 96 KB
30 KB 26ms
14ms Script
text/javascript 2a00:1450:4001:825::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/v0/amp-analytics-0.1.js

Requested by

Host: www.buguroo.com
URL: https://www.buguroo.com/en/labs/emotet-has-begun-distributing-the-qakbot-bank-malware?hs_amp=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c7b5ce3edc742d38d8e2ac91d9aeb00ba6c0a3e884754ff0567edaa35eb7a7c1

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.buguroo.com/en/labs/emotet-has-begun-distributing-the-qakbot-bank-malware?hs_amp=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29738
x-xss-protection: 0
server: sffe
date: Sat, 15 Aug 2020 19:12:08 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: private, max-age=604800, stale-while-revalidate=604800
etag: "7750398293a9b8b2"
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 15 Aug 2020 19:12:08 GMT

GET
H2 200 v0.js Show response
cdn.ampproject.org/ 263 KB
71 KB 27ms
15ms Script
text/javascript 2a00:1450:4001:825::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/v0.js

Requested by

Host: www.buguroo.com
URL: https://www.buguroo.com/en/labs/emotet-has-begun-distributing-the-qakbot-bank-malware?hs_amp=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5115922f7ef6a5902c70e9e8b44ff9cc9896e8c69d1c149cdf2fe365a3b6ec21

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.buguroo.com/en/labs/emotet-has-begun-distributing-the-qakbot-bank-malware?hs_amp=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 73016
x-xss-protection: 0
server: sffe
date: Sat, 15 Aug 2020 19:12:08 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: private, max-age=3000, stale-while-revalidate=1206600
etag: "03b06ec8352fd2ae"
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 15 Aug 2020 19:12:08 GMT

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
528 B 61ms
43ms Image
image/gif 2606:4700::6813:9a53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?cd=24-bit&cs=UTF-8&ln=en-us&sd=1600x1200&v=1.1&iaa=1&k=1&ccu=https%3A%2F%2Fwww.buguroo.com%2Fen%2Flabs%2Femotet-has-begun-distributing-the-qakbot-bank-malware&r=&ct=blog-post&t=Emotet+has+begun+distributing+the+QakBot+bank+malware&pi=33235502450&a=2264844&nc=true&cgi=14901678540&vi=amp-55HnX_o9mF2J5D5qtbP3YQ&ai=amp-wJwT1RbRGLqv8IaA5YLMgw

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.buguroo.com/en/labs/emotet-has-begun-distributing-the-qakbot-bank-malware?hs_amp=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

cf-ray: 5c3539b48a8dd6dd-FRA
date: Sat, 15 Aug 2020 19:12:08 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
p3p: CP="NOI CUR ADM OUR NOR STA NID"
status: 200
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/gif
content-length: 45
cf-request-id: 04952264d40000d6dd52191200000001
x-robots-tag: none

GET
H2 200 logo_buguroo_SA.png
www.buguroo.com/hubfs/ 3 KB
4 KB 23ms
22ms Image
image/webp 2606:4700::6811:70b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.buguroo.com/hubfs/logo_buguroo_SA.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:70b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: af6f2a4547572e883558f53fa5565f75963f0f0ec18e8cc09e4314d2e3acd9bf

Request headers

Referer: https://www.buguroo.com/en/labs/emotet-has-begun-distributing-the-qakbot-bank-malware?hs_amp=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 15 Aug 2020 19:12:08 GMT
via: 1.1 d5fb859c39a16d7f218b4c7fb1528ad6.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-22032694945,P-2264844,FLS-ALL
age: 247
cf-polished: origFmt=png, origSize=8209
edge-cache-tag: F-22032694945,P-2264844,FLS-ALL
status: 200
content-disposition: inline; filename="logo_buguroo_SA.webp"
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 9
x-amz-request-id: 79AD0100840139E1
cf-request-id: 04952264c4000006292b9c9200000001
x-cache: Miss from cloudfront
accept-ranges: bytes
last-modified: Tue, 26 Nov 2019 10:07:47 GMT
server: cloudflare
etag: "c038a8a1d9fd008891effd10246e9a3a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
x-amz-id-2: /YfhiSkRWe/XvyTxaOX2bOTf+/8YIJrLPm7YJZvNuQMSuTXFfoXzxbl0HbUg/xtEvm2oXYuP8TE=
cf-bgj: imgq:85,h2pri
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-amz-version-id: d.9qx6eAgMaYPFeXD6GnbOH1wy4biet_
x-amz-cf-pop: FRA6-C1
content-length: 3308
cf-ray: 5c3539b46ccc0629-FRA
x-amz-cf-id: TD3PHvVhmet29BGGbYsIOV4pOJFaSM7C3Uzp07mK7CT5r5MA2HM7Pw==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 9

