urlscan.io logo urlscan.io
SecurityTrails logo

blog.sekoia.io Open in urlscan Pro
35.214.255.233  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/#h-iocs
Effective URL: https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/
Submission: On July 03 via api from IN — Scanned from NL
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 20 IPs in 6 countries across 17 domains to perform 83 HTTP transactions. The main IP is 35.214.255.233, located in Groningen, Netherlands and belongs to GOOGLE, US. The main domain is blog.sekoia.io.
TLS certificate: Issued by AlphaSSL CA - SHA256 - G4 on January 9th 2024. Valid for: a year.
This is the only time blog.sekoia.io was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 35.214.255.233 15169 (GOOGLE)
38 2400:52e0:1e0... 60068 (CDN77 _)
1 2a00:1450:400... 15169 (GOOGLE)
5 2a00:1450:400... 15169 (GOOGLE)
10 2606:4700:10:... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
2 18.66.102.53 16509 (AMAZON-02)
2 99.81.164.152 16509 (AMAZON-02)
7 2a00:1450:400... 15169 (GOOGLE)
1 13.32.27.54 16509 (AMAZON-02)
3 2001:4860:480... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a02:26f0:940... 20940 (AKAMAI-ASN1)
2 184.31.85.59 16625 (AKAMAI-AS)
2 2a00:1450:400... 15169 (GOOGLE)
1 3 2620:1ec:21::14 8068 (MICROSOFT...)
1 13.107.42.14 8068 (MICROSOFT...)
1 130.248.173.59 15224 (OMNITURE)
83 20
2    35.214.255.233 (Groningen, Netherlands)

ASN15169 (GOOGLE, US)
PTR: 233.255.214.35.bc.googleusercontent.com
blog.sekoia.io
38    2400:52e0:1e00::1079:1 (Germany)

ASN60068 (CDN77 _, GB)
t7f4e9n3.rocketcdn.me
1    2a00:1450:4001:806::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
5    2a00:1450:4001:830::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
10    2606:4700:10::ac43:1408 (United States)

ASN13335 (CLOUDFLARENET, US)
cdn-cookieyes.com
1    2606:4700::6810:89d1 (United States)

ASN13335 (CLOUDFLARENET, US)
js.hs-scripts.com
2    18.66.102.53 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-102-53.fra56.r.cloudfront.net
static.hotjar.com
2    99.81.164.152 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-99-81-164-152.eu-west-1.compute.amazonaws.com
log.cookieyes.com
7    2a00:1450:4001:830::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
1    13.32.27.54 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-27-54.fra56.r.cloudfront.net
script.hotjar.com
3    2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)
region1.analytics.google.com
region1.google-analytics.com
1    2a00:1450:400c:c00::9b (Brussels, Belgium)

ASN15169 (GOOGLE, US)
stats.g.doubleclick.net
1    2a00:1450:4001:82f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.nl
1    2a02:26f0:9400::215:2248 (Paris, France)

ASN20940 (AKAMAI-ASN1, NL)
snap.licdn.com
2    184.31.85.59 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a184-31-85-59.deploy.static.akamaitechnologies.com
munchkin.marketo.net
2    2a00:1450:4001:82a::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
3    2620:1ec:21::14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
px.ads.linkedin.com
1    13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
px4.ads.linkedin.com
1    130.248.173.59 (United States)

ASN15224 (OMNITURE, US)
362-pti-203.mktoresp.com
Apex Domain
Subdomains		 Transfer
38 rocketcdn.me
t7f4e9n3.rocketcdn.me
3 MB
10 cdn-cookieyes.com
cdn-cookieyes.com — Cisco Umbrella Rank: 8844
79 KB
7 gstatic.com
fonts.gstatic.com
93 KB
5 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 81
449 KB
4 linkedin.com
px.ads.linkedin.com — Cisco Umbrella Rank: 360
px4.ads.linkedin.com — Cisco Umbrella Rank: 6416
2 KB
4 google-analytics.com
region1.google-analytics.com — Cisco Umbrella Rank: 2355
www.google-analytics.com — Cisco Umbrella Rank: 71
21 KB
3 hotjar.com
static.hotjar.com — Cisco Umbrella Rank: 894
script.hotjar.com — Cisco Umbrella Rank: 1260
64 KB
2 marketo.net
munchkin.marketo.net — Cisco Umbrella Rank: 4512
6 KB
2 cookieyes.com
log.cookieyes.com — Cisco Umbrella Rank: 9784
305 B
2 sekoia.io
blog.sekoia.io
41 KB
1 mktoresp.com
362-pti-203.mktoresp.com
318 B
1 licdn.com
snap.licdn.com — Cisco Umbrella Rank: 902
14 KB
1 google.nl
www.google.nl — Cisco Umbrella Rank: 10567
408 B
1 doubleclick.net
stats.g.doubleclick.net — Cisco Umbrella Rank: 136
253 B
1 google.com
region1.analytics.google.com — Cisco Umbrella Rank: 3125
1 hs-scripts.com
js.hs-scripts.com — Cisco Umbrella Rank: 2984
1 KB
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 83
1 KB
83 17
Domain Requested by
38 t7f4e9n3.rocketcdn.me blog.sekoia.io
t7f4e9n3.rocketcdn.me
10 cdn-cookieyes.com blog.sekoia.io
cdn-cookieyes.com
www.googletagmanager.com
7 fonts.gstatic.com fonts.googleapis.com
5 www.googletagmanager.com blog.sekoia.io
www.googletagmanager.com
3 px.ads.linkedin.com 1 redirects snap.licdn.com
2 www.google-analytics.com www.googletagmanager.com
blog.sekoia.io
2 region1.google-analytics.com www.googletagmanager.com
2 munchkin.marketo.net blog.sekoia.io
munchkin.marketo.net
2 log.cookieyes.com cdn-cookieyes.com
2 static.hotjar.com blog.sekoia.io
www.googletagmanager.com
2 blog.sekoia.io t7f4e9n3.rocketcdn.me
1 362-pti-203.mktoresp.com munchkin.marketo.net
1 px4.ads.linkedin.com blog.sekoia.io
1 snap.licdn.com www.googletagmanager.com
1 www.google.nl blog.sekoia.io
1 stats.g.doubleclick.net www.googletagmanager.com
1 region1.analytics.google.com www.googletagmanager.com
1 script.hotjar.com static.hotjar.com
1 js.hs-scripts.com blog.sekoia.io
1 fonts.googleapis.com blog.sekoia.io
83 20
Subject Issuer Validity Valid
*.sekoia.io
AlphaSSL CA - SHA256 - G4		 2024-01-09 -
2025-02-09		 a year crt.sh
*.rocketcdn.me
R3		 2024-05-14 -
2024-08-12		 3 months crt.sh
upload.video.google.com
WR2		 2024-06-13 -
2024-09-05		 3 months crt.sh
*.google-analytics.com
WR2		 2024-06-13 -
2024-09-05		 3 months crt.sh
cdn-cookieyes.com
GTS CA 1P5		 2024-05-27 -
2024-08-25		 3 months crt.sh
hs-scripts.com
E1		 2024-05-31 -
2024-08-29		 3 months crt.sh
*.hotjar.com
Amazon RSA 2048 M03		 2024-05-22 -
2025-06-20		 a year crt.sh
log.cookieyes.com
Amazon RSA 2048 M02		 2024-03-26 -
2025-04-25		 a year crt.sh
*.gstatic.com
WR2		 2024-06-13 -
2024-09-05		 3 months crt.sh
*.g.doubleclick.net
WR2		 2024-06-13 -
2024-09-05		 3 months crt.sh
*.google.nl
WR2		 2024-06-13 -
2024-09-05		 3 months crt.sh
snap.licdn.com
DigiCert SHA2 Secure Server CA		 2023-12-13 -
2024-12-12		 a year crt.sh
*.marketo.net
DigiCert TLS RSA SHA256 2020 CA1		 2023-12-08 -
2024-12-11		 a year crt.sh
www.linkedin.com
DigiCert SHA2 Secure Server CA		 2024-07-01 -
2025-01-01		 6 months crt.sh
*.mktoresp.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2023-09-07 -
2024-10-07		 a year crt.sh

This page contains 1 frames:

Primary Page: https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/
Frame ID: F4ED2BE18C3F72FA03ADAB546C542FDF
Requests: 88 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Exposing FakeBat loader: distribution methods and adversary infrastructure

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
  • /wp-(?:content|includes)/
Overall confidence: 100%
Detected patterns
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Overall confidence: 100%
Detected patterns
  • <!-- (?:End )?Google Tag Manager -->
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js
Overall confidence: 100%
Detected patterns
  • //static\.hotjar\.com/
Overall confidence: 100%
Detected patterns
  • lightbox(?:-plus-jquery)?.{0,32}\.js
Overall confidence: 100%
Detected patterns
  • snap\.licdn\.com/li\.lms-analytics/insight\.min\.js
Overall confidence: 100%
Detected patterns
  • munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js
Overall confidence: 100%
Detected patterns
  • swiper(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Overall confidence: 100%
Detected patterns
  • jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

83
Requests

99 %
HTTPS

63 %
IPv6

17
Domains

20
Subdomains

20
IPs

6
Countries

3587 kB
Transfer

6044 kB
Size

4
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 74
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=5046826&time=1719984189503&url=https%3A%2F%2Fblog.sekoia.io%2Fexposing-fakebat-loader-distribution-methods-and-adversary-infrastructure%2F%23h-iocs&tm=gtmv2 HTTP 302
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=5046826&time=1719984189503&url=https%3A%2F%2Fblog.sekoia.io%2Fexposing-fakebat-loader-distribution-methods-and-adversary-infrastructure%2F%23h-iocs&tm=gtmv2&e_ipv6=AQJVbaqLSo2X3AAAAZB3C_DoLQp1iG2l94CRXaj7NiksGS_px4quO6Wa5YAsRYYe91LmOw

83 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/ 		193 KB
39 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.214.255.233 Groningen, Netherlands, ASN15169 (GOOGLE, US),
Reverse DNS
233.255.214.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
70ce504aea1307c87370b3d7ebc41138b6917d728121ebbc81e0e7941beffe1f
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
Strict-Transport-Security max-age=63072000; includeSubDomains
X-Content-Security-Policy default-src 'self'; img-src *; media-src * data:;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
nl-NL,nl;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

access-control-allow-headers
Content-Type, Authorization
access-control-allow-methods
GET,POST
cache-control
max-age=0
content-encoding
br
content-security-policy
upgrade-insecure-requests;
content-type
text/html; charset=UTF-8
cross-origin-embedder-policy
unsafe-none; report-to='default'
cross-origin-embedder-policy-report-only
unsafe-none; report-to='default'
cross-origin-opener-policy
unsafe-none
cross-origin-opener-policy-report-only
unsafe-none; report-to='default'
cross-origin-resource-policy
cross-origin
date
Wed, 03 Jul 2024 05:23:08 GMT
expires
Wed, 03 Jul 2024 05:23:08 GMT
host-header
6b7412fb82ca5edfd0917e3957f05d89
last-modified
Tue, 02 Jul 2024 18:28:58 GMT
permissions-policy
accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(self), encrypted-media=(), fullscreen=*, geolocation=(self), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=*, picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), xr-spatial-tracking=(), gamepad=(), serial=()
referrer-policy
strict-origin-when-cross-origin
server
nginx
strict-transport-security
max-age=63072000; includeSubDomains
vary
Accept-Encoding Accept-Encoding,User-Agent
x-content-security-policy
default-src 'self'; img-src *; media-src * data:;
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-httpd-modphp
1
x-permitted-cross-domain-policies
none
x-proxy-cache
MISS
x-proxy-cache-info
0 NC:000000 UP:
x-xss-protection
1; mode=block
fakebat_background.png
t7f4e9n3.rocketcdn.me/wp-content/uploads/2024/07/ 		2 MB
2 MB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://t7f4e9n3.rocketcdn.me/wp-content/uploads/2024/07/fakebat_background.png
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1079:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1079 / RocketCDN - b
Resource Hash
4878923038c55038c628de10f98d6610d6ca597b506733e6bd6972aa73ae37d3

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://blog.sekoia.io/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 05:23:08 GMT
cdn-edgestorageid
1079
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
07/02/2024 08:15:34
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
content-length
2513851
last-modified
Mon, 01 Jul 2024 15:46:14 GMT
server
BunnyCDN-DE1-1079
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
"6682cf46-265bbb"
vary
Accept-Encoding
content-type
image/png
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control
public, max-age=31919000
cdn-requestid
6ae646b0456373471f321f7fb8333a4d
accept-ranges
bytes
cdn-requestcountrycode
NL
link
<https://blog.sekoia.io/wp-content/uploads/2024/07/fakebat_background.png>; rel="canonical"
cdn-status
200
cdn-requestpullsuccess
True
style.min.css
t7f4e9n3.rocketcdn.me/wp-includes/css/dist/block-library/ 		111 KB
14 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://t7f4e9n3.rocketcdn.me/wp-includes/css/dist/block-library/style.min.css?ver=6.5.5
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1079:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1079 / RocketCDN - b
Resource Hash
98cecf88a23542fa047ce46eedb650b5c5128761ed4386c0977b847094ddfa20

