www.bleepingcomputer.com Open in urlscan Pro
104.20.60.209 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
Submission: On December 02 via api (December 2nd 2020, 7:35:53 pm UTC) from US

Summary HTTP 127 Redirects Links 11 Behaviour Indicators

Summary

This website contacted 42 IPs in 6 countries across 28 domains to perform 127 HTTP transactions. The main IP is 104.20.60.209, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.bleepingcomputer.com.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on May 16th 2020. Valid for: 2 years.

This is the only time www.bleepingcomputer.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	104.20.60.209 104.20.60.209	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:803::200a	15169 (GOOGLE) (GOOGLE)
42	172.67.75.139 172.67.75.139	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:817::2008	15169 (GOOGLE) (GOOGLE)
1 1	2a00:1450:400... 2a00:1450:4001:81a::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:81f::200e	15169 (GOOGLE) (GOOGLE)
1 4	151.101.194.137 151.101.194.137	54113 (FASTLY) (FASTLY)
1	2606:4700:20:... 2606:4700:20::ac43:443c	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	212.71.236.31 212.71.236.31	63949 (LINODE-AP...) (LINODE-AP Linode)
2	185.3.92.12 185.3.92.12	63949 (LINODE-AP...) (LINODE-AP Linode)
4	2a00:1450:400... 2a00:1450:4001:814::2003	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:809::2002	15169 (GOOGLE) (GOOGLE)
7	104.75.88.112 104.75.88.112	16625 (AKAMAI-AS) (AKAMAI-AS)
5	2600:9000:215... 2600:9000:2156:6400:9:46dc:4700:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:80b::200e	15169 (GOOGLE) (GOOGLE)
1	35.188.71.214 35.188.71.214	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:801::2002	15169 (GOOGLE) (GOOGLE)
2	2620:116:800d... 2620:116:800d:21:5a23:9c4e:e774:96c1	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:824::200e	15169 (GOOGLE) (GOOGLE)
1	104.111.216.96 104.111.216.96	16625 (AKAMAI-AS) (AKAMAI-AS)
1	172.217.22.38 172.217.22.38	15169 (GOOGLE) (GOOGLE)
1	104.111.216.19 104.111.216.19	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2600:9000:20e... 2600:9000:20eb:1600:6:44e3:f8c0:93a1	16509 (AMAZON-02) (AMAZON-02)
13	3.129.41.174 3.129.41.174	16509 (AMAZON-02) (AMAZON-02)
1	46.51.197.9 46.51.197.9	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:219... 2600:9000:2190:6800:3:a4cd:8380:93a1	16509 (AMAZON-02) (AMAZON-02)
2	199.232.53.140 199.232.53.140	54113 (FASTLY) (FASTLY)
1	13.224.194.60 13.224.194.60	16509 (AMAZON-02) (AMAZON-02)
6	2600:9000:215... 2600:9000:2156:a400:12:238e:df80:93a1	16509 (AMAZON-02) (AMAZON-02)
1	34.252.182.145 34.252.182.145	16509 (AMAZON-02) (AMAZON-02)
6	2a00:1450:400... 2a00:1450:4001:819::200a	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:81f::2006	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:821::2002	15169 (GOOGLE) (GOOGLE)
1	2001:4de0:ac1... 2001:4de0:ac18::1:a:3a	20446 (HIGHWINDS3) (HIGHWINDS3)
1	2a00:1450:400... 2a00:1450:4001:820::2001	15169 (GOOGLE) (GOOGLE)
1	2a02:fa8:8806... 2a02:fa8:8806:13::1460	41041 (VCLK-EU-) (VCLK-EU-)
1	185.64.189.112 185.64.189.112	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1	18.196.104.43 18.196.104.43	16509 (AMAZON-02) (AMAZON-02)
1	185.33.220.242 185.33.220.242	29990 (ASN-APPNEX) (ASN-APPNEX)
1	34.248.116.70 34.248.116.70	16509 (AMAZON-02) (AMAZON-02)
1	2607:f8b0:400... 2607:f8b0:4003:c0b::5e	15169 (GOOGLE) (GOOGLE)
1 1	2a00:1450:400... 2a00:1450:4009:4e::7	15169 (GOOGLE) (GOOGLE)
1 1	2a00:1450:400... 2a00:1450:4001:4c::7	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:9::c	15169 (GOOGLE) (GOOGLE)
127	42

1 104.20.60.209 (United States)

ASN13335 (CLOUDFLARENET, US)

www.bleepingcomputer.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:803::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

42 172.67.75.139 (United States)

ASN13335 (CLOUDFLARENET, US)

www.bleepstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:817::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81a::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81f::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

cse.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 151.101.194.137 (United States) 1 redirects

ASN54113 (FASTLY, US)

cd.connatix.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cds.connatix.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
vid.connatix.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:20::ac43:443c (United States)

ASN13335 (CLOUDFLARENET, US)

a.pub.network	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 212.71.236.31 (London, United Kingdom)

ASN63949 (LINODE-AP Linode, LLC, US)
PTR: nb-212-71-236-31.london.nodebalancer.linode.com

ecdn.analysis.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.3.92.12 (London, United Kingdom)

ASN63949 (LINODE-AP Linode, LLC, US)
PTR: nb-185-3-92-12.london.nodebalancer.linode.com

ecdn.firstimpression.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:814::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:809::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 104.75.88.112 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a104-75-88-112.deploy.static.akamaitechnologies.com

s9.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
v1.addthisedge.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
m.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
s7.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
api-public.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2600:9000:2156:6400:9:46dc:4700:93a1 (United States)

ASN16509 (AMAZON-02, US)

quantcast.mgr.consensu.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80b::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.188.71.214 (United States)

ASN15169 (GOOGLE, US)
PTR: 214.71.188.35.bc.googleusercontent.com

d.pub.network	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:801::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:116:800d:21:5a23:9c4e:e774:96c1 (United States)

ASN16509 (AMAZON-02, US)

secure.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:824::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.111.216.96 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-216-96.deploy.static.akamaitechnologies.com

z.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.22.38 (United States)

ASN15169 (GOOGLE, US)
PTR: fra15s16-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.111.216.19 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-216-19.deploy.static.akamaitechnologies.com

widgets.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:20eb:1600:6:44e3:f8c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

rules.quantcount.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 3.129.41.174 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-129-41-174.us-east-2.compute.amazonaws.com

capi.connatix.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 46.51.197.9 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-46-51-197-9.eu-west-1.compute.amazonaws.com

cdn.firstimpression.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2190:6800:3:a4cd:8380:93a1 (United States)

ASN16509 (AMAZON-02, US)

test.quantcast.mgr.consensu.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 199.232.53.140 (United States)

ASN54113 (FASTLY, US)

www.reddit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.224.194.60 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-194-60.fra2.r.cloudfront.net

audit-tcfv2.quantcast.mgr.consensu.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2600:9000:2156:a400:12:238e:df80:93a1 (United States)

ASN16509 (AMAZON-02, US)

img.connatix.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.252.182.145 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-252-182-145.eu-west-1.compute.amazonaws.com

vid.springserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:819::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

imasdk.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:81f::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:821::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac18::1:a:3a (Netherlands)

ASN20446 (HIGHWINDS3, US)

vpaid.springserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:820::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:fa8:8806:13::1460 (Sweden)

ASN41041 (VCLK-EU-, SE)

web.hb.ad.cpe.dotomi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.64.189.112 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)

hbopenbid.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.196.104.43 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-196-104-43.eu-central-1.compute.amazonaws.com

hb.emxdgt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.33.220.242 (Netherlands)

ASN29990 (ASN-APPNEX, US)
PTR: 724.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.248.116.70 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-248-116-70.eu-west-1.compute.amazonaws.com

vid-io-dub.springserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4003:c0b::5e (United States)

ASN15169 (GOOGLE, US)

csi.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4009:4e::7 (London, United Kingdom) 1 redirects

ASN15169 (GOOGLE, US)

r2---sn-aigl6ned.googlevideo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:4c::7 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

r2---sn-4g5e6nzs.googlevideo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:9::c (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

r12---sn-4g5ednzz.googlevideo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
42	bleepstatic.com www.bleepstatic.com	375 KB
23	connatix.com 1 redirects cd.connatix.com cds.connatix.com capi.connatix.com vid.connatix.com img.connatix.com	445 KB
7	consensu.org quantcast.mgr.consensu.org test.quantcast.mgr.consensu.org audit-tcfv2.quantcast.mgr.consensu.org	260 KB
7	googleapis.com fonts.googleapis.com imasdk.googleapis.com	234 KB
6	addthis.com s9.addthis.com m.addthis.com s7.addthis.com Failed api-public.addthis.com	191 KB
5	gstatic.com fonts.gstatic.com csi.gstatic.com	44 KB
4	googlesyndication.com pagead2.googlesyndication.com tpc.googlesyndication.com	133 KB
4	google.com 1 redirects www.google.com cse.google.com adservice.google.com	2 KB
3	googlevideo.com 2 redirects r2---sn-aigl6ned.googlevideo.com r2---sn-4g5e6nzs.googlevideo.com r12---sn-4g5ednzz.googlevideo.com	5 MB
3	springserve.com vid.springserve.com vpaid.springserve.com vid-io-dub.springserve.com	99 KB
3	firstimpression.io ecdn.firstimpression.io cdn.firstimpression.io	192 KB
2	2mdn.net s0.2mdn.net	21 KB
2	reddit.com www.reddit.com	844 B
2	quantserve.com secure.quantserve.com pixel.quantserve.com	9 KB
2	doubleclick.net googleads.g.doubleclick.net ad.doubleclick.net	483 B
2	google-analytics.com www.google-analytics.com	19 KB
2	pub.network a.pub.network d.pub.network	46 KB
1	adnxs.com ib.adnxs.com	861 B
1	emxdgt.com hb.emxdgt.com	316 B
1	pubmatic.com hbopenbid.pubmatic.com	122 B
1	dotomi.com web.hb.ad.cpe.dotomi.com	341 B
1	quantcount.com rules.quantcount.com	354 B
1	outbrain.com widgets.outbrain.com	3 KB
1	addthisedge.com v1.addthisedge.com	855 B
1	moatads.com z.moatads.com	1 KB
1	analysis.fi ecdn.analysis.fi	2 KB
1	googletagmanager.com www.googletagmanager.com	38 KB
1	bleepingcomputer.com www.bleepingcomputer.com	16 KB
127	28

	Domain	Requested by
42	www.bleepstatic.com	www.bleepingcomputer.com www.bleepstatic.com
13	capi.connatix.com	cd.connatix.com
6	imasdk.googleapis.com	cd.connatix.com imasdk.googleapis.com blank
6	img.connatix.com	www.bleepingcomputer.com
5	quantcast.mgr.consensu.org	www.bleepstatic.com quantcast.mgr.consensu.org
4	fonts.gstatic.com	fonts.googleapis.com
3	s7.addthis.com	s9.addthis.com
3	pagead2.googlesyndication.com	www.bleepingcomputer.com pagead2.googlesyndication.com imasdk.googleapis.com
2	adservice.google.com	imasdk.googleapis.com
2	s0.2mdn.net	imasdk.googleapis.com
2	www.reddit.com	s9.addthis.com
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
2	ecdn.firstimpression.io	www.bleepingcomputer.com ecdn.firstimpression.io
2	cds.connatix.com	www.bleepingcomputer.com cd.connatix.com
1	r12---sn-4g5ednzz.googlevideo.com
1	r2---sn-4g5e6nzs.googlevideo.com	1 redirects
1	r2---sn-aigl6ned.googlevideo.com	1 redirects
1	csi.gstatic.com	imasdk.googleapis.com
1	vid-io-dub.springserve.com	vpaid.springserve.com
1	ib.adnxs.com	vpaid.springserve.com
1	hb.emxdgt.com	vpaid.springserve.com
1	hbopenbid.pubmatic.com	vpaid.springserve.com
1	web.hb.ad.cpe.dotomi.com	vpaid.springserve.com
1	tpc.googlesyndication.com	vpaid.springserve.com
1	vpaid.springserve.com	cd.connatix.com
1	vid.springserve.com	cd.connatix.com
1	vid.connatix.com	cd.connatix.com
1	audit-tcfv2.quantcast.mgr.consensu.org	quantcast.mgr.consensu.org
1	api-public.addthis.com	s9.addthis.com
1	test.quantcast.mgr.consensu.org	quantcast.mgr.consensu.org
1	cdn.firstimpression.io	ecdn.firstimpression.io
1	rules.quantcount.com	secure.quantserve.com
1	widgets.outbrain.com	www.bleepingcomputer.com
1	ad.doubleclick.net	www.bleepingcomputer.com
1	m.addthis.com	s9.addthis.com
1	v1.addthisedge.com	s9.addthis.com
1	z.moatads.com	s9.addthis.com
1	pixel.quantserve.com	www.bleepingcomputer.com
1	secure.quantserve.com	quantcast.mgr.consensu.org
1	googleads.g.doubleclick.net	pagead2.googlesyndication.com
1	d.pub.network	a.pub.network
1	s9.addthis.com	www.bleepingcomputer.com
1	ecdn.analysis.fi	www.bleepingcomputer.com
1	a.pub.network	www.bleepingcomputer.com
1	cd.connatix.com	1 redirects
1	cse.google.com	www.bleepingcomputer.com
1	www.google.com	1 redirects
1	www.googletagmanager.com	www.bleepingcomputer.com
1	fonts.googleapis.com	www.bleepingcomputer.com
1	www.bleepingcomputer.com
127	50

This site contains links to these domains. Also see Links.

Domain
www.facebook.com
twitter.com
www.youtube.com
deals.bleepingcomputer.com
blog.sonatype.com
www.virustotal.com

Subject Issuer	Validity	Valid
bleepingcomputer.com Sectigo RSA Domain Validation Secure Server CA	`2020-05-16` - `2022-05-15`	2 years	crt.sh
upload.video.google.com GTS CA 1O1	`2020-11-03` - `2021-01-26`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-07-17` - `2021-07-17`	a year	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-11-03` - `2021-01-26`	3 months	crt.sh
*.google.com GTS CA 1O1	`2020-11-03` - `2021-01-26`	3 months	crt.sh
*.connatix.com Go Daddy Secure Certificate Authority - G2	`2020-09-29` - `2021-10-19`	a year	crt.sh
*.analysis.fi Sectigo RSA Domain Validation Secure Server CA	`2020-05-17` - `2021-06-16`	a year	crt.sh
*.firstimpression.io Sectigo RSA Organization Validation Secure Server CA	`2019-11-06` - `2020-12-04`	a year	crt.sh
*.gstatic.com GTS CA 1O1	`2020-11-03` - `2021-01-26`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2020-11-03` - `2021-01-26`	3 months	crt.sh
odc-prod-01.oracle.com DigiCert Secure Site ECC CA-1	`2020-07-22` - `2021-10-13`	a year	crt.sh
quantcast.mgr.consensu.org Amazon	`2020-05-22` - `2021-06-22`	a year	crt.sh
*.pub.network Go Daddy Secure Certificate Authority - G2	`2020-03-17` - `2021-05-16`	a year	crt.sh
*.quantserve.com DigiCert SHA2 High Assurance Server CA	`2020-10-02` - `2021-10-07`	a year	crt.sh
moatads.com DigiCert SHA2 Secure Server CA	`2020-01-17` - `2021-03-17`	a year	crt.sh
*.doubleclick.net GTS CA 1O1	`2020-11-03` - `2021-01-26`	3 months	crt.sh
*.outbrain.com DigiCert SHA2 Secure Server CA	`2020-03-09` - `2021-06-08`	a year	crt.sh
*.quantcast.mgr.consensu.org Amazon	`2020-05-22` - `2021-06-22`	a year	crt.sh
*.reddit.com DigiCert SHA2 Secure Server CA	`2020-08-26` - `2021-02-22`	6 months	crt.sh
*.springserve.com Amazon	`2020-11-19` - `2021-12-18`	a year	crt.sh
tpc.googlesyndication.com GTS CA 1O1	`2020-11-03` - `2021-01-26`	3 months	crt.sh
ad.cpe.dotomi.com GlobalSign RSA OV SSL CA 2018	`2020-03-30` - `2022-06-25`	2 years	crt.sh
*.pubmatic.com Sectigo RSA Organization Validation Secure Server CA	`2019-02-22` - `2021-02-21`	2 years	crt.sh
*.emxdgt.com Amazon	`2020-07-31` - `2021-08-30`	a year	crt.sh
*.adnxs.com DigiCert ECC Secure Server CA	`2019-01-23` - `2021-03-08`	2 years	crt.sh
*.c.docs.google.com GTS CA 1O1	`2020-11-10` - `2021-01-19`	2 months	crt.sh

This page contains 11 frames:

Primary Page: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
Frame ID: AD301C8B347E3845D663EEB360A7557F
Requests: 89 HTTP requests in this frame

Frame: https://cds.connatix.com/p/81038/connatix.playspace.dc.js
Frame ID: F854FE688A3F20672970103FDCB0AC8A
Requests: 20 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20201112/r20190131/zrt_lookup.html
Frame ID: 328D027E1C85032E6BB843256F40AB68
Requests: 1 HTTP requests in this frame

Frame: https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html
Frame ID: 7ACAFB1448CCEFA80EBBD3C4761098B4
Requests: 1 HTTP requests in this frame

Frame: https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html
Frame ID: B94F56419C8F8AA4B6B735F4FC196B5D
Requests: 1 HTTP requests in this frame

Frame: https://ecdn.firstimpression.io/static/sw/tracking-sw-index.html
Frame ID: 4A43342D8E7BF29D95DF27E2923CB87F
Requests: 1 HTTP requests in this frame

Frame: https://imasdk.googleapis.com/js/core/bridge3.427.1_en.html
Frame ID: 2EAC755E540523F92948CF169CDD0880
Requests: 1 HTTP requests in this frame

Frame: https://vpaid.springserve.com/production/vpaid_e414d106.js
Frame ID: 488526933413F6D3734407C74A6F6E8C
Requests: 7 HTTP requests in this frame

Frame: https://imasdk.googleapis.com/js/sdkloader/vpaid_adapter.js?adtagurl=https://pubads.g.doubleclick.net/gampad/ads%3Fiu%3D/21769024953/Bleeping_Computer_SpringServe%26description_url%3Dhttps%253A%252F%252Fwww.bleepingcomputer.com%252F%26tfcd%3D0%26npa%3D0%26sz%3D400x300%257C640x480%26max_ad_duration%3D30000%26gdfp_req%3D1%26output%3Dvast%26unviewed_position_start%3D1%26env%3Dvp%26vpos%3Dpreroll%26vpmute%3D1%26vpa%3Dauto%26type%3Djs%26vad_type%3Dlinear%26channel%3Dvastadp&correlator=1606937736598
Frame ID: CDABAD13A461A26431E9ADE1D6C61470
Requests: 5 HTTP requests in this frame

Frame: https://imasdk.googleapis.com/js/core/bridge3.427.1_en.html
Frame ID: 902FC0AD7F77CCD91A7E4FD4DBA6C9AC
Requests: 1 HTTP requests in this frame

Frame: https://imasdk.googleapis.com/js/core/bridge3.427.1_en.html
Frame ID: 29A93BEAD564426063D31DFE645D6098
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

script /googlesyndication\.com\//i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

Quantcast (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /\.quantserve\.com\/quant\.js/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery[.-]([\d.]*\d)[^/]*\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

127
Requests

99 %
HTTPS

57 %
IPv6

28
Domains

50
Subdomains

42
IPs

6
Countries

6890 kB
Transfer

11225 kB
Size

11
Cookies

11 Outgoing links

These are links going to different origins than the main page.

