www.bankinfosecurity.com Open in urlscan Pro
50.56.167.254 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Submission: On January 09 via api (January 9th 2025, 2:11:18 am UTC) from TR — Scanned from US

Summary HTTP 246 Redirects Links 53 Behaviour Indicators

Summary

This website contacted 49 IPs in 2 countries across 34 domains to perform 246 HTTP transactions. The main IP is 50.56.167.254, located in United States and belongs to RMH-14, US. The main domain is www.bankinfosecurity.com. The Cisco Umbrella rank of the primary domain is 734646.
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on July 30th 2024. Valid for: a year.

This is the only time www.bankinfosecurity.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
28	50.56.167.254 50.56.167.254	33070 (RMH-14) (RMH-14)
1	2607:f8b0:400... 2607:f8b0:4004:c1b::5f	15169 (GOOGLE) (GOOGLE)
2	18.165.83.61 18.165.83.61	16509 (AMAZON-02) (AMAZON-02)
17	23.43.207.143 23.43.207.143	16625 (AKAMAI-AS) (AKAMAI-AS)
52	23.60.78.137 23.60.78.137	16625 (AKAMAI-AS) (AKAMAI-AS)
1	104.130.251.6 104.130.251.6	33070 (RMH-14) (RMH-14)
1	2607:f8b0:400... 2607:f8b0:4004:c1f::9b	15169 (GOOGLE) (GOOGLE)
2	23.9.166.209 23.9.166.209	16625 (AKAMAI-AS) (AKAMAI-AS)
4	2607:f8b0:400... 2607:f8b0:4004:c1d::61	15169 (GOOGLE) (GOOGLE)
2	142.251.179.94 142.251.179.94	15169 (GOOGLE) (GOOGLE)
1	199.232.192.134 199.232.192.134	54113 (FASTLY) (FASTLY)
2 7	34.117.77.79 34.117.77.79	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	2600:1408:c40... 2600:1408:c400:24::17da:d819	20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.)
2	2600:1408:c40... 2600:1408:c400:24::17da:d815	20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.)
15	23.205.106.73 23.205.106.73	20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.)
1	18.160.45.62 18.160.45.62	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:250... 2600:9000:250b:ce00:c:abe:f440:93a1	16509 (AMAZON-02) (AMAZON-02)
1 2	3.13.151.97 3.13.151.97	16509 (AMAZON-02) (AMAZON-02)
1	23.205.106.74 23.205.106.74	20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.)
1	34.228.175.96 34.228.175.96	14618 (AMAZON-AES) (AMAZON-AES)
1	35.175.32.137 35.175.32.137	14618 (AMAZON-AES) (AMAZON-AES)
17	142.251.179.157 142.251.179.157	15169 (GOOGLE) (GOOGLE)
1 2	18.233.177.54 18.233.177.54	14618 (AMAZON-AES) (AMAZON-AES)
2 2	35.244.154.8 35.244.154.8	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2 2	15.197.193.217 15.197.193.217	16509 (AMAZON-02) (AMAZON-02)
2 2	68.67.181.230 68.67.181.230	29990 (ASN-APPNEX) (ASN-APPNEX)
2 3	44.196.77.126 44.196.77.126	14618 (AMAZON-AES) (AMAZON-AES)
4 6	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	2620:1ec:bdf::40 2620:1ec:bdf::40	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	2600:9000:28a... 2600:9000:28ac:a600:2:8f43:5780:93a1	16509 (AMAZON-02) (AMAZON-02)
2	104.19.147.8 104.19.147.8	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2600:1408:c40... 2600:1408:c400:d::17cd:6a49	20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.)
2	192.28.147.68 192.28.147.68	15224 (OMNITURE) (OMNITURE)
3	2600:9000:26c... 2600:9000:26c1:b000:1d:85c3:6640:93a1	16509 (AMAZON-02) (AMAZON-02)
1	151.101.0.134 151.101.0.134	54113 (FASTLY) (FASTLY)
3	2001:4860:480... 2001:4860:4802:36::178	15169 (GOOGLE) (GOOGLE)
2	99.83.231.3 99.83.231.3	16509 (AMAZON-02) (AMAZON-02)
1	2607:f8b0:400... 2607:f8b0:4004:c09::84	15169 (GOOGLE) (GOOGLE)
1	23.205.106.89 23.205.106.89	20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.)
2	75.2.108.141 75.2.108.141	16509 (AMAZON-02) (AMAZON-02)
5	3.171.76.38 3.171.76.38	16509 (AMAZON-02) (AMAZON-02)
3	4.227.249.197 4.227.249.197	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
20	2607:f8b0:400... 2607:f8b0:4004:c07::84	15169 (GOOGLE) (GOOGLE)
21	172.253.115.155 172.253.115.155	15169 (GOOGLE) (GOOGLE)
3	3.171.100.53 3.171.100.53	16509 (AMAZON-02) (AMAZON-02)
1 1	3.33.220.150 3.33.220.150	16509 (AMAZON-02) (AMAZON-02)
1	3.167.119.120 3.167.119.120	16509 (AMAZON-02) (AMAZON-02)
2	2600:9000:27d... 2600:9000:27d1:5200:6:8656:f5c0:93a1	16509 (AMAZON-02) (AMAZON-02)
1	64.233.180.156 64.233.180.156	15169 (GOOGLE) (GOOGLE)
1 2	20.110.205.119 20.110.205.119	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 1	2620:1ec:c11:... 2620:1ec:c11::237	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	172.253.63.147 172.253.63.147	15169 (GOOGLE) (GOOGLE)
246	49

28 50.56.167.254 (United States)

ASN33070 (RMH-14, US)

www.bankinfosecurity.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4004:c1b::5f (Washington, United States)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.165.83.61 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-165-83-61.iad55.r.cloudfront.net

platform-api.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 23.43.207.143 (Chicago, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-43-207-143.deploy.static.akamaitechnologies.com

130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

52 23.60.78.137 (Chicago, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-60-78-137.deploy.static.akamaitechnologies.com

0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
4a7efb2d53317100f611-1d7064c4f7b6de25658a4199efb34975.ssl.cf1.rackcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
6d63d49ccb7c52435540-5070aa97eaa2b8df4eb5a91600e69901.ssl.cf1.rackcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
fa94d5c47256403c613d-7164cafcaac68bfd3318486ab257f999.ssl.cf1.rackcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
21aaef15263171502b5a-3fc6a64a094676b060fa7dc8c4490be9.ssl.cf1.rackcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
752b069ec945bee67d86-1021436e05aad7b2347bf3096cc7e309.ssl.cf1.rackcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.130.251.6 (United States)

ASN33070 (RMH-14, US)

worker.ismgcorp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4004:c1f::9b (Washington, United States)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.9.166.209 (United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-9-166-209.deploy.static.akamaitechnologies.com

munchkin.marketo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2607:f8b0:4004:c1d::61 (Washington, United States)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.251.179.94 (Farmingdale, United States)

ASN15169 (GOOGLE, US)
PTR: pd-in-f94.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 199.232.192.134 (United States)

ASN54113 (FASTLY, US)

bankinfosecurity.disqus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 34.117.77.79 (Kansas City, United States) 2 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 79.77.117.34.bc.googleusercontent.com

ml314.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1408:c400:24::17da:d819 (Ashburn, United States)

ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL)

sjs.bizographics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:1408:c400:24::17da:d815 (Ashburn, United States)

ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 23.205.106.73 (Ashburn, United States)

ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL)
PTR: a23-205-106-73.deploy.static.akamaitechnologies.com

j.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.160.45.62 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-160-45-62.iad55.r.cloudfront.net

dnn506yrbagrg.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:250b:ce00:c:abe:f440:93a1 (United States)

ASN16509 (AMAZON-02, US)

buttons-config.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.13.151.97 (Columbus, United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-13-151-97.us-east-2.compute.amazonaws.com

l.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.205.106.74 (Ashburn, United States)

ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL)
PTR: a23-205-106-74.deploy.static.akamaitechnologies.com

t.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.228.175.96 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-228-175-96.compute-1.amazonaws.com

bcp.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.175.32.137 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-35-175-32-137.compute-1.amazonaws.com

in.ml314.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 142.251.179.157 (Farmingdale, United States)

ASN15169 (GOOGLE, US)
PTR: pd-in-f157.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.233.177.54 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-18-233-177-54.compute-1.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.244.154.8 (Kansas City, United States) 2 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 8.154.244.35.bc.googleusercontent.com

idsync.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 15.197.193.217 (Seattle, United States) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: a12b7a488abeaa9e4.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 68.67.181.230 (North Bergen, United States) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 1042.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 44.196.77.126 (Ashburn, United States) 2 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-44-196-77-126.compute-1.amazonaws.com

ps.eyeota.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2620:1ec:21::14 (United States) 4 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:1ec:bdf::40 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.clarity.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:28ac:a600:2:8f43:5780:93a1 (United States)

ASN16509 (AMAZON-02, US)

nexus.ensighten.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.19.147.8 (None, )

ASN13335 (CLOUDFLARENET, US)

script.crazyegg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:1408:c400:d::17cd:6a49 (Ashburn, United States)

ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL)

ipv6.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 192.28.147.68 (United States)

ASN15224 (OMNITURE, US)

051-zxi-237.mktoresp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:9000:26c1:b000:1d:85c3:6640:93a1 (United States)

ASN16509 (AMAZON-02, US)

platform-cdn.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.0.134 (San Francisco, United States)

ASN54113 (FASTLY, US)

disqus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2001:4860:4802:36::178 (United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 99.83.231.3 (United States)

ASN16509 (AMAZON-02, US)
PTR: afe865822f884bb48.awsglobalaccelerator.com

epsilon.6sense.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4004:c09::84 (Washington, United States)

ASN15169 (GOOGLE, US)

5e8e59f6e1ebb9fa9791aec59a922de3.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.205.106.89 (Ashburn, United States)

ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL)
PTR: a23-205-106-89.deploy.static.akamaitechnologies.com

t.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 75.2.108.141 (United States)

ASN16509 (AMAZON-02, US)
PTR: afe865822f884bb48.awsglobalaccelerator.com

eps.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 3.171.76.38 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-3-171-76-38.iad89.r.cloudfront.net

v.eps.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 4.227.249.197 (Washington, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

u.clarity.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

20 2607:f8b0:4004:c07::84 (Washington, United States)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ep2.adtrafficquality.google	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

21 172.253.115.155 (United States)

ASN15169 (GOOGLE, US)
PTR: bg-in-f155.1e100.net

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 3.171.100.53 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-3-171-100-53.iad12.r.cloudfront.net

nexus.ensighten.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.33.220.150 (Seattle, United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: a12b7a488abeaa9e4.awsglobalaccelerator.com

insight.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.167.119.120 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-3-167-119-120.iad55.r.cloudfront.net

d1eoo1tco6rr5e.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:27d1:5200:6:8656:f5c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

c.disquscdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 64.233.180.156 (United States)

ASN15169 (GOOGLE, US)
PTR: pe-in-f156.1e100.net

ep1.adtrafficquality.google	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 20.110.205.119 (Boydton, United States) 1 redirects

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

c.clarity.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:c11::237 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

c.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.253.63.147 (United States)

ASN15169 (GOOGLE, US)
PTR: bi-in-f147.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
69	rackcdn.com 130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com — Cisco Umbrella Rank: 285694 0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com — Cisco Umbrella Rank: 700720 4a7efb2d53317100f611-1d7064c4f7b6de25658a4199efb34975.ssl.cf1.rackcdn.com — Cisco Umbrella Rank: 724293 75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com — Cisco Umbrella Rank: 314497 6d63d49ccb7c52435540-5070aa97eaa2b8df4eb5a91600e69901.ssl.cf1.rackcdn.com — Cisco Umbrella Rank: 600904 dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com — Cisco Umbrella Rank: 622056 fa94d5c47256403c613d-7164cafcaac68bfd3318486ab257f999.ssl.cf1.rackcdn.com — Cisco Umbrella Rank: 781143 21aaef15263171502b5a-3fc6a64a094676b060fa7dc8c4490be9.ssl.cf1.rackcdn.com — Cisco Umbrella Rank: 754216 752b069ec945bee67d86-1021436e05aad7b2347bf3096cc7e309.ssl.cf1.rackcdn.com — Cisco Umbrella Rank: 325014	9 MB
40	googlesyndication.com 5e8e59f6e1ebb9fa9791aec59a922de3.safeframe.googlesyndication.com tpc.googlesyndication.com — Cisco Umbrella Rank: 173 pagead2.googlesyndication.com — Cisco Umbrella Rank: 110	304 KB
28	bankinfosecurity.com www.bankinfosecurity.com — Cisco Umbrella Rank: 734646	459 KB
24	6sc.co j.6sc.co — Cisco Umbrella Rank: 5557 c.6sc.co — Cisco Umbrella Rank: 6739 ipv6.6sc.co — Cisco Umbrella Rank: 5633 b.6sc.co — Cisco Umbrella Rank: 3603 eps.6sc.co — Cisco Umbrella Rank: 9024 v.eps.6sc.co — Cisco Umbrella Rank: 16220	25 KB
17	doubleclick.net securepubads.g.doubleclick.net — Cisco Umbrella Rank: 218	216 KB
10	sharethis.com 1 redirects platform-api.sharethis.com — Cisco Umbrella Rank: 5010 buttons-config.sharethis.com — Cisco Umbrella Rank: 5845 l.sharethis.com — Cisco Umbrella Rank: 5470 t.sharethis.com — Cisco Umbrella Rank: 7050 platform-cdn.sharethis.com — Cisco Umbrella Rank: 10787	66 KB
8	ml314.com 2 redirects ml314.com — Cisco Umbrella Rank: 1917 in.ml314.com — Cisco Umbrella Rank: 13563	15 KB
7	clarity.ms 1 redirects www.clarity.ms — Cisco Umbrella Rank: 625 u.clarity.ms — Cisco Umbrella Rank: 7789 c.clarity.ms — Cisco Umbrella Rank: 1269	31 KB
7	linkedin.com 4 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 333 www.linkedin.com — Cisco Umbrella Rank: 676 px4.ads.linkedin.com — Cisco Umbrella Rank: 7032	5 KB
5	ensighten.com nexus.ensighten.com — Cisco Umbrella Rank: 4813	21 KB
4	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 39	352 KB
3	adtrafficquality.google ep1.adtrafficquality.google — Cisco Umbrella Rank: 389 ep2.adtrafficquality.google — Cisco Umbrella Rank: 403	20 KB
3	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 36
3	eyeota.net 2 redirects ps.eyeota.net — Cisco Umbrella Rank: 1141	1 KB
3	adsrvr.org 3 redirects match.adsrvr.org — Cisco Umbrella Rank: 377 insight.adsrvr.org — Cisco Umbrella Rank: 960	1 KB
2	disquscdn.com c.disquscdn.com — Cisco Umbrella Rank: 6938	841 B
2	6sense.com epsilon.6sense.com — Cisco Umbrella Rank: 29160	666 B
2	mktoresp.com 051-zxi-237.mktoresp.com — Cisco Umbrella Rank: 784216	636 B
2	crazyegg.com script.crazyegg.com — Cisco Umbrella Rank: 2604	3 KB
2	adnxs.com 2 redirects ib.adnxs.com — Cisco Umbrella Rank: 281	2 KB
2	rlcdn.com 2 redirects idsync.rlcdn.com — Cisco Umbrella Rank: 476	836 B
2	demdex.net 1 redirects dpm.demdex.net — Cisco Umbrella Rank: 262	1 KB
2	cloudfront.net dnn506yrbagrg.cloudfront.net d1eoo1tco6rr5e.cloudfront.net	820 B
2	licdn.com snap.licdn.com — Cisco Umbrella Rank: 831	24 KB
2	disqus.com bankinfosecurity.disqus.com disqus.com — Cisco Umbrella Rank: 1315	26 KB
2	gstatic.com fonts.gstatic.com	96 KB
2	marketo.net munchkin.marketo.net — Cisco Umbrella Rank: 3671	7 KB
1	google.com www.google.com — Cisco Umbrella Rank: 3
1	bing.com 1 redirects c.bing.com — Cisco Umbrella Rank: 205	769 B
1	crwdcntrl.net bcp.crwdcntrl.net — Cisco Umbrella Rank: 1026	596 B
1	bizographics.com sjs.bizographics.com — Cisco Umbrella Rank: 47137	17 KB
1	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 332	33 KB
1	ismgcorp.com worker.ismgcorp.com — Cisco Umbrella Rank: 892896	305 B
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 29	3 KB
246	34

	Domain	Requested by
28	www.bankinfosecurity.com	www.bankinfosecurity.com
21	pagead2.googlesyndication.com	securepubads.g.doubleclick.net pagead2.googlesyndication.com
18	tpc.googlesyndication.com	securepubads.g.doubleclick.net
17	securepubads.g.doubleclick.net	www.googletagservices.com www.bankinfosecurity.com securepubads.g.doubleclick.net pagead2.googlesyndication.com
17	130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com	www.bankinfosecurity.com
12	b.6sc.co	www.bankinfosecurity.com
11	dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com	www.bankinfosecurity.com
11	0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com	www.bankinfosecurity.com
9	75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com	www.bankinfosecurity.com
7	ml314.com	2 redirects www.bankinfosecurity.com ml314.com
5	v.eps.6sc.co	j.6sc.co
5	nexus.ensighten.com	www.googletagmanager.com nexus.ensighten.com
5	px.ads.linkedin.com	3 redirects sjs.bizographics.com snap.licdn.com
5	6d63d49ccb7c52435540-5070aa97eaa2b8df4eb5a91600e69901.ssl.cf1.rackcdn.com	www.bankinfosecurity.com
4	www.googletagmanager.com	www.bankinfosecurity.com www.googletagmanager.com
4	752b069ec945bee67d86-1021436e05aad7b2347bf3096cc7e309.ssl.cf1.rackcdn.com	www.bankinfosecurity.com
4	21aaef15263171502b5a-3fc6a64a094676b060fa7dc8c4490be9.ssl.cf1.rackcdn.com	www.bankinfosecurity.com
4	fa94d5c47256403c613d-7164cafcaac68bfd3318486ab257f999.ssl.cf1.rackcdn.com	www.bankinfosecurity.com
4	4a7efb2d53317100f611-1d7064c4f7b6de25658a4199efb34975.ssl.cf1.rackcdn.com	www.bankinfosecurity.com
3	u.clarity.ms	www.clarity.ms
3	www.google-analytics.com	www.googletagmanager.com
3	platform-cdn.sharethis.com	www.bankinfosecurity.com
3	ps.eyeota.net	2 redirects www.bankinfosecurity.com
2	ep2.adtrafficquality.google	securepubads.g.doubleclick.net ep2.adtrafficquality.google
2	c.clarity.ms	1 redirects
2	c.disquscdn.com	bankinfosecurity.disqus.com
2	eps.6sc.co	j.6sc.co
2	epsilon.6sense.com	j.6sc.co
2	051-zxi-237.mktoresp.com	munchkin.marketo.net
2	ipv6.6sc.co	j.6sc.co
2	c.6sc.co	j.6sc.co
2	script.crazyegg.com	dnn506yrbagrg.cloudfront.net script.crazyegg.com
2	www.clarity.ms	www.bankinfosecurity.com www.clarity.ms
2	ib.adnxs.com	2 redirects
2	match.adsrvr.org	2 redirects
2	idsync.rlcdn.com	2 redirects
2	dpm.demdex.net	1 redirects www.bankinfosecurity.com
2	t.sharethis.com	platform-api.sharethis.com t.sharethis.com
2	l.sharethis.com	1 redirects www.bankinfosecurity.com
2	snap.licdn.com	www.bankinfosecurity.com snap.licdn.com
2	fonts.gstatic.com	fonts.googleapis.com
2	munchkin.marketo.net	www.bankinfosecurity.com munchkin.marketo.net
2	platform-api.sharethis.com	www.bankinfosecurity.com platform-api.sharethis.com
1	www.google.com	ep2.adtrafficquality.google
1	c.bing.com	1 redirects
1	ep1.adtrafficquality.google	securepubads.g.doubleclick.net
1	d1eoo1tco6rr5e.cloudfront.net	nexus.ensighten.com
1	insight.adsrvr.org	1 redirects
1	5e8e59f6e1ebb9fa9791aec59a922de3.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
1	disqus.com	bankinfosecurity.disqus.com
1	px4.ads.linkedin.com	www.bankinfosecurity.com
1	www.linkedin.com	1 redirects
1	in.ml314.com	ml314.com
1	bcp.crwdcntrl.net	platform-api.sharethis.com
1	buttons-config.sharethis.com	platform-api.sharethis.com
1	dnn506yrbagrg.cloudfront.net	www.bankinfosecurity.com
1	j.6sc.co	www.bankinfosecurity.com
1	sjs.bizographics.com	www.bankinfosecurity.com
1	bankinfosecurity.disqus.com	www.bankinfosecurity.com
1	www.googletagservices.com	www.bankinfosecurity.com
1	worker.ismgcorp.com	www.bankinfosecurity.com
1	fonts.googleapis.com	www.bankinfosecurity.com
246	62

This site contains links to these domains. Also see Links.

Domain
www.cuinfosecurity.com
www.govinfosecurity.com
www.healthcareinfosecurity.com
www.inforisktoday.com
www.careersinfosecurity.com
www.databreachtoday.com
www.devicesecurity.io
www.fraudtoday.io
www.paymentsecurity.io
www.cio.inc
www.aitoday.io
www.ot.today
www.bankinfosecurity.co.uk
www.bankinfosecurity.eu
www.bankinfosecurity.in
www.bankinfosecurity.asia
ffiec.bankinfosecurity.com
omnibus.healthcareinfosecurity.com
ddos.inforisktoday.com
ransomware.databreachtoday.com
gdpr.inforisktoday.com
covid19.inforisktoday.com
mena.cs4ca.com
ismg.events
europe.manusecevent.com
www.facebook.com
twitter.com
www.linkedin.com
www.twitter.com
labs.watchtowr.com
w3techs.com
www.tenable.com
forum.joomla.org
attack.mitre.org
dl.acm.org
securityintelligence.inforisktoday.com
ismg.io

Subject Issuer	Validity	Valid
ismg.io Go Daddy Secure Certificate Authority - G2	`2024-07-30` - `2025-07-30`	a year	crt.sh
upload.video.google.com WR2	`2024-12-02` - `2025-02-24`	3 months	crt.sh
sharethis.com Amazon RSA 2048 M03	`2024-04-19` - `2025-05-17`	a year	crt.sh
*.ssl.cf1.rackcdn.com DigiCert TLS RSA SHA256 2020 CA1	`2024-01-29` - `2025-01-29`	a year	crt.sh
worker.ismgcorp.com Go Daddy Secure Certificate Authority - G2	`2024-02-13` - `2025-03-16`	a year	crt.sh
*.g.doubleclick.net WR2	`2024-12-02` - `2025-02-24`	3 months	crt.sh
*.marketo.net DigiCert TLS RSA SHA256 2020 CA1	`2024-10-22` - `2025-10-24`	a year	crt.sh
*.google-analytics.com WR2	`2024-12-02` - `2025-02-24`	3 months	crt.sh
*.gstatic.com WR2	`2024-12-02` - `2025-02-24`	3 months	crt.sh
*.disqus.com Sectigo RSA Domain Validation Secure Server CA	`2024-04-16` - `2025-04-16`	a year	crt.sh
event-horizon.gcp.bomm.in WR3	`2024-12-15` - `2025-03-15`	3 months	crt.sh
js.bizographics.com DigiCert SHA2 Secure Server CA	`2024-07-12` - `2025-07-11`	a year	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2024-12-02` - `2025-12-01`	a year	crt.sh
6sc.co R11	`2024-12-20` - `2025-03-20`	3 months	crt.sh
*.cloudfront.net Amazon RSA 2048 M01	`2024-07-30` - `2025-07-03`	a year	crt.sh
cert1-prod.aut.a24365.net R10	`2024-12-27` - `2025-03-27`	3 months	crt.sh
*.crwdcntrl.net Amazon RSA 2048 M02	`2024-09-07` - `2025-10-07`	a year	crt.sh
*.ml314.com Amazon RSA 2048 M02	`2024-09-14` - `2025-10-11`	a year	crt.sh
www.linkedin.com DigiCert SHA2 Secure Server CA	`2024-10-14` - `2025-04-14`	6 months	crt.sh
www.clarity.ms DigiCert TLS RSA SHA256 2020 CA1	`2024-09-04` - `2025-09-04`	a year	crt.sh
nexus.ensighten.com Amazon RSA 2048 M03	`2024-08-29` - `2025-09-28`	a year	crt.sh
script.crazyegg.com E5	`2024-11-27` - `2025-02-25`	3 months	crt.sh
*.mktoresp.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-08-15` - `2025-09-15`	a year	crt.sh
epsilon.6sense.com Amazon RSA 2048 M02	`2024-10-02` - `2025-11-01`	a year	crt.sh
eps.6sc.co Amazon RSA 2048 M03	`2024-08-27` - `2025-09-25`	a year	crt.sh
v.eps.6sc.co Amazon RSA 2048 M03	`2024-09-06` - `2025-10-05`	a year	crt.sh
a.clarity.ms Microsoft Azure RSA TLS Issuing CA 08	`2024-06-23` - `2025-06-18`	a year	crt.sh
tpc.googlesyndication.com WR2	`2024-12-02` - `2025-02-24`	3 months	crt.sh
a.disquscdn.com Amazon RSA 2048 M02	`2024-07-30` - `2025-08-27`	a year	crt.sh
adtrafficquality.google WR2	`2024-12-02` - `2025-02-24`	3 months	crt.sh
*.google.com WR2	`2024-12-02` - `2025-02-24`	3 months	crt.sh

This page contains 16 frames:

Primary Page: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Frame ID: 76A5B1A2B13E3ECA7687DE7554DC8D57
Requests: 182 HTTP requests in this frame

Frame: https://disqus.com/embed/comments/?base=default&f=bankinfosecurity&t_u=https%3A%2F%2Fwww.bankinfosecurity.com%2Fblogs%2Fabandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790&t_d=Abandoned%20Backdoors%3A%20How%20Malicious%20Infrastructure%20Lives%20On&t_t=Abandoned%20Backdoors%3A%20How%20Malicious%20Infrastructure%20Lives%20On&s_o=default
Frame ID: AE56F574E705E54109B673C52C2BB199
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/static/topics/topics_frame.html
Frame ID: 7BE0AC5A4F29F42726110600D4D20E40
Requests: 1 HTTP requests in this frame

Frame: https://5e8e59f6e1ebb9fa9791aec59a922de3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: F2046892568FE7D50CF2B6D9C0192720
Requests: 1 HTTP requests in this frame

Frame: https://t.sharethis.com/a/t_.htm?ver=1.1667.23406&cid=c010&cls=B
Frame ID: FD10F669715DEEBA07C694E22E1CBABB
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvuOURRCo7a3G3jsrOedcC_mCTd3YqOkokOYXg1gfoA7R5bsgSqVfILDJz_0YqrpYq7yLglPP0UKXXa3EXfdH6WUwAtB2a1JZzYZWVydqopHmdgfnjwff_EFttBVpc5Nti7QXzRursA4MEHyKb2-jLBp8YCYdqYC7gqf8zxB57FFABBDtLC_Ji9q1hZQSLu4xgMhh9EKTXp0erGmcc3W1tMeiRh8G_uwo3QCseAXTleM237cVnDSGdh6oGJ3Y7DjshtmSnbg-QV_zXKm_UwK3LLabKjbIOSt9Ljm2qsK3LT1oydtNG8Rw2MSOO74h6-bMZC_wNh5uhJjwHuJ7EQ5drA8QjJue_4OmVyKFQ7x78cLs6z0TL2aLBCTgw5M2twJaovikT4kMUdDbmdRQ&sai=AMfl-YQHKk87_ujuGJn9E-wZv5Xwb7QZXyoY8-ixnp1evDmcBTyS6ZWo2peL_7tcZlP0G1qldnAfZJDXjsrD7-EKw5t4SYVv09yYNFdh6h01Wp7plKDNf5FxgzgSeoiya7PQWCoFD10kaI5L0VROvKHQ&sig=Cg0ArKJSzD-uMfIh33EwEAE&uach_m=%5BUACH%5D&adurl=
Frame ID: 316F0980C1DB685206F065C6999871CD
Requests: 10 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstdiKBnDaFOH_iz66kAT4vmicyzRzOvyq-O6M0l69FmkLa-6Et09F7WTXHtkzeoXIrOnBFsHxhkMBuZLhz3pxJnBaLZ1iwFFW2rOkCgCVsFh8IeZ6ZnYsBEfJWxOqToAMf6VMxizeeoVd-LjQ0c6zCqgTn38uTxJWQB_nxKvZg8i90U8pTQUYMhY1Z-ynQAW6Iu-uArLN0yrFHOGxP0rdK9tpheyNYpqTp2kGVn_MiuG1-1aBcaF7zwX8gcbj6XlBvU7aK4csrtC2KETqyZfafTq9gq-mIlDdhVcIyXDzIdgMByyFxvBjo7Dtm3cnHFzUMXL0vLR0EiFrExLnX0T2lf2KA7KRC8ofG3U-rq2VaUEN5J0Xb6TMnzgS2DXVyn0I7m9VWVcLbW6C9KopEjIU8&sai=AMfl-YTEqgVna7a42yQhWEC9Hglg6P_r58LUY9Pf3nr4V88MZRuo6oPFtdAA9v9jOZvrRW5EoPMtYiphJ1yR7zpJgwVzzKYjf1-NC8P5i6zq0BIDQw_OAWxpYJdNYBFbnuTA10VVoobguv6-fWhxcDpn&sig=Cg0ArKJSzLMhKrnIwxKnEAE&uach_m=%5BUACH%5D&adurl=
Frame ID: 1EA81BBBECF7070ED380E1AAF2F10AA1
Requests: 10 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjss0a4MzRSyHmSzFH7xCVcqNYDDsXDm53VvaeRshwBcqKoK8qTiF670WkODy4Hje20N6p4cQZYVh6g1Ra-B_uWsPRDpaNFV85E7RaQUKmItTo34kJgQpHzMBo1f6U0PErNhKvZ8yj_XLX-FwTL_lNeKYJTzk_ANkYJU8c8euVzMiIP7Fx2c9ZsRrbAZPDYPWXmGGgHhSX_vsSC1HmMtRYAs8cPKySGDXavrnaIeD8C4qOZmRx4f16KfuNmZEtZtOdo_ErG-v-E7O0tj0UqlOEDm5Uh21x6-t7L_9iX1PnSDvguLoX5XJRJu9xoDvKfTOL-4xAUWXo17Iv76DLx7dKoXaYeL2kYGVuiVZQLky5YTK8-mqS2rV5e_c6emXI-wTRV1SSd_YIybMo8IMf3NQyPH32Q&sai=AMfl-YSOYG76zQSvNQ10f_xkbgzXXzUlN8sf3HHvak6A3HYNq1BpeInUJm7JbZg-iO1uCqnzPbt45_9bncft4XaPACg8JFyuNuiu47DrXobLEex0RFYUxU5OVd25oDb4Yqp3wara7w7_Bvm94ind3vm4&sig=Cg0ArKJSzAj9PJQWVXayEAE&uach_m=%5BUACH%5D&adurl=
Frame ID: 4DE6EC1DF26ADBA487B2F561CD5C5CDC
Requests: 9 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsv8pgvps3wg5uqiKt1MuQvz-_gTaa_EQhWwIadkqGYpDncDluUPY7HLvZ3e02yaF-fNRml4DDl6XGKsg0IOqYOuaufn2T5kpFwSSE97-TWxnEhBurzN7qTkHYc0AINaMxitWtM1ZP-G-HO6jJwqsXpXu11-iNzkwV-sXGYbPoGee1IP-u6M7zr_5Rg5MFsFULpCGS8R7aVJqAwkayB_C-68ezRyrhl1Y1mqm50056OAElVYaa91WpF7n4zVK8wITy5OKA6e3qX1unXQwIRSkSL78JiPJPBeVQnWzkImtyxuwBR-FbRC9rIoJwBJYLO4KxSvQBF1vNns5XGErRZnE22V0QMkMHnomQfxLELe4A8lyBQ-DbjsopMXKq302R5RT5j-j_KIxPbRDmVbicXwYZU&sai=AMfl-YSjKmMd64DQ7jIVDHAe83jPbNU9Lo9GKP_u80JaCmzKLMTGRNfpOHbhIU6_rvrhWPwdrvN024fza2psG5_7TATCGSbg5zfPMhzVXyF-GN4zbQuBPKIjEic8nK0K2Q99-F3TIPWGslPpmDaLUp1_&sig=Cg0ArKJSzHo4zSyJG2Q2EAE&uach_m=%5BUACH%5D&adurl=
Frame ID: 3AF2FCFC6A63E2E5FD078C90999B03F9
Requests: 9 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjss6HMfAa0YzxJuW1ojLdvC9A6C7i8h3ToqjgkfOQZsErlyGy4tGsl2PHiQcJTVrXC1M6vciG0yaDP7Ji-P1X3F4z6Ma-qdotF5Wpod9gdN5KX1yNcyzcTa69EBI6yFvlb7t-HsxtcGRgfN63zU9u13e_EpFOzQMWkeS2vMQD66TweRuLk17I-wbifPc_kA96i_r592i5bJMm_df89z3JRfra1bVSAsFrMNEQewQ-zXiXrBZkU4_-0VfzKBVCbXUDBIEMeSYuKQcKNUCWflJ8BIJGRfYnfojR8UnsuJFObIFHl2IXyU3FLrFNSxwF13uPDbxDtrG1iEPxNCyLAoYCxSdeR9sW2hFavHzK3JBDGwtdDjFdFzfcEYxiQa4lL81_HCOLtH8n01O-exyjw&sai=AMfl-YQSj6R1WHcht5U8FxIiUEVOmedfoCY6X9HB--zhlfYpSNYv6Jj7Dq7H5ON2-zL7egBug1_W8bGEV0tkXxzUQ7AUFdAR1u1EpSXJ33jJja-BTAUNU7JA-HYvp1P3SAtdGs3VEHZ0h-TbfAs5e5cY&sig=Cg0ArKJSzGSnCjWRZs0QEAE&uach_m=%5BUACH%5D&adurl=
Frame ID: 1095766E419E6A87B63B14CE0C2D2555
Requests: 10 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuOhqMbXX9LHrhEUuOPnEhremHcMRCPYV_RMXjuTb0m46pEC7uEVwyYAMXb-ej8qhZ0j_t8HByKp7J7rl4dDNJkQvOwgA1gc9u78LfijC7oOKHy4Kw54PAcp_cm1ONw6_PhKe3max9ZcsPn9vXDY-bKzjqLZht60ufmjIPf8u4_-UHry8NpSEgLj2CYfH_iiklFpI-cZ-NiJjsbJ6PUU5beX1viGIhI4gHU5f4uonSKCjxfMyADIUqT8oxy_b7Mn869FTGTMAGaICGNzGMsaEiFlx4w3wOiHml7wX3YEQz2F1wJ2axaqq7cSyJw4Q_ZtBNg3IMhHX5_HvDwHpIFDlX2GITAI0mY8vU2Yg6Y7uPK2nDgSUh72-YRHewnjUdMnE4iRlGmCBu5skqMZDNI2w&sai=AMfl-YQgHNgAX4Mg_fR6P-y2-N3fMAjmL-0-ZJbjebINRjLy_rkCpNF-Qo6AzonaMJousxYed0JwEa5T0G-v2dab40MvZBRxgJWKmkLYFQM-jTHzzXmgNBtm6mffW6HnQBdKrJt8-JabuVw237Z-3xiq&sig=Cg0ArKJSzCnD_LxYKBUXEAE&uach_m=%5BUACH%5D&adurl=
Frame ID: 93C7D9D34657CD56DC22083FEAF668E1
Requests: 9 HTTP requests in this frame

Frame: https://d1eoo1tco6rr5e.cloudfront.net/86s8kpd/tm47y0o/iframe
Frame ID: C7D2E9D8093BABDEF90CD5F8FDE735C6
Requests: 1 HTTP requests in this frame

Frame: https://c.disquscdn.com/next/embed/styles/realtime.b23ff3c36dd0169627f8e54ca1621eca.css
Frame ID: 4E1ED44A7396CE7A1E6BD7F7F4CBE84C
Requests: 1 HTTP requests in this frame

Frame: https://c.disquscdn.com/next/embed/styles/realtime.b23ff3c36dd0169627f8e54ca1621eca.css
Frame ID: 34B2BB3D48302A2B6C92A9356CB9BBAC
Requests: 1 HTTP requests in this frame

Frame: https://ep2.adtrafficquality.google/sodar/sodar2/232/runner.html
Frame ID: 17BDF1842B0377ABA95015F56ECD02B1
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: FA4F721EF5BDF6D382F2411B23C9233C
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Abandoned Backdoors: How Malicious Infrastructure Lives On

Detected technologies

TinyMCE (Rich Text Editors) Expand

Overall confidence: 100%
Detected patterns

/tiny_?mce(?:\.min)?\.js

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Crazy Egg (Analytics) Expand

Overall confidence: 100%
Detected patterns

script\.crazyegg\.com/pages/scripts/\d+/\d+\.js

DoubleClick for Publishers (DFP) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googletagservices\.com/tag/js/gpt(?:_mobile)?\.js

Ensighten (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

//nexus\.ensighten\.com/

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Marketo (Marketing Automation) Expand

Overall confidence: 100%
Detected patterns

munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery UI (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery-ui.*\.js

prettyPhoto (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

(?:<link [^>]*href="[^"]*prettyPhoto(?:\.min)?\.css|<a [^>]*rel="prettyPhoto)

Page Statistics

246
Requests

96 %
HTTPS

30 %
IPv6

34
Domains

62
Subdomains

49
IPs

2
Countries

11117 kB
Transfer

15864 kB
Size

103
Cookies

53 Outgoing links

These are links going to different origins than the main page.