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://blog.sekoia.io/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 05:23:08 GMT
content-encoding
br
cdn-edgestorageid
1079
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
05/16/2024 13:02:49
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
last-modified
Wed, 03 Apr 2024 09:35:39 GMT
server
BunnyCDN-DE1-1079
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"660d22eb-1bae5"
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
access-control-expose-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control
public, max-age=31919000
cdn-requestid
f652f1068363aa900b329522a5c65d3c
cdn-requestcountrycode
NL
access-control-allow-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status
200
link
<https://blog.sekoia.io/wp-includes/css/dist/block-library/style.min.css?ver=6.5.3>; rel="canonical"
cdn-requestpullsuccess
True
style.min.css
t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/css/ 		454 KB
44 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/css/style.min.css?ver=6.5.5
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1079:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1079 / RocketCDN - b
Resource Hash
6cebe21539559e9c48fbfe65e91dee01455111406e02929814d913b1ec5ea942

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://blog.sekoia.io/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 05:23:08 GMT
content-encoding
br
cdn-edgestorageid
1079
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
03/26/2024 21:23:04
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
last-modified
Wed, 04 Jan 2023 15:10:29 GMT
server
BunnyCDN-DE1-1079
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"63b596e5-716b5"
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
access-control-expose-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control
public, max-age=31919000
cdn-requestid
2058d14fd04f3cf671889fe100942f83
cdn-requestcountrycode
NL
access-control-allow-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status
200
link
<https://blog.sekoia.io/wp-content/themes/notizia/assets/css/style.min.css?ver=6.4.3>; rel="canonical"
cdn-requestpullsuccess
True
style.css
t7f4e9n3.rocketcdn.me/wp-content/cache/min/1/wp-content/themes/notizia/ 		88 B
915 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://t7f4e9n3.rocketcdn.me/wp-content/cache/min/1/wp-content/themes/notizia/style.css?ver=1717663978
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1079:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1079 / RocketCDN - b
Resource Hash
129c8dd408b302e29db500ca187cac1136fde1e3f8731e91ecf3129f4148f23f

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://blog.sekoia.io/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 05:23:08 GMT
content-encoding
br
cdn-edgestorageid
1082
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
06/05/2024 07:05:41
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
last-modified
Mon, 03 Jun 2024 08:05:58 GMT
server
BunnyCDN-DE1-1079
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"665d7966-58"
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
access-control-expose-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control
public, max-age=31919000
cdn-requestid
848dc7808e6f85dedca2de5404c2276e
cdn-requestcountrycode
NL
access-control-allow-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status
200
link
<https://blog.sekoia.io/wp-content/cache/min/1/wp-content/themes/notizia/style.css?ver=1717401958>; rel="canonical"
cdn-requestpullsuccess
True
all.min.css
t7f4e9n3.rocketcdn.me/wp-content/cache/min/1/wp-content/themes/notizia/assets/libraries/fontawesome/css/ 		54 KB
12 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://t7f4e9n3.rocketcdn.me/wp-content/cache/min/1/wp-content/themes/notizia/assets/libraries/fontawesome/css/all.min.css?ver=1717663978
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1079:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1079 / RocketCDN - b
Resource Hash
b69bbf76924f3f2cb2b8a48ad8879f94c41350bcaaa1e2f5bad1ef26c1023313

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://blog.sekoia.io/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 05:23:08 GMT
content-encoding
br
cdn-edgestorageid
1079
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
03/26/2024 21:23:04
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
last-modified
Fri, 08 Mar 2024 14:07:02 GMT
server
BunnyCDN-DE1-1079
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"65eb1b86-d689"
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
access-control-expose-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control
public, max-age=31919000
cdn-requestid
1d7fb5eec59247643fc45693ba3ec7ed
cdn-requestcountrycode
NL
access-control-allow-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status
200
link
<https://blog.sekoia.io/wp-content/cache/min/1/wp-content/themes/notizia/assets/libraries/fontawesome/css/all.min.css?ver=1709906822>; rel="canonical"
cdn-requestpullsuccess
True
swiper.min.css
t7f4e9n3.rocketcdn.me/wp-content/cache/min/1/wp-content/themes/notizia/assets/libraries/swiper/css/ 		15 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://t7f4e9n3.rocketcdn.me/wp-content/cache/min/1/wp-content/themes/notizia/assets/libraries/swiper/css/swiper.min.css?ver=1717663978
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1079:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1079 / RocketCDN - b
Resource Hash
fd2d3909ddff9145977ab7f4deef6257278aa7601dbcc5482ac59ec3af69ff42

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://blog.sekoia.io/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 05:23:08 GMT
content-encoding
br
cdn-edgestorageid
1081
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
03/08/2024 14:36:12
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
last-modified
Fri, 08 Mar 2024 14:07:02 GMT
server
BunnyCDN-DE1-1079
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"65eb1b86-3bd4"
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
access-control-expose-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control
public, max-age=31919000
cdn-requestid
5e8ca475144f33acc8109408767c0b6e
cdn-requestcountrycode
NL
access-control-allow-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status
200
link
<https://blog.sekoia.io/wp-content/cache/min/1/wp-content/themes/notizia/assets/libraries/swiper/css/swiper.min.css?ver=1709906822>; rel="canonical"
cdn-requestpullsuccess
True
magnific-popup.min.css
t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/libraries/magnific-popup/ 		5 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/libraries/magnific-popup/magnific-popup.min.css?ver=6.5.5
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1079:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1079 / RocketCDN - b
Resource Hash
9af0f4e90a7cba0dbe38575666bfedf0e853278155957eb78e63761e33b88a11

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://blog.sekoia.io/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 05:23:08 GMT
content-encoding
br
cdn-edgestorageid
1079
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
03/26/2024 21:23:04
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
last-modified
Wed, 04 Jan 2023 15:12:01 GMT
server
BunnyCDN-DE1-1079
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"63b59741-1473"
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
access-control-expose-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control
public, max-age=31919000
cdn-requestid
47e23300e60c4b858547ab74e65eb293
cdn-requestcountrycode
NL
access-control-allow-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status
200
link
<https://blog.sekoia.io/wp-content/themes/notizia/assets/libraries/magnific-popup/magnific-popup.min.css?ver=6.4.3>; rel="canonical"
cdn-requestpullsuccess
True
hamburgers.min.css
t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/libraries/hamburgers/ 		22 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/libraries/hamburgers/hamburgers.min.css?ver=6.5.5
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1079:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1079 / RocketCDN - b
Resource Hash
24fbf98a0312aa6db3b49c6d8e2ba9d2ae8d316bbb2f731b327f45ab23e07dda

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://blog.sekoia.io/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 05:23:08 GMT
content-encoding
br
cdn-edgestorageid
1079
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
03/26/2024 21:23:04
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
last-modified
Wed, 04 Jan 2023 15:12:01 GMT
server
BunnyCDN-DE1-1079
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"63b59741-57ba"
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
access-control-expose-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control
public, max-age=31919000
cdn-requestid
550dd609be38dd3b685bfb606e63791f
cdn-requestcountrycode
NL
access-control-allow-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status
200
link
<https://blog.sekoia.io/wp-content/themes/notizia/assets/libraries/hamburgers/hamburgers.min.css?ver=6.4.3>; rel="canonical"
cdn-requestpullsuccess
True
animate.min.css
t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/libraries/animate/ 		70 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/libraries/animate/animate.min.css?ver=6.5.5
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1079:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1079 / RocketCDN - b
Resource Hash
eb2798553d86c6b1806d208320f645bd79eab0cebcf22176bddbc648e8f3ccd4

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://blog.sekoia.io/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 05:23:08 GMT
content-encoding
br
cdn-edgestorageid
1081
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
03/08/2024 14:36:12
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
last-modified
Wed, 04 Jan 2023 15:12:01 GMT
server
BunnyCDN-DE1-1079
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"63b59741-11848"
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
access-control-expose-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control
public, max-age=31919000
cdn-requestid
2d94b5478fef43b65ecee58f4ed5a795
cdn-requestcountrycode
NL
access-control-allow-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status
200
link
<https://blog.sekoia.io/wp-content/themes/notizia/assets/libraries/animate/animate.min.css?ver=6.4.3>; rel="canonical"
cdn-requestpullsuccess
True
lightbox.min.css
t7f4e9n3.rocketcdn.me/wp-content/cache/background-css/t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/libraries/lightbox/css/ 		2 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://t7f4e9n3.rocketcdn.me/wp-content/cache/background-css/t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/libraries/lightbox/css/lightbox.min.css?ver=6.5.5&wpr_t=1719952138
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1079:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1079 / RocketCDN - b
Resource Hash
871876a93786ce9cbcf5cff222a14cf184da2c2b4aa74de28a3ec68aba508541

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://blog.sekoia.io/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 05:23:08 GMT
content-encoding
br
cdn-edgestorageid
1080
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
03/08/2024 14:36:12
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
last-modified
Fri, 08 Mar 2024 14:07:02 GMT
server
BunnyCDN-DE1-1079
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"65eb1b86-9c0"
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
access-control-expose-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control
public, max-age=31919000
cdn-requestid
046a0d79cb6b8aa56ab506267abe117f
cdn-requestcountrycode
NL
access-control-allow-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status
200
link
<https://blog.sekoia.io/wp-content/cache/background-css/t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/libraries/lightbox/css/lightbox.min.css?ver=6.4.3&wpr_t=1709910836>; rel="canonical"
cdn-requestpullsuccess
True
css
fonts.googleapis.com/ 		13 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Poppins%3Aital%2Cwght%400%2C400%3B0%2C500%3B0%2C600%3B1%2C300%3B1%2C400%3B1%2C500%3B1%2C600%7CNoto+Sans%3Aital%2Cwght%400%2C400%3B0%2C700%3B1%2C400%3B1%2C700&display=swap&ver=6.5.5
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
175202eabfde37a4bfc6d0d646ff0818908491e556eda5a911d204e00afa5859
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://blog.sekoia.io/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000
date
Wed, 03 Jul 2024 05:23:08 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Wed, 03 Jul 2024 05:23:08 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Wed, 03 Jul 2024 05:23:08 GMT
front.css
t7f4e9n3.rocketcdn.me/wp-content/cache/min/1/wp-content/plugins/easy-notification-bar/assets/css/ 		4 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://t7f4e9n3.rocketcdn.me/wp-content/cache/min/1/wp-content/plugins/easy-notification-bar/assets/css/front.css?ver=1717663978
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1079:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1079 / RocketCDN - b
Resource Hash
67e602a944bcceb8eec54d907ddac6feca2610c15f37bba5877a410826bf78c0

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://blog.sekoia.io/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 05:23:08 GMT
content-encoding
br
cdn-edgestorageid
1080
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
05/29/2024 20:08:35
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
last-modified
Wed, 29 May 2024 09:48:18 GMT
server
BunnyCDN-DE1-1079
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"6656f9e2-e82"
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
access-control-expose-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control
public, max-age=31919000
cdn-requestid
4f43cb7dc14f11c4310e83cce1be31ae
cdn-requestcountrycode
NL
access-control-allow-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status
200
link
<https://blog.sekoia.io/wp-content/cache/min/1/wp-content/plugins/easy-notification-bar/assets/css/front.css?ver=1716976098>; rel="canonical"
cdn-requestpullsuccess
True
feather.min.js
t7f4e9n3.rocketcdn.me/wp-content/plugins/notizia-reading-center/assets/libraries/feather-icons/ 		74 KB
19 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://t7f4e9n3.rocketcdn.me/wp-content/plugins/notizia-reading-center/assets/libraries/feather-icons/feather.min.js?ver=6.5.5
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1079:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1079 / RocketCDN - b
Resource Hash
5dfcdd882f92d647a26beb3d974ef2ef27b96bcef8b01abaef32b8bbb2d38ef9

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://blog.sekoia.io/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 05:23:08 GMT
content-encoding
br
cdn-edgestorageid
1080
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
03/08/2024 14:36:12
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
last-modified
Wed, 04 Jan 2023 15:11:12 GMT
server
BunnyCDN-DE1-1079
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"63b59710-12803"
vary
Accept-Encoding
content-type
application/javascript
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control
public, max-age=31919000
cdn-requestid
bc5efc2473658db7be087195d01c46f6
cdn-requestcountrycode
NL
link
<https://blog.sekoia.io/wp-content/plugins/notizia-reading-center/assets/libraries/feather-icons/feather.min.js?ver=6.4.3>; rel="canonical"
cdn-status
200
cdn-requestpullsuccess
True
jquery.min.js
t7f4e9n3.rocketcdn.me/wp-includes/js/jquery/ 		86 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://t7f4e9n3.rocketcdn.me/wp-includes/js/jquery/jquery.min.js?ver=3.7.1
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1079:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1079 / RocketCDN - b
Resource Hash
cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://blog.sekoia.io/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 05:23:08 GMT
content-encoding
br
cdn-edgestorageid
1079
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
03/26/2024 21:23:04
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
last-modified
Wed, 29 Nov 2023 09:31:15 GMT
server
BunnyCDN-DE1-1079
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"656704e3-15601"
vary
Accept-Encoding
content-type
application/javascript
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control
public, max-age=31919000
cdn-requestid
5ad4217fad7fe8d13e0a8b25b7b6b97d
cdn-requestcountrycode
NL
link
<https://blog.sekoia.io/wp-includes/js/jquery/jquery.min.js?ver=3.7.1>; rel="canonical"
cdn-status
200
cdn-requestpullsuccess
True
jquery-migrate.min.js
t7f4e9n3.rocketcdn.me/wp-includes/js/jquery/ 		13 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://t7f4e9n3.rocketcdn.me/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1079:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1079 / RocketCDN - b
Resource Hash
5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://blog.sekoia.io/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 05:23:08 GMT
content-encoding
br
cdn-edgestorageid
1079
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
03/26/2024 21:23:04
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
last-modified
Fri, 11 Aug 2023 10:22:55 GMT
server
BunnyCDN-DE1-1079
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"64d60bff-3509"
vary
Accept-Encoding
content-type
application/javascript
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control
public, max-age=31919000
cdn-requestid
8fc88d2f6219e70742dab4214ee1c476
cdn-requestcountrycode
NL
link
<https://blog.sekoia.io/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1>; rel="canonical"
cdn-status
200
cdn-requestpullsuccess
True
script.js
t7f4e9n3.rocketcdn.me/wp-content/plugins/notizia-reading-center/assets/js/ 		4 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://t7f4e9n3.rocketcdn.me/wp-content/plugins/notizia-reading-center/assets/js/script.js?ver=6.5.5
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1079:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1079 / RocketCDN - b
Resource Hash
5da7118ba9a235cf7886a940fee43e57077adbe94af4d3f6117ca3aee39946a1