URL: https://www.facebook.com/BleepingComputer

Search URL Search Domain Scan URL

URL: https://twitter.com/BleepinComputer

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/BleepingComputer

Search URL Search Domain Scan URL

URL: https://deals.bleepingcomputer.com/
Title: Deals

Search URL Search Domain Scan URL

URL: https://deals.bleepingcomputer.com/deals/elearning?utm_source=bleepingcomputer.com&utm_medium=dd_cat
Title: eLearning

Search URL Search Domain Scan URL

URL: https://deals.bleepingcomputer.com/deals/certifications?utm_source=bleepingcomputer.com&utm_medium=dd_cat
Title: IT Certification Courses

Search URL Search Domain Scan URL

URL: https://deals.bleepingcomputer.com/deals/gear-gadgets?utm_source=bleepingcomputer.com&utm_medium=dd_cat
Title: Gear + Gadgets

Search URL Search Domain Scan URL

URL: https://deals.bleepingcomputer.com/collections/tag-cyber-security?utm_source=bleepingcomputer.com&utm_medium=dd_cat
Title: Security

Search URL Search Domain Scan URL

URL: https://blog.sonatype.com/bladabindi-njrat-rat-in-jdb.js-npm-malware
Title: discovered malicious NPM packages

Search URL Search Domain Scan URL

URL: https://www.virustotal.com/gui/file/d6c04cc24598c63e1d561768663808ff43a73d3876aee17d90e2ea01ee9540ff/detection
Title: patch.exe executable

Search URL Search Domain Scan URL

URL: https://twitter.com/LawrenceAbrams

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 10

https://www.google.com/coop/cse/brand?form=cse-search-box&lang=en HTTP 302
https://cse.google.com/coop/cse/brand?form=cse-search-box&lang=en

Request Chain 12

https://cd.connatix.com/connatix.playspace.js HTTP 302
https://cds.connatix.com/p/81038/connatix.playspace.dc.js

Request Chain 120

https://r2---sn-aigl6ned.googlevideo.com/videoplayback?expire=1606966540&ei=jOzHX_KKEYLTxgLD4L2ADg&ip=89.249.64.203&id=4e42e19bfc59eb83&itag=22&source=youtube&requiressl=yes&mh=d6&mm=31&mn=sn-aigl6ned&ms=au&mv=m&mvi=2&pl=25&susc=gvp&acao=yes&ctier=L&mime=video/mp4&dur=15.069&lmt=1606047213357244&mt=1606937312&txp=5432434&sparams=expire,ei,ip,id,itag,source,requiressl,susc,acao,ctier,mime,dur,lmt&sig=AOq0QJ8wRAIgL9ItdiiErYL3wAfEKDYTo21tUi-6EJu8GR58Sloc49MCIEZvYmlTXrW_jhZpTzL03kryg64HuMfNQOhwQY3FGC8l&lsparams=mh,mm,mn,ms,mv,mvi,pl&lsig=AG3C_xAwRQIhANNRmBXjfnJqBpzGxIfQROdZQvSqQ2CwllR8QUxi2SrSAiA0W5TywGVDYpKaB096YlT1BLJR_MOchw-yjjFP81x6AA==&cpn=WaspDekUaL9-GmgG HTTP 302
https://r2---sn-4g5e6nzs.googlevideo.com/videoplayback?expire=1606966540&ei=jOzHX_KKEYLTxgLD4L2ADg&ip=89.249.64.203&id=4e42e19bfc59eb83&itag=22&source=youtube&requiressl=yes&susc=gvp&acao=yes&ctier=L&mime=video/mp4&dur=15.069&lmt=1606047213357244&txp=5432434&sparams=expire,ei,ip,id,itag,source,requiressl,susc,acao,ctier,mime,dur,lmt&sig=AOq0QJ8wRAIgL9ItdiiErYL3wAfEKDYTo21tUi-6EJu8GR58Sloc49MCIEZvYmlTXrW_jhZpTzL03kryg64HuMfNQOhwQY3FGC8l&cpn=WaspDekUaL9-GmgG&redirect_counter=1&rm=sn-aiges77l&fexp=9420244&req_id=6c9d434a73de36e2&cms_redirect=yes&ipbypass=yes&mh=d6&mip=2a01:4f8:121:131a::2&mm=31&mn=sn-4g5e6nzs&ms=au&mt=1606937549&mv=m&mvi=2&pl=40&lsparams=ipbypass,mh,mip,mm,mn,ms,mv,mvi,pl&lsig=AG3C_xAwRgIhAJxC2EUf1P6oIOumV_TC3VrE8M_46Db0QnjdNmqs-1ewAiEAmChOEeSOSiax6uXrQsyGzkiJHSmEmCYGeQS13mGJ8e8%3D HTTP 302
https://r12---sn-4g5ednzz.googlevideo.com/videoplayback?expire=1606966540&ei=jOzHX_KKEYLTxgLD4L2ADg&ip=89.249.64.203&id=4e42e19bfc59eb83&itag=22&source=youtube&requiressl=yes&susc=gvp&acao=yes&ctier=L&mime=video/mp4&dur=15.069&lmt=1606047213357244&txp=5432434&sparams=expire,ei,ip,id,itag,source,requiressl,susc,acao,ctier,mime,dur,lmt&sig=AOq0QJ8wRAIgL9ItdiiErYL3wAfEKDYTo21tUi-6EJu8GR58Sloc49MCIEZvYmlTXrW_jhZpTzL03kryg64HuMfNQOhwQY3FGC8l&cpn=WaspDekUaL9-GmgG&rm=sn-aiges77l,sn-4g5ede7l&fexp=9420244,23812955,23951038&req_id=6c9d434a73de36e2&ipbypass=yes&redirect_counter=2&he=yes&cms_redirect=yes&mh=d6&mip=2a01:4f8:121:131a::2&mm=43&mn=sn-4g5ednzz&ms=onl&mt=1606937526&mv=m&mvi=12&pl=40&lsparams=ipbypass,mh,mip,mm,mn,ms,mv,mvi,pl&lsig=AG3C_xAwRAIgVXLS339F6vKd0z00T40QlsgzM1RCReSAcJfrMM3QSWsCIDsMRfF1OvOfEu_ck1o35CMTSRQT11WjuTlFPqMfghz0

127 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/ 72 KB
16 KB 802ms
705ms Document
text/html 104.20.60.209
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.60.209 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

25265b8bd25d4cb0afcfcafec0e8a5625a56152e59092116baf8d948fdbcb7f8

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

:method: GET
:authority: www.bleepingcomputer.com
:scheme: https
:path: /news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 19:35:35 GMT
content-type: text/html; charset=UTF-8
set-cookie: __cfduid=d645db1cbe764e6269d951bc243c3046f1606937734; expires=Fri, 01-Jan-21 19:35:34 GMT; path=/; domain=.bleepingcomputer.com; HttpOnly; SameSite=Lax; Secure session_id=584871804bab1a2e2e99ff7e9ae06d65; path=/; domain=.bleepingcomputer.com; httponly;Secure lav=9702; expires=Fri, 01-Jan-2021 19:35:34 GMT; Max-Age=2592000; path=/;Secure
content-security-policy: upgrade-insecure-requests;
x-frame-options: SAMEORIGIN
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
expires: 0
last-modified: Tue, 01 Dec 2020 19:27:13 GMT
vary: Accept-Encoding,User-Agent
cf-cache-status: DYNAMIC
cf-request-id: 06c68d05360000e8f76688b000000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 5fb77de85f74e8f7-MXP
content-encoding: br

GET
H2 200 css
fonts.googleapis.com/ 13 KB
971 B 27ms
24ms Stylesheet
text/css 2a00:1450:4001:803::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:400,100,300,500,700,900&display=swap

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

f9afb0e286986c3c4f1a83b1bbafb02a601ff074a2c5962d06a5182fa471e452

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 02 Dec 2020 19:35:35 GMT
server: ESF
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
date: Wed, 02 Dec 2020 19:35:35 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
expires: Wed, 02 Dec 2020 19:35:35 GMT

GET
H2 200 bootstrap.css
www.bleepstatic.com/css/redesign/ 111 KB
17 KB 69ms
29ms Stylesheet
text/css 172.67.75.139
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bleepstatic.com/css/redesign/bootstrap.css
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.75.139 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 082674d615a4428081a2b3ffc2d0aac637a3b4e8e2d588a9459f6d523ec738cb

Request headers

Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 19:35:35 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 1378120
cf-polished: origSize=137522
cf-request-id: 06c68d080e00001e6199a4f000000001
last-modified: Mon, 16 Nov 2020 20:42:26 GMT
server: cloudflare
etag: W/"1035334175"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=H6WIEeP0sw4iZ1J6lDWo5m0QcHh%2F4e1sz3TUm8v9nJVTsG%2BHDS1knHxkh7OkQB4JZvlpiMIwmyPkn6D4Rpm8mtrUWDznKfp8SUVu7g4uvfY6QPF0"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *
expires: Mon, 21 Dec 2020 20:46:54 GMT
cache-control: max-age=3024000
cf-ray: 5fb77dece8fe1e61-MUC
cf-bgj: minify

GET
H2 200 main.css
www.bleepstatic.com/css/redesign/ 52 KB
10 KB 63ms
23ms Stylesheet
text/css 172.67.75.139
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bleepstatic.com/css/redesign/main.css?v=11.14.20.7
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.75.139 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a1b78cddcd44ccfb8a11daa2e7556481768b6003af2f2ef9440c6e16fa233aeb

Request headers

Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 19:35:35 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 956592
cf-polished: origSize=62620
cf-request-id: 06c68d080e00001e619c3c8000000001
last-modified: Sat, 21 Nov 2020 17:48:08 GMT
server: cloudflare
etag: W/"2941469458"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=t0Q8DcJviVVAwy1SeZ6S5bmkT4pGARdKuL%2FPCa4XZNM%2F6alga%2Br%2FuorBCzrEdsF0094Kx8qvRye%2BZcF%2FWx9lPTFE5XSy%2F%2BSyPN9MGK9m%2F3DomVst"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *
expires: Sat, 26 Dec 2020 17:52:23 GMT
cache-control: max-age=3024000
cf-ray: 5fb77dece8ff1e61-MUC
cf-bgj: minify

GET
H2 200 home.css
www.bleepstatic.com/css/redesign/ 12 KB
3 KB 68ms
29ms Stylesheet
text/css 172.67.75.139
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bleepstatic.com/css/redesign/home.css
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.75.139 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ca22345f969dd8077c21281572a34d4a51bc6a5ad9d764bd1338b2c12a68c3e3

Request headers

Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 19:35:35 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 956373
cf-polished: origSize=15024
cf-request-id: 06c68d080f00001e61541c2000000001
last-modified: Sat, 21 Nov 2020 17:53:40 GMT
server: cloudflare
etag: W/"2807382579"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=7tix2vVPodRtuw7QE08JV0QgMD6ZjQamTTbkNc7jWuR9FFaHlXduO0VQIqNd5uB4C4hJlnjqUUcj7rDiMyz%2BNbYYJlTDHE5c%2Fho71YAV2bEEOFbW"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *
expires: Sat, 26 Dec 2020 17:56:01 GMT
cache-control: max-age=3024000
cf-ray: 5fb77dece9031e61-MUC
cf-bgj: minify

GET
H2 200 news.css
www.bleepstatic.com/css/redesign/ 27 KB
5 KB 63ms
24ms Stylesheet
text/css 172.67.75.139
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bleepstatic.com/css/redesign/news.css
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.75.139 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7ed5aa7b858e4bb494b8f71729baf404aa4d7fd4c0971d0e4a20f262feb016b5

Request headers

Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 19:35:35 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 956592
cf-polished: origSize=32994
cf-request-id: 06c68d080e00001e61690cd000000001
last-modified: Sat, 21 Nov 2020 17:51:52 GMT
server: cloudflare
etag: W/"108855812"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=l3bfFpEJEb7EUJIOp0mApWgCEn%2Fv9Uc18M7wCwq4Sm%2B3BkyvLVZ%2Bu%2Bf%2FzaBFbRsXk%2FbUqxFTrWoZoVQltbO2rH5DPc%2B94tDmsA6v0kLdhuMNtHs5"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *
expires: Sat, 26 Dec 2020 17:52:23 GMT
cache-control: max-age=3024000
cf-ray: 5fb77dece9011e61-MUC
cf-bgj: minify

GET
H2 200 jquery-1.11.1.min.js Show response
www.bleepstatic.com/js/redesign/ 94 KB
32 KB 70ms
31ms Script
text/javascript 172.67.75.139
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bleepstatic.com/js/redesign/jquery-1.11.1.min.js
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.75.139 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441

Request headers

Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 19:35:35 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 2735479
cf-request-id: 06c68d081100001e619589d000000001
last-modified: Thu, 23 Apr 2015 12:36:44 GMT
server: cloudflare
etag: W/"3647451394"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=UTzvR9oCk414mJs8ZoMG9OZeq1T5tofXh65hACyy67ix4%2F94Mh0KWXuzoYRcs5sJmqyMB2D%2BzTq5XLoh%2FQPfL%2FiaVb24yAO5IVC%2BvOPvthUyFKnA"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=3024000
cf-ray: 5fb77dece9041e61-MUC
expires: Sun, 06 Dec 2020 03:44:16 GMT

GET
H2 200 news.js Show response
www.bleepstatic.com/js/redesign/ 183 B
769 B 18ms
17ms Script
text/javascript 172.67.75.139
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bleepstatic.com/js/redesign/news.js
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.75.139 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 827252be04765631f8ff21fee8ffe1028e27dfa52f62c08ef3182609a0a0e991

Request headers

Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 19:35:35 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 2802853
cf-polished: origSize=247
cf-request-id: 06c68d082d00001e614e9e3000000001
last-modified: Wed, 16 Dec 2015 15:41:46 GMT
server: cloudflare
etag: W/"4218930423"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=6M6pfKz%2Bqj%2BMbN%2BD9B7RQ3R3lStX6da835aqCW9v7lMTxmf4od62E8ubxqQOIPYf8rYhKJ7NoAUn6gIwJNXTnN0NZS2hEW9IDrjhmaJyAUCo%2BtRs"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
access-control-allow-origin: *
expires: Sat, 05 Dec 2020 09:01:22 GMT
cache-control: max-age=3024000
cf-ray: 5fb77ded19911e61-MUC
cf-bgj: minify

GET
H2 200 qc-consent.js Show response
www.bleepstatic.com/js/qc-consent/ 2 KB
1 KB 20ms
19ms Script
text/javascript 172.67.75.139
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bleepstatic.com/js/qc-consent/qc-consent.js
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.75.139 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 28d4e8c1043164607dcdeb358e2a08c9565fe286ceeeabea79e67f8c680187e7

Request headers

Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 19:35:35 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 1104799
cf-polished: origSize=3904
cf-request-id: 06c68d083700001e6164973000000001
last-modified: Mon, 05 Oct 2020 20:38:13 GMT
server: cloudflare
etag: W/"2345400546"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=zfHZAa4whE7mjxqoiH0hB19dXRXK4vWO8w6Se2GB%2FYio%2Fq3BiTxdz7j6fyK3AJ27b1RWIKdpqb6yuDI2VVy1VyHG2KWOO5YF1wVgb9iCkHBL6GPb"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
access-control-allow-origin: *
expires: Fri, 25 Dec 2020 00:42:16 GMT
cache-control: max-age=3024000
cf-ray: 5fb77ded29b81e61-MUC
cf-bgj: minify

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 96 KB
38 KB 19ms
14ms Script
application/javascript 2a00:1450:4001:817::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-91740-1

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d504524659927bac2d4fb08367d7e19fc7d88aa3f668915491f4470ab1303f8c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 19:35:35 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38712
x-xss-protection: 0
last-modified: Wed, 02 Dec 2020 19:05:53 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 02 Dec 2020 19:35:35 GMT

GET
H2 200 logo.png
www.bleepstatic.com/images/site/ 1 KB
1 KB 29ms
24ms Image
image/webp 172.67.75.139
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bleepstatic.com/images/site/logo.png
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.75.139 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 19db4a2cde712e2ceaac317e732b4ec40b62818a938a8bf8391ad68470845019

Request headers

Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 19:35:35 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 1202605
cf-polished: origFmt=png, origSize=1882
content-disposition: inline; filename="logo.webp"
content-length: 1152
cf-request-id: 06c68d085200001e61a2960000000001
last-modified: Sat, 04 Mar 2017 04:12:00 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=%2FEJo1rHA%2BN2w7JoCavw6mR%2FeQV8rFHfXS3dPD4X7nUpanoBiEJUCFKBtDaspSQwPLXpQkP63Rs5AzxP%2FRvM5SiFLeWTHX260z41GkgaLiLq%2BRMsk"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
expires: Fri, 18 Dec 2020 21:32:09 GMT
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 5fb77ded4a1a1e61-MUC
cf-bgj: imgq:85,h2pri

GET
H2

200

brand Show response
cse.google.com/coop/cse/
Redirect Chain

https://www.google.com/coop/cse/brand?form=cse-search-box&lang=en
https://cse.google.com/coop/cse/brand?form=cse-search-box&lang=en

3 KB
2 KB

27ms
7ms

Script
text/javascript

2a00:1450:4001:81f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cse.google.com/coop/cse/brand?form=cse-search-box&lang=en

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

pfe /

Resource Hash

4eeb4df3522892ea2ec61de6a58e870e8262019f8e3c759c099450cefb589313

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 19:23:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: pfe
age: 714
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1800
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1181
x-xss-protection: 0
expires: Wed, 02 Dec 2020 19:53:41 GMT

Redirect headers

date: Wed, 02 Dec 2020 19:35:35 GMT
x-content-type-options: nosniff
server: sffe
content-type: text/html; charset=UTF-8
location: https://cse.google.com/coop/cse/brand?form=cse-search-box&lang=en
cache-control: private
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 266
x-xss-protection: 0

GET
H2 200 NPM.jpg
www.bleepstatic.com/content/hl-images/2019/08/21/ 48 KB
49 KB 39ms
35ms Image
image/webp 172.67.75.139
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bleepstatic.com/content/hl-images/2019/08/21/NPM.jpg
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.75.139 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b7e4b21bbee9dbae4efabe383da4dd080026382b980585bd42d46dac2c8ae3e6

Request headers

Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 19:35:35 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 87957
cf-polished: qual=85, origFmt=jpeg, origSize=107088
content-disposition: inline; filename="NPM.webp"
content-length: 49282
cf-request-id: 06c68d085200001e61509b0000000001
last-modified: Wed, 21 Aug 2019 23:02:21 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=EdI2mGQXEeI6ki6ZEKJ8hZtuVr2AJjWNKou8yVDXlUH3f7eyJoRK6lK28z0VrhJqASyu5J4gb41iQtifJdP3zsHpOSRDUnFRFhO0L3n%2FuqpbwL%2Fw"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
expires: Thu, 31 Dec 2020 19:09:38 GMT
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 5fb77ded4a1c1e61-MUC
cf-bgj: imgq:85,h2pri

GET
H2

200

connatix.playspace.dc.js Show response
cds.connatix.com/p/81038/ Frame F854
Redirect Chain

https://cd.connatix.com/connatix.playspace.js
https://cds.connatix.com/p/81038/connatix.playspace.dc.js

1 MB
248 KB

24ms
15ms

Script
application/javascript

151.101.194.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.connatix.com/p/81038/connatix.playspace.dc.js
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: bf64579b8e2f5e88e1e2d7f18c70280913781da7f6a3b3283260bb07984c52c6

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 19:35:35 GMT
via: 1.1 varnish, 1.1 varnish
age: 33936
x-cache: HIT, HIT
content-encoding: gzip
content-length: 253946
x-served-by: cache-dca17779-DCA, cache-hhn4052-HHN
last-modified: Wed, 02 Dec 2020 09:02:27 GMT
x-timer: S1606937735.336115,VS0,VE0
etag: "92df395cb88afd877421b95260989f84"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31557600
accept-ranges: bytes
x-cache-hits: 1, 1257

Redirect headers

date: Wed, 02 Dec 2020 19:35:35 GMT
via: 1.1 varnish
server: Varnish
age: 0
x-served-by: cache-hhn4052-HHN
x-cache: HIT
location: https://cds.connatix.com/p/81038/connatix.playspace.dc.js
cache-control: no-cache, no-store, must-revalidate, max-age=0
accept-ranges: bytes
x-timer: S1606937735.289536,VS0,VE0
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H2 200 pubfig.min.js Show response
a.pub.network/bleepingcomputer-com/ 187 KB
45 KB 83ms
52ms Script
application/javascript 2606:4700:20::ac43:443c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:443c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: eb807ff4011748a050156ca84e739b9b53deea44a761637a75fc7edd12953449