GET
H2 200 EmotetQakBot-01.jpg
www.buguroo.com/hs-fs/hubfs/ 16 KB
16 KB 25ms
24ms Image
image/webp 2606:4700::6811:70b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.buguroo.com/hs-fs/hubfs/EmotetQakBot-01.jpg?width=1772&name=EmotetQakBot-01.jpg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:70b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5a08b464a3ad1ec66906134ad16f625a1134b15902947afef08751eb70a19809

Request headers

Referer: https://www.buguroo.com/en/labs/emotet-has-begun-distributing-the-qakbot-bank-malware?hs_amp=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 15 Aug 2020 19:12:08 GMT
via: 1.1 fba666ceffdeb316c8edf476d8994bd5.cloudfront.net (CloudFront)
cf-cache-status: HIT
age: 248
cf-polished: qual=85, origFmt=jpeg, origSize=51722
cf-ray: 5c3539b46ccf0629-FRA
edge-cache-tag: F-33234502557,P-2264844,FLS-ALL
status: 200
x-amz-replication-status: COMPLETED
content-disposition: inline; filename="EmotetQakBot-01.webp"
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 9
content-length: 16102
cf-request-id: 04952264c4000006292b9ca200000001
x-amz-meta-index-tag: all
x-amz-server-side-encryption: AES256
last-modified: Tue, 04 Aug 2020 08:23:41 GMT
server: cloudflare
x-cache: Miss from cloudfront
etag: "e35ab379d77b241df55415e8a3601ec9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1596529420632
content-type: image/webp
cf-bgj: imgq:85,h2pri
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
access-control-allow-credentials: false
x-amz-cf-pop: IAD89-C1
accept-ranges: bytes
x-robots-tag: all
x-amz-cf-id: y1J6_OxTEd_bqSeBAyDTQPucWIJnZnFtU2G0NF8aVjJw7671x9Bayw==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 9

GET
H/2+Q/46 200 amp-auto-lightbox-0.1.js Show response
cdn.ampproject.org/rtv/012007302351001/v0/ 7 KB
4 KB 27ms
13ms Script
text/javascript 2a00:1450:4001:825::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012007302351001/v0/amp-auto-lightbox-0.1.js

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js

Protocol

HTTP/2+QUIC/46

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:825::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2deb12b6556eb773bcf61f7ddfac533ab456f270b9cd1f3a15836292a8f0884e

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://www.buguroo.com
Referer: https://www.buguroo.com/en/labs/emotet-has-begun-distributing-the-qakbot-bank-malware?hs_amp=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 337552
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2742
x-xss-protection: 0
server: sffe
date: Tue, 11 Aug 2020 21:26:16 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "2cfcc7bff0007560"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 11 Aug 2021 21:26:16 GMT

GET
H/2+Q/46 200 amp-lightbox-gallery-0.1.js Show response
cdn.ampproject.org/rtv/012007302351001/v0/ 59 KB
18 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:825::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012007302351001/v0/amp-lightbox-gallery-0.1.js

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js

Protocol

HTTP/2+QUIC/46

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:825::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1dfdc77246f0a68706f1d505b0a32caa2b931a8aec75ae837ceee39ee26d4166

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://www.buguroo.com
Referer: https://www.buguroo.com/en/labs/emotet-has-begun-distributing-the-qakbot-bank-malware?hs_amp=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 274013
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18105
x-xss-protection: 0
server: sffe
date: Wed, 12 Aug 2020 15:05:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "8ee90ea633bf6e37"
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 12 Aug 2021 15:05:15 GMT

GET
H/2+Q/46 200 googleanalytics.json Show response
cdn.ampproject.org/rtv/012007302351001/v0/analytics-vendors/ 2 KB
889 B 6ms
6ms Fetch
application/json 2a00:1450:4001:825::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012007302351001/v0/analytics-vendors/googleanalytics.json

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js

Protocol

HTTP/2+QUIC/46

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:825::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6f53945eda017435c600f05df250c86a4788653b8e2e4c17aa7d647b4ce35bdd

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: application/json
Referer: https://www.buguroo.com/en/labs/emotet-has-begun-distributing-the-qakbot-bank-malware?hs_amp=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 259838
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 778
x-xss-protection: 0
server: sffe
date: Wed, 12 Aug 2020 19:01:30 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/json
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "fa204e4ff03497ce"
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 12 Aug 2021 19:01:30 GMT