URL: https://www.cuinfosecurity.com/
Title: CUInfoSecurity

Search URL Search Domain Scan URL

URL: https://www.govinfosecurity.com/
Title: GovInfoSecurity

Search URL Search Domain Scan URL

URL: https://www.healthcareinfosecurity.com/
Title: HealthcareInfoSecurity

Search URL Search Domain Scan URL

URL: https://www.inforisktoday.com/
Title: InfoRiskToday

Search URL Search Domain Scan URL

URL: https://www.careersinfosecurity.com/
Title: CareersInfoSecurity

Search URL Search Domain Scan URL

URL: https://www.databreachtoday.com/
Title: DataBreachToday

Search URL Search Domain Scan URL

URL: https://www.devicesecurity.io/
Title: DeviceSecurity

Search URL Search Domain Scan URL

URL: https://www.fraudtoday.io/
Title: FraudToday

Search URL Search Domain Scan URL

URL: https://www.paymentsecurity.io/
Title: PaymentSecurity

Search URL Search Domain Scan URL

URL: https://www.cio.inc/
Title: CIO

Search URL Search Domain Scan URL

URL: https://www.aitoday.io/
Title: AIToday

Search URL Search Domain Scan URL

URL: https://www.ot.today/
Title: OT.today

Search URL Search Domain Scan URL

URL: https://www.bankinfosecurity.co.uk/
Title: UK

Search URL Search Domain Scan URL

URL: https://www.bankinfosecurity.eu/
Title: Europe

Search URL Search Domain Scan URL

URL: https://www.bankinfosecurity.in/
Title: India

Search URL Search Domain Scan URL

URL: https://www.bankinfosecurity.asia/
Title: Asia

Search URL Search Domain Scan URL

URL: https://ffiec.bankinfosecurity.com/
Title: FFIEC

Search URL Search Domain Scan URL

URL: https://omnibus.healthcareinfosecurity.com/
Title: HIPAA Omnibus

Search URL Search Domain Scan URL

URL: https://ddos.inforisktoday.com/
Title: DDoS

Search URL Search Domain Scan URL

URL: https://ransomware.databreachtoday.com/
Title: Ransomware

Search URL Search Domain Scan URL

URL: https://gdpr.inforisktoday.com/
Title: GDPR

Search URL Search Domain Scan URL

URL: https://covid19.inforisktoday.com/
Title: COVID-19

Search URL Search Domain Scan URL

URL: https://mena.cs4ca.com/

Search URL Search Domain Scan URL

URL: https://ismg.events/summit/ai-virtual-summit-2025-americas

Search URL Search Domain Scan URL

URL: https://europe.manusecevent.com/

Search URL Search Domain Scan URL

URL: https://ismg.events/summit/fraud-prevention-newyork-2025/

Search URL Search Domain Scan URL

URL: https://www.careersinfosecurity.com/jobs
Title: Jobs

Search URL Search Domain Scan URL

URL: https://www.careersinfosecurity.com/jobs/employer-center
Title: Post a Job

Search URL Search Domain Scan URL

URL: http://www.facebook.com/bankinfosec

Search URL Search Domain Scan URL

URL: http://twitter.com/BnkInfoSecurity

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/information-security-media-group-corp-ismg/?viewAsMember=true

Search URL Search Domain Scan URL

URL: https://ismg.events/summit/ai-virtual-summit-2025-americas/?utm_source=trending
Title: Virtual Summit: Cybersecurity Implications of AI

Search URL Search Domain Scan URL

URL: https://www.twitter.com/euroinfosec
Title: euroinfosec

Search URL Search Domain Scan URL

URL: https://labs.watchtowr.com/more-governments-backdoors-in-your-backdoors/
Title: said

Search URL Search Domain Scan URL

URL: https://w3techs.com/technologies/details/pl-php
Title: market share

Search URL Search Domain Scan URL

URL: https://www.tenable.com/plugins/nessus/46349
Title: c99 shell

Search URL Search Domain Scan URL

URL: https://forum.joomla.org/viewtopic.php?t=508857
Title: r57 shell

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/software/S0020/
Title: China Chopper

Search URL Search Domain Scan URL

URL: https://dl.acm.org/doi/abs/10.1145/2872427.2882992
Title: paper

Search URL Search Domain Scan URL

URL: https://twitter.com/euroinfosec

Search URL Search Domain Scan URL

URL: https://www.bankinfosecurity.asia/interviews/addressing-gen-ai-privacy-security-governance-in-healthcare-i-5433

Search URL Search Domain Scan URL

URL: https://www.bankinfosecurity.asia/interviews/overcoming-identity-access-challenges-in-healthcare-i-5425

Search URL Search Domain Scan URL

URL: https://www.bankinfosecurity.asia/interviews/hackers-love-weekend-holiday-attacks-i-5430

Search URL Search Domain Scan URL

URL: https://www.bankinfosecurity.asia/interviews/protecting-c-suite-in-wake-uhc-ceos-murder-i-5428

Search URL Search Domain Scan URL

URL: https://www.bankinfosecurity.asia/interviews/wanted-incident-repository-for-healthcare-nonprofits-i-5435

Search URL Search Domain Scan URL

URL: https://www.bankinfosecurity.asia/interviews/how-will-health-data-privacy-cyber-regs-shape-up-in-2025-i-5431

Search URL Search Domain Scan URL

URL: https://www.bankinfosecurity.asia/interviews/how-hackers-manipulate-ai-to-affect-health-app-accuracy-i-5427

Search URL Search Domain Scan URL

URL: https://www.bankinfosecurity.asia/interviews/whats-ahead-for-healthcare-cyber-regs-legislation-in-2025-i-5434

Search URL Search Domain Scan URL

URL: https://www.bankinfosecurity.asia/interviews/protecting-highly-sensitive-health-data-for-research-i-5432

Search URL Search Domain Scan URL

URL: https://www.bankinfosecurity.asia/interviews/contingency-planning-for-attacks-on-critical-third-parties-i-5436

Search URL Search Domain Scan URL

URL: https://securityintelligence.inforisktoday.com/
Title: Security Intelligence

Search URL Search Domain Scan URL

URL: https://ismg.io/
Title: Information Security Media Group, Corp.

Search URL Search Domain Scan URL

URL: https://ismg.io/about-us
Title: About ISMG

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 109

https://l.sharethis.com/pview?event=pview&hostname=www.bankinfosecurity.com&location=%2Fblogs%2Fabandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790&product=inline-share-buttons&url=https%3A%2F%2Fwww.bankinfosecurity.com%2Fblogs%2Fabandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790&source=platform&fcmp=false&fcmpv2=false&has_segmentio=false&title=Abandoned%20Backdoors%3A%20How%20Malicious%20Infrastructure%20Lives%20On&cms=unknown&publisher=64270ee65d783b00125f1b83&sop=true&version=st_sop.js&lang=en&description=How%20many%20servers%20are%20infected%20by%20web%20shells%20designed%20to%20give%20attackers%20remote%20access%20to%20systems%2C%20but%20now%20%22phone%20home%22%20to%20malicious%20infrastructure%20that%27s%20now%20abandoned%20or%20expired%3F%20Security%20researchers%20who%20posed%20that%20question%20have%20counted%204%2C000%20such%20systems%2C%20including%20in%20government%20and%20education.&ua=&ua_mobile=false&ua_full_version_list=&uuid=293e0318-480a-4955-bdf9-a6bdd135f0a4 HTTP 301
https://l.sharethis.com/sc?event=pview&hostname=www.bankinfosecurity.com&location=%2Fblogs%2Fabandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790&product=inline-share-buttons&url=https%3A%2F%2Fwww.bankinfosecurity.com%2Fblogs%2Fabandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790&source=platform&fcmp=false&fcmpv2=false&has_segmentio=false&title=Abandoned%20Backdoors%3A%20How%20Malicious%20Infrastructure%20Lives%20On&cms=unknown&publisher=64270ee65d783b00125f1b83&sop=true&version=st_sop.js&lang=en&description=How%20many%20servers%20are%20infected%20by%20web%20shells%20designed%20to%20give%20attackers%20remote%20access%20to%20systems%2C%20but%20now%20%22phone%20home%22%20to%20malicious%20infrastructure%20that%27s%20now%20abandoned%20or%20expired%3F%20Security%20researchers%20who%20posed%20that%20question%20have%20counted%204%2C000%20such%20systems%2C%20including%20in%20government%20and%20education.&ua=&ua_mobile=false&ua_full_version_list=&uuid=293e0318-480a-4955-bdf9-a6bdd135f0a4&samesite=None

Request Chain 119

https://dpm.demdex.net/ibs:dpid=22052&dpuuid=3649708125471637511&redir= HTTP 302
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=22052&dpuuid=3649708125471637511&redir=

Request Chain 120

https://idsync.rlcdn.com/395886.gif?partner_uid=3649708125471637511 HTTP 307
https://idsync.rlcdn.com/1000.gif?memo=CO6UGBIeChoIARCuXxoTMzY0OTcwODEyNTQ3MTYzNzUxMRAAGg0IwOD8uwYSBQjoBxAAQgBKAA HTTP 307
https://ml314.com/csync.ashx?fp=c9c6ba0953b085de732143d0d396f8e2a6b7d81036831e83c2938201f6507db0f4cb09cee1a4f8eb&person_id=3649708125471637511&eid=50082

Request Chain 121

https://match.adsrvr.org/track/cmf/generic?ttd_pid=d0tro1j&ttd_tpi=1 HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=d0tro1j&ttd_tpi=1 HTTP 302
https://ml314.com/utsync.ashx?eid=53819&et=0&fp=e919bb23-4ac0-4883-b0fa-f765eeb0f13c&gdpr=0&gdpr_consent=

Request Chain 122

https://ib.adnxs.com/getuid?https://ml314.com/csync.ashx%3Ffp=$UID%26person_id=3649708125471637511%26eid=2 HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fml314.com%2Fcsync.ashx%253Ffp%3D%24UID%2526person_id%3D3649708125471637511%2526eid%3D2 HTTP 302
https://ml314.com/csync.ashx?fp=3258195736511359540&person_id=3649708125471637511&eid=2

Request Chain 123

https://ps.eyeota.net/pixel?pid=r8hrb20&t=gif HTTP 302
https://ps.eyeota.net/pixel/bounce/?pid=r8hrb20&t=gif HTTP 302
https://ml314.com/utsync.ashx?eid=50052&et=0&fp=2VwxugCA_itoTCsDWrGP9miV-FT5W8Nw30Zxv6DMM7vk&gdpr=0&gdpr_consent=&return=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fbid%3Dr8hrb20%26uid%3Dnil%26referrer_pid%3Dr8hrb20 HTTP 302
https://ml314.com/csync.ashx?fp=2VwxugCA_itoTCsDWrGP9miV-FT5W8Nw30Zxv6DMM7vk&person_id=3649708125471637511&eid=50052&return=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fbid%3Dr8hrb20%26uid%3Dnil%26referrer_pid%3Dr8hrb20 HTTP 302
https://ps.eyeota.net/match?bid=r8hrb20&uid=nil&referrer_pid=r8hrb20

Request Chain 127

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=749%2C2330930&time=1736388672263&url=https%3A%2F%2Fwww.bankinfosecurity.com%2Fblogs%2Fabandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790 HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=749%2C2330930&time=1736388672263&url=https%3A%2F%2Fwww.bankinfosecurity.com%2Fblogs%2Fabandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790&cookiesTest=true HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D749%252C2330930%26time%3D1736388672263%26url%3Dhttps%253A%252F%252Fwww.bankinfosecurity.com%252Fblogs%252Fabandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=749%2C2330930&time=1736388672263&url=https%3A%2F%2Fwww.bankinfosecurity.com%2Fblogs%2Fabandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790&cookiesTest=true&liSync=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=749%2C2330930&time=1736388672263&url=https%3A%2F%2Fwww.bankinfosecurity.com%2Fblogs%2Fabandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790&cookiesTest=true&liSync=true&e_ipv6=AQLcGNd21geRMwAAAZRI1H4QOQbonXCs3s0Jtj_P2MjvNIa-yvQtseuF7EbZKWGTGZjmmMQ

Request Chain 224

https://insight.adsrvr.org/tags/86s8kpd/tm47y0o/iframe HTTP 301
https://d1eoo1tco6rr5e.cloudfront.net/86s8kpd/tm47y0o/iframe

Request Chain 233

https://c.clarity.ms/c.gif HTTP 302
https://c.bing.com/c.gif?ctsa=mr&CtsSyncId=482281510C9A466A97F5D1828DE036D7&RedC=c.clarity.ms&MXFR=051925401C6061B412DE302F18606F3C HTTP 302
https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=482281510C9A466A97F5D1828DE036D7&MUID=020073F4376F648D287C669B36FF6531

246 HTTP transactions
6 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790 Show response
www.bankinfosecurity.com/blogs/ 385 KB
50 KB 517ms
251ms Document
text/html 50.56.167.254
RMH-14

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

50.56.167.254 , United States, ASN33070 (RMH-14, US),

Reverse DNS

Software

Resource Hash

9ef059261896ab1fd56a7f7b47dd35ccb70099fc3ba4871089c3e121e077265d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-security-policy: frame-ancestors 'none'
content-type: text/html; charset=UTF-8
date: Thu, 09 Jan 2025 02:11:09 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: deny
x-xss-protection: 1; mode=block

GET
H2 200 jquery-ui.min.css
www.bankinfosecurity.com/css-responsive/vendor/ 25 KB
5 KB 68ms
61ms Stylesheet
text/css 50.56.167.254
RMH-14

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bankinfosecurity.com/css-responsive/vendor/jquery-ui.min.css?s=1736388669.4283

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

50.56.167.254 , United States, ASN33070 (RMH-14, US),

Reverse DNS

Software

Resource Hash

fc54c09a7a71615ec35a22ed20afa4034588986ed88c3fc184b2c0bc637c33fb

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: frame-ancestors 'none'
cache-control: max-age=86400, private, must-revalidate
content-encoding: gzip
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
x-xss-protection: 1; mode=block
date: Thu, 09 Jan 2025 02:11:09 GMT
content-type: text/css; charset=utf-8
vary: Accept-Encoding
x-frame-options: deny

GET
H2 200 mediaelementplayer-updated.css
www.bankinfosecurity.com/css-responsive/vendor/ 11 KB
3 KB 104ms
99ms Stylesheet
text/css 50.56.167.254
RMH-14

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bankinfosecurity.com/css-responsive/vendor/mediaelementplayer-updated.css?s=1736388669.4283

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

50.56.167.254 , United States, ASN33070 (RMH-14, US),

Reverse DNS

Software

Resource Hash

1a0bbdba57f90a60fef89419fc940d8eae55c5b0d12ecbadde2beaef32ab2d90

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: frame-ancestors 'none'
cache-control: max-age=86400, private, must-revalidate
content-encoding: gzip
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 2729
x-xss-protection: 1; mode=block
date: Thu, 09 Jan 2025 02:11:09 GMT
content-type: text/css; charset=utf-8
vary: Accept-Encoding
x-frame-options: deny

GET
H2 200 css
fonts.googleapis.com/ 57 KB
3 KB 196ms
75ms Stylesheet
text/css 2607:f8b0:4004:c1b::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans:300italic,400italic,600italic,700italic,800italic,400,300,600,700,800

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1b::5f Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

200ea2792715456ea62f7de0ab54444d6f417f183f61ecfb53bbfa78476194f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Thu, 09 Jan 2025 02:11:09 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 09 Jan 2025 02:11:09 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Thu, 09 Jan 2025 00:56:43 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H2 200 main.css
www.bankinfosecurity.com/css-responsive/ 232 KB
45 KB 67ms
62ms Stylesheet
text/css 50.56.167.254
RMH-14

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bankinfosecurity.com/css-responsive/main.css?s=1736388669.4283

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

50.56.167.254 , United States, ASN33070 (RMH-14, US),

Reverse DNS

Software

Resource Hash

91283916a6e9695687bb57ed913fe6fae10324ebfcfa06d31209357e56ebc004

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: frame-ancestors 'none'
cache-control: max-age=86400, private, must-revalidate
content-encoding: gzip
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
x-xss-protection: 1; mode=block
date: Thu, 09 Jan 2025 02:11:09 GMT
content-type: text/css; charset=utf-8
vary: Accept-Encoding
x-frame-options: deny

GET
H2 200 prettyPhoto.css
www.bankinfosecurity.com/css-responsive/ 20 KB
3 KB 102ms
97ms Stylesheet
text/css 50.56.167.254
RMH-14

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bankinfosecurity.com/css-responsive/prettyPhoto.css?s=1736388669.4283

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

50.56.167.254 , United States, ASN33070 (RMH-14, US),

Reverse DNS

Software

Resource Hash

7d5e2f10ede290b4ad0d1bb2861dfacae9754453f352923e85e7d101a7686b00

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: frame-ancestors 'none'
cache-control: max-age=86400, private, must-revalidate
content-encoding: gzip
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 2993
x-xss-protection: 1; mode=block
date: Thu, 09 Jan 2025 02:11:09 GMT
content-type: text/css; charset=utf-8
vary: Accept-Encoding
x-frame-options: deny

GET
H2 200 bis-hdr.desktop.r2.css
www.bankinfosecurity.com/css-responsive/vendor/ 8 KB
2 KB 104ms
100ms Stylesheet
text/css 50.56.167.254
RMH-14

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bankinfosecurity.com/css-responsive/vendor/bis-hdr.desktop.r2.css?s=1736388669.4283

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

50.56.167.254 , United States, ASN33070 (RMH-14, US),

Reverse DNS

Software

Resource Hash

20b9ebf817b8dc640c06e993e5ae1127a6eb6b0c9fc6acbfb288f3b3a82405be

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: frame-ancestors 'none'
cache-control: max-age=86400, private, must-revalidate
content-encoding: gzip
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 1997
x-xss-protection: 1; mode=block
date: Thu, 09 Jan 2025 02:11:09 GMT
content-type: text/css; charset=utf-8
vary: Accept-Encoding
x-frame-options: deny

GET
H2 200 bis-hdr.mobile.r2.css
www.bankinfosecurity.com/css-responsive/vendor/ 9 KB
2 KB 180ms
176ms Stylesheet
text/css 50.56.167.254
RMH-14

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bankinfosecurity.com/css-responsive/vendor/bis-hdr.mobile.r2.css?s=1736388669.4283

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

50.56.167.254 , United States, ASN33070 (RMH-14, US),

Reverse DNS

Software

Resource Hash

59400de556b42dee4aa3e6f7b73676a81e260d35481b6d8d77656ee45ae9484b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: frame-ancestors 'none'
cache-control: max-age=86400, private, must-revalidate
content-encoding: gzip
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 2183
x-xss-protection: 1; mode=block
date: Thu, 09 Jan 2025 02:11:09 GMT
content-type: text/css; charset=utf-8
vary: Accept-Encoding
x-frame-options: deny

GET
H2 200 font-awesome.min.css
www.bankinfosecurity.com/css-responsive/vendor/ 22 KB
5 KB 102ms
98ms Stylesheet
text/css 50.56.167.254
RMH-14

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bankinfosecurity.com/css-responsive/vendor/font-awesome.min.css?s=1736388669.4283

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

50.56.167.254 , United States, ASN33070 (RMH-14, US),

Reverse DNS

Software

Resource Hash

93f466f6b1a81c848140e51c839a5372034ab22182601e86dd86947ad3a7fe94

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: frame-ancestors 'none'
cache-control: max-age=86400, private, must-revalidate
content-encoding: gzip
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
x-xss-protection: 1; mode=block
date: Thu, 09 Jan 2025 02:11:09 GMT
content-type: text/css; charset=utf-8
vary: Accept-Encoding
x-frame-options: deny

GET
H2 200 jquery.min.js Show response
www.bankinfosecurity.com/javascripts-responsive/vendor/ 91 KB
34 KB 103ms
99ms Script
text/javascript 50.56.167.254
RMH-14

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bankinfosecurity.com/javascripts-responsive/vendor/jquery.min.js?s=1736388669.4283

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

50.56.167.254 , United States, ASN33070 (RMH-14, US),

Reverse DNS

Software

Resource Hash

eccabf5cc7613433c3ddc71ff34391ae850d304d3aceb5666868c4947134f3b5

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: frame-ancestors 'none'
cache-control: max-age=86400, private, must-revalidate
content-encoding: gzip
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
x-xss-protection: 1; mode=block
date: Thu, 09 Jan 2025 02:11:09 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
x-frame-options: deny

GET
H2 200 bootstrap.min.js Show response
www.bankinfosecurity.com/javascripts-responsive/vendor/ 35 KB
10 KB 181ms
177ms Script
text/javascript 50.56.167.254
RMH-14

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bankinfosecurity.com/javascripts-responsive/vendor/bootstrap.min.js?s=1736388669.4283

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

50.56.167.254 , United States, ASN33070 (RMH-14, US),

Reverse DNS

Software

Resource Hash

3fede2d0c0a8c93b0c5d0ab0c38289a5743bb88720255b8298c520d2e3d90939

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: frame-ancestors 'none'
cache-control: max-age=86400, private, must-revalidate
content-encoding: gzip
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
x-xss-protection: 1; mode=block
date: Thu, 09 Jan 2025 02:11:09 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
x-frame-options: deny

GET
H2 200 jquery.validate.min.js Show response
www.bankinfosecurity.com/javascripts-responsive/vendor/ 21 KB
7 KB 158ms
155ms Script
text/javascript 50.56.167.254
RMH-14

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bankinfosecurity.com/javascripts-responsive/vendor/jquery.validate.min.js?s=1736388669.4283

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

50.56.167.254 , United States, ASN33070 (RMH-14, US),

Reverse DNS

Software

Resource Hash

e51831d751ef667b1f703a47bb05802b681e6a30816f5cce0d56c3552a4eaa31

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: frame-ancestors 'none'
cache-control: max-age=86400, private, must-revalidate
content-encoding: gzip
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
x-xss-protection: 1; mode=block
date: Thu, 09 Jan 2025 02:11:09 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
x-frame-options: deny

GET
H2 200 mediaelement-and-player-updated.min.js Show response
www.bankinfosecurity.com/javascripts-responsive/vendor/ 154 KB
39 KB 216ms
213ms Script
text/javascript 50.56.167.254
RMH-14

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bankinfosecurity.com/javascripts-responsive/vendor/mediaelement-and-player-updated.min.js?s=1736388669.4283

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

50.56.167.254 , United States, ASN33070 (RMH-14, US),

Reverse DNS

Software

Resource Hash

4e7304371ef9bcaea396e8928a9647f8306c296b9195c8763848d70c7f6f1390

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: frame-ancestors 'none'
cache-control: max-age=86400, private, must-revalidate
content-encoding: gzip
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
x-xss-protection: 1; mode=block
date: Thu, 09 Jan 2025 02:11:09 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
x-frame-options: deny

GET
H2 200 tinymce.min.js Show response
www.bankinfosecurity.com/javascripts-responsive/vendor/ 295 KB
105 KB 181ms
178ms Script
text/javascript 50.56.167.254
RMH-14

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bankinfosecurity.com/javascripts-responsive/vendor/tinymce.min.js?s=1736388669.4283

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

50.56.167.254 , United States, ASN33070 (RMH-14, US),

Reverse DNS

Software

Resource Hash

247d04c4d14c60a79c16245a74a792a662f9e7adf784d68edd4520a35ec90251

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: frame-ancestors 'none'
cache-control: max-age=86400, private, must-revalidate
content-encoding: gzip
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
x-xss-protection: 1; mode=block
date: Thu, 09 Jan 2025 02:11:09 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
x-frame-options: deny

GET
H2 200 jquery.validate.bootstrap.popover.js Show response
www.bankinfosecurity.com/javascripts-responsive/vendor/ 2 KB
987 B 182ms
179ms Script
text/javascript 50.56.167.254
RMH-14

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bankinfosecurity.com/javascripts-responsive/vendor/jquery.validate.bootstrap.popover.js?s=1736388669.4283

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

50.56.167.254 , United States, ASN33070 (RMH-14, US),

Reverse DNS

Software

Resource Hash

04d304d7ee49ac157f146382a46f02a666279bd7f29074f50e863b88f2affae9

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: frame-ancestors 'none'
cache-control: max-age=86400, private, must-revalidate
content-encoding: gzip
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 952
x-xss-protection: 1; mode=block
date: Thu, 09 Jan 2025 02:11:09 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
x-frame-options: deny

GET
H2 200 jquery.placeholder.js Show response
www.bankinfosecurity.com/javascripts-responsive/vendor/ 2 KB
971 B 214ms
211ms Script
text/javascript 50.56.167.254
RMH-14

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bankinfosecurity.com/javascripts-responsive/vendor/jquery.placeholder.js?s=1736388669.4283

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

50.56.167.254 , United States, ASN33070 (RMH-14, US),

Reverse DNS

Software

Resource Hash

256a489beea4a14eca458f6e5436758f1fcb8dd34034d3c36dd21b22a5841f3b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: frame-ancestors 'none'
cache-control: max-age=86400, private, must-revalidate
content-encoding: gzip
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 936
x-xss-protection: 1; mode=block
date: Thu, 09 Jan 2025 02:11:09 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
x-frame-options: deny

GET
H2 200 jquery-ui.min.js Show response
www.bankinfosecurity.com/javascripts-responsive/vendor/ 222 KB
63 KB 180ms
178ms Script
text/javascript 50.56.167.254
RMH-14

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bankinfosecurity.com/javascripts-responsive/vendor/jquery-ui.min.js?s=1736388669.4283

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

50.56.167.254 , United States, ASN33070 (RMH-14, US),

Reverse DNS

Software

Resource Hash

78cf63898c91ce3b95e37bc53e07adba5c2ee705ff28c2dd1dd784173c264ad1

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: frame-ancestors 'none'
cache-control: max-age=86400, private, must-revalidate
content-encoding: gzip
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
x-xss-protection: 1; mode=block
date: Thu, 09 Jan 2025 02:11:09 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
x-frame-options: deny

GET
H2 200 crypt_des.js Show response
www.bankinfosecurity.com/javascripts-responsive/vendor/ 9 KB
3 KB 181ms
179ms Script
text/javascript 50.56.167.254
RMH-14

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bankinfosecurity.com/javascripts-responsive/vendor/crypt_des.js?s=1736388669.4283

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

50.56.167.254 , United States, ASN33070 (RMH-14, US),

Reverse DNS

Software

Resource Hash

34f6a8e7792bc499cdcfcfae70d35a02766db4471551ec36844c3214357d6163

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: frame-ancestors 'none'
cache-control: max-age=86400, private, must-revalidate
content-encoding: gzip
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 2829
x-xss-protection: 1; mode=block
date: Thu, 09 Jan 2025 02:11:09 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
x-frame-options: deny

GET
H2 200 sharethis.js Show response
platform-api.sharethis.com/js/ 206 KB
46 KB 240ms
68ms Script
text/javascript 18.165.83.61
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://platform-api.sharethis.com/js/sharethis.js

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.165.83.61 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-165-83-61.iad55.r.cloudfront.net

Software

Resource Hash

98d32b00fca86fc6994df33302e051a6ad03461a43ff5797d5b10ace4cf4772f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: max-age=600, public
content-encoding: gzip
etag: W/"336d0-g/6wprihOkYe7HpMswOVDodT6lU"
age: 419
via: 1.1 3c84f89bba43de446e67a27b8df8b660.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: 47uA1MwVliOxjirvSYtGkJZ1yYI7_mwBkeRIn1IaF8Y1ZupJfCFV4A==
edge-control: cache-maxage=60m,downstream-ttl=60m
date: Thu, 09 Jan 2025 02:04:12 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
x-amz-cf-pop: IAD55-P3
x-frame-options: SAMEORIGIN

GET
H2 200 headerlogo-bis.png
www.bankinfosecurity.com/images-responsive/logos/ 2 KB
2 KB 182ms
180ms Image
image/png 50.56.167.254
RMH-14

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bankinfosecurity.com/images-responsive/logos/headerlogo-bis.png

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

50.56.167.254 , United States, ASN33070 (RMH-14, US),

Reverse DNS

Software

Resource Hash

ea3325c2094d82033ce9583d4180194fb82729dfae65b62925831a88a6838d7c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: frame-ancestors 'none'
cache-control: max-age=86400, private, must-revalidate
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
accept-ranges: bytes
content-length: 1659
x-xss-protection: 1; mode=block
date: Thu, 09 Jan 2025 02:11:09 GMT
content-type: image/png
vary: Accept-Encoding
x-frame-options: deny

GET
H/1.1 200
OK un-cybercrime-treaty-faces-longs-odds-to-us-passage-showcase_image-6-a-27248.jpg
130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/ 225 KB
225 KB 347ms
74ms Image
image/jpeg 23.43.207.143
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/un-cybercrime-treaty-faces-longs-odds-to-us-passage-showcase_image-6-a-27248.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.43.207.143 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-43-207-143.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 222f138c4f37e63eae6a92faa98fb389c5724edc99eceff153d45d32951746fc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Cache-Control: public, max-age=75697
ETag: 873fde4a9749e2673bd46a8e69a22818
X-Timestamp: 1736377517.67664
Connection: keep-alive
Expires: Thu, 09 Jan 2025 23:12:46 GMT
Accept-Ranges: bytes
X-Trans-Id: tx4579377907054ef494f4e-00677f0676dfw1
Content-Length: 230025
Date: Thu, 09 Jan 2025 02:11:09 GMT
Last-Modified: Wed, 08 Jan 2025 23:05:18 GMT
Content-Type: image/jpeg

GET
H/1.1 200
OK white-house-launches-us-cyber-trust-mark-for-iot-devices-showcase_image-5-a-27249.jpg
130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/ 151 KB
151 KB 218ms
79ms Image
image/jpeg 23.43.207.143
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/white-house-launches-us-cyber-trust-mark-for-iot-devices-showcase_image-5-a-27249.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.43.207.143 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-43-207-143.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 58bfe7b806ee50b2dcafe2c659acb2eaf66aef4c77e03a64bbf77bf5ce63b0ea

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Cache-Control: public, max-age=71328
ETag: 1f9da0f5df4d87a8fb717e5c99814794
X-Timestamp: 1736373383.57583
Connection: keep-alive
Expires: Thu, 09 Jan 2025 21:59:57 GMT
Accept-Ranges: bytes
X-Trans-Id: txd407d1d05a3d4f96b6ed7-00677ef56adfw1
Content-Length: 154538
Date: Thu, 09 Jan 2025 02:11:09 GMT
Last-Modified: Wed, 08 Jan 2025 21:56:24 GMT
Content-Type: image/jpeg

GET
H/1.1 200
OK european-court-fines-european-commission-for-gdpr-violation-showcase_image-1-a-27247.jpg
130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/ 383 KB
383 KB 212ms
75ms Image
image/jpeg 23.43.207.143
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/european-court-fines-european-commission-for-gdpr-violation-showcase_image-1-a-27247.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.43.207.143 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-43-207-143.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: e5c508bafba73ec42c846248bd50bf39e3dc03872adf3133cca16a14a9acf4d7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Cache-Control: public, max-age=70221
ETag: 12a24e752c21db82f1b5a35786278a86
X-Timestamp: 1736370294.97151
Connection: keep-alive
Expires: Thu, 09 Jan 2025 21:41:31 GMT
Accept-Ranges: bytes
X-Trans-Id: txfa3a11e75ba94fb4be663-00677ef108dfw1
Content-Length: 391717
Date: Thu, 09 Jan 2025 02:11:10 GMT
Last-Modified: Wed, 08 Jan 2025 21:04:55 GMT
Content-Type: image/jpeg

GET
H/1.1 200
OK cymulate-expands-exposure-management-cync-secure-deal-showcase_image-3-a-27246.jpg
130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/ 91 KB
92 KB 207ms
70ms Image
image/jpeg 23.43.207.143
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/cymulate-expands-exposure-management-cync-secure-deal-showcase_image-3-a-27246.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.43.207.143 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-43-207-143.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 3e505267f44a11bf0168bcaec3ca176dae6b1cc0d3bde4237ed79ea02ecb18a9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Cache-Control: public, max-age=68265
ETag: 39cb4b94e3341620a504e36cd7a02d2a
X-Timestamp: 1736368663.68655
Connection: keep-alive
Expires: Thu, 09 Jan 2025 21:08:55 GMT
Accept-Ranges: bytes
X-Trans-Id: tx45888d279e6d444f88f2e-00677ee918dfw1
Content-Length: 93496
Date: Thu, 09 Jan 2025 02:11:10 GMT
Last-Modified: Wed, 08 Jan 2025 20:37:44 GMT
Content-Type: image/jpeg

GET
H/1.1 200
OK whats-ahead-for-healthcare-cyber-regs-legislation-in-2025-showcase_image-10-i-5434.jpg
0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com/ 105 KB
106 KB 324ms
77ms Image
image/jpeg 23.60.78.137
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com/whats-ahead-for-healthcare-cyber-regs-legislation-in-2025-showcase_image-10-i-5434.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.60.78.137 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-60-78-137.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 9b65740b89a4c7a62b7ddb6e50baa1f552d0753954a20e5143f37da7b3026058

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Cache-Control: public, max-age=75731
ETag: 22fa70012578d8a25582f0d27d877842
X-Timestamp: 1734711343.68790
Connection: keep-alive
Expires: Thu, 09 Jan 2025 23:13:21 GMT
Accept-Ranges: bytes
X-Trans-Id: tx92e7122291284c9dbcccd-0067758386dfw1
Content-Length: 107785
Date: Thu, 09 Jan 2025 02:11:10 GMT
Last-Modified: Fri, 20 Dec 2024 16:15:44 GMT
Content-Type: image/jpeg

GET
H/1.1 200
OK addressing-genai-privacy-security-governance-in-healthcare-dave-perry-showcase_image-8-i-5433.jpg
0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com/ 66 KB
67 KB 339ms
97ms Image
image/jpeg 23.60.78.137
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com/addressing-genai-privacy-security-governance-in-healthcare-dave-perry-showcase_image-8-i-5433.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.60.78.137 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-60-78-137.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 96cd9c1e55d92a0f67176a4c06a40a9c4a5f4974e3d82255da3f171c2e705361

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Cache-Control: public, max-age=64784
ETag: f90660bb8474496d27211d198c623a15
X-Timestamp: 1734710981.59539
Connection: keep-alive
Expires: Thu, 09 Jan 2025 20:10:54 GMT
Accept-Ranges: bytes
X-Trans-Id: txda785bac663c40adbb9fc-00677428aadfw1
Content-Length: 67747
Date: Thu, 09 Jan 2025 02:11:10 GMT
Last-Modified: Fri, 20 Dec 2024 16:09:42 GMT
Content-Type: image/jpeg

GET
H/1.1 200
OK protecting-highly-sensitive-health-data-for-research-kurt-rohloff-showcase_image-3-i-5432.jpg
0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com/ 46 KB
46 KB 343ms
104ms Image
image/jpeg 23.60.78.137
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com/protecting-highly-sensitive-health-data-for-research-kurt-rohloff-showcase_image-3-i-5432.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.60.78.137 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-60-78-137.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 56a9fb61a8920c2f06cad160e7ed7a521c0c384ed72379e5f236e1d557c0e34d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Cache-Control: public, max-age=54955
ETag: be9b33d2d66d9d8dd28ad60c55958743
X-Timestamp: 1734710609.43542
Connection: keep-alive
Expires: Thu, 09 Jan 2025 17:27:05 GMT
Accept-Ranges: bytes
X-Trans-Id: txba38088133de4071beca8-006772d608dfw1
Content-Length: 46736
Date: Thu, 09 Jan 2025 02:11:10 GMT
Last-Modified: Fri, 20 Dec 2024 16:03:30 GMT
Content-Type: image/jpeg

GET
H/1.1 200
OK incident-reporting-by-nonprofit-non-government-entities-stan-mierzwa-showcase_image-8-i-5435.jpg
0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com/ 59 KB
60 KB 315ms
77ms Image
image/jpeg 23.60.78.137
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com/incident-reporting-by-nonprofit-non-government-entities-stan-mierzwa-showcase_image-8-i-5435.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.60.78.137 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-60-78-137.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: adb521de8a2d2756a97673c7a83fe2ec7d8892cbdb31efbaec231fbb52553bed

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Cache-Control: public, max-age=22622
ETag: 5d2d8920b419e7be2c41435afb1fe2d2
X-Timestamp: 1734711998.57999
Connection: keep-alive
Expires: Thu, 09 Jan 2025 08:28:12 GMT
Accept-Ranges: bytes
X-Trans-Id: tx50c0eb741d0148929c337-00676ec30fdfw1
Content-Length: 60583
Date: Thu, 09 Jan 2025 02:11:10 GMT
Last-Modified: Fri, 20 Dec 2024 16:26:39 GMT
Content-Type: image/jpeg

GET
H/1.1 200
OK metas-fact-checking-pull-back-to-could-help-scammers-thrive-showcase_image-2-p-3791.jpg
4a7efb2d53317100f611-1d7064c4f7b6de25658a4199efb34975.ssl.cf1.rackcdn.com/ 72 KB
72 KB 345ms
99ms Image
image/jpeg 23.60.78.137
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://4a7efb2d53317100f611-1d7064c4f7b6de25658a4199efb34975.ssl.cf1.rackcdn.com/metas-fact-checking-pull-back-to-could-help-scammers-thrive-showcase_image-2-p-3791.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.60.78.137 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-60-78-137.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: cb7ae215db84229feac0b45bbbcdc0c83df395d6bd0d4897695f50b41a50bcbc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Cache-Control: public, max-age=60830
ETag: e0a75a1dd15ad405a699308f394a1eee
X-Timestamp: 1736360056.45400
Connection: keep-alive
Expires: Thu, 09 Jan 2025 19:05:00 GMT
Accept-Ranges: bytes
X-Trans-Id: tx67c4bf7df772472aa8bc5-00677ecc77dfw1
Content-Length: 73643
Date: Thu, 09 Jan 2025 02:11:10 GMT
Last-Modified: Wed, 08 Jan 2025 18:14:17 GMT
Content-Type: image/jpeg