Request headers

Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-goog-hash: crc32c=WWqNlg==, md5=w2sRU+VsDzyCXGc9m9rznA==
date: Wed, 02 Dec 2020 19:35:35 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
x-guploader-uploadid: ABg5-UzqMpJKgYRb2EJ8Ne-m67xeYEzK8Uo6CmR6l75z1pBBwuAfAkhnKNC-TemmQj_5W2Q3szLuQLcGcrd-sXJ7Vmk
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-type: application/javascript
cf-request-id: 06c68d086500003237e1131000000001
last-modified: Tue, 24 Nov 2020 21:21:29 GMT
server: cloudflare
etag: W/"c36b1153e56c0f3c825c673d9bdaf39c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=%2FwDxiq8ARQ0c96Eu2UsCa0NX0KO%2BFmw9fhXU3JqlHW8wYLKfINTbLbVfKd%2BMSPwUpanrvmyD9CcjHbpPuLdfROwto%2Bjj3EArXxNbCE0xwntGH2cRl8V5N30G"}],"group":"cf-nel","max_age":604800}
x-goog-generation: 1606252889760656
cache-control: public, max-age=1800
x-goog-stored-content-length: 191148
cf-ray: 5fb77ded683c3237-FRA
expires: Wed, 25 Nov 2020 18:13:07 GMT

GET
H/1.1 200
OK fab.js Show response
ecdn.analysis.fi/static/js/ 4 KB
2 KB 134ms
28ms Script
application/javascript 212.71.236.31
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to

Full URL: https://ecdn.analysis.fi/static/js/fab.js
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 212.71.236.31 London, United Kingdom, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS: nb-212-71-236-31.london.nodebalancer.linode.com
Software: nginx/1.16.1 /
Resource Hash: 6e7304cbbeecfb8e3d98623654c9cfbad72cebf4271f4e7bc895c7bba539c4be

Request headers

Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 02 Dec 2020 19:38:40 GMT
Content-Encoding: gzip
Last-Modified: Wed, 15 Jul 2015 00:00:00 GMT
Server: nginx/1.16.1
ETag: "55a5a280-66f"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=3600
Connection: close
Content-Length: 1647
Expires: Wed, 02 Dec 2020 20:38:40 GMT

GET
H/1.1 200
OK fi_client.js Show response
ecdn.firstimpression.io/ 614 KB
185 KB 136ms
30ms Script
text/javascript 185.3.92.12
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to

Full URL

https://ecdn.firstimpression.io/fi_client.js

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.3.92.12 London, United Kingdom, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

nb-185-3-92-12.london.nodebalancer.linode.com

Software

nginx/1.16.1 / PHP/7.3.11

Resource Hash

3eacf72248f46c06ce6a19a756e71797c4b5302ac8f34d3d9662117b020105ba

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 02 Dec 2020 19:38:40 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Thu, 01 Jan 2015 00:00:00 GMT
Server: nginx/1.16.1
X-Powered-By: PHP/7.3.11
ETag: d7fe92794fb705b3bbbce5292edaac9b
Transfer-Encoding: chunked
Access-Control-Allow-Methods: POST, GET, OPTIONS
Content-Type: text/javascript;charset=UTF-8
Cache-Control: max-age=3600
Access-Control-Allow-Credentials: true
Connection: close
X-XSS-Protection: 0
Expires: Wed, 02 Dec 2020 20:38:40 GMT

GET
H2 200 login_bg.png
www.bleepstatic.com/images/site/ 126 B
664 B 26ms
23ms Image
image/webp 172.67.75.139
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bleepstatic.com/images/site/login_bg.png
Requested by: Host: www.bleepstatic.com
URL: https://www.bleepstatic.com/css/redesign/main.css?v=11.14.20.7
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.75.139 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 32e73e8e0eec3e6c1345d84e7ef091b90e71fb0045814043b34c914156235eb9

Request headers

Referer: https://www.bleepstatic.com/css/redesign/main.css?v=11.14.20.7
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 19:35:35 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 628667
cf-polished: origFmt=png, origSize=187
content-disposition: inline; filename="login_bg.webp"
content-length: 126
cf-request-id: 06c68d085200001e61958a2000000001
last-modified: Sat, 04 Mar 2017 20:46:52 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=gq6CV%2BYujy5Z4QfpGkovNfPdpFNobPelygzpNZvXeZ%2BjZXbKf0G%2FlZwAnZ6MPYBe3zqExEWLYdH6ro2GGTuFyy90dZX7GOceyeyAKofbyj4ZWLog"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
expires: Fri, 25 Dec 2020 12:57:47 GMT
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 5fb77ded5a1e1e61-MUC
cf-bgj: imgq:85,h2pri

GET
H2 200 KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
fonts.gstatic.com/s/roboto/v20/ 11 KB
11 KB 8ms
5ms Font
font/woff2 2a00:1450:4001:814::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,100,300,500,700,900&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://www.bleepingcomputer.com
Referer: https://fonts.googleapis.com/css?family=Roboto:400,100,300,500,700,900&display=swap
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 01 Dec 2020 11:20:36 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:18:50 GMT
server: sffe
age: 116099
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11016
x-xss-protection: 0
expires: Wed, 01 Dec 2021 11:20:36 GMT

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v20/ 11 KB
11 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:814::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,100,300,500,700,900&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0d9fd7ccabde9b202de45ee6b65878ce9594975d8e8810b0878d3f3fa3637d0e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://www.bleepingcomputer.com
Referer: https://fonts.googleapis.com/css?family=Roboto:400,100,300,500,700,900&display=swap
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 01 Dec 2020 20:01:11 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:18:58 GMT
server: sffe
age: 84864
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11020
x-xss-protection: 0
expires: Wed, 01 Dec 2021 20:01:11 GMT

GET
DATA 200
OK truncated
/ 37 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/gif

GET
H2 200 nav_bg.png
www.bleepstatic.com/images/site/ 72 B
449 B 31ms
30ms Image
image/webp 172.67.75.139
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bleepstatic.com/images/site/nav_bg.png
Requested by: Host: www.bleepstatic.com
URL: https://www.bleepstatic.com/css/redesign/main.css?v=11.14.20.7
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.75.139 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ab52a578c101a14bbc790f87f9a7400dda65469f23c6ce85c461e07cdf776460

Request headers

Referer: https://www.bleepstatic.com/css/redesign/main.css?v=11.14.20.7
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 19:35:35 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 631481
cf-polished: origFmt=png, origSize=83
content-disposition: inline; filename="nav_bg.webp"
content-length: 72
cf-request-id: 06c68d086c00001e61690d6000000001
last-modified: Sat, 04 Mar 2017 07:57:02 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=RZHIR9rHqdwLtRMCHbiq9BqnRgrPb%2B2BwqjmBA%2BMOaotIabZWsHyEf9AqH3HWifx1KtzIlgr%2FI4SMmyxhoIh0JUPBictYPYNa5ueQ3NzIrPlnsBL"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
expires: Fri, 25 Dec 2020 12:10:54 GMT
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 5fb77ded7aa41e61-MUC
cf-bgj: imgq:85,h2pri

GET
H2 200 JsonDB.jpg
www.bleepstatic.com/images/news/malware/n/npm/njRAT/ 56 KB
56 KB 34ms
30ms Image
image/webp 172.67.75.139
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bleepstatic.com/images/news/malware/n/npm/njRAT/JsonDB.jpg
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.75.139 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3dd301dcf6c48d81d85447fd14785c67ecf66ca799e063109dab178f51d0d2aa

Request headers

Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 19:35:35 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 86677
cf-polished: qual=85, origFmt=jpeg, origSize=91728
content-disposition: inline; filename="JsonDB.webp"
content-length: 57350
cf-request-id: 06c68d087100001e6165b45000000001
last-modified: Tue, 01 Dec 2020 18:31:33 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=VcSVwiYrVkjm8FC0WjsgHKuAteDkqqEYVPxPG8VnRIXS2O6C1eNVao2Pm5RM3GuUmqQN4BioSs6xsON0QInp4LlkfBo%2FhiDEFk5pg98Iql%2FIl0kz"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
expires: Thu, 31 Dec 2020 19:30:58 GMT
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 5fb77ded8abc1e61-MUC
cf-bgj: imgq:85,h2pri

GET
H2 200 package-json.jpg
www.bleepstatic.com/images/news/malware/n/npm/njRAT/ 33 KB
33 KB 43ms
39ms Image
image/webp 172.67.75.139
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bleepstatic.com/images/news/malware/n/npm/njRAT/package-json.jpg
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.75.139 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2db8c339fed061bfa7e810ff84d1b5acda3363e2788abbf9fb6cef3f2387d1c5

Request headers

Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 19:35:35 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 2758
cf-polished: qual=85, origFmt=jpeg, origSize=39796
content-disposition: inline; filename="package-json.webp"
content-length: 33332
cf-request-id: 06c68d087100001e614f1d5000000001
last-modified: Tue, 01 Dec 2020 18:46:39 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=AbD83%2FNGAQGsQRNYnb%2FfYpbp38I%2FnZ2%2F5qUqEuc3IE709QE7pQ7fQtY8j4MWUSgWyJraPOLzElZz%2F1RffmAdw3axkD4a6xGiy8UycCRTLPtLOjxh"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
expires: Fri, 01 Jan 2021 18:49:37 GMT
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 5fb77ded8abe1e61-MUC
cf-bgj: imgq:85,h2pri

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 129 KB
45 KB 44ms
21ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0d201b848d5c357264798bd1e0cd54a56f5bb684810efc80cc76c1b2eb03f403

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 19:35:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 45292
x-xss-protection: 0
server: cafe
etag: 11816825275535004790
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Wed, 02 Dec 2020 19:35:35 GMT

GET
H2 200 qualys-logo.png
www.bleepstatic.com/images/logos/companies/qualys/ 10 KB
10 KB 36ms
32ms Image
image/webp 172.67.75.139
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bleepstatic.com/images/logos/companies/qualys/qualys-logo.png
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.75.139 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1e9322d90411989f7e09ef5ad4a3465d6cb97c77741d1030b254cd50d7c7ffe5

Request headers

Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 19:35:35 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 1798690
cf-polished: origFmt=png, origSize=28795
content-disposition: inline; filename="qualys-logo.webp"
content-length: 10050
cf-request-id: 06c68d087200001e61531b8000000001
last-modified: Tue, 19 May 2020 21:36:44 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=vi0xt%2B00ps5wn3CBTKPydkyRlfmpoYjZ5CXYNsi%2BiWHRvjKUBQ08aNiimRCLVG80VBDpBZzN9HKzpwLxGxHPfOnRSQLNiLFw5WerZbwS0zrWN9%2Bv"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
expires: Fri, 11 Dec 2020 23:57:25 GMT
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 5fb77ded8ac01e61-MUC
cf-bgj: imgq:85,h2pri

GET
H2 200 jscm.png
www.bleepstatic.com/images/logos/companies/jscm/ 9 KB
9 KB 36ms
31ms Image
image/webp 172.67.75.139
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bleepstatic.com/images/logos/companies/jscm/jscm.png
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.75.139 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8c74196378cf2c91d1f38b58038cb90708f6afb708f971b94cd49bf8c59f541c

Request headers

Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 19:35:35 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 633268
cf-polished: origFmt=png, origSize=20937
content-disposition: inline; filename="jscm.webp"
content-length: 8846
cf-request-id: 06c68d087200001e619c3d3000000001
last-modified: Thu, 15 Oct 2020 21:51:02 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=PTLB5J69VYB59LtJ8z8vIqM4NwQRuBmpY3p6%2BlVkQ8kYBN1sKn35V%2BEovYsduvYfCPV5SJ4E9Mjb6o7XztbW3G15rPDN1OpB54FsglqrSDA3LYZ6"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
expires: Fri, 25 Dec 2020 11:41:07 GMT
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 5fb77ded8ac11e61-MUC
cf-bgj: imgq:85,h2pri

GET
H2 200 twitter.png
www.bleepstatic.com/images/site/login/ 282 B
978 B 42ms
36ms Image
image/webp 172.67.75.139
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bleepstatic.com/images/site/login/twitter.png
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.75.139 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 67d86a29de7993fbd23b7dde2c4f26bdc434055c35a4b08c830c0d02fcfa6dd2

Request headers

Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 19:35:35 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 684444
cf-polished: origFmt=png, origSize=475
content-disposition: inline; filename="twitter.webp"
content-length: 282
cf-request-id: 06c68d087600001e615fbb9000000001
last-modified: Sat, 04 Mar 2017 20:46:52 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=IVmNdglrCWEUQcb4MAq0FDKdHo6Hw5cDDxjrRCaptEK%2BPquis7T2%2Fk%2FdngREksCxTnCVbK8x4%2FYgXzBeeDJWj4VtztzuXIaC8yM3RUz07oHXv%2Fwt"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
expires: Thu, 24 Dec 2020 21:28:11 GMT
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 5fb77ded8ada1e61-MUC
cf-bgj: imgq:85,h2pri

GET
H2 200 bootstrap.js Show response
www.bleepstatic.com/js/redesign/ 44 KB
10 KB 38ms
32ms Script
text/javascript 172.67.75.139
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bleepstatic.com/js/redesign/bootstrap.js
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.75.139 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e5e0f326458e8b8ed839d42a0cf6892df80bf26d7dc7e4f8276a65c41582ab85

Request headers

Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 19:35:35 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 2834629
cf-polished: origSize=65813
cf-request-id: 06c68d087600001e61531b9000000001
last-modified: Thu, 23 Apr 2015 12:36:43 GMT
server: cloudflare
etag: W/"3930092018"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=3Y89ydfKTdvRA8CDZkop%2FaOI8SRcFGDixe3htJkJ%2BGWtNdZHwAXXJJ9t%2Blu9JNtgcvQY9M4ehlkyMCiK5Ati%2B9lCL269mqGd7%2FAdkexgyVt%2B0p%2Fe"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
access-control-allow-origin: *
expires: Sat, 05 Dec 2020 00:11:45 GMT
cache-control: max-age=3024000
cf-ray: 5fb77ded8add1e61-MUC
cf-bgj: minify

GET
H2 200 blazy.min.js Show response
www.bleepstatic.com/js/blazy/ 5 KB
2 KB 37ms
33ms Script
text/javascript 172.67.75.139
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bleepstatic.com/js/blazy/blazy.min.js
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.75.139 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0f427d0f88a0698c955ff63bf13af4ca80c9b32f218b5e210847450da901a74f

Request headers

Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 19:35:35 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 2735479
cf-request-id: 06c68d087200001e615c8d7000000001
last-modified: Thu, 16 Aug 2018 21:06:19 GMT
server: cloudflare
etag: W/"753357888"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=K4dHJ88p8mmZ1Hb60go5hBUCJ4C3IXy%2FCL%2FWqbHeqB9Onh0V4Yh5IjghuSt8HnBeMoAlUBh0%2Bv9weo%2F4hprxPOn0VC%2BTP4MatJlEq%2F26bGZ0IN6d"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=3024000
cf-ray: 5fb77ded8abf1e61-MUC
expires: Sun, 06 Dec 2020 03:44:15 GMT

GET
H2 200 bleep.js Show response
www.bleepstatic.com/js/redesign/ 3 KB
977 B 40ms
35ms Script
text/javascript 172.67.75.139
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bleepstatic.com/js/redesign/bleep.js
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.75.139 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 22e977346d45bab9f531ce1132d7ecfbe8e46868eaea790a0d4dcd1d0649d74b

Request headers

Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 19:35:35 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 2735479
cf-polished: origSize=3600
cf-request-id: 06c68d087600001e618a843000000001
last-modified: Mon, 01 Oct 2018 12:47:57 GMT
server: cloudflare
etag: W/"2696894447"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=ZY3cLDqJDdc2h%2FhcleSkr6WM8q1x%2FONBvluWlJdFP7hRUK36rDzAiqsm4gk1nWkQVsFykbKuZp9GBEJx92hHFc3QQM8HCV%2F34ODfCPQaWvFD8AcP"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
access-control-allow-origin: *
expires: Sun, 06 Dec 2020 03:44:16 GMT
cache-control: max-age=3024000
cf-ray: 5fb77ded8adf1e61-MUC
cf-bgj: minify

GET
H2 200 jquery.fancybox.js Show response
www.bleepstatic.com/js/redesign/fancybox/ 31 KB
10 KB 46ms
40ms Script
text/javascript 172.67.75.139
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bleepstatic.com/js/redesign/fancybox/jquery.fancybox.js
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.75.139 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 31cd7d9398307ca2e6cfaa111bbe7b69d69cbaaed2ff74034412ebc5008671fd

Request headers

Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 19:35:35 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 2824406
cf-polished: origSize=48706
cf-request-id: 06c68d087700001e6172946000000001
last-modified: Wed, 14 Oct 2015 20:25:51 GMT
server: cloudflare
etag: W/"327140449"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=%2BKI7EHogRj5xj488Hm2SKhh%2BEgSBoql4oEyCb8oUnCiPe%2Bjy2LvtWcMFG%2FOkdfn0jOH34cRFEFPRovdhFGptZ1mETggHo1XL7RMdEZxyCZ1XzwCl"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
access-control-allow-origin: *
expires: Sat, 05 Dec 2020 03:02:08 GMT
cache-control: max-age=3024000
cf-ray: 5fb77ded8ae21e61-MUC
cf-bgj: minify

GET
H2 200 fixto.min.js Show response
www.bleepstatic.com/js/fixto/ 8 KB
3 KB 35ms
30ms Script
text/javascript 172.67.75.139
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bleepstatic.com/js/fixto/fixto.min.js
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.75.139 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7d6d26827b887aa09b2a5eb7c001e35b93773e53c36ddbfc127ad824e0a6ba39

Request headers

Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 19:35:35 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 2813009
cf-request-id: 06c68d087300001e614cb40000000001
last-modified: Sat, 13 Jun 2015 21:34:42 GMT
server: cloudflare
etag: W/"1740214911"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=%2Ba%2F9B75prtdpclrPSBJ%2BNzNV7mqL6nVRdX3eVpfvdn5ZIXfgDXpsLoyOmIT8ef1IC7VgYvHD5oaOOMRuV51B%2Bl4Yp8Hus5dx3SQGAkxn6Srs4bp6"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=3024000
cf-ray: 5fb77ded8ac51e61-MUC
expires: Sat, 05 Dec 2020 06:12:06 GMT

GET
H2 200 noty.css
www.bleepstatic.com/js/noty/ 14 KB
3 KB 45ms
40ms Stylesheet
text/css 172.67.75.139
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bleepstatic.com/js/noty/noty.css
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.75.139 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c1bd0f4a8086eaaf6aff1ae5db3a58caa8f37a97503dbb0dbbe96c3ff86412f0

Request headers

Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 19:35:35 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 602306
cf-polished: origSize=17493
cf-request-id: 06c68d087500001e615221a000000001
last-modified: Fri, 24 Nov 2017 16:52:17 GMT
server: cloudflare
etag: W/"3461293989"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=9jnq5e228Bvwrtn%2BBND2Fu2mIyIqk5ijB2bO9H7bTNtOQCl3ETbDdXY6dQCr7tvBmrDsppNJTOhpJwQ4OoKr1RUVtsc7H%2F%2Bt113gy8BFYLXqJ5rZ"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *
expires: Wed, 30 Dec 2020 20:17:09 GMT
cache-control: max-age=3024000
cf-ray: 5fb77ded8ad01e61-MUC
cf-bgj: minify

GET
H2 200 noty.js Show response
www.bleepstatic.com/js/noty/ 46 KB
11 KB 46ms
41ms Script
text/javascript 172.67.75.139
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bleepstatic.com/js/noty/noty.js
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.75.139 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e5f51209e23b5d8a4ba4370726b53a7bf8165c655fc3d9757cfa05ae33c7f270

Request headers

Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 19:35:35 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 602306
cf-polished: origSize=79865
cf-request-id: 06c68d087600001e61921f3000000001
last-modified: Thu, 23 Nov 2017 17:50:15 GMT
server: cloudflare
etag: W/"2074561786"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=e7Bnhtktumw9xEelBis19cu8AG0CllYQgXYDpussmx%2BqXxNXHP2MEEMeal9FxtnIllaszn9gtAnMTM9M8rMSXeaZTXJ7z4Y%2FZZvcd66txl%2FreUXD"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
access-control-allow-origin: *
expires: Wed, 30 Dec 2020 20:17:09 GMT
cache-control: max-age=3024000
cf-ray: 5fb77ded8ad31e61-MUC
cf-bgj: minify

