blog.talosintelligence.com Open in urlscan Pro
2400:cb00:2048:1::6810:1a36 Public Scan

Go To Rescan
Add Verdict Report

URL:
http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
Submission: On November 30 via manual (November 30th 2017, 8:29:26 pm UTC) from US

Summary HTTP 56 Redirects Links 105 Behaviour Indicators

Summary

This website contacted 11 IPs in 2 countries across 9 domains to perform 56 HTTP transactions. The main IP is 2400:cb00:2048:1::6810:1a36, located in United States and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is blog.talosintelligence.com.

This is the only time blog.talosintelligence.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2	2400:cb00:204... 2400:cb00:2048:1::6810:1a36	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
8	2a00:1450:400... 2a00:1450:4001:814::2009	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2a00:1450:400... 2a00:1450:4001:814::200a	15169 (GOOGLE) (GOOGLE - Google LLC)
20	2a00:1450:400... 2a00:1450:4001:814::2001	15169 (GOOGLE) (GOOGLE - Google LLC)
7 7	2400:cb00:204... 2400:cb00:2048:1::6810:1d36	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
12	2400:cb00:204... 2400:cb00:2048:1::6810:1b36	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
2 2	2400:cb00:204... 2400:cb00:2048:1::6810:1c36	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
2 2	2400:cb00:204... 2400:cb00:2048:1::6810:1936	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
3	2a00:1450:400... 2a00:1450:4001:814::200e	15169 (GOOGLE) (GOOGLE - Google LLC)
6	2a00:1450:400... 2a00:1450:4001:818::2003	15169 (GOOGLE) (GOOGLE - Google LLC)
1 2	2a00:1450:400... 2a00:1450:4001:818::200e	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2a00:1450:400... 2a00:1450:4001:81e::2003	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2a00:1450:400... 2a00:1450:400c:c0b::9c	15169 (GOOGLE) (GOOGLE - Google LLC)
56	11

2 2400:cb00:2048:1::6810:1a36 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

blog.talosintelligence.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a00:1450:4001:814::2009 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

www.blogger.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
img2.blogblog.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
resources.blogblog.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:814::200a (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

20 2a00:1450:4001:814::2001 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

2.bp.blogspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
4.bp.blogspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
3.bp.blogspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
1.bp.blogspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2400:cb00:2048:1::6810:1d36 (United States) 7 redirects

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

www.talosintelligence.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2400:cb00:2048:1::6810:1b36 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

www.talosintelligence.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2400:cb00:2048:1::6810:1c36 (United States) 2 redirects

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

www.talosintelligence.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2400:cb00:2048:1::6810:1936 (United States) 2 redirects

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

www.talosintelligence.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:814::200e (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

apis.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:818::2003 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:818::200e (Ireland) 1 redirects

ASN15169 (GOOGLE - Google LLC, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81e::2003 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c0b::9c (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
25	talosintelligence.com 11 redirects blog.talosintelligence.com www.talosintelligence.com	46 KB
20	blogspot.com 2.bp.blogspot.com 4.bp.blogspot.com 3.bp.blogspot.com 1.bp.blogspot.com	1 MB
7	gstatic.com fonts.gstatic.com www.gstatic.com	82 KB
6	blogger.com www.blogger.com	190 KB
3	google.com apis.google.com	83 KB
2	google-analytics.com 1 redirects www.google-analytics.com	14 KB
2	blogblog.com img2.blogblog.com resources.blogblog.com	646 B
1	doubleclick.net stats.g.doubleclick.net	53 B
1	googleapis.com fonts.googleapis.com	2 KB
56	9

	Domain	Requested by
23	www.talosintelligence.com	11 redirects blog.talosintelligence.com apis.google.com
8	2.bp.blogspot.com	blog.talosintelligence.com
6	fonts.gstatic.com	blog.talosintelligence.com
6	www.blogger.com	blog.talosintelligence.com www.blogger.com
4	1.bp.blogspot.com	blog.talosintelligence.com
4	3.bp.blogspot.com	blog.talosintelligence.com
4	4.bp.blogspot.com	blog.talosintelligence.com
3	apis.google.com	blog.talosintelligence.com apis.google.com
2	www.google-analytics.com	1 redirects blog.talosintelligence.com
2	blog.talosintelligence.com	blog.talosintelligence.com
1	stats.g.doubleclick.net	blog.talosintelligence.com
1	www.gstatic.com	apis.google.com
1	resources.blogblog.com	blog.talosintelligence.com
1	img2.blogblog.com	blog.talosintelligence.com
1	fonts.googleapis.com	blog.talosintelligence.com
56	15

This site contains links to these domains. Also see Links.

Domain
www.talosintelligence.com
snort.org
www.clamav.net
www.spamcop.net
www.twitter.com
2.bp.blogspot.com
4.bp.blogspot.com
ko.wikipedia.org
m.blog.daum.net
m.ohmynews.com
www.rohitab.com
www.dmtf.org
3.bp.blogspot.com
1.bp.blogspot.com
www.codeproject.com
researchcenter.paloaltonetworks.com
www.cisco.com
meraki.cisco.com
umbrella.cisco.com
www.snort.org
www.blogger.com
www.facebook.com
twitter.com
www.reddit.com
blog.snort.org
feedproxy.google.com
blogs.cisco.com
blog.clamav.net
talosintelligence.com
www.youtube.com
www.linkedin.com

Subject Issuer	Validity	Valid
*.blogger.com Google Internet Authority G3	`2017-11-01` - `2018-01-24`	3 months	crt.sh
*.googleusercontent.com Google Internet Authority G2	`2017-11-01` - `2018-01-24`	3 months	crt.sh
ssl400246.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2017-10-20` - `2018-04-28`	6 months	crt.sh
*.google.com Google Internet Authority G2	`2017-11-01` - `2018-01-24`	3 months	crt.sh
*.google-analytics.com Google Internet Authority G3	`2017-11-01` - `2018-01-24`	3 months	crt.sh
*.g.doubleclick.net Google Internet Authority G2	`2017-11-09` - `2018-02-01`	3 months	crt.sh

This page contains 2 frames:

Primary Page: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
Frame ID: 30281.1
Requests: 55 HTTP requests in this frame

Frame: https://www.blogger.com/comment-iframe.g?blogID=1029833275466591797&postID=3991676789207201940&blogspotRpcToken=5321898&bpli=1
Frame ID: 30281.2
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Blogger (Blogs) Expand

Overall confidence: 100%
Detected patterns

meta generator /^Blogger$/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /cloudflare/i

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

Page Statistics

56
Requests

80 %
HTTPS

100 %
IPv6

9
Domains

15
Subdomains

11
IPs

2
Countries

1730 kB
Transfer

2472 kB
Size

5
Cookies

105 Outgoing links

These are links going to different origins than the main page.

URL: http://www.talosintelligence.com/
Title:

Search URL Search Domain Scan URL

URL: http://www.talosintelligence.com/software
Title: Software

Search URL Search Domain Scan URL

URL: http://www.talosintelligence.com/snort
Title: Snort

Search URL Search Domain Scan URL

URL: http://www.talosintelligence.com/clamav
Title: ClamAV

Search URL Search Domain Scan URL

URL: http://www.talosintelligence.com/razorback
Title: Razorback

Search URL Search Domain Scan URL

URL: http://www.talosintelligence.com/daemon
Title: Daemonlogger

Search URL Search Domain Scan URL

URL: http://www.talosintelligence.com/moflow
Title: Moflow

Search URL Search Domain Scan URL

URL: http://www.talosintelligence.com/pesig
Title: PE-Sig

Search URL Search Domain Scan URL

URL: http://www.talosintelligence.com/immunet
Title: Immunet

Search URL Search Domain Scan URL

URL: http://www.talosintelligence.com/teslacrypt_tool
Title: Teslacrypt Decryption Tool

Search URL Search Domain Scan URL

URL: http://www.talosintelligence.com/mbrfilter
Title: MBR Filter

Search URL Search Domain Scan URL

URL: http://www.talosintelligence.com/first
Title: FIRST

Search URL Search Domain Scan URL

URL: http://www.talosintelligence.com/lockydump
Title: LockyDump

Search URL Search Domain Scan URL

URL: http://www.talosintelligence.com/freesentry
Title: FreeSentry

Search URL Search Domain Scan URL

URL: http://www.talosintelligence.com/flokibot
Title: Flokibot Tools

Search URL Search Domain Scan URL

URL: http://www.talosintelligence.com/scanner
Title: Synful Knock Scanner

Search URL Search Domain Scan URL

URL: http://www.talosintelligence.com/smart_scanner
Title: Cisco Smart Install Scanner

Search URL Search Domain Scan URL

URL: http://www.talosintelligence.com/ropmemu
Title: ROPMEMU

Search URL Search Domain Scan URL

URL: http://www.talosintelligence.com/vulnerability_info
Title: Vulnerability Information

Search URL Search Domain Scan URL

URL: http://www.talosintelligence.com/vulnerability_reports
Title: Vulnerability Reports

Search URL Search Domain Scan URL

URL: http://www.talosintelligence.com/ms_advisories
Title: Microsoft Advisories

Search URL Search Domain Scan URL

URL: http://www.talosintelligence.com/reputation
Title: Reputation Center

Search URL Search Domain Scan URL

URL: http://www.talosintelligence.com/reputation_center
Title: Email & Web Traffic Reputation

Search URL Search Domain Scan URL

URL: http://www.talosintelligence.com/amp-naming
Title: AMP Threat Naming Conventions

Search URL Search Domain Scan URL

URL: http://www.talosintelligence.com/documents/ip-blacklist
Title: IP Blacklist Download

Search URL Search Domain Scan URL

URL: http://www.talosintelligence.com/awbo_intro
Title: AWBO Exercises

Search URL Search Domain Scan URL

URL: http://www.talosintelligence.com/resources
Title: Library

Search URL Search Domain Scan URL

URL: http://www.talosintelligence.com/community
Title: Support Communities

Search URL Search Domain Scan URL

URL: https://snort.org/community
Title: Snort Community

Search URL Search Domain Scan URL

URL: https://www.clamav.net/contact.html#ml
Title: ClamAV Community

Search URL Search Domain Scan URL

URL: http://www.talosintelligence.com/aspis
Title: Project Aspis

Search URL Search Domain Scan URL

URL: https://www.spamcop.net/
Title: SpamCop

Search URL Search Domain Scan URL

URL: http://www.talosintelligence.com/about
Title: About

Search URL Search Domain Scan URL

URL: http://www.talosintelligence.com/careers
Title: Careers

Search URL Search Domain Scan URL

URL: https://www.twitter.com/SecurityBeard/
Title: Warren Mercer

Search URL Search Domain Scan URL

URL: https://www.twitter.com/r00tbsd
Title: Paul Rascagneres

Search URL Search Domain Scan URL

URL: https://2.bp.blogspot.com/-oZY_XkhLCak/WhyBjcvv1DI/AAAAAAAAAMY/EtxUBxnlW0I7Zw5dvU4cVLCmMy3vVYzEwCLcBGAs/s1600/image7.png

Search URL Search Domain Scan URL

URL: https://4.bp.blogspot.com/-UK3O08XFp2k/WhyBximnWLI/AAAAAAAAAMc/s5N3fKQB__ks4xpcTOH6GtWfOMVzQS_TwCLcBGAs/s1600/image6.png

Search URL Search Domain Scan URL

URL: https://2.bp.blogspot.com/-UdRh6pJR0FU/WhyB6um-i6I/AAAAAAAAAMg/Rujz_rpXM8AIMWxHayfmA7v0sdKxbxYawCLcBGAs/s1600/image20.png

Search URL Search Domain Scan URL

URL: https://ko.wikipedia.org/wiki/%EB%B0%B1%EC%84%A0%EC%97%BD
Title: Wikipedia

Search URL Search Domain Scan URL

URL: http://m.blog.daum.net/_blog/_m/articleView.do?blogid=0UCYA&articleno=1545
Title: this blog

Search URL Search Domain Scan URL

URL: http://m.ohmynews.com/NWS_Web/Mobile/at_pg.aspx?CNTN_CD=A0000939170#cb
Title: news website

Search URL Search Domain Scan URL

URL: https://4.bp.blogspot.com/-ThSGoJ2fiL8/WhyCFM6M3SI/AAAAAAAAAMo/kS5m9vVHIhUAhkMPEhb-YiPH5-WISQ0hgCLcBGAs/s1600/image10.png

Search URL Search Domain Scan URL

URL: https://2.bp.blogspot.com/-sshO1piH2Z4/WhyCKaO_YUI/AAAAAAAAAMs/T-ioks5MAWQP9yqvUiBKHLO88h3IIGBQgCLcBGAs/s1600/image13.png

Search URL Search Domain Scan URL

URL: https://4.bp.blogspot.com/-P3vttCd3--8/WhyCQUU2stI/AAAAAAAAAMw/yqLRBtpi1DUNwbOJ8WiPWn9nC3rtishggCLcBGAs/s1600/image8.png

Search URL Search Domain Scan URL

URL: http://www.rohitab.com/discuss/topic/35915-win32-api-to-get-system-information/?p%3D10075283
Title: forum

Search URL Search Domain Scan URL

URL: http://www.dmtf.org/sites/default/files/standards/documents/DSP0134_2.7.0.pdf
Title: SMBIOS documentation

Search URL Search Domain Scan URL

URL: https://2.bp.blogspot.com/-0Ere0jsIaBM/WhyCWDThHsI/AAAAAAAAAM0/hGb9Yd4MiZ85bo8q1mlGuZ8VzRrFI690wCLcBGAs/s1600/image19.png

Search URL Search Domain Scan URL

URL: https://3.bp.blogspot.com/-tMpcUMOjVY4/WhyCeLjiTtI/AAAAAAAAAM4/55qQDK6rByglGRQeSmTpw6kLM3ksCkJ9QCLcBGAs/s1600/image4.png

Search URL Search Domain Scan URL

URL: https://2.bp.blogspot.com/--2thdwNFFWk/WhyCxluop1I/AAAAAAAAANA/ZvScFYWEfmEX8V0XKU8Ab3e6RR9Nl3vFACLcBGAs/s1600/image5.png

Search URL Search Domain Scan URL

URL: https://1.bp.blogspot.com/-FOQkjTQlNvA/WhyC3zsnVTI/AAAAAAAAANE/WmpI7gwqSBM75SG_ls-3cHjVzcKC50JTgCLcBGAs/s1600/image2.png

Search URL Search Domain Scan URL

URL: https://2.bp.blogspot.com/-9U3juJSttOw/WhyC_xXCS7I/AAAAAAAAANI/QFDm3a7rfxQcmAM_ly8YHcSBuD4WW6FegCLcBGAs/s1600/image17.png