GET
H/1.1 200
OK high-paying-security-career-choosing-path-getting-there-showcase_image-2-p-3792.jpg
4a7efb2d53317100f611-1d7064c4f7b6de25658a4199efb34975.ssl.cf1.rackcdn.com/ 25 KB
25 KB 269ms
119ms Image
image/jpeg 23.60.78.137
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://4a7efb2d53317100f611-1d7064c4f7b6de25658a4199efb34975.ssl.cf1.rackcdn.com/high-paying-security-career-choosing-path-getting-there-showcase_image-2-p-3792.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.60.78.137 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-60-78-137.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 7fd4326338952187b22295242cd4fa2c18a0a45061b6c3c448500e8bf6b61b7f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Cache-Control: public, max-age=64715
ETag: c07967ffea58807bb4fad478f3cf38d6
X-Timestamp: 1736366015.45274
Connection: keep-alive
Expires: Thu, 09 Jan 2025 20:09:45 GMT
Accept-Ranges: bytes
X-Trans-Id: txab244b34941a415caf6ef-00677edb5ddfw1
Content-Length: 25256
Date: Thu, 09 Jan 2025 02:11:10 GMT
Last-Modified: Wed, 08 Jan 2025 19:53:36 GMT
Content-Type: image/jpeg

GET
H/1.1 200
OK abandoned-backdoors-how-malicious-infrastructure-lives-on-image_medium-5-p-3790.jpg
4a7efb2d53317100f611-1d7064c4f7b6de25658a4199efb34975.ssl.cf1.rackcdn.com/ 68 KB
69 KB 236ms
103ms Image
image/jpeg 23.60.78.137
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://4a7efb2d53317100f611-1d7064c4f7b6de25658a4199efb34975.ssl.cf1.rackcdn.com/abandoned-backdoors-how-malicious-infrastructure-lives-on-image_medium-5-p-3790.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.60.78.137 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-60-78-137.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 0d4bd3f0ceb717b4b3d8e265d9ad3e082fb0aaf2da61a1c2b4df0e84c704b7fc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Cache-Control: public, max-age=56518
ETag: 41057d3306bcf26ac415fa9706670e73
X-Timestamp: 1736355937.54850
Connection: keep-alive
Expires: Thu, 09 Jan 2025 17:53:08 GMT
Accept-Ranges: bytes
X-Trans-Id: tx48f4a2c1a0504f26a5b6a-00677ebb47dfw1
Content-Length: 70132
Date: Thu, 09 Jan 2025 02:11:10 GMT
Last-Modified: Wed, 08 Jan 2025 17:05:38 GMT
Content-Type: image/jpeg

GET
H/1.1 200
OK mixed-bag-for-cybersecurity-stocks-in-2024-as-paths-differ-showcase_image-8-p-3788.jpg
4a7efb2d53317100f611-1d7064c4f7b6de25658a4199efb34975.ssl.cf1.rackcdn.com/ 346 KB
346 KB 235ms
88ms Image
image/jpeg 23.60.78.137
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://4a7efb2d53317100f611-1d7064c4f7b6de25658a4199efb34975.ssl.cf1.rackcdn.com/mixed-bag-for-cybersecurity-stocks-in-2024-as-paths-differ-showcase_image-8-p-3788.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.60.78.137 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-60-78-137.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 0f923e8e4eed10ce979b73e6a23151dd251c53d87e8add85498e557c9889a873

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Cache-Control: public, max-age=22171
ETag: 2e910dc3b02028f7cdb91ada06d06c01
X-Timestamp: 1735856332.57260
Connection: keep-alive
Expires: Thu, 09 Jan 2025 08:20:41 GMT
Accept-Ranges: bytes
X-Trans-Id: txaa19bef99187486895cb6-006777148bdfw1
Content-Length: 354364
Date: Thu, 09 Jan 2025 02:11:10 GMT
Last-Modified: Thu, 02 Jan 2025 22:18:53 GMT
Content-Type: image/jpeg

GET
H/1.1 200
OK pci-dss-to-focus-on-phishing-resistant-authentication-showcase_image-10-a-27220.jpg
130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/ 278 KB
279 KB 77ms
76ms Image
image/jpeg 23.43.207.143
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/pci-dss-to-focus-on-phishing-resistant-authentication-showcase_image-10-a-27220.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.43.207.143 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-43-207-143.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: c397eda55501b6850428c6af5aa386bdc46dab5b4fe4a24d4af2d85dd139d8b7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Cache-Control: public, max-age=46440
ETag: 08fcc23e1c55945952b1a6069a210b3b
X-Timestamp: 1736150867.40598
Connection: keep-alive
Expires: Thu, 09 Jan 2025 15:05:10 GMT
Accept-Ranges: bytes
X-Trans-Id: txe11aeeedb17b4ffba1e6e-00677e944fdfw1
Content-Length: 285177
Date: Thu, 09 Jan 2025 02:11:10 GMT
Last-Modified: Mon, 06 Jan 2025 08:07:48 GMT
Content-Type: image/jpeg

GET
H/1.1 200
OK proof-concept-lessons-from-ai-in-2024-whats-ahead-showcase_image-8-a-27135.jpg
130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/ 300 KB
301 KB 84ms
83ms Image
image/jpeg 23.43.207.143
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/proof-concept-lessons-from-ai-in-2024-whats-ahead-showcase_image-8-a-27135.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.43.207.143 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-43-207-143.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 3571f8456a5b0cb9535c6971a5145aeead7fb99334e9e30d7c21daca413d9f67

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Cache-Control: public, max-age=33079
ETag: de02f85892635316cbc67206acaad56d
X-Timestamp: 1734974681.17245
Connection: keep-alive
Expires: Thu, 09 Jan 2025 11:22:29 GMT
Accept-Ranges: bytes
X-Trans-Id: tx4a721cd5285d4cefb749c-00677d2fa0dfw1
Content-Length: 307318
Date: Thu, 09 Jan 2025 02:11:10 GMT
Last-Modified: Mon, 23 Dec 2024 17:24:42 GMT
Content-Type: image/jpeg

GET
H/1.1 200
OK contrast-ceo-application-security-needs-people-just-ai-showcase_image-10-a-27148.jpg
130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/ 83 KB
83 KB 78ms
77ms Image
image/jpeg 23.43.207.143
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/contrast-ceo-application-security-needs-people-just-ai-showcase_image-10-a-27148.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.43.207.143 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-43-207-143.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: e3499ee00a95b255fbe46521bf05e0dafd636ffd53cd77edc7ed808a54a3c0ec

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Cache-Control: public, max-age=36577
ETag: 5a5a7b0c7e75a51ca65016769a5a00de
X-Timestamp: 1735137321.54329
Connection: keep-alive
Expires: Thu, 09 Jan 2025 12:20:47 GMT
Accept-Ranges: bytes
X-Trans-Id: txc0fd90046d5a41acbdb71-00677c0e21dfw1
Content-Length: 84865
Date: Thu, 09 Jan 2025 02:11:10 GMT
Last-Modified: Wed, 25 Dec 2024 14:35:22 GMT
Content-Type: image/jpeg

GET
H/1.1 200
OK scams-reimbursement-mobilization-to-continue-in-2025-showcase_image-5-a-26895.jpg
130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/ 172 KB
172 KB 127ms
71ms Image
image/jpeg 23.43.207.143
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/scams-reimbursement-mobilization-to-continue-in-2025-showcase_image-5-a-26895.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.43.207.143 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-43-207-143.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 43f87e4bfd7daf44d35bbec88d39c7a4f13322821f2c001ff2e125cdc01d1bb9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Cache-Control: public, max-age=35164
ETag: 0874b798e3d459d583a2169c444bfaa6
X-Timestamp: 1734963362.27336
Connection: keep-alive
Expires: Thu, 09 Jan 2025 11:57:14 GMT
Accept-Ranges: bytes
X-Trans-Id: tx62f28186ac83496a83927-00677c074fdfw1
Content-Length: 176090
Date: Thu, 09 Jan 2025 02:11:10 GMT
Last-Modified: Mon, 23 Dec 2024 14:16:03 GMT
Content-Type: image/jpeg

GET
H/1.1 200
OK live-webinar-ai-in-spotlight-exploring-future-appsec-evolution-showcase_image-8-w-6066.jpg
75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com/ 54 KB
54 KB 384ms
78ms Image
image/jpeg 23.60.78.137
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com/live-webinar-ai-in-spotlight-exploring-future-appsec-evolution-showcase_image-8-w-6066.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.60.78.137 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-60-78-137.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: c610b098992666ef336e1a0600fca9a78890f6c721e757c768fed19ac8b8bcea

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Cache-Control: public, max-age=56622
ETag: 8c810c83801d64c44828e7d85c641801
X-Timestamp: 1736352960.18545
Connection: keep-alive
Expires: Thu, 09 Jan 2025 17:54:52 GMT
Accept-Ranges: bytes
X-Trans-Id: txca96b0cb514948949863d-00677ebbefdfw1
Content-Length: 54833
Date: Thu, 09 Jan 2025 02:11:10 GMT
Last-Modified: Wed, 08 Jan 2025 16:16:01 GMT
Content-Type: image/jpeg

GET
H/1.1 200
OK live-webinar-guess-whos-back-exploring-use-canaries-for-threat-deception-in-cloud-showcase_image-4-w-6059.png
75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com/ 291 KB
291 KB 424ms
119ms Image
image/png 23.60.78.137
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com/live-webinar-guess-whos-back-exploring-use-canaries-for-threat-deception-in-cloud-showcase_image-4-w-6059.png
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.60.78.137 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-60-78-137.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 2c4a5aac7fb6351c30888a6f8073d313a19aad966543d1faaa10e75a6a1e062c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Cache-Control: public, max-age=66995
ETag: abcf7e355290b62d41726922b498705d
X-Timestamp: 1736367406.83914
Connection: keep-alive
Expires: Thu, 09 Jan 2025 20:47:45 GMT
Accept-Ranges: bytes
X-Trans-Id: tx2987bbc13edf4b72b55e8-00677ee482dfw1
Content-Length: 297553
Date: Thu, 09 Jan 2025 02:11:10 GMT
Last-Modified: Wed, 08 Jan 2025 20:16:47 GMT
Content-Type: image/png

GET
H/1.1 200
OK challenges-in-sustainability-data-management-live-webinar-showcase_image-10-w-6009.jpg
75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com/ 55 KB
55 KB 370ms
95ms Image
image/jpeg 23.60.78.137
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com/challenges-in-sustainability-data-management-live-webinar-showcase_image-10-w-6009.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.60.78.137 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-60-78-137.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 562d36d2795c96712917263a0534870011a5b0291045504ff02f96f03a54c3b2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Cache-Control: public, max-age=59725
ETag: c997300fd7d29c6ca2ccf9311ffbac73
X-Timestamp: 1732203441.02620
Connection: keep-alive
Expires: Thu, 09 Jan 2025 18:46:35 GMT
Accept-Ranges: bytes
X-Trans-Id: txd1136746987e4470948f7-006744b6d6dfw1
Content-Length: 55929
Date: Thu, 09 Jan 2025 02:11:10 GMT
Last-Modified: Thu, 21 Nov 2024 15:37:22 GMT
Content-Type: image/jpeg

GET
H/1.1 200
OK live-webinar-north-koreas-secret-army-how-to-combat-it-showcase_image-8-w-6054.jpg
75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com/ 59 KB
59 KB 423ms
149ms Image
image/jpeg 23.60.78.137
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com/live-webinar-north-koreas-secret-army-how-to-combat-it-showcase_image-8-w-6054.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.60.78.137 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-60-78-137.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: c3f75006aec18ce713124dac3c3fa6d605a7b53802c32bf977ce5760430aafd2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Cache-Control: public, max-age=39847
ETag: 0a813eaadb66e3ce36b8c4609c000d15
X-Timestamp: 1735310298.01623
Connection: keep-alive
Expires: Thu, 09 Jan 2025 13:15:17 GMT
Accept-Ranges: bytes
X-Trans-Id: tx6fcfc548b9724d9f84d42-00676ec852dfw1
Content-Length: 60222
Date: Thu, 09 Jan 2025 02:11:10 GMT
Last-Modified: Fri, 27 Dec 2024 14:38:19 GMT
Content-Type: image/jpeg

GET
H/1.1 200
OK live-webinar-navigating-unstructured-data-maze-your-journey-starts-here-showcase_image-6-w-6007.jpg
75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com/ 46 KB
47 KB 323ms
81ms Image
image/jpeg 23.60.78.137
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com/live-webinar-navigating-unstructured-data-maze-your-journey-starts-here-showcase_image-6-w-6007.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.60.78.137 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-60-78-137.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 0fe54b2d311e56b08c2f94ba0cf9cd656f16faadc4ca50899cc8dac904119f29

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Cache-Control: public, max-age=62884
ETag: db25ea623fb9472a67927834d3ebf398
X-Timestamp: 1732115885.14109
Connection: keep-alive
Expires: Thu, 09 Jan 2025 19:39:14 GMT
Accept-Ranges: bytes
X-Trans-Id: tx1e3c69ea1f15424e82979-006772c1c5dfw1
Content-Length: 47472
Date: Thu, 09 Jan 2025 02:11:10 GMT
Last-Modified: Wed, 20 Nov 2024 15:18:06 GMT
Content-Type: image/jpeg

GET
H/1.1 200
OK streamlining-retail-operations-protecting-your-brand-while-reducing-costs-showcase_image-5-w-6044.jpg
75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com/ 58 KB
58 KB 320ms
80ms Image
image/jpeg 23.60.78.137
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com/streamlining-retail-operations-protecting-your-brand-while-reducing-costs-showcase_image-5-w-6044.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.60.78.137 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-60-78-137.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 26d0fa36f3c233c5b08ee8e56fd1525bd432967905b05b1303da8b3dcd1c2823

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Cache-Control: public, max-age=41253
ETag: b53fadc30a413c4988f5ed3284edf1ab
X-Timestamp: 1734473100.03941
Connection: keep-alive
Expires: Thu, 09 Jan 2025 13:38:43 GMT
Accept-Ranges: bytes
X-Trans-Id: tx9776fcd3dd6344ba983a6-0067632d25dfw1
Content-Length: 59248
Date: Thu, 09 Jan 2025 02:11:10 GMT
Last-Modified: Tue, 17 Dec 2024 22:05:01 GMT
Content-Type: image/jpeg

GET
H/1.1 200
OK yashaswi-mudumbai-large_image-6-a-6952.jpg
6d63d49ccb7c52435540-5070aa97eaa2b8df4eb5a91600e69901.ssl.cf1.rackcdn.com/ 30 KB
30 KB 84ms
83ms Image
image/jpeg 23.60.78.137
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://6d63d49ccb7c52435540-5070aa97eaa2b8df4eb5a91600e69901.ssl.cf1.rackcdn.com/yashaswi-mudumbai-large_image-6-a-6952.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.60.78.137 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-60-78-137.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 8e87002c7c7950edfcba2fcc16efb4a10cc88a96b98700a5ae9fe6d8a9449fb6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Cache-Control: public, max-age=5860
ETag: 0de18250352fe4fc45bf4e00c8367ff4
X-Timestamp: 1732255876.25090
Connection: keep-alive
Expires: Thu, 09 Jan 2025 03:48:50 GMT
Accept-Ranges: bytes
X-Trans-Id: tx2228867268aa4ed9959b8-00674020cedfw1
Content-Length: 30338
Date: Thu, 09 Jan 2025 02:11:10 GMT
Last-Modified: Fri, 22 Nov 2024 06:11:17 GMT
Content-Type: image/jpeg

GET
H/1.1 200
OK sonal-koul-large_image-5-a-6913.png
6d63d49ccb7c52435540-5070aa97eaa2b8df4eb5a91600e69901.ssl.cf1.rackcdn.com/ 192 KB
193 KB 175ms
99ms Image
image/png 23.60.78.137
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://6d63d49ccb7c52435540-5070aa97eaa2b8df4eb5a91600e69901.ssl.cf1.rackcdn.com/sonal-koul-large_image-5-a-6913.png
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.60.78.137 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-60-78-137.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: dc4b06990df4609085f1450fada968380da66a8fd1d2cb8bdb4068371cb1ec0c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Cache-Control: public, max-age=22562
ETag: 5a56c78e105b78e553b42ee4705ba584
X-Timestamp: 1732035856.71622
Connection: keep-alive
Expires: Thu, 09 Jan 2025 08:27:12 GMT
Accept-Ranges: bytes
X-Trans-Id: tx5a184112cbce468698e78-0067771699dfw1
Content-Length: 196985
Date: Thu, 09 Jan 2025 02:11:10 GMT
Last-Modified: Tue, 19 Nov 2024 17:04:17 GMT
Content-Type: image/png

GET
H/1.1 200
OK sruthi-nagulavancha-large_image-1-a-6979.jpg
6d63d49ccb7c52435540-5070aa97eaa2b8df4eb5a91600e69901.ssl.cf1.rackcdn.com/ 26 KB
27 KB 247ms
120ms Image
image/jpeg 23.60.78.137
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://6d63d49ccb7c52435540-5070aa97eaa2b8df4eb5a91600e69901.ssl.cf1.rackcdn.com/sruthi-nagulavancha-large_image-1-a-6979.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.60.78.137 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-60-78-137.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: b8f1a2e5ae298b7083365faa7dc3c97c173c1e4607f4c625cd195b41fb33e606

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Cache-Control: public, max-age=63455
ETag: 67e28b6a6c73be8326e4296d42df1bfe
X-Timestamp: 1732857805.86140
Connection: keep-alive
Expires: Thu, 09 Jan 2025 19:48:45 GMT
Accept-Ranges: bytes
X-Trans-Id: txd80f1f22a7284feb8fca5-006749560bdfw1
Content-Length: 26938
Date: Thu, 09 Jan 2025 02:11:10 GMT
Last-Modified: Fri, 29 Nov 2024 05:23:26 GMT
Content-Type: image/jpeg

GET
H/1.1 200
OK vinay-padegaonkar-large_image-1-a-6912.jpg
6d63d49ccb7c52435540-5070aa97eaa2b8df4eb5a91600e69901.ssl.cf1.rackcdn.com/ 24 KB
24 KB 167ms
86ms Image
image/jpeg 23.60.78.137
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://6d63d49ccb7c52435540-5070aa97eaa2b8df4eb5a91600e69901.ssl.cf1.rackcdn.com/vinay-padegaonkar-large_image-1-a-6912.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.60.78.137 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-60-78-137.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 7e7a3444709b6476152c274f3deafaa6f238c20d9badd36ce9ec56c67a86a1b9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Cache-Control: public, max-age=42641
ETag: c082d4c19845f6b635996b171f4a89b1
X-Timestamp: 1730775522.67921
Connection: keep-alive
Expires: Thu, 09 Jan 2025 14:01:51 GMT
Accept-Ranges: bytes
X-Trans-Id: txb2e1d82294274764969c0-006760e5afdfw1
Content-Length: 24528
Date: Thu, 09 Jan 2025 02:11:10 GMT
Last-Modified: Tue, 05 Nov 2024 02:58:43 GMT
Content-Type: image/jpeg

GET
H/1.1 200
OK gigaom-radar-software-supply-chain-security-2024-report-logo-1-w-14613.PNG
dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com/ 54 KB
54 KB 295ms
77ms Image
image/png 23.60.78.137
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com/gigaom-radar-software-supply-chain-security-2024-report-logo-1-w-14613.PNG
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.60.78.137 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-60-78-137.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 9e932fc7917418932aac3cda29691c2efb46f8f849b8c38ac7b04696ee42396b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Cache-Control: public, max-age=73101
ETag: 4113c616902289d237b710f5e8362f36
X-Timestamp: 1735613856.07194
Connection: keep-alive
Expires: Thu, 09 Jan 2025 22:29:31 GMT
Accept-Ranges: bytes
X-Trans-Id: tx0ac284dafbc8497a9ca99-00677b6c40dfw1
Content-Length: 54815
Date: Thu, 09 Jan 2025 02:11:10 GMT
Last-Modified: Tue, 31 Dec 2024 02:57:37 GMT
Content-Type: image/png

GET
H/1.1 200
OK frost-radar-cloud-security-posture-management-2024-pdf-1-w-14614.jpg
dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com/ 103 KB
104 KB 71ms
71ms Image
image/jpeg 23.60.78.137
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com/frost-radar-cloud-security-posture-management-2024-pdf-1-w-14614.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.60.78.137 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-60-78-137.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 12ee11d0b7e5180cd74d66f09b6c6a9a0525eda351ce2e6b732454346791f6d4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Cache-Control: public, max-age=73138
ETag: cfa9180ad3837dabab8496459dd51b08
X-Timestamp: 1735614057.90400
Connection: keep-alive
Expires: Thu, 09 Jan 2025 22:30:08 GMT
Accept-Ranges: bytes
X-Trans-Id: txae5e3babef5c41f882e09-00677b6beedfw1
Content-Length: 105709
Date: Thu, 09 Jan 2025 02:11:10 GMT
Last-Modified: Tue, 31 Dec 2024 03:00:58 GMT
Content-Type: image/jpeg

GET
H/1.1 200
OK oreilly-cloud-native-application-protection-platforms-pdf-3-w-14611.jpg
dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com/ 271 KB
271 KB 305ms
87ms Image
image/jpeg 23.60.78.137
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com/oreilly-cloud-native-application-protection-platforms-pdf-3-w-14611.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.60.78.137 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-60-78-137.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 1024c10cc5d758e65707a1e8374a350873cce5b6d94e9845da7ba39b98b60d6f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Cache-Control: public, max-age=76970
ETag: e180c9cbd976a24cf3870c4069c564fb
X-Timestamp: 1735585450.62930
Connection: keep-alive
Expires: Thu, 09 Jan 2025 23:34:00 GMT
Accept-Ranges: bytes
X-Trans-Id: txfef0beda404a42349ec86-00677f0b65dfw1
Content-Length: 277238
Date: Thu, 09 Jan 2025 02:11:10 GMT
Last-Modified: Mon, 30 Dec 2024 19:04:11 GMT
Content-Type: image/jpeg

GET
H/1.1 200
OK gigaom-cnapp-2024-report-logo-1-w-14612.PNG
dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com/ 56 KB
57 KB 311ms
88ms Image
image/png 23.60.78.137
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com/gigaom-cnapp-2024-report-logo-1-w-14612.PNG
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.60.78.137 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-60-78-137.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: c2377b781a7da01b324dc4aa3b643cd2ecd0fedb5a57bac46d4f983c611709e3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Cache-Control: public, max-age=73077
ETag: 435257f2899b651c99054a4d8d9da23d
X-Timestamp: 1735613569.64843
Connection: keep-alive
Expires: Thu, 09 Jan 2025 22:29:07 GMT
Accept-Ranges: bytes
X-Trans-Id: tx94e8a7a562e0401cb5616-00677b6c40dfw1
Content-Length: 57660
Date: Thu, 09 Jan 2025 02:11:10 GMT
Last-Modified: Tue, 31 Dec 2024 02:52:50 GMT
Content-Type: image/png

GET
H/1.1 200
OK top-canadian-cyber-threats-expected-in-2020-logo-9-h-102.jpg
fa94d5c47256403c613d-7164cafcaac68bfd3318486ab257f999.ssl.cf1.rackcdn.com/ 76 KB
77 KB 415ms
184ms Image
image/jpeg 23.60.78.137
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fa94d5c47256403c613d-7164cafcaac68bfd3318486ab257f999.ssl.cf1.rackcdn.com/top-canadian-cyber-threats-expected-in-2020-logo-9-h-102.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.60.78.137 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-60-78-137.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: eb9ec684a7198fded61e248eaff2d28d0c9f8a15dfee8d9afff66aa6ff200461

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Cache-Control: public, max-age=19789
ETag: 69913c61181f1fc9d730d6c8298e55c4
X-Timestamp: 1572271064.63410
Connection: keep-alive
Expires: Thu, 09 Jan 2025 07:41:00 GMT
Accept-Ranges: bytes
X-Trans-Id: tx55fd78c6ad3b44158313a-00676d868edfw1
Content-Length: 78320
Date: Thu, 09 Jan 2025 02:11:11 GMT
Last-Modified: Mon, 28 Oct 2019 13:57:45 GMT
Content-Type: image/jpeg

GET
H/1.1 200
OK leveraging-new-technologies-in-fraud-investigations-logo-7-h-101.jpg
fa94d5c47256403c613d-7164cafcaac68bfd3318486ab257f999.ssl.cf1.rackcdn.com/ 197 KB
198 KB 298ms
93ms Image
image/jpeg 23.60.78.137
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fa94d5c47256403c613d-7164cafcaac68bfd3318486ab257f999.ssl.cf1.rackcdn.com/leveraging-new-technologies-in-fraud-investigations-logo-7-h-101.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.60.78.137 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-60-78-137.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: c70242480ad0a0ecc7c305d659f1fdb3a9cb1eb480927b46f8bd62d33ed0f8b2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Cache-Control: public, max-age=31381
ETag: e3e068e355cdbfaa15e88b627d7ebc55
X-Timestamp: 1571148412.42493
Connection: keep-alive
Expires: Thu, 09 Jan 2025 10:54:12 GMT
Accept-Ranges: bytes
X-Trans-Id: tx44e458a04c6f434396430-00673cfe15dfw1
Content-Length: 202154
Date: Thu, 09 Jan 2025 02:11:11 GMT
Last-Modified: Tue, 15 Oct 2019 14:06:53 GMT
Content-Type: image/jpeg

GET
H/1.1 200
OK collaboration-avoiding-operational-conflicts-taking-on-new-roles-logo-10-h-100.jpg
fa94d5c47256403c613d-7164cafcaac68bfd3318486ab257f999.ssl.cf1.rackcdn.com/ 87 KB
88 KB 298ms
102ms Image
image/jpeg 23.60.78.137
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fa94d5c47256403c613d-7164cafcaac68bfd3318486ab257f999.ssl.cf1.rackcdn.com/collaboration-avoiding-operational-conflicts-taking-on-new-roles-logo-10-h-100.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.60.78.137 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-60-78-137.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 4c57a77761f2639985b760e69c5bbaffceb6100559dcf3296d3cc96ea6a0d305

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Cache-Control: public, max-age=72163
ETag: 36c70127fa172aa8ce8cd235fddf4c97
X-Timestamp: 1570023700.81183
Connection: keep-alive
Expires: Thu, 09 Jan 2025 22:13:54 GMT
Accept-Ranges: bytes
X-Trans-Id: txf75347cceedc4ccfad25a-00677dc840dfw1
Content-Length: 89481
Date: Thu, 09 Jan 2025 02:11:11 GMT
Last-Modified: Wed, 02 Oct 2019 13:41:41 GMT
Content-Type: image/jpeg

GET
H/1.1 200
OK cybered-magazine-special-healthcare-edition-logo-1-h-99.jpg
fa94d5c47256403c613d-7164cafcaac68bfd3318486ab257f999.ssl.cf1.rackcdn.com/ 75 KB
76 KB 277ms
102ms Image
image/jpeg 23.60.78.137
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fa94d5c47256403c613d-7164cafcaac68bfd3318486ab257f999.ssl.cf1.rackcdn.com/cybered-magazine-special-healthcare-edition-logo-1-h-99.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.60.78.137 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-60-78-137.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 369bffbe203ed6d6454c3b45ee0a20f216518f676d7520bc5ed03a87ddc3f2b8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Cache-Control: public, max-age=20453
ETag: 60d462094cfe3458426e91f8ae0a015d
X-Timestamp: 1565973399.90545
Connection: keep-alive
Expires: Thu, 09 Jan 2025 07:52:04 GMT
Accept-Ranges: bytes
X-Trans-Id: txe89ca326bb924101aee79-00673e02e6dfw1
Content-Length: 76929
Date: Thu, 09 Jan 2025 02:11:11 GMT
Last-Modified: Fri, 16 Aug 2019 16:36:40 GMT
Content-Type: image/jpeg

GET
H/1.1 200
OK cloud-security-posture-checklist-heading-into-2025-showcase_image-2-s-139.jpg
21aaef15263171502b5a-3fc6a64a094676b060fa7dc8c4490be9.ssl.cf1.rackcdn.com/ 61 KB
61 KB 379ms
145ms Image
image/jpeg 23.60.78.137
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://21aaef15263171502b5a-3fc6a64a094676b060fa7dc8c4490be9.ssl.cf1.rackcdn.com/cloud-security-posture-checklist-heading-into-2025-showcase_image-2-s-139.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.60.78.137 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-60-78-137.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 7caf9fb1d97edb1a1459b0de03b4fa7c78df380d1e19e034e6e857e1f76bbedf

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Cache-Control: public, max-age=45264
ETag: be5f0dd68681a07f959e378c0664599f
X-Timestamp: 1733229557.44010
Connection: keep-alive
Expires: Thu, 09 Jan 2025 14:45:35 GMT
Accept-Ranges: bytes
X-Trans-Id: txef80d55522f14a0b82fac-00674f0097dfw1
Content-Length: 62466
Date: Thu, 09 Jan 2025 02:11:11 GMT
Last-Modified: Tue, 03 Dec 2024 12:39:18 GMT
Content-Type: image/jpeg

GET
H/1.1 200
OK 3-minute-survey-unlock-future-cloud-share-your-insights-today-showcase_image-6-s-135.jpg
21aaef15263171502b5a-3fc6a64a094676b060fa7dc8c4490be9.ssl.cf1.rackcdn.com/ 61 KB
61 KB 351ms
120ms Image
image/jpeg 23.60.78.137
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://21aaef15263171502b5a-3fc6a64a094676b060fa7dc8c4490be9.ssl.cf1.rackcdn.com/3-minute-survey-unlock-future-cloud-share-your-insights-today-showcase_image-6-s-135.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.60.78.137 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-60-78-137.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 7caf9fb1d97edb1a1459b0de03b4fa7c78df380d1e19e034e6e857e1f76bbedf

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Cache-Control: public, max-age=9847
ETag: be5f0dd68681a07f959e378c0664599f
X-Timestamp: 1728660672.29319
Connection: keep-alive
Expires: Thu, 09 Jan 2025 04:55:18 GMT
Accept-Ranges: bytes
X-Trans-Id: txea70e7782d78437cb0d35-00670947e1dfw1
Content-Length: 62466
Date: Thu, 09 Jan 2025 02:11:11 GMT
Last-Modified: Fri, 11 Oct 2024 15:31:13 GMT
Content-Type: image/jpeg

GET
H/1.1 200
OK bankinfosecurity-survey-enhancing-cybersecurity-training-in-financial-sector-showcase_image-6-s-136.jpg
21aaef15263171502b5a-3fc6a64a094676b060fa7dc8c4490be9.ssl.cf1.rackcdn.com/ 81 KB
81 KB 326ms
103ms Image
image/jpeg 23.60.78.137
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://21aaef15263171502b5a-3fc6a64a094676b060fa7dc8c4490be9.ssl.cf1.rackcdn.com/bankinfosecurity-survey-enhancing-cybersecurity-training-in-financial-sector-showcase_image-6-s-136.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.60.78.137 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-60-78-137.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 9868d92483cafd2077c0f23bdded0f15eb319f9302c9ea3817da9d1bdceaa596

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Cache-Control: public, max-age=599
ETag: 14d4aa71c8680401326708935bfefd46
X-Timestamp: 1732045355.50203
Connection: keep-alive
Expires: Thu, 09 Jan 2025 02:21:10 GMT
Accept-Ranges: bytes
X-Trans-Id: tx2a0440ee461e4ed4850ce-00673ceab5dfw1
Content-Length: 82869
Date: Thu, 09 Jan 2025 02:11:11 GMT
Last-Modified: Tue, 19 Nov 2024 19:42:36 GMT
Content-Type: image/jpeg

GET
H/1.1 200
OK customized-security-report-in-5-minutes-to-uncover-gaps-in-your-cloud-protection-showcase_image-6-s-134.jpg
21aaef15263171502b5a-3fc6a64a094676b060fa7dc8c4490be9.ssl.cf1.rackcdn.com/ 61 KB
61 KB 298ms
80ms Image
image/jpeg 23.60.78.137
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://21aaef15263171502b5a-3fc6a64a094676b060fa7dc8c4490be9.ssl.cf1.rackcdn.com/customized-security-report-in-5-minutes-to-uncover-gaps-in-your-cloud-protection-showcase_image-6-s-134.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.60.78.137 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-60-78-137.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 7caf9fb1d97edb1a1459b0de03b4fa7c78df380d1e19e034e6e857e1f76bbedf

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Cache-Control: public, max-age=6419
ETag: be5f0dd68681a07f959e378c0664599f
X-Timestamp: 1728393949.74240
Connection: keep-alive
Expires: Thu, 09 Jan 2025 03:58:10 GMT
Accept-Ranges: bytes
X-Trans-Id: txe1e7e0cc55f14001adcc3-006706699cdfw1
Content-Length: 62466
Date: Thu, 09 Jan 2025 02:11:11 GMT
Last-Modified: Tue, 08 Oct 2024 13:25:50 GMT
Content-Type: image/jpeg

GET
H/1.1 200
OK cs4ca-cyber-security-for-critical-assets-mena-summit-showcase_image-5-e-423.jpg
752b069ec945bee67d86-1021436e05aad7b2347bf3096cc7e309.ssl.cf1.rackcdn.com/ 57 KB
57 KB 327ms
79ms Image
image/jpeg 23.60.78.137
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://752b069ec945bee67d86-1021436e05aad7b2347bf3096cc7e309.ssl.cf1.rackcdn.com/cs4ca-cyber-security-for-critical-assets-mena-summit-showcase_image-5-e-423.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.60.78.137 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-60-78-137.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 8d3c5d3745d81d914406a42405c43f0d9cb66bfe29f3f1f24a0729dae7fc2cc8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Cache-Control: public, max-age=6893
ETag: a1456f859ca74f7915be1f2c3a3216c5
X-Timestamp: 1711364820.08405
Connection: keep-alive
Expires: Thu, 09 Jan 2025 04:06:04 GMT
Accept-Ranges: bytes
X-Trans-Id: tx82205f8920b445b4b99d5-006740a08edfw1
Content-Length: 58333
Date: Thu, 09 Jan 2025 02:11:11 GMT
Last-Modified: Mon, 25 Mar 2024 11:07:01 GMT
Content-Type: image/jpeg

GET
H/1.1 200
OK virtual-summit-cybersecurity-implications-ai-americas-image_file_large-1-e-440.png
752b069ec945bee67d86-1021436e05aad7b2347bf3096cc7e309.ssl.cf1.rackcdn.com/ 187 KB
187 KB 233ms
90ms Image
image/png 23.60.78.137
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://752b069ec945bee67d86-1021436e05aad7b2347bf3096cc7e309.ssl.cf1.rackcdn.com/virtual-summit-cybersecurity-implications-ai-americas-image_file_large-1-e-440.png
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.60.78.137 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-60-78-137.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: b05c82faf0ced5798edf1f2e7f14918bcc89c8cdeea841a7bf776b12f2d02326

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Cache-Control: public, max-age=8086
ETag: 6dfa1fa5316ce6a5641d5131e7023897
X-Timestamp: 1735834781.92413
Connection: keep-alive
Expires: Thu, 09 Jan 2025 04:25:57 GMT
Accept-Ranges: bytes
X-Trans-Id: txac80ce15369743b89ca1a-006776c37ddfw1
Content-Length: 191183
Date: Thu, 09 Jan 2025 02:11:11 GMT
Last-Modified: Thu, 02 Jan 2025 16:19:42 GMT
Content-Type: image/png

GET
H/1.1 200
OK manusec-cyber-security-for-manufacturing-europe-summit-showcase_image-10-e-424.jpg
752b069ec945bee67d86-1021436e05aad7b2347bf3096cc7e309.ssl.cf1.rackcdn.com/ 57 KB
58 KB 219ms
95ms Image
image/jpeg 23.60.78.137
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://752b069ec945bee67d86-1021436e05aad7b2347bf3096cc7e309.ssl.cf1.rackcdn.com/manusec-cyber-security-for-manufacturing-europe-summit-showcase_image-10-e-424.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.60.78.137 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-60-78-137.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 7eec79b40363103fe8930508db7a14e4e4c2e2bcd90e97448b487bd50958694b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Cache-Control: public, max-age=75665
ETag: 99c4df34de545f4cabdeefcedfacb4c8
X-Timestamp: 1711366585.68352
Connection: keep-alive
Expires: Thu, 09 Jan 2025 23:12:16 GMT
Accept-Ranges: bytes
X-Trans-Id: tx4c085c33dae74d878d1d2-006745f792dfw1
Content-Length: 58585
Date: Thu, 09 Jan 2025 02:11:11 GMT
Last-Modified: Mon, 25 Mar 2024 11:36:26 GMT
Content-Type: image/jpeg