GET
H2 200 js.cookie.min.js Show response
www.bleepstatic.com/js/jq-cookie/ 2 KB
1 KB 36ms
32ms Script
text/javascript 172.67.75.139
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bleepstatic.com/js/jq-cookie/js.cookie.min.js
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.75.139 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f3d2f3c252cb69ecc65b35060f06d8f20d5af93d751731c9b47d5ad0a4b28c5a

Request headers

Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 19:35:35 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 602306
cf-request-id: 06c68d087600001e61a49ac000000001
last-modified: Fri, 24 Nov 2017 16:58:52 GMT
server: cloudflare
etag: W/"3155542618"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=GFxkapdXIcCKwajIq%2FuceK8FDG3SfRM3u5Cuyapeu1cjDCmHGuLu3%2Fl7dtXUdzSKn1N6dLl9KwCEX4wdDNy723zJlSofDaJhbUZtSSORd%2BsfN%2F3X"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=3024000
cf-ray: 5fb77ded8ad91e61-MUC
expires: Wed, 30 Dec 2020 20:17:09 GMT

GET
H2 200 addthis_widget.js Show response
s9.addthis.com/js/300/ 353 KB
114 KB 53ms
34ms Script
application/javascript 104.75.88.112
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://s9.addthis.com/js/300/addthis_widget.js

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.75.88.112 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-75-88-112.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

acd2f7ad78edeebad4b6b0fdd17ff57d81c3726c60fd5435ee8c5a0115d29403

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
last-modified: Mon, 26 Oct 2020 18:11:48 GMT
server: nginx/1.15.8
etag: "5f971164-5834c"
vary: Accept-Encoding
x-distribution: 99
content-type: application/javascript
cache-control: public, max-age=600
date: Wed, 02 Dec 2020 19:35:35 GMT
x-host: s9.addthis.com
content-length: 116325

GET
H2 200 20x20-printer.png
www.bleepstatic.com/images/site/ 422 B
914 B 41ms
38ms Image
image/webp 172.67.75.139
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bleepstatic.com/images/site/20x20-printer.png
Requested by: Host: www.bleepstatic.com
URL: https://www.bleepstatic.com/css/redesign/main.css?v=11.14.20.7
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.75.139 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b34676178982122b66b0a55d3ee411fa343b1d19a6c119c0c9b0ea2c892738a1

Request headers

Referer: https://www.bleepstatic.com/css/redesign/main.css?v=11.14.20.7
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 19:35:35 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 1801815
cf-polished: origFmt=png, origSize=824
content-disposition: inline; filename="20x20-printer.webp"
content-length: 422
cf-request-id: 06c68d087800001e614db25000000001
last-modified: Sat, 03 Oct 2015 03:18:32 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=bEJjOswxQhv7Zoj7i8Grr5AshDFt9ISngpHbDlyoTztANpEszG4EkFEdqz4NzPbvZ1gnKKuELjGMok3IsmkPO3x9rerrrzmLIwydI88D2TZGc302"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
expires: Fri, 11 Dec 2020 23:05:19 GMT
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 5fb77ded8ae41e61-MUC
cf-bgj: imgq:85,h2pri

GET
H2 200 calendar.png
www.bleepstatic.com/images/site/ 86 B
472 B 44ms
42ms Image
image/webp 172.67.75.139
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bleepstatic.com/images/site/calendar.png
Requested by: Host: www.bleepstatic.com
URL: https://www.bleepstatic.com/css/redesign/news.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.75.139 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 85ae9534729617e69eafa40195c7854697eb3d13b4205f3ee467e07c4af0a24b

Request headers

Referer: https://www.bleepstatic.com/css/redesign/news.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 19:35:35 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 681069
cf-polished: origFmt=png, origSize=129
content-disposition: inline; filename="calendar.webp"
content-length: 86
cf-request-id: 06c68d087d00001e615a224000000001
last-modified: Sat, 04 Mar 2017 20:46:52 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=BsdqNGOfSvwE0NnyVangmgqX%2FDPs2UaB2R3J0JvwM6%2F39AGf6Id6Bbx3jxS79%2FJgoFnKEZfppSy%2F37EyerG9gbNT1%2B%2FjzPDdaM3%2Fa5vgclLzTwh%2B"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
expires: Thu, 24 Dec 2020 22:24:25 GMT
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 5fb77ded9afa1e61-MUC
cf-bgj: imgq:85,h2pri

GET
H2 200 clock.png
www.bleepstatic.com/images/site/ 252 B
626 B 44ms
41ms Image
image/webp 172.67.75.139
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bleepstatic.com/images/site/clock.png
Requested by: Host: www.bleepstatic.com
URL: https://www.bleepstatic.com/css/redesign/news.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.75.139 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 82c7fdbc4d001907e1e5d56cd335af3f0d48e0ffa7f0ad2aa3486ebb1123cb21

Request headers

Referer: https://www.bleepstatic.com/css/redesign/news.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 19:35:35 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 629663
cf-polished: origFmt=png, origSize=1316
content-disposition: inline; filename="clock.webp"
content-length: 252
cf-request-id: 06c68d087d00001e61a49ad000000001
last-modified: Fri, 29 May 2015 07:08:14 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=Kw1C%2Ffy3GXogO0RomCRPa3NMLpl8JmCrmS5SaulmmsrVRhgpUDZ09tgq32JCw%2FhtUB45tmETAafnM6EXODv7p4gko1YdGlLbPiSgl82jj4Ib99nn"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
expires: Fri, 25 Dec 2020 12:41:12 GMT
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 5fb77ded9afd1e61-MUC
cf-bgj: imgq:85,h2pri

GET
H2 200 comment-light.png
www.bleepstatic.com/images/site/ 96 B
755 B 42ms
40ms Image
image/webp 172.67.75.139
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bleepstatic.com/images/site/comment-light.png
Requested by: Host: www.bleepstatic.com
URL: https://www.bleepstatic.com/css/redesign/news.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.75.139 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bfc8e65089dc5421d56ecc71a0328eafd4feb2a602503ae5c15bfa3189c02f7e

Request headers

Referer: https://www.bleepstatic.com/css/redesign/news.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 19:35:35 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 683764
cf-polished: origFmt=png, origSize=1034
content-disposition: inline; filename="comment-light.webp"
content-length: 96
cf-request-id: 06c68d087d00001e616497b000000001
last-modified: Fri, 29 May 2015 07:08:28 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=wQjkpzTJHYW3JyLJgboQFlj5tHN3wlxnogyVdr0SIdsMK5qAPJPSCeN4FpJYgJ2BOODHWp3c%2F2ezDK88h%2FHYQJ5HDIROl4a37OhwRshEHGjwXaKT"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
expires: Thu, 24 Dec 2020 21:39:30 GMT
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 5fb77ded9aff1e61-MUC
cf-bgj: imgq:85,h2pri

GET
H3-Q050 200 KFOlCnqEu92Fr1MmSU5fBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v20/ 11 KB
11 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:814::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmSU5fBBc4AMP6lQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,100,300,500,700,900&display=swap

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

92606bd38901e67d069f2ef883715b6e5ae07d72ae3bead3ad92346528374afc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://www.bleepingcomputer.com
Referer: https://fonts.googleapis.com/css?family=Roboto:400,100,300,500,700,900&display=swap
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 01 Dec 2020 20:05:05 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:18:52 GMT
server: sffe
age: 84630
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11180
x-xss-protection: 0
expires: Wed, 01 Dec 2021 20:05:05 GMT

GET
H2 200 choice.js Show response
quantcast.mgr.consensu.org/choice/sktb670LZWvFX/www.bleepingcomputer.com/ 5 KB
2 KB 46ms
18ms Script
application/javascript 2600:9000:2156:6400:9:46dc:4700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://quantcast.mgr.consensu.org/choice/sktb670LZWvFX/www.bleepingcomputer.com/choice.js
Requested by: Host: www.bleepstatic.com
URL: https://www.bleepstatic.com/js/qc-consent/qc-consent.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:6400:9:46dc:4700:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 7320e5365ede863b09d7604b3be1cabc240ccf7702c3dc83263727846b2da42f

Request headers

Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 19:35:35 GMT
content-encoding: gzip
etag: "54d1f6060ccb0d1e07d8f296b0f80b0e"
last-modified: Mon, 05 Oct 2020 22:15:00 GMT
server: AmazonS3
x-amz-cf-pop: FRA50-C1
x-amz-server-side-encryption: AES256
vary: Access-Control-Request-Headers,Access-Control-Request-Method,Origin,Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 e6d97713eb9b65f883e0f86b833878dd.cloudfront.net (CloudFront)
cache-control: max-age=900
x-amz-cf-id: g1_-4Rb2C73LslGjWJR9RJS_WFGuceVG8qfHUCqKyNkrJB1HkcAScQ==

GET
H2 200 32x32-printer.png
www.bleepstatic.com/images/site/ 256 B
794 B 28ms
25ms Image
image/webp 172.67.75.139
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bleepstatic.com/images/site/32x32-printer.png
Requested by: Host: www.bleepstatic.com
URL: https://www.bleepstatic.com/css/redesign/main.css?v=11.14.20.7
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.75.139 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 33eb81af8a0101c1ad2a210f322fb362ce1598e6e37f0a7ecc62d6ff39add590

Request headers

Referer: https://www.bleepstatic.com/css/redesign/main.css?v=11.14.20.7
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 19:35:35 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 633226
cf-polished: origFmt=png, origSize=618
content-disposition: inline; filename="32x32-printer.webp"
content-length: 256
cf-request-id: 06c68d08ab00001e61a2968000000001
last-modified: Fri, 02 Oct 2015 21:57:19 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=s3qDNTi7y6ZLQfx0%2B%2BhQ6cHWb2Sn1fr6HAHxvwUKvdBGgrQIM%2FHW272XncChNVv1%2F4NtQOpwsw5QakXSHGK6DgsLNNCGymd%2BhgrzS7Ytc94jdkjt"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
expires: Fri, 25 Dec 2020 11:41:49 GMT
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 5fb77deddbbb1e61-MUC
cf-bgj: imgq:85,h2pri

GET
H2 200 21beb902b545b086a90ec39f1df36b94.jpg
www.bleepstatic.com/author/photos/ 7 KB
8 KB 31ms
28ms Image
image/jpeg 172.67.75.139
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bleepstatic.com/author/photos/21beb902b545b086a90ec39f1df36b94.jpg
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.75.139 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fb845bc1998e818ffd1ebeacd695e0a60e479e5993e5f0053e34bff96b8d4c53

Request headers

Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 19:35:35 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 5939
cf-polished: origSize=7617, status=webp_bigger
content-length: 7551
cf-request-id: 06c68d08ab00001e617b056000000001
last-modified: Mon, 26 Oct 2015 17:15:33 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=YEaBwDBqoaGsPs3il0dCOEoI94MGJ9CU%2F1r6nS2hIcMtqCkMu3BE6%2BgqKMNCPVpEwyP5R5ihXKlI7jOTqfPITNMHcNbMkVZ7BhFKZ3B8u9NTeOxZ"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
expires: Fri, 01 Jan 2021 17:56:36 GMT
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 5fb77deddbbd1e61-MUC
cf-bgj: imgq:85,h2pri

GET
H2 200 before-bg.png
www.bleepstatic.com/images/site/ 116 B
776 B 28ms
26ms Image
image/webp 172.67.75.139
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bleepstatic.com/images/site/before-bg.png
Requested by: Host: www.bleepstatic.com
URL: https://www.bleepstatic.com/css/redesign/news.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.75.139 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ee9b2fe75e3a5637b840957e2f9aefedb394224a1846a731ad7ead76abf91d58

Request headers

Referer: https://www.bleepstatic.com/css/redesign/news.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 19:35:35 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 1197341
cf-polished: origFmt=png, origSize=1026
content-disposition: inline; filename="before-bg.webp"
content-length: 116
cf-request-id: 06c68d08ab00001e61518b4000000001
last-modified: Fri, 29 May 2015 07:08:06 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=XAhuJZzN2zZu0D9U4Fg8Q7JpWqiwiY3YrMlI4JYivZbbpTpeTLgfMl38KuiEGH4MD0woxPDJUzq32b9n6t1eW%2Ffx%2F2tzpMwXxpNNMvmbCn5QIIrI"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
expires: Fri, 18 Dec 2020 22:59:54 GMT
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 5fb77deddbbe1e61-MUC
cf-bgj: imgq:85,h2pri

GET
H2 200 news-icon-01.png
www.bleepstatic.com/images/site/ 240 B
619 B 30ms
28ms Image
image/webp 172.67.75.139
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bleepstatic.com/images/site/news-icon-01.png
Requested by: Host: www.bleepstatic.com
URL: https://www.bleepstatic.com/css/redesign/news.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.75.139 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a1af15b17fd7099b2d3a81a8b3aeffd94b26d2c1a58489c3903e11ec5a4896d3

Request headers

Referer: https://www.bleepstatic.com/css/redesign/news.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 19:35:35 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 23
cf-polished: origFmt=png, origSize=1204
content-disposition: inline; filename="news-icon-01.webp"
content-length: 240
cf-request-id: 06c68d08ab00001e61528c9000000001
last-modified: Fri, 29 May 2015 07:09:52 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=GF7vuZ5oWJ7%2BcwoY27W5OhzgZpW3AC27EWDQg21HB7pHNR0YNpLF%2FLk3jvdpcTuwRJRLTR8OmxRquPnjrTSs5tI81dpmSg3dzehpQmsnnkbJW6l%2F"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
expires: Wed, 02 Dec 2020 05:48:48 GMT
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 5fb77deddbc01e61-MUC
cf-bgj: imgq:85,h2pri

GET
H2 200 link-icon.png
www.bleepstatic.com/images/site/comments/ 494 B
905 B 31ms
29ms Image
image/webp 172.67.75.139
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bleepstatic.com/images/site/comments/link-icon.png
Requested by: Host: www.bleepstatic.com
URL: https://www.bleepstatic.com/css/redesign/news.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.75.139 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ef3d32ea9a9fa05f8170d164890b55e15ce39157bb9ae7e96b047c1996d22a8b

Request headers

Referer: https://www.bleepstatic.com/css/redesign/news.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 19:35:35 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 23
cf-polished: origFmt=png, origSize=787
content-disposition: inline; filename="link-icon.webp"
content-length: 494
cf-request-id: 06c68d08ab00001e6181bab000000001
last-modified: Fri, 25 Sep 2015 17:29:04 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=IMqCqrHbeOfGDa0sAxlCTDbNQU0wO7IfnxQafNUWk0Q%2FowYWQlEv86To5giCROmJ7uZtxGbOfjFrxSMRn3obAqrpPfBfqsQX3ew0ogUXjxMhNEeS"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
expires: Tue, 01 Dec 2020 03:44:16 GMT
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 5fb77deddbc11e61-MUC
cf-bgj: imgq:85,h2pri

GET
H3-Q050 200 KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v20/ 11 KB
11 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:814::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,100,300,500,700,900&display=swap

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ce897833ac6e362df7c91ac8223fe511c6defcf33964928a81004600a2dd4c2e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://www.bleepingcomputer.com
Referer: https://fonts.googleapis.com/css?family=Roboto:400,100,300,500,700,900&display=swap
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 26 Nov 2020 11:20:37 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:18:48 GMT
server: sffe
age: 548098
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11056
x-xss-protection: 0
expires: Fri, 26 Nov 2021 11:20:37 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 46 KB
18 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:80b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-91740-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

e441c3e2771625ba05630ab464275136a82c99650ee2145ca5aa9853bedeb01b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 23 Oct 2020 03:00:57 GMT
server: Golfe2
age: 6374
date: Wed, 02 Dec 2020 17:49:21 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18817
expires: Wed, 02 Dec 2020 19:49:21 GMT

GET
H2 200 h4-bg.png
www.bleepstatic.com/images/site/ 38 B
692 B 21ms
20ms Image
image/webp 172.67.75.139
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bleepstatic.com/images/site/h4-bg.png
Requested by: Host: www.bleepstatic.com
URL: https://www.bleepstatic.com/css/redesign/main.css?v=11.14.20.7
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.75.139 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 942935ead42820e6c9184f099c77dde34fa4be70d395a17c47b5d7ad07967339

Request headers

Referer: https://www.bleepstatic.com/css/redesign/main.css?v=11.14.20.7
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 19:35:35 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 2697
cf-polished: origFmt=png, origSize=72
content-disposition: inline; filename="h4-bg.webp"
content-length: 38
cf-request-id: 06c68d08d100001e61541d6000000001
last-modified: Sat, 04 Mar 2017 20:46:52 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=gUGwVNB48QjTmJZmSCndtu3x5vPuo9jK79sX2LVcIjSOFGg0Wh6XnUylI1B5juSQDufz8F3%2FyrEI0gvwIlyhGEExSzZH7sZVgXxAOXNcSGdJh7K0"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
expires: Tue, 01 Dec 2020 08:27:01 GMT
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 5fb77dee1c3f1e61-MUC
cf-bgj: imgq:85,h2pri

GET
H2 200 news_email_icon.png
www.bleepstatic.com/images/site/ 126 B
627 B 22ms
21ms Image
image/webp 172.67.75.139
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bleepstatic.com/images/site/news_email_icon.png
Requested by: Host: www.bleepstatic.com
URL: https://www.bleepstatic.com/css/redesign/home.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.75.139 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7c42933014424dabb2256a0732a9f792559d26ba09a84308c278f52834522f9a

Request headers

Referer: https://www.bleepstatic.com/css/redesign/home.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 19:35:35 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 2254345
cf-polished: origFmt=png, origSize=1105
content-disposition: inline; filename="news_email_icon.webp"
content-length: 126
cf-request-id: 06c68d08d100001e617b8c3000000001
last-modified: Fri, 29 May 2015 07:10:12 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=NafS7AiOxz9Fjl4InJULGlFkMtdNfXLoroZBl4AaVicbyJuaZtrHpmLg9dYyqmTXDmS7Xq6NKA8TsTiDxOU8zM5tMNRZYlQNBq%2FeXsbiYg%2B4%2FIS5"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
expires: Sun, 06 Dec 2020 17:23:10 GMT
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 5fb77dee1c431e61-MUC
cf-bgj: imgq:85,h2pri

GET
H2 200 news_footer_icon.png
www.bleepstatic.com/images/site/ 110 B
480 B 28ms
27ms Image
image/webp 172.67.75.139
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bleepstatic.com/images/site/news_footer_icon.png
Requested by: Host: www.bleepstatic.com
URL: https://www.bleepstatic.com/css/redesign/main.css?v=11.14.20.7
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.75.139 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d020fa6036628dd1d6dbf760edc742273359e93119832249bdce332d05d6db4d

Request headers

Referer: https://www.bleepstatic.com/css/redesign/main.css?v=11.14.20.7
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 19:35:35 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 682928
cf-polished: origFmt=png, origSize=186
content-disposition: inline; filename="news_footer_icon.webp"
content-length: 110
cf-request-id: 06c68d08d100001e61509bd000000001
last-modified: Sat, 04 Mar 2017 20:46:52 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=IR7ETl76%2BXbDMKEi4Dz4i6w9CVkC%2FdB8%2F%2FETsEKLWXE3S%2BxZSHD3Hid8WtDGGpFP0GG9iLpuhY8m9kvWRPhw9%2FOsbR%2Bg2tvn2W5cVmAYhjMg%2FfrN"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
expires: Thu, 24 Dec 2020 21:53:27 GMT
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 5fb77dee1c451e61-MUC
cf-bgj: imgq:85,h2pri

GET
H/1.1 200
OK init Show response
d.pub.network/ 143 B
590 B 577ms
154ms XHR
application/json 35.188.71.214
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://d.pub.network/init?key=535undefined
Requested by: Host: a.pub.network
URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.188.71.214 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 214.71.188.35.bc.googleusercontent.com
Software: /
Resource Hash: ee7dddf6eca49bd63ce931405cfa0064d51b011a1a076a036d59555780250751