Search URL Search Domain Scan URL

URL: https://1.bp.blogspot.com/--n6yXqONkEs/WhyDFe5MlnI/AAAAAAAAANM/3XsNWR3OdBUI3VK6FQLIhAGsopYx4WT5ACLcBGAs/s1600/image11.png

Search URL Search Domain Scan URL

URL: https://2.bp.blogspot.com/-1c4E_cI5198/WhyDL5Xq05I/AAAAAAAAANQ/pkyAlBQDvAgq3n9AX1XpGuRd8uLEQhbVACLcBGAs/s1600/image3.png

Search URL Search Domain Scan URL

URL: https://2.bp.blogspot.com/-kgM45XXgNKw/WhyDSVHJD5I/AAAAAAAAANY/y18ZaMeY3XAiJJt0c2qUT88YUc-HQfPtACLcBGAs/s1600/image14.png

Search URL Search Domain Scan URL

URL: https://www.codeproject.com/Articles/1167943/The-Secrets-of-Internet-Explorer-Credentials
Title: following project

Search URL Search Domain Scan URL

URL: https://researchcenter.paloaltonetworks.com/2017/10/unit42-freemilk-highly-targeted-spear-phishing-campaign/
Title: FreeMilk

Search URL Search Domain Scan URL

URL: https://1.bp.blogspot.com/-wgeOLIL7OBQ/WhyDX-7egxI/AAAAAAAAANc/bj86udF7beAhD0Q3kWPDDLsJPNjWn-FBwCLcBGAs/s1600/image12.png

Search URL Search Domain Scan URL

URL: https://3.bp.blogspot.com/-PrgljjxiAFo/WhyEcoSdFdI/AAAAAAAAAN4/bdK6iwGJ8moRLm9NDzv_5CVZx82QlV0NQCLcBGAs/s1600/image18.png

Search URL Search Domain Scan URL

URL: https://1.bp.blogspot.com/-mEPlwuN1nzk/WhyEywpiFYI/AAAAAAAAAOA/WJFSGK8Ylp8IQE6Vru-WMQWd57IGHsBkwCLcBGAs/s1600/image15.png

Search URL Search Domain Scan URL

URL: https://3.bp.blogspot.com/-DFU-dyBrdNg/WhyFAJdvf6I/AAAAAAAAAOM/oP6_ri4qfBQZa3-1tuSvysODAQyRZT73gCLcBGAs/s1600/image9.png

Search URL Search Domain Scan URL

URL: https://4.bp.blogspot.com/-obpjJED7PA8/WhyFL04Jk0I/AAAAAAAAAOQ/5c1siYoQcdAt8UgR9YIuTXiawtZlN1DhACLcBGAs/s1600/image16.png

Search URL Search Domain Scan URL

URL: https://3.bp.blogspot.com/-h3Ubgz2tpKo/WhyDpf-abzI/AAAAAAAAANk/QXJs9157NFcro7ZHWf36KsfFiQ2yjgazgCLcBGAs/s1600/image1.png

Search URL Search Domain Scan URL

URL: https://www.cisco.com/c/en/us/products/security/advanced-malware-protection
Title: AMP

Search URL Search Domain Scan URL

URL: https://www.cisco.com/c/en/us/products/security/cloud-web-security/index.html
Title: CWS

Search URL Search Domain Scan URL

URL: https://www.cisco.com/c/en/us/products/security/web-security-appliance/index.html
Title: WSA

Search URL Search Domain Scan URL

URL: https://www.cisco.com/c/en/us/products/security/email-security-appliance/index.html
Title: Email Security

Search URL Search Domain Scan URL

URL: https://www.cisco.com/c/en/us/products/security/firewalls/index.html
Title:

Search URL Search Domain Scan URL

URL: https://www.cisco.com/c/en/us/products/security/intrusion-prevention-system-ips/index.html
Title:

Search URL Search Domain Scan URL

URL: https://meraki.cisco.com/products/appliances
Title:

Search URL Search Domain Scan URL

URL: https://www.cisco.com/c/en/us/solutions/enterprise-networks/amp-threat-grid/index.html
Title: AMP Threat Grid

Search URL Search Domain Scan URL

URL: https://umbrella.cisco.com/
Title: Umbrella

Search URL Search Domain Scan URL

URL: https://www.snort.org/products
Title: Snort.org

Search URL Search Domain Scan URL

URL: https://www.blogger.com/profile/10073079939160046441
Title: Paul Rascagneres

Search URL Search Domain Scan URL

URL: https://www.blogger.com/post-edit.g?blogID=1029833275466591797&postID=3991676789207201940&from=pencil
Title:

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer.php?u=http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html&text=ROKRAT%20Reloaded
Title:

Search URL Search Domain Scan URL

URL: https://twitter.com/share?url=http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html&text=ROKRAT%20Reloaded
Title:

Search URL Search Domain Scan URL

URL: http://www.reddit.com/submit?url=http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html&title=ROKRAT%20Reloaded
Title:

Search URL Search Domain Scan URL

URL: https://www.blogger.com/comment-iframe.g?blogID=1029833275466591797&postID=3991676789207201940&blogspotRpcToken=5321898

Search URL Search Domain Scan URL

URL: http://www.blogger.com/rearrange?blogID=1029833275466591797&widgetType=HTML&widgetId=HTML1&action=editWidget&sectionId=sidebar
Title:

Search URL Search Domain Scan URL

URL: http://www.talosintelligence.com/blog_subscription
Title: Subscribe via Email

Search URL Search Domain Scan URL

URL: http://www.blogger.com/rearrange?blogID=1029833275466591797&widgetType=Subscribe&widgetId=Subscribe1&action=editWidget&sectionId=sidebar
Title:

Search URL Search Domain Scan URL

URL: http://www.blogger.com/rearrange?blogID=1029833275466591797&widgetType=BlogArchive&widgetId=BlogArchive1&action=editWidget&sectionId=sidebar
Title:

Search URL Search Domain Scan URL

URL: http://blog.snort.org/
Title: Snort Blog

Search URL Search Domain Scan URL

URL: https://feedproxy.google.com/~r/Snort/~3/87xm4qaOqc0/snort-subscriber-rule-set-update-for_30.html
Title: Snort Subscriber Rule Set Update for 11/30/2017

Search URL Search Domain Scan URL

URL: https://blogs.cisco.com/
Title: Cisco Blog

Search URL Search Domain Scan URL

URL: https://blogs.cisco.com/enterprise/intuitive-networks-drive-digital-success
Title: Intuitive Networks Drive Digital Success

Search URL Search Domain Scan URL

URL: http://blog.clamav.net/
Title: ClamAV® blog

Search URL Search Domain Scan URL

URL: https://feedproxy.google.com/~r/Clamav/~3/fzC99YEXL4g/mirror-sync-outage-for-clamav-av-updates.html
Title: Mirror Sync Outage for ClamAV AV updates

Search URL Search Domain Scan URL

URL: http://www.blogger.com/rearrange?blogID=1029833275466591797&widgetType=BlogList&widgetId=BlogList1&action=editWidget&sectionId=sidebar
Title:

Search URL Search Domain Scan URL

URL: http://talosintelligence.com/software
Title: Software

Search URL Search Domain Scan URL

URL: http://talosintelligence.com/reputation
Title: Reputation Center

Search URL Search Domain Scan URL

URL: http://talosintelligence.com/vulnerability-reports
Title: Vulnerability Information

Search URL Search Domain Scan URL

URL: http://talosintelligence.com/resources
Title: Library

Search URL Search Domain Scan URL

URL: http://talosintelligence.com/community
Title: Support Communities

Search URL Search Domain Scan URL

URL: http://talosintelligence.com/ms_advisories
Title: Microsoft Advisory Snort Rules

Search URL Search Domain Scan URL

URL: http://talosintelligence.com/documents/ip-blacklist
Title: IP Blacklist Download

Search URL Search Domain Scan URL

URL: http://talosintelligence.com/awbo_exercises
Title: AWBO Exercises

Search URL Search Domain Scan URL

URL: http://talosintelligence.com/about
Title: About Talos

Search URL Search Domain Scan URL

URL: http://talosintelligence.com/careers
Title: Careers

Search URL Search Domain Scan URL

URL: https://twitter.com/talossecurity
Title:

Search URL Search Domain Scan URL

URL: https://www.facebook.com/groups/TalosGroupatCisco/
Title:

Search URL Search Domain Scan URL

URL: https://www.youtube.com/playlist?list=PLFT-9JpKjRTDn_qtGN238gzycJfaVzMqD
Title:

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/grp/home?gid=8287731
Title:

Search URL Search Domain Scan URL

URL: http://www.cisco.com/web/siteassets/legal/privacy_full.html
Title: Privacy Policy

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 24

http://www.talosintelligence.com/assets/icon_fb-share_grey.svg HTTP 301
https://www.talosintelligence.com/assets/icon_fb-share_grey.svg

Request Chain 25

http://www.talosintelligence.com/assets/icon_tw-share_grey.svg HTTP 301
https://www.talosintelligence.com/assets/icon_tw-share_grey.svg

Request Chain 26

http://www.talosintelligence.com/assets/icon_re-share_grey.svg HTTP 301
https://www.talosintelligence.com/assets/icon_re-share_grey.svg

Request Chain 27

http://www.talosintelligence.com/assets/icon_em-share_grey.svg HTTP 301
https://www.talosintelligence.com/assets/icon_em-share_grey.svg

Request Chain 31

http://www.talosintelligence.com/assets/icon_rss_orange.svg HTTP 301
https://www.talosintelligence.com/assets/icon_rss_orange.svg

Request Chain 32

http://www.talosintelligence.com/assets/icon_email_orange.svg HTTP 301
https://www.talosintelligence.com/assets/icon_email_orange.svg

Request Chain 33

http://www.talosintelligence.com/assets/footer_icon_tw.svg HTTP 301
https://www.talosintelligence.com/assets/footer_icon_tw.svg

Request Chain 34

http://www.talosintelligence.com/assets/footer_icon_fb.svg HTTP 301
https://www.talosintelligence.com/assets/footer_icon_fb.svg

Request Chain 35

http://www.talosintelligence.com/assets/footer_icon_yt.svg HTTP 301
https://www.talosintelligence.com/assets/footer_icon_yt.svg

Request Chain 36

http://www.talosintelligence.com/assets/footer_icon_li.svg HTTP 301
https://www.talosintelligence.com/assets/footer_icon_li.svg

Request Chain 37

http://www.talosintelligence.com/assets/logo_cisco_grey.svg HTTP 301
https://www.talosintelligence.com/assets/logo_cisco_grey.svg

Request Chain 46

https://www.blogger.com/comment-iframe.g?blogID=1029833275466591797&postID=3991676789207201940&blogspotRpcToken=5321898 HTTP 302
https://accounts.google.com/ServiceLogin?continue=https://www.blogger.com/comment-iframe.g?blogID%3D1029833275466591797%26postID%3D3991676789207201940%26blogspotRpcToken%3D5321898%26bpli%3D1&followup=https://www.blogger.com/comment-iframe.g?blogID%3D1029833275466591797%26postID%3D3991676789207201940%26blogspotRpcToken%3D5321898%26bpli%3D1&passive=true&go=true HTTP 302
https://www.blogger.com/comment-iframe.g?blogID=1029833275466591797&postID=3991676789207201940&blogspotRpcToken=5321898&bpli=1

Request Chain 47

http://www.google-analytics.com/analytics.js HTTP 307
https://www.google-analytics.com/analytics.js

Request Chain 52

http://www.google-analytics.com/r/collect?v=1&_v=j66&a=1344197960&t=pageview&_s=1&dl=http%3A%2F%2Fblog.talosintelligence.com%2F2017%2F11%2FROKRAT-Reloaded.html%3Ff_l%3Ds&ul=en-us&de=UTF-8&dt=Cisco%27s%20Talos%20Intelligence%20Group%20Blog%3A%20ROKRAT%20Reloaded&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=IEBAAEAB~&jid=359168648&gjid=1250032666&cid=146855418.1512073755&tid=UA-30016562-3&_gid=2057202281.1512073755&_r=1&z=674658500 HTTP 307
https://www.google-analytics.com/r/collect?v=1&_v=j66&a=1344197960&t=pageview&_s=1&dl=http%3A%2F%2Fblog.talosintelligence.com%2F2017%2F11%2FROKRAT-Reloaded.html%3Ff_l%3Ds&ul=en-us&de=UTF-8&dt=Cisco%27s%20Talos%20Intelligence%20Group%20Blog%3A%20ROKRAT%20Reloaded&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=IEBAAEAB~&jid=359168648&gjid=1250032666&cid=146855418.1512073755&tid=UA-30016562-3&_gid=2057202281.1512073755&_r=1&z=674658500 HTTP 302
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-30016562-3&cid=146855418.1512073755&jid=359168648&_gid=2057202281.1512073755&gjid=1250032666&_v=j66&z=674658500

56 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request Cookie set ROKRAT-Reloaded.html Show response
blog.talosintelligence.com/2017/11/ 148 KB
31 KB 484ms
478ms Document
text/html 2400:cb00:2048:1::6810:1a36
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s

Protocol

HTTP/1.1

Server

2400:cb00:2048:1::6810:1a36 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare-nginx /

Resource Hash

63555c37094b104d5246fd7a4de400a8679cb4c5532f59c2b7673e922a1503f9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: blog.talosintelligence.com
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Cache-Control: no-cache
Connection: keep-alive
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date: Thu, 30 Nov 2017 20:29:14 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Thu, 30 Nov 2017 15:07:36 GMT
Server: cloudflare-nginx
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
Set-Cookie: __cfduid=d509e23ebf18900163c858797a8330f121512073754; expires=Fri, 30-Nov-18 20:29:14 GMT; path=/; domain=.talosintelligence.com; HttpOnly
Cache-Control: private, max-age=0
Connection: keep-alive
CF-RAY: 3c608ec4407d2798-FRA
X-XSS-Protection: 1; mode=block
Expires: Thu, 30 Nov 2017 20:29:14 GMT

GET
H2 200 3213516723-css_bundle_v2.css
www.blogger.com/static/v1/widgets/ 41 KB
9 KB 29ms
6ms Stylesheet
text/css 2a00:1450:4001:814::2009
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.blogger.com/static/v1/widgets/3213516723-css_bundle_v2.css

Requested by

Host: blog.talosintelligence.com
URL: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:814::2009 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

630e4fd46a40c9983b7e8dcdee9366f5f7a921e8dc6882281dfced08b5744858

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /static/v1/widgets/3213516723-css_bundle_v2.css
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: text/css,*/*;q=0.1
cache-control: no-cache
:authority: www.blogger.com
referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
:scheme: https
:method: GET
Referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Fri, 10 Nov 2017 09:51:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 09 Nov 2017 11:28:58 GMT
server: sffe
age: 1766249
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 9140
x-xss-protection: 1; mode=block
expires: Sat, 10 Nov 2018 09:51:45 GMT