GET
H/1.1 200
OK fraud-prevention-summit-new-york-image_file_large-5-e-443.png
752b069ec945bee67d86-1021436e05aad7b2347bf3096cc7e309.ssl.cf1.rackcdn.com/ 185 KB
185 KB 214ms
89ms Image
image/png 23.60.78.137
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://752b069ec945bee67d86-1021436e05aad7b2347bf3096cc7e309.ssl.cf1.rackcdn.com/fraud-prevention-summit-new-york-image_file_large-5-e-443.png
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.60.78.137 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-60-78-137.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 966532d57c30c928493774e71d48b17683c4197d670851f4a5a84ec3bebff61d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Cache-Control: public, max-age=7969
ETag: ebd3fa8f4fcb0bb153658121b0540fd8
X-Timestamp: 1735834513.45320
Connection: keep-alive
Expires: Thu, 09 Jan 2025 04:24:00 GMT
Accept-Ranges: bytes
X-Trans-Id: txa100cd1bb7c447b59c630-006776c37ddfw1
Content-Length: 188985
Date: Thu, 09 Jan 2025 02:11:11 GMT
Last-Modified: Thu, 02 Jan 2025 16:15:14 GMT
Content-Type: image/png

GET
H2 200 empty_menu_image.png
www.bankinfosecurity.com/images/navigation/generic/ 5 KB
5 KB 72ms
69ms Image
image/png 50.56.167.254
RMH-14

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bankinfosecurity.com/images/navigation/generic/empty_menu_image.png

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

50.56.167.254 , United States, ASN33070 (RMH-14, US),

Reverse DNS

Software

Resource Hash

69278fe35261286939e10f3832f461f9bf6addf267ffe0134e26be3d313dbd7d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: frame-ancestors 'none'
cache-control: max-age=86400, private, must-revalidate
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
accept-ranges: bytes
content-length: 5306
x-xss-protection: 1; mode=block
date: Thu, 09 Jan 2025 02:11:09 GMT
content-type: image/png
vary: Accept-Encoding
x-frame-options: deny

GET
H/1.1 200
OK ismg-editors-china-outpacing-us-in-critical-technology-rd-showcase_image-9-a-26981.jpg
130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/ 156 KB
157 KB 72ms
72ms Image
image/jpeg 23.43.207.143
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/ismg-editors-china-outpacing-us-in-critical-technology-rd-showcase_image-9-a-26981.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.43.207.143 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-43-207-143.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: a98945419e4fe40565e179dbfe55c164440b599c74a63d47c8dceec5fdc6eae4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Cache-Control: public, max-age=18347
ETag: 0321db2ec37afa5f957174a07882ad0b
X-Timestamp: 1733415112.77950
Connection: keep-alive
Expires: Thu, 09 Jan 2025 07:16:58 GMT
Accept-Ranges: bytes
X-Trans-Id: tx9d9ac29c86514354bdc9b-0067533af6dfw1
Content-Length: 160170
Date: Thu, 09 Jan 2025 02:11:11 GMT
Last-Modified: Thu, 05 Dec 2024 16:11:53 GMT
Content-Type: image/jpeg

GET
H/1.1 200
OK crosspoint-to-invest-5m-in-each-innovation-sandbox-finalist-showcase_image-2-a-26902.jpg
130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/ 317 KB
318 KB 75ms
74ms Image
image/jpeg 23.43.207.143
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/crosspoint-to-invest-5m-in-each-innovation-sandbox-finalist-showcase_image-2-a-26902.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.43.207.143 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-43-207-143.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 941cbbc71aff530567694df4b6753b0a72279ae87fb83cbf6e5c08dd52e01284

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Cache-Control: public, max-age=13815
ETag: a881e614ea615e7063785c4fcc1eb063
X-Timestamp: 1732568938.57898
Connection: keep-alive
Expires: Thu, 09 Jan 2025 06:01:26 GMT
Accept-Ranges: bytes
X-Trans-Id: tx640afd40433d439aad48c-006744f972dfw1
Content-Length: 325030
Date: Thu, 09 Jan 2025 02:11:11 GMT
Last-Modified: Mon, 25 Nov 2024 21:08:59 GMT
Content-Type: image/jpeg

GET
H/1.1 200
OK cybersecurity-insights-from-60-ceos-company-founders-showcase_image-5-a-25927.jpg
130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/ 229 KB
230 KB 73ms
72ms Image
image/jpeg 23.43.207.143
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/cybersecurity-insights-from-60-ceos-company-founders-showcase_image-5-a-25927.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.43.207.143 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-43-207-143.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 4e88dcbac59e33817a032b1c1666118c6bdf3d140fe07f6943ae5cf9c4767adc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Cache-Control: public, max-age=39827
ETag: 84d4c8b1dff4d9493d39353ceda35652
X-Timestamp: 1722619405.68930
Connection: keep-alive
Expires: Thu, 09 Jan 2025 13:14:58 GMT
Accept-Ranges: bytes
X-Trans-Id: txdb771d10d6f3415c8f324-0067716a59dfw1
Content-Length: 234903
Date: Thu, 09 Jan 2025 02:11:11 GMT
Last-Modified: Fri, 02 Aug 2024 17:23:26 GMT
Content-Type: image/jpeg

GET
H/1.1 200
OK rsa-conference-2024-compendium-150-interviews-more-showcase_image-1-a-25565.jpg
130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/ 111 KB
112 KB 74ms
73ms Image
image/jpeg 23.43.207.143
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/rsa-conference-2024-compendium-150-interviews-more-showcase_image-1-a-25565.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.43.207.143 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-43-207-143.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 76d3bbf6509834b8e39342ef129df55612a7db03356366abb13399b8d389d25a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Cache-Control: public, max-age=36086
ETag: 2516afe1e1bc24f5c811a6b7419b99b9
X-Timestamp: 1719245619.06064
Connection: keep-alive
Expires: Thu, 09 Jan 2025 12:12:37 GMT
Accept-Ranges: bytes
X-Trans-Id: txf347de030ae84788b26b7-00673a6f6ddfw1
Content-Length: 113802
Date: Thu, 09 Jan 2025 02:11:11 GMT
Last-Modified: Mon, 24 Jun 2024 16:13:40 GMT
Content-Type: image/jpeg

GET
H/1.1 200
OK infosecurity-europe-2024-latest-insights-on-cybersecurity-showcase_image-3-a-26031.jpg
130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/ 327 KB
327 KB 75ms
75ms Image
image/jpeg 23.43.207.143
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/infosecurity-europe-2024-latest-insights-on-cybersecurity-showcase_image-3-a-26031.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.43.207.143 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-43-207-143.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: e38d21eebc8657374beb023fd20aff7fe78c433d34cd95bd002312b6ed851939

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Cache-Control: public, max-age=76656
ETag: c85abb1fa1364189f50879e98db7d79b
X-Timestamp: 1723700251.86261
Connection: keep-alive
Expires: Thu, 09 Jan 2025 23:28:47 GMT
Accept-Ranges: bytes
X-Trans-Id: tx0d407158b6ea4574b63f5-0067354249dfw1
Content-Length: 334729
Date: Thu, 09 Jan 2025 02:11:11 GMT
Last-Modified: Thu, 15 Aug 2024 05:37:32 GMT
Content-Type: image/jpeg

GET
H/1.1 200
OK cyberedboard-profiles-in-leadership-don-gibson-showcase_image-2-a-25465.jpg
130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/ 187 KB
187 KB 112ms
71ms Image
image/jpeg 23.43.207.143
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/cyberedboard-profiles-in-leadership-don-gibson-showcase_image-2-a-25465.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.43.207.143 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-43-207-143.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 05f2bd204d6a112236e1cdfc2fbb4fa8f678628bf20d77b00fba7c1cbbb06052

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Cache-Control: public, max-age=18499
ETag: f911af545d40dac86d29cf9072c4dea0
X-Timestamp: 1718022565.94152
Connection: keep-alive
Expires: Thu, 09 Jan 2025 07:19:30 GMT
Accept-Ranges: bytes
X-Trans-Id: tx16d806933fc04a10b63e2-0066749c22dfw1
Content-Length: 191352
Date: Thu, 09 Jan 2025 02:11:11 GMT
Last-Modified: Mon, 10 Jun 2024 12:29:26 GMT
Content-Type: image/jpeg

GET
H/1.1 200
OK cloud-security-big-challenge-for-cisos-heres-why-showcase_image-1-a-25575.jpg
130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/ 233 KB
233 KB 137ms
74ms Image
image/jpeg 23.43.207.143
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/cloud-security-big-challenge-for-cisos-heres-why-showcase_image-1-a-25575.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.43.207.143 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-43-207-143.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fc914abef5985cda118c262ac69b47cac07fbc94d51c5254cb055961590b6a98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Cache-Control: public, max-age=44708
ETag: 3cfbf0be30efc6b56680e178d4a287c1
X-Timestamp: 1718884938.29510
Connection: keep-alive
Expires: Thu, 09 Jan 2025 14:36:19 GMT
Accept-Ranges: bytes
X-Trans-Id: txc3960246c07648f4a017a-0066fcbb4cdfw1
Content-Length: 238655
Date: Thu, 09 Jan 2025 02:11:11 GMT
Last-Modified: Thu, 20 Jun 2024 12:02:19 GMT
Content-Type: image/jpeg

GET
H/1.1 200
OK cyberedboard-profiles-in-leadership-aman-sood-showcase_image-4-a-25498.jpg
130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/ 124 KB
125 KB 88ms
70ms Image
image/jpeg 23.43.207.143
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/cyberedboard-profiles-in-leadership-aman-sood-showcase_image-4-a-25498.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.43.207.143 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-43-207-143.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: ed8f02bdd4fa786645522f9d95a9a151b1e487063d6e8fcbe675ae60d444d8be

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Cache-Control: public, max-age=27932
ETag: 61ed6c940a567abdafb5d8440404ea13
X-Timestamp: 1718197705.16604
Connection: keep-alive
Expires: Thu, 09 Jan 2025 09:56:43 GMT
Accept-Ranges: bytes
X-Trans-Id: tx2a5292cb0e6347f785337-00671a8b85dfw1
Content-Length: 127371
Date: Thu, 09 Jan 2025 02:11:11 GMT
Last-Modified: Wed, 12 Jun 2024 13:08:26 GMT
Content-Type: image/jpeg

GET
H/1.1 200
OK mathew-j-schwartz-largeImage-4-a-892.jpg
6d63d49ccb7c52435540-5070aa97eaa2b8df4eb5a91600e69901.ssl.cf1.rackcdn.com/ 63 KB
63 KB 320ms
100ms Image
image/jpeg 23.60.78.137
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://6d63d49ccb7c52435540-5070aa97eaa2b8df4eb5a91600e69901.ssl.cf1.rackcdn.com/mathew-j-schwartz-largeImage-4-a-892.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.60.78.137 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-60-78-137.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 23da1dd7c3c9ea31b5cba0b16ddc8bd521f11ba2b622692f4ec5703fc7555221

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Cache-Control: public, max-age=22803
ETag: 0a4204e2649185daf7ea39a3c953e722
X-Timestamp: 1552336267.88871
Connection: keep-alive
Expires: Thu, 09 Jan 2025 08:31:13 GMT
Accept-Ranges: bytes
X-Trans-Id: txf887658d4e1648f393845-006775df81dfw1
Content-Length: 64095
Date: Thu, 09 Jan 2025 02:11:10 GMT
Last-Modified: Mon, 11 Mar 2019 20:31:08 GMT
Content-Type: image/jpeg

GET
H/1.1 200
OK elevate-your-aml-program-ai-pdf-2-w-14546.jpg
dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com/ 511 KB
512 KB 143ms
143ms Image
image/jpeg 23.60.78.137
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com/elevate-your-aml-program-ai-pdf-2-w-14546.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.60.78.137 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-60-78-137.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 50072ae7930cf008d6493766b86605cb41373e07a04f2b2e17bc8d508425ac28

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Cache-Control: public, max-age=52398
ETag: 276736edb2b48c2d1cb1bcc6a0ceac93
X-Timestamp: 1732570341.50206
Connection: keep-alive
Expires: Thu, 09 Jan 2025 16:44:29 GMT
Accept-Ranges: bytes
X-Trans-Id: tx9fb33c04c3f3485e92ff6-00677c49fcdfw1
Content-Length: 523553
Date: Thu, 09 Jan 2025 02:11:11 GMT
Last-Modified: Mon, 25 Nov 2024 21:32:22 GMT
Content-Type: image/jpeg

GET
H/1.1 200
OK ai-vs-dirty-money-state-artificial-intelligence-in-financial-crime-compliance-pdf-10-w-14551.jpg
dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com/ 302 KB
302 KB 77ms
76ms Image
image/jpeg 23.60.78.137
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com/ai-vs-dirty-money-state-artificial-intelligence-in-financial-crime-compliance-pdf-10-w-14551.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.60.78.137 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-60-78-137.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: c6160c3fe2c0f80af0d2fc7026570f9b0895a5ae51c6b21f720c2626724d9447

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Cache-Control: public, max-age=51714
ETag: ef1ddcd63df5a161cb190f97eb7786b2
X-Timestamp: 1732571311.02518
Connection: keep-alive
Expires: Thu, 09 Jan 2025 16:33:05 GMT
Accept-Ranges: bytes
X-Trans-Id: tx1bfb474c550e4417918aa-006778ab59dfw1
Content-Length: 309094
Date: Thu, 09 Jan 2025 02:11:11 GMT
Last-Modified: Mon, 25 Nov 2024 21:48:32 GMT
Content-Type: image/jpeg

GET
H/1.1 200
OK accelerating-financial-crime-investigations-generative-ai-pdf-9-w-14552.jpg
dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com/ 173 KB
173 KB 109ms
108ms Image
image/jpeg 23.60.78.137
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com/accelerating-financial-crime-investigations-generative-ai-pdf-9-w-14552.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.60.78.137 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-60-78-137.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: f076b905f97bfcc9f85ae929b89b9f1ef536e9bc3348cbfa4845c04c7fb760e6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Cache-Control: public, max-age=34730
ETag: 0c8b1017305e6449313b5a195f06dba4
X-Timestamp: 1732571511.69390
Connection: keep-alive
Expires: Thu, 09 Jan 2025 11:50:01 GMT
Accept-Ranges: bytes
X-Trans-Id: tx0446fc18173545adabf30-006762bca6dfw1
Content-Length: 177049
Date: Thu, 09 Jan 2025 02:11:11 GMT
Last-Modified: Mon, 25 Nov 2024 21:51:52 GMT
Content-Type: image/jpeg

GET
H/1.1 200
OK webinar-prisma-access-browser-boosting-security-for-browser-based-work-landing_page_image-2-w-5973.jpg
75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com/ 57 KB
57 KB 73ms
73ms Image
image/jpeg 23.60.78.137
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com/webinar-prisma-access-browser-boosting-security-for-browser-based-work-landing_page_image-2-w-5973.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.60.78.137 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-60-78-137.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 2c44dc80bb23cfd60d76addb8444f0f70f435fe736e1b1db1e04805726d0d4f2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Cache-Control: public, max-age=57617
ETag: ba07c601eaf8f2358a85e9e06f728785
X-Timestamp: 1730996361.27312
Connection: keep-alive
Expires: Thu, 09 Jan 2025 18:11:28 GMT
Accept-Ranges: bytes
X-Trans-Id: tx721364f4756741d3965e9-00673e22d1dfw1
Content-Length: 58410
Date: Thu, 09 Jan 2025 02:11:11 GMT
Last-Modified: Thu, 07 Nov 2024 16:19:22 GMT
Content-Type: image/jpeg

GET
H/1.1 200
OK live-webinar-from-risk-to-resilience-elevating-cyber-awareness-human-risk-management-landing_page_image-2-w-5936.jpg
75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com/ 49 KB
50 KB 88ms
88ms Image
image/jpeg 23.60.78.137
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com/live-webinar-from-risk-to-resilience-elevating-cyber-awareness-human-risk-management-landing_page_image-2-w-5936.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.60.78.137 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-60-78-137.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 1a2c5fa3e14be0421b0524cea968dc24656f6129df9d7ccc7a71f827bf725bac

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Cache-Control: public, max-age=56954
ETag: 3b560bb30f087dfd1def2eb07bab2075
X-Timestamp: 1730306227.84461
Connection: keep-alive
Expires: Thu, 09 Jan 2025 18:00:25 GMT
Accept-Ranges: bytes
X-Trans-Id: tx41668d52d1c54bd9bf853-00672e7966dfw1
Content-Length: 50628
Date: Thu, 09 Jan 2025 02:11:11 GMT
Last-Modified: Wed, 30 Oct 2024 16:37:08 GMT
Content-Type: image/jpeg

GET
H/1.1 200
OK how-active-directory-security-drives-operational-resilience-pdf-7-w-14488.jpg
dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com/ 248 KB
248 KB 94ms
93ms Image
image/jpeg 23.60.78.137
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com/how-active-directory-security-drives-operational-resilience-pdf-7-w-14488.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.60.78.137 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-60-78-137.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: a297bfad6d37def57f78fa6e2a2c3b48269a1507b0280f547df0c597b5cfa7c5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Cache-Control: public, max-age=8346
ETag: 1fbf4ba96978a81e51837a807865bb9f
X-Timestamp: 1730999489.57529
Connection: keep-alive
Expires: Thu, 09 Jan 2025 04:30:17 GMT
Accept-Ranges: bytes
X-Trans-Id: txe1eb86aac4f247eea166a-006740d4d2dfw1
Content-Length: 253448
Date: Thu, 09 Jan 2025 02:11:11 GMT
Last-Modified: Thu, 07 Nov 2024 17:11:30 GMT
Content-Type: image/jpeg

GET
H/1.1 200
OK live-webinar-protecting-people-defending-data-in-healthcare-rise-ai-landing_page_image-6-w-5839.jpg
75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com/ 44 KB
45 KB 104ms
103ms Image
image/jpeg 23.60.78.137
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com/live-webinar-protecting-people-defending-data-in-healthcare-rise-ai-landing_page_image-6-w-5839.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.60.78.137 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-60-78-137.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 573860cbe93b28320024b6b7be1859bb87c236947aa7af25e37af26175c15d9c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Cache-Control: public, max-age=43387
ETag: b3e2f5bde6a04a0a9f7d3b509734b432
X-Timestamp: 1726692666.58636
Connection: keep-alive
Expires: Thu, 09 Jan 2025 14:14:18 GMT
Accept-Ranges: bytes
X-Trans-Id: tx2441883559154fc281eb1-00671bb511dfw1
Content-Length: 45235
Date: Thu, 09 Jan 2025 02:11:11 GMT
Last-Modified: Wed, 18 Sep 2024 20:51:07 GMT
Content-Type: image/jpeg

GET
H/1.1 200
OK definitive-guide-to-enterprise-browsers-pdf-8-w-14328.jpg
dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com/ 183 KB
183 KB 156ms
71ms Image
image/jpeg 23.60.78.137
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com/definitive-guide-to-enterprise-browsers-pdf-8-w-14328.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.60.78.137 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-60-78-137.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: b79264897c57ba1c56f43633b42ae372c48b812627c87fd50b53d54a2b546d79

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Cache-Control: public, max-age=20933
ETag: 3f1092707c583c07a59197511664bb3b
X-Timestamp: 1728030853.87739
Connection: keep-alive
Expires: Thu, 09 Jan 2025 08:00:04 GMT
Accept-Ranges: bytes
X-Trans-Id: tx87911a7a00e94b7e8d078-0067796a19dfw1
Content-Length: 187228
Date: Thu, 09 Jan 2025 02:11:11 GMT
Last-Modified: Fri, 04 Oct 2024 08:34:14 GMT
Content-Type: image/jpeg

GET
H/1.1 200
OK ultimate-guide-to-privacy-program-automation-pdf-3-w-14387.jpg
dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com/ 59 KB
60 KB 191ms
98ms Image
image/jpeg 23.60.78.137
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com/ultimate-guide-to-privacy-program-automation-pdf-3-w-14387.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.60.78.137 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-60-78-137.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 8a8d2287ffb5696820d375d1ccda78fb7121a19726ba0beaff1a5e6f16330111

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Cache-Control: public, max-age=10190
ETag: 1c9073d1c31ad061f34cb9d4d1c80e3f
X-Timestamp: 1729620009.73297
Connection: keep-alive
Expires: Thu, 09 Jan 2025 05:01:01 GMT
Accept-Ranges: bytes
X-Trans-Id: tx85cda9b746ec401f97927-006734e741dfw1
Content-Length: 60533
Date: Thu, 09 Jan 2025 02:11:11 GMT
Last-Modified: Tue, 22 Oct 2024 18:00:10 GMT
Content-Type: image/jpeg

GET
H/1.1 200
OK how-to-take-complexity-out-cybersecurity-image-1-i-5426.jpg
0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com/ 94 KB
94 KB 208ms
76ms Image
image/jpeg 23.60.78.137
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com/how-to-take-complexity-out-cybersecurity-image-1-i-5426.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.60.78.137 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-60-78-137.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: ad5199d07e0c2af95f5a9b771bcdad7bfc9630daa166cb02423b5b696b2a8bd4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Cache-Control: public, max-age=29403
ETag: 2599524c53c318a3c26e913aeedc22f7
X-Timestamp: 1732736575.42570
Connection: keep-alive
Expires: Thu, 09 Jan 2025 10:21:13 GMT
Accept-Ranges: bytes
X-Trans-Id: txaffdbdf5a6fa49759f56e-006751d39bdfw1
Content-Length: 95895
Date: Thu, 09 Jan 2025 02:11:10 GMT
Last-Modified: Wed, 27 Nov 2024 19:42:56 GMT
Content-Type: image/jpeg

GET
H/1.1 200
OK 2025-fraud-survey-emea-financial-fraud-trends-investment-priorities-pdf-9-w-14544.jpg
dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com/ 444 KB
444 KB 315ms
97ms Image
image/jpeg 23.60.78.137
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com/2025-fraud-survey-emea-financial-fraud-trends-investment-priorities-pdf-9-w-14544.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.60.78.137 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-60-78-137.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: a73c52320a301cf788b5de8381cdada7066bfee0d60e9edf91d68f2cac6a3c2b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Cache-Control: public, max-age=75939
ETag: 1e6eb449c9dc5da02e7cb40471c573fa
X-Timestamp: 1732568111.28670
Connection: keep-alive
Expires: Thu, 09 Jan 2025 23:16:49 GMT
Accept-Ranges: bytes
X-Trans-Id: tx5238e9f44a88472caaacc-0067645539dfw1
Content-Length: 454276
Date: Thu, 09 Jan 2025 02:11:10 GMT
Last-Modified: Mon, 25 Nov 2024 20:55:12 GMT
Content-Type: image/jpeg

GET
H/1.1 200
OK 2-hipaa-business-associates-pay-hhs-ransomware-settlements-showcase_image-9-a-27245.jpg
130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/ 68 KB
68 KB 79ms
78ms Image
image/jpeg 23.43.207.143
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/2-hipaa-business-associates-pay-hhs-ransomware-settlements-showcase_image-9-a-27245.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.43.207.143 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-43-207-143.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 5a5672523abbb16f5eac375b98f12d7bb28dc8f476d8ce8e01caafd4efd85c84

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Cache-Control: public, max-age=64175
ETag: 371de236cc42857208b32a8fe78cec47
X-Timestamp: 1736364869.02476
Connection: keep-alive
Expires: Thu, 09 Jan 2025 20:00:46 GMT
Accept-Ranges: bytes
X-Trans-Id: txdb0215ab15e545eaa40b4-00677ed972dfw1
Content-Length: 69469
Date: Thu, 09 Jan 2025 02:11:11 GMT
Last-Modified: Wed, 08 Jan 2025 19:34:30 GMT
Content-Type: image/jpeg

GET
H/1.1 200
OK overcoming-identity-access-challenges-in-healthcare-showcase_image-2-i-5425.jpg
0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com/ 63 KB
63 KB 80ms
79ms Image
image/jpeg 23.60.78.137
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com/overcoming-identity-access-challenges-in-healthcare-showcase_image-2-i-5425.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.60.78.137 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-60-78-137.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 3247aea10f4255589a28a38f85499a9772991f6150ebd9d61fdc47b15cbf47a5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Cache-Control: public, max-age=18492
ETag: 3822337f76ee6c41f07f070aa69e5001
X-Timestamp: 1732647444.69980
Connection: keep-alive
Expires: Thu, 09 Jan 2025 07:19:23 GMT
Accept-Ranges: bytes
X-Trans-Id: tx77843514a0624e6b9a68d-006749c2dddfw1
Content-Length: 64187
Date: Thu, 09 Jan 2025 02:11:11 GMT
Last-Modified: Tue, 26 Nov 2024 18:57:25 GMT
Content-Type: image/jpeg

GET
H/1.1 200
OK hackers-love-weekend-holiday-attacks-jeff-wichman-showcase_image-10-i-5430.jpg
0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com/ 74 KB
75 KB 80ms
79ms Image
image/jpeg 23.60.78.137
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com/hackers-love-weekend-holiday-attacks-jeff-wichman-showcase_image-10-i-5430.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.60.78.137 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-60-78-137.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 602d8ece71d11c8fe67abef151f2b984296c1c20f2670e5d4f72039998a26069

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Cache-Control: public, max-age=76724
ETag: bcaf432e6d2ed08ea660d28894ff1be1
X-Timestamp: 1734724080.85845
Connection: keep-alive
Expires: Thu, 09 Jan 2025 23:29:55 GMT
Accept-Ranges: bytes
X-Trans-Id: txbf021add3fa4404796bc9-006769a8c8dfw1
Content-Length: 76099
Date: Thu, 09 Jan 2025 02:11:11 GMT
Last-Modified: Fri, 20 Dec 2024 19:48:01 GMT
Content-Type: image/jpeg

GET
H/1.1 200
OK protecting-c-suite-in-wake-uhc-ceos-murder-showcase_image-5-i-5428.jpg
0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com/ 53 KB
54 KB 116ms
116ms Image
image/jpeg 23.60.78.137
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com/protecting-c-suite-in-wake-uhc-ceos-murder-showcase_image-5-i-5428.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.60.78.137 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-60-78-137.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: c1f9c7df78fdc65bf710385a6ed02bb7e6459e8b0f9115d13816ee81dc9b1111

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Cache-Control: public, max-age=13714
ETag: 98a693e58b1440a6ab617a78773d71c3
X-Timestamp: 1733505032.26334
Connection: keep-alive
Expires: Thu, 09 Jan 2025 05:59:45 GMT
Accept-Ranges: bytes
X-Trans-Id: txdf6e0b6d95264fbdabfaa-00675345fbdfw1
Content-Length: 54403
Date: Thu, 09 Jan 2025 02:11:11 GMT
Last-Modified: Fri, 06 Dec 2024 17:10:33 GMT
Content-Type: image/jpeg

GET
H/1.1 200
OK how-will-health-data-privacy-cyber-regs-shape-up-in-2025-melissa-crespo-showcase_image-5-i-5431.jpg
0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com/ 94 KB
95 KB 86ms
85ms Image
image/jpeg 23.60.78.137
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com/how-will-health-data-privacy-cyber-regs-shape-up-in-2025-melissa-crespo-showcase_image-5-i-5431.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.60.78.137 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-60-78-137.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: cac0f817700f204d8c78ee37a1da48eb893d4d84e5e59d0d138e9b3caabb0a22

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Cache-Control: public, max-age=1078
ETag: f51ae8ed5a8930b69568fa8b9207534d
X-Timestamp: 1734710087.68651
Connection: keep-alive
Expires: Thu, 09 Jan 2025 02:29:09 GMT
Accept-Ranges: bytes
X-Trans-Id: tx4f70b8443c6342eca5ed4-00677de2f5dfw1
Content-Length: 96409
Date: Thu, 09 Jan 2025 02:11:11 GMT
Last-Modified: Fri, 20 Dec 2024 15:54:48 GMT
Content-Type: image/jpeg

GET
H/1.1 200
OK how-hackers-manipulate-ai-to-affect-health-app-accuracy-showcase_image-5-i-5427.jpg
0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com/ 76 KB
76 KB 87ms
86ms Image
image/jpeg 23.60.78.137
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com/how-hackers-manipulate-ai-to-affect-health-app-accuracy-showcase_image-5-i-5427.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.60.78.137 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-60-78-137.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 03ecdc990f13413dbd1948f27773064ab143a4ae4ddac0cb3b1fe3953932d94f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Cache-Control: public, max-age=3953
ETag: b263a133aaa7d80d61ef4514cd13e31b
X-Timestamp: 1733254218.72138
Connection: keep-alive
Expires: Thu, 09 Jan 2025 03:17:04 GMT
Accept-Ranges: bytes
X-Trans-Id: txa3406d6203c64fb694fff-0067733ab6dfw1
Content-Length: 77418
Date: Thu, 09 Jan 2025 02:11:11 GMT
Last-Modified: Tue, 03 Dec 2024 19:30:19 GMT
Content-Type: image/jpeg

GET
H/1.1 200
OK contingency-planning-for-attacks-on-critical-3rd-parties-betsy-hodge-showcase_image-8-i-5436.jpg
0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com/ 55 KB
55 KB 172ms
114ms Image
image/jpeg 23.60.78.137
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com/contingency-planning-for-attacks-on-critical-3rd-parties-betsy-hodge-showcase_image-8-i-5436.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.60.78.137 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-60-78-137.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 0bf225d89007baa905f895a86688c43f28331d0ff721b8ea0c95abbf8541ebf7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Cache-Control: public, max-age=13733
ETag: 0160cfd427f38cf9d239338c0c569793
X-Timestamp: 1734712372.50220
Connection: keep-alive
Expires: Thu, 09 Jan 2025 06:00:04 GMT
Accept-Ranges: bytes
X-Trans-Id: txc585359fe6fd434385b97-00676d6eb1dfw1
Content-Length: 56248
Date: Thu, 09 Jan 2025 02:11:11 GMT
Last-Modified: Fri, 20 Dec 2024 16:32:53 GMT
Content-Type: image/jpeg

GET
H2 200 logo-ismg-with-text.png
www.bankinfosecurity.com/images-responsive/ 4 KB
4 KB 65ms
64ms Image
image/png 50.56.167.254
RMH-14

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bankinfosecurity.com/images-responsive/logo-ismg-with-text.png

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

50.56.167.254 , United States, ASN33070 (RMH-14, US),

Reverse DNS

Software

Resource Hash

4e2db1bef009e01901b4083a153f1607301428277a76f508e659dc2849cefa04

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: frame-ancestors 'none'
cache-control: max-age=86400, private, must-revalidate
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
accept-ranges: bytes
content-length: 4419
x-xss-protection: 1; mode=block
date: Thu, 09 Jan 2025 02:11:09 GMT
content-type: image/png
vary: Accept-Encoding
x-frame-options: deny

GET
H2 200 logo-ismg-print.png
www.bankinfosecurity.com/images-responsive/ 5 KB
5 KB 67ms
66ms Image
image/png 50.56.167.254
RMH-14

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bankinfosecurity.com/images-responsive/logo-ismg-print.png

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

50.56.167.254 , United States, ASN33070 (RMH-14, US),

Reverse DNS

Software

Resource Hash

5133e2e1a213ca44a8adb1f42f103a2d2e495849dfa4d42bf67c04fcc962e577

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: frame-ancestors 'none'
cache-control: max-age=86400, private, must-revalidate
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
accept-ranges: bytes
content-length: 5575
x-xss-protection: 1; mode=block
date: Thu, 09 Jan 2025 02:11:09 GMT
content-type: image/png
vary: Accept-Encoding
x-frame-options: deny

GET
H2 200 main.js Show response
www.bankinfosecurity.com/javascripts-responsive/ 42 KB
10 KB 71ms
62ms Script
text/javascript 50.56.167.254
RMH-14

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bankinfosecurity.com/javascripts-responsive/main.js?s=1736388669.4283

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

50.56.167.254 , United States, ASN33070 (RMH-14, US),

Reverse DNS

Software

Resource Hash

65aa03b8baf6c12db882c7ff9194eac095cb6107256cc9b05889c368ba2f5e90

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: frame-ancestors 'none'
cache-control: max-age=86400, private, must-revalidate
content-encoding: gzip
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
x-xss-protection: 1; mode=block
date: Thu, 09 Jan 2025 02:11:09 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
x-frame-options: deny

GET
H2 200 media-transcript-navigation.js Show response
www.bankinfosecurity.com/javascripts-responsive/ 26 KB
7 KB 74ms
65ms Script
text/javascript 50.56.167.254
RMH-14

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bankinfosecurity.com/javascripts-responsive/media-transcript-navigation.js?s=1736388669.4283

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

50.56.167.254 , United States, ASN33070 (RMH-14, US),

Reverse DNS

Software

Resource Hash

ae3c472ff47a96820c1acdf9574b231a88f62a006b84d320eb313af40f32f2db

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: frame-ancestors 'none'
cache-control: max-age=86400, private, must-revalidate
content-encoding: gzip
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
x-xss-protection: 1; mode=block
date: Thu, 09 Jan 2025 02:11:09 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
x-frame-options: deny

GET
H2 200 bis-hdr.r1.js Show response
www.bankinfosecurity.com/javascripts-responsive/ 1 KB
484 B 70ms
61ms Script
text/javascript 50.56.167.254
RMH-14

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bankinfosecurity.com/javascripts-responsive/bis-hdr.r1.js?s=1736388669.4283

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

50.56.167.254 , United States, ASN33070 (RMH-14, US),

Reverse DNS

Software

Resource Hash

9a13fb5949ace41b41f2baafd0749b4a9e3b98a86082246980d785c0f0e2f494

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: frame-ancestors 'none'
cache-control: max-age=86400, private, must-revalidate
content-encoding: gzip
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 449
x-xss-protection: 1; mode=block
date: Thu, 09 Jan 2025 02:11:09 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
x-frame-options: deny

POST
H2 200 ismg-user-ip Show response
worker.ismgcorp.com/ 12 B
305 B 337ms
78ms XHR
text/html 104.130.251.6
RMH-14

General

Check archive.org

Show headers Download Go to

Full URL

https://worker.ismgcorp.com/ismg-user-ip

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/javascripts-responsive/vendor/jquery.min.js?s=1736388669.4283

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.130.251.6 , United States, ASN33070 (RMH-14, US),

Reverse DNS

Software

Resource Hash

d7299f53c4e3975280f5d8e9245bb5404f203f29b5313288e32f50e1f2a05ceb

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Accept: */*
Referer: https://www.bankinfosecurity.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: upgrade-insecure-requests
cache-control: no-cache, private
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
access-control-allow-origin: *
content-length: 12
date: Thu, 09 Jan 2025 02:11:10 GMT
x-xss-protection: 1; mode=block
content-type: text/html; charset=UTF-8

GET
H2 200 gpt.js Show response
www.googletagservices.com/tag/js/ 106 KB
33 KB 229ms
77ms Script
text/javascript 2607:f8b0:4004:c1f::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1f::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

00607e74a1323e12d3cbbd248cceba1fc202fadfaff07f486c5e6b9e209d4992

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

content-encoding: br
etag: 495 / 20097 / 31089501 / config-hash: 2786262764300291707
x-content-type-options: nosniff
expires: Thu, 09 Jan 2025 02:11:11 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 09 Jan 2025 02:11:11 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 33775
x-xss-protection: 0
server: cafe

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/ 1 KB
1 KB 262ms
65ms Script
application/x-javascript 23.9.166.209
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/munchkin.js
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/javascripts-responsive/vendor/jquery.min.js?s=1736388669.4283
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.9.166.209 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-9-166-209.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 081ad4206bfeb1950c8382b5bc32aac31c4698598563d87080ee67a8fc5318d0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Content-Encoding: gzip
ETag: "0c131de2a0d8f1ba69eab7f6866c84dd:1736217492.752819"
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 729
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Date: Thu, 09 Jan 2025 02:11:12 GMT
Content-Type: application/x-javascript
Last-Modified: Tue, 07 Jan 2025 02:38:12 GMT
Server: AkamaiNetStorage
Vary: Accept-Encoding

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 243 KB
81 KB 211ms
88ms Script
application/javascript 2607:f8b0:4004:c1d::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-T6KM3T

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1d::61 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

c7e8a65fea836b76d6173012252cd6ec988f474f42ec97ef8323946371100a9e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1080:0"}],}
expires: Thu, 09 Jan 2025 02:11:12 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 09 Jan 2025 02:11:12 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 09 Jan 2025 00:19:22 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1080:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 82642
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 195 KB
71 KB 194ms
72ms Script
application/javascript 2607:f8b0:4004:c1d::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-T8C2JFW

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1d::61 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

34dafcef59776ba3b559c86c0996b3a11866b5121e7706fffccd1aff8ef8556d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1080:0"}],}
expires: Thu, 09 Jan 2025 02:11:12 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 09 Jan 2025 02:11:12 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 09 Jan 2025 00:19:22 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1080:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 71718
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v40/ 47 KB
47 KB 115ms
55ms Font
font/woff2 142.251.179.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300italic,400italic,600italic,700italic,800italic,400,300,600,700,800

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.179.94 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

pd-in-f94.1e100.net

Software

sffe /

Resource Hash

3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.bankinfosecurity.com
Referer: https://fonts.googleapis.com/

Response headers

age: 189446
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Tue, 06 Jan 2026 21:33:44 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 06 Jan 2025 21:33:44 GMT
last-modified: Thu, 14 Dec 2023 02:08:40 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 48236
x-xss-protection: 0
server: sffe

GET
H2 200 fontawesome-webfont.woff
www.bankinfosecurity.com/css-responsive/fonts/ 43 KB
44 KB 67ms
65ms Font
font/woff 50.56.167.254
RMH-14

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bankinfosecurity.com/css-responsive/fonts/fontawesome-webfont.woff?v=4.2.0

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/css-responsive/vendor/font-awesome.min.css?s=1736388669.4283

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

50.56.167.254 , United States, ASN33070 (RMH-14, US),

Reverse DNS

Software

Resource Hash

0fd28fece9ebd606b8b071460ebd3fc2ed7bc7a66ef91c8834f11dfacab4a849

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.bankinfosecurity.com
Referer: https://www.bankinfosecurity.com/css-responsive/vendor/font-awesome.min.css?s=1736388669.4283