Request headers

Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Access-Control-Allow-Origin: https://www.bleepingcomputer.com
Date: Wed, 02 Dec 2020 19:35:35 GMT
Access-Control-Allow-Credentials: true
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Transfer-Encoding: chunked
Content-Type: application/json

GET
H3-Q050 200 show_ads_impl_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20201112/r20190131/ 231 KB
87 KB 29ms
29ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20201112/r20190131/show_ads_impl_fy2019.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ad7386d16a056df5c235702a97a5fa4cee68e302d71041aa35df96151f756f48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 19:35:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 88601
x-xss-protection: 0
server: cafe
etag: 4353532171737760018
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Wed, 02 Dec 2020 19:35:35 GMT

GET
H2 200 zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20201112/r20190131/ Frame 328D 0
0 6ms
5ms Document
text/html 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20201112/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/html/r20201112/r20190131/zrt_lookup.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Wed, 02 Dec 2020 01:05:48 GMT
expires: Wed, 16 Dec 2020 01:05:48 GMT
content-type: text/html; charset=UTF-8
etag: 5228831996244654541
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4745
x-xss-protection: 0
age: 66587
cache-control: public, max-age=1209600
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"

GET
H2 200 quant.js Show response
secure.quantserve.com/ 23 KB
9 KB 27ms
8ms Script
application/javascript 2620:116:800d:21:5a23:9c4e:e774:96c1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.quantserve.com/quant.js
Requested by: Host: quantcast.mgr.consensu.org
URL: https://quantcast.mgr.consensu.org/choice/sktb670LZWvFX/www.bleepingcomputer.com/choice.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:116:800d:21:5a23:9c4e:e774:96c1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 87d73170be9a2e277c57d324c4e05ec0ac60ed3c0191fa29e7a31133b4c4c119

Request headers

Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 19:35:35 GMT
content-encoding: gzip
etag: "O/+l6c17R2TQ0JQMJXOiXA=="
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, max-age=604800
accept-ranges: bytes
expires: Wed, 09 Dec 2020 19:35:35 GMT

GET
H2 200 cmp2.js Show response
quantcast.mgr.consensu.org/tcfv2/ 266 KB
67 KB 11ms
10ms Script
text/javascript 2600:9000:2156:6400:9:46dc:4700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://quantcast.mgr.consensu.org/tcfv2/cmp2.js
Requested by: Host: quantcast.mgr.consensu.org
URL: https://quantcast.mgr.consensu.org/choice/sktb670LZWvFX/www.bleepingcomputer.com/choice.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:6400:9:46dc:4700:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: d60a01e86a6701bf5d527ff6b176b7b501fc2638b5582fe22be89dabf5133720

Request headers

Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 19:35:17 GMT
content-encoding: br
etag: "8e6f2132b0d4913d00a9957b268f90d9"
last-modified: Fri, 13 Nov 2020 00:49:15 GMT
server: AmazonS3
age: 18
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript;charset=UTF-8
via: 1.1 e6d97713eb9b65f883e0f86b833878dd.cloudfront.net (CloudFront)
cache-control: max-age=3600
x-amz-meta-qc-ineu: True
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: xbevb7gqNGv73fuNQMy5MuBVMTQSwqD9sm0pn8SpK7ooXsVFnDC5PA==

GET
H2 200 p-sktb670LZWvFX.gif
pixel.quantserve.com/pixel/ 35 B
373 B 26ms
7ms Image
image/gif 2620:116:800d:21:5a23:9c4e:e774:96c1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.quantserve.com/pixel/p-sktb670LZWvFX.gif

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:5a23:9c4e:e774:96c1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 02 Dec 2020 19:35:35 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

POST
H3-Q050 200 collect Show response
www.google-analytics.com/j/ 1 B
73 B 13ms
13ms XHR
text/plain 2a00:1450:4001:824::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j87&a=133804974&t=pageview&_s=1&dl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fmicrosoft%2Fmalicious-npm-packages-used-to-install-njrat-remote-access-trojan%2F&ul=en-us&de=UTF-8&dt=Malicious%20NPM%20packages%20used%20to%20install%20njRAT%20remote%20access%20trojan&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAUABAAAAAC~&jid=287222945&gjid=1747764477&cid=372363179.1606937735&tid=UA-91740-1&_gid=1190244487.1606937735&_r=1&gtm=2oub41&z=764908826

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:824::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 02 Dec 2020 19:35:35 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.bleepingcomputer.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 moatframe.js Show response
z.moatads.com/addthismoatframe568911941483/ 2 KB
1 KB 74ms
24ms Script
application/x-javascript 104.111.216.96
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/addthismoatframe568911941483/moatframe.js
Requested by: Host: s9.addthis.com
URL: https://s9.addthis.com/js/300/addthis_widget.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-216-96.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd

Request headers

Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 19:35:35 GMT
content-encoding: gzip
last-modified: Fri, 08 Nov 2019 20:13:52 GMT
server: AmazonS3
x-amz-request-id: 6CDA04CEF72D568E
etag: "f14b4e1f799b14f798a195f43cf58376"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=16912
accept-ranges: bytes
content-length: 948
x-amz-id-2: vmrAbpbzrBs8g4V4M3AoGAqwWb0EhELJ1wy9AWvX/tuPVstbiwgv0ja/UaK2kknp20dNDPCNIa4=

GET
H2 200 _ate.track.config_resp Show response
v1.addthisedge.com/live/boost/ra-561517d2c7f964d6/ 2 KB
855 B 39ms
38ms Script
application/javascript 104.75.88.112
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.addthisedge.com/live/boost/ra-561517d2c7f964d6/_ate.track.config_resp
Requested by: Host: s9.addthis.com
URL: https://s9.addthis.com/js/300/addthis_widget.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.75.88.112 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-75-88-112.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 6d23d10111755a12c87198df1c71cce449de31eca9643030c6327a2157f9bd86

Request headers

Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 19:35:35 GMT
content-encoding: gzip
etag: -1659864586--gzip
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
cache-control: public, max-age=30, s-maxage=86400
content-disposition: attachment; filename=1.txt
content-length: 678

GET
H2 200 300lo.json Show response
m.addthis.com/live/red_lojson/ 90 B
250 B 128ms
127ms Script
application/javascript 104.75.88.112
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://m.addthis.com/live/red_lojson/300lo.json?si=5fc7ec87df372b61&bkl=0&bl=1&pdt=944&sid=5fc7ec87df372b61&pub=ra-561517d2c7f964d6&rev=v8.28.8-wp&ln=en&pc=men&cb=0&ab=-&dp=www.bleepingcomputer.com&fp=news%2Fmicrosoft%2Fmalicious-npm-packages-used-to-install-njrat-remote-access-trojan%2F&fr=&of=0&pd=0&irt=0&vcl=0&md=0&ct=1&tct=0&abt=0&cdn=0&pi=1&rb=0&gen=100&chr=UTF-8&mk=computers%2Cwindows%2Clinux%2Cmac%2Csupport%2Ctech%20support%2Cspyware%2Cmalware%2Cvirus%2Csecurity%2CMalware%2CnjRAT%2Cnpm%2CRAT%2CRemote%20Access%20Trojan%2Cvirus%20removal%2Cmalware%20removal%2Ccomputer%20help%2Ctechnical%20support&colc=1606937735510&jsl=4097&uvs=5fc7ec877d5c26fd000&skipb=1&callback=addthis.cbs.jsonp__303524876046682660
Requested by: Host: s9.addthis.com
URL: https://s9.addthis.com/js/300/addthis_widget.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.75.88.112 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-75-88-112.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: ea709729b980139033444c5b81a25ecd999d1d7fff87cda1803511886c8328ef

Request headers

Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 02 Dec 2020 19:35:35 GMT
cache-control: max-age=0, no-cache, no-store, no-transform
content-disposition: attachment; filename=1.txt
content-length: 90
content-type: application/javascript;charset=utf-8

GET sh.f48a1a04fe8dbf021b4cda1d.html
s7.addthis.com/static/ Frame 7ACA 0
0

GET
H2 200 sh.f48a1a04fe8dbf021b4cda1d.html
s7.addthis.com/static/ Frame B94F 0
0 22ms
19ms Document
text/html 104.75.88.112
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html

Requested by

Host: s9.addthis.com
URL: https://s9.addthis.com/js/300/addthis_widget.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.75.88.112 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-75-88-112.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

:method: GET
:authority: s7.addthis.com
:scheme: https
:path: /static/sh.f48a1a04fe8dbf021b4cda1d.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/

Response headers

server: nginx/1.15.8
content-type: text/html
last-modified: Thu, 04 Jun 2020 15:49:19 GMT
etag: W/"5ed917ff-11adc"
timing-allow-origin: *
cache-control: public, max-age=86313600
p3p: CP="NON ADM OUR DEV IND COM STA"
strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
content-length: 26421
date: Wed, 02 Dec 2020 19:35:35 GMT
vary: Accept-Encoding
x-host: s7.addthis.com

GET
H2 200 292x176_Advantech.jpg
www.bleepstatic.com/content/posts/2020/11/27/thumb/ 5 KB
6 KB 32ms
31ms Image
image/webp 172.67.75.139
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bleepstatic.com/content/posts/2020/11/27/thumb/292x176_Advantech.jpg
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.75.139 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d34199e64ca6bdadfe74bedaf438b875e17ae739fd9d9ff2b861cfcc402d68f6

Request headers

Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 19:35:35 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 3342
cf-polished: qual=85, origFmt=jpeg, origSize=7977
content-disposition: inline; filename="292x176_Advantech.webp"
content-length: 5424
cf-request-id: 06c68d097600001e618a859000000001
last-modified: Fri, 27 Nov 2020 20:12:26 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=0wUku7ZQRJ8Gh4iCwf71Ym7yrQlmE%2BBiJn%2BT4J1Lf%2FJrM0ZokTcGTW2S9nX9cHx389poIu7pJypV7NohXcAzDMT3jPSMPyp6ct3qwzv26RxhtKhO"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
expires: Fri, 01 Jan 2021 18:39:53 GMT
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 5fb77def2e5c1e61-MUC
cf-bgj: imgq:85,h2pri

GET
H2 200 292x176_Windows-Update.jpg
www.bleepstatic.com/content/hl-images/2017/04/06/thumb/ 3 KB
4 KB 27ms
27ms Image
image/jpeg 172.67.75.139
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bleepstatic.com/content/hl-images/2017/04/06/thumb/292x176_Windows-Update.jpg
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.75.139 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 36d9f0003be15d4a513ca82ffafaf509a402d488f5f2e306ec8e0306ea21dbb8

Request headers

Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 19:35:35 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 46182
cf-polished: origSize=4080, status=webp_bigger
content-length: 3235
cf-request-id: 06c68d097500001e617b068000000001
last-modified: Thu, 06 Apr 2017 10:23:15 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=gvGvHftZRjtNeKg70zqFlV6fIcfDfGpe2lhd7Sw4tMM1hWojyqXcgUoS2dJue6602CoTKuXknLs6fxGxB%2FVk2TJqjws9u6YGoVK6TWZc7fq%2B5Y8G"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
expires: Fri, 01 Jan 2021 06:45:52 GMT
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 5fb77def2e5f1e61-MUC
cf-bgj: imgq:85,h2pri

GET
H2 200 connatix.playspace.css
cds.connatix.com/p/81038/ 105 KB
15 KB 12ms
12ms Stylesheet
text/css 151.101.194.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.connatix.com/p/81038/connatix.playspace.css
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 555e47081a0d4e6e4e53f14fcf39c5de289bb641601738552d1dd74840c1beba

Request headers

Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 19:35:35 GMT
via: 1.1 varnish, 1.1 varnish
age: 34355
x-cache: HIT, HIT
content-encoding: gzip
content-length: 15363
x-served-by: cache-dca17732-DCA, cache-hhn4052-HHN
last-modified: Wed, 02 Dec 2020 09:02:27 GMT
x-timer: S1606937736.568775,VS0,VE0
etag: "e9553598fc400677830e871c7cdebb61"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31557600
accept-ranges: bytes
x-cache-hits: 1, 6279

GET
H2 200 jquery.fancybox.css
www.bleepstatic.com/js/redesign/fancybox/ 4 KB
1 KB 23ms
23ms Stylesheet
text/css 172.67.75.139
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bleepstatic.com/js/redesign/fancybox/jquery.fancybox.css
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.75.139 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6e86593083facba2710a2312f26bd7b436d7ef299f99cbc2ccc1b32693ec3144

Request headers

Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 19:35:35 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 2812826
cf-polished: origSize=4895
cf-request-id: 06c68d099500001e615694e000000001
last-modified: Wed, 14 Oct 2015 20:25:51 GMT
server: cloudflare
etag: W/"9108074"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=CCG7Y888BHzh5JnFbe1ZaYVPYWBKnXzdo3hDWLhKQop2U1m1VwbiYP14FxeRlOGNw8wBQSGp3G4YAHt1dG6c0%2FJIyYcI7lyimj0yYhKmxO4c1%2FnR"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *
expires: Sat, 05 Dec 2020 06:15:09 GMT
cache-control: max-age=3024000
cf-ray: 5fb77def5ecc1e61-MUC
cf-bgj: minify

GET
H2 200 font-awesome.css
www.bleepstatic.com/css/redesign/ 22 KB
5 KB 29ms
29ms Stylesheet
text/css 172.67.75.139
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bleepstatic.com/css/redesign/font-awesome.css
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.75.139 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8733e2183f16906b2fa2e58fdab82cf336f249ab71ac1b184470da2dd3c6e29f

Request headers

Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 19:35:35 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 2729009
cf-polished: origSize=26776
cf-request-id: 06c68d099600001e619d297000000001
last-modified: Tue, 03 May 2016 04:39:29 GMT
server: cloudflare
etag: W/"1700274315"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=4VfB2EwhvXVsSSOB%2BiVkUHXjdm7K%2Fk1n4UXjmZq3dMzXoy4FJFyJSAH34SpnTKaHWDndL8Qm9hREMBkF2kAvO9PnlWcbL92IQyTp9TGwZ8GfHFl%2F"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *
expires: Sun, 06 Dec 2020 05:32:06 GMT
cache-control: max-age=3024000
cf-ray: 5fb77def5ece1e61-MUC
cf-bgj: minify

GET
H2 200 favicon.ico
ad.doubleclick.net/ 1 KB
483 B 57ms
20ms Image
image/x-icon 172.217.22.38
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.38 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s16-in-f6.1e100.net

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 11:40:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 28518
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0
last-modified: Tue, 08 May 2012 13:08:06 GMT
server: sffe
vary: Accept-Encoding
content-type: image/x-icon
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
expires: Thu, 03 Dec 2020 11:40:17 GMT

GET
H2 200 achoice.svg
widgets.outbrain.com/images/widgetIcons/ 3 KB
3 KB 94ms
35ms Image
image/svg+xml 104.111.216.19
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://widgets.outbrain.com/images/widgetIcons/achoice.svg
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.216.19 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-216-19.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 2c87952cc1c23627496c7874271042bdb6af21efdf7cbf36ec4d98e6cec34d04

Request headers

Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 19:35:35 GMT
last-modified: Wed, 14 Oct 2020 08:08:54 GMT
server: AkamaiNetStorage
etag: "9d26fa4e7238ed94f1d0d92afb453b3e:1602663139.008777"
access-control-allow-methods: GET,POST
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=2592000
access-control-allow-credentials: false
cookie: CheetahStaging=true
accept-ranges: bytes
timing-allow-origin: *
content-length: 2735
expires: Fri, 01 Jan 2021 19:35:35 GMT

GET
H/1.1 200
OK tracking-sw-index.html
ecdn.firstimpression.io/static/sw/ Frame 4A43 0
0 90ms
31ms Document
text/html 185.3.92.12
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to

Full URL: https://ecdn.firstimpression.io/static/sw/tracking-sw-index.html
Requested by: Host: ecdn.firstimpression.io
URL: https://ecdn.firstimpression.io/fi_client.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.3.92.12 London, United Kingdom, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS: nb-185-3-92-12.london.nodebalancer.linode.com
Software: nginx/1.16.1 /
Resource Hash

Request headers

Host: ecdn.firstimpression.io
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/

Response headers

Server: nginx/1.16.1
Date: Wed, 02 Dec 2020 19:35:09 GMT
Content-Type: text/html
Content-Length: 5819
Connection: close
Last-Modified: Wed, 15 Jul 2015 00:00:00 GMT
ETag: "55a5a280-16bb"
Expires: Wed, 02 Dec 2020 20:35:09 GMT
Cache-Control: max-age=3600
Accept-Ranges: bytes

GET
H2 200 fontawesome-webfont.woff
www.bleepstatic.com/fonts/ 64 KB
65 KB 105ms
39ms Font
application/octet-stream 172.67.75.139
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bleepstatic.com/fonts/fontawesome-webfont.woff?v=4.2.0
Requested by: Host: www.bleepstatic.com
URL: https://www.bleepstatic.com/css/redesign/font-awesome.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.75.139 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 199411f659f41aaccb959bacb1b0de30e54f244352a48c6f9894e65ae0f8a9a1

Request headers

Origin: https://www.bleepingcomputer.com
Referer: https://www.bleepstatic.com/css/redesign/font-awesome.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 19:35:35 GMT
cf-cache-status: HIT
last-modified: Thu, 23 Apr 2015 09:36:00 GMT
server: cloudflare
age: 6292
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=8gvXuz8ElLsfcLKBvPQ3KRvFhlHCPQpZgTRIflB6Qg6z366tZn%2Bc%2BXOtGYKDU%2Boy8%2BPpeIE%2F0RlLUd%2BOmh4dkFcWb8J8IEda45%2BVjB3A%2FOIS7B6w"}],"group":"cf-nel","max_age":604800}
content-type: application/octet-stream
access-control-allow-origin: *
nel: {"report_to":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 5fb77df04f9f375a-MXP
content-length: 65452
cf-request-id: 06c68d0a2e0000375af125e000000001

GET
H2 200 rules-p-sktb670LZWvFX.js Show response
rules.quantcount.com/ 3 B
354 B 129ms
112ms Script
application/x-javascript 2600:9000:20eb:1600:6:44e3:f8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-sktb670LZWvFX.js
Requested by: Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:1600:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Request headers

Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 19:33:35 GMT
via: 1.1 59d92388a3a66e5f245f384a437fa025.cloudfront.net (CloudFront)
last-modified: Fri, 03 Mar 2017 23:52:35 GMT
server: AmazonS3
age: 121
etag: "8a80554c91d9fca8acb82f023de02f11"
x-cache: Error from cloudfront
content-type: application/x-javascript
cache-control: max-age=300
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
content-length: 3
x-amz-cf-id: oi_cBwj9lXKNtRIaiGtW5A2UO3_2LuSpgK_8Mxxe49kmX1lmKInOaA==

GET
H2 200 google-atp-list.json Show response
quantcast.mgr.consensu.org/tcfv2/ 157 KB
37 KB 22ms
6ms XHR
application/json 2600:9000:2156:6400:9:46dc:4700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://quantcast.mgr.consensu.org/tcfv2/google-atp-list.json
Requested by: Host: quantcast.mgr.consensu.org
URL: https://quantcast.mgr.consensu.org/tcfv2/cmp2.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:6400:9:46dc:4700:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 91079a7764463a894b0848a4c1860e3a66dbe6a0d28084809ccae8539d365ca0

Request headers

Accept: application/json, text/plain, */*
Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 03:01:42 GMT
content-encoding: br
vary: Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
age: 59634
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
access-control-allow-origin: *
last-modified: Wed, 02 Dec 2020 03:01:40 GMT
server: AmazonS3
etag: W/"c655bc36372f1846fe9b9b4ad9feb97f"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/json
via: 1.1 1f49a084ca923f375f74b42fa36ef429.cloudfront.net (CloudFront)
cache-control: max-age=172800
access-control-allow-credentials: true
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: 4E2oSnfBcXjWg0g4zVFm_ryaavPdUZHtyHCMskfWQO_TptIt6DVpOw==

GET
H2 200 layers.fa6cd1947ce26e890d3d.js Show response
s7.addthis.com/static/ 263 KB
76 KB 27ms
27ms Script
application/javascript 104.75.88.112
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/static/layers.fa6cd1947ce26e890d3d.js