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://blog.sekoia.io/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 05:23:08 GMT
content-encoding
br
cdn-edgestorageid
1079
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
03/26/2024 21:23:04
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
last-modified
Wed, 04 Jan 2023 15:09:26 GMT
server
BunnyCDN-DE1-1079
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"63b596a6-10a3"
vary
Accept-Encoding
content-type
application/javascript
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control
public, max-age=31919000
cdn-requestid
335d1d675a8d8d16f503f63a224c9ad6
cdn-requestcountrycode
NL
link
<https://blog.sekoia.io/wp-content/plugins/notizia-reading-center/assets/js/script.js?ver=6.4.3>; rel="canonical"
cdn-status
200
cdn-requestpullsuccess
True
ajax.js
t7f4e9n3.rocketcdn.me/wp-content/plugins/notizia-reading-center/assets/js/ 		18 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://t7f4e9n3.rocketcdn.me/wp-content/plugins/notizia-reading-center/assets/js/ajax.js?ver=6.5.5
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1079:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1079 / RocketCDN - b
Resource Hash
f95dafc4dfe117d050194c7812377df2e9c1b1b476b12bc0a38503e786fd04ac

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://blog.sekoia.io/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 05:23:08 GMT
content-encoding
br
cdn-edgestorageid
1081
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
05/26/2024 11:17:52
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
last-modified
Wed, 04 Jan 2023 15:09:26 GMT
server
BunnyCDN-DE1-1079
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"63b596a6-47f4"
vary
Accept-Encoding
content-type
application/javascript
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control
public, max-age=31919000
cdn-requestid
3172ae16a5fba5ea1f5aaae5df7a30cc
cdn-requestcountrycode
NL
link
<https://blog.sekoia.io/wp-content/plugins/notizia-reading-center/assets/js/ajax.js?ver=6.5.3>; rel="canonical"
cdn-status
200
cdn-requestpullsuccess
True
script.min.js
t7f4e9n3.rocketcdn.me/wp-content/plugins/notizia-tools/assets/js/ 		35 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://t7f4e9n3.rocketcdn.me/wp-content/plugins/notizia-tools/assets/js/script.min.js?ver=6.5.5
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1079:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1079 / RocketCDN - b
Resource Hash
1b0e165a72588997e984e9055ce36b40c4aba3a4d45567b7af95f1cf2af23ba4

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://blog.sekoia.io/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 05:23:08 GMT
content-encoding
br
cdn-edgestorageid
1082
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
03/08/2024 14:36:12
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
last-modified
Wed, 04 Jan 2023 15:09:27 GMT
server
BunnyCDN-DE1-1079
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"63b596a7-8d6c"
vary
Accept-Encoding
content-type
application/javascript
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control
public, max-age=31919000
cdn-requestid
63681752bc5928c6c2e5957724045f57
cdn-requestcountrycode
NL
link
<https://blog.sekoia.io/wp-content/plugins/notizia-tools/assets/js/script.min.js?ver=6.4.3>; rel="canonical"
cdn-status
200
cdn-requestpullsuccess
True
foundation.core.min.js
t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/js/foundation/ 		13 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/js/foundation/foundation.core.min.js?ver=6.5.5
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1079:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1079 / RocketCDN - b
Resource Hash
5e3b5a5069534703b6b441668a33d3aecd877044e2bb8ff0bbb564c5f23a29ae

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://blog.sekoia.io/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 05:23:08 GMT
content-encoding
br
cdn-edgestorageid
1079
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
03/26/2024 21:23:04
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
last-modified
Wed, 04 Jan 2023 15:12:00 GMT
server
BunnyCDN-DE1-1079
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"63b59740-3579"
vary
Accept-Encoding
content-type
application/javascript
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control
public, max-age=31919000
cdn-requestid
4f0b4f63cf96791bae3e4104f13e5356
cdn-requestcountrycode
NL
link
<https://blog.sekoia.io/wp-content/themes/notizia/assets/js/foundation/foundation.core.min.js?ver=6.4.3>; rel="canonical"
cdn-status
200
cdn-requestpullsuccess
True
foundation.util.nest.min.js
t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/js/foundation/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/js/foundation/foundation.util.nest.min.js?ver=6.5.5
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1079:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1079 / RocketCDN - b
Resource Hash
a43dd50b7d497a8b9964fc6a08dfe9895a73e588eeffbe0bb1b659d6ac5703b1

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://blog.sekoia.io/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 05:23:08 GMT
content-encoding
br
cdn-edgestorageid
1080
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
03/08/2024 14:36:12
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
last-modified
Wed, 04 Jan 2023 15:12:00 GMT
server
BunnyCDN-DE1-1079
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"63b59740-baa"
vary
Accept-Encoding
content-type
application/javascript
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control
public, max-age=31919000
cdn-requestid
6d4fc8696cef8efe2ceadd25aebf552e
cdn-requestcountrycode
NL
link
<https://blog.sekoia.io/wp-content/themes/notizia/assets/js/foundation/foundation.util.nest.min.js?ver=6.4.3>; rel="canonical"
cdn-status
200
cdn-requestpullsuccess
True
foundation.util.keyboard.min.js
t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/js/foundation/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/js/foundation/foundation.util.keyboard.min.js?ver=6.5.5
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1079:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1079 / RocketCDN - b
Resource Hash
5259d3d1db0ab9bbb835ea4bb25b69be5db7366bda907678b2d9272b52fbc1ed

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://blog.sekoia.io/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 05:23:08 GMT
content-encoding
br
cdn-edgestorageid
1079
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
03/26/2024 21:23:04
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
last-modified
Wed, 04 Jan 2023 15:12:00 GMT
server
BunnyCDN-DE1-1079
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"63b59740-e0c"
vary
Accept-Encoding
content-type
application/javascript
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control
public, max-age=31919000
cdn-requestid
3dde0bc82d07ced095f45d8af1836f31
cdn-requestcountrycode
NL
link
<https://blog.sekoia.io/wp-content/themes/notizia/assets/js/foundation/foundation.util.keyboard.min.js?ver=6.4.3>; rel="canonical"
cdn-status
200
cdn-requestpullsuccess
True
foundation.util.box.min.js
t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/js/foundation/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/js/foundation/foundation.util.box.min.js?ver=6.5.5
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1079:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1079 / RocketCDN - b
Resource Hash
28b58d1719430b0a469ec4afa2b8b7c1a4a801fe8734d73b273db0d01b788ea3

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://blog.sekoia.io/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 05:23:08 GMT
content-encoding
br
cdn-edgestorageid
1079
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
03/26/2024 21:23:04
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
last-modified
Wed, 04 Jan 2023 15:12:00 GMT
server
BunnyCDN-DE1-1079
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"63b59740-e65"
vary
Accept-Encoding
content-type
application/javascript
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control
public, max-age=31919000
cdn-requestid
f5e897cf1999a5498d3fd05b7bc063da
cdn-requestcountrycode
NL
link
<https://blog.sekoia.io/wp-content/themes/notizia/assets/js/foundation/foundation.util.box.min.js?ver=6.4.3>; rel="canonical"
cdn-status
200
cdn-requestpullsuccess
True
foundation.util.touch.min.js
t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/js/foundation/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/js/foundation/foundation.util.touch.min.js?ver=6.5.5
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1079:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1079 / RocketCDN - b
Resource Hash
48ad7fc9c26959cc4e41c1addf2f513215b9f48f6e46e587286215ea3b3e1d2b

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://blog.sekoia.io/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 05:23:08 GMT
content-encoding
br
cdn-edgestorageid
1080
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
06/13/2024 11:03:32
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
last-modified
Wed, 04 Jan 2023 15:12:00 GMT
server
BunnyCDN-DE1-1079
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"63b59740-1192"
vary
Accept-Encoding
content-type
application/javascript
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control
public, max-age=31919000
cdn-requestid
b4990ea4ee1bdfa93637fbc5cad5be56
cdn-requestcountrycode
NL
link
<https://blog.sekoia.io/wp-content/themes/notizia/assets/js/foundation/foundation.util.touch.min.js?ver=6.5.4>; rel="canonical"
cdn-status
200
cdn-requestpullsuccess
True
foundation.dropdownMenu.min.js
t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/js/foundation/ 		10 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/js/foundation/foundation.dropdownMenu.min.js?ver=6.5.5
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1079:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1079 / RocketCDN - b
Resource Hash
b7c769c34783e3dfd90f07e035efafd8cc1b57a4b1db3e027c42c207802271e6

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://blog.sekoia.io/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 05:23:08 GMT
content-encoding
br
cdn-edgestorageid
1081
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
06/14/2024 10:30:23
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
last-modified
Wed, 04 Jan 2023 15:12:00 GMT
server
BunnyCDN-DE1-1079
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"63b59740-2912"
vary
Accept-Encoding
content-type
application/javascript
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control
public, max-age=31919000
cdn-requestid
a618558b9599f59482f66b5e6319b454
cdn-requestcountrycode
NL
link
<https://blog.sekoia.io/wp-content/themes/notizia/assets/js/foundation/foundation.dropdownMenu.min.js?ver=6.5.4>; rel="canonical"
cdn-status
200
cdn-requestpullsuccess
True
foundation.accordionMenu.min.js
t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/js/foundation/ 		9 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/js/foundation/foundation.accordionMenu.min.js?ver=6.5.5
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1079:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1079 / RocketCDN - b
Resource Hash
250354fad29f1a85fc4e431b09faeccbf0275f5d5afdf6faf422936b206f25ab

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://blog.sekoia.io/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 05:23:08 GMT
content-encoding
br
cdn-edgestorageid
1082
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
03/08/2024 14:36:12
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
last-modified
Wed, 04 Jan 2023 15:12:00 GMT
server
BunnyCDN-DE1-1079
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"63b59740-2237"
vary
Accept-Encoding
content-type
application/javascript
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control
public, max-age=31919000
cdn-requestid
acc82dc7966541a709f1cbf83a644023
cdn-requestcountrycode
NL
link
<https://blog.sekoia.io/wp-content/themes/notizia/assets/js/foundation/foundation.accordionMenu.min.js?ver=6.4.3>; rel="canonical"
cdn-status
200
cdn-requestpullsuccess
True
js
www.googletagmanager.com/gtag/ 		265 KB
93 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=GT-MQXZQ8K
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
d4882e536a9c1013dc9abd3f7959f263ddf1d576c06c023defb1f37d17749e36
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://blog.sekoia.io/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 05:23:09 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
95089
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Wed, 03 Jul 2024 05:23:09 GMT
js
www.googletagmanager.com/gtag/ 		310 KB
104 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=G-12N1XPRQ0H
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
6682a68c5c46a2a32746bf93906dbc12b735344b8fbd8d8891e317e4de82f687
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://blog.sekoia.io/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 05:23:09 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
106104
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Wed, 03 Jul 2024 05:23:09 GMT
script.js
cdn-cookieyes.com/client_data/8e62bd9aea8528cd3a8c337f/ 		97 KB
34 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn-cookieyes.com/client_data/8e62bd9aea8528cd3a8c337f/script.js
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:1408 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
04e8cde8d717404bb5cd8983f6a7817994b4434b70c0a2d834dd02dfb8297187

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://blog.sekoia.io/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 05:23:08 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Tue, 18 Jun 2024 12:55:22 GMT
server
cloudflare
age
54685
etag
"184e0-61b2998495b03-gzip"
vary
Accept-Encoding
access-control-allow-methods
GET, OPTIONS
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=0, must-revalidate, s-maxage=604800, proxy-revalidate
accept-ranges
bytes
cf-ray
89d4711c5bba1eb5-AMS
content-length
34387
cropped-logo-sekoia-io-blog-light.png
t7f4e9n3.rocketcdn.me/wp-content/uploads/2023/03/ 		4 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://t7f4e9n3.rocketcdn.me/wp-content/uploads/2023/03/cropped-logo-sekoia-io-blog-light.png
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1079:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1079 / RocketCDN - b
Resource Hash
08674dbb7419f9e5a5e6310436d0cd84559d92789fa278b9876fdedac7dec06f