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: frame-ancestors 'none'
content-encoding: gzip
etag: "d6w0wff7ja0uya8-gzip"
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
date: Thu, 09 Jan 2025 02:11:10 GMT
content-type: font/woff
last-modified: Tue, 07 Jan 2025 17:39:20 GMT
vary: Accept-Encoding
x-frame-options: deny

GET
H3 200 memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2
fonts.gstatic.com/s/opensans/v40/ 49 KB
49 KB 135ms
77ms Font
font/woff2 142.251.179.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300italic,400italic,600italic,700italic,800italic,400,300,600,700,800

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.179.94 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

pd-in-f94.1e100.net

Software

sffe /

Resource Hash

0d8601a776b7dc777cd23bc42392d05a43df0d6402328e8913b58811083b513d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.bankinfosecurity.com
Referer: https://fonts.googleapis.com/

Response headers

age: 435833
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Sun, 04 Jan 2026 01:07:17 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 04 Jan 2025 01:07:17 GMT
last-modified: Thu, 14 Dec 2023 02:10:01 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 50296
x-xss-protection: 0
server: sffe

GET
H/1.1 200
OK embed.js Show response
bankinfosecurity.disqus.com/ 80 KB
26 KB 329ms
143ms Script
application/javascript 199.232.192.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://bankinfosecurity.disqus.com/embed.js

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

199.232.192.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

openresty /

Resource Hash

debf2783b523e3fd55ee708f4a351259be048377011b44a756caa91c73d0dccd

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Strict-Transport-Security: max-age=300; includeSubdomains
Link: <https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
Cache-Control: private, max-age=60
x-service: router
content-encoding: gzip
Age: 0
Connection: keep-alive
Cross-Origin-Resource-Policy: cross-origin
Content-Length: 26467
Date: Thu, 09 Jan 2025 02:11:12 GMT
content-type: application/javascript; charset=utf-8
Vary: Accept-Encoding
server: openresty

GET
H2 200 tag.aspx Show response
ml314.com/ 38 KB
13 KB 146ms
33ms Script
application/javascript 34.117.77.79
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ml314.com/tag.aspx?802025
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.117.77.79 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 79.77.117.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: d0e12af8c4e560fe89643639e0c3ed4dc76125c62adeb2879b761d73dbaecf50

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

x-goog-metageneration: 1
x-goog-hash: crc32c=6sDw2Q==, md5=YyYW/xWCXwMKqzORpY7wQg==
content-encoding: br
age: 334
x-goog-stored-content-encoding: identity
x-cache-hit: hit
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 39162
date: Thu, 09 Jan 2025 02:05:38 GMT
last-modified: Wed, 24 Jul 2024 19:30:50 GMT
content-type: application/javascript
vary: Accept-Encoding
x-guploader-uploadid: AFiumC7xB2XGyxjYWAeGOSUnDuCnocdKHOJhV9w973vJOLE0OMNk_l6rGx1tSHKtE3av0PzU
cache-control: public,max-age=3600
x-goog-storage-class: STANDARD
via: 1.1 google
cache-id: MIA-ebd516a
accept-ranges: bytes
x-goog-generation: 1721849450340665
content-length: 12522
server: UploadServer

GET
H2 200 insight.min.js Show response
sjs.bizographics.com/ 47 KB
17 KB 287ms
62ms Script
application/javascript 2600:1408:c400:24::17da:d819
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL

https://sjs.bizographics.com/insight.min.js

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:1408:c400:24::17da:d819 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

Software

Resource Hash

899d1ec3c095342571d3be2091ec6f984d4cc82390d1f61945c391fa035b00d9

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

cache-control: max-age=84921
content-encoding: gzip
x-cdn: AKAM
x-content-type-options: nosniff
accept-ranges: bytes
content-length: 16683
date: Thu, 09 Jan 2025 02:11:12 GMT
last-modified: Mon, 06 May 2024 17:20:18 GMT
content-type: application/javascript;charset=utf-8
vary: Accept-Encoding
x-amz-server-side-encryption: AES256

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 25 KB
9 KB 225ms
59ms Script
application/javascript 2600:1408:c400:24::17da:d815
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:1408:c400:24::17da:d815 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

Software

Resource Hash

c8879b289784c2f0e524c601ee26bd458ab9d35a527c22ce582904004e47d018

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

cache-control: max-age=74382
content-encoding: gzip
x-cdn: AKAM
x-content-type-options: nosniff
accept-ranges: bytes
content-length: 9404
date: Thu, 09 Jan 2025 02:11:12 GMT
last-modified: Mon, 06 Jan 2025 08:25:15 GMT
content-type: application/javascript;charset=utf-8
vary: Accept-Encoding
x-amz-server-side-encryption: AES256

GET
H2 200 6si.min.js Show response
j.6sc.co/ 69 KB
19 KB 254ms
55ms Script
application/javascript 23.205.106.73
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL

https://j.6sc.co/6si.min.js

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.205.106.73 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-205-106-73.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

420b8db005b9223c5e1d9ba4140abc2356eac8069735ad8c870fcc8313828de4

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

cache-control: private, proxy-revalidate, max-age=10800
content-encoding: gzip
etag: "6763d3a0-115be"
x-content-type-options: nosniff
expires: Thu, 09 Jan 2025 05:11:12 GMT
accept-ranges: bytes
content-length: 19249
date: Thu, 09 Jan 2025 02:11:12 GMT
content-type: application/javascript
vary: Accept-Encoding
server: nginx/1.14.0 (Ubuntu)
last-modified: Thu, 19 Dec 2024 08:04:48 GMT

GET
H/1.1 200
OK 2682.js Show response
dnn506yrbagrg.cloudfront.net/pages/scripts/0021/ 309 B
820 B 241ms
60ms Script
application/x-javascript 18.160.45.62
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dnn506yrbagrg.cloudfront.net/pages/scripts/0021/2682.js?482330
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.160.45.62 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-160-45-62.iad55.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 6caf904d3dfc096ae3b4e40aed43181686bdf1bac4722b3dd2a775ab6d2a9992

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Cache-Control: max-age=31536000
ETag: "53b0291ca3900aca920ad48e9790c1b7"
Age: 338932
Connection: keep-alive
Via: 1.1 6d06c1cebf839017775983f86078f53a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
X-Cache: Hit from cloudfront
Content-Length: 309
X-Amz-Cf-Id: VYpDuUVhsZjYR-R3OGhuzOQHwzCE_8Ut0S2pAsbFfzoY8P9XinN_zQ==
Date: Sun, 05 Jan 2025 04:02:21 GMT
Content-Type: application/x-javascript
Last-Modified: Tue, 03 Mar 2020 19:14:28 GMT
Server: AmazonS3
X-Amz-Cf-Pop: IAD55-P2

GET
H2 200 64270ee65d783b00125f1b83.js Show response
buttons-config.sharethis.com/js/ 521 B
967 B 246ms
61ms Script
text/javascript 2600:9000:250b:ce00:c:abe:f440:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://buttons-config.sharethis.com/js/64270ee65d783b00125f1b83.js

Requested by

Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:250b:ce00:c:abe:f440:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

5983be7036fc26270495fd1a318795ac3538b9e8e8a34dff25685a3e4fbe3858

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

etag: "b1b92dd067a349c8db8fab212b24e99e"
age: 40
x-cache: Hit from cloudfront
x-amz-cf-id: 4zyt0piAslYVFSwvRSxggGShLWaWqXNH_cQLyip07EGmPAvKieDu1A==
date: Thu, 09 Jan 2025 02:10:33 GMT
content-type: text/javascript
vary: accept-encoding
last-modified: Fri, 31 Mar 2023 17:48:50 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=60
via: 1.1 a7a07e0b0db92670f70b5d65da05ed76.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 521
x-amz-cf-pop: IAD12-P4
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H/1.1

200
OK

sc Show response
l.sharethis.com/
Redirect Chain

https://l.sharethis.com/pview?event=pview&hostname=www.bankinfosecurity.com&location=%2Fblogs%2Fabandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790&product=inline-share-buttons&url=htt...
https://l.sharethis.com/sc?event=pview&hostname=www.bankinfosecurity.com&location=%2Fblogs%2Fabandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790&product=inline-share-buttons&url=https%...

176 B
706 B

72ms
72ms

XHR
text/plain

3.13.151.97
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://l.sharethis.com/sc?event=pview&hostname=www.bankinfosecurity.com&location=%2Fblogs%2Fabandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790&product=inline-share-buttons&url=https%3A%2F%2Fwww.bankinfosecurity.com%2Fblogs%2Fabandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790&source=platform&fcmp=false&fcmpv2=false&has_segmentio=false&title=Abandoned%20Backdoors%3A%20How%20Malicious%20Infrastructure%20Lives%20On&cms=unknown&publisher=64270ee65d783b00125f1b83&sop=true&version=st_sop.js&lang=en&description=How%20many%20servers%20are%20infected%20by%20web%20shells%20designed%20to%20give%20attackers%20remote%20access%20to%20systems%2C%20but%20now%20%22phone%20home%22%20to%20malicious%20infrastructure%20that%27s%20now%20abandoned%20or%20expired%3F%20Security%20researchers%20who%20posed%20that%20question%20have%20counted%204%2C000%20such%20systems%2C%20including%20in%20government%20and%20education.&ua=&ua_mobile=false&ua_full_version_list=&uuid=293e0318-480a-4955-bdf9-a6bdd135f0a4&samesite=None

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Protocol

HTTP/1.1

Server

3.13.151.97 Columbus, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-13-151-97.us-east-2.compute.amazonaws.com

Software

Resource Hash

8f5384cbf460f5da0c25faeecfa5e8be312f5bd1b4e2c8f80c81f30d1066bebf

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Strict-Transport-Security: max-age=63072000; includeSubDomains;
X-Robots-Tag: noindex, nofollow
Access-Control-Max-Age: 1728000
Access-Control-Expose-Headers: stid
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Access-Control-Allow-Credentials: true
Stid: ZHuAA2d/MD4AAAAICGnUAw==
Access-Control-Allow-Origin: https://www.bankinfosecurity.com
Content-Length: 176
Date: Thu, 09 Jan 2025 02:11:10 GMT
Content-Type: text/plain; charset=utf-8
Access-Control-Allow-Headers: *

Redirect headers

Strict-Transport-Security: max-age=63072000; includeSubDomains;
X-Robots-Tag: noindex, nofollow
Access-Control-Max-Age: 1728000
Access-Control-Expose-Headers: stid
Cache-Control: no-cache, no-store, must-revalidate
Location: /sc?event=pview&hostname=www.bankinfosecurity.com&location=%2Fblogs%2Fabandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790&product=inline-share-buttons&url=https%3A%2F%2Fwww.bankinfosecurity.com%2Fblogs%2Fabandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790&source=platform&fcmp=false&fcmpv2=false&has_segmentio=false&title=Abandoned%20Backdoors%3A%20How%20Malicious%20Infrastructure%20Lives%20On&cms=unknown&publisher=64270ee65d783b00125f1b83&sop=true&version=st_sop.js&lang=en&description=How%20many%20servers%20are%20infected%20by%20web%20shells%20designed%20to%20give%20attackers%20remote%20access%20to%20systems%2C%20but%20now%20%22phone%20home%22%20to%20malicious%20infrastructure%20that%27s%20now%20abandoned%20or%20expired%3F%20Security%20researchers%20who%20posed%20that%20question%20have%20counted%204%2C000%20such%20systems%2C%20including%20in%20government%20and%20education.&ua=&ua_mobile=false&ua_full_version_list=&uuid=293e0318-480a-4955-bdf9-a6bdd135f0a4&samesite=None
Connection: keep-alive
Access-Control-Allow-Credentials: true
Stid: ZHuAA2d/MD4AAAAICGnUAw==
Access-Control-Allow-Origin: https://www.bankinfosecurity.com
Content-Length: 1123
Date: Thu, 09 Jan 2025 02:11:10 GMT
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Headers: *

POST
H2 200 ajax.php Show response
www.bankinfosecurity.com/ 5 B
61 B 106ms
105ms XHR
text/html 50.56.167.254
RMH-14

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bankinfosecurity.com/ajax.php?json=notificationCookies&action=getNotifications

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/javascripts-responsive/vendor/jquery.min.js?s=1736388669.4283

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

50.56.167.254 , United States, ASN33070 (RMH-14, US),

Reverse DNS

Software

Resource Hash

fcbcf165908dd18a9e49f7ff27810176db8e9f63b4352213741664245224f8aa

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Accept: */*

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: frame-ancestors 'none'
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
expires: Thu, 19 Nov 1981 08:52:00 GMT
content-length: 25
x-xss-protection: 1; mode=block
date: Thu, 09 Jan 2025 02:11:10 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-frame-options: deny

GET
H/1.1 200
OK t.dhj Show response
t.sharethis.com/1/k/ 2 KB
2 KB 386ms
60ms Script
text/javascript 23.205.106.74
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL

https://t.sharethis.com/1/k/t.dhj?cid=c010&cls=B&dmn=www.bankinfosecurity.com&rnd=1736388670660

Requested by

Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.205.106.74 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-205-106-74.deploy.static.akamaitechnologies.com

Software

Resource Hash

52a3375d3e617f1dbf29bab11c5942193fba6263802c4b2cec96a0a26970e4a9

Security Headers

Name	Value
Strict-Transport-Security	max-age=2628000 ; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Strict-Transport-Security: max-age=2628000 ; includeSubDomains
X-Robots-Tag: noindex, nofollow
Cache-Control: private, max-age=3600
Content-Encoding: gzip
Connection: keep-alive
X-Content-Type-Options: nosniff
Expires: Thu, 09 Jan 2025 03:11:12 GMT
Content-Length: 1385
Date: Thu, 09 Jan 2025 02:11:12 GMT
Content-Type: text/javascript

GET
H2 200 panorama.js Show response
platform-api.sharethis.com/ 39 KB
12 KB 66ms
65ms Script
application/javascript 18.165.83.61
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://platform-api.sharethis.com/panorama.js

Requested by

Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.165.83.61 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-165-83-61.iad55.r.cloudfront.net

Software

Resource Hash

a782015ceceb595c8305a944456587c4f2c4b3f0ca82aac8e5c6d7b33138f392

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=3600
content-encoding: gzip
etag: W/"9a71-1934f7555b0"
age: 1584
via: 1.1 3c84f89bba43de446e67a27b8df8b660.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
x-amz-cf-id: PsU4wH0N-aKiW4Hqr5cM600BY6QripWDUSQUAM8wuyEYiN-tgb8-MA==
date: Thu, 09 Jan 2025 01:44:51 GMT
content-type: application/javascript; charset=UTF-8
last-modified: Thu, 21 Nov 2024 16:01:50 GMT
vary: Accept-Encoding
x-amz-cf-pop: IAD55-P3
x-frame-options: SAMEORIGIN

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 156 B
596 B 226ms
71ms XHR
application/json 34.228.175.96
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/panorama.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.228.175.96 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-228-175-96.compute-1.amazonaws.com
Software: /
Resource Hash: af4445e937d150f1780fa6d1b3d7bd433b5c6d0489dc5d09a5777c20ba5950a7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://www.bankinfosecurity.com/

Response headers

cache-control: no-cache
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://www.bankinfosecurity.com
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 156
date: Thu, 09 Jan 2025 02:11:10 GMT
content-type: application/json;charset=utf-8
x-server: 10.40.51.205

GET
H2 200 utsync.ashx Show response
ml314.com/ 641 B
1 KB 67ms
66ms Script
application/javascript 34.117.77.79
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ml314.com/utsync.ashx?pub=&adv=&et=0&eid=57819&ct=js&pi=&fp=&clid=&if=0&ps=&cl=&mlt=&data=&&cp=https%3A%2F%2Fwww.bankinfosecurity.com%2Fblogs%2Fabandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790&pv=1736388672043_3rl3hhiny&bl=en-us&cb=116385&return=&ht=&d=&dc=&si=1736388672043_3rl3hhiny&cid=&s=1600x1200&rp=&v=2.7.4.212
Requested by: Host: ml314.com
URL: https://ml314.com/tag.aspx?802025
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.117.77.79 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 79.77.117.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 0332f2d43c66bd180b78010f21d4e7ea26a972885b3e9e475a9d46374345dcf7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 google
expires: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
date: Thu, 09 Jan 2025 02:11:12 GMT
content-type: application/javascript
server: Google Frontend

GET
H/1.1 200
OK ud.ashx Show response
in.ml314.com/ 20 B
482 B 334ms
121ms Script
application/javascript 35.175.32.137
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://in.ml314.com/ud.ashx?topiclimit=&cb=802025&v=2.7.4.212
Requested by: Host: ml314.com
URL: https://ml314.com/tag.aspx?802025
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.175.32.137 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-175-32-137.compute-1.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: d0e4a6372d6fb5ffe9505dbe9e94aee8f1b9b96ec8e5e20684cce8b4c5a88fa7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Cache-Control: public
X-AspNet-Version: 4.0.30319
Content-Encoding: gzip
Connection: keep-alive
Expires: Fri, 10 Jan 2025 02:11:12 GMT
Content-Length: 138
Date: Thu, 09 Jan 2025 02:11:11 GMT
Content-Type: application/javascript; charset=utf-8
Vary: Accept-Encoding
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202501030202/ 494 KB
154 KB 163ms
56ms Script
text/javascript 142.251.179.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202501030202/pubads_impl.js?cb=31089501

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.179.157 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

pd-in-f157.1e100.net

Software

cafe /

Resource Hash

e430ac99d48aa7aa291fe9ef82398d2e7f599643dd1732d026947ba15edf718f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

content-encoding: br
etag: 4755344281006871465
age: 38360
x-content-type-options: nosniff
expires: Thu, 08 Jan 2026 15:31:52 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Wed, 08 Jan 2025 15:31:52 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 157521
x-xss-protection: 0
server: cafe

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 72 B
71 B 210ms
67ms XHR
application/json 142.251.179.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=www.bankinfosecurity.com

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.179.157 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

pd-in-f157.1e100.net

Software

cafe /

Resource Hash

719087413e175004c74e34af6ef370b257e42f589df16014f8cee92c91aa30c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
content-encoding: br
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Thu, 09 Jan 2025 02:11:12 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 47
date: Thu, 09 Jan 2025 02:11:12 GMT
x-xss-protection: 0
content-type: application/json; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/164/ 11 KB
5 KB 64ms
63ms Script
application/x-javascript 23.9.166.209
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/164/munchkin.js
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.9.166.209 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-9-166-209.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: dea9df0145848ffeb3c6931228d41e833341b4837c0e713d321c5bfcf6dcd4e6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Cache-Control: max-age=8640000
Content-Encoding: gzip
ETag: "756f9116836f579d12be8fe786b69d98:1726632111.60799"
Connection: keep-alive
Expires: Sat, 19 Apr 2025 02:11:12 GMT
Accept-Ranges: bytes
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Content-Length: 4843
Date: Thu, 09 Jan 2025 02:11:12 GMT
Content-Type: application/x-javascript
Last-Modified: Wed, 18 Sep 2024 04:01:51 GMT
Server: AkamaiNetStorage
Vary: Accept-Encoding

GET
H2

200

demconf.jpg
dpm.demdex.net/
Redirect Chain

https://dpm.demdex.net/ibs:dpid=22052&dpuuid=3649708125471637511&redir=
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=22052&dpuuid=3649708125471637511&redir=

42 B
716 B

60ms
59ms

Image
image/gif

18.233.177.54
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=22052&dpuuid=3649708125471637511&redir=

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Protocol

Server

18.233.177.54 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-18-233-177-54.compute-1.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs: dcs-prod-va6-2-v068-094e22e41.edge-va6.demdex.com 2 ms
content-encoding: gzip
pragma: no-cache
x-content-type-options: nosniff
x-tid: nFBSUajcSys=
expires: Thu, 01 Jan 1970 00:00:00 UTC
content-length: 59
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Thu, 09 Jan 2025 02:11:12 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
location: https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=22052&dpuuid=3649708125471637511&redir=
dcs: dcs-prod-va6-1-v068-01276fdff.edge-va6.demdex.com 0 ms
pragma: no-cache
x-tid: iCx8DG5RRaw=
expires: Thu, 01 Jan 1970 00:00:00 UTC
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Thu, 09 Jan 2025 02:11:12 GMT

GET
H3

200

csync.ashx
ml314.com/
Redirect Chain

https://idsync.rlcdn.com/395886.gif?partner_uid=3649708125471637511
https://idsync.rlcdn.com/1000.gif?memo=CO6UGBIeChoIARCuXxoTMzY0OTcwODEyNTQ3MTYzNzUxMRAAGg0IwOD8uwYSBQjoBxAAQgBKAA
https://ml314.com/csync.ashx?fp=c9c6ba0953b085de732143d0d396f8e2a6b7d81036831e83c2938201f6507db0f4cb09cee1a4f8eb&person_id=3649708125471637511&eid=50082

43 B
56 B

73ms
72ms

Image
image/gif

34.117.77.79
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ml314.com/csync.ashx?fp=c9c6ba0953b085de732143d0d396f8e2a6b7d81036831e83c2938201f6507db0f4cb09cee1a4f8eb&person_id=3649708125471637511&eid=50082
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: H3
Server: 34.117.77.79 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 79.77.117.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

via: 1.1 google
expires: Fri, 10 Jan 2025 02:11:12 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 09 Jan 2025 02:11:12 GMT
content-type: image/gif
server: Google Frontend

Redirect headers

cache-control: no-cache, no-store
timing-allow-origin: *
location: https://ml314.com/csync.ashx?fp=c9c6ba0953b085de732143d0d396f8e2a6b7d81036831e83c2938201f6507db0f4cb09cee1a4f8eb&person_id=3649708125471637511&eid=50082
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 0
date: Thu, 09 Jan 2025 02:11:12 GMT

GET
H3

200

utsync.ashx
ml314.com/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=d0tro1j&ttd_tpi=1
https://match.adsrvr.org/track/cmb/generic?ttd_pid=d0tro1j&ttd_tpi=1
https://ml314.com/utsync.ashx?eid=53819&et=0&fp=e919bb23-4ac0-4883-b0fa-f765eeb0f13c&gdpr=0&gdpr_consent=

43 B
61 B

61ms
60ms

Image
image/gif

34.117.77.79
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ml314.com/utsync.ashx?eid=53819&et=0&fp=e919bb23-4ac0-4883-b0fa-f765eeb0f13c&gdpr=0&gdpr_consent=
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: H3
Server: 34.117.77.79 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 79.77.117.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 google
expires: 0,Fri, 10 Jan 2025 02:11:12 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
date: Thu, 09 Jan 2025 02:11:12 GMT
content-type: image/gif
server: Google Frontend

Redirect headers

location: https://ml314.com/utsync.ashx?eid=53819&et=0&fp=e919bb23-4ac0-4883-b0fa-f765eeb0f13c&gdpr=0&gdpr_consent=
content-length: 241
date: Thu, 09 Jan 2025 02:11:12 GMT
server: Kestrel

GET
H3

200

csync.ashx
ml314.com/
Redirect Chain

https://ib.adnxs.com/getuid?https://ml314.com/csync.ashx%3Ffp=$UID%26person_id=3649708125471637511%26eid=2
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fml314.com%2Fcsync.ashx%253Ffp%3D%24UID%2526person_id%3D3649708125471637511%2526eid%3D2
https://ml314.com/csync.ashx?fp=3258195736511359540&person_id=3649708125471637511&eid=2

43 B
56 B

68ms
67ms

Image
image/gif

34.117.77.79
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ml314.com/csync.ashx?fp=3258195736511359540&person_id=3649708125471637511&eid=2
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: H3
Server: 34.117.77.79 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 79.77.117.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

via: 1.1 google
expires: Fri, 10 Jan 2025 02:11:12 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 09 Jan 2025 02:11:12 GMT
content-type: image/gif
server: Google Frontend

Redirect headers

cache-control: no-store, no-cache, private
location: https://ml314.com/csync.ashx?fp=3258195736511359540&person_id=3649708125471637511&eid=2
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 38.132.118.73; 38.132.118.73; 1042.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 12cfd9e8-13e4-481d-97e1-267e5448f5d0
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 09 Jan 2025 02:11:12 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H/1.1

204
No Content

match
ps.eyeota.net/
Redirect Chain

https://ps.eyeota.net/pixel?pid=r8hrb20&t=gif
https://ps.eyeota.net/pixel/bounce/?pid=r8hrb20&t=gif
https://ml314.com/utsync.ashx?eid=50052&et=0&fp=2VwxugCA_itoTCsDWrGP9miV-FT5W8Nw30Zxv6DMM7vk&gdpr=0&gdpr_consent=&return=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fbid%3Dr8hrb20%26uid%3Dnil%26referrer_p...
https://ml314.com/csync.ashx?fp=2VwxugCA_itoTCsDWrGP9miV-FT5W8Nw30Zxv6DMM7vk&person_id=3649708125471637511&eid=50052&return=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fbid%3Dr8hrb20%26uid%3Dnil%26referre...
https://ps.eyeota.net/match?bid=r8hrb20&uid=nil&referrer_pid=r8hrb20

0
83 B

56ms
56ms

Image
text/plain

44.196.77.126
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ps.eyeota.net/match?bid=r8hrb20&uid=nil&referrer_pid=r8hrb20
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: HTTP/1.1
Server: 44.196.77.126 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-196-77-126.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Date: Thu, 09 Jan 2025 02:11:13 GMT
Content-Length: 0

Redirect headers

location: https://ps.eyeota.net/match?bid=r8hrb20&uid=nil&referrer_pid=r8hrb20
via: 1.1 google
expires: Fri, 10 Jan 2025 02:11:13 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
date: Thu, 09 Jan 2025 02:11:13 GMT
content-type: image/gif
x-cloud-trace-context: 805f448d2136a294167c3b82faf7dca0
server: Google Frontend

GET
H3 200 gpt
securepubads.g.doubleclick.net/pagead/managed/dict/m202501070101/ 63 KB
23 KB 55ms
54ms Other
text/plain 142.251.179.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/dict/m202501070101/gpt

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.179.157 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

pd-in-f157.1e100.net

Software

cafe /

Resource Hash

e228891b15bd5240c2da3a0d8e01c9795f13239c94de6ee383f7f8f908dbc417

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 10918878473317485729
age: 36616
x-content-type-options: nosniff
expires: Thu, 09 Jan 2025 16:00:56 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Wed, 08 Jan 2025 16:00:56 GMT
content-type: text/plain; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=86400, stale-while-revalidate=7200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 23207
x-xss-protection: 0
server: cafe
use-as-dictionary: match="/gampad/ads", id="m202501070101"

GET
H2 200 insight.old.min.js Show response
snap.licdn.com/li.lms-analytics/ 40 KB
14 KB 59ms
59ms Script
application/javascript 2600:1408:c400:24::17da:d815
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.old.min.js

Requested by

Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:1408:c400:24::17da:d815 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

Software

Resource Hash

e6b8a90a2870483ace67380ff4a64b39bfecb7952a432393470d76a6614fc62c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

cache-control: max-age=36570
content-encoding: gzip
x-cdn: AKAM
x-content-type-options: nosniff
accept-ranges: bytes
content-length: 14634
date: Thu, 09 Jan 2025 02:11:12 GMT
last-modified: Mon, 02 Dec 2024 19:22:52 GMT
content-type: application/javascript;charset=utf-8
vary: Accept-Encoding
x-amz-server-side-encryption: AES256

GET
H2 200 attribution_trigger Show response
px.ads.linkedin.com/ 2 B
759 B 351ms
133ms XHR
application/json 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/attribution_trigger?pid=749%2C2330930&time=1736388672263&url=https%3A%2F%2Fwww.bankinfosecurity.com%2Fblogs%2Fabandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Requested by: Host: sjs.bizographics.com
URL: https://sjs.bizographics.com/insight.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Accept: *
Referer: https://www.bankinfosecurity.com/

Response headers

x-li-pop: afd-prod-lor1-x
content-encoding: gzip
x-fs-uuid: 00062b3c7e04d77b4a97b70b928106b3
x-msedge-ref: Ref A: C7DA8A16810C4D7EB3B34C87A9E11FB7 Ref B: MIAEDGE1920 Ref C: 2025-01-09T02:11:12Z
x-li-fabric: prod-lor1
x-restli-protocol-version: 1.0.0
access-control-allow-methods: GET, OPTIONS
x-li-uuid: AAYrPH4E13tKl7cLkoEGsw==
x-li-proto: http/2
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
date: Thu, 09 Jan 2025 02:11:12 GMT
content-type: application/json
access-control-allow-headers: *

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=749%2C2330930&time=1736388672263&url=https%3A%2F%2Fwww.bankinfosecurity.com%2Fblogs%2Fabandoned-backdoors-how-malicious-infrastructure-lives-on-p-...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=749%2C2330930&time=1736388672263&url=https%3A%2F%2Fwww.bankinfosecurity.com%2Fblogs%2Fabandoned-backdoors-how-malicious-infrastructure-lives-on-p-...
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D749%252C2330930%26time%3D1736388672263%26url%3Dhttps%253A%252F%252Fwww.bankinfose...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=749%2C2330930&time=1736388672263&url=https%3A%2F%2Fwww.bankinfosecurity.com%2Fblogs%2Fabandoned-backdoors-how-malicious-infrastructure-lives-on-p-...
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=749%2C2330930&time=1736388672263&url=https%3A%2F%2Fwww.bankinfosecurity.com%2Fblogs%2Fabandoned-backdoors-how-malicious-infrastructure-lives-on-p...

0
701 B

239ms
68ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=749%2C2330930&time=1736388672263&url=https%3A%2F%2Fwww.bankinfosecurity.com%2Fblogs%2Fabandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790&cookiesTest=true&liSync=true&e_ipv6=AQLcGNd21geRMwAAAZRI1H4QOQbonXCs3s0Jtj_P2MjvNIa-yvQtseuF7EbZKWGTGZjmmMQ
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lva1-x
nel: {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
x-msedge-ref: Ref A: E7DE788059284DBE93748A406E8C5832 Ref B: MIAEDGE1619 Ref C: 2025-01-09T02:11:13Z
x-li-fabric: prod-lva1
report-to: {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
x-li-uuid: AAYrPH4QGG82Prub2MQ/mA==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Thu, 09 Jan 2025 02:11:13 GMT
content-type: application/javascript

Redirect headers

linkedin-action: 1
x-li-pop: afd-prod-lva1-x
nel: {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=749%2C2330930&time=1736388672263&url=https%3A%2F%2Fwww.bankinfosecurity.com%2Fblogs%2Fabandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790&cookiesTest=true&liSync=true&e_ipv6=AQLcGNd21geRMwAAAZRI1H4QOQbonXCs3s0Jtj_P2MjvNIa-yvQtseuF7EbZKWGTGZjmmMQ
x-msedge-ref: Ref A: 9E9EAF8C7A0045B193CA4E9FB58FC549 Ref B: MIAEDGE2509 Ref C: 2025-01-09T02:11:13Z
x-li-fabric: prod-lva1
report-to: {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
x-li-uuid: AAYrPH4MVuBJz0hl4LPcfQ==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Thu, 09 Jan 2025 02:11:12 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 300 KB
103 KB 73ms
72ms Script
application/javascript 2607:f8b0:4004:c1d::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-XJ8Q4QGGRH&l=dataLayer&cx=c&gtm=45He5170v6625173za200

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T6KM3T

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1d::61 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

3b8b9025df7dbdf3b20fd4931d763b190ad46a80de9e14ae5ab1db491a6bde59

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 09 Jan 2025 02:11:12 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 09 Jan 2025 02:11:12 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 105317
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 279 KB
98 KB 84ms
84ms Script
application/javascript 2607:f8b0:4004:c1d::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-2RK1HGW2E4&l=dataLayer&cx=c&gtm=45He5170v6625173za200

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T6KM3T

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1d::61 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

113748801759e566d21145852c42316606436b6b916e629061e14266471272be

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 09 Jan 2025 02:11:12 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 09 Jan 2025 02:11:12 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 99899
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 i5wta0dq65 Show response
www.clarity.ms/tag/ 689 B
1 KB 289ms
67ms Script
application/x-javascript 2620:1ec:bdf::40
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.clarity.ms/tag/i5wta0dq65
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:bdf::40 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: c9a09b4a436150c644d56fabe528bb174ad06085859c5c3d275984e8b515258c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

cache-control: no-cache, no-store
request-context: appId=cid-v1:2f7711a9-b21e-4abe-a9d6-5b0ce5d18b64
expires: -1
accept-ranges: bytes
x-cache: CONFIG_NOCACHE
content-length: 689
date: Thu, 09 Jan 2025 02:11:12 GMT
content-type: application/x-javascript
x-azure-ref: 20250109T021112Z-r1c9cc78978jm8hbhC1MIA6gbs0000000fx00000000110xs

GET
H2 200 Bootstrap.js Show response
nexus.ensighten.com/choozle/19322/ 57 KB
17 KB 310ms
65ms Script
application/javascript 2600:9000:28ac:a600:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/choozle/19322/Bootstrap.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T6KM3T
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:28ac:a600:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: 699e4d441a6c069832f33550b732d90d5263edf82da5c2ddffd9236e3910a994

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

content-encoding: gzip
x-amz-version-id: dWqqGWjDkL_dGHn6QVVMgNdXRFOvROzn
etag: W/"013d85c9008da47ef2f3c05fb56902bf"
age: 3380789
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: 3H-XSVFo3nP-LyLJ6i9jHEgVmQKCZRy5Ryd7YcBE97clwZaqs-_pNA==
date: Sat, 30 Nov 2024 23:04:43 GMT
content-type: application/javascript; charset=utf-8
vary: accept-encoding
last-modified: Wed, 16 Oct 2024 17:22:03 GMT
x-amz-replication-status: COMPLETED
cache-control: max-age=300
via: 1.1 009a5d13a4dd74719c9131c464732ee8.cloudfront.net (CloudFront)
x-amz-cf-pop: IAD12-P5
server: CloudFront
x-amz-server-side-encryption: AES256

POST
H2 204 / Show response
px.ads.linkedin.com/wa/ 0
309 B 265ms
101ms XHR
text/plain 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/wa/
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.old.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Accept: *
Content-Type: text/plain;charset=UTF-8

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 51791B48911849A5B31D2D9E6B4D8E46 Ref B: MIAEDGE2509 Ref C: 2025-01-09T02:11:12Z
x-li-fabric: prod-lva1
access-control-allow-credentials: true
x-li-uuid: AAYrPH4EZvpPcEzSq0us3g==
x-li-proto: http/2
access-control-allow-origin: https://www.bankinfosecurity.com
x-cache: CONFIG_NOCACHE
date: Thu, 09 Jan 2025 02:11:11 GMT
vary: Origin

GET
H3 200 2682.js Show response
script.crazyegg.com/pages/scripts/0021/ 7 KB
3 KB 191ms
63ms Script
text/javascript 104.19.147.8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/scripts/0021/2682.js
Requested by: Host: dnn506yrbagrg.cloudfront.net
URL: https://dnn506yrbagrg.cloudfront.net/pages/scripts/0021/2682.js?482330
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.19.147.8 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b15c967bba9169e509c9efdb0603036e4f2e25745caf138d1e621c487df267d5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

access-control-expose-headers: CE-Version
content-encoding: gzip
cf-cache-status: HIT
age: 690631
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 09 Jan 2025 02:11:12 GMT
content-type: text/javascript
last-modified: Wed, 01 Jan 2025 02:20:24 GMT
vary: Accept-Encoding
priority: u=3,i=?0
cache-control: public, max-age=300, s-maxage=1209600
timing-allow-origin: *
cf-ray: 8ff0e533c82bb3d1-MIA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 2482
ce-version: 11.5.340
server: cloudflare

GET
H2 200 / Show response
c.6sc.co/ 7 B
200 B 175ms
89ms XHR
text/html 23.205.106.73
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.205.106.73 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS: a23-205-106-73.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

access-control-max-age: 86400
access-control-allow-credentials: true
access-control-allow-methods: GET,POST
access-control-allow-origin: https://www.bankinfosecurity.com
content-length: 7
date: Thu, 09 Jan 2025 02:11:12 GMT
content-type: text/html
access-control-allow-headers: *

GET
H2 200 / Show response
ipv6.6sc.co/ 19 B
316 B 264ms
58ms XHR
text/html 2600:1408:c400:d::17cd:6a49
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL: https://ipv6.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1408:c400:d::17cd:6a49 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software: /
Resource Hash: a48d321e1f30c017b6d9407b160c7253ee3dee7e1b28c9f49e57e40c52b4a71e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

cache-control: max-age=0, no-cache, no-store
pragma: no-cache
6si-ipv6: 2001:550:1d05:1::13
expires: Thu, 09 Jan 2025 02:11:12 GMT
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1736388672502_400219719_3604294730_24_1025_56_61_219";dur=1
access-control-allow-origin: https://www.bankinfosecurity.com
content-length: 19
date: Thu, 09 Jan 2025 02:11:12 GMT
content-type: text/html
vary: Origin

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 179ms
94ms Image
image/gif 23.205.106.73
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=8cde4267f2ac828e1ae5d1fbcd5ef992&svisitor=null&visitor=bd87d981-3948-421a-8d77-a1c2f4a808c0&session=f9c357a0-9256-4d47-85b1-205b4158ccc6&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Thu%2C%2009%20Jan%202025%2002%3A11%3A12%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22How%20many%20servers%20are%20infected%20by%20web%20shells%20designed%20to%20give%20attackers%20remote%20access%20to%20systems%2C%20but%20now%20%26quot%3Bphone%20home%26quot%3B%20to%20malicious%20infrastructure%20that%27s%20now%20abandoned%20or%20expired%3F%20Security%20researchers%20who%20posed%20that%20question%20have%20counted%204%2C000%20such%20systems%2C%20including%20in%20government%20and%20education.%22%2C%22keywords%22%3A%22web%20shell%2C%20php%2C%20shell%2C%20cybersecurity%2C%20information%20security%2C%20watchTowr%2C%20c99shell%2C%20r57shell%22%2C%22title%22%3A%22Abandoned%20Backdoors%3A%20How%20Malicious%20Infrastructure%20Lives%20On%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.bankinfosecurity.com%2Fblogs%2Fabandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790&pageViewId=e840a489-c3b8-4bdc-8ee6-8c9ee40109d5&v=1.1.31