GET
H/1.1 200
OK css
fonts.googleapis.com/ 14 KB
2 KB 24ms
18ms Stylesheet
text/css 2a00:1450:4001:814::200a
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.googleapis.com/css?family=Roboto:100,300,400|Exo+2:500,400,300,100,700|Fira+Mono

Requested by

Host: blog.talosintelligence.com
URL: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s

Protocol

HTTP/1.1

Server

2a00:1450:4001:814::200a , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

73a25b8ead8e7c449b936da8334801caef2f201f46967a2a1635b75ebfa6d4ff

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
Connection: keep-alive
Cache-Control: no-cache
Referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date: Thu, 30 Nov 2017 20:29:14 GMT
Content-Encoding: gzip
Last-Modified: Thu, 30 Nov 2017 20:29:14 GMT
Server: ESF
X-Frame-Options: SAMEORIGIN
Content-Type: text/css; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: private, max-age=86400, stale-while-revalidate=604800
Transfer-Encoding: chunked
Timing-Allow-Origin: *
Link: <http://fonts.gstatic.com>; rel=preconnect; crossorigin
X-XSS-Protection: 1; mode=block
Expires: Thu, 30 Nov 2017 20:29:14 GMT

GET
H2 200 authorization.css
www.blogger.com/dyn-css/ 1 B
39 B 123ms
122ms Stylesheet
text/css 2a00:1450:4001:814::2009
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.blogger.com/dyn-css/authorization.css?targetBlogID=1029833275466591797&zx=45e0610f-db4e-4425-a778-d4f3f781a541

Requested by

Host: blog.talosintelligence.com
URL: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:814::2009 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

GSE /

Resource Hash

01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b

Security Headers

Name	Value
Content-Security-Policy	script-src 'self' .google.com .google-analytics.com 'unsafe-inline' 'unsafe-eval' .gstatic.com .googlesyndication.com .blogger.com .googleapis.com uds.googleusercontent.com https://s.ytimg.com https://i18n-cloud.appspot.com www-onepick-opensocial.googleusercontent.com www-bloggervideo-opensocial.googleusercontent.com www-blogger-opensocial.googleusercontent.com https://www.blogblog.com; report-uri /cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /dyn-css/authorization.css?targetBlogID=1029833275466591797&zx=45e0610f-db4e-4425-a778-d4f3f781a541
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: text/css,*/*;q=0.1
cache-control: no-cache
:authority: www.blogger.com
referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
:scheme: https
:method: GET
Referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

content-security-policy: script-src 'self' *.google.com *.google-analytics.com 'unsafe-inline' 'unsafe-eval' *.gstatic.com *.googlesyndication.com *.blogger.com *.googleapis.com uds.googleusercontent.com https://s.ytimg.com https://i18n-cloud.appspot.com www-onepick-opensocial.googleusercontent.com www-bloggervideo-opensocial.googleusercontent.com www-blogger-opensocial.googleusercontent.com https://www.blogblog.com; report-uri /cspreport
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="This is not a P3P policy! See https://www.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info."
status: 200
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 21
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Thu, 30 Nov 2017 20:29:14 GMT
server: GSE
date: Thu, 30 Nov 2017 20:29:14 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=UTF-8
cache-control: private, max-age=1800
expires: Thu, 30 Nov 2017 20:29:14 GMT

GET
H2 200 image7.png
2.bp.blogspot.com/-oZY_XkhLCak/WhyBjcvv1DI/AAAAAAAAAMY/EtxUBxnlW0I7Zw5dvU4cVLCmMy3vVYzEwCLcBGAs/s640/ 121 KB
121 KB 45ms
23ms Image
image/png 2a00:1450:4001:814::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://2.bp.blogspot.com/-oZY_XkhLCak/WhyBjcvv1DI/AAAAAAAAAMY/EtxUBxnlW0I7Zw5dvU4cVLCmMy3vVYzEwCLcBGAs/s640/image7.png

Requested by

Host: blog.talosintelligence.com
URL: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:814::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

fife /

Resource Hash

4092c8e3c7b3958e5ac5e66d4788415595c11babbe5761477f2b0cdffd3231ee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /-oZY_XkhLCak/WhyBjcvv1DI/AAAAAAAAAMY/EtxUBxnlW0I7Zw5dvU4cVLCmMy3vVYzEwCLcBGAs/s640/image7.png
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 2.bp.blogspot.com
referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
:scheme: https
:method: GET
Referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Thu, 30 Nov 2017 20:29:14 GMT
x-content-type-options: nosniff
age: 0
status: 200
content-disposition: inline;filename="image7.png"
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 123757
x-xss-protection: 1; mode=block
server: fife
etag: "vc9"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Thu, 30 Nov 2017 21:33:21 GMT

GET
H2 200 image6.png
4.bp.blogspot.com/-UK3O08XFp2k/WhyBximnWLI/AAAAAAAAAMc/s5N3fKQB__ks4xpcTOH6GtWfOMVzQS_TwCLcBGAs/s640/ 84 KB
84 KB 62ms
27ms Image
image/png 2a00:1450:4001:814::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://4.bp.blogspot.com/-UK3O08XFp2k/WhyBximnWLI/AAAAAAAAAMc/s5N3fKQB__ks4xpcTOH6GtWfOMVzQS_TwCLcBGAs/s640/image6.png

Requested by

Host: blog.talosintelligence.com
URL: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:814::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

fife /

Resource Hash

d653587e0ba104704feb374a84eb9ed6b485e45c55835cd4311475af0216f2ff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /-UK3O08XFp2k/WhyBximnWLI/AAAAAAAAAMc/s5N3fKQB__ks4xpcTOH6GtWfOMVzQS_TwCLcBGAs/s640/image6.png
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 4.bp.blogspot.com
referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
:scheme: https
:method: GET
Referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Thu, 30 Nov 2017 20:29:14 GMT
x-content-type-options: nosniff
age: 0
status: 200
content-disposition: inline;filename="image6.png"
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 85794
x-xss-protection: 1; mode=block
server: fife
etag: "vc9"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Thu, 30 Nov 2017 21:33:21 GMT

GET
H2 200 image20.png
2.bp.blogspot.com/-UdRh6pJR0FU/WhyB6um-i6I/AAAAAAAAAMg/Rujz_rpXM8AIMWxHayfmA7v0sdKxbxYawCLcBGAs/s400/ 213 KB
213 KB 57ms
39ms Image
image/png 2a00:1450:4001:814::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://2.bp.blogspot.com/-UdRh6pJR0FU/WhyB6um-i6I/AAAAAAAAAMg/Rujz_rpXM8AIMWxHayfmA7v0sdKxbxYawCLcBGAs/s400/image20.png

Requested by

Host: blog.talosintelligence.com
URL: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:814::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

fife /

Resource Hash

53e382b21d553c64e067d714883b37558bcb020904d1986fb5120f6ecd2eaa4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /-UdRh6pJR0FU/WhyB6um-i6I/AAAAAAAAAMg/Rujz_rpXM8AIMWxHayfmA7v0sdKxbxYawCLcBGAs/s400/image20.png
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 2.bp.blogspot.com
referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
:scheme: https
:method: GET
Referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Thu, 30 Nov 2017 20:29:14 GMT
x-content-type-options: nosniff
age: 0
status: 200
content-disposition: inline;filename="image20.png"
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 217712
x-xss-protection: 1; mode=block
server: fife
etag: "vc9"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Thu, 30 Nov 2017 21:33:21 GMT

GET
H2 200 image10.png
4.bp.blogspot.com/-ThSGoJ2fiL8/WhyCFM6M3SI/AAAAAAAAAMo/kS5m9vVHIhUAhkMPEhb-YiPH5-WISQ0hgCLcBGAs/s640/ 26 KB
26 KB 61ms
26ms Image
image/png 2a00:1450:4001:814::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://4.bp.blogspot.com/-ThSGoJ2fiL8/WhyCFM6M3SI/AAAAAAAAAMo/kS5m9vVHIhUAhkMPEhb-YiPH5-WISQ0hgCLcBGAs/s640/image10.png

Requested by

Host: blog.talosintelligence.com
URL: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:814::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

fife /

Resource Hash

23ceb7a0f6258fae8ec0f156cffca5e0259135728c489e4ca041fca5804a1c83

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /-ThSGoJ2fiL8/WhyCFM6M3SI/AAAAAAAAAMo/kS5m9vVHIhUAhkMPEhb-YiPH5-WISQ0hgCLcBGAs/s640/image10.png
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 4.bp.blogspot.com
referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
:scheme: https
:method: GET
Referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Thu, 30 Nov 2017 20:29:14 GMT
x-content-type-options: nosniff
age: 0
status: 200
content-disposition: inline;filename="image10.png"
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 26613
x-xss-protection: 1; mode=block
server: fife
etag: "vcf"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Fri, 01 Dec 2017 07:19:28 GMT

GET
H2 200 image13.png
2.bp.blogspot.com/-sshO1piH2Z4/WhyCKaO_YUI/AAAAAAAAAMs/T-ioks5MAWQP9yqvUiBKHLO88h3IIGBQgCLcBGAs/s640/ 25 KB
25 KB 34ms
17ms Image
image/png 2a00:1450:4001:814::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://2.bp.blogspot.com/-sshO1piH2Z4/WhyCKaO_YUI/AAAAAAAAAMs/T-ioks5MAWQP9yqvUiBKHLO88h3IIGBQgCLcBGAs/s640/image13.png

Requested by

Host: blog.talosintelligence.com
URL: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:814::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

fife /

Resource Hash

f95dc7ebaf77a683791e59adf16e14be4f1e96e8c75c7640f8ef1a319cc3dc55

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /-sshO1piH2Z4/WhyCKaO_YUI/AAAAAAAAAMs/T-ioks5MAWQP9yqvUiBKHLO88h3IIGBQgCLcBGAs/s640/image13.png
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 2.bp.blogspot.com
referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
:scheme: https
:method: GET
Referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Thu, 30 Nov 2017 20:29:14 GMT
x-content-type-options: nosniff
age: 0
status: 200
content-disposition: inline;filename="image13.png"
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 25514
x-xss-protection: 1; mode=block
server: fife
etag: "vcf"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Fri, 01 Dec 2017 10:47:11 GMT

GET
H2 200 image8.png
4.bp.blogspot.com/-P3vttCd3--8/WhyCQUU2stI/AAAAAAAAAMw/yqLRBtpi1DUNwbOJ8WiPWn9nC3rtishggCLcBGAs/s640/ 6 KB
6 KB 64ms
29ms Image
image/png 2a00:1450:4001:814::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://4.bp.blogspot.com/-P3vttCd3--8/WhyCQUU2stI/AAAAAAAAAMw/yqLRBtpi1DUNwbOJ8WiPWn9nC3rtishggCLcBGAs/s640/image8.png

Requested by

Host: blog.talosintelligence.com
URL: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:814::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

fife /

Resource Hash

c8b6dbe908e7b73e8a32a49df8445fbf5673a7a0ece4bc51ce1e8a3494a30041

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /-P3vttCd3--8/WhyCQUU2stI/AAAAAAAAAMw/yqLRBtpi1DUNwbOJ8WiPWn9nC3rtishggCLcBGAs/s640/image8.png
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 4.bp.blogspot.com
referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
:scheme: https
:method: GET
Referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Thu, 30 Nov 2017 20:29:14 GMT
x-content-type-options: nosniff
age: 0
status: 200
content-disposition: inline;filename="image8.png"
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 6539
x-xss-protection: 1; mode=block
server: fife
etag: "vcf"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Fri, 01 Dec 2017 07:19:28 GMT

GET
H2 200 image19.png
2.bp.blogspot.com/-0Ere0jsIaBM/WhyCWDThHsI/AAAAAAAAAM0/hGb9Yd4MiZ85bo8q1mlGuZ8VzRrFI690wCLcBGAs/s640/ 110 KB
110 KB 49ms
32ms Image
image/png 2a00:1450:4001:814::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://2.bp.blogspot.com/-0Ere0jsIaBM/WhyCWDThHsI/AAAAAAAAAM0/hGb9Yd4MiZ85bo8q1mlGuZ8VzRrFI690wCLcBGAs/s640/image19.png

Requested by

Host: blog.talosintelligence.com
URL: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:814::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

fife /

Resource Hash

8e9efe9645a7c12addd5aab3da7f84f348ac0c8bc8f5f49359f3aaa4bb087b48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /-0Ere0jsIaBM/WhyCWDThHsI/AAAAAAAAAM0/hGb9Yd4MiZ85bo8q1mlGuZ8VzRrFI690wCLcBGAs/s640/image19.png
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 2.bp.blogspot.com
referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
:scheme: https
:method: GET
Referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Thu, 30 Nov 2017 20:29:14 GMT
x-content-type-options: nosniff
age: 0
status: 200
content-disposition: inline;filename="image19.png"
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 112201
x-xss-protection: 1; mode=block
server: fife
etag: "vcf"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Fri, 01 Dec 2017 07:19:28 GMT

GET
H2 200 image4.png
3.bp.blogspot.com/-tMpcUMOjVY4/WhyCeLjiTtI/AAAAAAAAAM4/55qQDK6rByglGRQeSmTpw6kLM3ksCkJ9QCLcBGAs/s640/ 49 KB
49 KB 61ms
26ms Image
image/png 2a00:1450:4001:814::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://3.bp.blogspot.com/-tMpcUMOjVY4/WhyCeLjiTtI/AAAAAAAAAM4/55qQDK6rByglGRQeSmTpw6kLM3ksCkJ9QCLcBGAs/s640/image4.png

Requested by

Host: blog.talosintelligence.com
URL: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:814::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

fife /

Resource Hash

8168823dbb74046c4cacf5739d15df3c81770360e751a5e1a4fd79bfe42353d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /-tMpcUMOjVY4/WhyCeLjiTtI/AAAAAAAAAM4/55qQDK6rByglGRQeSmTpw6kLM3ksCkJ9QCLcBGAs/s640/image4.png
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 3.bp.blogspot.com
referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
:scheme: https
:method: GET
Referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Thu, 30 Nov 2017 20:29:14 GMT
x-content-type-options: nosniff
age: 0
status: 200
content-disposition: inline;filename="image4.png"
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 50611
x-xss-protection: 1; mode=block
server: fife
etag: "vcf"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Fri, 01 Dec 2017 07:19:28 GMT

GET
H2 200 image5.png
2.bp.blogspot.com/--2thdwNFFWk/WhyCxluop1I/AAAAAAAAANA/ZvScFYWEfmEX8V0XKU8Ab3e6RR9Nl3vFACLcBGAs/s640/ 52 KB
52 KB 54ms
36ms Image
image/png 2a00:1450:4001:814::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://2.bp.blogspot.com/--2thdwNFFWk/WhyCxluop1I/AAAAAAAAANA/ZvScFYWEfmEX8V0XKU8Ab3e6RR9Nl3vFACLcBGAs/s640/image5.png