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://blog.sekoia.io/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 05:23:09 GMT
cdn-edgestorageid
1080
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
03/08/2024 16:36:53
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
content-length
4586
last-modified
Thu, 30 Mar 2023 20:01:58 GMT
server
BunnyCDN-DE1-1079
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
"6425eab6-11ea"
vary
Accept-Encoding
content-type
image/png
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control
public, max-age=31919000
cdn-requestid
fdd1c7a0300bbcc523e9bc463dc4424a
accept-ranges
bytes
cdn-requestcountrycode
NL
link
<https://blog.sekoia.io/wp-content/uploads/2023/03/cropped-logo-sekoia-io-blog-light.png>; rel="canonical"
cdn-status
200
cdn-requestpullsuccess
True
logo-sekoia-symbol-6.png
t7f4e9n3.rocketcdn.me/wp-content/uploads/2023/04/ 		18 KB
19 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://t7f4e9n3.rocketcdn.me/wp-content/uploads/2023/04/logo-sekoia-symbol-6.png
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1079:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1079 / RocketCDN - b
Resource Hash
3cbefb9b0f14015aba9d624075ae01b1ce1101fea52838241708ef22783f49be

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://blog.sekoia.io/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 05:23:09 GMT
cdn-edgestorageid
1082
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
03/08/2024 16:36:53
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
content-length
18477
last-modified
Thu, 20 Apr 2023 13:56:40 GMT
server
BunnyCDN-DE1-1079
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
"64414498-482d"
vary
Accept-Encoding
content-type
image/png
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control
public, max-age=31919000
cdn-requestid
b897b42e5cc83f04b0902c0662c8e209
accept-ranges
bytes
cdn-requestcountrycode
NL
link
<https://blog.sekoia.io/wp-content/uploads/2023/04/logo-sekoia-symbol-6.png>; rel="canonical"
cdn-status
200
cdn-requestpullsuccess
True
gtm.js
www.googletagmanager.com/ 		212 KB
74 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-K8T6VX2
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
36c5a1bea1a435627251c30ee5c547b82c6791ece004325f0441f2a58ca56452
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://blog.sekoia.io/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 05:23:09 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
75387
x-xss-protection
0
last-modified
Wed, 03 Jul 2024 03:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Wed, 03 Jul 2024 05:23:09 GMT
7095517.js
js.hs-scripts.com/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.hs-scripts.com/7095517.js?integration=WordPress&ver=11.1.22
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:89d1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
902d9c0591da116384b2642524023ef99fa6db18fc53d1bd7bf93c67ddd75aa4
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://blog.sekoia.io/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 05:23:08 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
EXPIRED
x-evy-trace-route-service-name
envoyset-translator
x-hubspot-correlation-id
048fa618-030f-40ca-bc33-1dc16fbac142
x-envoy-upstream-service-time
7
content-length
664
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
048fa618-030f-40ca-bc33-1dc16fbac142
last-modified
Wed, 03 Jul 2024 02:59:01 GMT
server
cloudflare
vary
origin, Accept-Encoding
access-control-max-age
3600
content-type
application/javascript;charset=utf-8
access-control-allow-origin
https://blog.sekoia.io
x-evy-trace-virtual-host
all
x-evy-trace-served-by-pod
iad02/hubapi-td/envoy-proxy-7dd59b876-ln4rs
access-control-allow-credentials
true
cache-control
public, max-age=90
accept-ranges
bytes
cf-ray
89d4711c692f96f4-AMS
expires
Wed, 03 Jul 2024 05:24:38 GMT
byline.334a.min.js
t7f4e9n3.rocketcdn.me/wp-content/plugins/molongui-authorship/assets/js/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://t7f4e9n3.rocketcdn.me/wp-content/plugins/molongui-authorship/assets/js/byline.334a.min.js?ver=4.9.3
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1079:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1079 / RocketCDN - b
Resource Hash
9df6c4c7c9ded0611ccf30c49f5a271fe7ab2405cdecbfbf38413a1430d5f75e

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://blog.sekoia.io/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 05:23:08 GMT
content-encoding
br
cdn-edgestorageid
1080
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
03/08/2024 14:36:13
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
last-modified
Fri, 01 Mar 2024 08:07:13 GMT
server
BunnyCDN-DE1-1079
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"65e18cb1-1095"
vary
Accept-Encoding
content-type
application/javascript
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control
public, max-age=31919000
cdn-requestid
6a6d18daf8ad02968696216e805c3fe2
cdn-requestcountrycode
NL
link
<https://blog.sekoia.io/wp-content/plugins/molongui-authorship/assets/js/byline.334a.min.js?ver=4.7.10>; rel="canonical"
cdn-status
200
cdn-requestpullsuccess
True
intersection-observer.min.js
t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/libraries/intersection-observer/ 		9 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/libraries/intersection-observer/intersection-observer.min.js?ver=1.1
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1079:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1079 / RocketCDN - b
Resource Hash
d89933395cd19a7fcf51defdc49031608af28bd675c9f3524e7bc8e1e261495d

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://blog.sekoia.io/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 05:23:08 GMT
content-encoding
br
cdn-edgestorageid
1080
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
03/08/2024 14:36:13
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
last-modified
Wed, 04 Jan 2023 15:12:01 GMT
server
BunnyCDN-DE1-1079
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"63b59741-22f1"
vary
Accept-Encoding
content-type
application/javascript
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control
public, max-age=31919000
cdn-requestid
70c00847b5917170de4dd91294dd12ff
cdn-requestcountrycode
NL
link
<https://blog.sekoia.io/wp-content/themes/notizia/assets/libraries/intersection-observer/intersection-observer.min.js?ver=1.1>; rel="canonical"
cdn-status
200
cdn-requestpullsuccess
True
theme.min.js
t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/js/ 		81 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/js/theme.min.js?ver=1.1
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1079:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1079 / RocketCDN - b
Resource Hash
bc7dbcdf8032d1fa2b724cdd699a0f80e3d9fa4bfecca91eb802abde8b919e2d

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://blog.sekoia.io/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 05:23:09 GMT
content-encoding
br
cdn-edgestorageid
1081
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
06/25/2024 13:41:56
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
last-modified
Wed, 04 Jan 2023 15:10:29 GMT
server
BunnyCDN-DE1-1079
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"63b596e5-145ad"
vary
Accept-Encoding
content-type
application/javascript
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control
public, max-age=31919000
cdn-requestid
8e4bf7dc14282f920f1f93a99b636476
cdn-requestcountrycode
NL
link
<https://blog.sekoia.io/wp-content/themes/notizia/assets/js/theme.min.js?ver=1.1>; rel="canonical"
cdn-status
200
cdn-requestpullsuccess
True
swiper.min.js
t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/libraries/swiper/js/ 		133 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/libraries/swiper/js/swiper.min.js
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1079:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1079 / RocketCDN - b
Resource Hash
9ee89affccbb6f24bf0dbfd697a97d13a1dfb9a94227c6b7daf7f697ceaf073f

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://blog.sekoia.io/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 05:23:09 GMT
content-encoding
br
cdn-edgestorageid
1080
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
03/08/2024 16:37:03
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
last-modified
Wed, 04 Jan 2023 15:13:15 GMT
server
BunnyCDN-DE1-1079
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"63b5978b-212ea"
vary
Accept-Encoding
content-type
application/javascript
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control
public, max-age=31919000
cdn-requestid
02c109038e44b2f6ca632a0fc59b9988
cdn-requestcountrycode
NL
link
<https://blog.sekoia.io/wp-content/themes/notizia/assets/libraries/swiper/js/swiper.min.js>; rel="canonical"
cdn-status
200
cdn-requestpullsuccess
True
hoverintent.min.js
t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/libraries/hoverintent/ 		2 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/libraries/hoverintent/hoverintent.min.js
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1079:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1079 / RocketCDN - b
Resource Hash
0ab10cbd66e537859e4a75a22fd8e3ac547eec9b4276e12e70e13700817763e9

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://blog.sekoia.io/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 05:23:09 GMT
content-encoding
br
cdn-edgestorageid
1082
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
03/08/2024 16:37:03
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
last-modified
Wed, 04 Jan 2023 15:12:01 GMT
server
BunnyCDN-DE1-1079
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"63b59741-913"
vary
Accept-Encoding
content-type
application/javascript
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control
public, max-age=31919000
cdn-requestid
666a6ba7c3d8bc7c86804d8c297aeb87
cdn-requestcountrycode
NL
link
<https://blog.sekoia.io/wp-content/themes/notizia/assets/libraries/hoverintent/hoverintent.min.js>; rel="canonical"
cdn-status
200
cdn-requestpullsuccess
True
magnific-popup.min.js
t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/libraries/magnific-popup/ 		20 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/libraries/magnific-popup/magnific-popup.min.js
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1079:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1079 / RocketCDN - b
Resource Hash
fc7109dd6428c821842660a87bda6494e52c0f4ecad22105a1aed87e440ee0b1

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://blog.sekoia.io/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 05:23:09 GMT
content-encoding
br
cdn-edgestorageid
1081
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
03/08/2024 16:37:03
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
last-modified
Wed, 04 Jan 2023 15:12:02 GMT
server
BunnyCDN-DE1-1079
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"63b59742-4f29"
vary
Accept-Encoding
content-type
application/javascript
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control
public, max-age=31919000
cdn-requestid
135aafaa52e48c97adb70174ef5f02b3
cdn-requestcountrycode
NL
link
<https://blog.sekoia.io/wp-content/themes/notizia/assets/libraries/magnific-popup/magnific-popup.min.js>; rel="canonical"
cdn-status
200
cdn-requestpullsuccess
True
lightbox.min.js
t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/libraries/lightbox/js/ 		9 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/libraries/lightbox/js/lightbox.min.js
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1079:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1079 / RocketCDN - b
Resource Hash
d3ef3695bb858983c86f962d408897ea6742380534b225ba3ecfb5d47820ad06

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://blog.sekoia.io/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 05:23:09 GMT
content-encoding
br
cdn-edgestorageid
1081
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
03/08/2024 16:37:03
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
last-modified
Wed, 04 Jan 2023 15:13:15 GMT
server
BunnyCDN-DE1-1079
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"63b5978b-2503"
vary
Accept-Encoding
content-type
application/javascript
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control
public, max-age=31919000
cdn-requestid
53d498ef7fcb1639b42beba81802e727
cdn-requestcountrycode
NL
link
<https://blog.sekoia.io/wp-content/themes/notizia/assets/libraries/lightbox/js/lightbox.min.js>; rel="canonical"
cdn-status
200
cdn-requestpullsuccess
True
ajax.min.js
t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/js/ 		4 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/js/ajax.min.js?ver=1.1
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1079:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1079 / RocketCDN - b
Resource Hash
e43b5d8e33e7e90b8a0ee4962984feb08e72d030794dbcf94b8b292dbe8ee6c5

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://blog.sekoia.io/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 05:23:09 GMT
content-encoding
br
cdn-edgestorageid
1082
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
03/08/2024 14:36:13
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
last-modified
Wed, 04 Jan 2023 15:10:29 GMT
server
BunnyCDN-DE1-1079
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"63b596e5-eec"
vary
Accept-Encoding
content-type
application/javascript
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control
public, max-age=31919000
cdn-requestid
265d05c09870b210959329518aaa6d5b
cdn-requestcountrycode
NL
link
<https://blog.sekoia.io/wp-content/themes/notizia/assets/js/ajax.min.js?ver=1.1>; rel="canonical"
cdn-status
200
cdn-requestpullsuccess
True
lazyload.min.js
t7f4e9n3.rocketcdn.me/wp-content/plugins/wp-rocket/assets/js/lazyload/17.8.3/ 		9 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://t7f4e9n3.rocketcdn.me/wp-content/plugins/wp-rocket/assets/js/lazyload/17.8.3/lazyload.min.js
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1079:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1079 / RocketCDN - b
Resource Hash
f40767552e5e94b2d5f9a65d7f640cfa7d225298023dbd682095e040809a3d1a

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://blog.sekoia.io/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 05:23:09 GMT
content-encoding
br
cdn-edgestorageid
1080
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
05/21/2024 20:12:03
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
last-modified
Mon, 13 May 2024 17:48:06 GMT
server
BunnyCDN-DE1-1079
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"66425256-22bc"
vary
Accept-Encoding
content-type
application/javascript
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control
public, max-age=31919000
cdn-requestid
0ef9538c55968f1c42dcb89f5228f157
cdn-requestcountrycode
NL
link
<https://blog.sekoia.io/wp-content/plugins/wp-rocket/assets/js/lazyload/17.8.3/lazyload.min.js>; rel="canonical"
cdn-status
200
cdn-requestpullsuccess
True
hotjar-3347717.js
static.hotjar.com/c/ 		9 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.hotjar.com/c/hotjar-3347717.js?sv=5
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.102.53 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-102-53.fra56.r.cloudfront.net
Software
/
Resource Hash
e6fd3eb1cdfd3eb43f7cf123feaf5bfb4510052405542acbff11094e251ddbc9
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://blog.sekoia.io/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=2592000; includeSubDomains
content-encoding
br
x-content-type-options
nosniff
date
Wed, 03 Jul 2024 05:23:09 GMT
via
1.1 e44e0b24e706487eaec6b9e01f2166dc.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P2
etag
W/228be2658cc7def45c82050e87182c1c
vary
Accept-Encoding
x-cache
RefreshHit from cloudfront
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
x-cache-hit
1
cache-control
max-age=60
cross-origin-resource-policy
cross-origin
x-amz-cf-id
IKc651B3V86le-AZu-upI3VoBIgesjqByuC4bCGQEE5NEDF-yBertQ==
log
log.cookieyes.com/api/v1/ 		2 B
153 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://log.cookieyes.com/api/v1/log
Requested by
Host: cdn-cookieyes.com
URL: https://cdn-cookieyes.com/client_data/8e62bd9aea8528cd3a8c337f/script.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
99.81.164.152 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-99-81-164-152.eu-west-1.compute.amazonaws.com
Software
/ Express
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-platform
"Win32"
Referer
https://blog.sekoia.io/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type
multipart/form-data; boundary=----WebKitFormBoundaryEDVVKkNClb7spNVq