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.205.106.73 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-205-106-73.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "5e502810-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Thu, 09 Jan 2025 02:11:12 GMT
accept-ranges: bytes
content-length: 43
date: Thu, 09 Jan 2025 02:11:12 GMT
content-type: image/gif
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 101ms
84ms Image
image/gif 23.205.106.73
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=8cde4267f2ac828e1ae5d1fbcd5ef992&svisitor=null&visitor=bd87d981-3948-421a-8d77-a1c2f4a808c0&session=f9c357a0-9256-4d47-85b1-205b4158ccc6&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2009%20Jan%202025%2002%3A11%3A12%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%228cde4267f2ac828e1ae5d1fbcd5ef992%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2009%20Jan%202025%2002%3A11%3A12%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEndpoint%5C%22%2C%5C%22value%5C%22%3A%5C%22b.6sc.co%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2009%20Jan%202025%2002%3A11%3A12%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2009%20Jan%202025%2002%3A11%3A12%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%228cde4267f2ac828e1ae5d1fbcd5ef992%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2009%20Jan%202025%2002%3A11%3A12%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEndpoint%5C%22%2C%5C%22value%5C%22%3A%5C%22b.6sc.co%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2009%20Jan%202025%2002%3A11%3A12%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%227207ef3e32cb3a527876a3e90b6bf51dbd9d9339%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2009%20Jan%202025%2002%3A11%3A12%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22%5Btrue%2Cnull%2C3%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2009%20Jan%202025%2002%3A11%3A12%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22How%20many%20servers%20are%20infected%20by%20web%20shells%20designed%20to%20give%20attackers%20remote%20access%20to%20systems%2C%20but%20now%20%26quot%3Bphone%20home%26quot%3B%20to%20malicious%20infrastructure%20that%27s%20now%20abandoned%20or%20expired%3F%20Security%20researchers%20who%20posed%20that%20question%20have%20counted%204%2C000%20such%20systems%2C%20including%20in%20government%20and%20education.%22%2C%22keywords%22%3A%22web%20shell%2C%20php%2C%20shell%2C%20cybersecurity%2C%20information%20security%2C%20watchTowr%2C%20c99shell%2C%20r57shell%22%2C%22title%22%3A%22Abandoned%20Backdoors%3A%20How%20Malicious%20Infrastructure%20Lives%20On%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.bankinfosecurity.com%2Fblogs%2Fabandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790&pageViewId=e840a489-c3b8-4bdc-8ee6-8c9ee40109d5&v=1.1.31

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.205.106.73 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-205-106-73.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "60bb2e15-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Thu, 09 Jan 2025 02:11:12 GMT
accept-ranges: bytes
content-length: 43
date: Thu, 09 Jan 2025 02:11:12 GMT
content-type: image/gif
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 / Show response
c.6sc.co/ 7 B
200 B 230ms
56ms XHR
text/html 23.205.106.73
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.205.106.73 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS: a23-205-106-73.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

access-control-max-age: 86400
access-control-allow-credentials: true
access-control-allow-methods: GET,POST
access-control-allow-origin: https://www.bankinfosecurity.com
content-length: 7
date: Thu, 09 Jan 2025 02:11:12 GMT
content-type: text/html
access-control-allow-headers: *

GET
H2 200 / Show response
ipv6.6sc.co/ 19 B
316 B 323ms
61ms XHR
text/html 2600:1408:c400:d::17cd:6a49
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL: https://ipv6.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1408:c400:d::17cd:6a49 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software: /
Resource Hash: a48d321e1f30c017b6d9407b160c7253ee3dee7e1b28c9f49e57e40c52b4a71e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

cache-control: max-age=0, no-cache, no-store
pragma: no-cache
6si-ipv6: 2001:550:1d05:1::13
expires: Thu, 09 Jan 2025 02:11:12 GMT
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1736388672624_400219719_3604294908_22_1230_56_0_219";dur=1
access-control-allow-origin: https://www.bankinfosecurity.com
content-length: 19
date: Thu, 09 Jan 2025 02:11:12 GMT
content-type: text/html
vary: Origin

POST
H/1.1 200
OK visitWebPage
051-zxi-237.mktoresp.com/webevents/ 2 B
318 B 606ms
109ms Ping
text/plain 192.28.147.68
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL: https://051-zxi-237.mktoresp.com/webevents/visitWebPage?_mchNc=1736388672335&_mchCn=&_mchId=051-ZXI-237&_mchTk=_mch-bankinfosecurity.com-fa3f40c0a4cc1debf321231c34da7690&_mchHo=www.bankinfosecurity.com&_mchPo=&_mchRu=%2Fblogs%2Fabandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790&_mchPc=https%3A&_mchVr=164&_mchEcid=&_mchHa=&_mchRe=&_mchQp=
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/164/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.28.147.68 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software: nginx/1.20.1 /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Transfer-Encoding: chunked
X-Request-Id: 43628117-5276-4f61-a907-466165d625bc
Content-Encoding: gzip
Connection: keep-alive
Access-Control-Allow-Origin: *
Date: Thu, 09 Jan 2025 02:11:13 GMT
Content-Type: text/plain; charset=UTF-8
Server: nginx/1.20.1

POST
H/1.1 200
OK visitWebPage
051-zxi-237.mktoresp.com/webevents/ 2 B
318 B 562ms
108ms Ping
text/plain 192.28.147.68
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL: https://051-zxi-237.mktoresp.com/webevents/visitWebPage?_mchNc=1736388672335&_mchRu=%2Fblogs%2Fabandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790&_mchQp=cat%3D416%26cat%3D409%26cat%3D421%26assetID%3D3790%26assetType%3Dblog%26key%3Dweb%20shell%26key%3Dphp%26key%3Dshell%26key%3Dcybersecurity%26key%3Dinformation%20security%26key%3Dwatchtowr%26key%3Dc99shell%26key%3Dr57shell%26key%3D&_mchId=051-ZXI-237&_mchTk=_mch-bankinfosecurity.com-fa3f40c0a4cc1debf321231c34da7690&_mchHo=www.bankinfosecurity.com&_mchPo=&_mchPc=https%3A&_mchVr=164&_mchEcid=&_mchRe=
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/164/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.28.147.68 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software: nginx/1.20.1 /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

Transfer-Encoding: chunked
X-Request-Id: 73872b4c-168d-4a8f-b295-43e0b07a8aae
Content-Encoding: gzip
Connection: keep-alive
Access-Control-Allow-Origin: *
Date: Thu, 09 Jan 2025 02:11:13 GMT
Content-Type: text/plain; charset=UTF-8
Server: nginx/1.20.1

GET
H2 200 facebook.svg
platform-cdn.sharethis.com/img/ 301 B
725 B 328ms
59ms Image
image/svg+xml 2600:9000:26c1:b000:1d:85c3:6640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://platform-cdn.sharethis.com/img/facebook.svg

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:26c1:b000:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

768d97ec0916217ae82c70aeda3a61b9b0dab344edc4a3240a4f7cd94af00307

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=2592000
etag: "c6e9be45643e197ce1db1d7e24a99adc"
age: 1504412
via: 1.1 e21deb2f30f16d84eb8e8fda826091d4.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 301
x-amz-cf-id: -x7Sp6dUKpMhxKs3xrBdxd0JaqImv6zZeZTlyhkVtEYAjj0BA__44w==
date: Sun, 22 Dec 2024 16:17:41 GMT
content-type: image/svg+xml
last-modified: Thu, 10 Oct 2019 01:20:12 GMT
server: AmazonS3
x-amz-cf-pop: IAD61-P1
x-amz-server-side-encryption: AES256

GET
H2 200 twitter.svg
platform-cdn.sharethis.com/img/ 368 B
778 B 329ms
60ms Image
image/svg+xml 2600:9000:26c1:b000:1d:85c3:6640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://platform-cdn.sharethis.com/img/twitter.svg

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:26c1:b000:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

76ffdc5337cd5a509f15d70767b85a793aead82975d0d86912e1607e963c9aed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
vary: accept-encoding
etag: "2deb3d5121d475d195577a70b0a91a0c"
age: 161
via: 1.1 e21deb2f30f16d84eb8e8fda826091d4.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 368
x-amz-cf-id: 1BUs4U_n4LQsDA1SAnzZvtPzgVU4K4QkgXuJiAvVqZsNBWdv1e09MQ==
date: Thu, 09 Jan 2025 02:08:32 GMT
content-type: image/svg+xml
last-modified: Fri, 15 Sep 2023 16:58:49 GMT
server: AmazonS3
x-amz-cf-pop: IAD61-P1
x-amz-server-side-encryption: AES256

GET
H2 200 linkedin.svg
platform-cdn.sharethis.com/img/ 456 B
881 B 328ms
59ms Image
image/svg+xml 2600:9000:26c1:b000:1d:85c3:6640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://platform-cdn.sharethis.com/img/linkedin.svg

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:26c1:b000:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

cb8c2b19fd9b56c41db14bd71b5c0616c1ba4e99b08c8e75084cf695f74b7120

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=2592000
etag: "fa43b4ede18498b114fc7185993f6da7"
age: 92900
via: 1.1 e21deb2f30f16d84eb8e8fda826091d4.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 456
x-amz-cf-id: MkGNf_WwDIL6xdS0oD0q_ChmcvrmjSM7CWAKBdqflBNdyouiqnbZ6w==
date: Wed, 08 Jan 2025 00:22:53 GMT
content-type: image/svg+xml
last-modified: Thu, 10 Oct 2019 01:20:12 GMT
server: AmazonS3
x-amz-cf-pop: IAD61-P1
x-amz-server-side-encryption: AES256

GET
H/1.1 200
OK /
disqus.com/embed/comments/ Frame AE56 0
0 185ms
94ms Document
text/html 151.101.0.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://disqus.com/embed/comments/?base=default&f=bankinfosecurity&t_u=https%3A%2F%2Fwww.bankinfosecurity.com%2Fblogs%2Fabandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790&t_d=Abandoned%20Backdoors%3A%20How%20Malicious%20Infrastructure%20Lives%20On&t_t=Abandoned%20Backdoors%3A%20How%20Malicious%20Infrastructure%20Lives%20On&s_o=default

Requested by

Host: bankinfosecurity.disqus.com
URL: https://bankinfosecurity.disqus.com/embed.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

151.101.0.134 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src https://.twitter.com: https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://.services.disqus.com: https://cdn.boomtrain.com/p13n/ https://com-disqus.netmng.com:* 'unsafe-inline' https://referrer.disqus.com/juggler/ https://connect.facebook.net/en_US/sdk.js https://cdn.syndication.twimg.com/tweets.json https://apis.google.com https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.bankinfosecurity.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

Age: 0
Cache-Control: stale-if-error=3600, s-stalewhilerevalidate=3600, stale-while-revalidate=30, no-cache, must-revalidate, public, s-maxage=5
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 2944
Content-Security-Policy: script-src https://*.twitter.com:* https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://*.services.disqus.com:* https://cdn.boomtrain.com/p13n/ https://com-disqus.netmng.com:* 'unsafe-inline' https://referrer.disqus.com/juggler/ https://connect.facebook.net/en_US/sdk.js https://cdn.syndication.twimg.com/tweets.json https://apis.google.com https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com
Content-Type: text/html; charset=utf-8
Cross-Origin-Resource-Policy: cross-origin
Date: Thu, 09 Jan 2025 02:11:12 GMT
ETag: W/"lounge:view:10426952209.313ccb420ae8a73947c43b45fdab8756.2"
Last-Modified: Wed, 08 Jan 2025 16:39:41 GMT
Link: <https://c.disquscdn.com>;rel=preconnect,<https://c.disquscdn.com>;rel=dns-prefetch
Referrer-Policy: no-referrer-when-downgrade
Server: nginx
Strict-Transport-Security: max-age=300; includeSubdomains
Timing-Allow-Origin: *
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 224ms
79ms Fetch
text/plain 2001:4860:4802:36::178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-XJ8Q4QGGRH&gtm=45je5170v886765778z86625173za200zb6625173&_p=1736388669948&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&cid=387413935.1736388672&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1736388672&sct=1&seg=0&dl=https%3A%2F%2Fwww.bankinfosecurity.com%2Fblogs%2Fabandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790&dt=Abandoned%20Backdoors%3A%20How%20Malicious%20Infrastructure%20Lives%20On&en=page_view&_fv=1&_nsi=1&_ss=1&ep.asset_type=blog3790&ep.asset_categories=416%2C409%2C421&ep.asset_keywords_1=web%20shell%2C%20php%2C%20shell%2C%20cybersecurity%2C%20information%20security%2C%20watchTowr%2C%20c99shell%2C%20r57shell&ep.asset_keywords_2=&ep.asset_keywords_3=&ep.asset_keywords_4=&ep.asset_keywords_5=&ep.asset_keywords_6=&ep.asset_keywords_7=&ep.asset_keywords_8=&ep.asset_keywords_9=&ep.asset_keywords_10=&tfd=3399
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-XJ8Q4QGGRH&l=dataLayer&cx=c&gtm=45He5170v6625173za200
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:36::178 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.bankinfosecurity.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 09 Jan 2025 02:11:12 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 details Show response
epsilon.6sense.com/v3/company/ 752 B
666 B 173ms
84ms XHR
application/json 99.83.231.3
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://epsilon.6sense.com/v3/company/details
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.83.231.3 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afe865822f884bb48.awsglobalaccelerator.com
Software: /
Resource Hash: 55096bdb72819db90b109af46d94fce8e71551e9c7a8464a6dcf930f60bb7f39

Request headers

Authorization: Token 7207ef3e32cb3a527876a3e90b6bf51dbd9d9339
X-6s-CustomID: WebTag1.0 8cde4267f2ac828e1ae5d1fbcd5ef992
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-expose-headers: X-6si-Region
timing-allow-origin: https://6sense.com
content-encoding: gzip
x-6si-region
access-control-allow-credentials: true
access-control-allow-origin: https://www.bankinfosecurity.com
content-length: 400
date: Thu, 09 Jan 2025 02:11:12 GMT
content-type: application/json
vary: Origin, Accept-Encoding

OPTIONS
H2 200 details
epsilon.6sense.com/v3/company/ Frame 0
0 175ms
57ms Preflight 99.83.231.3
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://epsilon.6sense.com/v3/company/details
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.83.231.3 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afe865822f884bb48.awsglobalaccelerator.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,x-6s-customid
Access-Control-Request-Method: GET
Origin: https://www.bankinfosecurity.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: authorization,x-6s-customid
access-control-allow-methods: OPTIONS,GET
access-control-allow-origin: https://www.bankinfosecurity.com
access-control-expose-headers: X-6si-Region
access-control-max-age: 1800
content-length: 0
date: Thu, 09 Jan 2025 02:11:12 GMT
timing-allow-origin: https://6sense.com
x-6si-region

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 190ms
80ms Fetch
text/plain 2001:4860:4802:36::178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-2RK1HGW2E4&gtm=45je5170v9122981174z86625173za200zb6625173&_p=1736388669948&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&cid=387413935.1736388672&ul=en-us&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=EA&_s=1&sid=1736388672&sct=1&seg=0&dl=https%3A%2F%2Fwww.bankinfosecurity.com%2Fblogs%2Fabandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790&dt=Abandoned%20Backdoors%3A%20How%20Malicious%20Infrastructure%20Lives%20On&en=page_view&_fv=1&_ss=1&tfd=3435
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-2RK1HGW2E4&l=dataLayer&cx=c&gtm=45He5170v6625173za200
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:36::178 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.bankinfosecurity.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 09 Jan 2025 02:11:12 GMT
content-type: text/plain
server: Golfe2

GET
H3 200 topics_frame.html
securepubads.g.doubleclick.net/static/topics/ Frame 7BE0 0
0 160ms
55ms Document
text/html 142.251.179.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/static/topics/topics_frame.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202501030202/pubads_impl.js?cb=31089501

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.179.157 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

pd-in-f157.1e100.net

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bankinfosecurity.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 1367
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000, stale-while-revalidate=3600
content-encoding: br
content-length: 29517
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 09 Jan 2025 01:48:25 GMT
expires: Thu, 09 Jan 2025 02:38:25 GMT
last-modified: Mon, 06 Jan 2025 20:43:01 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 566 KB
40 KB 214ms
212ms Fetch
text/plain 142.251.179.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3533049612149708&correlator=4116328983892841&eid=31086814%2C31089501%2C83321073&output=ldjh&gdfp_req=1&vrg=202501030202&ptt=17&impl=fifs&iu_parts=4444691%2CBIS_TOP_728x90%2CBIS_MID_RB_300x250%2CBIS_MID_RB_2_300x250%2CBIS_MID_RB_3_300x250%2CBIS_MID_RB_300x600%2CBIS_MID_L_180x150%2CBIS_MID_R_180x150%2CBIS_MID2_L_180x150%2CBIS_MID2_R_180x150%2CBIS_TEXT_1%2CBIS_TEXT_2%2CBIS_BOTTOM_728x90%2CBIS_MID_728x90%2CBIS_Interstitial%2CBIS_TOP_320x50%2CBIS_BOTTOM_320x50%2CBIS_MID_320x50%2CBIS_CAT_LOGO&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3%2C%2F0%2F4%2C%2F0%2F5%2C%2F0%2F6%2C%2F0%2F7%2C%2F0%2F8%2C%2F0%2F9%2C%2F0%2F10%2C%2F0%2F11%2C%2F0%2F12%2C%2F0%2F13%2C%2F0%2F14%2C%2F0%2F15%2C%2F0%2F16%2C%2F0%2F17%2C%2F0%2F18&prev_iu_szs=728x90%2C300x250%2C300x250%2C300x250%2C300x600%2C180x150%2C180x150%2C180x150%2C180x150%2C280x70%2C280x70%2C728x90%2C728x90%2C640x480%2C320x50%2C320x50%2C320x50%2C216x54&ifi=1&sfv=1-0-40&sc=1&cookie_enabled=1&abxe=1&dt=1736388672631&lmt=1736388672&adxs=615%2C1025%2C1025%2C-9%2C1010%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C15%2C-9%2C-12245933%2C-12245933%2C-12245933%2C-9%2C-12245933&adys=71%2C584%2C1910%2C-9%2C1845%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C4519%2C-9%2C-12245933%2C-12245933%2C-12245933%2C-9%2C-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0%7C0%7C1%7C-1%7C2%7C-1%7C-1%7C-1%7C-1%7C-1%7C-1%7C3%7C-1%7C-1%7C-1%7C-1%7C-1%7C-1&ucis=1%7C2%7C3%7C4%7C5%7C6%7C7%7C8%7C9%7Ca%7Cb%7Cc%7Cd%7Ce%7Cf%7Cg%7Ch%7Ci&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.bankinfosecurity.com%2Fblogs%2Fabandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790&vis=1&psz=800x1%7C360x0%7C360x0%7C0x-1%7C390x0%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C1600x1%7C0x-1%7C0x-1%7C0x0%7C0x0%7C0x-1%7C780x4160&msz=770x0%7C360x1%7C360x1%7C0x-1%7C390x1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C1570x0%7C0x-1%7C0x-1%7C0x0%7C0x0%7C0x-1%7C236x36&fws=0%2C0%2C0%2C2%2C0%2C2%2C2%2C2%2C2%2C2%2C2%2C0%2C2%2C644%2C128%2C128%2C2%2C128&ohw=0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C1600%2C0%2C0%2C0%2C0&topics=9&tps=9&htps=10&nt=1&psd=WzE1LFtdLG51bGwsM10.&dlt=1736388669612&idt=2917&cust_params=category%3D%255B416%252C409%252C421%255D%26gated%3Dn&adks=606436291%2C592806581%2C4037182823%2C700692632%2C585369811%2C2214922354%2C1142555781%2C3687202745%2C1536889060%2C1397140349%2C824892936%2C1158310571%2C1554130010%2C3082656849%2C1657167512%2C3519266287%2C3120678580%2C3463778582&frm=20&eoidce=1&td=1&tan=6a22e813-13a3-4b11-830f-ff607199e501%2C6a22e813-13a3-4b11-830f-ff607199e502%2C6a22e813-13a3-4b11-830f-ff607199e503%2C6a22e813-13a3-4b11-830f-ff607199e504%2C6a22e813-13a3-4b11-830f-ff607199e505%2C6a22e813-13a3-4b11-830f-ff607199e506%2C6a22e813-13a3-4b11-830f-ff607199e507%2C6a22e813-13a3-4b11-830f-ff607199e508%2C6a22e813-13a3-4b11-830f-ff607199e509%2C6a22e813-13a3-4b11-830f-ff607199e50a%2C6a22e813-13a3-4b11-830f-ff607199e50b%2C6a22e813-13a3-4b11-830f-ff607199e50c%2C6a22e813-13a3-4b11-830f-ff607199e50d%2C6a22e813-13a3-4b11-830f-ff607199e50e%2C6a22e813-13a3-4b11-830f-ff607199e50f%2C6a22e813-13a3-4b11-830f-ff607199e510%2C6a22e813-13a3-4b11-830f-ff607199e511%2C6a22e813-13a3-4b11-830f-ff607199e512&tdf=2

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202501030202/pubads_impl.js?cb=31089501

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.179.157 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

pd-in-f157.1e100.net

Software

cafe /

Resource Hash

b28d69a486c2ebd13c3799e9bbe336c9ae42fedd82a88b668dbd09dbca49b990

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

content-encoding: dcb
google-lineitem-id: 6809784464,6866199034,6866199034,6866199034,6866199034,-2,-2,-2,-2,-2,-2,6866199034,6866199034,6891490046,-2,-2,-2,-2
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2,-2,-2,-2,-2,-2,-2,-2,-2,-2,-2,-2,-2,-2,-2,-2,-2,-2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 09 Jan 2025 02:11:12 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: 138493186587,138500617641,138500617626,138500617614,138500617650,-2,-2,-2,-2,-2,-2,138500617647,138500617611,138503523642,-2,-2,-2,-2
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.bankinfosecurity.com
content-length: 40445
x-xss-protection: 0
server: cafe

GET
H2 200 container.html
5e8e59f6e1ebb9fa9791aec59a922de3.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame F204 0
0 236ms
55ms Document
text/html 2607:f8b0:4004:c09::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://5e8e59f6e1ebb9fa9791aec59a922de3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202501030202/pubads_impl.js?cb=31089501

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bankinfosecurity.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 09 Jan 2025 02:11:12 GMT
expires: Thu, 09 Jan 2025 02:11:12 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK t_.htm
t.sharethis.com/a/ Frame FD10 0
0 222ms
60ms Document
text/html 23.205.106.89
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL

https://t.sharethis.com/a/t_.htm?ver=1.1667.23406&cid=c010&cls=B

Requested by

Host: t.sharethis.com
URL: https://t.sharethis.com/1/k/t.dhj?cid=c010&cls=B&dmn=www.bankinfosecurity.com&rnd=1736388670660

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.205.106.89 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-205-106-89.deploy.static.akamaitechnologies.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=2628000 ; includeSubDomains

Request headers

Referer: https://www.bankinfosecurity.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

Cache-Control: max-age=604800
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 1190
Content-Type: text/html
Date: Thu, 09 Jan 2025 02:11:12 GMT
Expires: Thu, 16 Jan 2025 02:11:12 GMT
Strict-Transport-Security: max-age=2628000 ; includeSubDomains
X-Robots-Tag: noindex, nofollow

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 68ms
68ms Image
image/gif 23.205.106.73
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=8cde4267f2ac828e1ae5d1fbcd5ef992&svisitor=null&visitor=bd87d981-3948-421a-8d77-a1c2f4a808c0&session=f9c357a0-9256-4d47-85b1-205b4158ccc6&event=ipv6&q=%7B%22address%22%3A%222001%3A550%3A1d05%3A1%3A%3A13%22%7D&isIframe=false&m=%7B%22description%22%3A%22How%20many%20servers%20are%20infected%20by%20web%20shells%20designed%20to%20give%20attackers%20remote%20access%20to%20systems%2C%20but%20now%20%26quot%3Bphone%20home%26quot%3B%20to%20malicious%20infrastructure%20that%27s%20now%20abandoned%20or%20expired%3F%20Security%20researchers%20who%20posed%20that%20question%20have%20counted%204%2C000%20such%20systems%2C%20including%20in%20government%20and%20education.%22%2C%22keywords%22%3A%22web%20shell%2C%20php%2C%20shell%2C%20cybersecurity%2C%20information%20security%2C%20watchTowr%2C%20c99shell%2C%20r57shell%22%2C%22title%22%3A%22Abandoned%20Backdoors%3A%20How%20Malicious%20Infrastructure%20Lives%20On%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.bankinfosecurity.com%2Fblogs%2Fabandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790&pageViewId=e840a489-c3b8-4bdc-8ee6-8c9ee40109d5&ipv6=2001%3A550%3A1d05%3A1%3A%3A13&v=1.1.31

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.205.106.73 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-205-106-73.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f02dad-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Thu, 09 Jan 2025 02:11:12 GMT
accept-ranges: bytes
content-length: 43
date: Thu, 09 Jan 2025 02:11:12 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 clarity.js Show response
www.clarity.ms/s/0.7.59/ 67 KB
28 KB 66ms
64ms Script
application/javascript 2620:1ec:bdf::40
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.clarity.ms/s/0.7.59/clarity.js
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/tag/i5wta0dq65
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:bdf::40 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 83146c62110f911cbc9e66daa824d1f4e1d8f8aa6508aa45fe061932db65fa27

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

x-azure-ref: 20250109T021112Z-r1c9cc78978jm8hbhC1MIA6gbs0000000fx00000000110yk
cache-control: public, max-age=86400
x-ms-version: 2018-03-28
content-encoding: br
etag: W/"0x8DD2FD8C5BBA94B"
x-fd-int-roxy-purgeid: 79034942
x-ms-request-id: f9d54847-501e-0016-1619-62d80c000000
access-control-allow-origin: *
x-cache: TCP_HIT
date: Thu, 09 Jan 2025 02:11:12 GMT
content-type: application/javascript;charset=utf-8
vary: Accept-Encoding
last-modified: Wed, 08 Jan 2025 11:37:03 GMT

GET
H3 200 www.bankinfosecurity.com.json Show response
script.crazyegg.com/pages/data-scripts/0021/2682/site/ 1 KB
757 B 95ms
62ms XHR
application/json 104.19.147.8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/data-scripts/0021/2682/site/www.bankinfosecurity.com.json?t=1
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0021/2682.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.19.147.8 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 07bfb0d3a8042b211ef193a2ac689dbb3b95a3f501c6754557c259cedfe96aca

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

access-control-expose-headers: CE-Version
content-encoding: gzip
cf-cache-status: HIT
age: 690630
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 09 Jan 2025 02:11:12 GMT
content-type: application/json
last-modified: Wed, 01 Jan 2025 02:20:25 GMT
vary: Accept-Encoding
priority: u=1,i
cache-control: public, max-age=300, s-maxage=1209600
timing-allow-origin: *
cf-ray: 8ff0e5348af44c1a-MIA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 475
ce-version: 11.5.340
server: cloudflare

GET
H2 200 serverComponent.php Show response
nexus.ensighten.com/choozle/19322/ 486 B
818 B 92ms
92ms Script
text/javascript 2600:9000:28ac:a600:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/choozle/19322/serverComponent.php?namespace=Bootstrapper&staticJsPath=nexus.ensighten.com/choozle/19322/code/&publishedOn=Wed%20Oct%2016%2017:21:53%20GMT%202024&ClientID=923&PageID=https%3A%2F%2Fwww.bankinfosecurity.com%2Fblogs%2Fabandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/choozle/19322/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:28ac:a600:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: 45613a1070573b208d73c7919993b67c5a9ebf0c4450a00aadc671017fc01dd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

cache-control: no-cache, no-store
via: 1.1 009a5d13a4dd74719c9131c464732ee8.cloudfront.net (CloudFront)
expires: Thu, 09 Jan 2025 02:11:11 GMT
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
content-length: 486
x-amz-cf-id: -HvAWzpA823LDaXmzhoEwshJ43rPtQVNw4zMSeJR7Vm1GKZgkgih4w==
date: Thu, 09 Jan 2025 02:11:12 GMT
content-type: text/javascript
x-amz-cf-pop: IAD12-P5
server: CloudFront

GET
H2 200 details Show response
eps.6sc.co/v3/company/ 752 B
665 B 89ms
88ms Fetch
application/json 75.2.108.141
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eps.6sc.co/v3/company/details
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 75.2.108.141 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afe865822f884bb48.awsglobalaccelerator.com
Software: /
Resource Hash: 55096bdb72819db90b109af46d94fce8e71551e9c7a8464a6dcf930f60bb7f39

Request headers

Authorization: Token 7207ef3e32cb3a527876a3e90b6bf51dbd9d9339
X-6s-CustomID: WebTag1.0 8cde4267f2ac828e1ae5d1fbcd5ef992
EpsilonCookie: null
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

access-control-expose-headers: X-6si-Region
timing-allow-origin: https://6sense.com
content-encoding: gzip
x-6si-region
access-control-allow-credentials: true
access-control-allow-origin: https://www.bankinfosecurity.com
content-length: 400
date: Thu, 09 Jan 2025 02:11:13 GMT
content-type: application/json
vary: Origin, Accept-Encoding

OPTIONS
H2 200 details
eps.6sc.co/v3/company/ Frame 0
0 181ms
59ms Preflight 75.2.108.141
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eps.6sc.co/v3/company/details
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 75.2.108.141 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afe865822f884bb48.awsglobalaccelerator.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,epsiloncookie,x-6s-customid
Access-Control-Request-Method: GET
Origin: https://www.bankinfosecurity.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: authorization,epsiloncookie,x-6s-customid
access-control-allow-methods: OPTIONS,GET
access-control-allow-origin: https://www.bankinfosecurity.com
access-control-expose-headers: X-6si-Region
access-control-max-age: 1800
content-length: 0
date: Thu, 09 Jan 2025 02:11:13 GMT
timing-allow-origin: https://6sense.com
x-6si-region

OPTIONS
H2 200 v
v.eps.6sc.co/ Frame 0
0 240ms
64ms Preflight
application/json 3.171.76.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://v.eps.6sc.co/v
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.171.76.38 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-171-76-38.iad89.r.cloudfront.net
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.bankinfosecurity.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token
access-control-allow-methods: OPTIONS,POST
access-control-allow-origin: *
content-length: 0
content-type: application/json
date: Thu, 09 Jan 2025 02:11:13 GMT
via: 1.1 21fe0e69004d87d63e0024c8e921008a.cloudfront.net (CloudFront)
x-amz-apigw-id: EGR6OGLjoAMETuA=
x-amz-cf-id: WAgfSeIkm-ji8V12oCR2XBhPUdJsiroI_K7rO7kW9T6eiggiJqfW2g==
x-amz-cf-pop: IAD89-P4
x-amzn-requestid: 82055bcf-422b-4c32-b106-7ef546a0475b
x-cache: Miss from cloudfront

POST
H2 200 v Show response
v.eps.6sc.co/ 12 B
518 B 220ms
218ms XHR
application/json 3.171.76.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://v.eps.6sc.co/v
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.171.76.38 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-171-76-38.iad89.r.cloudfront.net
Software: /
Resource Hash: 512a4f403d30a587ad5ab0b9fa7b2fd4f078249ee03f9c23c445332838f6a436

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-type: application/json
Referer: https://www.bankinfosecurity.com/

Response headers

x-amz-apigw-id: EGR6PEh1oAMEH0A=
x-amzn-trace-id: Root=1-677f3041-588fe5251bc2c85d29fa3a19;Parent=21609129411ab89a;Sampled=0;Lineage=1:56167173:0
access-control-allow-methods: OPTIONS,POST
x-amzn-requestid: 86cbf25d-a2ca-4dc4-bf7b-15c6cfa8d3b0
via: 1.1 21fe0e69004d87d63e0024c8e921008a.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-cache: Miss from cloudfront
content-length: 12
x-amz-cf-id: H7jkWhs14Z16q4PvRhFslunig0QELfb_nJMxDpeTf5kjC0fqMBLvjQ==
date: Thu, 09 Jan 2025 02:11:13 GMT
content-type: application/json
x-amz-cf-pop: IAD89-P4
access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 58ms
57ms Image
image/gif 23.205.106.73
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.205.106.73 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-205-106-73.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "60bb2e15-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Thu, 09 Jan 2025 02:11:12 GMT
accept-ranges: bytes
content-length: 43
date: Thu, 09 Jan 2025 02:11:12 GMT
content-type: image/gif
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)

POST
H/1.1 204
No Content collect Show response
u.clarity.ms/ 0
288 B 232ms
62ms XHR
text/plain 4.227.249.197
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://u.clarity.ms/collect
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/s/0.7.59/clarity.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 4.227.249.197 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Accept: application/x-clarity-gzip
Referer: https://www.bankinfosecurity.com/

Response headers

Request-Context: appId=cid-v1:9c7c879b-c51a-427e-9701-218438da5f81
Access-Control-Allow-Origin: https://www.bankinfosecurity.com
Date: Thu, 09 Jan 2025 02:11:13 GMT
Vary: Origin
Server: nginx
Connection: keep-alive
Access-Control-Allow-Credentials: true

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 316F 0
0 66ms
66ms Fetch
image/gif 142.251.179.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvuOURRCo7a3G3jsrOedcC_mCTd3YqOkokOYXg1gfoA7R5bsgSqVfILDJz_0YqrpYq7yLglPP0UKXXa3EXfdH6WUwAtB2a1JZzYZWVydqopHmdgfnjwff_EFttBVpc5Nti7QXzRursA4MEHyKb2-jLBp8YCYdqYC7gqf8zxB57FFABBDtLC_Ji9q1hZQSLu4xgMhh9EKTXp0erGmcc3W1tMeiRh8G_uwo3QCseAXTleM237cVnDSGdh6oGJ3Y7DjshtmSnbg-QV_zXKm_UwK3LLabKjbIOSt9Ljm2qsK3LT1oydtNG8Rw2MSOO74h6-bMZC_wNh5uhJjwHuJ7EQ5drA8QjJue_4OmVyKFQ7x78cLs6z0TL2aLBCTgw5M2twJaovikT4kMUdDbmdRQ&sai=AMfl-YQHKk87_ujuGJn9E-wZv5Xwb7QZXyoY8-ixnp1evDmcBTyS6ZWo2peL_7tcZlP0G1qldnAfZJDXjsrD7-EKw5t4SYVv09yYNFdh6h01Wp7plKDNf5FxgzgSeoiya7PQWCoFD10kaI5L0VROvKHQ&sig=Cg0ArKJSzD-uMfIh33EwEAE&uach_m=%5BUACH%5D&adurl=

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.179.157 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

pd-in-f157.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Thu, 09 Jan 2025 02:11:12 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Thu, 09 Jan 2025 02:11:12 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20250107/r20110914/ Frame 316F 23 KB
9 KB 389ms
233ms Script
text/javascript 2607:f8b0:4004:c07::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20250107/r20110914/abg_lite_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202501030202/pubads_impl.js?cb=31089501

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c07::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0d93c445a67d71996119f9eff796d49f0345670d58ce927b278fa2de7b9397e9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

content-encoding: br
etag: 14443936298496593048
age: 45958
x-content-type-options: nosniff
expires: Wed, 22 Jan 2025 13:25:15 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Wed, 08 Jan 2025 13:25:15 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 9152
x-xss-protection: 0
server: cafe

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20250107/r20110914/client/ Frame 316F 3 KB
1 KB 345ms
189ms Script
text/javascript 2607:f8b0:4004:c07::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20250107/r20110914/client/window_focus_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202501030202/pubads_impl.js?cb=31089501

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c07::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

944a37f694b55de268a0bf52dbae4e12f12c4ae09ee5c8d213ba05075c2865dd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

content-encoding: br
etag: 6567774568227038691
age: 41147
x-content-type-options: nosniff
expires: Wed, 22 Jan 2025 14:45:26 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Wed, 08 Jan 2025 14:45:26 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 1234
x-xss-protection: 0
server: cafe

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 316F 218 KB
67 KB 193ms
54ms Script
text/javascript 172.253.115.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202501030202/pubads_impl.js?cb=31089501

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f155.1e100.net

Software

cafe /

Resource Hash

af6b15d8917bd5ab039b73db5f939c17df1aca2acf7d4ac9d8f44a005edaf6d6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

content-encoding: br
etag: 15965780714114583650
age: 2506
x-content-type-options: nosniff
expires: Thu, 09 Jan 2025 02:29:27 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 09 Jan 2025 01:29:27 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 69026
x-xss-protection: 0
server: cafe

GET
H2 200 8575290906037306302
tpc.googlesyndication.com/simgad/ Frame 316F 70 KB
70 KB 345ms
190ms Image
image/png 2607:f8b0:4004:c07::84
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/8575290906037306302

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202501030202/pubads_impl.js?cb=31089501

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c07::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2df2aa43ccae63e60dafddef949eda35ce389d91fcf65b386a69bfe62993ad4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

age: 9436
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
x-content-type-options: nosniff
expires: Thu, 08 Jan 2026 23:33:57 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons: true
date: Wed, 08 Jan 2025 23:33:57 GMT
last-modified: Thu, 17 Oct 2024 11:47:46 GMT
content-type: image/png
cache-control: public, max-age=31536000
timing-allow-origin: *
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
content-length: 71296
x-xss-protection: 0
server: sffe