Requested by

Host: blog.talosintelligence.com
URL: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:814::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

fife /

Resource Hash

8b8f5d18405f7b38f05161089408a0795ab53bd759e85a799a6b6152237d64c9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /--2thdwNFFWk/WhyCxluop1I/AAAAAAAAANA/ZvScFYWEfmEX8V0XKU8Ab3e6RR9Nl3vFACLcBGAs/s640/image5.png
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 2.bp.blogspot.com
referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
:scheme: https
:method: GET
Referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Thu, 30 Nov 2017 20:29:14 GMT
x-content-type-options: nosniff
age: 0
status: 200
content-disposition: inline;filename="image5.png"
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 53457
x-xss-protection: 1; mode=block
server: fife
etag: "vd5"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Fri, 01 Dec 2017 10:47:11 GMT

GET
H2 200 image2.png
1.bp.blogspot.com/-FOQkjTQlNvA/WhyC3zsnVTI/AAAAAAAAANE/WmpI7gwqSBM75SG_ls-3cHjVzcKC50JTgCLcBGAs/s640/ 101 KB
101 KB 58ms
28ms Image
image/png 2a00:1450:4001:814::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1.bp.blogspot.com/-FOQkjTQlNvA/WhyC3zsnVTI/AAAAAAAAANE/WmpI7gwqSBM75SG_ls-3cHjVzcKC50JTgCLcBGAs/s640/image2.png

Requested by

Host: blog.talosintelligence.com
URL: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:814::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

fife /

Resource Hash

6bfe2a4e2bf7b651b7c7b8c1a6877898737e85c8e4c80baf99f3d0795834aa93

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /-FOQkjTQlNvA/WhyC3zsnVTI/AAAAAAAAANE/WmpI7gwqSBM75SG_ls-3cHjVzcKC50JTgCLcBGAs/s640/image2.png
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 1.bp.blogspot.com
referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
:scheme: https
:method: GET
Referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Thu, 30 Nov 2017 20:29:14 GMT
x-content-type-options: nosniff
age: 0
status: 200
content-disposition: inline;filename="image2.png"
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 103491
x-xss-protection: 1; mode=block
server: fife
etag: "vd5"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Fri, 01 Dec 2017 10:47:11 GMT

GET
H2 200 image17.png
2.bp.blogspot.com/-9U3juJSttOw/WhyC_xXCS7I/AAAAAAAAANI/QFDm3a7rfxQcmAM_ly8YHcSBuD4WW6FegCLcBGAs/s640/ 82 KB
82 KB 32ms
31ms Image
image/png 2a00:1450:4001:814::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://2.bp.blogspot.com/-9U3juJSttOw/WhyC_xXCS7I/AAAAAAAAANI/QFDm3a7rfxQcmAM_ly8YHcSBuD4WW6FegCLcBGAs/s640/image17.png

Requested by

Host: blog.talosintelligence.com
URL: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:814::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

fife /

Resource Hash

3c51cd30925a607212cf94ef119f07df1ebb1f5d185b30c1b9a0e16b3b8ffcde

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /-9U3juJSttOw/WhyC_xXCS7I/AAAAAAAAANI/QFDm3a7rfxQcmAM_ly8YHcSBuD4WW6FegCLcBGAs/s640/image17.png
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 2.bp.blogspot.com
referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
:scheme: https
:method: GET
Referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Thu, 30 Nov 2017 20:29:14 GMT
x-content-type-options: nosniff
age: 0
status: 200
content-disposition: inline;filename="image17.png"
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 84153
x-xss-protection: 1; mode=block
server: fife
etag: "vd5"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Fri, 01 Dec 2017 07:19:28 GMT

GET
H2 200 image11.png
1.bp.blogspot.com/--n6yXqONkEs/WhyDFe5MlnI/AAAAAAAAANM/3XsNWR3OdBUI3VK6FQLIhAGsopYx4WT5ACLcBGAs/s640/ 85 KB
85 KB 24ms
23ms Image
image/png 2a00:1450:4001:814::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1.bp.blogspot.com/--n6yXqONkEs/WhyDFe5MlnI/AAAAAAAAANM/3XsNWR3OdBUI3VK6FQLIhAGsopYx4WT5ACLcBGAs/s640/image11.png

Requested by

Host: blog.talosintelligence.com
URL: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:814::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

fife /

Resource Hash

9aab50fe9be26f42146f75f4636a17be7d66af5d5ea30a725d8c16743ef4469b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /--n6yXqONkEs/WhyDFe5MlnI/AAAAAAAAANM/3XsNWR3OdBUI3VK6FQLIhAGsopYx4WT5ACLcBGAs/s640/image11.png
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 1.bp.blogspot.com
referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
:scheme: https
:method: GET
Referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Thu, 30 Nov 2017 20:29:14 GMT
x-content-type-options: nosniff
age: 0
status: 200
content-disposition: inline;filename="image11.png"
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 86898
x-xss-protection: 1; mode=block
server: fife
etag: "vd5"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Fri, 01 Dec 2017 07:19:28 GMT

GET
H2 200 image3.png
2.bp.blogspot.com/-1c4E_cI5198/WhyDL5Xq05I/AAAAAAAAANQ/pkyAlBQDvAgq3n9AX1XpGuRd8uLEQhbVACLcBGAs/s640/ 54 KB
54 KB 25ms
24ms Image
image/png 2a00:1450:4001:814::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://2.bp.blogspot.com/-1c4E_cI5198/WhyDL5Xq05I/AAAAAAAAANQ/pkyAlBQDvAgq3n9AX1XpGuRd8uLEQhbVACLcBGAs/s640/image3.png

Requested by

Host: blog.talosintelligence.com
URL: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:814::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

fife /

Resource Hash

72b9d4ad35c93a600e4ebe84519ddcbc0ce109b265c1728652e6379db31808db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /-1c4E_cI5198/WhyDL5Xq05I/AAAAAAAAANQ/pkyAlBQDvAgq3n9AX1XpGuRd8uLEQhbVACLcBGAs/s640/image3.png
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 2.bp.blogspot.com
referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
:scheme: https
:method: GET
Referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Thu, 30 Nov 2017 20:29:14 GMT
x-content-type-options: nosniff
age: 0
status: 200
content-disposition: inline;filename="image3.png"
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 55052
x-xss-protection: 1; mode=block
server: fife
etag: "vd5"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Fri, 01 Dec 2017 07:19:28 GMT

GET
H2 200 image14.png
2.bp.blogspot.com/-kgM45XXgNKw/WhyDSVHJD5I/AAAAAAAAANY/y18ZaMeY3XAiJJt0c2qUT88YUc-HQfPtACLcBGAs/s640/ 105 KB
105 KB 26ms
26ms Image
image/png 2a00:1450:4001:814::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://2.bp.blogspot.com/-kgM45XXgNKw/WhyDSVHJD5I/AAAAAAAAANY/y18ZaMeY3XAiJJt0c2qUT88YUc-HQfPtACLcBGAs/s640/image14.png

Requested by

Host: blog.talosintelligence.com
URL: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:814::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

fife /

Resource Hash

9553ee3cd062452e7ef16ceb76def30ac55763dddf18bb84685105d64b0b17d6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /-kgM45XXgNKw/WhyDSVHJD5I/AAAAAAAAANY/y18ZaMeY3XAiJJt0c2qUT88YUc-HQfPtACLcBGAs/s640/image14.png
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 2.bp.blogspot.com
referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
:scheme: https
:method: GET
Referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Thu, 30 Nov 2017 20:29:14 GMT
x-content-type-options: nosniff
age: 0
status: 200
content-disposition: inline;filename="image14.png"
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 107914
x-xss-protection: 1; mode=block
server: fife
etag: "vdc"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Fri, 01 Dec 2017 10:47:11 GMT

GET
H2 200 image12.png
1.bp.blogspot.com/-wgeOLIL7OBQ/WhyDX-7egxI/AAAAAAAAANc/bj86udF7beAhD0Q3kWPDDLsJPNjWn-FBwCLcBGAs/s640/ 92 KB
92 KB 18ms
18ms Image
image/png 2a00:1450:4001:814::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1.bp.blogspot.com/-wgeOLIL7OBQ/WhyDX-7egxI/AAAAAAAAANc/bj86udF7beAhD0Q3kWPDDLsJPNjWn-FBwCLcBGAs/s640/image12.png

Requested by

Host: blog.talosintelligence.com
URL: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:814::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

fife /

Resource Hash

8cb0f170c28a730d5baef084f7a0690871de657845893040e2bf3dc93c50c130

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /-wgeOLIL7OBQ/WhyDX-7egxI/AAAAAAAAANc/bj86udF7beAhD0Q3kWPDDLsJPNjWn-FBwCLcBGAs/s640/image12.png
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 1.bp.blogspot.com
referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
:scheme: https
:method: GET
Referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Thu, 30 Nov 2017 20:29:14 GMT
x-content-type-options: nosniff
age: 0
status: 200
content-disposition: inline;filename="image12.png"
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 93957
x-xss-protection: 1; mode=block
server: fife
etag: "vdc"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Fri, 01 Dec 2017 07:19:28 GMT

GET
H2 200 image18.png
3.bp.blogspot.com/-PrgljjxiAFo/WhyEcoSdFdI/AAAAAAAAAN4/bdK6iwGJ8moRLm9NDzv_5CVZx82QlV0NQCLcBGAs/s640/ 36 KB
36 KB 17ms
17ms Image
image/png 2a00:1450:4001:814::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://3.bp.blogspot.com/-PrgljjxiAFo/WhyEcoSdFdI/AAAAAAAAAN4/bdK6iwGJ8moRLm9NDzv_5CVZx82QlV0NQCLcBGAs/s640/image18.png

Requested by

Host: blog.talosintelligence.com
URL: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:814::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

fife /

Resource Hash

d92c686e8b4f6b082442fdf64f6a5e4f7766c1e9332bf36f18f52746582ceeac

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /-PrgljjxiAFo/WhyEcoSdFdI/AAAAAAAAAN4/bdK6iwGJ8moRLm9NDzv_5CVZx82QlV0NQCLcBGAs/s640/image18.png
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 3.bp.blogspot.com
referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
:scheme: https
:method: GET
Referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Thu, 30 Nov 2017 20:29:14 GMT
x-content-type-options: nosniff
age: 0
status: 200
content-disposition: inline;filename="image18.png"
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 37040
x-xss-protection: 1; mode=block
server: fife
etag: "ve2"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Fri, 01 Dec 2017 07:19:28 GMT

GET
H2 200 image15.png
1.bp.blogspot.com/-mEPlwuN1nzk/WhyEywpiFYI/AAAAAAAAAOA/WJFSGK8Ylp8IQE6Vru-WMQWd57IGHsBkwCLcBGAs/s640/ 17 KB
17 KB 18ms
18ms Image
image/png 2a00:1450:4001:814::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1.bp.blogspot.com/-mEPlwuN1nzk/WhyEywpiFYI/AAAAAAAAAOA/WJFSGK8Ylp8IQE6Vru-WMQWd57IGHsBkwCLcBGAs/s640/image15.png

Requested by

Host: blog.talosintelligence.com
URL: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:814::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

fife /

Resource Hash

bba6832e48ea89eda09dd76de437cfa61892ac76978828d41e35b3c906dfb88a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /-mEPlwuN1nzk/WhyEywpiFYI/AAAAAAAAAOA/WJFSGK8Ylp8IQE6Vru-WMQWd57IGHsBkwCLcBGAs/s640/image15.png
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 1.bp.blogspot.com
referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
:scheme: https
:method: GET
Referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Thu, 30 Nov 2017 20:29:14 GMT
x-content-type-options: nosniff
age: 0
status: 200
content-disposition: inline;filename="image15.png"
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 17652
x-xss-protection: 1; mode=block
server: fife
etag: "ve2"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Fri, 01 Dec 2017 10:47:11 GMT

GET
H2 200 image9.png
3.bp.blogspot.com/-DFU-dyBrdNg/WhyFAJdvf6I/AAAAAAAAAOM/oP6_ri4qfBQZa3-1tuSvysODAQyRZT73gCLcBGAs/s640/ 25 KB
25 KB 19ms
17ms Image
image/png 2a00:1450:4001:814::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://3.bp.blogspot.com/-DFU-dyBrdNg/WhyFAJdvf6I/AAAAAAAAAOM/oP6_ri4qfBQZa3-1tuSvysODAQyRZT73gCLcBGAs/s640/image9.png

Requested by

Host: blog.talosintelligence.com
URL: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:814::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

fife /

Resource Hash

4dfa36892e6b7192adebbdad13cd3c2f82594287391fcd56ba0233d5fe7d6918

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /-DFU-dyBrdNg/WhyFAJdvf6I/AAAAAAAAAOM/oP6_ri4qfBQZa3-1tuSvysODAQyRZT73gCLcBGAs/s640/image9.png
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 3.bp.blogspot.com
referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
:scheme: https
:method: GET
Referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Thu, 30 Nov 2017 20:29:14 GMT
x-content-type-options: nosniff
age: 0
status: 200
content-disposition: inline;filename="image9.png"
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 25537
x-xss-protection: 1; mode=block
server: fife
etag: "ve6"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Fri, 01 Dec 2017 10:47:11 GMT

GET
H2 200 image16.png
4.bp.blogspot.com/-obpjJED7PA8/WhyFL04Jk0I/AAAAAAAAAOQ/5c1siYoQcdAt8UgR9YIuTXiawtZlN1DhACLcBGAs/s640/ 16 KB
16 KB 17ms
15ms Image
image/png 2a00:1450:4001:814::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://4.bp.blogspot.com/-obpjJED7PA8/WhyFL04Jk0I/AAAAAAAAAOQ/5c1siYoQcdAt8UgR9YIuTXiawtZlN1DhACLcBGAs/s640/image16.png

Requested by

Host: blog.talosintelligence.com
URL: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:814::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

fife /

Resource Hash

d1233d4d3a77ac832c8a9b95b4d6beee2e66c9529c6c042e44d375020c8bb2b8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /-obpjJED7PA8/WhyFL04Jk0I/AAAAAAAAAOQ/5c1siYoQcdAt8UgR9YIuTXiawtZlN1DhACLcBGAs/s640/image16.png
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 4.bp.blogspot.com
referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
:scheme: https
:method: GET
Referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Thu, 30 Nov 2017 20:29:14 GMT
x-content-type-options: nosniff
age: 0
status: 200
content-disposition: inline;filename="image16.png"
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 16781
x-xss-protection: 1; mode=block
server: fife
etag: "ve6"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Fri, 01 Dec 2017 07:19:28 GMT