Response headers

access-control-allow-origin
*
date
Wed, 03 Jul 2024 05:23:09 GMT
x-powered-by
Express
content-length
2
etag
W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc"
content-type
text/plain; charset=utf-8
banner.js
cdn-cookieyes.com/client_data/8e62bd9aea8528cd3a8c337f/ 		100 KB
33 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn-cookieyes.com/client_data/8e62bd9aea8528cd3a8c337f/banner.js
Requested by
Host: cdn-cookieyes.com
URL: https://cdn-cookieyes.com/client_data/8e62bd9aea8528cd3a8c337f/script.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:1408 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fe80d5294e7125d8bad8d9b6edeb66fca0937aaa5c7fd67c002b1f5eeee11303

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://blog.sekoia.io/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 05:23:09 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Tue, 18 Jun 2024 12:55:22 GMT
server
cloudflare
etag
"18e86-61b2998492c23-gzip"
vary
Accept-Encoding
access-control-allow-methods
GET, OPTIONS
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=0, must-revalidate, s-maxage=604800, proxy-revalidate
accept-ranges
bytes
cf-ray
89d4711dbc341eb5-AMS
content-length
33418
truncated
/ 		394 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
0258a377207160921b4def95e08bde2b05f202a1d441850d49502f768e72307d

Request headers

Accept-Language
nl-NL,nl;q=0.9;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		66 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
86db658dfe497e14c80a844f99abed48bb368b88a7ebc047dc3b133267c67bf0

Request headers

Accept-Language
nl-NL,nl;q=0.9;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		64 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b6dcc1490a0cc33cdeed8970677b89bbec6fa095675af198b8e923b64563c70a

Request headers

Accept-Language
nl-NL,nl;q=0.9;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		66 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
c2103f98dab7e47abd92c47030caa47d0dd0595ad21446d0f396a1c1df017da7

Request headers

Accept-Language
nl-NL,nl;q=0.9;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type
image/svg+xml
pxiByp8kv8JHgFVrLGT9Z1xlFQ.woff2
fonts.gstatic.com/s/poppins/v21/ 		8 KB
8 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/poppins/v21/pxiByp8kv8JHgFVrLGT9Z1xlFQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Poppins%3Aital%2Cwght%400%2C400%3B0%2C500%3B0%2C600%3B1%2C300%3B1%2C400%3B1%2C500%3B1%2C600%7CNoto+Sans%3Aital%2Cwght%400%2C400%3B0%2C700%3B1%2C400%3B1%2C700&display=swap&ver=6.5.5
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
cd36de204aca2d5fa263a731f7c20009b5e3d754ba1f1e03c33e93a48f3e7446
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://fonts.googleapis.com/
Origin
https://blog.sekoia.io
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 02 Jul 2024 14:55:50 GMT
x-content-type-options
nosniff
age
52039
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
7748
x-xss-protection
0
last-modified
Fri, 22 Mar 2024 00:01:14 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 02 Jul 2025 14:55:50 GMT
pxiByp8kv8JHgFVrLEj6Z1xlFQ.woff2
fonts.gstatic.com/s/poppins/v21/ 		8 KB
8 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/poppins/v21/pxiByp8kv8JHgFVrLEj6Z1xlFQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Poppins%3Aital%2Cwght%400%2C400%3B0%2C500%3B0%2C600%3B1%2C300%3B1%2C400%3B1%2C500%3B1%2C600%7CNoto+Sans%3Aital%2Cwght%400%2C400%3B0%2C700%3B1%2C400%3B1%2C700&display=swap&ver=6.5.5
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f4e80d9dfd374d02989b87a27b5ed4cb78fbb177c27f1478e9a8b0afb7513149
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://fonts.googleapis.com/
Origin
https://blog.sekoia.io
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 27 Jun 2024 03:04:16 GMT
x-content-type-options
nosniff
age
526733
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
8000
x-xss-protection
0
last-modified
Fri, 22 Mar 2024 00:00:59 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 27 Jun 2025 03:04:16 GMT
o-0bIpQlx3QUlC5A4PNB6Ryti20_6n1iPHjc5a7duw.woff2
fonts.gstatic.com/s/notosans/v36/ 		38 KB
39 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/notosans/v36/o-0bIpQlx3QUlC5A4PNB6Ryti20_6n1iPHjc5a7duw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Poppins%3Aital%2Cwght%400%2C400%3B0%2C500%3B0%2C600%3B1%2C300%3B1%2C400%3B1%2C500%3B1%2C600%7CNoto+Sans%3Aital%2Cwght%400%2C400%3B0%2C700%3B1%2C400%3B1%2C700&display=swap&ver=6.5.5
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
91c01ec0de315f973f4c00041b7ae25e1a790cedff79a6fbb56c571bba379142
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://fonts.googleapis.com/
Origin
https://blog.sekoia.io
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 02 Jul 2024 15:02:49 GMT
x-content-type-options
nosniff
age
51620
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
39412
x-xss-protection
0
last-modified
Wed, 14 Feb 2024 22:43:09 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 02 Jul 2025 15:02:49 GMT
pxiEyp8kv8JHgFVrJJfecg.woff2
fonts.gstatic.com/s/poppins/v21/ 		8 KB
8 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/poppins/v21/pxiEyp8kv8JHgFVrJJfecg.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Poppins%3Aital%2Cwght%400%2C400%3B0%2C500%3B0%2C600%3B1%2C300%3B1%2C400%3B1%2C500%3B1%2C600%7CNoto+Sans%3Aital%2Cwght%400%2C400%3B0%2C700%3B1%2C400%3B1%2C700&display=swap&ver=6.5.5
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
7d93459d86585bfcdbb7e0376056226adb25821ee54b96236fe2123e9560929f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://fonts.googleapis.com/
Origin
https://blog.sekoia.io
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 27 Jun 2024 16:21:03 GMT
x-content-type-options
nosniff
age
478926
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
7884
x-xss-protection
0
last-modified
Fri, 22 Mar 2024 00:00:38 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 27 Jun 2025 16:21:03 GMT
o-0kIpQlx3QUlC5A4PNr4C5OaxRsfNNlKbCePevHtVtX57DGjDU1QDce2VDSyA.woff2
fonts.gstatic.com/s/notosans/v36/ 		14 KB
14 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/notosans/v36/o-0kIpQlx3QUlC5A4PNr4C5OaxRsfNNlKbCePevHtVtX57DGjDU1QDce2VDSyA.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Poppins%3Aital%2Cwght%400%2C400%3B0%2C500%3B0%2C600%3B1%2C300%3B1%2C400%3B1%2C500%3B1%2C600%7CNoto+Sans%3Aital%2Cwght%400%2C400%3B0%2C700%3B1%2C400%3B1%2C700&display=swap&ver=6.5.5
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
50ee69eaa26f0d0f1b40bbbf32dd02ef15ff00c9be25938512ebc1e1d3ec2506
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://fonts.googleapis.com/
Origin
https://blog.sekoia.io
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 27 Jun 2024 03:25:09 GMT
x-content-type-options
nosniff
age
525480
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
14068
x-xss-protection
0
last-modified
Wed, 14 Feb 2024 22:38:47 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 27 Jun 2025 03:25:09 GMT
fa-brands-400.woff2
t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/libraries/fontawesome/webfonts/ 		73 KB
73 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/libraries/fontawesome/webfonts/fa-brands-400.woff2
Requested by
Host: t7f4e9n3.rocketcdn.me
URL: https://t7f4e9n3.rocketcdn.me/wp-content/cache/min/1/wp-content/themes/notizia/assets/libraries/fontawesome/css/all.min.css?ver=1717663978
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1079:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1079 / RocketCDN - b
Resource Hash
eed474a49bdbf745c19e463f070e67977c1ab27835603eb749d9e5c249cf81f8

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://t7f4e9n3.rocketcdn.me/wp-content/cache/min/1/wp-content/themes/notizia/assets/libraries/fontawesome/css/all.min.css?ver=1717663978
Origin
https://blog.sekoia.io
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 05:23:09 GMT
cdn-edgestorageid
1082
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
06/23/2024 12:16:25
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
content-length
74288
last-modified
Wed, 04 Jan 2023 15:13:13 GMT
server
BunnyCDN-DE1-1079
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
"63b59789-12230"
vary
Accept-Encoding
content-type
font/woff2
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
access-control-expose-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control
public, max-age=31919000
cdn-requestid
98908e176f12edc673c8b417961df77f
accept-ranges
bytes
cdn-requestcountrycode
NL
access-control-allow-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status
200
link
<https://blog.sekoia.io/wp-content/themes/notizia/assets/libraries/fontawesome/webfonts/fa-brands-400.woff2>; rel="canonical"
cdn-requestpullsuccess
True
fa-regular-400.woff2
t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/libraries/fontawesome/webfonts/ 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/libraries/fontawesome/webfonts/fa-regular-400.woff2
Requested by
Host: t7f4e9n3.rocketcdn.me
URL: https://t7f4e9n3.rocketcdn.me/wp-content/cache/min/1/wp-content/themes/notizia/assets/libraries/fontawesome/css/all.min.css?ver=1717663978
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1079:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1079 / RocketCDN - b
Resource Hash
0ecdc6188a4b2ec48e2ebf84a2a6584e78473f1216d7119832b5dc109bec7492

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://t7f4e9n3.rocketcdn.me/wp-content/cache/min/1/wp-content/themes/notizia/assets/libraries/fontawesome/css/all.min.css?ver=1717663978
Origin
https://blog.sekoia.io
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 05:23:09 GMT
cdn-edgestorageid
1082
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
06/08/2024 05:10:32
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
content-length
14872
last-modified
Wed, 04 Jan 2023 15:13:13 GMT
server
BunnyCDN-DE1-1079
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
"63b59789-3a18"
vary
Accept-Encoding
content-type
font/woff2
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
access-control-expose-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control
public, max-age=31919000
cdn-requestid
ec97f56dcfabc2504e7c88c785cec9b9
accept-ranges
bytes
cdn-requestcountrycode
NL
access-control-allow-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status
200
link
<https://blog.sekoia.io/wp-content/themes/notizia/assets/libraries/fontawesome/webfonts/fa-regular-400.woff2>; rel="canonical"
cdn-requestpullsuccess
True
pxiGyp8kv8JHgFVrJJLucHtA.woff2
fonts.gstatic.com/s/poppins/v21/ 		8 KB
9 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/poppins/v21/pxiGyp8kv8JHgFVrJJLucHtA.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Poppins%3Aital%2Cwght%400%2C400%3B0%2C500%3B0%2C600%3B1%2C300%3B1%2C400%3B1%2C500%3B1%2C600%7CNoto+Sans%3Aital%2Cwght%400%2C400%3B0%2C700%3B1%2C400%3B1%2C700&display=swap&ver=6.5.5
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
50d0c1742d80ac71f4cde20e8c04d41a24806af342831f479938b527fbff0972
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://fonts.googleapis.com/
Origin
https://blog.sekoia.io
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 02 Jul 2024 15:02:46 GMT
x-content-type-options
nosniff
age
51623
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
8668
x-xss-protection
0
last-modified
Fri, 22 Mar 2024 00:00:54 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 02 Jul 2025 15:02:46 GMT
o-0kIpQlx3QUlC5A4PNr4C5OaxRsfNNlKbCePevHtVtX57DGjDU1QDce2VTSyFtY.woff2
fonts.gstatic.com/s/notosans/v36/ 		8 KB
9 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/notosans/v36/o-0kIpQlx3QUlC5A4PNr4C5OaxRsfNNlKbCePevHtVtX57DGjDU1QDce2VTSyFtY.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Poppins%3Aital%2Cwght%400%2C400%3B0%2C500%3B0%2C600%3B1%2C300%3B1%2C400%3B1%2C500%3B1%2C600%7CNoto+Sans%3Aital%2Cwght%400%2C400%3B0%2C700%3B1%2C400%3B1%2C700&display=swap&ver=6.5.5
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
8b1f5c50c0a0c760863ccfccca303ce8edf692c83aca17cd6b948d9e8d430a86
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://fonts.googleapis.com/
Origin
https://blog.sekoia.io
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 27 Jun 2024 13:08:29 GMT
x-content-type-options
nosniff
age
490480
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
8632
x-xss-protection
0
last-modified
Wed, 14 Feb 2024 22:29:15 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 27 Jun 2025 13:08:29 GMT
modules.e4b2dc39f985f11fb1e4.js
script.hotjar.com/ 		223 KB
56 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://script.hotjar.com/modules.e4b2dc39f985f11fb1e4.js
Requested by
Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-3347717.js?sv=5
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.27.54 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-27-54.fra56.r.cloudfront.net
Software
/
Resource Hash
619feac205d68f6356fcad13d6758533011a8acc7830e3deb0f763249d7516c0
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://blog.sekoia.io/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 01 Jul 2024 08:11:07 GMT
content-encoding
br
x-content-type-options
nosniff
strict-transport-security
max-age=2592000; includeSubDomains
via
1.1 a7631312afe99e40229aa0da70662112.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-C2
age
162722
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
content-length
56291
last-modified
Mon, 01 Jul 2024 08:10:34 GMT
etag
"ca025d2d8ae4b3dc51e058b782590501"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
x-robots-tag
none
x-amz-cf-id
ahst_jehHAPHIpS1loU6RAoGa5HheUpiObSyXuy37XDLZbxgR3TA8w==
admin-ajax.php
blog.sekoia.io/wp-admin/ 		3 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://blog.sekoia.io/wp-admin/admin-ajax.php
Requested by
Host: t7f4e9n3.rocketcdn.me
URL: https://t7f4e9n3.rocketcdn.me/wp-includes/js/jquery/jquery.min.js?ver=3.7.1
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.214.255.233 Groningen, Netherlands, ASN15169 (GOOGLE, US),
Reverse DNS
233.255.214.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
a2c43eefd1ba78e4297fbc14c5388a9147664cde72814be9cbbb558d532063c7
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
Strict-Transport-Security max-age=63072000; includeSubDomains
X-Content-Security-Policy default-src 'self'; img-src *; media-src * data:;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8
Accept
*/*
Referer
https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/
X-Requested-With
XMLHttpRequest
sec-ch-ua-platform
"Win32"