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 1EA8 0
0 67ms
67ms Fetch
image/gif 142.251.179.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstdiKBnDaFOH_iz66kAT4vmicyzRzOvyq-O6M0l69FmkLa-6Et09F7WTXHtkzeoXIrOnBFsHxhkMBuZLhz3pxJnBaLZ1iwFFW2rOkCgCVsFh8IeZ6ZnYsBEfJWxOqToAMf6VMxizeeoVd-LjQ0c6zCqgTn38uTxJWQB_nxKvZg8i90U8pTQUYMhY1Z-ynQAW6Iu-uArLN0yrFHOGxP0rdK9tpheyNYpqTp2kGVn_MiuG1-1aBcaF7zwX8gcbj6XlBvU7aK4csrtC2KETqyZfafTq9gq-mIlDdhVcIyXDzIdgMByyFxvBjo7Dtm3cnHFzUMXL0vLR0EiFrExLnX0T2lf2KA7KRC8ofG3U-rq2VaUEN5J0Xb6TMnzgS2DXVyn0I7m9VWVcLbW6C9KopEjIU8&sai=AMfl-YTEqgVna7a42yQhWEC9Hglg6P_r58LUY9Pf3nr4V88MZRuo6oPFtdAA9v9jOZvrRW5EoPMtYiphJ1yR7zpJgwVzzKYjf1-NC8P5i6zq0BIDQw_OAWxpYJdNYBFbnuTA10VVoobguv6-fWhxcDpn&sig=Cg0ArKJSzLMhKrnIwxKnEAE&uach_m=%5BUACH%5D&adurl=

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.179.157 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

pd-in-f157.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Thu, 09 Jan 2025 02:11:12 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Thu, 09 Jan 2025 02:11:12 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20250107/r20110914/ Frame 1EA8 23 KB
0 379ms
379ms Script
text/javascript 2607:f8b0:4004:c07::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20250107/r20110914/abg_lite_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202501030202/pubads_impl.js?cb=31089501

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c07::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0d93c445a67d71996119f9eff796d49f0345670d58ce927b278fa2de7b9397e9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

content-encoding: br
etag: 14443936298496593048
age: 45958
x-content-type-options: nosniff
expires: Wed, 22 Jan 2025 13:25:15 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Wed, 08 Jan 2025 13:25:15 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 9152
x-xss-protection: 0
server: cafe

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20250107/r20110914/client/ Frame 1EA8 3 KB
0 335ms
335ms Script
text/javascript 2607:f8b0:4004:c07::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20250107/r20110914/client/window_focus_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202501030202/pubads_impl.js?cb=31089501

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c07::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

944a37f694b55de268a0bf52dbae4e12f12c4ae09ee5c8d213ba05075c2865dd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

content-encoding: br
etag: 6567774568227038691
age: 41147
x-content-type-options: nosniff
expires: Wed, 22 Jan 2025 14:45:26 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Wed, 08 Jan 2025 14:45:26 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 1234
x-xss-protection: 0
server: cafe

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 1EA8 218 KB
0 184ms
184ms Script
text/javascript 172.253.115.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202501030202/pubads_impl.js?cb=31089501

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f155.1e100.net

Software

cafe /

Resource Hash

af6b15d8917bd5ab039b73db5f939c17df1aca2acf7d4ac9d8f44a005edaf6d6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

content-encoding: br
etag: 15965780714114583650
age: 2506
x-content-type-options: nosniff
expires: Thu, 09 Jan 2025 02:29:27 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 09 Jan 2025 01:29:27 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 69026
x-xss-protection: 0
server: cafe

GET
H2 200 1380568137195394735
tpc.googlesyndication.com/simgad/ Frame 1EA8 21 KB
21 KB 315ms
171ms Image
image/png 2607:f8b0:4004:c07::84
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/1380568137195394735

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202501030202/pubads_impl.js?cb=31089501

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c07::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

589c63e27d66d704b2484604035c62fbe5250943ac3f1c83f6bb6fc8e80440ae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

age: 33676
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
x-content-type-options: nosniff
expires: Thu, 08 Jan 2026 16:49:57 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons: true
date: Wed, 08 Jan 2025 16:49:57 GMT
last-modified: Wed, 11 Dec 2024 13:52:18 GMT
content-type: image/png
cache-control: public, max-age=31536000
timing-allow-origin: *
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
content-length: 20995
x-xss-protection: 0
server: sffe

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 4DE6 0
0 67ms
66ms Fetch
image/gif 142.251.179.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjss0a4MzRSyHmSzFH7xCVcqNYDDsXDm53VvaeRshwBcqKoK8qTiF670WkODy4Hje20N6p4cQZYVh6g1Ra-B_uWsPRDpaNFV85E7RaQUKmItTo34kJgQpHzMBo1f6U0PErNhKvZ8yj_XLX-FwTL_lNeKYJTzk_ANkYJU8c8euVzMiIP7Fx2c9ZsRrbAZPDYPWXmGGgHhSX_vsSC1HmMtRYAs8cPKySGDXavrnaIeD8C4qOZmRx4f16KfuNmZEtZtOdo_ErG-v-E7O0tj0UqlOEDm5Uh21x6-t7L_9iX1PnSDvguLoX5XJRJu9xoDvKfTOL-4xAUWXo17Iv76DLx7dKoXaYeL2kYGVuiVZQLky5YTK8-mqS2rV5e_c6emXI-wTRV1SSd_YIybMo8IMf3NQyPH32Q&sai=AMfl-YSOYG76zQSvNQ10f_xkbgzXXzUlN8sf3HHvak6A3HYNq1BpeInUJm7JbZg-iO1uCqnzPbt45_9bncft4XaPACg8JFyuNuiu47DrXobLEex0RFYUxU5OVd25oDb4Yqp3wara7w7_Bvm94ind3vm4&sig=Cg0ArKJSzAj9PJQWVXayEAE&uach_m=%5BUACH%5D&adurl=

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.179.157 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

pd-in-f157.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Thu, 09 Jan 2025 02:11:13 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Thu, 09 Jan 2025 02:11:13 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20250107/r20110914/ Frame 4DE6 23 KB
0 234ms
234ms Script
text/javascript 2607:f8b0:4004:c07::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20250107/r20110914/abg_lite_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202501030202/pubads_impl.js?cb=31089501

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c07::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0d93c445a67d71996119f9eff796d49f0345670d58ce927b278fa2de7b9397e9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

content-encoding: br
etag: 14443936298496593048
age: 45958
x-content-type-options: nosniff
expires: Wed, 22 Jan 2025 13:25:15 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Wed, 08 Jan 2025 13:25:15 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 9152
x-xss-protection: 0
server: cafe

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20250107/r20110914/client/ Frame 4DE6 3 KB
0 190ms
190ms Script
text/javascript 2607:f8b0:4004:c07::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20250107/r20110914/client/window_focus_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202501030202/pubads_impl.js?cb=31089501

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c07::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

944a37f694b55de268a0bf52dbae4e12f12c4ae09ee5c8d213ba05075c2865dd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

content-encoding: br
etag: 6567774568227038691
age: 41147
x-content-type-options: nosniff
expires: Wed, 22 Jan 2025 14:45:26 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Wed, 08 Jan 2025 14:45:26 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 1234
x-xss-protection: 0
server: cafe

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 4DE6 218 KB
0 171ms
171ms Script
text/javascript 172.253.115.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202501030202/pubads_impl.js?cb=31089501

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f155.1e100.net

Software

cafe /

Resource Hash

af6b15d8917bd5ab039b73db5f939c17df1aca2acf7d4ac9d8f44a005edaf6d6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

content-encoding: br
etag: 15965780714114583650
age: 2506
x-content-type-options: nosniff
expires: Thu, 09 Jan 2025 02:29:27 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 09 Jan 2025 01:29:27 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 69026
x-xss-protection: 0
server: cafe

GET
H2 200 14449823274107467540
tpc.googlesyndication.com/simgad/ Frame 4DE6 21 KB
21 KB 160ms
57ms Image
image/png 2607:f8b0:4004:c07::84
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/14449823274107467540

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202501030202/pubads_impl.js?cb=31089501

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c07::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1ba34b6430aca50d20ac17d7d2e523ad9a3d7ba764a0c85fec35f91afd480bef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

age: 9502
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
x-content-type-options: nosniff
expires: Thu, 08 Jan 2026 23:32:51 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons: true
date: Wed, 08 Jan 2025 23:32:51 GMT
last-modified: Wed, 11 Dec 2024 13:52:18 GMT
content-type: image/png
cache-control: public, max-age=31536000
timing-allow-origin: *
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
content-length: 21327
x-xss-protection: 0
server: sffe

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 3AF2 0
0 69ms
68ms Fetch
image/gif 142.251.179.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsv8pgvps3wg5uqiKt1MuQvz-_gTaa_EQhWwIadkqGYpDncDluUPY7HLvZ3e02yaF-fNRml4DDl6XGKsg0IOqYOuaufn2T5kpFwSSE97-TWxnEhBurzN7qTkHYc0AINaMxitWtM1ZP-G-HO6jJwqsXpXu11-iNzkwV-sXGYbPoGee1IP-u6M7zr_5Rg5MFsFULpCGS8R7aVJqAwkayB_C-68ezRyrhl1Y1mqm50056OAElVYaa91WpF7n4zVK8wITy5OKA6e3qX1unXQwIRSkSL78JiPJPBeVQnWzkImtyxuwBR-FbRC9rIoJwBJYLO4KxSvQBF1vNns5XGErRZnE22V0QMkMHnomQfxLELe4A8lyBQ-DbjsopMXKq302R5RT5j-j_KIxPbRDmVbicXwYZU&sai=AMfl-YSjKmMd64DQ7jIVDHAe83jPbNU9Lo9GKP_u80JaCmzKLMTGRNfpOHbhIU6_rvrhWPwdrvN024fza2psG5_7TATCGSbg5zfPMhzVXyF-GN4zbQuBPKIjEic8nK0K2Q99-F3TIPWGslPpmDaLUp1_&sig=Cg0ArKJSzHo4zSyJG2Q2EAE&uach_m=%5BUACH%5D&adurl=

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.179.157 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

pd-in-f157.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Thu, 09 Jan 2025 02:11:13 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Thu, 09 Jan 2025 02:11:13 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20250107/r20110914/ Frame 3AF2 23 KB
0 236ms
236ms Script
text/javascript 2607:f8b0:4004:c07::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20250107/r20110914/abg_lite_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202501030202/pubads_impl.js?cb=31089501

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c07::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0d93c445a67d71996119f9eff796d49f0345670d58ce927b278fa2de7b9397e9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

content-encoding: br
etag: 14443936298496593048
age: 45958
x-content-type-options: nosniff
expires: Wed, 22 Jan 2025 13:25:15 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Wed, 08 Jan 2025 13:25:15 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 9152
x-xss-protection: 0
server: cafe

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20250107/r20110914/client/ Frame 3AF2 3 KB
0 191ms
191ms Script
text/javascript 2607:f8b0:4004:c07::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20250107/r20110914/client/window_focus_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202501030202/pubads_impl.js?cb=31089501

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c07::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

944a37f694b55de268a0bf52dbae4e12f12c4ae09ee5c8d213ba05075c2865dd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

content-encoding: br
etag: 6567774568227038691
age: 41147
x-content-type-options: nosniff
expires: Wed, 22 Jan 2025 14:45:26 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Wed, 08 Jan 2025 14:45:26 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 1234
x-xss-protection: 0
server: cafe

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 3AF2 218 KB
0 161ms
161ms Script
text/javascript 172.253.115.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202501030202/pubads_impl.js?cb=31089501

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f155.1e100.net

Software

cafe /

Resource Hash

af6b15d8917bd5ab039b73db5f939c17df1aca2acf7d4ac9d8f44a005edaf6d6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

content-encoding: br
etag: 15965780714114583650
age: 2506
x-content-type-options: nosniff
expires: Thu, 09 Jan 2025 02:29:27 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 09 Jan 2025 01:29:27 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 69026
x-xss-protection: 0
server: cafe

GET
H2 200 4475497991796156269
tpc.googlesyndication.com/simgad/ Frame 3AF2 32 KB
32 KB 211ms
108ms Image
image/png 2607:f8b0:4004:c07::84
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/4475497991796156269

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202501030202/pubads_impl.js?cb=31089501

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c07::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2c1571db2b0e3d38ea6db662c445b6abad4fa93c341d0b86f81f73752048cee2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

age: 33445
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
x-content-type-options: nosniff
expires: Thu, 08 Jan 2026 16:53:48 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons: true
date: Wed, 08 Jan 2025 16:53:48 GMT
last-modified: Wed, 11 Dec 2024 13:52:18 GMT
content-type: image/png
cache-control: public, max-age=31536000
timing-allow-origin: *
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
content-length: 33077
x-xss-protection: 0
server: sffe

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 1095 0
0 67ms
67ms Fetch
image/gif 142.251.179.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjss6HMfAa0YzxJuW1ojLdvC9A6C7i8h3ToqjgkfOQZsErlyGy4tGsl2PHiQcJTVrXC1M6vciG0yaDP7Ji-P1X3F4z6Ma-qdotF5Wpod9gdN5KX1yNcyzcTa69EBI6yFvlb7t-HsxtcGRgfN63zU9u13e_EpFOzQMWkeS2vMQD66TweRuLk17I-wbifPc_kA96i_r592i5bJMm_df89z3JRfra1bVSAsFrMNEQewQ-zXiXrBZkU4_-0VfzKBVCbXUDBIEMeSYuKQcKNUCWflJ8BIJGRfYnfojR8UnsuJFObIFHl2IXyU3FLrFNSxwF13uPDbxDtrG1iEPxNCyLAoYCxSdeR9sW2hFavHzK3JBDGwtdDjFdFzfcEYxiQa4lL81_HCOLtH8n01O-exyjw&sai=AMfl-YQSj6R1WHcht5U8FxIiUEVOmedfoCY6X9HB--zhlfYpSNYv6Jj7Dq7H5ON2-zL7egBug1_W8bGEV0tkXxzUQ7AUFdAR1u1EpSXJ33jJja-BTAUNU7JA-HYvp1P3SAtdGs3VEHZ0h-TbfAs5e5cY&sig=Cg0ArKJSzGSnCjWRZs0QEAE&uach_m=%5BUACH%5D&adurl=

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.179.157 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

pd-in-f157.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Thu, 09 Jan 2025 02:11:13 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Thu, 09 Jan 2025 02:11:13 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20250107/r20110914/ Frame 1095 23 KB
0 238ms
238ms Script
text/javascript 2607:f8b0:4004:c07::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20250107/r20110914/abg_lite_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202501030202/pubads_impl.js?cb=31089501

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c07::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0d93c445a67d71996119f9eff796d49f0345670d58ce927b278fa2de7b9397e9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

content-encoding: br
etag: 14443936298496593048
age: 45958
x-content-type-options: nosniff
expires: Wed, 22 Jan 2025 13:25:15 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Wed, 08 Jan 2025 13:25:15 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 9152
x-xss-protection: 0
server: cafe

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20250107/r20110914/client/ Frame 1095 3 KB
0 192ms
192ms Script
text/javascript 2607:f8b0:4004:c07::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20250107/r20110914/client/window_focus_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202501030202/pubads_impl.js?cb=31089501

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c07::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

944a37f694b55de268a0bf52dbae4e12f12c4ae09ee5c8d213ba05075c2865dd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

content-encoding: br
etag: 6567774568227038691
age: 41147
x-content-type-options: nosniff
expires: Wed, 22 Jan 2025 14:45:26 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Wed, 08 Jan 2025 14:45:26 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 1234
x-xss-protection: 0
server: cafe

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 1095 218 KB
0 151ms
151ms Script
text/javascript 172.253.115.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202501030202/pubads_impl.js?cb=31089501

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f155.1e100.net

Software

cafe /

Resource Hash

af6b15d8917bd5ab039b73db5f939c17df1aca2acf7d4ac9d8f44a005edaf6d6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

content-encoding: br
etag: 15965780714114583650
age: 2506
x-content-type-options: nosniff
expires: Thu, 09 Jan 2025 02:29:27 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 09 Jan 2025 01:29:27 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 69026
x-xss-protection: 0
server: cafe

GET
H2 200 8829216585854077496
tpc.googlesyndication.com/simgad/ Frame 1095 60 KB
61 KB 235ms
233ms Image
image/png 2607:f8b0:4004:c07::84
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/8829216585854077496

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202501030202/pubads_impl.js?cb=31089501

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c07::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a49d2f06cb9d6255bdc47902f601bd515ff40df3f08bc0d186d5f126950816ad

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
x-content-type-options: nosniff
expires: Fri, 09 Jan 2026 02:11:13 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons: true
date: Thu, 09 Jan 2025 02:11:13 GMT
content-type: image/png
last-modified: Wed, 08 Jan 2025 16:46:53 GMT
cache-control: public, max-age=31536000
timing-allow-origin: *
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
content-length: 61914
x-xss-protection: 0
server: sffe

GET
DATA 200
OK truncated
/ Frame 316F 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 321ddda1f2272a2c711cadec06908c4bab712cbf7c364e0e8ad81f756170a9a8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 1EA8 218 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 32c004bf0287e5e7442846d1c7978405dca03c3eed0af09e658d21e2bac9adc5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 4DE6 210 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f4e12557ccfa5b634378089ef3a8045180368eebd0e0677666d5c1b158312a8e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 3AF2 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7c1f9970a3c60af9df93f0a37b87a459d0ca5684ac291dd18d566bc542197556

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 93C7 0
0 68ms
67ms Fetch
image/gif 142.251.179.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuOhqMbXX9LHrhEUuOPnEhremHcMRCPYV_RMXjuTb0m46pEC7uEVwyYAMXb-ej8qhZ0j_t8HByKp7J7rl4dDNJkQvOwgA1gc9u78LfijC7oOKHy4Kw54PAcp_cm1ONw6_PhKe3max9ZcsPn9vXDY-bKzjqLZht60ufmjIPf8u4_-UHry8NpSEgLj2CYfH_iiklFpI-cZ-NiJjsbJ6PUU5beX1viGIhI4gHU5f4uonSKCjxfMyADIUqT8oxy_b7Mn869FTGTMAGaICGNzGMsaEiFlx4w3wOiHml7wX3YEQz2F1wJ2axaqq7cSyJw4Q_ZtBNg3IMhHX5_HvDwHpIFDlX2GITAI0mY8vU2Yg6Y7uPK2nDgSUh72-YRHewnjUdMnE4iRlGmCBu5skqMZDNI2w&sai=AMfl-YQgHNgAX4Mg_fR6P-y2-N3fMAjmL-0-ZJbjebINRjLy_rkCpNF-Qo6AzonaMJousxYed0JwEa5T0G-v2dab40MvZBRxgJWKmkLYFQM-jTHzzXmgNBtm6mffW6HnQBdKrJt8-JabuVw237Z-3xiq&sig=Cg0ArKJSzCnD_LxYKBUXEAE&uach_m=%5BUACH%5D&adurl=

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.179.157 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

pd-in-f157.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Thu, 09 Jan 2025 02:11:13 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20250107/r20110914/ Frame 93C7 23 KB
0 239ms
239ms Script
text/javascript 2607:f8b0:4004:c07::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20250107/r20110914/abg_lite_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202501030202/pubads_impl.js?cb=31089501

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c07::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0d93c445a67d71996119f9eff796d49f0345670d58ce927b278fa2de7b9397e9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

content-encoding: br
etag: 14443936298496593048
age: 45958
x-content-type-options: nosniff
expires: Wed, 22 Jan 2025 13:25:15 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Wed, 08 Jan 2025 13:25:15 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 9152
x-xss-protection: 0
server: cafe

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20250107/r20110914/client/ Frame 93C7 3 KB
0 192ms
192ms Script
text/javascript 2607:f8b0:4004:c07::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20250107/r20110914/client/window_focus_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202501030202/pubads_impl.js?cb=31089501

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c07::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

944a37f694b55de268a0bf52dbae4e12f12c4ae09ee5c8d213ba05075c2865dd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

content-encoding: br
etag: 6567774568227038691
age: 41147
x-content-type-options: nosniff
expires: Wed, 22 Jan 2025 14:45:26 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Wed, 08 Jan 2025 14:45:26 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 1234
x-xss-protection: 0
server: cafe

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 93C7 218 KB
0 129ms
129ms Script
text/javascript 172.253.115.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202501030202/pubads_impl.js?cb=31089501

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f155.1e100.net

Software

cafe /

Resource Hash

af6b15d8917bd5ab039b73db5f939c17df1aca2acf7d4ac9d8f44a005edaf6d6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

content-encoding: br
etag: 15965780714114583650
age: 2506
x-content-type-options: nosniff
expires: Thu, 09 Jan 2025 02:29:27 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 09 Jan 2025 01:29:27 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 69026
x-xss-protection: 0
server: cafe

GET
H2 200 3195304718162646313
tpc.googlesyndication.com/simgad/ Frame 93C7 21 KB
21 KB 207ms
146ms Image
image/png 2607:f8b0:4004:c07::84
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/3195304718162646313

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202501030202/pubads_impl.js?cb=31089501

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c07::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e1c1edc48f52ea38e75aceb1d0fa7d521ca26387f6f4d17a0e2eb0784010c410

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

age: 33676
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
x-content-type-options: nosniff
expires: Thu, 08 Jan 2026 16:49:57 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons: true
date: Wed, 08 Jan 2025 16:49:57 GMT
last-modified: Wed, 11 Dec 2024 13:52:18 GMT
content-type: image/png
cache-control: public, max-age=31536000
timing-allow-origin: *
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
content-length: 21071
x-xss-protection: 0
server: sffe

GET
DATA 200
OK truncated
/ Frame 93C7 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 40c1dd784124aa07cb110d6f61620f6eb991acae58b1b7cbc963961d7fee5c67

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H3 200 623f33741352c768077746bc172bfcb2.js Show response
nexus.ensighten.com/choozle/19322/code/ 583 B
1001 B 61ms
60ms Script
application/javascript 3.171.100.53
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/choozle/19322/code/623f33741352c768077746bc172bfcb2.js?conditionId0=4958059&conditionId1=4958060
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/choozle/19322/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 3.171.100.53 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-171-100-53.iad12.r.cloudfront.net
Software: CloudFront /
Resource Hash: 9a78701f6e49e71ab4a15f85c515418a37fb8e7e179b2686faa795765a402bac

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

etag: "bd833dd44a422db4eabf82aebcec5ae6"
age: 3477666
x-amz-version-id: zJtKrIqnT_4.uuMaVvZe_JAIV7PikZ.I
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: _goXilHBaiqvBfSqFWenUJ0DlHOZrqtVJYCLmcC9rGcctVBBt6EbQA==
date: Fri, 29 Nov 2024 20:10:08 GMT
content-type: application/javascript; charset=utf-8
last-modified: Thu, 09 May 2024 16:01:15 GMT
x-amz-replication-status: COMPLETED
cache-control: max-age=315360000
via: 1.1 8b49500bf8f9ec11f4fd4939e6ec97be.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 583
x-amz-cf-pop: IAD12-P5
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H3 200 4f6d758c47b6b3c1bb1cbb237721b445.js Show response
nexus.ensighten.com/choozle/19322/code/ 673 B
1 KB 61ms
60ms Script
application/javascript 3.171.100.53
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/choozle/19322/code/4f6d758c47b6b3c1bb1cbb237721b445.js?conditionId0=4965895
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/choozle/19322/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 3.171.100.53 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-171-100-53.iad12.r.cloudfront.net
Software: CloudFront /
Resource Hash: 624c34a5245d2d14f6e741da5da91a1adb26b29c17f364f24628c509d91e7008

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

etag: "0cf3dc205446a670d1eadbfb83a2f9a4"
age: 3477666
x-amz-version-id: Rs3JiW3OTZsbRPSzaLxF7o.plP57Dpzz
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: 1MrQ4XLFfYefvxIXP8RPynn_j9jbv9MK9i0ZNsMJcgGeIwPVHM03Nw==
date: Fri, 29 Nov 2024 20:10:08 GMT
content-type: application/javascript; charset=utf-8
last-modified: Wed, 16 Oct 2024 17:22:03 GMT
x-amz-replication-status: COMPLETED
cache-control: max-age=315360000
via: 1.1 8b49500bf8f9ec11f4fd4939e6ec97be.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 673
x-amz-cf-pop: IAD12-P5
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H3 200 40c8679203dd9dec345291ae588c2bcf.js Show response
nexus.ensighten.com/choozle/19322/code/ 3 KB
1 KB 62ms
60ms Script
application/javascript 3.171.100.53
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/choozle/19322/code/40c8679203dd9dec345291ae588c2bcf.js?conditionId0=421905
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/choozle/19322/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 3.171.100.53 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-171-100-53.iad12.r.cloudfront.net
Software: CloudFront /
Resource Hash: 55d1c842ceae117300fd3220131eb6c306ba65da20d3e5da96d56353946b6c4e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

content-encoding: br
x-amz-version-id: nJuwHo1XhOqEmJPw8mwltc93FrgbMJvg
age: 3481351
etag: W/"92d1995a36998595c802de1b8ee7697f"
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: O4Yy5Fpz6B2fNrtIi4z03XFzg6_iWSNbDrpmba_YbF89jSKzPOXPyg==
date: Fri, 29 Nov 2024 19:08:43 GMT
content-type: application/javascript; charset=utf-8
vary: accept-encoding
last-modified: Thu, 09 May 2024 16:01:13 GMT
x-amz-replication-status: COMPLETED
cache-control: max-age=315360000
via: 1.1 8b49500bf8f9ec11f4fd4939e6ec97be.cloudfront.net (CloudFront)
x-amz-cf-pop: IAD12-P5
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 71ms
70ms Image
image/gif 23.205.106.73
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=8cde4267f2ac828e1ae5d1fbcd5ef992&svisitor=null&visitor=bd87d981-3948-421a-8d77-a1c2f4a808c0&session=f9c357a0-9256-4d47-85b1-205b4158ccc6&event=ni%3Aepsv&q=%7B%22or%22%3A%22%22%2C%22nr%22%3A%22%22%2C%22orl%22%3A366%2C%22nrl%22%3A274%2C%22ores%22%3A%22%7B%5C%22company%5C%22%3A%7B%5C%22domain%5C%22%3A%5C%22%5C%22%2C%5C%22name%5C%22%3A%5C%22%5C%22%2C%5C%22region%5C%22%3A%5C%22%5C%22%2C%5C%22country%5C%22%3A%5C%22United%20States%5C%22%2C%5C%22state%5C%22%3A%5C%22Florida%5C%22%2C%5C%22city%5C%22%3A%5C%22Miami%5C%22%2C%5C%22industry%5C%22%3A%5C%22%5C%22%2C%5C%22companyId%5C%22%3A%5C%22%5C%22%2C%5C%22country_iso_code%5C%22%3A%5C%22US%5C%22%2C%5C%22address%5C%22%3A%5C%22%5C%22%2C%5C%22zip%5C%22%3A%5C%22%5C%22%2C%5C%22phone%5C%22%3A%5C%22%5C%22%2C%5C%22employee_range%5C%22%3A%5C%22%5C%22%2C%5C%22revenue_range%5C%22%3A%5C%22%5C%22%2C%5C%22employee_count%5C%22%3A%5C%22%5C%22%2C%5C%22annual_revenue%5C%22%3A%5C%22%5C%22%2C%5C%22is_blacklisted%5C%22%3Afalse%2C%5C%22state_code%5C%22%3A%5C%22%5C%22%2C%5C%22is_6qa%5C%22%3Afalse%2C%5C%22geoIP_country%5C%22%3A%5C%22United%20States%5C%22%2C%5C%22geoIP_state%5C%22%3A%5C%22Florida%5C%22%2C%5C%22geoIP_city%5C%22%3A%5C%22Miami%5C%22%2C%5C%22company_match%5C%22%3A%5C%22Non-actionable%20Match%5C%22%2C%5C%22additional_comment%5C%22%3A%5C%22There%20is%20no%20valid%20B2B%20use%20case%20as%20this%20was%20matched%20to%20something%20other%20than%20a%20company%20name%2Fdomain%20(i.e.%20bot%2C%20host%2C%20noisy%20signal%2C%20etc.)%5C%22%2C%5C%22sic%5C%22%3A%5C%22%5C%22%2C%5C%22sic_description%5C%22%3A%5C%22%5C%22%2C%5C%22naics%5C%22%3A%5C%22%5C%22%2C%5C%22naics_description%5C%22%3A%5C%22%5C%22%2C%5C%22industry_v2%5C%22%3A%5B%5D%7D%2C%5C%22scores%5C%22%3A%5B%5D%2C%5C%22segments%5C%22%3A%7B%5C%22ids%5C%22%3A%5B%5D%2C%5C%22names%5C%22%3A%5B%5D%2C%5C%22list%5C%22%3A%5B%5D%7D%2C%5C%22confidence%5C%22%3A%5C%22NA%5C%22%7D%22%2C%22nres%22%3A%22%7B%5C%22company%5C%22%3A%7B%5C%22domain%5C%22%3A%5C%22%5C%22%2C%5C%22name%5C%22%3A%5C%22%5C%22%2C%5C%22region%5C%22%3A%5C%22%5C%22%2C%5C%22country%5C%22%3A%5C%22United%20States%5C%22%2C%5C%22state%5C%22%3A%5C%22Florida%5C%22%2C%5C%22city%5C%22%3A%5C%22Miami%5C%22%2C%5C%22industry%5C%22%3A%5C%22%5C%22%2C%5C%22companyId%5C%22%3A%5C%22%5C%22%2C%5C%22country_iso_code%5C%22%3A%5C%22US%5C%22%2C%5C%22address%5C%22%3A%5C%22%5C%22%2C%5C%22zip%5C%22%3A%5C%22%5C%22%2C%5C%22phone%5C%22%3A%5C%22%5C%22%2C%5C%22employee_range%5C%22%3A%5C%22%5C%22%2C%5C%22revenue_range%5C%22%3A%5C%22%5C%22%2C%5C%22employee_count%5C%22%3A%5C%22%5C%22%2C%5C%22annual_revenue%5C%22%3A%5C%22%5C%22%2C%5C%22is_blacklisted%5C%22%3Afalse%2C%5C%22state_code%5C%22%3A%5C%22%5C%22%2C%5C%22is_6qa%5C%22%3Afalse%2C%5C%22geoIP_country%5C%22%3A%5C%22United%20States%5C%22%2C%5C%22geoIP_state%5C%22%3A%5C%22Florida%5C%22%2C%5C%22geoIP_city%5C%22%3A%5C%22Miami%5C%22%2C%5C%22company_match%5C%22%3A%5C%22Non-actionable%20Match%5C%22%2C%5C%22additional_comment%5C%22%3A%5C%22There%20is%20no%20valid%20B2B%20use%20case%20as%20this%20was%20matched%20to%20something%20other%20than%20a%20company%20name%2Fdomain%20(i.e.%20bot%2C%20host%2C%20noisy%20signal%2C%20etc.)%5C%22%2C%5C%22sic%5C%22%3A%5C%22%5C%22%2C%5C%22sic_description%5C%22%3A%5C%22%5C%22%2C%5C%22naics%5C%22%3A%5C%22%5C%22%2C%5C%22naics_description%5C%22%3A%5C%22%5C%22%2C%5C%22industry_v2%5C%22%3A%5B%5D%7D%2C%5C%22scores%5C%22%3A%5B%5D%2C%5C%22segments%5C%22%3A%7B%5C%22ids%5C%22%3A%5B%5D%2C%5C%22names%5C%22%3A%5B%5D%2C%5C%22list%5C%22%3A%5B%5D%7D%2C%5C%22confidence%5C%22%3A%5C%22NA%5C%22%7D%22%2C%22match%22%3Atrue%7D&isIframe=false&m=%7B%22description%22%3A%22How%20many%20servers%20are%20infected%20by%20web%20shells%20designed%20to%20give%20attackers%20remote%20access%20to%20systems%2C%20but%20now%20%26quot%3Bphone%20home%26quot%3B%20to%20malicious%20infrastructure%20that%27s%20now%20abandoned%20or%20expired%3F%20Security%20researchers%20who%20posed%20that%20question%20have%20counted%204%2C000%20such%20systems%2C%20including%20in%20government%20and%20education.%22%2C%22keywords%22%3A%22web%20shell%2C%20php%2C%20shell%2C%20cybersecurity%2C%20information%20security%2C%20watchTowr%2C%20c99shell%2C%20r57shell%22%2C%22title%22%3A%22Abandoned%20Backdoors%3A%20How%20Malicious%20Infrastructure%20Lives%20On%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.bankinfosecurity.com%2Fblogs%2Fabandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790&pageViewId=e840a489-c3b8-4bdc-8ee6-8c9ee40109d5&ipv6=2001%3A550%3A1d05%3A1%3A%3A13&v=1.1.31

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.205.106.73 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-205-106-73.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f02dad-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Thu, 09 Jan 2025 02:11:13 GMT
accept-ranges: bytes
content-length: 43
date: Thu, 09 Jan 2025 02:11:13 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)

POST
H2 200 v Show response
v.eps.6sc.co/ 12 B
519 B 140ms
136ms XHR
application/json 3.171.76.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://v.eps.6sc.co/v
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.171.76.38 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-171-76-38.iad89.r.cloudfront.net
Software: /
Resource Hash: 512a4f403d30a587ad5ab0b9fa7b2fd4f078249ee03f9c23c445332838f6a436

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-type: application/json
Referer: https://www.bankinfosecurity.com/