GET
H2 200 image1.png
3.bp.blogspot.com/-h3Ubgz2tpKo/WhyDpf-abzI/AAAAAAAAANk/QXJs9157NFcro7ZHWf36KsfFiQ2yjgazgCLcBGAs/s1600/ 16 KB
16 KB 18ms
16ms Image
image/png 2a00:1450:4001:814::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://3.bp.blogspot.com/-h3Ubgz2tpKo/WhyDpf-abzI/AAAAAAAAANk/QXJs9157NFcro7ZHWf36KsfFiQ2yjgazgCLcBGAs/s1600/image1.png

Requested by

Host: blog.talosintelligence.com
URL: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:814::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

fife /

Resource Hash

21f5db706fb03fbe93d52b65c0b3bb21fcdd4985608c512c6a0ebe50a0c39284

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /-h3Ubgz2tpKo/WhyDpf-abzI/AAAAAAAAANk/QXJs9157NFcro7ZHWf36KsfFiQ2yjgazgCLcBGAs/s1600/image1.png
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 3.bp.blogspot.com
referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
:scheme: https
:method: GET
Referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Thu, 30 Nov 2017 20:29:14 GMT
x-content-type-options: nosniff
age: 0
status: 200
content-disposition: inline;filename="image1.png"
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 16107
x-xss-protection: 1; mode=block
server: fife
etag: "vdc"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Fri, 01 Dec 2017 07:19:28 GMT

GET
H/1.1 200
OK icon18_edit_allbkg.gif
img2.blogblog.com/img/ 162 B
162 B 13ms
6ms Image
image/gif 2a00:1450:4001:814::2009
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://img2.blogblog.com/img/icon18_edit_allbkg.gif

Requested by

Host: blog.talosintelligence.com
URL: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s

Protocol

HTTP/1.1

Server

2a00:1450:4001:814::2009 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

ca9848e6006cfec8f9ffa29433ade8152204bdb95579200831c6dc0f53dff70b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: img2.blogblog.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
Connection: keep-alive
Cache-Control: no-cache
Referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date: Fri, 24 Nov 2017 10:22:57 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 23 Nov 2017 16:55:48 GMT
Server: sffe
Age: 554777
Content-Type: image/gif
Cache-Control: public, max-age=604800
Accept-Ranges: bytes
Content-Length: 162
X-XSS-Protection: 1; mode=block
Expires: Fri, 01 Dec 2017 10:22:57 GMT

GET
H2

200

icon_fb-share_grey.svg
www.talosintelligence.com/assets/
Redirect Chain

http://www.talosintelligence.com/assets/icon_fb-share_grey.svg
https://www.talosintelligence.com/assets/icon_fb-share_grey.svg

851 B
573 B

14ms
14ms

Image
image/svg+xml

2400:cb00:2048:1::6810:1b36
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.talosintelligence.com/assets/icon_fb-share_grey.svg

Requested by

Host: blog.talosintelligence.com
URL: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2400:cb00:2048:1::6810:1b36 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare-nginx /

Resource Hash

ba5753dfae9cdac414e27b1b74973e9041d76173a44fe2151bdecc03e13599da

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff

Request headers

:path: /assets/icon_fb-share_grey.svg
pragma: no-cache
cookie: __cfduid=d509e23ebf18900163c858797a8330f121512073754
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: www.talosintelligence.com
referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
:scheme: https
:method: GET
Referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

cf-ray: 3c608ec88c1f637f-FRA
x-runtime: 0.004487
date: Thu, 30 Nov 2017 20:29:14 GMT
via: 1.1 vegur
x-content-type-options: nosniff
cf-cache-status: HIT
server: cloudflare-nginx
etag: W/"ba5753dfae9cdac414e27b1b74973e9041d76173a44fe2151bdecc03e13599da"
vary: Accept-Encoding
content-type: image/svg+xml
status: 200
cache-control: public, must-revalidate
strict-transport-security: max-age=0
content-encoding: gzip
x-request-id: dfae3c86-3d35-49dc-828d-ee924fcfed83

Redirect headers

Date: Thu, 30 Nov 2017 20:29:14 GMT
X-Content-Type-Options: nosniff
Server: cloudflare-nginx
Transfer-Encoding: chunked
Location: https://www.talosintelligence.com/assets/icon_fb-share_grey.svg
Cache-Control: max-age=3600
Connection: keep-alive
CF-RAY: 3c608ec7e70b265a-FRA
Expires: Thu, 30 Nov 2017 21:29:14 GMT

GET
H2

200

icon_tw-share_grey.svg
www.talosintelligence.com/assets/
Redirect Chain

http://www.talosintelligence.com/assets/icon_tw-share_grey.svg
https://www.talosintelligence.com/assets/icon_tw-share_grey.svg

1 KB
837 B

14ms
13ms

Image
image/svg+xml

2400:cb00:2048:1::6810:1b36
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.talosintelligence.com/assets/icon_tw-share_grey.svg

Requested by

Host: blog.talosintelligence.com
URL: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2400:cb00:2048:1::6810:1b36 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare-nginx /

Resource Hash

f23e9081ad69daedd9c1e7c4cd22513ba3ac3160b3a032d55a307c91be730920

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff

Request headers

:path: /assets/icon_tw-share_grey.svg
pragma: no-cache
cookie: __cfduid=d509e23ebf18900163c858797a8330f121512073754
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: www.talosintelligence.com
referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
:scheme: https
:method: GET
Referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

cf-ray: 3c608ec88c1d637f-FRA
x-runtime: 0.001657
date: Thu, 30 Nov 2017 20:29:14 GMT
via: 1.1 vegur
x-content-type-options: nosniff
cf-cache-status: HIT
server: cloudflare-nginx
etag: W/"f23e9081ad69daedd9c1e7c4cd22513ba3ac3160b3a032d55a307c91be730920"
vary: Accept-Encoding
content-type: image/svg+xml
status: 200
cache-control: public, must-revalidate
strict-transport-security: max-age=0
content-encoding: gzip
x-request-id: 15c17507-99dc-43fc-8cd6-de96d7637645

Redirect headers

Date: Thu, 30 Nov 2017 20:29:14 GMT
X-Content-Type-Options: nosniff
Server: cloudflare-nginx
Transfer-Encoding: chunked
Location: https://www.talosintelligence.com/assets/icon_tw-share_grey.svg
Cache-Control: max-age=3600
Connection: keep-alive
CF-RAY: 3c608ec7e5eb97b0-FRA
Expires: Thu, 30 Nov 2017 21:29:14 GMT

GET
H2

200

icon_re-share_grey.svg
www.talosintelligence.com/assets/
Redirect Chain

http://www.talosintelligence.com/assets/icon_re-share_grey.svg
https://www.talosintelligence.com/assets/icon_re-share_grey.svg

3 KB
1 KB

14ms
14ms

Image
image/svg+xml

2400:cb00:2048:1::6810:1b36
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.talosintelligence.com/assets/icon_re-share_grey.svg

Requested by

Host: blog.talosintelligence.com
URL: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2400:cb00:2048:1::6810:1b36 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare-nginx /

Resource Hash

b0fb32319c8ca714cbddda23041581d8ebae13d6ad925913f5b26e1664d680d5

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff

Request headers

:path: /assets/icon_re-share_grey.svg
pragma: no-cache
cookie: __cfduid=d509e23ebf18900163c858797a8330f121512073754
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: www.talosintelligence.com
referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
:scheme: https
:method: GET
Referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

cf-ray: 3c608ec88c20637f-FRA
x-runtime: 0.002645
date: Thu, 30 Nov 2017 20:29:14 GMT
via: 1.1 vegur
x-content-type-options: nosniff
cf-cache-status: HIT
server: cloudflare-nginx
etag: W/"b0fb32319c8ca714cbddda23041581d8ebae13d6ad925913f5b26e1664d680d5"
vary: Accept-Encoding
content-type: image/svg+xml
status: 200
cache-control: public, must-revalidate
strict-transport-security: max-age=0
content-encoding: gzip
x-request-id: f9d6301d-b103-4c59-81e1-1a179041700b

Redirect headers

Date: Thu, 30 Nov 2017 20:29:14 GMT
X-Content-Type-Options: nosniff
Server: cloudflare-nginx
Transfer-Encoding: chunked
Location: https://www.talosintelligence.com/assets/icon_re-share_grey.svg
Cache-Control: max-age=3600
Connection: keep-alive
CF-RAY: 3c608ec7e236638b-FRA
Expires: Thu, 30 Nov 2017 21:29:14 GMT

GET
H2

200

icon_em-share_grey.svg
www.talosintelligence.com/assets/
Redirect Chain

http://www.talosintelligence.com/assets/icon_em-share_grey.svg
https://www.talosintelligence.com/assets/icon_em-share_grey.svg

835 B
559 B

31ms
30ms

Image
image/svg+xml

2400:cb00:2048:1::6810:1b36
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.talosintelligence.com/assets/icon_em-share_grey.svg

Requested by

Host: blog.talosintelligence.com
URL: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2400:cb00:2048:1::6810:1b36 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare-nginx /

Resource Hash

1179f7c2d10f3ea42022f84cca8cadf9cc17acb9d2e928c79961d753b5d89275

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff

Request headers

:path: /assets/icon_em-share_grey.svg
pragma: no-cache
cookie: __cfduid=d509e23ebf18900163c858797a8330f121512073754
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: www.talosintelligence.com
referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
:scheme: https
:method: GET
Referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

cf-ray: 3c608ec88c24637f-FRA
x-runtime: 0.002082
date: Thu, 30 Nov 2017 20:29:14 GMT
via: 1.1 vegur
x-content-type-options: nosniff
cf-cache-status: HIT
server: cloudflare-nginx
etag: W/"1179f7c2d10f3ea42022f84cca8cadf9cc17acb9d2e928c79961d753b5d89275"
vary: Accept-Encoding
content-type: image/svg+xml
status: 200
cache-control: public, must-revalidate
strict-transport-security: max-age=0
content-encoding: gzip
x-request-id: a2b7e596-6f01-4171-915b-542241bd6bb1

Redirect headers

Date: Thu, 30 Nov 2017 20:29:14 GMT
X-Content-Type-Options: nosniff
Server: cloudflare-nginx
Transfer-Encoding: chunked
Location: https://www.talosintelligence.com/assets/icon_em-share_grey.svg
Cache-Control: max-age=3600
Connection: keep-alive
CF-RAY: 3c608ec7f16c6385-FRA
Expires: Thu, 30 Nov 2017 21:29:14 GMT

GET
H/1.1 200
OK email-decode.min.js Show response
blog.talosintelligence.com/cdn-cgi/scripts/ddc5a536/cloudflare-static/ 878 B
525 B 7ms
6ms Script
application/javascript 2400:cb00:2048:1::6810:1a36
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

http://blog.talosintelligence.com/cdn-cgi/scripts/ddc5a536/cloudflare-static/email-decode.min.js

Requested by

Host: blog.talosintelligence.com
URL: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s

Protocol

HTTP/1.1

Server

2400:cb00:2048:1::6810:1a36 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare-nginx /

Resource Hash

6b7e633fbafa358db332434b8c2924acd19bff3ec6d65f9615bbee668423d44a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: blog.talosintelligence.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept: */*
Referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
Cookie: __cfduid=d509e23ebf18900163c858797a8330f121512073754
Connection: keep-alive
Cache-Control: no-cache
Referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date: Thu, 30 Nov 2017 20:29:14 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Wed, 29 Nov 2017 09:24:12 GMT
Server: cloudflare-nginx
ETag: W/"5a1e7cbc-36e"
X-Frame-Options: SAMEORIGIN
Content-Type: application/javascript
Cache-Control: max-age=172800 public
Transfer-Encoding: chunked
Connection: keep-alive
CF-RAY: 3c608ec772582798-FRA
Expires: Sat, 02 Dec 2017 20:29:14 GMT

GET
H2 200 1930376684-comment_from_post_iframe.js Show response
www.blogger.com/static/v1/jsbin/ 11 KB
4 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:814::2009
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.blogger.com/static/v1/jsbin/1930376684-comment_from_post_iframe.js

Requested by

Host: blog.talosintelligence.com
URL: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:814::2009 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

540f4b7abbcbb4ac5591d0074a696a22c8c8ff679e491a96bc05545c0600d4ff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /static/v1/jsbin/1930376684-comment_from_post_iframe.js
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: */*
cache-control: no-cache
:authority: www.blogger.com
referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
:scheme: https
:method: GET
Referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Fri, 17 Nov 2017 02:43:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 17 Nov 2017 00:59:39 GMT
server: sffe
age: 1187170
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 4408
x-xss-protection: 1; mode=block
expires: Sat, 17 Nov 2018 02:43:04 GMT

GET
H2 200 icon18_wrench_allbkg.png
resources.blogblog.com/img/ 475 B
484 B 28ms
6ms Image
image/png 2a00:1450:4001:814::2009
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://resources.blogblog.com/img/icon18_wrench_allbkg.png

Requested by

Host: blog.talosintelligence.com
URL: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:814::2009 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

d172d750493be64a7ed84dec1dd2a0d787ba42f78bc694b0858f152c52b6620b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /img/icon18_wrench_allbkg.png
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: resources.blogblog.com
referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
:scheme: https
:method: GET
Referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Wed, 29 Nov 2017 20:18:59 GMT
x-content-type-options: nosniff
last-modified: Wed, 29 Nov 2017 05:46:42 GMT
server: sffe
age: 87015
content-type: image/png
status: 200
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 475
x-xss-protection: 1; mode=block
expires: Wed, 06 Dec 2017 20:18:59 GMT

GET
H2

200

icon_rss_orange.svg
www.talosintelligence.com/assets/
Redirect Chain

http://www.talosintelligence.com/assets/icon_rss_orange.svg
https://www.talosintelligence.com/assets/icon_rss_orange.svg

1 KB
819 B

13ms
13ms

Image
image/svg+xml

2400:cb00:2048:1::6810:1b36
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.talosintelligence.com/assets/icon_rss_orange.svg

Requested by

Host: blog.talosintelligence.com
URL: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2400:cb00:2048:1::6810:1b36 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare-nginx /

Resource Hash

29ec20506c9a93aaf3444bd98e2ecd22fe41b085002c9cdf1b1e1f8c2dc931f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff

Request headers

:path: /assets/icon_rss_orange.svg
pragma: no-cache
cookie: __cfduid=d509e23ebf18900163c858797a8330f121512073754
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: www.talosintelligence.com
referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
:scheme: https
:method: GET
Referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

cf-ray: 3c608ec88c21637f-FRA
x-runtime: 0.001706
date: Thu, 30 Nov 2017 20:29:14 GMT
via: 1.1 vegur
x-content-type-options: nosniff
cf-cache-status: HIT
server: cloudflare-nginx
etag: W/"29ec20506c9a93aaf3444bd98e2ecd22fe41b085002c9cdf1b1e1f8c2dc931f8"
vary: Accept-Encoding
content-type: image/svg+xml
status: 200
cache-control: public, must-revalidate
strict-transport-security: max-age=0
content-encoding: gzip
x-request-id: 1754b323-c647-49a6-852d-cdbc74bedf0c

Redirect headers

Date: Thu, 30 Nov 2017 20:29:14 GMT
X-Content-Type-Options: nosniff
Server: cloudflare-nginx
Transfer-Encoding: chunked
Location: https://www.talosintelligence.com/assets/icon_rss_orange.svg
Cache-Control: max-age=3600
Connection: keep-alive
CF-RAY: 3c608ec7f24727aa-FRA
Expires: Thu, 30 Nov 2017 21:29:14 GMT

GET
H2

200

icon_email_orange.svg
www.talosintelligence.com/assets/
Redirect Chain

http://www.talosintelligence.com/assets/icon_email_orange.svg
https://www.talosintelligence.com/assets/icon_email_orange.svg

839 B
502 B

12ms
12ms

Image
image/svg+xml

2400:cb00:2048:1::6810:1b36
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.talosintelligence.com/assets/icon_email_orange.svg

Requested by

Host: blog.talosintelligence.com
URL: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2400:cb00:2048:1::6810:1b36 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare-nginx /

Resource Hash

3f352db86262c5cbe0af82f15f00b097c7bb8fae116d50cd615540970f03b3da

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff

Request headers

:path: /assets/icon_email_orange.svg
pragma: no-cache
cookie: __cfduid=d509e23ebf18900163c858797a8330f121512073754
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: www.talosintelligence.com
referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
:scheme: https
:method: GET
Referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

cf-ray: 3c608ec88c23637f-FRA
x-runtime: 0.001726
date: Thu, 30 Nov 2017 20:29:14 GMT
via: 1.1 vegur
x-content-type-options: nosniff
cf-cache-status: HIT
server: cloudflare-nginx
etag: W/"3f352db86262c5cbe0af82f15f00b097c7bb8fae116d50cd615540970f03b3da"
vary: Accept-Encoding
content-type: image/svg+xml
status: 200
cache-control: public, must-revalidate
strict-transport-security: max-age=0
content-encoding: gzip
x-request-id: 168f2b32-890c-413d-9a13-82ee8d9506c3

Redirect headers

Date: Thu, 30 Nov 2017 20:29:14 GMT
X-Content-Type-Options: nosniff
Server: cloudflare-nginx
Transfer-Encoding: chunked
Location: https://www.talosintelligence.com/assets/icon_email_orange.svg
Cache-Control: max-age=3600
Connection: keep-alive
CF-RAY: 3c608ec7f7d1641b-FRA
Expires: Thu, 30 Nov 2017 21:29:14 GMT

GET
H2

200

footer_icon_tw.svg
www.talosintelligence.com/assets/
Redirect Chain

http://www.talosintelligence.com/assets/footer_icon_tw.svg
https://www.talosintelligence.com/assets/footer_icon_tw.svg

1 KB
861 B

12ms
11ms

Image
image/svg+xml

2400:cb00:2048:1::6810:1b36
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.talosintelligence.com/assets/footer_icon_tw.svg

Requested by

Host: blog.talosintelligence.com
URL: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2400:cb00:2048:1::6810:1b36 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare-nginx /

Resource Hash

bc0e96790d3264696a88a27c94294f32187c98547bcc5f0aaa422f8ddfb69dd1

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff

Request headers

:path: /assets/footer_icon_tw.svg
pragma: no-cache
cookie: __cfduid=d509e23ebf18900163c858797a8330f121512073754
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: www.talosintelligence.com
referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
:scheme: https
:method: GET
Referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

cf-ray: 3c608ec8cc85637f-FRA
x-runtime: 0.001612
date: Thu, 30 Nov 2017 20:29:15 GMT
via: 1.1 vegur
x-content-type-options: nosniff
cf-cache-status: HIT
server: cloudflare-nginx
etag: W/"bc0e96790d3264696a88a27c94294f32187c98547bcc5f0aaa422f8ddfb69dd1"
vary: Accept-Encoding
content-type: image/svg+xml
status: 200
cache-control: public, must-revalidate
strict-transport-security: max-age=0
content-encoding: gzip
x-request-id: 27b8f49d-3e23-41b6-907a-4e4b2f51eca0

Redirect headers

Date: Thu, 30 Nov 2017 20:29:14 GMT
X-Content-Type-Options: nosniff
Server: cloudflare-nginx
Transfer-Encoding: chunked
Location: https://www.talosintelligence.com/assets/footer_icon_tw.svg
Cache-Control: max-age=3600
Connection: keep-alive
CF-RAY: 3c608ec8a1c26385-FRA
Expires: Thu, 30 Nov 2017 21:29:14 GMT

GET
H2

200

footer_icon_fb.svg
www.talosintelligence.com/assets/
Redirect Chain

http://www.talosintelligence.com/assets/footer_icon_fb.svg
https://www.talosintelligence.com/assets/footer_icon_fb.svg

830 B
577 B

27ms
26ms

Image
image/svg+xml

2400:cb00:2048:1::6810:1b36
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.talosintelligence.com/assets/footer_icon_fb.svg

Requested by

Host: blog.talosintelligence.com
URL: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2400:cb00:2048:1::6810:1b36 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare-nginx /

Resource Hash

e029744c5b3e3f38babbb89b7b3ada13219c817320068aeb4add12da7f21fd5f

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff

Request headers

:path: /assets/footer_icon_fb.svg
pragma: no-cache
cookie: __cfduid=d509e23ebf18900163c858797a8330f121512073754
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: www.talosintelligence.com
referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
:scheme: https
:method: GET
Referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

cf-ray: 3c608ec8cc81637f-FRA
x-runtime: 0.003931
date: Thu, 30 Nov 2017 20:29:15 GMT
via: 1.1 vegur
x-content-type-options: nosniff
cf-cache-status: HIT
server: cloudflare-nginx
etag: W/"e029744c5b3e3f38babbb89b7b3ada13219c817320068aeb4add12da7f21fd5f"
vary: Accept-Encoding
content-type: image/svg+xml
status: 200
cache-control: public, must-revalidate
strict-transport-security: max-age=0
content-encoding: gzip
x-request-id: e597574f-d152-4046-bbf9-cf4b6b666c45

Redirect headers

Date: Thu, 30 Nov 2017 20:29:14 GMT
X-Content-Type-Options: nosniff
Server: cloudflare-nginx
Transfer-Encoding: chunked
Location: https://www.talosintelligence.com/assets/footer_icon_fb.svg
Cache-Control: max-age=3600
Connection: keep-alive
CF-RAY: 3c608ec89067641b-FRA
Expires: Thu, 30 Nov 2017 21:29:14 GMT

GET
H2

200

footer_icon_yt.svg
www.talosintelligence.com/assets/
Redirect Chain

http://www.talosintelligence.com/assets/footer_icon_yt.svg
https://www.talosintelligence.com/assets/footer_icon_yt.svg

1 KB
734 B

16ms
16ms

Image
image/svg+xml

2400:cb00:2048:1::6810:1b36
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.talosintelligence.com/assets/footer_icon_yt.svg

Requested by

Host: blog.talosintelligence.com
URL: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2400:cb00:2048:1::6810:1b36 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare-nginx /

Resource Hash

b812952e2ecbdd529f7423a246bca7bdba383e2bb484730a7895dc884e87446c

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff

Request headers

:path: /assets/footer_icon_yt.svg
pragma: no-cache
cookie: __cfduid=d509e23ebf18900163c858797a8330f121512073754
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: www.talosintelligence.com
referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
:scheme: https
:method: GET
Referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

cf-ray: 3c608ec8cc84637f-FRA
x-runtime: 0.002052
date: Thu, 30 Nov 2017 20:29:15 GMT
via: 1.1 vegur
x-content-type-options: nosniff
cf-cache-status: HIT
server: cloudflare-nginx
etag: W/"b812952e2ecbdd529f7423a246bca7bdba383e2bb484730a7895dc884e87446c"
vary: Accept-Encoding
content-type: image/svg+xml
status: 200
cache-control: public, must-revalidate
strict-transport-security: max-age=0
content-encoding: gzip
x-request-id: 5272c52e-87fd-4847-9705-6d2fac99c692

Redirect headers

Date: Thu, 30 Nov 2017 20:29:14 GMT
X-Content-Type-Options: nosniff
Server: cloudflare-nginx
Transfer-Encoding: chunked
Location: https://www.talosintelligence.com/assets/footer_icon_yt.svg
Cache-Control: max-age=3600
Connection: keep-alive
CF-RAY: 3c608ec8a2a427aa-FRA
Expires: Thu, 30 Nov 2017 21:29:14 GMT

GET
H2

200

footer_icon_li.svg
www.talosintelligence.com/assets/
Redirect Chain

http://www.talosintelligence.com/assets/footer_icon_li.svg
https://www.talosintelligence.com/assets/footer_icon_li.svg

1013 B
643 B

24ms
23ms

Image
image/svg+xml

2400:cb00:2048:1::6810:1b36
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.talosintelligence.com/assets/footer_icon_li.svg

Requested by

Host: blog.talosintelligence.com
URL: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2400:cb00:2048:1::6810:1b36 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare-nginx /

Resource Hash

bd0ddcd91a27b1c50c11176142adcf7f1f7bd4ab581b1f04518f681674889461

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff

Request headers

:path: /assets/footer_icon_li.svg
pragma: no-cache
cookie: __cfduid=d509e23ebf18900163c858797a8330f121512073754
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: www.talosintelligence.com
referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
:scheme: https
:method: GET
Referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

cf-ray: 3c608ec8cc83637f-FRA
x-runtime: 0.002319
date: Thu, 30 Nov 2017 20:29:15 GMT
via: 1.1 vegur
x-content-type-options: nosniff
cf-cache-status: HIT
server: cloudflare-nginx
etag: W/"bd0ddcd91a27b1c50c11176142adcf7f1f7bd4ab581b1f04518f681674889461"
vary: Accept-Encoding
content-type: image/svg+xml
status: 200
cache-control: public, must-revalidate
strict-transport-security: max-age=0
content-encoding: gzip
x-request-id: 4f255cf7-2165-4bf2-ac04-78d24a59abaa

Redirect headers

Date: Thu, 30 Nov 2017 20:29:14 GMT
X-Content-Type-Options: nosniff
Server: cloudflare-nginx
Transfer-Encoding: chunked
Location: https://www.talosintelligence.com/assets/footer_icon_li.svg
Cache-Control: max-age=3600
Connection: keep-alive
CF-RAY: 3c608ec89290638b-FRA
Expires: Thu, 30 Nov 2017 21:29:14 GMT

GET
H2

200

logo_cisco_grey.svg
www.talosintelligence.com/assets/
Redirect Chain

http://www.talosintelligence.com/assets/logo_cisco_grey.svg
https://www.talosintelligence.com/assets/logo_cisco_grey.svg

7 KB
2 KB

15ms
14ms

Image
image/svg+xml

2400:cb00:2048:1::6810:1b36
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.talosintelligence.com/assets/logo_cisco_grey.svg

Requested by

Host: blog.talosintelligence.com
URL: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2400:cb00:2048:1::6810:1b36 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare-nginx /

Resource Hash

26f5ea290915effad3bcafe2acabaad611aefc3a6ecee6fa50322de01686545c

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff

Request headers

:path: /assets/logo_cisco_grey.svg
pragma: no-cache
cookie: __cfduid=d509e23ebf18900163c858797a8330f121512073754
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: www.talosintelligence.com
referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
:scheme: https
:method: GET
Referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

cf-ray: 3c608ec8cc86637f-FRA
x-runtime: 0.002433
date: Thu, 30 Nov 2017 20:29:15 GMT
via: 1.1 vegur
x-content-type-options: nosniff
cf-cache-status: HIT
server: cloudflare-nginx
etag: W/"26f5ea290915effad3bcafe2acabaad611aefc3a6ecee6fa50322de01686545c"
vary: Accept-Encoding
content-type: image/svg+xml
status: 200
cache-control: public, must-revalidate
strict-transport-security: max-age=0
content-encoding: gzip
x-request-id: eb4e4275-b1c4-4e54-bd1b-7d50241c0ab4

Redirect headers

Date: Thu, 30 Nov 2017 20:29:14 GMT
X-Content-Type-Options: nosniff
Server: cloudflare-nginx
Transfer-Encoding: chunked
Location: https://www.talosintelligence.com/assets/logo_cisco_grey.svg
Cache-Control: max-age=3600
Connection: keep-alive
CF-RAY: 3c608ec8a781265a-FRA
Expires: Thu, 30 Nov 2017 21:29:14 GMT

GET
H2 200 plusone.js Show response
apis.google.com/js/ 43 KB
17 KB 32ms
32ms Script
application/javascript 2a00:1450:4001:814::200e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/js/plusone.js

Requested by

Host: blog.talosintelligence.com
URL: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:814::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

70c8436b7f0cee03daa4711f307224e132f66d7c8a6935644af29df6fcdb308a

Security Headers

Name	Value
Content-Security-Policy	script-src 'unsafe-inline' 'unsafe-eval' 'self' https://*.gstatic.com https://www.google-analytics.com https://pagead2.googleadservices.com https://pagead2.googlesyndication.com https://tpc.googlesyndication.com https://s.ytimg.com https://www.youtube.com;report-uri /_/cspreport/es_oz_20171128.14_p0
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /js/plusone.js
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: */*
cache-control: no-cache
:authority: apis.google.com
referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
:scheme: https
:method: GET
Referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

content-security-policy: script-src 'unsafe-inline' 'unsafe-eval' 'self' https://*.gstatic.com https://www.google-analytics.com https://pagead2.googleadservices.com https://pagead2.googlesyndication.com https://tpc.googlesyndication.com https://s.ytimg.com https://www.youtube.com;report-uri /_/cspreport/es_oz_20171128.14_p0
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
status: 200
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge, chrome=1
server: ESF
x-frame-options: SAMEORIGIN
date: Thu, 30 Nov 2017 20:29:14 GMT
strict-transport-security: max-age=31536000
content-type: application/javascript; charset=utf-8
cache-control: private, max-age=1800, stale-while-revalidate=1800
etag: "ffd3fffffc564f707193dbc74a7abce6"
set-cookie: NID=118=J-uC1aMrhsz9G-jffQutICNqYIMlFdhI3VjiVrl392maIgwzAwmwvS8bb3SHh7qaXXqEeKKJ2Gv2fEkf6GCls3niIifa1oCRf4LIphSskJ97YHBWU3uC3kX8gdWeaq0-;Domain=.google.com;Path=/;Expires=Fri, 01-Jun-2018 20:29:14 GMT;HttpOnly
timing-allow-origin: *
expires: Thu, 30 Nov 2017 20:29:14 GMT