Response headers

expires
Wed, 11 Jan 1984 05:00:00 GMT
date
Wed, 03 Jul 2024 05:23:09 GMT
content-security-policy
upgrade-insecure-requests;
x-content-type-options
nosniff
strict-transport-security
max-age=63072000; includeSubDomains
content-encoding
br
x-permitted-cross-domain-policies
none
cross-origin-embedder-policy
unsafe-none; report-to='default'
x-proxy-cache-info
DT:1
cross-origin-resource-policy
cross-origin
x-httpd-modphp
1
host-header
8441280b0c35cbc1147f8ba998a563a7
x-xss-protection
1; mode=block
cross-origin-embedder-policy-report-only
unsafe-none; report-to='default'
referrer-policy
strict-origin-when-cross-origin
server
nginx
cross-origin-opener-policy
unsafe-none
vary
Accept-Encoding, Accept-Encoding,User-Agent
x-frame-options
SAMEORIGIN
content-type
text/html; charset=UTF-8
access-control-allow-origin
https://blog.sekoia.io
access-control-allow-methods
GET,POST
cache-control
no-cache, must-revalidate, max-age=0
access-control-allow-credentials
true
permissions-policy
accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(self), encrypted-media=(), fullscreen=*, geolocation=(self), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=*, picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), xr-spatial-tracking=(), gamepad=(), serial=()
x-robots-tag
noindex
access-control-allow-headers
Content-Type, Authorization
cross-origin-opener-policy-report-only
unsafe-none; report-to='default'
x-content-security-policy
default-src 'self'; img-src *; media-src * data:;
truncated
/ 		43 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
nl-NL,nl;q=0.9;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type
image/gif
collect
region1.analytics.google.com/g/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://region1.analytics.google.com/g/collect?v=2&tid=G-9XJJ1LP075&gtm=45Pe4710v9114055258za200&_p=1719984188810&_gaz=1&gcd=13l3l3l2l1&npa=1&dma_cps=sypham&dma=1&tag_exp=0&gdid=dZTNiMT&cid=1472557891.1719984189&ul=nl-nl&sr=1600x1200&ir=1&uaa=x86&uab=64&uafvl=Not%252FA)Brand%3B8.0.0.0%7CChromium%3B126.0.6478.126%7CGoogle%2520Chrome%3B126.0.6478.126&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&are=1&frm=0&pscdl=noapi&_eu=EA&_s=1&sid=1719984189&sct=1&seg=0&dl=https%3A%2F%2Fblog.sekoia.io%2Fexposing-fakebat-loader-distribution-methods-and-adversary-infrastructure%2F&dt=Exposing%20FakeBat%20loader%3A%20distribution%20methods%20and%20adversary%20infrastructure&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=990&_z=fetch
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=GT-MQXZQ8K
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://blog.sekoia.io/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Wed, 03 Jul 2024 05:23:09 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://blog.sekoia.io
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/g/ 		0
253 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/g/collect?v=2&tid=G-9XJJ1LP075&cid=1472557891.1719984189&gtm=45Pe4710v9114055258za200&aip=1&dma=1&dma_cps=sypham&gcd=13l3l3l2l1&npa=1&frm=0
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=GT-MQXZQ8K
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c00::9b Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://blog.sekoia.io/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Wed, 03 Jul 2024 05:23:09 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://blog.sekoia.io
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
js
www.googletagmanager.com/gtag/ 		307 KB
103 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=G-12N1XPRQ0H&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=GT-MQXZQ8K
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
3413d12d4acc8dfc0674f77dbaa453009ec83f008b269aca99b5edd68e42dd2a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://blog.sekoia.io/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 05:23:09 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
105101
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Wed, 03 Jul 2024 05:23:09 GMT
ga-audiences
www.google.nl/ads/ 		42 B
408 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.nl/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-9XJJ1LP075&cid=1472557891.1719984189&gtm=45Pe4710v9114055258za200&aip=1&dma=1&dma_cps=sypham&gcd=13l3l3l2l1&npa=1&frm=0&z=1329358048
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://blog.sekoia.io/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Wed, 03 Jul 2024 05:23:09 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
script.js
cdn-cookieyes.com/client_data/src=%22https://cdn-cookieyes.com/client_data/8e62bd9aea8528cd3a8c337f/script.js%22/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn-cookieyes.com/client_data/src=%22https://cdn-cookieyes.com/client_data/8e62bd9aea8528cd3a8c337f/script.js%22/script.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-K8T6VX2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:1408 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://blog.sekoia.io/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 05:23:09 GMT
content-encoding
br
cf-cache-status
HIT
server
cloudflare
age
64977
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
access-control-allow-origin
*
cache-control
max-age=0, s-maxage=604800, proxy-revalidate
cf-ray
89d4711f9cf41eb5-AMS
hotjar-3133674.js
static.hotjar.com/c/ 		9 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.hotjar.com/c/hotjar-3133674.js?sv=7
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-K8T6VX2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.102.53 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-102-53.fra56.r.cloudfront.net
Software
/
Resource Hash
d375cbf668234b83e732a9a326a187066afdd5b6ed18b9caffb050a94ab5f386
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://blog.sekoia.io/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 05:23:09 GMT
content-encoding
br
x-content-type-options
nosniff
strict-transport-security
max-age=2592000; includeSubDomains
via
1.1 e44e0b24e706487eaec6b9e01f2166dc.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P2
etag
W/6d15affb011440c850556bfed6dd25c0
vary
Accept-Encoding
x-cache
Miss from cloudfront
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
max-age=60
x-cache-hit
1
cross-origin-resource-policy
cross-origin
x-amz-cf-id
n4kGH0M6IM3GoBFaN_YZ8PbKCht-PJ2_y2bwwL19J7OZdgGF6bwo-w==
insight.min.js
snap.licdn.com/li.lms-analytics/ 		38 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-K8T6VX2
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:9400::215:2248 Paris, France, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
942a9ba1fe78b402e8b52b83058dbbabde8db6b4d1debf960d6d5afe5192db52
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://blog.sekoia.io/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 05:23:09 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 18 Jun 2024 16:46:52 GMT
x-cdn
AKAM
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
content-type
application/javascript;charset=utf-8
cache-control
max-age=50709
accept-ranges
bytes
content-length
14004
munchkin.js
munchkin.marketo.net/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://munchkin.marketo.net/munchkin.js
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
184.31.85.59 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-31-85-59.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://blog.sekoia.io/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Wed, 03 Jul 2024 05:23:09 GMT
Content-Encoding
gzip
Last-Modified
Fri, 17 Mar 2023 01:24:48 GMT
Server
AkamaiNetStorage
ETag
"cb731cc5c2bd9f31d6bfeb19f3c8b1ff:1679016288.730763"
Vary
Accept-Encoding
Content-Type
application/x-javascript
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
729
js
www.googletagmanager.com/gtag/ 		208 KB
75 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=UA-152945562-2&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-12N1XPRQ0H
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
31037d01ced224a852b82fc29efcfbf17dd3bd10a19f699eabb2524c342f3a2a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://blog.sekoia.io/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 05:23:09 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
76841
x-xss-protection
0
last-modified
Wed, 03 Jul 2024 03:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Wed, 03 Jul 2024 05:23:09 GMT
collect
region1.google-analytics.com/g/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://region1.google-analytics.com/g/collect?v=2&tid=G-12N1XPRQ0H&gtm=45je4710v876103120z89105367108za200zb9114055258&_p=1719984188810&gcs=G100&gcd=13u3u3q2q5&npa=1&dma_cps=-&dma=1&tag_exp=0&gdid=dY2Q2ZW&cid=250530858.1719984189&ul=nl-nl&sr=1600x1200&uaa=x86&uab=64&uafvl=Not%252FA)Brand%3B8.0.0.0%7CChromium%3B126.0.6478.126%7CGoogle%2520Chrome%3B126.0.6478.126&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&are=1&frm=0&pscdl=denied&_s=1&sid=1719984189&sct=1&seg=0&dl=https%3A%2F%2Fblog.sekoia.io%2Fexposing-fakebat-loader-distribution-methods-and-adversary-infrastructure%2F&dt=Exposing%20FakeBat%20loader%3A%20distribution%20methods%20and%20adversary%20infrastructure&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=1033&_z=fetch
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-12N1XPRQ0H
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://blog.sekoia.io/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Wed, 03 Jul 2024 05:23:09 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://blog.sekoia.io
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
munchkin.js
munchkin.marketo.net/163/ 		11 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://munchkin.marketo.net/163/munchkin.js
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
184.31.85.59 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-31-85-59.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://blog.sekoia.io/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Wed, 03 Jul 2024 05:23:09 GMT
Content-Encoding
gzip
Last-Modified
Fri, 06 Jan 2023 02:26:40 GMT
Server
AkamaiNetStorage
ETag
"ea7826f34518d7c2295738f39c7640fa:1672972000.238769"
Vary
Accept-Encoding
Content-Type
application/x-javascript
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control
max-age=8640000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
4741
Expires
Fri, 11 Oct 2024 05:23:09 GMT
analytics.js
www.google-analytics.com/ 		52 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-152945562-2&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://blog.sekoia.io/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Wed, 03 Jul 2024 04:29:07 GMT
last-modified
Tue, 12 Dec 2023 18:09:08 GMT
server
Golfe2
age
3242
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20994
expires
Wed, 03 Jul 2024 06:29:07 GMT
/
px.ads.linkedin.com/wa/ 		0
724 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://px.ads.linkedin.com/wa/
Requested by
Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8
Accept
*
Referer
https://blog.sekoia.io/
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 05:23:08 GMT
x-li-pop
afd-prod-lva1-x
x-msedge-ref
Ref A: E216116326604DD4AB7B6FD9AF57617B Ref B: AMS04EDGE3116 Ref C: 2024-07-03T05:23:09Z
linkedin-action
1
vary
Origin
x-cache
CONFIG_NOCACHE
x-li-fabric
prod-lor1
access-control-allow-origin
https://blog.sekoia.io
x-li-source-fabric
prod-lva1
x-li-proto
http/2
access-control-allow-credentials
true
x-li-uuid
AAYcUQakNADzKC6ww957iw==
attribution_trigger
px.ads.linkedin.com/ 		2 B
842 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://px.ads.linkedin.com/attribution_trigger?pid=5046826&time=1719984189503&url=https%3A%2F%2Fblog.sekoia.io%2Fexposing-fakebat-loader-distribution-methods-and-adversary-infrastructure%2F%23h-iocs&tm=gtmv2
Requested by
Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Accept
*
Referer
https://blog.sekoia.io/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 05:23:09 GMT
content-encoding
gzip
x-li-pop
afd-prod-lva1-x
x-msedge-ref
Ref A: D0CD38FFC5E74F69B68AC7ADC5A31D5C Ref B: DUS30EDGE0710 Ref C: 2024-07-03T05:23:09Z
access-control-allow-methods
GET, OPTIONS
x-li-fabric
prod-lor1
access-control-allow-origin
*
x-li-source-fabric
prod-lva1
content-type
application/json
x-li-proto
http/2
x-restli-protocol-version
1.0.0
x-cache
CONFIG_NOCACHE
access-control-allow-headers
*
x-li-uuid
AAYcUQakTM29NFs+9wFqXw==
x-fs-uuid
00061c5106a44ccdbd345b3ef7016a5f
collect
px4.ads.linkedin.com/
Redirect Chain
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=5046826&time=1719984189503&url=https%3A%2F%2Fblog.sekoia.io%2Fexposing-fakebat-loader-distribution-methods-and-adversary-infrastructure%2F%23h-ioc...
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=5046826&time=1719984189503&url=https%3A%2F%2Fblog.sekoia.io%2Fexposing-fakebat-loader-distribution-methods-and-adversary-infrastructure%2F%23h-io...
0
265 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=5046826&time=1719984189503&url=https%3A%2F%2Fblog.sekoia.io%2Fexposing-fakebat-loader-distribution-methods-and-adversary-infrastructure%2F%23h-iocs&tm=gtmv2&e_ipv6=AQJVbaqLSo2X3AAAAZB3C_DoLQp1iG2l94CRXaj7NiksGS_px4quO6Wa5YAsRYYe91LmOw
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/
Protocol
H2
Server
13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
nl-NL,nl;q=0.9;q=0.9
Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Wed, 03 Jul 2024 05:23:09 GMT
x-li-pop
afd-prod-lor1-x
x-msedge-ref
Ref A: 2901ADEB04A5429C95B80377FEB5BF80 Ref B: AMS04EDGE2910 Ref C: 2024-07-03T05:23:09Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
content-type
application/javascript
x-li-fabric
prod-lor1
x-li-proto
http/2
content-length
0
x-li-uuid
AAYcUQaogkF0ixKVoOfIYw==