Requested by

Host: s9.addthis.com
URL: https://s9.addthis.com/js/300/addthis_widget.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.75.88.112 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-75-88-112.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

6121ca306ad1045453d52517b8f436eb5a68055c82aefa46a9a77de36996a3df

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
last-modified: Mon, 26 Oct 2020 18:11:48 GMT
server: nginx/1.15.8
etag: W/"5f971164-41cf5"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=86313600
date: Wed, 02 Dec 2020 19:35:35 GMT
x-host: s7.addthis.com
timing-allow-origin: *
content-length: 77617

POST
H/1.1 200
OK story Show response
capi.connatix.com/core/ Frame F854 2 KB
2 KB 564ms
138ms XHR
multipart/form-data 3.129.41.174
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/core/story?v=81038
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.129.41.174 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-129-41-174.us-east-2.compute.amazonaws.com
Software: openresty/1.15.8.2 /
Resource Hash: a5da2a52884707661811d1198d0a84617f086d074fe6c4ac66344a6f28d0a3f9

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Wed, 02 Dec 2020 19:35:36 GMT
Content-Encoding: gzip
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://www.bleepingcomputer.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 1553

GET
H2 200 spc_fi.php Show response
cdn.firstimpression.io/delivery/ 31 KB
7 KB 610ms
509ms Script
application/javascript 46.51.197.9
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.firstimpression.io/delivery/spc_fi.php?id=5971&url=%2Fnews%2Fmicrosoft%2Fmalicious-npm-packages-used-to-install-njrat-remote-access-trojan%2F&charset=UTF-8&wrapto=firstSpcFetch&ch=20&ref=www.bleepingcomputer.com&referer=&_firid=41309780
Requested by: Host: ecdn.firstimpression.io
URL: https://ecdn.firstimpression.io/fi_client.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 46.51.197.9 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-46-51-197-9.eu-west-1.compute.amazonaws.com
Software: nginx/1.18.0 / PHP/7.3.11
Resource Hash: 8cbb6ff9430a72c63e71843ba2aa571976624efc3ecb7bb2b31601c1193fd854

Request headers

Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 02 Dec 2020 19:35:36 GMT
content-encoding: gzip
server: nginx/1.18.0
x-powered-by: PHP/7.3.11
vary: Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
content-type: application/javascript; charset=UTF-8
expires: 0

GET
H2 200 cmp-list.json Show response
test.quantcast.mgr.consensu.org/GVL-v2/ 7 KB
2 KB 44ms
12ms XHR
application/json 2600:9000:2190:6800:3:a4cd:8380:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://test.quantcast.mgr.consensu.org/GVL-v2/cmp-list.json
Requested by: Host: quantcast.mgr.consensu.org
URL: https://quantcast.mgr.consensu.org/tcfv2/cmp2.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2190:6800:3:a4cd:8380:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: dd8a01673a596265022dad09fddb7edea13075b84a158fedae7775c3728430db

Request headers

Accept: application/json, text/plain, */*
Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 03:00:35 GMT
content-encoding: br
age: 59701
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
access-control-max-age: 86400
access-control-allow-origin: *
last-modified: Wed, 25 Nov 2020 19:52:30 GMT
server: AmazonS3
etag: W/"d76a0ee9065b2d49a4deb28a0405718e"
vary: Accept-Encoding
access-control-allow-methods: GET
x-amz-version-id: ZrS49rVJ7IAdvHHSy5pUmlFqoRebSBk5
via: 1.1 048a65288aba3f3565a971a2e44151be.cloudfront.net (CloudFront)
cache-control: max-age=172800
x-amz-cf-pop: ZRH50-C1
content-type: application/json
x-amz-cf-id: 0uxKKr9Xu5CW83BHP1sGs4w4WHluqH58QOGjfTCVreXRZFGt79uozA==

GET
H2 200 48.008759e9efe1c1b693dd.js Show response
s7.addthis.com/static/ 281 B
486 B 31ms
31ms Script
application/javascript 104.75.88.112
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/static/48.008759e9efe1c1b693dd.js

Requested by

Host: s9.addthis.com
URL: https://s9.addthis.com/js/300/addthis_widget.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.75.88.112 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-75-88-112.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

f8a52990bbe6892abb730d241570fbfbd2ff2fc707fdd3004c7dba6e843bbae3

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
last-modified: Thu, 04 Jun 2020 15:49:19 GMT
server: nginx/1.15.8
etag: W/"5ed917ff-119"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=86313600
date: Wed, 02 Dec 2020 19:35:35 GMT
x-host: s7.addthis.com
timing-allow-origin: *
content-length: 246

POST
H2 200 shares-post.json Show response
api-public.addthis.com/url/serviceapi/ 2 B
324 B 197ms
195ms XHR
application/json 104.75.88.112
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://api-public.addthis.com/url/serviceapi/shares-post.json?services=sFbt&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fmicrosoft%2Fmalicious-npm-packages-used-to-install-njrat-remote-access-trojan%2F

Requested by

Host: s9.addthis.com
URL: https://s9.addthis.com/js/300/addthis_widget.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.75.88.112 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-75-88-112.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-type: text/plain

Response headers

strict-transport-security: max-age=15724800; includeSubDomains
surrogate-key: sFbt=https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
last-modified: Wed, 02 Dec 2020 19:00:00 GMT
server: nginx/1.15.8
date: Wed, 02 Dec 2020 19:35:35 GMT
content-type: application/json
access-control-allow-origin: https://www.bleepingcomputer.com
cache-control: no-transform, max-age=0, s-maxage=14400
access-control-allow-credentials: true
content-length: 2

GET
H2 200 info.json Show response
www.reddit.com/api/ 126 B
589 B 251ms
141ms Script
application/javascript 199.232.53.140
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reddit.com/api/info.json?url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fmicrosoft%2Fmalicious-npm-packages-used-to-install-njrat-remote-access-trojan%2F&jsonp=_ate.cbs.rcb_f9zx0

Requested by

Host: s9.addthis.com
URL: https://s9.addthis.com/js/300/addthis_widget.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

199.232.53.140 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

snooserv /

Resource Hash

e97655ed2169f38db0e567f479c47aeb807dda97e4a559ecaaf4cb557df59fc8

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 19:35:35 GMT
via: 1.1 varnish
x-content-type-options: nosniff
content-length: 126
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge
x-moose: majestic
server: snooserv
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-expose-headers: X-Moose
cache-control: private, s-maxage=0, max-age=0, must-revalidate, no-store, max-age=0, must-revalidate
accept-ranges: bytes
expires: -1

GET
H2 200 info.json Show response
www.reddit.com/api/ 126 B
255 B 270ms
161ms Script
application/javascript 199.232.53.140
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reddit.com/api/info.json?url=http%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fmicrosoft%2Fmalicious-npm-packages-used-to-install-njrat-remote-access-trojan%2F&jsonp=_ate.cbs.rcb_axol0

Requested by

Host: s9.addthis.com
URL: https://s9.addthis.com/js/300/addthis_widget.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

199.232.53.140 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

snooserv /

Resource Hash

30ffd07e41684cc4f5cbe125509fb50754ac3665296ff0f744cd45d6c8cde128

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 19:35:36 GMT
via: 1.1 varnish
x-content-type-options: nosniff
content-length: 126
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge
x-moose: majestic
server: snooserv
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-expose-headers: X-Moose
cache-control: private, s-maxage=0, max-age=0, must-revalidate, no-store, max-age=0, must-revalidate
accept-ranges: bytes
expires: -1

GET
H2 200 vendor-list.json Show response
quantcast.mgr.consensu.org/GVL-v2/ 209 KB
28 KB 7ms
6ms XHR
application/json 2600:9000:2156:6400:9:46dc:4700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://quantcast.mgr.consensu.org/GVL-v2/vendor-list.json
Requested by: Host: quantcast.mgr.consensu.org
URL: https://quantcast.mgr.consensu.org/tcfv2/cmp2.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:6400:9:46dc:4700:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: a34049f26bcf68a56fe6e320de34eea2bf081c3d4b484448e1fcb99e85010a92

Request headers

Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 03:01:57 GMT
content-encoding: br
vary: Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
age: 59619
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
access-control-allow-origin: *
last-modified: Wed, 02 Dec 2020 03:01:54 GMT
server: AmazonS3
etag: W/"5851d37db89a9507647b0c85d0d08231"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/json
via: 1.1 1f49a084ca923f375f74b42fa36ef429.cloudfront.net (CloudFront)
cache-control: max-age=172800
access-control-allow-credentials: true
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: Jj2PF_fiRcD78Cuna_33hOJqsP-toKnjeYacFv2M5f924KtOqEKGuQ==

GET
H2 200 cmp2ui-en.js Show response
quantcast.mgr.consensu.org/tcfv2/22/ 468 KB
123 KB 8ms
7ms Script
text/javascript 2600:9000:2156:6400:9:46dc:4700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://quantcast.mgr.consensu.org/tcfv2/22/cmp2ui-en.js
Requested by: Host: quantcast.mgr.consensu.org
URL: https://quantcast.mgr.consensu.org/tcfv2/cmp2.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:6400:9:46dc:4700:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 56f6b77164fc8f08cd67aedae16d9650111a4a85c79390a59a7d35af969f2f5b

Request headers

Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 10:35:07 GMT
content-encoding: br
age: 32429
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
access-control-max-age: 86400
access-control-allow-origin: *
last-modified: Fri, 13 Nov 2020 00:48:50 GMT
server: AmazonS3
etag: "04ab5cd5c03a6ea5e81d2548b6ab8134"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: text/javascript;charset=UTF-8
via: 1.1 e6d97713eb9b65f883e0f86b833878dd.cloudfront.net (CloudFront)
cache-control: max-age=172800
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: WMti22qpuIHUwvSEQS-rL9pQ9z-xNNBacU9MYtnh5O3IlqvSUs5LVA==

GET
H2 200 / Show response
audit-tcfv2.quantcast.mgr.consensu.org/ 80 B
505 B 90ms
34ms XHR
text/html 13.224.194.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://audit-tcfv2.quantcast.mgr.consensu.org/?log=%7B%22accountId%22%3A%22sktb670LZWvFX%22%2C%22domain%22%3A%22www.bleepingcomputer.com%22%2C%22publisher%22%3A%22BleepingComputer%22%2C%22cmpId%22%3A10%2C%22cmpVersion%22%3A%222.22%22%2C%22displayType%22%3A%22tcfui%3Amandatory%22%2C%22configurationHashCode%22%3A%22XIRO8UgbdjjNHwyt8oPDZg%22%2C%22clientTimestamp%22%3A1606937735883%2C%22operationType%22%3A%22init%22%2C%22sessionId%22%3A%22GDPR-nn1hgn46cl8lyi8dxlmu%22%7D
Requested by: Host: quantcast.mgr.consensu.org
URL: https://quantcast.mgr.consensu.org/tcfv2/22/cmp2ui-en.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.194.60 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-194-60.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2d0f6b590917e7d27ddeb026b280d62dde9d03bb92f47f56342fc5f68f0c24eb

Request headers

Accept: application/json, text/plain, */*
Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 01 Dec 2020 22:36:45 GMT
via: 1.1 1d67a4c00b06651cb6daa95ec3f21f9b.cloudfront.net (CloudFront)
age: 75531
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
access-control-max-age: 3000
content-length: 80
last-modified: Tue, 26 Nov 2019 14:21:44 GMT
server: AmazonS3
etag: "0614149d8033903db5de46d6c184bbfd"
vary: Origin
access-control-allow-methods: GET
content-type: text/html
access-control-allow-origin: *
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
x-amz-cf-id: nCD73ZO7oSkfVOW-8f49o-kChyq2w1N3oQzwhlF4CN8oFqfc_cu2zQ==

GET
H2 200 bleeping-computerlogo-lg.png
www.bleepstatic.com/logos/ 7 KB
7 KB 31ms
30ms Image
image/webp 172.67.75.139
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bleepstatic.com/logos/bleeping-computerlogo-lg.png
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.75.139 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 57292d9d8c895f526c9f7cdae30de7ee3bad46137b432711a1c1fb19a3061cab

Request headers

Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 19:35:36 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 630454
cf-polished: origFmt=png, origSize=15281
content-disposition: inline; filename="bleeping-computerlogo-lg.webp"
content-length: 6986
cf-request-id: 06c68d0b4800001e6199a91000000001
last-modified: Wed, 07 Jan 2015 22:52:15 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=WjWvE6jLABVGfudejyy9BrfFtQPHRAe%2FUkHN08lGj7ubsInlZnSGx2xopl3mpb0sJOojNL%2FCJaNyDX604ieUI%2F4YUhhTGey7It78801dCEovj7UR"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
expires: Fri, 25 Dec 2020 12:28:02 GMT
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 5fb77df20dae1e61-MUC
cf-bgj: imgq:85,h2pri

POST
H/1.1 200
OK sr Show response
capi.connatix.com/tr/ Frame F854 0
333 B 515ms
135ms XHR
multipart/form-data 3.129.41.174
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/sr?v=81038
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.129.41.174 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-129-41-174.us-east-2.compute.amazonaws.com
Software: openresty/1.15.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Wed, 02 Dec 2020 19:35:36 GMT
Content-Encoding: gzip
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://www.bleepingcomputer.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20

GET
H2 200 d5d6733d-ea12-4fd0-9f90-d10ca74fef92.bin Show response
vid.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/ Frame F854 2 KB
1 KB 66ms
20ms XHR
application/octet-stream 151.101.194.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/d5d6733d-ea12-4fd0-9f90-d10ca74fef92.bin
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 9579313a2a4f9321d77abdf80da1e868825cb76aa05ec69acf31f8659217e100

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 19:35:36 GMT
content-encoding: gzip
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
age: 5923
x-cache: HIT, HIT
content-length: 813
x-served-by: cache-bwi5134-BWI, cache-hhn4023-HHN
last-modified: Wed, 02 Dec 2020 17:55:12 GMT
x-timer: S1606937736.365881,VS0,VE1
etag: "76b713211f56ab34110876bd69092d39"
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=31557600
accept-ranges: bytes
x-cache-hits: 2, 1

GET
H2 200 1.png
img.connatix.com/067e5169-ece3-4ce8-87ad-c7961b8bb396/ 10 KB
10 KB 34ms
12ms Image
image/png 2600:9000:2156:a400:12:238e:df80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.connatix.com/067e5169-ece3-4ce8-87ad-c7961b8bb396/1.png
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:a400:12:238e:df80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 956035a88a8424f2d36b292231cd4cd7ed705d412b47a7aa929f7b537196c1cb

Request headers

Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 18 Nov 2020 10:27:12 GMT
via: 1.1 varnish, 1.1 varnish, 1.1 f6c241b75ae7d21ac836339454ab90b8.cloudfront.net (CloudFront)
age: 20046648
x-cache: Hit from cloudfront
fastly-io-info: ifsz=11996 idim=794x206 ifmt=png ofsz=9784 odim=794x206 ofmt=png
fastly-stats: io=1
content-length: 9784
x-served-by: cache-dca17783-DCA, cache-fra19153-FRA
x-timer: S1605695233.806462,VS0,VE0
etag: "o7hSHwAUmCBIixIgiGzuW02nJNU8oGEvPnjWp++AQj4"
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31557600
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
x-amz-cf-id: qZ_P9vBM3kB-mTv8mBc3VOemPG3orZiFY5LEzdpbZQvgTH_kB6j8Yw==
x-cache-hits: 2, 56

POST
H/1.1 200
OK ao Show response
capi.connatix.com/tr/ Frame F854 0
333 B 511ms
131ms XHR
multipart/form-data 3.129.41.174
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/ao?v=81038
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.129.41.174 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-129-41-174.us-east-2.compute.amazonaws.com
Software: openresty/1.15.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Wed, 02 Dec 2020 19:35:36 GMT
Content-Encoding: gzip
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://www.bleepingcomputer.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20

POST
H/1.1 200
OK ps Show response
capi.connatix.com/tr/ Frame F854 0
333 B 538ms
132ms XHR
multipart/form-data 3.129.41.174
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/ps?v=81038
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.129.41.174 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-129-41-174.us-east-2.compute.amazonaws.com
Software: openresty/1.15.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Wed, 02 Dec 2020 19:35:36 GMT
Content-Encoding: gzip
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://www.bleepingcomputer.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20

POST
H/1.1 200
OK mq Show response
capi.connatix.com/tr/ Frame F854 0
333 B 544ms
135ms XHR
multipart/form-data 3.129.41.174
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/mq?v=81038
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.129.41.174 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-129-41-174.us-east-2.compute.amazonaws.com
Software: openresty/1.15.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Wed, 02 Dec 2020 19:35:36 GMT
Content-Encoding: gzip
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://www.bleepingcomputer.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20

GET
H2 200 514171 Show response
vid.springserve.com/vast/ Frame F854 2 KB
2 KB 160ms
49ms XHR
application/xml 34.252.182.145
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.springserve.com/vast/514171?w=640&h=480&cb=&url=bleepingcomputer.com/&schain=
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.252.182.145 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-252-182-145.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: c2fe3ed40087fbfa908ded830117036325348b84a897fc7a5f46283acef843f0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin: https://www.bleepingcomputer.com
date: Wed, 02 Dec 2020 19:35:36 GMT
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
server: nginx
content-encoding: gzip
content-type: application/xml;charset=UTF-8

GET
H2 200 1ed9037f-67cf-4b28-b80b-d1865185fe03.jpg
img.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/ 27 KB
27 KB 21ms
20ms Image
image/jpeg 2600:9000:2156:a400:12:238e:df80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/1ed9037f-67cf-4b28-b80b-d1865185fe03.jpg?crop=834:469,smart&width=834&height=469&format=jpeg&quality=60&fit=crop
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:a400:12:238e:df80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 573d162cdafc05e2e5f3574348acb893969cc84c08b9f64d0814d863631804ae

Request headers

Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 17:57:14 GMT
content-encoding: gzip
age: 6028
x-cache: Hit from cloudfront
fastly-io-info: ifsz=187614 idim=1600x800 ifmt=jpeg ofsz=27881 odim=834x469 ofmt=jpeg
fastly-stats: io=1
content-length: 27163
x-served-by: cache-dca17720-DCA, cache-fra19169-FRA
access-control-allow-origin: *
x-timer: S1606931834.288197,VS0,VE94
etag: "sNla3sAK7/NLibWqJWMu6Dr46dEofqfkbNq1ln665uY"
content-type: image/jpeg
via: 1.1 varnish, 1.1 varnish, 1.1 f6c241b75ae7d21ac836339454ab90b8.cloudfront.net (CloudFront)
cache-control: max-age=31557600
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
x-amz-cf-id: 9cstiBTEypuQVP2cfUBo1amUUa6aq06sCU2Oi8YtvMNDz6_8VvYeAA==
x-cache-hits: 1, 0

GET
H2 200 5afb5a69-f3ad-46af-b6bd-45dd7a1f5091.jpg
img.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/ 23 KB
23 KB 57ms
55ms Image
image/jpeg 2600:9000:2156:a400:12:238e:df80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/5afb5a69-f3ad-46af-b6bd-45dd7a1f5091.jpg?crop=834:469,smart&width=834&height=469&format=jpeg&quality=60&fit=crop
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:a400:12:238e:df80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 10c1ad7d012fad2fb5e3bf51e3486e91f39075370590ae2254dbfb3bf6ff751b

Request headers

Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 17:57:14 GMT
content-encoding: gzip
age: 6026
x-cache: Hit from cloudfront
fastly-io-info: ifsz=196266 idim=1600x800 ifmt=jpeg ofsz=23512 odim=834x469 ofmt=jpeg
fastly-stats: io=1
content-length: 23085
x-served-by: cache-dca17741-DCA, cache-fra19183-FRA
access-control-allow-origin: *
x-timer: S1606931834.285997,VS0,VE91
etag: "I1vqIv1R5GnonEoDNi4A7N6dcYe4+fgNbXPNT8NJXjQ"
content-type: image/jpeg
via: 1.1 varnish, 1.1 varnish, 1.1 f6c241b75ae7d21ac836339454ab90b8.cloudfront.net (CloudFront)
cache-control: max-age=31557600
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
x-amz-cf-id: 6mKq2A_-uq0vak2Kx1ErBiP6ZuspusWKumGylaEIxRwFl8N085CwMQ==
x-cache-hits: 1, 0