GET
H2 200 3577707566-widgets.js Show response
www.blogger.com/static/v1/widgets/ 126 KB
45 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:814::2009
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.blogger.com/static/v1/widgets/3577707566-widgets.js

Requested by

Host: blog.talosintelligence.com
URL: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:814::2009 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

03b4dd14a1bb34ff5f93c7468408a75de96fa029ea4fe2325b03803d9cbad190

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /static/v1/widgets/3577707566-widgets.js
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: */*
cache-control: no-cache
:authority: www.blogger.com
referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
:scheme: https
:method: GET
Referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Thu, 23 Nov 2017 01:45:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 23 Nov 2017 00:04:15 GMT
server: sffe
age: 672249
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 45872
x-xss-protection: 1; mode=block
expires: Fri, 23 Nov 2018 01:45:05 GMT

GET
H/1.1 200
OK oMMgfZMQthOryQo9n22dcuvvDin1pK8aKteLpeZ5c0A.woff2
fonts.gstatic.com/s/roboto/v18/ 10 KB
10 KB 19ms
13ms Font
font/woff2 2a00:1450:4001:818::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.gstatic.com/s/roboto/v18/oMMgfZMQthOryQo9n22dcuvvDin1pK8aKteLpeZ5c0A.woff2

Requested by

Host: blog.talosintelligence.com
URL: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s

Protocol

HTTP/1.1

Server

2a00:1450:4001:818::2003 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

4352380f92ce7f9a4a4a23306b992bed10055dbfffe90987cc72083e583fc280

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Pragma: no-cache
Origin: http://blog.talosintelligence.com
Accept-Encoding: gzip, deflate
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept: */*
Referer: http://fonts.googleapis.com/css?family=Roboto:100,300,400|Exo+2:500,400,300,100,700|Fira+Mono
Connection: keep-alive
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Referer: http://fonts.googleapis.com/css?family=Roboto:100,300,400|Exo+2:500,400,300,100,700|Fira+Mono
Origin: http://blog.talosintelligence.com

Response headers

Date: Wed, 08 Nov 2017 19:21:21 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 16 Oct 2017 17:32:50 GMT
Server: sffe
Age: 1904873
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 10748
X-XSS-Protection: 1; mode=block
Expires: Thu, 08 Nov 2018 19:21:21 GMT

GET
H/1.1 200
OK AbMslUVu4Wq5jvNwOBLwLnYhjbSpvc47ee6xR_80Hnw.woff2
fonts.gstatic.com/s/exo2/v4/ 13 KB
13 KB 26ms
6ms Font
font/woff2 2a00:1450:4001:818::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.gstatic.com/s/exo2/v4/AbMslUVu4Wq5jvNwOBLwLnYhjbSpvc47ee6xR_80Hnw.woff2

Requested by

Host: blog.talosintelligence.com
URL: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s

Protocol

HTTP/1.1

Server

2a00:1450:4001:818::2003 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

80fe89cd3677762174d7e956d9645096bd51c57a943ed17ed330e3313123f5a9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Pragma: no-cache
Origin: http://blog.talosintelligence.com
Accept-Encoding: gzip, deflate
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept: */*
Referer: http://fonts.googleapis.com/css?family=Roboto:100,300,400|Exo+2:500,400,300,100,700|Fira+Mono
Connection: keep-alive
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Referer: http://fonts.googleapis.com/css?family=Roboto:100,300,400|Exo+2:500,400,300,100,700|Fira+Mono
Origin: http://blog.talosintelligence.com

Response headers

Date: Wed, 08 Nov 2017 18:05:20 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 10 Oct 2017 23:05:13 GMT
Server: sffe
Age: 1909434
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 13324
X-XSS-Protection: 1; mode=block
Expires: Thu, 08 Nov 2018 18:05:20 GMT

GET
H/1.1 200
OK mJrGVjHbrdshrbGyvd7vdaCWcynf_cDxXwCLxiixG1c.woff2
fonts.gstatic.com/s/exo2/v4/ 13 KB
13 KB 26ms
7ms Font
font/woff2 2a00:1450:4001:818::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.gstatic.com/s/exo2/v4/mJrGVjHbrdshrbGyvd7vdaCWcynf_cDxXwCLxiixG1c.woff2

Requested by

Host: blog.talosintelligence.com
URL: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s

Protocol

HTTP/1.1

Server

2a00:1450:4001:818::2003 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

044c6cd662c6a482c1a1e1720600aedd554ce9562fe450e3694df29562317f79

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Pragma: no-cache
Origin: http://blog.talosintelligence.com
Accept-Encoding: gzip, deflate
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept: */*
Referer: http://fonts.googleapis.com/css?family=Roboto:100,300,400|Exo+2:500,400,300,100,700|Fira+Mono
Connection: keep-alive
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Referer: http://fonts.googleapis.com/css?family=Roboto:100,300,400|Exo+2:500,400,300,100,700|Fira+Mono
Origin: http://blog.talosintelligence.com

Response headers

Date: Wed, 08 Nov 2017 17:53:51 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 10 Oct 2017 23:05:31 GMT
Server: sffe
Age: 1910123
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 13248
X-XSS-Protection: 1; mode=block
Expires: Thu, 08 Nov 2018 17:53:51 GMT

GET
H/1.1 200
OK Hgo13k-tfSpn0qi1SFdUfZBw1xU1rKptJj_0jans920.woff2
fonts.gstatic.com/s/roboto/v18/ 11 KB
11 KB 24ms
5ms Font
font/woff2 2a00:1450:4001:818::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.gstatic.com/s/roboto/v18/Hgo13k-tfSpn0qi1SFdUfZBw1xU1rKptJj_0jans920.woff2

Requested by

Host: blog.talosintelligence.com
URL: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s

Protocol

HTTP/1.1

Server

2a00:1450:4001:818::2003 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

f7c386915e39d8a925fe10d15744a9da95ac8f90423e12728e7fc3c5e34f4559

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Pragma: no-cache
Origin: http://blog.talosintelligence.com
Accept-Encoding: gzip, deflate
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept: */*
Referer: http://fonts.googleapis.com/css?family=Roboto:100,300,400|Exo+2:500,400,300,100,700|Fira+Mono
Connection: keep-alive
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Referer: http://fonts.googleapis.com/css?family=Roboto:100,300,400|Exo+2:500,400,300,100,700|Fira+Mono
Origin: http://blog.talosintelligence.com

Response headers

Date: Wed, 08 Nov 2017 18:59:13 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 16 Oct 2017 17:32:46 GMT
Server: sffe
Age: 1906201
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 10876
X-XSS-Protection: 1; mode=block
Expires: Thu, 08 Nov 2018 18:59:13 GMT

GET
H/1.1 200
OK SlRWfq1zeqXiYWAN-lnG-pBw1xU1rKptJj_0jans920.woff2
fonts.gstatic.com/s/firamono/v6/ 10 KB
10 KB 24ms
6ms Font
font/woff2 2a00:1450:4001:818::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.gstatic.com/s/firamono/v6/SlRWfq1zeqXiYWAN-lnG-pBw1xU1rKptJj_0jans920.woff2

Requested by

Host: blog.talosintelligence.com
URL: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s

Protocol

HTTP/1.1

Server

2a00:1450:4001:818::2003 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

ce2a95ea7202e115cc2e7b151c7b87a6fed261e543c1acf62d4ef450c7f63e94

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Pragma: no-cache
Origin: http://blog.talosintelligence.com
Accept-Encoding: gzip, deflate
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept: */*
Referer: http://fonts.googleapis.com/css?family=Roboto:100,300,400|Exo+2:500,400,300,100,700|Fira+Mono
Connection: keep-alive
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Referer: http://fonts.googleapis.com/css?family=Roboto:100,300,400|Exo+2:500,400,300,100,700|Fira+Mono
Origin: http://blog.talosintelligence.com

Response headers

Date: Wed, 08 Nov 2017 19:11:34 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 10 Oct 2017 20:48:42 GMT
Server: sffe
Age: 1905460
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 10716
X-XSS-Protection: 1; mode=block
Expires: Thu, 08 Nov 2018 19:11:34 GMT

GET
H/1.1 200
OK 6b9HPGUYUr8qZeNu0Z7o-HYhjbSpvc47ee6xR_80Hnw.woff2
fonts.gstatic.com/s/exo2/v4/ 13 KB
13 KB 23ms
6ms Font
font/woff2 2a00:1450:4001:818::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.gstatic.com/s/exo2/v4/6b9HPGUYUr8qZeNu0Z7o-HYhjbSpvc47ee6xR_80Hnw.woff2

Requested by

Host: blog.talosintelligence.com
URL: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s

Protocol

HTTP/1.1

Server

2a00:1450:4001:818::2003 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

c5c9a8cfef9c9f226004d1603b582f8f55e11c42142659f59a53a5f35cfa54c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Pragma: no-cache
Origin: http://blog.talosintelligence.com
Accept-Encoding: gzip, deflate
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept: */*
Referer: http://fonts.googleapis.com/css?family=Roboto:100,300,400|Exo+2:500,400,300,100,700|Fira+Mono
Connection: keep-alive
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Referer: http://fonts.googleapis.com/css?family=Roboto:100,300,400|Exo+2:500,400,300,100,700|Fira+Mono
Origin: http://blog.talosintelligence.com

Response headers

Date: Wed, 08 Nov 2017 18:08:27 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 10 Oct 2017 23:05:04 GMT
Server: sffe
Age: 1909247
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 13376
X-XSS-Protection: 1; mode=block
Expires: Thu, 08 Nov 2018 18:08:27 GMT

GET

comment-iframe.g
www.blogger.com/ Frame 3028
Redirect Chain

https://www.blogger.com/comment-iframe.g?blogID=1029833275466591797&postID=3991676789207201940&blogspotRpcToken=5321898
https://accounts.google.com/ServiceLogin?continue=https://www.blogger.com/comment-iframe.g?blogID%3D1029833275466591797%26postID%3D3991676789207201940%26blogspotRpcToken%3D5321898%26bpli%3D1&follow...
https://www.blogger.com/comment-iframe.g?blogID=1029833275466591797&postID=3991676789207201940&blogspotRpcToken=5321898&bpli=1

0
0

GET
H2

200

analytics.js Show response
www.google-analytics.com/
Redirect Chain

http://www.google-analytics.com/analytics.js
https://www.google-analytics.com/analytics.js

35 KB
14 KB

6ms
6ms

Script
text/javascript

2a00:1450:4001:818::200e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: blog.talosintelligence.com
URL: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:818::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

f8ef655ef916e39713ede9c6db56d7ca5618bd82cf5ac991dcd013f05e0fdfc7

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

:path: /analytics.js
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: */*
cache-control: no-cache
:authority: www.google-analytics.com
referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
:scheme: https
:method: GET
Referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 13 Nov 2017 20:19:12 GMT
server: Golfe2
age: 2442
date: Thu, 30 Nov 2017 19:48:32 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
timing-allow-origin: *
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 14597
expires: Thu, 30 Nov 2017 21:48:32 GMT

Redirect headers

Location: https://www.google-analytics.com/analytics.js
Non-Authoritative-Reason: HSTS

GET
H2 200 icon_search.svg
www.talosintelligence.com/assets/ 1 KB
634 B 40ms
16ms Image
image/svg+xml 2400:cb00:2048:1::6810:1b36
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.talosintelligence.com/assets/icon_search.svg

Requested by

Host: apis.google.com
URL: https://apis.google.com/js/plusone.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2400:cb00:2048:1::6810:1b36 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare-nginx /

Resource Hash

1ec2e33c88eec72d7050b474be41d3e79282421602d9120efc96d620b911c60e

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff

Request headers

:path: /assets/icon_search.svg
pragma: no-cache
cookie: __cfduid=d509e23ebf18900163c858797a8330f121512073754
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: www.talosintelligence.com
referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
:scheme: https
:method: GET
Referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

cf-ray: 3c608ec83bd9637f-FRA
x-runtime: 0.001725
date: Thu, 30 Nov 2017 20:29:14 GMT
via: 1.1 vegur
x-content-type-options: nosniff
cf-cache-status: HIT
server: cloudflare-nginx
etag: W/"1ec2e33c88eec72d7050b474be41d3e79282421602d9120efc96d620b911c60e"
vary: Accept-Encoding
content-type: image/svg+xml
status: 200
cache-control: public, must-revalidate
strict-transport-security: max-age=0
content-encoding: gzip
x-request-id: 138773ab-0a18-443e-855b-500126cb7fbb

GET
H2 200 cb=gapi.loaded_0 Show response
apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.de.F7a-wc4sUKs.O/m=plusone,profile/rt=j/sv=1/d=1/ed=1/am=AQ/rs=AGLTcCNViCwuEF2UrvVBCL4ftetBEBhytA/ 183 KB
63 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:814::200e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.de.F7a-wc4sUKs.O/m=plusone,profile/rt=j/sv=1/d=1/ed=1/am=AQ/rs=AGLTcCNViCwuEF2UrvVBCL4ftetBEBhytA/cb=gapi.loaded_0

Requested by

Host: apis.google.com
URL: https://apis.google.com/js/plusone.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:814::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

2de7e75ee2a063ece84872d532e14eb102743252e20f0fda678c0c9b2dd9450a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /_/scs/apps-static/_/js/k=oz.gapi.de.F7a-wc4sUKs.O/m=plusone,profile/rt=j/sv=1/d=1/ed=1/am=AQ/rs=AGLTcCNViCwuEF2UrvVBCL4ftetBEBhytA/cb=gapi.loaded_0
pragma: no-cache
cookie: NID=118=J-uC1aMrhsz9G-jffQutICNqYIMlFdhI3VjiVrl392maIgwzAwmwvS8bb3SHh7qaXXqEeKKJ2Gv2fEkf6GCls3niIifa1oCRf4LIphSskJ97YHBWU3uC3kX8gdWeaq0-
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: */*
cache-control: no-cache
:authority: apis.google.com
referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
:scheme: https
:method: GET
Referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Wed, 29 Nov 2017 22:04:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 29 Nov 2017 01:45:41 GMT
server: sffe
age: 80702
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
status: 200
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 64045
x-xss-protection: 1; mode=block
expires: Thu, 29 Nov 2018 22:04:12 GMT

GET
H2 200 lazy.min.js Show response
www.gstatic.com/feedback/js/help/prod/service/ 30 KB
11 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:81e::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/feedback/js/help/prod/service/lazy.min.js