Redirect headers

date
Wed, 03 Jul 2024 05:23:08 GMT
x-li-pop
afd-prod-lva1-x
x-msedge-ref
Ref A: B564A658A98549A09686BA240BEC738F Ref B: AMS04EDGE3116 Ref C: 2024-07-03T05:23:09Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
x-li-fabric
prod-lor1
location
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=5046826&time=1719984189503&url=https%3A%2F%2Fblog.sekoia.io%2Fexposing-fakebat-loader-distribution-methods-and-adversary-infrastructure%2F%23h-iocs&tm=gtmv2&e_ipv6=AQJVbaqLSo2X3AAAAZB3C_DoLQp1iG2l94CRXaj7NiksGS_px4quO6Wa5YAsRYYe91LmOw
x-li-source-fabric
prod-lva1
x-li-proto
http/2
content-length
0
x-li-uuid
AAYcUQakMjVh6EvSgNqtXQ==
visitWebPage
362-pti-203.mktoresp.com/webevents/ 		2 B
318 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://362-pti-203.mktoresp.com/webevents/visitWebPage?_mchNc=1719984189518&_mchCn=&_mchId=362-PTI-203&_mchTk=_mch-blog.sekoia.io-1719984189517-50876&_mchHo=blog.sekoia.io&_mchPo=&_mchRu=%2Fexposing-fakebat-loader-distribution-methods-and-adversary-infrastructure%2F&_mchPc=https%3A&_mchVr=163&_mchEcid=&_mchHa=%23h-iocs&_mchRe=&_mchQp=
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/163/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
130.248.173.59 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software
nginx/1.20.1 /
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://blog.sekoia.io/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Wed, 03 Jul 2024 05:23:09 GMT
Content-Encoding
gzip
Server
nginx/1.20.1
Transfer-Encoding
chunked
Content-Type
text/plain; charset=UTF-8
Access-Control-Allow-Origin
*
Connection
keep-alive
X-Request-Id
8315d879-c92e-41c8-b959-e5078347f9eb
collect
www.google-analytics.com/ 		35 B
194 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/collect?v=1&_v=j101&a=1626107850&t=pageview&_s=1&dl=https%3A%2F%2Fblog.sekoia.io%2Fexposing-fakebat-loader-distribution-methods-and-adversary-infrastructure%2F&ul=nl-nl&de=UTF-8&dt=Exposing%20FakeBat%20loader%3A%20distribution%20methods%20and%20adversary%20infrastructure&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YAgAAQABAAAAAAAAIk~&cid=250530858.1719984189&tid=UA-152945562-2&_gid=867226797.1719984190&gtm=457e4710z8876103120za200zb876103120&gcs=G100&gcd=13u3u3q2q5&dma_cps=-&dma=1&tag_exp=0&did=dY2Q2ZW&gdid=dY2Q2ZW&jsscut=1&npa=1&z=1053399669
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://blog.sekoia.io/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Tue, 02 Jul 2024 22:55:53 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
23236
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
zyxNi_sI.json
cdn-cookieyes.com/client_data/8e62bd9aea8528cd3a8c337f/ 		44 B
335 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://cdn-cookieyes.com/client_data/8e62bd9aea8528cd3a8c337f/zyxNi_sI.json
Requested by
Host: cdn-cookieyes.com
URL: https://cdn-cookieyes.com/client_data/8e62bd9aea8528cd3a8c337f/banner.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:1408 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f8c098c6bed7611f3c2d1dc4c546ad3a3ee45ae270e3f1a68248e6481c2dd371

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://blog.sekoia.io/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 05:23:10 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Tue, 18 Jun 2024 12:55:22 GMT
server
cloudflare
age
54685
etag
W/"2c-61b2998495b03"
vary
Accept-Encoding
access-control-allow-methods
GET, OPTIONS
content-type
application/json
access-control-allow-origin
*
cache-control
max-age=0, must-revalidate, s-maxage=604800, proxy-revalidate
cf-ray
89d47123ef855c4b-AMS
Fav_Sekoia.svg
t7f4e9n3.rocketcdn.me/wp-content/uploads/2023/03/ 		2 KB
2 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://t7f4e9n3.rocketcdn.me/wp-content/uploads/2023/03/Fav_Sekoia.svg
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1079:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1079 / RocketCDN - b
Resource Hash
018478a657fb232c5d4284853dd8300c652bd905b23f47c66de77ed6e9c99031

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://blog.sekoia.io/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 05:23:10 GMT
content-encoding
br
cdn-edgestorageid
1082
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
03/08/2024 14:27:14
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
last-modified
Thu, 30 Mar 2023 12:30:54 GMT
server
BunnyCDN-DE1-1079
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"642580fe-8b8"
vary
Accept-Encoding, Accept-Encoding
content-type
image/svg+xml
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control
public, max-age=31919000
cdn-requestid
5cca85a1ffd478d2afbd08e80a4e6662
cdn-requestcountrycode
NL
link
<https://blog.sekoia.io/wp-content/uploads/2023/03/Fav_Sekoia.svg>; rel="canonical"
cdn-status
200
cdn-requestpullsuccess
True
ls-Gg7-i.json
cdn-cookieyes.com/client_data/8e62bd9aea8528cd3a8c337f/config/ 		33 KB
6 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://cdn-cookieyes.com/client_data/8e62bd9aea8528cd3a8c337f/config/ls-Gg7-i.json
Requested by
Host: cdn-cookieyes.com
URL: https://cdn-cookieyes.com/client_data/8e62bd9aea8528cd3a8c337f/banner.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:1408 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f04453fd8f79412ed72026040628f50302c9c8ff0488102c71459c9273f1a06b

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://blog.sekoia.io/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 05:23:10 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Tue, 18 Jun 2024 12:55:22 GMT
server
cloudflare
age
54684
etag
W/"850c-61b2998493bc3"
vary
Accept-Encoding
access-control-allow-methods
GET, OPTIONS
content-type
application/json
access-control-allow-origin
*
cache-control
max-age=0, must-revalidate, s-maxage=604800, proxy-revalidate
cf-ray
89d471240f9a5c4b-AMS
qiwN5qP9.json
cdn-cookieyes.com/client_data/8e62bd9aea8528cd3a8c337f/translations/ 		2 KB
816 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://cdn-cookieyes.com/client_data/8e62bd9aea8528cd3a8c337f/translations/qiwN5qP9.json
Requested by
Host: cdn-cookieyes.com
URL: https://cdn-cookieyes.com/client_data/8e62bd9aea8528cd3a8c337f/banner.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:1408 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
14612faefc54e67007084332e850f554ca6ba980bebd2f88beb4051dffa87d61

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://blog.sekoia.io/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 05:23:10 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Tue, 18 Jun 2024 12:55:22 GMT
server
cloudflare
age
54684
etag
W/"6ef-61b2998495b03"
vary
Accept-Encoding
access-control-allow-methods
GET, OPTIONS
content-type
application/json
access-control-allow-origin
*
cache-control
max-age=0, must-revalidate, s-maxage=604800, proxy-revalidate
cf-ray
89d471243fc15c4b-AMS
9NWgp4E_.json
cdn-cookieyes.com/client_data/8e62bd9aea8528cd3a8c337f/audit-table/ 		7 KB
2 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://cdn-cookieyes.com/client_data/8e62bd9aea8528cd3a8c337f/audit-table/9NWgp4E_.json
Requested by
Host: cdn-cookieyes.com
URL: https://cdn-cookieyes.com/client_data/8e62bd9aea8528cd3a8c337f/banner.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:1408 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7701df7dd40eb9b322409a3b14193dd8613222619445be2ee6797bb1721d1138

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://blog.sekoia.io/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 05:23:10 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Tue, 18 Jun 2024 12:55:22 GMT
server
cloudflare
age
54684
etag
W/"1afa-61b2998492c23"
vary
Accept-Encoding
access-control-allow-methods
GET, OPTIONS
content-type
application/json
access-control-allow-origin
*
cache-control
max-age=0, must-revalidate, s-maxage=604800, proxy-revalidate
cf-ray
89d471246fe15c4b-AMS
revisit.svg
cdn-cookieyes.com/assets/images/ 		2 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn-cookieyes.com/assets/images/revisit.svg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:1408 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ed7c487f915432d9464e2af0a83002ee93596e86e076f3c917e439e5b844d08b

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://blog.sekoia.io/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 05:23:10 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Tue, 15 Mar 2022 04:40:47 GMT
server
cloudflare
age
564015
etag
W/"923-5da3a668dacc0"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
max-age=0, s-maxage=604800, proxy-revalidate
cf-ray
89d471249e981eb5-AMS
close.svg
cdn-cookieyes.com/assets/images/ 		1 KB
773 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn-cookieyes.com/assets/images/close.svg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:1408 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a049e1abe441835a2bcf35258936072189a0a52d0000c4ed2094e59d2afd189b

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://blog.sekoia.io/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 05:23:10 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Tue, 15 Mar 2022 04:40:50 GMT
server
cloudflare
age
554511
etag
W/"541-5da3a66c769d4"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
max-age=0, s-maxage=604800, proxy-revalidate
cf-ray
89d471249e991eb5-AMS
poweredbtcky.svg
cdn-cookieyes.com/assets/images/ 		4 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn-cookieyes.com/assets/images/poweredbtcky.svg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:1408 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
911f58b8d14bd6f73a83fd774e44bec97e896317c7093dc83e96921e64f1fbd5

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://blog.sekoia.io/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 05:23:10 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Tue, 15 Mar 2022 04:41:24 GMT
server
cloudflare
age
564015
etag
W/"eb2-5da3a68c50d09"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
max-age=0, s-maxage=604800, proxy-revalidate
cf-ray
89d471249e9a1eb5-AMS
log
log.cookieyes.com/api/v1/ 		2 B
152 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://log.cookieyes.com/api/v1/log
Requested by
Host: cdn-cookieyes.com
URL: https://cdn-cookieyes.com/client_data/8e62bd9aea8528cd3a8c337f/script.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
99.81.164.152 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-99-81-164-152.eu-west-1.compute.amazonaws.com
Software
/ Express
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-platform
"Win32"
Referer
https://blog.sekoia.io/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type
multipart/form-data; boundary=----WebKitFormBoundarySZAwypxcYs9LNUmQ

Response headers

access-control-allow-origin
*
date
Wed, 03 Jul 2024 05:23:10 GMT
x-powered-by
Express
content-length
2
etag
W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc"
content-type
text/plain; charset=utf-8
collect
region1.google-analytics.com/g/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://region1.google-analytics.com/g/collect?v=2&tid=G-12N1XPRQ0H&gtm=45je4710v876103120za200zb9114055258&_p=1719984188810&gcs=G100&gcd=13u3u3q2q5&npa=1&dma_cps=-&dma=1&tag_exp=0&gdid=dY2Q2ZW.dZTNiMT&cid=250530858.1719984189&ul=nl-nl&sr=1600x1200&uaa=x86&uab=64&uafvl=Not%252FA)Brand%3B8.0.0.0%7CChromium%3B126.0.6478.126%7CGoogle%2520Chrome%3B126.0.6478.126&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&are=1&frm=0&pscdl=denied&_eu=AAAC&_s=2&sid=1719984189&sct=1&seg=1&dl=https%3A%2F%2Fblog.sekoia.io%2Fexposing-fakebat-loader-distribution-methods-and-adversary-infrastructure%2F&dt=Exposing%20FakeBat%20loader%3A%20distribution%20methods%20and%20adversary%20infrastructure&en=page_view&_ee=1&_et=2&tfd=6036&_z=fetch
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-12N1XPRQ0H
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://blog.sekoia.io/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Wed, 03 Jul 2024 05:23:14 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://blog.sekoia.io
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