GET
H2 200 90bc49e7-0776-474a-8c7c-5f7a7b70d7a1.jpg
img.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/ 46 KB
45 KB 18ms
17ms Image
image/jpeg 2600:9000:2156:a400:12:238e:df80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/90bc49e7-0776-474a-8c7c-5f7a7b70d7a1.jpg?crop=834:469,smart&width=834&height=469&format=jpeg&quality=60&fit=crop
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:a400:12:238e:df80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: f8e471ebfa965e657a9974ffdd4ba95468534fe2987bc4b7c197744db53a1548

Request headers

Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 17:57:14 GMT
content-encoding: gzip
age: 6027
x-cache: Hit from cloudfront
fastly-io-info: ifsz=169777 idim=1600x800 ifmt=jpeg ofsz=47090 odim=834x469 ofmt=jpeg
fastly-stats: io=1
content-length: 45605
x-served-by: cache-dca17773-DCA, cache-fra19124-FRA
access-control-allow-origin: *
x-timer: S1606931834.288800,VS0,VE95
etag: "bMx1XN9i8QYomzd+fvNEAOAhCOKBnyp8V1dmctTEvSE"
content-type: image/jpeg
via: 1.1 varnish, 1.1 varnish, 1.1 f6c241b75ae7d21ac836339454ab90b8.cloudfront.net (CloudFront)
cache-control: max-age=31557600
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
x-amz-cf-id: eGisaeHUwppyEcke6-9HltYBiLGOBZ9Fbg55le4fM10-JAZoBsNTKQ==
x-cache-hits: 1, 0

GET
H2 200 b98e9d5b-ceb3-43af-b0da-c7a166cd7f74.jpg
img.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/ 47 KB
47 KB 13ms
12ms Image
image/jpeg 2600:9000:2156:a400:12:238e:df80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/b98e9d5b-ceb3-43af-b0da-c7a166cd7f74.jpg?crop=834:469,smart&width=834&height=469&format=jpeg&quality=60&fit=crop
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:a400:12:238e:df80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 2ad00d1f8dae0d5dba17c5a0beb7c24695e87791e63c792200d0a2d381ace3db

Request headers

Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 17:57:14 GMT
content-encoding: gzip
age: 6028
x-cache: Hit from cloudfront
fastly-io-info: ifsz=168667 idim=1400x700 ifmt=jpeg ofsz=48202 odim=834x469 ofmt=jpeg
fastly-stats: io=1
content-length: 47136
x-served-by: cache-dca17747-DCA, cache-fra19174-FRA
access-control-allow-origin: *
x-timer: S1606931834.283559,VS0,VE93
etag: "bA0DkxRbl4xv9DfJAkMoU7LbhBzJyEPfdPzi7jJBp+4"
content-type: image/jpeg
via: 1.1 varnish, 1.1 varnish, 1.1 f6c241b75ae7d21ac836339454ab90b8.cloudfront.net (CloudFront)
cache-control: max-age=31557600
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
x-amz-cf-id: tvfESVXupEhb6oRmnpwFXZufuGmPbr32_tmU2sIFmb1CBVulW3tnfQ==
x-cache-hits: 1, 0

GET
H2 200 a114b8a5-8ded-4987-8539-551a38d0cf77.jpg
img.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/ 23 KB
23 KB 11ms
11ms Image
image/jpeg 2600:9000:2156:a400:12:238e:df80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/a114b8a5-8ded-4987-8539-551a38d0cf77.jpg?crop=834:469,smart&width=834&height=469&format=jpeg&quality=60&fit=crop
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:a400:12:238e:df80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 0c359897cdcff4ac88fd6fe4b9b651bceae067ec0284f3b408104d47ced6634e

Request headers

Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 17:57:14 GMT
content-encoding: gzip
age: 6028
x-cache: Hit from cloudfront
fastly-io-info: ifsz=123083 idim=1600x800 ifmt=jpeg ofsz=23189 odim=834x469 ofmt=jpeg
fastly-stats: io=1
content-length: 22553
x-served-by: cache-dca17738-DCA, cache-fra19136-FRA
access-control-allow-origin: *
x-timer: S1606931834.287839,VS0,VE91
etag: "YSyCohVh65BOY3L+4xonjDfgLGf4Sqj765O2pbe67G8"
content-type: image/jpeg
via: 1.1 varnish, 1.1 varnish, 1.1 f6c241b75ae7d21ac836339454ab90b8.cloudfront.net (CloudFront)
cache-control: max-age=31557600
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
x-amz-cf-id: 0hZnoM_HtKZCRMq9rXlVx9JO6S4euAWUguOgIkhSFXgt2V44mKm8oQ==
x-cache-hits: 1, 0

POST
H/1.1 200
OK g Show response
capi.connatix.com/rtb/ Frame F854 404 B
597 B 677ms
320ms XHR
multipart/form-data 3.129.41.174
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/rtb/g?v=81038
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.129.41.174 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-129-41-174.us-east-2.compute.amazonaws.com
Software: openresty/1.15.8.2 /
Resource Hash: 0aab691822975cdad16b3efe1b7fa755ada60d1df923d06aa5b7ff8905781cdc

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Wed, 02 Dec 2020 19:35:37 GMT
Content-Encoding: gzip
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://www.bleepingcomputer.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 283

GET
H2 200 ima3.js Show response
imasdk.googleapis.com/js/sdkloader/ Frame F854 316 KB
109 KB 33ms
14ms Script
text/javascript 2a00:1450:4001:819::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/sdkloader/ima3.js

Requested by

Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cd42b0a8ba5c3c70f92708a2dcb18f76b0385b2cf63293e3d479d8ce2bc32d1a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 19:35:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 111284
x-xss-protection: 0
expires: Wed, 02 Dec 2020 19:35:37 GMT

GET
H3-Q050 200 bridge3.427.1_en.html
imasdk.googleapis.com/js/core/ Frame 2EAC 0
0 34ms
21ms Document
text/html 2a00:1450:4001:819::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/core/bridge3.427.1_en.html

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:819::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: imasdk.googleapis.com
:scheme: https
:path: /js/core/bridge3.427.1_en.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
content-length: 191898
date: Tue, 01 Dec 2020 22:37:30 GMT
expires: Wed, 01 Dec 2021 22:37:30 GMT
last-modified: Tue, 01 Dec 2020 19:16:08 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 75487
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 client.js Show response
s0.2mdn.net/instream/video/ Frame F854 26 KB
11 KB 63ms
42ms Script
text/javascript 2a00:1450:4001:81f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/instream/video/client.js

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

62f2eeec7851ae0d5e322062cf40092478236d4a4fc5a2cfd87b257739104147

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 19:35:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10523
x-xss-protection: 0
expires: Wed, 02 Dec 2020 19:35:37 GMT

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ Frame F854 109 B
317 B 16ms
15ms Script
application/javascript 2a00:1450:4001:821::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:821::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 02 Dec 2020 19:35:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0

GET
H2 200 vpaid_e414d106.js Show response
vpaid.springserve.com/production/ Frame 4885 470 KB
97 KB 145ms
122ms Script
application/javascript 2001:4de0:ac18::1:a:3a
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://vpaid.springserve.com/production/vpaid_e414d106.js
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac18::1:a:3a , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 544a19756d3214e2a45752031bae208c91d6c79a9b92e8f2a5a0494d842dddbb

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 19:35:38 GMT
content-encoding: gzip
last-modified: Mon, 30 Nov 2020 13:47:47 GMT
server: AmazonS3
x-amz-request-id: 0PBVFS4K4TAJ4WFY
etag: "e5660ec7e21f9f1b36d7ef65c930ce0a"
x-hw: 1606937738.dop228.fr8.t,1606937738.cds287.fr8.hn,1606937738.cds006.fr8.c
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=2436401
accept-ranges: bytes
content-length: 98980
x-amz-id-2: V0MHJKNgoBvkGvAPSPtDdhipv33QATpE6k/DuAx/D1v47YO3P4IUdDc/Mn673x/n4AFhp+otFdk=

GET
H2 200 ima3vpaid Show response
tpc.googlesyndication.com/ Frame 4885 940 B
1 KB 35ms
15ms XHR
text/xml 2a00:1450:4001:820::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/ima3vpaid?vad_format=linear&correlator=1606937736598&adtagurl=https%3A%2F%2Fpubads.g.doubleclick.net%2Fgampad%2Fads%3Fiu%3D%2F21769024953%2FBleeping_Computer_SpringServe%26description_url%3Dhttps%253A%252F%252Fwww.bleepingcomputer.com%252F%26tfcd%3D0%26npa%3D0%26sz%3D400x300%257C640x480%26max_ad_duration%3D30000%26gdfp_req%3D1%26output%3Dvast%26unviewed_position_start%3D1%26env%3Dvp%26vpos%3Dpreroll%26vpmute%3D1%26vpa%3Dauto%26type%3Djs%26vad_type%3Dlinear&ord=1606937736598

Requested by

Host: vpaid.springserve.com
URL: https://vpaid.springserve.com/production/vpaid_e414d106.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

173aa38287b7a86e4f13d257674ec01bc9f1336cad727eb771bb7fbbabea4c9e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 02 Dec 2020 19:35:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: https://www.bleepingcomputer.com
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
content-type: text/xml; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 585
x-xss-protection: 0

POST
H2 200 24 Show response
web.hb.ad.cpe.dotomi.com/s2s/header/ Frame 4885 150 B
341 B 43ms
13ms XHR
application/json 2a02:fa8:8806:13::1460
VCLK-EU-

General

Check archive.org

Show headers Download Go to

Full URL: https://web.hb.ad.cpe.dotomi.com/s2s/header/24
Requested by: Host: vpaid.springserve.com
URL: https://vpaid.springserve.com/production/vpaid_e414d106.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a02:fa8:8806:13::1460 , Sweden, ASN41041 (VCLK-EU-, SE),
Reverse DNS
Software: nginx /
Resource Hash: 702168254d51a8cd49fa27402da6efeb2bc5b36a23ad1936b702428ddbe11882

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 02 Dec 2020 19:35:38 GMT
server: nginx
content-type: application/json
access-control-allow-origin: https://www.bleepingcomputer.com
cache-control: no-cache
access-control-allow-credentials: true
content-length: 150
expires: 0

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ Frame 4885 0
122 B 209ms
124ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: vpaid.springserve.com
URL: https://vpaid.springserve.com/production/vpaid_e414d106.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.bleepingcomputer.com
date: Wed, 02 Dec 2020 19:35:38 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

POST
H/1.1 204
No Content / Show response
hb.emxdgt.com/ Frame 4885 0
316 B 186ms
55ms XHR
text/html 18.196.104.43
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://hb.emxdgt.com/?t=&ts=1606937738336&src=pbjs
Requested by: Host: vpaid.springserve.com
URL: https://vpaid.springserve.com/production/vpaid_e414d106.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.196.104.43 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-196-104-43.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Date: Wed, 02 Dec 2020 19:35:37 GMT
Content-Type: text/html
Access-Control-Allow-Origin: https://www.bleepingcomputer.com
Cache-Control: no-cache
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
Access-Control-Allow-Headers: security, Content-Type
Content-Length: 0

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ Frame 4885 160 B
861 B 162ms
78ms XHR
application/json 185.33.220.242
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: vpaid.springserve.com
URL: https://vpaid.springserve.com/production/vpaid_e414d106.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.242 , Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

724.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

d23400cca13c9c51ecea0f82e43e2290c80007360337125a8ab6528860cc9c27

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Wed, 02 Dec 2020 19:35:38 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 724.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.54:80
AN-X-Request-Uuid: a216abaf-727c-4a02-9cd3-efab8caed9b8
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.bleepingcomputer.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 160
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 200
OK sv Show response
capi.connatix.com/tr/ Frame F854 0
333 B 142ms
142ms XHR
multipart/form-data 3.129.41.174
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/sv?v=81038
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.129.41.174 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-129-41-174.us-east-2.compute.amazonaws.com
Software: openresty/1.15.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Wed, 02 Dec 2020 19:35:38 GMT
Content-Encoding: gzip
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://www.bleepingcomputer.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20

GET
H3-Q050 200 vpaid_adapter.js Show response
imasdk.googleapis.com/js/sdkloader/ Frame CDAB 42 KB
15 KB 26ms
26ms Script
text/javascript 2a00:1450:4001:819::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/sdkloader/vpaid_adapter.js?adtagurl=https://pubads.g.doubleclick.net/gampad/ads%3Fiu%3D/21769024953/Bleeping_Computer_SpringServe%26description_url%3Dhttps%253A%252F%252Fwww.bleepingcomputer.com%252F%26tfcd%3D0%26npa%3D0%26sz%3D400x300%257C640x480%26max_ad_duration%3D30000%26gdfp_req%3D1%26output%3Dvast%26unviewed_position_start%3D1%26env%3Dvp%26vpos%3Dpreroll%26vpmute%3D1%26vpa%3Dauto%26type%3Djs%26vad_type%3Dlinear%26channel%3Dvastadp&correlator=1606937736598

Requested by

Host: blank
URL: about:blank

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:819::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1ecc779307e00e971bdb2921d9768c2616483b81f071177492f6c96fa6609dc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 19:35:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 02 Dec 2020 16:16:27 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=900
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15443
x-xss-protection: 0
expires: Wed, 02 Dec 2020 19:50:38 GMT

GET
H3-Q050 200 ima3.js Show response
imasdk.googleapis.com/js/sdkloader/ Frame CDAB 316 KB
109 KB 15ms
15ms Script
text/javascript 2a00:1450:4001:819::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/sdkloader/ima3.js

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/vpaid_adapter.js?adtagurl=https://pubads.g.doubleclick.net/gampad/ads%3Fiu%3D/21769024953/Bleeping_Computer_SpringServe%26description_url%3Dhttps%253A%252F%252Fwww.bleepingcomputer.com%252F%26tfcd%3D0%26npa%3D0%26sz%3D400x300%257C640x480%26max_ad_duration%3D30000%26gdfp_req%3D1%26output%3Dvast%26unviewed_position_start%3D1%26env%3Dvp%26vpos%3Dpreroll%26vpmute%3D1%26vpa%3Dauto%26type%3Djs%26vad_type%3Dlinear%26channel%3Dvastadp&correlator=1606937736598

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:819::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cd42b0a8ba5c3c70f92708a2dcb18f76b0385b2cf63293e3d479d8ce2bc32d1a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 19:35:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 111284
x-xss-protection: 0
expires: Wed, 02 Dec 2020 19:35:38 GMT

POST
H3-Q050 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame CDAB 0
56 B 17ms
17ms Other
image/gif 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=vpaid_adapter_js&event=init-dv3&vps=0.6168310554418719&wt=1606937738414&sdkv=h.3.427.1&xai=undefined&url=2,https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fmicrosoft%2Fmalicious-npm-packages-used-to-install-njrat-remote-access-trojan%2F$0

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Wed, 02 Dec 2020 19:35:38 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 bridge3.427.1_en.html
imasdk.googleapis.com/js/core/ Frame 902F 0
0 7ms
7ms Document
text/html 2a00:1450:4001:819::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/core/bridge3.427.1_en.html

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:819::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: imasdk.googleapis.com
:scheme: https
:path: /js/core/bridge3.427.1_en.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
content-length: 191898
date: Tue, 01 Dec 2020 22:37:30 GMT
expires: Wed, 01 Dec 2021 22:37:30 GMT
last-modified: Tue, 01 Dec 2020 19:16:08 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 75488
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 client.js Show response
s0.2mdn.net/instream/video/ Frame CDAB 26 KB
11 KB 70ms
55ms Script
text/javascript 2a00:1450:4001:81f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/instream/video/client.js

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

62f2eeec7851ae0d5e322062cf40092478236d4a4fc5a2cfd87b257739104147

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Dec 2020 19:35:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10523
x-xss-protection: 0
expires: Wed, 02 Dec 2020 19:35:38 GMT

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ Frame CDAB 109 B
169 B 19ms
19ms Script
application/javascript 2a00:1450:4001:821::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:821::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 02 Dec 2020 19:35:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0

POST
H2 200 i Show response
vid-io-dub.springserve.com/vd/ Frame 4885 0
123 B 182ms
62ms XHR
text/plain 34.248.116.70
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://vid-io-dub.springserve.com/vd/i?suuid=a6340ea2&ps_id=514171&batch=1
Requested by: Host: vpaid.springserve.com
URL: https://vpaid.springserve.com/production/vpaid_e414d106.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.248.116.70 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-248-116-70.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.bleepingcomputer.com
date: Wed, 02 Dec 2020 19:35:39 GMT
access-control-allow-credentials: true
server: nginx
content-length: 0

GET
H2 200 bridge3.427.1_en.html
imasdk.googleapis.com/js/core/ Frame 29A9 0
0 6ms
6ms Document
text/html 2a00:1450:4001:819::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/core/bridge3.427.1_en.html

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: imasdk.googleapis.com
:scheme: https
:path: /js/core/bridge3.427.1_en.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
content-length: 191898
date: Tue, 01 Dec 2020 22:37:30 GMT
expires: Wed, 01 Dec 2021 22:37:30 GMT
last-modified: Tue, 01 Dec 2020 19:16:08 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 75489
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 204 csi
csi.gstatic.com/ Frame F854 0
54 B 317ms
138ms Other
image/gif 2607:f8b0:4003:c0b::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=1~ki7t8ljc&c=749101984472&slotId=374550992236&eee=missing-element&bi=missing-id
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4003:c0b::5e , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Wed, 02 Dec 2020 19:35:40 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

206
Partial Content

videoplayback
r12---sn-4g5ednzz.googlevideo.com/
Redirect Chain

https://r2---sn-aigl6ned.googlevideo.com/videoplayback?expire=1606966540&ei=jOzHX_KKEYLTxgLD4L2ADg&ip=89.249.64.203&id=4e42e19bfc59eb83&itag=22&source=youtube&requiressl=yes&mh=d6&mm=31&mn=sn-aigl6...
https://r2---sn-4g5e6nzs.googlevideo.com/videoplayback?expire=1606966540&ei=jOzHX_KKEYLTxgLD4L2ADg&ip=89.249.64.203&id=4e42e19bfc59eb83&itag=22&source=youtube&requiressl=yes&susc=gvp&acao=yes&ctier...
https://r12---sn-4g5ednzz.googlevideo.com/videoplayback?expire=1606966540&ei=jOzHX_KKEYLTxgLD4L2ADg&ip=89.249.64.203&id=4e42e19bfc59eb83&itag=22&source=youtube&requiressl=yes&susc=gvp&acao=yes&ctie...