Requested by

Host: apis.google.com
URL: https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.de.F7a-wc4sUKs.O/m=plusone,profile/rt=j/sv=1/d=1/ed=1/am=AQ/rs=AGLTcCNViCwuEF2UrvVBCL4ftetBEBhytA/cb=gapi.loaded_0

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:81e::2003 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

87400b6b2d1759daecaab2d56ad193fe4613aaa92c7ff366bf65469c47a6b661

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /feedback/js/help/prod/service/lazy.min.js
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: */*
cache-control: no-cache
:authority: www.gstatic.com
referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
:scheme: https
:method: GET
Referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Sun, 26 Nov 2017 03:02:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 17 Nov 2017 15:48:38 GMT
server: sffe
age: 408400
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 11278
x-xss-protection: 1; mode=block
expires: Sun, 03 Dec 2017 03:02:35 GMT

GET
H2 200 cb=gapi.loaded_1 Show response
apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.de.F7a-wc4sUKs.O/m=gapi_iframes_style_slide_menu/exm=plusone,profile/rt=j/sv=1/d=1/ed=1/am=AQ/rs=AGLTcCNViCwuEF2UrvVBCL4ftetBEBhytA/ 11 KB
4 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:814::200e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.de.F7a-wc4sUKs.O/m=gapi_iframes_style_slide_menu/exm=plusone,profile/rt=j/sv=1/d=1/ed=1/am=AQ/rs=AGLTcCNViCwuEF2UrvVBCL4ftetBEBhytA/cb=gapi.loaded_1

Requested by

Host: apis.google.com
URL: https://apis.google.com/js/plusone.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:814::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

7b6c97aa3b011ca29c1e0a9643c5cb1a8de00d3fb7c23fc995a350341083fcf4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /_/scs/apps-static/_/js/k=oz.gapi.de.F7a-wc4sUKs.O/m=gapi_iframes_style_slide_menu/exm=plusone,profile/rt=j/sv=1/d=1/ed=1/am=AQ/rs=AGLTcCNViCwuEF2UrvVBCL4ftetBEBhytA/cb=gapi.loaded_1
pragma: no-cache
cookie: NID=118=J-uC1aMrhsz9G-jffQutICNqYIMlFdhI3VjiVrl392maIgwzAwmwvS8bb3SHh7qaXXqEeKKJ2Gv2fEkf6GCls3niIifa1oCRf4LIphSskJ97YHBWU3uC3kX8gdWeaq0-
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: */*
cache-control: no-cache
:authority: apis.google.com
referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
:scheme: https
:method: GET
Referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Wed, 29 Nov 2017 22:18:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 29 Nov 2017 01:45:41 GMT
server: sffe
age: 79858
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
status: 200
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 4439
x-xss-protection: 1; mode=block
expires: Thu, 29 Nov 2018 22:18:17 GMT

GET
H2

200

collect
stats.g.doubleclick.net/r/
Redirect Chain

http://www.google-analytics.com/r/collect?v=1&_v=j66&a=1344197960&t=pageview&_s=1&dl=http%3A%2F%2Fblog.talosintelligence.com%2F2017%2F11%2FROKRAT-Reloaded.html%3Ff_l%3Ds&ul=en-us&de=UTF-8&dt=Cisco%...
https://www.google-analytics.com/r/collect?v=1&_v=j66&a=1344197960&t=pageview&_s=1&dl=http%3A%2F%2Fblog.talosintelligence.com%2F2017%2F11%2FROKRAT-Reloaded.html%3Ff_l%3Ds&ul=en-us&de=UTF-8&dt=Cisco...
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-30016562-3&cid=146855418.1512073755&jid=359168648&_gid=2057202281.1512073755&gjid=1250032666&_v=j66&z=674658500

35 B
53 B

15ms
15ms

Image
image/gif

2a00:1450:400c:c0b::9c
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-30016562-3&cid=146855418.1512073755&jid=359168648&_gid=2057202281.1512073755&gjid=1250032666&_v=j66&z=674658500

Requested by

Host: blog.talosintelligence.com
URL: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:400c:c0b::9c , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

:path: /r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-30016562-3&cid=146855418.1512073755&jid=359168648&_gid=2057202281.1512073755&gjid=1250032666&_v=j66&z=674658500
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: stats.g.doubleclick.net
referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
:scheme: https
:method: GET
Referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Thu, 30 Nov 2017 20:29:15 GMT
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 30 Nov 2017 20:29:15 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
status: 302
location: https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-30016562-3&cid=146855418.1512073755&jid=359168648&_gid=2057202281.1512073755&gjid=1250032666&_v=j66&z=674658500
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 417
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 368954415-lightbox_bundle.css
www.blogger.com/static/v1/v-css/ 35 KB
6 KB 6ms
6ms Stylesheet
text/css 2a00:1450:4001:814::2009
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.blogger.com/static/v1/v-css/368954415-lightbox_bundle.css

Requested by

Host: www.blogger.com
URL: https://www.blogger.com/static/v1/widgets/3577707566-widgets.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:814::2009 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

b60a462099b715aa3a5442a07142b969b9bb9c5ecee1bbdabea2e23f2d499458

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /static/v1/v-css/368954415-lightbox_bundle.css
pragma: no-cache
cookie: S=blogger=sto8OVWxNkY1CYcvk1HFnirwud7DkULI
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: text/css,*/*;q=0.1
cache-control: no-cache
:authority: www.blogger.com
referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
:scheme: https
:method: GET
Referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Thu, 23 Nov 2017 10:40:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 23 Nov 2017 08:45:33 GMT
server: sffe
age: 640096
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 6541
x-xss-protection: 1; mode=block
expires: Fri, 23 Nov 2018 10:40:59 GMT

GET
H2 200 3053021603-lbx.js Show response
www.blogger.com/static/v1/jsbin/ 388 KB
126 KB 9ms
9ms Script
text/javascript 2a00:1450:4001:814::2009
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.blogger.com/static/v1/jsbin/3053021603-lbx.js

Requested by

Host: www.blogger.com
URL: https://www.blogger.com/static/v1/widgets/3577707566-widgets.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:814::2009 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

e8d7515dd20bd35047c81bc9ceb894c78033dd0a98ba8da70f4c8cbb4755d2d4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /static/v1/jsbin/3053021603-lbx.js
pragma: no-cache
cookie: S=blogger=sto8OVWxNkY1CYcvk1HFnirwud7DkULI
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: */*
cache-control: no-cache
:authority: www.blogger.com
referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
:scheme: https
:method: GET
Referer: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Tue, 28 Nov 2017 04:17:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 27 Nov 2017 20:51:54 GMT
server: sffe
age: 231084
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 128831
x-xss-protection: 1; mode=block
expires: Wed, 28 Nov 2018 04:17:51 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.blogger.com
URL: https://www.blogger.com/comment-iframe.g?blogID=1029833275466591797&postID=3991676789207201940&blogspotRpcToken=5321898&bpli=1

Verdicts & Comments Add Verdict or Comment

73 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

5 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.talosintelligence.com/	1970-01-18 12:01:13	Name: _gat Value: 1
.talosintelligence.com/	1970-01-18 12:02:40	Name: _gid Value: GA1.2.2057202281.1512073755
.blogger.com/	1970-01-01 00:00:00	Name: S Value: blogger=sto8OVWxNkY1CYcvk1HFnirwud7DkULI
.talosintelligence.com/	1970-01-19 05:32:25	Name: _ga Value: GA1.2.146855418.1512073755
.talosintelligence.com/	1970-01-18 20:46:49	Name: __cfduid Value: d509e23ebf18900163c858797a8330f121512073754

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

1.bp.blogspot.com
2.bp.blogspot.com
3.bp.blogspot.com
4.bp.blogspot.com
apis.google.com
blog.talosintelligence.com
fonts.googleapis.com
fonts.gstatic.com
img2.blogblog.com
resources.blogblog.com
stats.g.doubleclick.net
www.blogger.com
www.google-analytics.com
www.gstatic.com
www.talosintelligence.com
www.blogger.com
2400:cb00:2048:1::6810:1936
2400:cb00:2048:1::6810:1a36
2400:cb00:2048:1::6810:1b36
2400:cb00:2048:1::6810:1c36
2400:cb00:2048:1::6810:1d36
2a00:1450:4001:814::2001
2a00:1450:4001:814::2009
2a00:1450:4001:814::200a
2a00:1450:4001:814::200e
2a00:1450:4001:818::2003
2a00:1450:4001:818::200e
2a00:1450:4001:81e::2003
2a00:1450:400c:c0b::9c
01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
03b4dd14a1bb34ff5f93c7468408a75de96fa029ea4fe2325b03803d9cbad190
044c6cd662c6a482c1a1e1720600aedd554ce9562fe450e3694df29562317f79
1179f7c2d10f3ea42022f84cca8cadf9cc17acb9d2e928c79961d753b5d89275
1ec2e33c88eec72d7050b474be41d3e79282421602d9120efc96d620b911c60e
21f5db706fb03fbe93d52b65c0b3bb21fcdd4985608c512c6a0ebe50a0c39284
23ceb7a0f6258fae8ec0f156cffca5e0259135728c489e4ca041fca5804a1c83
26f5ea290915effad3bcafe2acabaad611aefc3a6ecee6fa50322de01686545c
29ec20506c9a93aaf3444bd98e2ecd22fe41b085002c9cdf1b1e1f8c2dc931f8
2de7e75ee2a063ece84872d532e14eb102743252e20f0fda678c0c9b2dd9450a
3c51cd30925a607212cf94ef119f07df1ebb1f5d185b30c1b9a0e16b3b8ffcde
3f352db86262c5cbe0af82f15f00b097c7bb8fae116d50cd615540970f03b3da
4092c8e3c7b3958e5ac5e66d4788415595c11babbe5761477f2b0cdffd3231ee
4352380f92ce7f9a4a4a23306b992bed10055dbfffe90987cc72083e583fc280
4dfa36892e6b7192adebbdad13cd3c2f82594287391fcd56ba0233d5fe7d6918
53e382b21d553c64e067d714883b37558bcb020904d1986fb5120f6ecd2eaa4a
540f4b7abbcbb4ac5591d0074a696a22c8c8ff679e491a96bc05545c0600d4ff
630e4fd46a40c9983b7e8dcdee9366f5f7a921e8dc6882281dfced08b5744858
63555c37094b104d5246fd7a4de400a8679cb4c5532f59c2b7673e922a1503f9
6b7e633fbafa358db332434b8c2924acd19bff3ec6d65f9615bbee668423d44a
6bfe2a4e2bf7b651b7c7b8c1a6877898737e85c8e4c80baf99f3d0795834aa93
70c8436b7f0cee03daa4711f307224e132f66d7c8a6935644af29df6fcdb308a
72b9d4ad35c93a600e4ebe84519ddcbc0ce109b265c1728652e6379db31808db
73a25b8ead8e7c449b936da8334801caef2f201f46967a2a1635b75ebfa6d4ff
7b6c97aa3b011ca29c1e0a9643c5cb1a8de00d3fb7c23fc995a350341083fcf4
80fe89cd3677762174d7e956d9645096bd51c57a943ed17ed330e3313123f5a9
8168823dbb74046c4cacf5739d15df3c81770360e751a5e1a4fd79bfe42353d1
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
87400b6b2d1759daecaab2d56ad193fe4613aaa92c7ff366bf65469c47a6b661
8b8f5d18405f7b38f05161089408a0795ab53bd759e85a799a6b6152237d64c9
8cb0f170c28a730d5baef084f7a0690871de657845893040e2bf3dc93c50c130
8e9efe9645a7c12addd5aab3da7f84f348ac0c8bc8f5f49359f3aaa4bb087b48
9553ee3cd062452e7ef16ceb76def30ac55763dddf18bb84685105d64b0b17d6
9aab50fe9be26f42146f75f4636a17be7d66af5d5ea30a725d8c16743ef4469b
b0fb32319c8ca714cbddda23041581d8ebae13d6ad925913f5b26e1664d680d5
b60a462099b715aa3a5442a07142b969b9bb9c5ecee1bbdabea2e23f2d499458
b812952e2ecbdd529f7423a246bca7bdba383e2bb484730a7895dc884e87446c
ba5753dfae9cdac414e27b1b74973e9041d76173a44fe2151bdecc03e13599da
bba6832e48ea89eda09dd76de437cfa61892ac76978828d41e35b3c906dfb88a
bc0e96790d3264696a88a27c94294f32187c98547bcc5f0aaa422f8ddfb69dd1
bd0ddcd91a27b1c50c11176142adcf7f1f7bd4ab581b1f04518f681674889461
c5c9a8cfef9c9f226004d1603b582f8f55e11c42142659f59a53a5f35cfa54c0
c8b6dbe908e7b73e8a32a49df8445fbf5673a7a0ece4bc51ce1e8a3494a30041
ca9848e6006cfec8f9ffa29433ade8152204bdb95579200831c6dc0f53dff70b
ce2a95ea7202e115cc2e7b151c7b87a6fed261e543c1acf62d4ef450c7f63e94
d1233d4d3a77ac832c8a9b95b4d6beee2e66c9529c6c042e44d375020c8bb2b8
d172d750493be64a7ed84dec1dd2a0d787ba42f78bc694b0858f152c52b6620b
d653587e0ba104704feb374a84eb9ed6b485e45c55835cd4311475af0216f2ff
d92c686e8b4f6b082442fdf64f6a5e4f7766c1e9332bf36f18f52746582ceeac
e029744c5b3e3f38babbb89b7b3ada13219c817320068aeb4add12da7f21fd5f
e8d7515dd20bd35047c81bc9ceb894c78033dd0a98ba8da70f4c8cbb4755d2d4
f23e9081ad69daedd9c1e7c4cd22513ba3ac3160b3a032d55a307c91be730920
f7c386915e39d8a925fe10d15744a9da95ac8f90423e12728e7fc3c5e34f4559
f8ef655ef916e39713ede9c6db56d7ca5618bd82cf5ac991dcd013f05e0fdfc7
f95dc7ebaf77a683791e59adf16e14be4f1e96e8c75c7640f8ef1a319cc3dc55

blog.talosintelligence.com Open in urlscan Pro 2400:cb00:2048:1::6810:1a36 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

56 Requests

80 %HTTPS

100 %IPv6

9 Domains

15 Subdomains

11 IPs

2 Countries

1730 kBTransfer

2472 kBSize

5 Cookies

105 Outgoing links

Redirected requests

56 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

blog.talosintelligence.com Open in urlscan Pro
2400:cb00:2048:1::6810:1a36 Public Scan

Screenshot
Live screenshot

Full Image

56
Requests

80 %
HTTPS

100 %
IPv6

9
Domains

15
Subdomains

11
IPs

2
Countries

1730 kB
Transfer

2472 kB
Size

5
Cookies

56 HTTP transactions
0 data transactions