204 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 undefined| event object| fence object| sharedStorage object| dataLayer object| feather undefined| $ function| jQuery number| admin_b_height number| s_s_width function| notizia_show_reading_center function| notizia_show_reading_list object| alerts object| notiziaUrls boolean| loading number| post_not_in undefined| perpage undefined| post_id function| notizia_get_reading_center_data function| notizia_reading_center_bind_load_more function| notizia_reading_center_bind_close function| notizia_get_reading_list_data function| notizia_reading_list_bind_load_more function| notizia_reading_list_bind_remove function| notizia_reading_list_auto_remove object| notizia_Tools_Urls object| localized_tools_string undefined| container_width undefined| tweet_text undefined| blockquote_p_n undefined| active_modal string| user_menu boolean| has_main_menu boolean| has_second_menu string| header_type undefined| el2_height number| admin_bar_height undefined| captcha_result undefined| captcha_one undefined| captcha_two undefined| captcha_user number| display_width boolean| is_loading boolean| login_error function| notizia_tools_bind_user_buttons function| notizia_tools_bind_load_more function| notizia_tools_load_more function| notizia_tools_adjust_blocks_css object| __FOUNDATION_EXTERNAL__ object| Foundation function| gtag object| _hsq function| hj object| _hjSettings object| cookieyes object| leadin_wordpress object| molongui_authorship_byline_params function| _createClass function| _classCallCheck function| RocketBrowserCompatibilityChecker object| RocketPreloadLinksConfig object| rocket_lazyload_css_data object| notizia_t_Urls object| localized_strings undefined| elem_pos undefined| bg_src undefined| timer undefined| timer2 undefined| el_height undefined| $form undefined| $form_s undefined| decorations string| decorations_type string| decorations_classes undefined| current_page_pagination undefined| width_wo_header undefined| delta_width number| tags_container_height undefined| span_id undefined| width_wo_header_orig undefined| n_columns undefined| this_column number| menu_elements_total_width undefined| ecz_layout undefined| ecz_swiper undefined| ecz_id undefined| ecz_swiper_count undefined| slides_per_view undefined| first_transition undefined| scroll_element string| category_text undefined| search_process undefined| titles_content undefined| active_slide undefined| title_string undefined| title_string_length undefined| this_loop_n undefined| offset undefined| total undefined| where undefined| posts_per_page undefined| cat undefined| tag undefined| author undefined| search_query undefined| year undefined| month undefined| day undefined| tax_type undefined| tax_id undefined| megamenu_active undefined| megamenu_classes undefined| megamenu_cats undefined| megamenu_tags undefined| megamenu_posts undefined| megamenu_authors undefined| megamenu_count undefined| megamenu_howmany undefined| megamenu_n undefined| megamenu_timer undefined| megamenu_translate_in undefined| megamenu_translate_out undefined| megamenu_desc_words undefined| megamenu_show_date undefined| this_megamenu undefined| megamenu_offset undefined| this_megamenu_inner undefined| $this_card number| s_width number| scrollt number| scrollb number| lastscrollt boolean| hamburger_open boolean| has_first_menu boolean| has_social_menu number| count_loops boolean| megamenu_is_active object| notizia_main_menu_1 function| notizia_add_body_classes function| notizia_set_menu_elements_alignment function| notizia_animate_elements_scroll function| notizia_append_loaders function| notizia_hide_alert function| notizia_place_elements function| notizia_initialize_lightbox function| notizia_email_validation function| notizia_close_panel function| notizia_change_logo function| notizia_adjust_columns function| notizia_eye_catching_swiper function| notizia_adjust_eye_catching_elements function| notizia_bind_eye_catching_events function| notizia_observe_dom function| Swiper object| regeneratorRuntime function| revisitCkyConsent function| performBannerAction function| getCkyConsent object| lightbox object| notizia_Urls undefined| cat_content undefined| cat_post_number undefined| cat_link undefined| $this_widget undefined| $this_widget_categories undefined| $this_widget_sub undefined| cat_ids undefined| cat_classes undefined| cat_count undefined| this_widget_cat_id undefined| archive_content undefined| archive_link undefined| archive_post_number undefined| widget_count undefined| this_widget_count number| cat_widget_id function| notizia_set_categories_style object| lazyLoadOptions object| hjSiteSettings function| hjBootstrap object| hjLazyModules object| hjBootstrapCalled function| LazyLoad object| images boolean| is_image object| iframes boolean| is_iframe object| rocket_lazy object| google_tag_manager object| google_tag_data object| gaGlobal object| _linkedin_data_partner_ids boolean| _already_called_lintrk function| onYouTubeIframeAPIReady function| mktoMunchkinFunction object| Munchkin function| mktoMunchkin string| GoogleAnalyticsObject function| ga function| lintrk object| ORIBILI object| MunchkinTracker object| gaplugins object| gaData

4 Cookies

Domain/Path Name / Value
.linkedin.com/ Name: lidc
Value: "b=OGST09:s=O:r=O:a=O:p=O:g=2865:u=1:x=1:i=1719984189:t=1720070589:v=2:sig=AQGFreDibVHcwAzwbE-o38d-ysA4033D"
.linkedin.com/ Name: bcookie
Value: "v=2&6e4b4064-25d0-4834-8300-ce5f83a06b2e"
.linkedin.com/ Name: li_gc
Value: MTswOzE3MTk5ODQxODk7MjswMjH1PXamNIli+XN1dVtGJoDDrPpH9LXjIrlkuYdeXy08lw==
.blog.sekoia.io/ Name: cookieyes-consent
Value: consentid:VGNaeXBnZ0JMNnVPcG1uY3pLZ3dvcFlJYmJXeGVBcmc,consent:no,action:,necessary:yes,functional:no,analytics:no,performance:no,advertisement:no,other:no,lastRenewedDate:1716906604000

2 Console Messages

Source Level URL
Text
network error URL: https://cdn-cookieyes.com/client_data/src=%22https://cdn-cookieyes.com/client_data/8e62bd9aea8528cd3a8c337f/script.js%22/script.js
Message:
Failed to load resource: the server responded with a status of 403 ()
javascript warning URL: https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/#h-iocs
Message:
The resource https://t7f4e9n3.rocketcdn.me/wp-content/uploads/2024/07/fakebat_background.png was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy upgrade-insecure-requests;
Strict-Transport-Security max-age=63072000; includeSubDomains
X-Content-Security-Policy default-src 'self'; img-src *; media-src * data:;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

362-pti-203.mktoresp.com
blog.sekoia.io
cdn-cookieyes.com
fonts.googleapis.com
fonts.gstatic.com
js.hs-scripts.com
log.cookieyes.com
munchkin.marketo.net
px.ads.linkedin.com
px4.ads.linkedin.com
region1.analytics.google.com
region1.google-analytics.com
script.hotjar.com
snap.licdn.com
static.hotjar.com
stats.g.doubleclick.net
t7f4e9n3.rocketcdn.me
www.google-analytics.com
www.google.nl
www.googletagmanager.com
13.107.42.14
13.32.27.54
130.248.173.59
18.66.102.53
184.31.85.59
2001:4860:4802:32::36
2400:52e0:1e00::1079:1
2606:4700:10::ac43:1408
2606:4700::6810:89d1
2620:1ec:21::14
2a00:1450:4001:806::200a
2a00:1450:4001:82a::200e
2a00:1450:4001:82f::2003
2a00:1450:4001:830::2003
2a00:1450:4001:830::2008
2a00:1450:400c:c00::9b
2a02:26f0:9400::215:2248
35.214.255.233
99.81.164.152
018478a657fb232c5d4284853dd8300c652bd905b23f47c66de77ed6e9c99031
0258a377207160921b4def95e08bde2b05f202a1d441850d49502f768e72307d
04e8cde8d717404bb5cd8983f6a7817994b4434b70c0a2d834dd02dfb8297187
08674dbb7419f9e5a5e6310436d0cd84559d92789fa278b9876fdedac7dec06f
0ab10cbd66e537859e4a75a22fd8e3ac547eec9b4276e12e70e13700817763e9
0ecdc6188a4b2ec48e2ebf84a2a6584e78473f1216d7119832b5dc109bec7492
129c8dd408b302e29db500ca187cac1136fde1e3f8731e91ecf3129f4148f23f
14612faefc54e67007084332e850f554ca6ba980bebd2f88beb4051dffa87d61
175202eabfde37a4bfc6d0d646ff0818908491e556eda5a911d204e00afa5859
1b0e165a72588997e984e9055ce36b40c4aba3a4d45567b7af95f1cf2af23ba4
24fbf98a0312aa6db3b49c6d8e2ba9d2ae8d316bbb2f731b327f45ab23e07dda
250354fad29f1a85fc4e431b09faeccbf0275f5d5afdf6faf422936b206f25ab
28b58d1719430b0a469ec4afa2b8b7c1a4a801fe8734d73b273db0d01b788ea3
31037d01ced224a852b82fc29efcfbf17dd3bd10a19f699eabb2524c342f3a2a
3413d12d4acc8dfc0674f77dbaa453009ec83f008b269aca99b5edd68e42dd2a
36c5a1bea1a435627251c30ee5c547b82c6791ece004325f0441f2a58ca56452
3cbefb9b0f14015aba9d624075ae01b1ce1101fea52838241708ef22783f49be
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
4878923038c55038c628de10f98d6610d6ca597b506733e6bd6972aa73ae37d3
48ad7fc9c26959cc4e41c1addf2f513215b9f48f6e46e587286215ea3b3e1d2b
50d0c1742d80ac71f4cde20e8c04d41a24806af342831f479938b527fbff0972
50ee69eaa26f0d0f1b40bbbf32dd02ef15ff00c9be25938512ebc1e1d3ec2506
5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4
5259d3d1db0ab9bbb835ea4bb25b69be5db7366bda907678b2d9272b52fbc1ed
5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
5da7118ba9a235cf7886a940fee43e57077adbe94af4d3f6117ca3aee39946a1
5dfcdd882f92d647a26beb3d974ef2ef27b96bcef8b01abaef32b8bbb2d38ef9
5e3b5a5069534703b6b441668a33d3aecd877044e2bb8ff0bbb564c5f23a29ae
619feac205d68f6356fcad13d6758533011a8acc7830e3deb0f763249d7516c0
6682a68c5c46a2a32746bf93906dbc12b735344b8fbd8d8891e317e4de82f687
67e602a944bcceb8eec54d907ddac6feca2610c15f37bba5877a410826bf78c0
68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23
6cebe21539559e9c48fbfe65e91dee01455111406e02929814d913b1ec5ea942
70ce504aea1307c87370b3d7ebc41138b6917d728121ebbc81e0e7941beffe1f
7701df7dd40eb9b322409a3b14193dd8613222619445be2ee6797bb1721d1138
7d93459d86585bfcdbb7e0376056226adb25821ee54b96236fe2123e9560929f
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
86db658dfe497e14c80a844f99abed48bb368b88a7ebc047dc3b133267c67bf0
871876a93786ce9cbcf5cff222a14cf184da2c2b4aa74de28a3ec68aba508541
8b1f5c50c0a0c760863ccfccca303ce8edf692c83aca17cd6b948d9e8d430a86
902d9c0591da116384b2642524023ef99fa6db18fc53d1bd7bf93c67ddd75aa4
911f58b8d14bd6f73a83fd774e44bec97e896317c7093dc83e96921e64f1fbd5
91c01ec0de315f973f4c00041b7ae25e1a790cedff79a6fbb56c571bba379142
942a9ba1fe78b402e8b52b83058dbbabde8db6b4d1debf960d6d5afe5192db52
98cecf88a23542fa047ce46eedb650b5c5128761ed4386c0977b847094ddfa20
9af0f4e90a7cba0dbe38575666bfedf0e853278155957eb78e63761e33b88a11
9df6c4c7c9ded0611ccf30c49f5a271fe7ab2405cdecbfbf38413a1430d5f75e
9ee89affccbb6f24bf0dbfd697a97d13a1dfb9a94227c6b7daf7f697ceaf073f
a049e1abe441835a2bcf35258936072189a0a52d0000c4ed2094e59d2afd189b
a2c43eefd1ba78e4297fbc14c5388a9147664cde72814be9cbbb558d532063c7
a43dd50b7d497a8b9964fc6a08dfe9895a73e588eeffbe0bb1b659d6ac5703b1
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b69bbf76924f3f2cb2b8a48ad8879f94c41350bcaaa1e2f5bad1ef26c1023313
b6dcc1490a0cc33cdeed8970677b89bbec6fa095675af198b8e923b64563c70a
b7c769c34783e3dfd90f07e035efafd8cc1b57a4b1db3e027c42c207802271e6
bc7dbcdf8032d1fa2b724cdd699a0f80e3d9fa4bfecca91eb802abde8b919e2d
c2103f98dab7e47abd92c47030caa47d0dd0595ad21446d0f396a1c1df017da7
cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf
cd36de204aca2d5fa263a731f7c20009b5e3d754ba1f1e03c33e93a48f3e7446
d375cbf668234b83e732a9a326a187066afdd5b6ed18b9caffb050a94ab5f386
d3ef3695bb858983c86f962d408897ea6742380534b225ba3ecfb5d47820ad06
d4882e536a9c1013dc9abd3f7959f263ddf1d576c06c023defb1f37d17749e36
d89933395cd19a7fcf51defdc49031608af28bd675c9f3524e7bc8e1e261495d
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e43b5d8e33e7e90b8a0ee4962984feb08e72d030794dbcf94b8b292dbe8ee6c5
e6fd3eb1cdfd3eb43f7cf123feaf5bfb4510052405542acbff11094e251ddbc9
eb2798553d86c6b1806d208320f645bd79eab0cebcf22176bddbc648e8f3ccd4
ed7c487f915432d9464e2af0a83002ee93596e86e076f3c917e439e5b844d08b
eed474a49bdbf745c19e463f070e67977c1ab27835603eb749d9e5c249cf81f8
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f04453fd8f79412ed72026040628f50302c9c8ff0488102c71459c9273f1a06b
f40767552e5e94b2d5f9a65d7f640cfa7d225298023dbd682095e040809a3d1a
f4e80d9dfd374d02989b87a27b5ed4cb78fbb177c27f1478e9a8b0afb7513149
f8c098c6bed7611f3c2d1dc4c546ad3a3ee45ae270e3f1a68248e6481c2dd371
f95dafc4dfe117d050194c7812377df2e9c1b1b476b12bc0a38503e786fd04ac
fc7109dd6428c821842660a87bda6494e52c0f4ecad22105a1aed87e440ee0b1
fd2d3909ddff9145977ab7f4deef6257278aa7601dbcc5482ac59ec3af69ff42
fe80d5294e7125d8bad8d9b6edeb66fca0937aaa5c7fd67c002b1f5eeee11303