5 MB
5 MB

23ms
8ms

Media
video/mp4

2a00:1450:4001:9::c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://r12---sn-4g5ednzz.googlevideo.com/videoplayback?expire=1606966540&ei=jOzHX_KKEYLTxgLD4L2ADg&ip=89.249.64.203&id=4e42e19bfc59eb83&itag=22&source=youtube&requiressl=yes&susc=gvp&acao=yes&ctier=L&mime=video/mp4&dur=15.069&lmt=1606047213357244&txp=5432434&sparams=expire,ei,ip,id,itag,source,requiressl,susc,acao,ctier,mime,dur,lmt&sig=AOq0QJ8wRAIgL9ItdiiErYL3wAfEKDYTo21tUi-6EJu8GR58Sloc49MCIEZvYmlTXrW_jhZpTzL03kryg64HuMfNQOhwQY3FGC8l&cpn=WaspDekUaL9-GmgG&rm=sn-aiges77l,sn-4g5ede7l&fexp=9420244,23812955,23951038&req_id=6c9d434a73de36e2&ipbypass=yes&redirect_counter=2&he=yes&cms_redirect=yes&mh=d6&mip=2a01:4f8:121:131a::2&mm=43&mn=sn-4g5ednzz&ms=onl&mt=1606937526&mv=m&mvi=12&pl=40&lsparams=ipbypass,mh,mip,mm,mn,ms,mv,mvi,pl&lsig=AG3C_xAwRAIgVXLS339F6vKd0z00T40QlsgzM1RCReSAcJfrMM3QSWsCIDsMRfF1OvOfEu_ck1o35CMTSRQT11WjuTlFPqMfghz0

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:9::c Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gvs 1.0 /

Resource Hash

128238629d44d64ca040a325f3adc26affe4bd45c1be22ae1d26cb151873d595

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 02 Dec 2020 19:35:40 GMT
X-Content-Type-Options: nosniff
Last-Modified: Sun, 22 Nov 2020 12:13:33 GMT
Server: gvs 1.0
Vary: Origin
Content-Type: video/mp4
Content-Range: bytes 0-4870635/4870636
Cache-Control: private, max-age=28500
Cross-Origin-Resource-Policy: cross-origin
Connection: close
Accept-Ranges: bytes
Alt-Svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
Content-Length: 4870636
Expires: Wed, 02 Dec 2020 19:35:40 GMT

Redirect headers

Date: Wed, 02 Dec 2020 19:35:40 GMT
X-Content-Type-Options: nosniff
Last-Modified: Wed, 02 May 2007 10:26:10 GMT
Server: gvs 1.0
Vary: Origin
Content-Type: text/html
Location: https://r12---sn-4g5ednzz.googlevideo.com/videoplayback?expire=1606966540&ei=jOzHX_KKEYLTxgLD4L2ADg&ip=89.249.64.203&id=4e42e19bfc59eb83&itag=22&source=youtube&requiressl=yes&susc=gvp&acao=yes&ctier=L&mime=video/mp4&dur=15.069&lmt=1606047213357244&txp=5432434&sparams=expire,ei,ip,id,itag,source,requiressl,susc,acao,ctier,mime,dur,lmt&sig=AOq0QJ8wRAIgL9ItdiiErYL3wAfEKDYTo21tUi-6EJu8GR58Sloc49MCIEZvYmlTXrW_jhZpTzL03kryg64HuMfNQOhwQY3FGC8l&cpn=WaspDekUaL9-GmgG&rm=sn-aiges77l,sn-4g5ede7l&fexp=9420244,23812955,23951038&req_id=6c9d434a73de36e2&ipbypass=yes&redirect_counter=2&he=yes&cms_redirect=yes&mh=d6&mip=2a01:4f8:121:131a::2&mm=43&mn=sn-4g5ednzz&ms=onl&mt=1606937526&mv=m&mvi=12&pl=40&lsparams=ipbypass,mh,mip,mm,mn,ms,mv,mvi,pl&lsig=AG3C_xAwRAIgVXLS339F6vKd0z00T40QlsgzM1RCReSAcJfrMM3QSWsCIDsMRfF1OvOfEu_ck1o35CMTSRQT11WjuTlFPqMfghz0
Cache-Control: private, max-age=900
Cross-Origin-Resource-Policy: cross-origin
Connection: close
Content-Length: 0
Expires: Wed, 02 Dec 2020 19:35:40 GMT

POST
H/1.1 200
OK ai Show response
capi.connatix.com/tr/ Frame F854 0
333 B 146ms
146ms XHR
multipart/form-data 3.129.41.174
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/ai?v=81038
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.129.41.174 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-129-41-174.us-east-2.compute.amazonaws.com
Software: openresty/1.15.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Wed, 02 Dec 2020 19:35:40 GMT
Content-Encoding: gzip
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://www.bleepingcomputer.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20

POST
H/1.1 200
OK abt Show response
capi.connatix.com/tr/ Frame F854 0
333 B 136ms
135ms XHR
multipart/form-data 3.129.41.174
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/abt?v=81038
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.129.41.174 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-129-41-174.us-east-2.compute.amazonaws.com
Software: openresty/1.15.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Wed, 02 Dec 2020 19:35:41 GMT
Content-Encoding: gzip
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://www.bleepingcomputer.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20

POST
H/1.1 200
OK av Show response
capi.connatix.com/tr/ Frame F854 0
333 B 147ms
146ms XHR
multipart/form-data 3.129.41.174
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/av?v=81038
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.129.41.174 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-129-41-174.us-east-2.compute.amazonaws.com
Software: openresty/1.15.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Wed, 02 Dec 2020 19:35:42 GMT
Content-Encoding: gzip
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://www.bleepingcomputer.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20

POST
H/1.1 200
OK st Show response
capi.connatix.com/tr/ Frame F854 0
333 B 124ms
123ms XHR
multipart/form-data 3.129.41.174
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/st?v=81038
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.129.41.174 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-129-41-174.us-east-2.compute.amazonaws.com
Software: openresty/1.15.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Wed, 02 Dec 2020 19:35:43 GMT
Content-Encoding: gzip
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://www.bleepingcomputer.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20

POST
H/1.1 200
OK aq Show response
capi.connatix.com/tr/ Frame F854 0
333 B 141ms
140ms XHR
multipart/form-data 3.129.41.174
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/aq?v=81038
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.129.41.174 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-129-41-174.us-east-2.compute.amazonaws.com
Software: openresty/1.15.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Wed, 02 Dec 2020 19:35:44 GMT
Content-Encoding: gzip
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://www.bleepingcomputer.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20

POST
H/1.1 200
OK aq Show response
capi.connatix.com/tr/ Frame F854 0
333 B 124ms
124ms XHR
multipart/form-data 3.129.41.174
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/aq?v=81038
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.129.41.174 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-129-41-174.us-east-2.compute.amazonaws.com
Software: openresty/1.15.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Wed, 02 Dec 2020 19:35:48 GMT
Content-Encoding: gzip
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://www.bleepingcomputer.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: s7.addthis.com
URL: https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html

Verdicts & Comments Add Verdict or Comment

143 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

11 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.addthis.com/	1970-01-19 23:52:32	Name: loc Value: MDAwMDBFVURFQkUyMzI1MTkzNDAwNjAwMDBDSA==
.addthis.com/	1970-01-19 23:52:32	Name: uvc Value: 1%7C49
www.bleepingcomputer.com/	1970-01-19 14:22:19	Name: __atuvs Value: 5fc7ec877d5c26fd000
.bleepingcomputer.com/	1970-01-20 07:53:29	Name: _ga Value: GA1.2.372363179.1606937735
.bleepingcomputer.com/	1970-01-19 14:22:17	Name: _gat_gtag_UA_91740_1 Value: 1
www.bleepingcomputer.com/news/microsoft/malicious-npm-packages-used-to-install-njrat-remote-access-trojan	1969-12-31 23:59:59	Name: fsbotchecked Value: true
.bleepingcomputer.com/	1969-12-31 23:59:59	Name: session_id Value: 584871804bab1a2e2e99ff7e9ae06d65
.bleepingcomputer.com/	1970-01-19 14:23:44	Name: _gid Value: GA1.2.1190244487.1606937735
www.bleepingcomputer.com/	1970-01-19 15:05:29	Name: lav Value: 9702
www.bleepingcomputer.com/	1970-01-19 23:52:32	Name: __atuvc Value: 1%7C49
.bleepingcomputer.com/	1970-01-19 15:05:29	Name: __cfduid Value: d645db1cbe764e6269d951bc243c3046f1606937734

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.pub.network
ad.doubleclick.net
adservice.google.com
api-public.addthis.com
audit-tcfv2.quantcast.mgr.consensu.org
capi.connatix.com
cd.connatix.com
cdn.firstimpression.io
cds.connatix.com
cse.google.com
csi.gstatic.com
d.pub.network
ecdn.analysis.fi
ecdn.firstimpression.io
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
hb.emxdgt.com
hbopenbid.pubmatic.com
ib.adnxs.com
imasdk.googleapis.com
img.connatix.com
m.addthis.com
pagead2.googlesyndication.com
pixel.quantserve.com
quantcast.mgr.consensu.org
r12---sn-4g5ednzz.googlevideo.com
r2---sn-4g5e6nzs.googlevideo.com
r2---sn-aigl6ned.googlevideo.com
rules.quantcount.com
s0.2mdn.net
s7.addthis.com
s9.addthis.com
secure.quantserve.com
test.quantcast.mgr.consensu.org
tpc.googlesyndication.com
v1.addthisedge.com
vid-io-dub.springserve.com
vid.connatix.com
vid.springserve.com
vpaid.springserve.com
web.hb.ad.cpe.dotomi.com
widgets.outbrain.com
www.bleepingcomputer.com
www.bleepstatic.com
www.google-analytics.com
www.google.com
www.googletagmanager.com
www.reddit.com
z.moatads.com
s7.addthis.com
104.111.216.19
104.111.216.96
104.20.60.209
104.75.88.112
13.224.194.60
151.101.194.137
172.217.22.38
172.67.75.139
18.196.104.43
185.3.92.12
185.33.220.242
185.64.189.112
199.232.53.140
2001:4de0:ac18::1:a:3a
212.71.236.31
2600:9000:20eb:1600:6:44e3:f8c0:93a1
2600:9000:2156:6400:9:46dc:4700:93a1
2600:9000:2156:a400:12:238e:df80:93a1
2600:9000:2190:6800:3:a4cd:8380:93a1
2606:4700:20::ac43:443c
2607:f8b0:4003:c0b::5e
2620:116:800d:21:5a23:9c4e:e774:96c1
2a00:1450:4001:4c::7
2a00:1450:4001:801::2002
2a00:1450:4001:803::200a
2a00:1450:4001:809::2002
2a00:1450:4001:80b::200e
2a00:1450:4001:814::2003
2a00:1450:4001:817::2008
2a00:1450:4001:819::200a
2a00:1450:4001:81a::2004
2a00:1450:4001:81f::2006
2a00:1450:4001:81f::200e
2a00:1450:4001:820::2001
2a00:1450:4001:821::2002
2a00:1450:4001:824::200e
2a00:1450:4001:9::c
2a00:1450:4009:4e::7
2a02:fa8:8806:13::1460
3.129.41.174
34.248.116.70
34.252.182.145
35.188.71.214
46.51.197.9
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd
082674d615a4428081a2b3ffc2d0aac637a3b4e8e2d588a9459f6d523ec738cb
0aab691822975cdad16b3efe1b7fa755ada60d1df923d06aa5b7ff8905781cdc
0c359897cdcff4ac88fd6fe4b9b651bceae067ec0284f3b408104d47ced6634e
0d201b848d5c357264798bd1e0cd54a56f5bb684810efc80cc76c1b2eb03f403
0d9fd7ccabde9b202de45ee6b65878ce9594975d8e8810b0878d3f3fa3637d0e
0f427d0f88a0698c955ff63bf13af4ca80c9b32f218b5e210847450da901a74f
10c1ad7d012fad2fb5e3bf51e3486e91f39075370590ae2254dbfb3bf6ff751b
128238629d44d64ca040a325f3adc26affe4bd45c1be22ae1d26cb151873d595
173aa38287b7a86e4f13d257674ec01bc9f1336cad727eb771bb7fbbabea4c9e
199411f659f41aaccb959bacb1b0de30e54f244352a48c6f9894e65ae0f8a9a1
19db4a2cde712e2ceaac317e732b4ec40b62818a938a8bf8391ad68470845019
1e9322d90411989f7e09ef5ad4a3465d6cb97c77741d1030b254cd50d7c7ffe5
1ecc779307e00e971bdb2921d9768c2616483b81f071177492f6c96fa6609dc5
22e977346d45bab9f531ce1132d7ecfbe8e46868eaea790a0d4dcd1d0649d74b
25265b8bd25d4cb0afcfcafec0e8a5625a56152e59092116baf8d948fdbcb7f8
28d4e8c1043164607dcdeb358e2a08c9565fe286ceeeabea79e67f8c680187e7
2ad00d1f8dae0d5dba17c5a0beb7c24695e87791e63c792200d0a2d381ace3db
2c87952cc1c23627496c7874271042bdb6af21efdf7cbf36ec4d98e6cec34d04
2d0f6b590917e7d27ddeb026b280d62dde9d03bb92f47f56342fc5f68f0c24eb
2db8c339fed061bfa7e810ff84d1b5acda3363e2788abbf9fb6cef3f2387d1c5
30ffd07e41684cc4f5cbe125509fb50754ac3665296ff0f744cd45d6c8cde128
31cd7d9398307ca2e6cfaa111bbe7b69d69cbaaed2ff74034412ebc5008671fd
32e73e8e0eec3e6c1345d84e7ef091b90e71fb0045814043b34c914156235eb9
33eb81af8a0101c1ad2a210f322fb362ce1598e6e37f0a7ecc62d6ff39add590
36d9f0003be15d4a513ca82ffafaf509a402d488f5f2e306ec8e0306ea21dbb8
3dd301dcf6c48d81d85447fd14785c67ecf66ca799e063109dab178f51d0d2aa
3eacf72248f46c06ce6a19a756e71797c4b5302ac8f34d3d9662117b020105ba
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
4eeb4df3522892ea2ec61de6a58e870e8262019f8e3c759c099450cefb589313
540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441
544a19756d3214e2a45752031bae208c91d6c79a9b92e8f2a5a0494d842dddbb
555e47081a0d4e6e4e53f14fcf39c5de289bb641601738552d1dd74840c1beba
56f6b77164fc8f08cd67aedae16d9650111a4a85c79390a59a7d35af969f2f5b
57292d9d8c895f526c9f7cdae30de7ee3bad46137b432711a1c1fb19a3061cab
573d162cdafc05e2e5f3574348acb893969cc84c08b9f64d0814d863631804ae
5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479
6121ca306ad1045453d52517b8f436eb5a68055c82aefa46a9a77de36996a3df
62f2eeec7851ae0d5e322062cf40092478236d4a4fc5a2cfd87b257739104147
67d86a29de7993fbd23b7dde2c4f26bdc434055c35a4b08c830c0d02fcfa6dd2
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6d23d10111755a12c87198df1c71cce449de31eca9643030c6327a2157f9bd86
6e7304cbbeecfb8e3d98623654c9cfbad72cebf4271f4e7bc895c7bba539c4be
6e86593083facba2710a2312f26bd7b436d7ef299f99cbc2ccc1b32693ec3144
702168254d51a8cd49fa27402da6efeb2bc5b36a23ad1936b702428ddbe11882
7320e5365ede863b09d7604b3be1cabc240ccf7702c3dc83263727846b2da42f
7c42933014424dabb2256a0732a9f792559d26ba09a84308c278f52834522f9a
7d6d26827b887aa09b2a5eb7c001e35b93773e53c36ddbfc127ad824e0a6ba39
7ed5aa7b858e4bb494b8f71729baf404aa4d7fd4c0971d0e4a20f262feb016b5
827252be04765631f8ff21fee8ffe1028e27dfa52f62c08ef3182609a0a0e991
82c7fdbc4d001907e1e5d56cd335af3f0d48e0ffa7f0ad2aa3486ebb1123cb21
85ae9534729617e69eafa40195c7854697eb3d13b4205f3ee467e07c4af0a24b
8733e2183f16906b2fa2e58fdab82cf336f249ab71ac1b184470da2dd3c6e29f
87d73170be9a2e277c57d324c4e05ec0ac60ed3c0191fa29e7a31133b4c4c119
8c74196378cf2c91d1f38b58038cb90708f6afb708f971b94cd49bf8c59f541c
8cbb6ff9430a72c63e71843ba2aa571976624efc3ecb7bb2b31601c1193fd854
91079a7764463a894b0848a4c1860e3a66dbe6a0d28084809ccae8539d365ca0
92606bd38901e67d069f2ef883715b6e5ae07d72ae3bead3ad92346528374afc
942935ead42820e6c9184f099c77dde34fa4be70d395a17c47b5d7ad07967339
956035a88a8424f2d36b292231cd4cd7ed705d412b47a7aa929f7b537196c1cb
9579313a2a4f9321d77abdf80da1e868825cb76aa05ec69acf31f8659217e100
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a1af15b17fd7099b2d3a81a8b3aeffd94b26d2c1a58489c3903e11ec5a4896d3
a1b78cddcd44ccfb8a11daa2e7556481768b6003af2f2ef9440c6e16fa233aeb
a34049f26bcf68a56fe6e320de34eea2bf081c3d4b484448e1fcb99e85010a92
a5da2a52884707661811d1198d0a84617f086d074fe6c4ac66344a6f28d0a3f9
ab52a578c101a14bbc790f87f9a7400dda65469f23c6ce85c461e07cdf776460
acd2f7ad78edeebad4b6b0fdd17ff57d81c3726c60fd5435ee8c5a0115d29403
ad7386d16a056df5c235702a97a5fa4cee68e302d71041aa35df96151f756f48
b34676178982122b66b0a55d3ee411fa343b1d19a6c119c0c9b0ea2c892738a1
b7e4b21bbee9dbae4efabe383da4dd080026382b980585bd42d46dac2c8ae3e6
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bf64579b8e2f5e88e1e2d7f18c70280913781da7f6a3b3283260bb07984c52c6
bfc8e65089dc5421d56ecc71a0328eafd4feb2a602503ae5c15bfa3189c02f7e
c1bd0f4a8086eaaf6aff1ae5db3a58caa8f37a97503dbb0dbbe96c3ff86412f0
c2fe3ed40087fbfa908ded830117036325348b84a897fc7a5f46283acef843f0
ca22345f969dd8077c21281572a34d4a51bc6a5ad9d764bd1338b2c12a68c3e3
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
cd42b0a8ba5c3c70f92708a2dcb18f76b0385b2cf63293e3d479d8ce2bc32d1a
ce897833ac6e362df7c91ac8223fe511c6defcf33964928a81004600a2dd4c2e
d020fa6036628dd1d6dbf760edc742273359e93119832249bdce332d05d6db4d
d23400cca13c9c51ecea0f82e43e2290c80007360337125a8ab6528860cc9c27
d34199e64ca6bdadfe74bedaf438b875e17ae739fd9d9ff2b861cfcc402d68f6
d504524659927bac2d4fb08367d7e19fc7d88aa3f668915491f4470ab1303f8c
d60a01e86a6701bf5d527ff6b176b7b501fc2638b5582fe22be89dabf5133720
d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8
dd8a01673a596265022dad09fddb7edea13075b84a158fedae7775c3728430db
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e441c3e2771625ba05630ab464275136a82c99650ee2145ca5aa9853bedeb01b
e5e0f326458e8b8ed839d42a0cf6892df80bf26d7dc7e4f8276a65c41582ab85
e5f51209e23b5d8a4ba4370726b53a7bf8165c655fc3d9757cfa05ae33c7f270
e97655ed2169f38db0e567f479c47aeb807dda97e4a559ecaaf4cb557df59fc8
ea709729b980139033444c5b81a25ecd999d1d7fff87cda1803511886c8328ef
eb807ff4011748a050156ca84e739b9b53deea44a761637a75fc7edd12953449
ee7dddf6eca49bd63ce931405cfa0064d51b011a1a076a036d59555780250751
ee9b2fe75e3a5637b840957e2f9aefedb394224a1846a731ad7ead76abf91d58
ef3d32ea9a9fa05f8170d164890b55e15ce39157bb9ae7e96b047c1996d22a8b
f3d2f3c252cb69ecc65b35060f06d8f20d5af93d751731c9b47d5ad0a4b28c5a
f8a52990bbe6892abb730d241570fbfbd2ff2fc707fdd3004c7dba6e843bbae3
f8e471ebfa965e657a9974ffdd4ba95468534fe2987bc4b7c197744db53a1548
f9afb0e286986c3c4f1a83b1bbafb02a601ff074a2c5962d06a5182fa471e452
fb845bc1998e818ffd1ebeacd695e0a60e479e5993e5f0053e34bff96b8d4c53

www.bleepingcomputer.com Open in urlscan Pro 104.20.60.209 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

127 Requests

99 %HTTPS

57 %IPv6

28 Domains

50 Subdomains

42 IPs

6 Countries

6890 kBTransfer

11225 kBSize

11 Cookies

11 Outgoing links

Redirected requests

127 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.bleepingcomputer.com Open in urlscan Pro
104.20.60.209 Public Scan

Screenshot
Live screenshot

Full Image

127
Requests

99 %
HTTPS

57 %
IPv6

28
Domains

50
Subdomains

42
IPs

6
Countries

6890 kB
Transfer

11225 kB
Size

11
Cookies

127 HTTP transactions
1 data transactions