GET
H2

200

ga-audiences
www.google.de/ads/
Redirect Chain

https://www.google-analytics.com/r/collect?v=1&_v=a1&ds=AMP&aip&_s=1&dt=Emotet%20has%20begun%20distributing%20the%20QakBot%20bank%20malware&sr=1600x1200&_utmht=1597518728473&cid=amp-vhjlUh6SMtb0MKO...
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-19097152-1&cid=amp-vhjlUh6SMtb0MKOY8w9AVw&jid=0.7221306517911286&_v=a1&z=0.7885416314170619
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-19097152-1&cid=amp-vhjlUh6SMtb0MKOY8w9AVw&jid=0.7221306517911286&_v=a1&z=0.7885416314170619
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-19097152-1&cid=amp-vhjlUh6SMtb0MKOY8w9AVw&jid=0.7221306517911286&_v=a1&z=0.7885416314170619&slf_rd=1&random=3960599606

42 B
106 B

19ms
19ms

Other
image/gif

2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-19097152-1&cid=amp-vhjlUh6SMtb0MKOY8w9AVw&jid=0.7221306517911286&_v=a1&z=0.7885416314170619&slf_rd=1&random=3960599606

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.buguroo.com/en/labs/emotet-has-begun-distributing-the-qakbot-bank-malware?hs_amp=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 15 Aug 2020 19:12:08 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 15 Aug 2020 19:12:08 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
content-type: text/html; charset=UTF-8
location: https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-19097152-1&cid=amp-vhjlUh6SMtb0MKOY8w9AVw&jid=0.7221306517911286&_v=a1&z=0.7885416314170619&slf_rd=1&random=3960599606
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

16 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.buguroo.com/	1970-01-19 20:30:54	Name: amputk Value: amp-wJwT1RbRGLqv8IaA5YLMgw
.buguroo.com/	1970-01-19 20:30:54	Name: hubspotutk Value: amp-55HnX_o9mF2J5D5qtbP3YQ
.www.buguroo.com/	1969-12-31 23:59:59	Name: __cfruid Value: c714d92bcc24a8073400d78ba12ec713f13c0ab7-1597518728
.www.buguroo.com/	1970-01-19 12:28:30	Name: __cfduid Value: d30784be4e01316892009f3065f0079801597518728

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	info	URL: https://cdn.ampproject.org/v0.js(Line 548) Message: Powered by AMP ⚡ HTML – Version 2007302351001 https://www.buguroo.com/en/labs/emotet-has-begun-distributing-the-qakbot-bank-malware?hs_amp=true

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.ampproject.org
stats.g.doubleclick.net
track.hubspot.com
www.buguroo.com
www.google-analytics.com
www.google.com
www.google.de
2606:4700::6811:70b4
2606:4700::6813:9a53
2a00:1450:4001:800::2003
2a00:1450:4001:814::200e
2a00:1450:4001:81c::2004
2a00:1450:4001:825::2001
2a00:1450:400c:c0c::9c
0156f93819020ec0a436dd90d7bd67fed116c43276caa410f4cdf1c337ada92b
1dfdc77246f0a68706f1d505b0a32caa2b931a8aec75ae837ceee39ee26d4166
2deb12b6556eb773bcf61f7ddfac533ab456f270b9cd1f3a15836292a8f0884e
5115922f7ef6a5902c70e9e8b44ff9cc9896e8c69d1c149cdf2fe365a3b6ec21
5a08b464a3ad1ec66906134ad16f625a1134b15902947afef08751eb70a19809
6f53945eda017435c600f05df250c86a4788653b8e2e4c17aa7d647b4ce35bdd
af6f2a4547572e883558f53fa5565f75963f0f0ec18e8cc09e4314d2e3acd9bf
c7b5ce3edc742d38d8e2ac91d9aeb00ba6c0a3e884754ff0567edaa35eb7a7c1
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

www.buguroo.com Open in urlscan Pro 2606:4700::6811:70b4 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

10 Requests

100 %HTTPS

100 %IPv6

7 Domains

7 Subdomains

4 IPs

3 Countries

149 kBTransfer

460 kBSize

4 Cookies

0 Outgoing links

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Verdicts & Comments Add Verdict or Comment

16 JavaScript Global Variables

4 Cookies

1 Console Messages

Security Headers

Indicators

www.buguroo.com Open in urlscan Pro
2606:4700::6811:70b4 Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

100 %
HTTPS

100 %
IPv6

7
Domains

7
Subdomains

4
IPs

3
Countries

149 kB
Transfer

460 kB
Size

4
Cookies

10 HTTP transactions
0 data transactions