Response headers

x-amz-apigw-id: EGR6PEW6oAMEQ7w=
x-amzn-trace-id: Root=1-677f3041-01818c2961d2299e673c8693;Parent=13ea1353b2278a59;Sampled=0;Lineage=1:56167173:0
access-control-allow-methods: OPTIONS,POST
x-amzn-requestid: 02b5ed34-7895-4268-8d02-8862b1353ba9
via: 1.1 21fe0e69004d87d63e0024c8e921008a.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-cache: Miss from cloudfront
content-length: 12
x-amz-cf-id: y7XcvhWebyD10CGny5tt8d8i6Mv_Yf___m3tGjAkTW2pw3N_zSg1Wg==
date: Thu, 09 Jan 2025 02:11:13 GMT
content-type: application/json
x-amz-cf-pop: IAD89-P4
access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 69ms
68ms Image
image/gif 23.205.106.73
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=6sense-temp-analytics&svisitor=null&visitor=bd87d981-3948-421a-8d77-a1c2f4a808c0&session=f9c357a0-9256-4d47-85b1-205b4158ccc6&event=https%3A%2F%2Feps.6sc.co&q=%7B%22name%22%3A%22https%3A%2F%2Feps.6sc.co%2Fv3%2Fcompany%2Fdetails%22%2C%22entryType%22%3A%22resource%22%2C%22startTime%22%3A3781.300001144409%2C%22duration%22%3A272.6999988555908%2C%22initiatorType%22%3A%22fetch%22%2C%22deliveryType%22%3A%22%22%2C%22nextHopProtocol%22%3A%22%22%2C%22renderBlockingStatus%22%3A%22non-blocking%22%2C%22workerStart%22%3A0%2C%22redirectStart%22%3A0%2C%22redirectEnd%22%3A0%2C%22fetchStart%22%3A3781.300001144409%2C%22domainLookupStart%22%3A0%2C%22domainLookupEnd%22%3A0%2C%22connectStart%22%3A0%2C%22secureConnectionStart%22%3A0%2C%22connectEnd%22%3A0%2C%22requestStart%22%3A0%2C%22responseStart%22%3A0%2C%22firstInterimResponseStart%22%3A0%2C%22responseEnd%22%3A4054%2C%22transferSize%22%3A0%2C%22encodedBodySize%22%3A0%2C%22decodedBodySize%22%3A0%2C%22responseStatus%22%3A200%2C%22serverTiming%22%3A%5B%5D%2C%22metadata%22%3A%7B%22region%22%3A%22header-blocked%22%2C%22ores%22%3A%22%7B%5C%22company%5C%22%3A%7B%5C%22domain%5C%22%3A%5C%22%5C%22%2C%5C%22name%5C%22%3A%5C%22%5C%22%2C%5C%22region%5C%22%3A%5C%22%5C%22%2C%5C%22country%5C%22%3A%5C%22United%20States%5C%22%2C%5C%22state%5C%22%3A%5C%22Florida%5C%22%2C%5C%22city%5C%22%3A%5C%22Miami%5C%22%2C%5C%22industry%5C%22%3A%5C%22%5C%22%2C%5C%22companyId%5C%22%3A%5C%22%5C%22%2C%5C%22country_iso_code%5C%22%3A%5C%22US%5C%22%2C%5C%22address%5C%22%3A%5C%22%5C%22%2C%5C%22zip%5C%22%3A%5C%22%5C%22%2C%5C%22phone%5C%22%3A%5C%22%5C%22%2C%5C%22employee_range%5C%22%3A%5C%22%5C%22%2C%5C%22revenue_range%5C%22%3A%5C%22%5C%22%2C%5C%22employee_count%5C%22%3A%5C%22%5C%22%2C%5C%22annual_revenue%5C%22%3A%5C%22%5C%22%2C%5C%22is_blacklisted%5C%22%3Afalse%2C%5C%22state_code%5C%22%3A%5C%22%5C%22%2C%5C%22is_6qa%5C%22%3Afalse%2C%5C%22geoIP_country%5C%22%3A%5C%22United%20States%5C%22%2C%5C%22geoIP_state%5C%22%3A%5C%22Florida%5C%22%2C%5C%22geoIP_city%5C%22%3A%5C%22Miami%5C%22%2C%5C%22company_match%5C%22%3A%5C%22Non-actionable%20Match%5C%22%2C%5C%22additional_comment%5C%22%3A%5C%22There%20is%20no%20valid%20B2B%20use%20case%20as%20this%20was%20matched%20to%20something%20other%20than%20a%20company%20name%2Fdomain%20(i.e.%20bot%2C%20host%2C%20noisy%20signal%2C%20etc.)%5C%22%2C%5C%22sic%5C%22%3A%5C%22%5C%22%2C%5C%22sic_description%5C%22%3A%5C%22%5C%22%2C%5C%22naics%5C%22%3A%5C%22%5C%22%2C%5C%22naics_description%5C%22%3A%5C%22%5C%22%2C%5C%22industry_v2%5C%22%3A%5B%5D%7D%2C%5C%22scores%5C%22%3A%5B%5D%2C%5C%22segments%5C%22%3A%7B%5C%22ids%5C%22%3A%5B%5D%2C%5C%22names%5C%22%3A%5B%5D%2C%5C%22list%5C%22%3A%5B%5D%7D%2C%5C%22confidence%5C%22%3A%5C%22NA%5C%22%7D%22%2C%22nres%22%3A%22%7B%5C%22company%5C%22%3A%7B%5C%22domain%5C%22%3A%5C%22%5C%22%2C%5C%22name%5C%22%3A%5C%22%5C%22%2C%5C%22region%5C%22%3A%5C%22%5C%22%2C%5C%22country%5C%22%3A%5C%22United%20States%5C%22%2C%5C%22state%5C%22%3A%5C%22Florida%5C%22%2C%5C%22city%5C%22%3A%5C%22Miami%5C%22%2C%5C%22industry%5C%22%3A%5C%22%5C%22%2C%5C%22companyId%5C%22%3A%5C%22%5C%22%2C%5C%22country_iso_code%5C%22%3A%5C%22US%5C%22%2C%5C%22address%5C%22%3A%5C%22%5C%22%2C%5C%22zip%5C%22%3A%5C%22%5C%22%2C%5C%22phone%5C%22%3A%5C%22%5C%22%2C%5C%22employee_range%5C%22%3A%5C%22%5C%22%2C%5C%22revenue_range%5C%22%3A%5C%22%5C%22%2C%5C%22employee_count%5C%22%3A%5C%22%5C%22%2C%5C%22annual_revenue%5C%22%3A%5C%22%5C%22%2C%5C%22is_blacklisted%5C%22%3Afalse%2C%5C%22state_code%5C%22%3A%5C%22%5C%22%2C%5C%22is_6qa%5C%22%3Afalse%2C%5C%22geoIP_country%5C%22%3A%5C%22United%20States%5C%22%2C%5C%22geoIP_state%5C%22%3A%5C%22Florida%5C%22%2C%5C%22geoIP_city%5C%22%3A%5C%22Miami%5C%22%2C%5C%22company_match%5C%22%3A%5C%22Non-actionable%20Match%5C%22%2C%5C%22additional_comment%5C%22%3A%5C%22There%20is%20no%20valid%20B2B%20use%20case%20as%20this%20was%20matched%20to%20something%20other%20than%20a%20company%20name%2Fdomain%20(i.e.%20bot%2C%20host%2C%20noisy%20signal%2C%20etc.)%5C%22%2C%5C%22sic%5C%22%3A%5C%22%5C%22%2C%5C%22sic_description%5C%22%3A%5C%22%5C%22%2C%5C%22naics%5C%22%3A%5C%22%5C%22%2C%5C%22naics_description%5C%22%3A%5C%22%5C%22%2C%5C%22industry_v2%5C%22%3A%5B%5D%7D%2C%5C%22scores%5C%22%3A%5B%5D%2C%5C%22segments%5C%22%3A%7B%5C%22ids%5C%22%3A%5B%5D%2C%5C%22names%5C%22%3A%5B%5D%2C%5C%22list%5C%22%3A%5B%5D%7D%2C%5C%22confidence%5C%22%3A%5C%22NA%5C%22%7D%22%7D%7D&isIframe=false&m=%7B%22endpoint%22%3A%22epsilon.6sense.com%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.bankinfosecurity.com%2Fblogs%2Fabandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790&pageViewId=&d=1&v=1.1.31

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.205.106.73 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-205-106-73.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f02dad-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Thu, 09 Jan 2025 02:11:13 GMT
accept-ranges: bytes
content-length: 43
date: Thu, 09 Jan 2025 02:11:13 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 316F 0
0 109ms
108ms Fetch
image/gif 172.253.115.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f155.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 09 Jan 2025 02:11:13 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4DE6 0
0 143ms
65ms Fetch
image/gif 172.253.115.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f155.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 09 Jan 2025 02:11:13 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 4DE6 0
0 66ms
65ms Fetch
image/gif 142.251.179.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsv6lJFL2KshJb9oTeq4aeKXx-I_Kinl-eO4mpWiSY1r67HsWo9i8SsqnR_FwwkVWOIZx5YZyTJVOlFxpi8cVqgjEMyA2keuVfUhS2e1KwYn17Nu3ISNNY_ThFP4Ezkmfv0HDsVViCPQrc1FRiqczqqdu3BAZe5-b3Qvps8fS_Bh9bYk4bdWglXWjyx-8DSWQ8A_fZ7rnedh7bZEwweQc79EcfujRytaKKinrBf6IoyeHwegSYiqG8Z3WYmtIKGawSMznQjxJ97RNVCPljbr7UrAaIsjH-oS4dvCPWtMRqtUDSvSKKCgF7Xr24eSur6rqoAZ2fAEDGGQI9-TesN71zjD3_wvsy4Bu5cYKXrNYClMLObbQdYReEjoU5hEgn2rEImJxtZ3t92Awguchgran9-s9k03&sai=AMfl-YQ9ztgA78_D4iVIWyNsFWgyNsaVla4G6nO2UyStFP2cgYire4aiCQ6NOJ7cC8TX9owePuroxJO1OYOSl4_HZHkHma6NhCzywrCDOoJB7hJFNHqIA7tU9J6q0coupfza2TeMniMYLY3yf6K2I-30&sig=Cg0ArKJSzDWFe_A5OnD3EAE&uach_m=%5BUACH%5D&adurl=

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.179.157 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

pd-in-f157.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Thu, 09 Jan 2025 02:11:13 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Thu, 09 Jan 2025 02:11:13 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 1095 0
0 184ms
67ms Fetch
image/gif 172.253.115.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f155.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 09 Jan 2025 02:11:13 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 1EA8 0
0 233ms
66ms Fetch
image/gif 172.253.115.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f155.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 09 Jan 2025 02:11:13 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 1EA8 0
0 66ms
66ms Fetch
image/gif 142.251.179.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuv7nbQYOP7OfhUXv1KFqObENXBKFBDNBwWkySaLSdmE7Ar8V6BmiKzWby1BCEWNFu7Sd5IE2P61T85ZnCUIkgyOfThK9XOnJMrf1tcXHovmcq4T3a2DIcZgzSk_6husbdcqPlrvwlDRyo2a4oRwxJ8f2QDEA3yC-yik_4cBwyuY9_L88HO-Smh0Iej1W2CYyjomkE2ek5-I-2RCSuBt6xcVofwcND-5nCqhyUo3sVu2ixZERV5YGcSWtX_TzxM_uvl-BFrJbRGhBXkjbL0AkUXcmlNZof2l_f47OjEJ3Z-H9ZFPRu7pHJkMrzJEUb0F6jclZhyXOUri-RV7HQ4LcRWU6UGUHkdd--oMs8wt9tyN1DoFw5b_PZDdLQ2qr8PVnjU10ZJOcaJBcszHF-eSkTqSA&sai=AMfl-YTwpuof0-hkGnsLhuRQx6mcZ0G6__PUakmrgZD7HZa34KonrgIDEwZiTsQeDcCXqfBUdLK-39IDFtxrmuVqTznNAEB2mjsl6PsUSo79lScVfbdsdV9wnx5remvvnINWZKczidkjtf8l7tb-H5p6&sig=Cg0ArKJSzNpuQD_dZamYEAE&uach_m=%5BUACH%5D&adurl=

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.179.157 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

pd-in-f157.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Thu, 09 Jan 2025 02:11:13 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Thu, 09 Jan 2025 02:11:13 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 93C7 0
0 273ms
66ms Fetch
image/gif 172.253.115.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f155.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 09 Jan 2025 02:11:13 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 93C7 0
0 65ms
65ms Fetch
image/gif 142.251.179.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuX7_ydeq2n7Yz4fefxpIkiJcZWb5_iaU5ebxb1gRPqfez-G8coDwWQgvjsPEhr8IUi9f3SFF7PUdg2xTk9inCze1J_EVWPYtbHNvJ367RdyyPvlx1y1xu-pkiCaP16bmw9uqJEhpTx_Gd2DOTfdxp5dgN_Dg-XwbcFwf6toH2IoiwT1DIyODb9G7i-7-F69Z_ckvRvH9QnMozqaLbvim4Hhcv2ugNoh13-cuZXNUK4tKYqt8vvg3NNxn3_oGBOOUCsprBVCRIyJtPUgbQ8nk0soXJsURevnauyVIA7Eo40y_rGGnTY7X90gSIxXpv9p7gaieewnD5a1ILNn4ywX6GJvQkVklnuIV09iOSkrBvddXG570aBtkqv-_f5fi-GDhpSX-5lwQTsVzrDhwyd54Jq&sai=AMfl-YQDJLX-AO3oFePNVgRvcomZATMHNAtcfYUKHq3mX5OviwRQeadZj5nQLDoahFNks8_WfWslu_PEHk3aAVYxfVdQUywMuTgUpdur7atQqWBMWIKgyObb5Kl-QvmOmMOfbvW2ravch1IdvYjebJw4&sig=Cg0ArKJSzNpNlzW4vggkEAE&uach_m=%5BUACH%5D&adurl=

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.179.157 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

pd-in-f157.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Thu, 09 Jan 2025 02:11:13 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Thu, 09 Jan 2025 02:11:13 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3AF2 0
0 317ms
66ms Fetch
image/gif 172.253.115.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f155.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 09 Jan 2025 02:11:13 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 3AF2 0
0 67ms
67ms Fetch
image/gif 142.251.179.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsu4xnoDQPDjBO7ie4hSel8naOqfJhlJM-nsazy1YoGtYc2YM0djRTV62GPMwUdkIC6CQNRlKX0lqP_POZWqjQFMtsreEwmQEh511FXXdSRRdiTbJXleMmdbK81GcZqjhBUmUwxHIxnpnVYcPbffI8ERb0d78PP5hrOmQHcKFSaoTjAfjIr-1ak8AFT9EaSc_jMydL6kmNgQGp_3o7yJvsjubaS8RQLo_b0MukFdE7gXKxi98fLStbVYjjERbu8irAB5wy3dPFO-jYOn8PHwltJIBagko9dVI82O_dCe84Hj4jEPemy_XE-1sQDN8MedaM0LPl-GJUDfygU140tyXRnDRkDLnu7HS20qYyf_kzE5ij42g4j8P-XcMxcIdZYJyfpPYUB-BeDaacCpK2Z78IBgyA&sai=AMfl-YTwi7zHnc7LSHHLIiIdz2NtTXGxjXmX0_gFhLOUuAEWKeamuGkv4AtWQL9VbLnjtLRm31RSuC0sSDN8wbctCHHNPEKUtv4Pqdoq9rbkOLyqtCRMmt0gaZqOWJq4bzuPD4jrI6MfVsMhw56Y-ngI&sig=Cg0ArKJSzB3IaZTn9NIdEAE&uach_m=%5BUACH%5D&adurl=

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.179.157 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

pd-in-f157.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Thu, 09 Jan 2025 02:11:13 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Thu, 09 Jan 2025 02:11:13 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 316F 0
0 68ms
67ms Fetch
image/gif 172.253.115.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f155.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 09 Jan 2025 02:11:13 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4DE6 0
0 132ms
67ms Fetch
image/gif 172.253.115.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f155.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 09 Jan 2025 02:11:13 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 1095 0
0 189ms
66ms Fetch
image/gif 172.253.115.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f155.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 09 Jan 2025 02:11:13 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 1EA8 0
0 250ms
65ms Fetch
image/gif 172.253.115.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f155.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 09 Jan 2025 02:11:13 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 58ms
58ms Image
image/gif 23.205.106.73
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=8cde4267f2ac828e1ae5d1fbcd5ef992&svisitor=null&visitor=bd87d981-3948-421a-8d77-a1c2f4a808c0&session=f9c357a0-9256-4d47-85b1-205b4158ccc6&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2009%20Jan%202025%2002%3A11%3A13%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2009%20Jan%202025%2002%3A11%3A12%20GMT%22%2C%22timeSpent%22%3A%221091%22%2C%22totalTimeSpent%22%3A%221091%22%7D&isIframe=false&m=%7B%22description%22%3A%22How%20many%20servers%20are%20infected%20by%20web%20shells%20designed%20to%20give%20attackers%20remote%20access%20to%20systems%2C%20but%20now%20%26quot%3Bphone%20home%26quot%3B%20to%20malicious%20infrastructure%20that%27s%20now%20abandoned%20or%20expired%3F%20Security%20researchers%20who%20posed%20that%20question%20have%20counted%204%2C000%20such%20systems%2C%20including%20in%20government%20and%20education.%22%2C%22keywords%22%3A%22web%20shell%2C%20php%2C%20shell%2C%20cybersecurity%2C%20information%20security%2C%20watchTowr%2C%20c99shell%2C%20r57shell%22%2C%22title%22%3A%22Abandoned%20Backdoors%3A%20How%20Malicious%20Infrastructure%20Lives%20On%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.bankinfosecurity.com%2Fblogs%2Fabandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790&pageViewId=e840a489-c3b8-4bdc-8ee6-8c9ee40109d5&ipv6=2001%3A550%3A1d05%3A1%3A%3A13&v=1.1.31

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.205.106.73 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-205-106-73.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "60bb2e15-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Thu, 09 Jan 2025 02:11:13 GMT
accept-ranges: bytes
content-length: 43
date: Thu, 09 Jan 2025 02:11:13 GMT
content-type: image/gif
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 316F 0
0 67ms
67ms Fetch
image/gif 142.251.179.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsupHBoUHYQ7FK3U82C1oVI9CE2ACrmuz8juflwxJko8TRuqF6CCbc9ya4GZfdp1b6K0JskOhsMtLEZSNWcUPot6x0iltuXIf2IXfsTWeIrFiCxTKYG53hK273-Lem9q13WJZ9PZvELkwwQU-KdxDN0SMyEfEUWqOeuR6AkiMW_OEgt3O273oihx2myjUSfcz0Ek9_0s_uL8Kwv4o49ADrPHQgY6euWZ2aiU_Y3TjK-Jbm-stXumHPGa1Y5Xo-JGtAltit_mm9LmzEBKwfqRxEUgaZKrEA35wxw1rctSSF-3LfOQUge3gXc2BNCiSEaQbac1W8MoLH0y1q9K2HTU3lHUq-xvg3KBphqNjhG9_9KFk9erezCii5rIxzq8CY8t8XsSuThYtBkGsuobyM1x&sai=AMfl-YSnNhN0gSpleaIPV8chyeuvro5mdqEigJNANA4Zyibrq6nyWuG3wOlHo-9YfEBEm6swmbarBn3phYICGnPTzORec880Y_37l6PucyaXmbMl7-v_SCCW54DASk4e-BHuG29tJzS4vvqgA6gxEi61&sig=Cg0ArKJSzCGPA6jcmiOuEAE&uach_m=%5BUACH%5D&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&adurl=

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.179.157 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

pd-in-f157.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Thu, 09 Jan 2025 02:11:13 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Thu, 09 Jan 2025 02:11:13 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 93C7 0
0 288ms
66ms Fetch
image/gif 172.253.115.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f155.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 09 Jan 2025 02:11:13 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 1095 0
0 65ms
65ms Fetch
image/gif 142.251.179.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstOQciUd416X-C6aXlTBS-gfQd0AjaKGXONc5UEXLef3afYSDJywCZ6_8SwhOx2h-5SyPwbukwJECZMFpEENr0AkVGnoe6qK8xSYSW9jmDVzoFxdyQypAPvEfPZlZLaynfpDohU0N76DMUhKMVi1gwuFklqD1Lxq-TlQcKEKFMaY9qcBHhWnRQ_-fM8pIrC_ZVdLP6WPfI82auU0231tv8xnnrzTsy_Ne4kjambzf7gk7V9H5uSW4WCAWf8xUgf_XXAx7qQ0SCzv1vieYXIazhORpttyPam2GHIqrRU5LqoPdLnJSlA9CZ-XdVhb0fOxXS7Hl_g-OTMZZ9ImKljacsddmGn0WO0HoDDWloGBkQ0FCMXxL-y9HTHSLFCP2C9jLdF8pFPq78Pbxa0sqQN&sai=AMfl-YRPHwEFZlm0WY3swb-w8RR1FcG5TNtvkmqxz1Mpq3JZBy-HihTS0rDvvqK9ocm5qkL4nkZbKUq6mXFFEzbNnWUhrmYRpQqw5m0I2qdeCxIoGT6xbfQgiUF5BQx-0Xj60wZJ_9Y8neHyFUEKdRid&sig=Cg0ArKJSzG9FoIbLNIW0EAE&uach_m=%5BUACH%5D&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&adurl=

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.179.157 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

pd-in-f157.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Thu, 09 Jan 2025 02:11:13 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Thu, 09 Jan 2025 02:11:13 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3AF2 0
0 345ms
65ms Fetch
image/gif 172.253.115.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f155.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 09 Jan 2025 02:11:13 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H/1.1

200
OK

iframe
d1eoo1tco6rr5e.cloudfront.net/86s8kpd/tm47y0o/ Frame C7D2
Redirect Chain

https://insight.adsrvr.org/tags/86s8kpd/tm47y0o/iframe
https://d1eoo1tco6rr5e.cloudfront.net/86s8kpd/tm47y0o/iframe

0
0

256ms
62ms

Document
text/html

3.167.119.120
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d1eoo1tco6rr5e.cloudfront.net/86s8kpd/tm47y0o/iframe
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/choozle/19322/code/4f6d758c47b6b3c1bb1cbb237721b445.js?conditionId0=4965895
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 3.167.119.120 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-167-119-120.iad55.r.cloudfront.net
Software: AmazonS3 /
Resource Hash

Request headers

Referer: https://www.bankinfosecurity.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

Accept-Ranges: bytes
Age: 70590
Cache-Control: max-age=86400
Connection: keep-alive
Content-Length: 137
Content-Type: text/html
Date: Wed, 08 Jan 2025 06:34:44 GMT
ETag: "115661d2a9cf2a6c8e35b0f86ddd7b5c"
Last-Modified: Wed, 09 Oct 2024 08:33:52 GMT
Server: AmazonS3
Via: 1.1 e96ed109dde78412c6b4651755281804.cloudfront.net (CloudFront)
X-Amz-Cf-Id: Dolvw0sEBOohtzWtyM7kTzKO4oXIEUicoSSR4Z569c41J3XcQgQ1nA==
X-Amz-Cf-Pop: IAD55-P8
X-Cache: Hit from cloudfront
x-amz-server-side-encryption: AES256

Redirect headers

content-length: 0
date: Thu, 09 Jan 2025 02:11:13 GMT
location: https://d1eoo1tco6rr5e.cloudfront.net/86s8kpd/tm47y0o/iframe

GET
H2 200 realtime.b23ff3c36dd0169627f8e54ca1621eca.css
c.disquscdn.com/next/embed/styles/ Frame 4E1E 337 B
841 B 172ms
57ms Stylesheet
text/css 2600:9000:27d1:5200:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/styles/realtime.b23ff3c36dd0169627f8e54ca1621eca.css

Requested by

Host: bankinfosecurity.disqus.com
URL: https://bankinfosecurity.disqus.com/embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:27d1:5200:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

c284dcb06ef882b1b45e11e0a16baa223b4117eca94e243c8e725c4ce3f909b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

content-encoding: gzip
surrogate-key: next
etag: "673f77d4-f4"
age: 3830438
x-content-type-options: nosniff
expires: Tue, 25 Nov 2025 18:10:35 GMT
x-cache: Hit from cloudfront
x-amz-cf-id: IrqFb50Tt89GOcgdJDm6_Q6_T1WbWVz0LoXERfn4BITrvOJopyCaoQ==
date: Mon, 25 Nov 2024 18:10:35 GMT
content-type: text/css; charset=utf-8
last-modified: Thu, 21 Nov 2024 18:11:32 GMT
x-cache-hits: 0
x-served-by: static-web-1
cache-control: max-age=31536000, public, immutable, no-transform
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
via: 1.1 5b0b018dc5d72a42f205b24b17f4f56e.cloudfront.net (CloudFront)
access-control-allow-origin: *
content-length: 244
x-xss-protection: 1; mode=block
x-amz-cf-pop: IAD55-P8
server: nginx

GET
H2 200 realtime.b23ff3c36dd0169627f8e54ca1621eca.css
c.disquscdn.com/next/embed/styles/ Frame 34B2 337 B
0 167ms
167ms Stylesheet
text/css 2600:9000:27d1:5200:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/styles/realtime.b23ff3c36dd0169627f8e54ca1621eca.css

Requested by

Host: bankinfosecurity.disqus.com
URL: https://bankinfosecurity.disqus.com/embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:27d1:5200:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

c284dcb06ef882b1b45e11e0a16baa223b4117eca94e243c8e725c4ce3f909b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

content-encoding: gzip
surrogate-key: next
etag: "673f77d4-f4"
age: 3830438
x-content-type-options: nosniff
expires: Tue, 25 Nov 2025 18:10:35 GMT
x-cache: Hit from cloudfront
x-amz-cf-id: IrqFb50Tt89GOcgdJDm6_Q6_T1WbWVz0LoXERfn4BITrvOJopyCaoQ==
date: Mon, 25 Nov 2024 18:10:35 GMT
content-type: text/css; charset=utf-8
last-modified: Thu, 21 Nov 2024 18:11:32 GMT
x-cache-hits: 0
x-served-by: static-web-1
cache-control: max-age=31536000, public, immutable, no-transform
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
via: 1.1 5b0b018dc5d72a42f205b24b17f4f56e.cloudfront.net (CloudFront)
access-control-allow-origin: *
content-length: 244
x-xss-protection: 1; mode=block
x-amz-cf-pop: IAD55-P8
server: nginx

POST
H/1.1 204
No Content collect Show response
u.clarity.ms/ 0
288 B 276ms
206ms XHR
text/plain 4.227.249.197
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://u.clarity.ms/collect
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/s/0.7.59/clarity.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 4.227.249.197 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Accept: application/x-clarity-gzip
Referer: https://www.bankinfosecurity.com/

Response headers

Request-Context: appId=cid-v1:9c7c879b-c51a-427e-9701-218438da5f81
Access-Control-Allow-Origin: https://www.bankinfosecurity.com
Date: Thu, 09 Jan 2025 02:11:13 GMT
Vary: Origin
Server: nginx
Connection: keep-alive
Access-Control-Allow-Credentials: true

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 1EA8 42 B
65 B 70ms
70ms Fetch
image/gif 172.253.115.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsu7N7_cLSsLPeVfHMQzXCG3pb1ckRzbpey8tTKtpdn2WwbO61cA-Ctrs9UhitpywWBnULbqEYPtxYTzuld3AEDFaRxqpM9-g5OZKaLnB6xEDzpJPqOhSZPcitE7OkKPUd9ox2Z37EWncCwzyrFD_xcrvyKDBfoKim6tXgdE2sD8xrgl8-ZbDXPALPfoufm_iXh4lw&sig=Cg0ArKJSzOMD-VPediCwEAE&id=lidar2&mcvt=1000&p=589,1040,839,1340&tm=1009.8000011444092&tu=10.100000381469727&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20241204&bin=7&avms=nio&bs=1600,1200&mc=1&vu=1&app=0&itpl=3&adk=592806581&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=3232147300&rst=1736388672955&rpt=385&isd=0&lsd=0&met=mue&wmsd=0&pbe=0&fle=0&vae=0&spb=0&sfl=0&ffslot=0&reach=8&io2=0

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f155.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Thu, 09 Jan 2025 02:11:14 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 61ms
57ms Image
image/gif 23.205.106.73
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=8cde4267f2ac828e1ae5d1fbcd5ef992&svisitor=null&visitor=bd87d981-3948-421a-8d77-a1c2f4a808c0&session=f9c357a0-9256-4d47-85b1-205b4158ccc6&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2009%20Jan%202025%2002%3A11%3A14%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2009%20Jan%202025%2002%3A11%3A13%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%222092%22%7D&isIframe=false&m=%7B%22description%22%3A%22How%20many%20servers%20are%20infected%20by%20web%20shells%20designed%20to%20give%20attackers%20remote%20access%20to%20systems%2C%20but%20now%20%26quot%3Bphone%20home%26quot%3B%20to%20malicious%20infrastructure%20that%27s%20now%20abandoned%20or%20expired%3F%20Security%20researchers%20who%20posed%20that%20question%20have%20counted%204%2C000%20such%20systems%2C%20including%20in%20government%20and%20education.%22%2C%22keywords%22%3A%22web%20shell%2C%20php%2C%20shell%2C%20cybersecurity%2C%20information%20security%2C%20watchTowr%2C%20c99shell%2C%20r57shell%22%2C%22title%22%3A%22Abandoned%20Backdoors%3A%20How%20Malicious%20Infrastructure%20Lives%20On%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.bankinfosecurity.com%2Fblogs%2Fabandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790&pageViewId=e840a489-c3b8-4bdc-8ee6-8c9ee40109d5&ipv6=2001%3A550%3A1d05%3A1%3A%3A13&v=1.1.31

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.205.106.73 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-205-106-73.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f02dad-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Thu, 09 Jan 2025 02:11:14 GMT
accept-ranges: bytes
content-length: 43
date: Thu, 09 Jan 2025 02:11:14 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 316F 42 B
65 B 72ms
71ms Fetch
image/gif 172.253.115.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstlw0F42u97gPnhDBavJAGjJ1c-uPsLH3XgFoLYRbijAhbef9V8IzMTRvmNMpmeMlCt7UoF8YSuPlWjPDOkEbprzkWy4OkncUwRk-G58bZkCF8BRb19mjWOFkh6xx9zG7Kj3BY9aXT-N8Ohr4ozIVMhorzGBaJlSNZKFDNJ3Qy-TFH-nKpfqbHR34ta8ug8lAI_JQ&sig=Cg0ArKJSzHrZodSBEgHwEAE&id=lidar2&mcvt=1001&p=71,636,161,1364&tm=1172.1999988555908&tu=171.10000038146973&mtos=1001,1001,1001,1001,1001&tos=1001,0,0,0,0&v=20241204&bin=7&avms=nio&bs=1600,1200&mc=1&vu=1&app=0&itpl=3&adk=606436291&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=3232147300&rst=1736388672940&rpt=478&isd=0&lsd=0&met=mue&wmsd=0&pbe=0&fle=0&vae=0&spb=0&sfl=0&ffslot=0&reach=8&io2=0

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f155.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Thu, 09 Jan 2025 02:11:14 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 bis-hdr.desktop.r2.js Show response
www.bankinfosecurity.com/javascripts-responsive/ 2 KB
651 B 66ms
65ms Script
text/javascript 50.56.167.254
RMH-14

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bankinfosecurity.com/javascripts-responsive/bis-hdr.desktop.r2.js

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

50.56.167.254 , United States, ASN33070 (RMH-14, US),

Reverse DNS

Software

Resource Hash

56d67bff3c0d11af3f7b09d825eca83408c0017d7c34a03678f0f9433a97819d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: frame-ancestors 'none'
cache-control: max-age=86400, private, must-revalidate
content-encoding: gzip
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 593
x-xss-protection: 1; mode=block
date: Thu, 09 Jan 2025 02:11:15 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
x-frame-options: deny

GET
H3 200 sodar Show response
ep1.adtrafficquality.google/getconfig/ 17 KB
13 KB 144ms
69ms XHR
application/json 64.233.180.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ep1.adtrafficquality.google/getconfig/sodar?sv=200&tid=gpt&tv=m202501030202&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202501030202/pubads_impl.js?cb=31089501

Protocol

Security

QUIC, , AES_128_GCM

Server

64.233.180.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

pe-in-f156.1e100.net

Software

cafe /

Resource Hash

75819104c325a7041c8e863ca354d37fd40602627c1a7ba3c929d7ebfd075f37

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

timing-allow-origin: *
content-encoding: br
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 13124
date: Thu, 09 Jan 2025 02:11:15 GMT
x-xss-protection: 0
content-type: application/json; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2

200

c.gif
c.clarity.ms/
Redirect Chain

https://c.clarity.ms/c.gif
https://c.bing.com/c.gif?ctsa=mr&CtsSyncId=482281510C9A466A97F5D1828DE036D7&RedC=c.clarity.ms&MXFR=051925401C6061B412DE302F18606F3C
https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=482281510C9A466A97F5D1828DE036D7&MUID=020073F4376F648D287C669B36FF6531

42 B
442 B

54ms
54ms

Image
image/gif

20.110.205.119
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=482281510C9A466A97F5D1828DE036D7&MUID=020073F4376F648D287C669B36FF6531
Protocol: H2
Server: 20.110.205.119 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

cache-control: private, no-cache, proxy-revalidate, no-store
pragma: no-cache
etag: "dda11c98eb61db1:0"
accept-ranges: bytes
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
content-length: 42
date: Thu, 09 Jan 2025 02:11:15 GMT
content-type: image/gif
last-modified: Wed, 08 Jan 2025 16:37:23 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET

Redirect headers

cache-control: private, no-cache, proxy-revalidate, no-store
location: https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=482281510C9A466A97F5D1828DE036D7&MUID=020073F4376F648D287C669B36FF6531
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 8122A39D6F4F41AA810B0F6C05F8FC95 Ref B: MIAEDGE1508 Ref C: 2025-01-09T02:11:15Z
x-cache: CONFIG_NOCACHE
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
content-length: 0
date: Thu, 09 Jan 2025 02:11:15 GMT
x-powered-by: ASP.NET

GET
DATA 200
OK truncated
/ Frame 1095 209 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f1a5717fcfb5a691957184c2eae91691228aaa0e2f4d3d209230242a99b3deaa

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H2 200 favicon_BIS.ico
www.bankinfosecurity.com/images/favicons/ 4 KB
2 KB 64ms
63ms Other
image/vnd.microsoft.icon 50.56.167.254
RMH-14

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bankinfosecurity.com/images/favicons/favicon_BIS.ico

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

50.56.167.254 , United States, ASN33070 (RMH-14, US),

Reverse DNS

Software

Resource Hash

eeaece944fcb879b3345ea46bb228f9e02d0ee4d73b8ea71549cee3a4275ddfd

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: frame-ancestors 'none'
cache-control: max-age=86400, private, must-revalidate
content-encoding: gzip
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 2451
x-xss-protection: 1; mode=block
date: Thu, 09 Jan 2025 02:11:15 GMT
content-type: image/vnd.microsoft.icon
vary: Accept-Encoding
x-frame-options: deny

GET
H2 200 sodar2.js Show response
ep2.adtrafficquality.google/sodar/ 18 KB
7 KB 185ms
59ms Script
text/javascript 2607:f8b0:4004:c07::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ep2.adtrafficquality.google/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202501030202/pubads_impl.js?cb=31089501

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c07::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ff3de130872fe0fb5b770dfa2bc9f0daf8ab320403a34a60d089436f08d24f99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

content-encoding: gzip
etag: "1727224258380615"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
x-content-type-options: nosniff
expires: Thu, 09 Jan 2025 02:11:15 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 09 Jan 2025 02:11:15 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: private, max-age=3000
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 6445
x-xss-protection: 0
server: sffe

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 58ms
57ms Image
image/gif 23.205.106.73
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=8cde4267f2ac828e1ae5d1fbcd5ef992&svisitor=null&visitor=bd87d981-3948-421a-8d77-a1c2f4a808c0&session=f9c357a0-9256-4d47-85b1-205b4158ccc6&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2009%20Jan%202025%2002%3A11%3A15%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2009%20Jan%202025%2002%3A11%3A14%20GMT%22%2C%22timeSpent%22%3A%221004%22%2C%22totalTimeSpent%22%3A%223096%22%7D&isIframe=false&m=%7B%22description%22%3A%22How%20many%20servers%20are%20infected%20by%20web%20shells%20designed%20to%20give%20attackers%20remote%20access%20to%20systems%2C%20but%20now%20%26quot%3Bphone%20home%26quot%3B%20to%20malicious%20infrastructure%20that%27s%20now%20abandoned%20or%20expired%3F%20Security%20researchers%20who%20posed%20that%20question%20have%20counted%204%2C000%20such%20systems%2C%20including%20in%20government%20and%20education.%22%2C%22keywords%22%3A%22web%20shell%2C%20php%2C%20shell%2C%20cybersecurity%2C%20information%20security%2C%20watchTowr%2C%20c99shell%2C%20r57shell%22%2C%22title%22%3A%22Abandoned%20Backdoors%3A%20How%20Malicious%20Infrastructure%20Lives%20On%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.bankinfosecurity.com%2Fblogs%2Fabandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790&pageViewId=e840a489-c3b8-4bdc-8ee6-8c9ee40109d5&ipv6=2001%3A550%3A1d05%3A1%3A%3A13&v=1.1.31

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.205.106.73 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-205-106-73.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f02dad-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Thu, 09 Jan 2025 02:11:15 GMT
accept-ranges: bytes
content-length: 43
date: Thu, 09 Jan 2025 02:11:15 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 runner.html
ep2.adtrafficquality.google/sodar/sodar2/232/ Frame 17BD 0
0 168ms
54ms Document
text/html 2607:f8b0:4004:c07::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ep2.adtrafficquality.google/sodar/sodar2/232/runner.html

Requested by

Host: ep2.adtrafficquality.google
URL: https://ep2.adtrafficquality.google/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c07::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bankinfosecurity.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 1191
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000
content-encoding: gzip
content-length: 5005
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 09 Jan 2025 01:51:24 GMT
expires: Thu, 09 Jan 2025 02:41:24 GMT
last-modified: Mon, 23 Sep 2024 18:12:21 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe
www.google.com/recaptcha/api2/ Frame FA4F 0
0 179ms
68ms Document
text/html 172.253.63.147
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: ep2.adtrafficquality.google
URL: https://ep2.adtrafficquality.google/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.147 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f147.1e100.net

Software

ESF /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-g0H_IpWr_HkcUTjOP940eQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bankinfosecurity.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-g0H_IpWr_HkcUTjOP940eQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy-report-only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d"
cross-origin-resource-policy: cross-origin
date: Thu, 09 Jan 2025 02:11:15 GMT
expires: Thu, 09 Jan 2025 02:11:15 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]}
server: ESF
x-content-type-options: nosniff
x-xss-protection: 0

POST
H/1.1 204
No Content collect Show response
u.clarity.ms/ 0
288 B 61ms
59ms XHR
text/plain 4.227.249.197
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://u.clarity.ms/collect
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/s/0.7.59/clarity.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 4.227.249.197 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Accept: application/x-clarity-gzip
Referer: https://www.bankinfosecurity.com/

Response headers

Request-Context: appId=cid-v1:9c7c879b-c51a-427e-9701-218438da5f81
Access-Control-Allow-Origin: https://www.bankinfosecurity.com
Date: Thu, 09 Jan 2025 02:11:15 GMT
Vary: Origin
Server: nginx
Connection: keep-alive
Access-Control-Allow-Credentials: true

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 1095 42 B
65 B 68ms
67ms Fetch
image/gif 172.253.115.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjst6M-n6aX9ipOS1iC5clxrk-8EiSto2LeZ4rHb1wAVs9DM5R70KSELql1e5vwiFhlc0ZFxmdH0lL1lQwcDr66wtB1j1hpFAAdok53vWlQPtci--Wp4bMH-M2t50B4v2G0cu7IWTtAcDulAF7c8l6UyFjUC6oBcEDPZIDzlhc86NIVRBzHnvS0-SLZi7KX3x7XpeQQ&sig=Cg0ArKJSzC-BIYdAdY3mEAE&id=lidar2&mcvt=1000&p=0,0,480,640&tm=2913.800001144409&tu=1913.5&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20241204&bin=7&avms=nio&bs=1600,1200&mc=1&vu=1&app=0&itpl=3&adk=3082656849&rs=4&la=1&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=3232147300&rst=1736388672989&rpt=457&isd=0&lsd=0&met=mue&wmsd=0&pbe=0&fle=0&vae=0&spb=0&sfl=0&ffslot=0&reach=8&io2=0

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f155.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Thu, 09 Jan 2025 02:11:16 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 60ms
59ms Image
image/gif 23.205.106.73
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=8cde4267f2ac828e1ae5d1fbcd5ef992&svisitor=null&visitor=bd87d981-3948-421a-8d77-a1c2f4a808c0&session=f9c357a0-9256-4d47-85b1-205b4158ccc6&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2009%20Jan%202025%2002%3A11%3A16%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2009%20Jan%202025%2002%3A11%3A15%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%224097%22%7D&isIframe=false&m=%7B%22description%22%3A%22How%20many%20servers%20are%20infected%20by%20web%20shells%20designed%20to%20give%20attackers%20remote%20access%20to%20systems%2C%20but%20now%20%26quot%3Bphone%20home%26quot%3B%20to%20malicious%20infrastructure%20that%27s%20now%20abandoned%20or%20expired%3F%20Security%20researchers%20who%20posed%20that%20question%20have%20counted%204%2C000%20such%20systems%2C%20including%20in%20government%20and%20education.%22%2C%22keywords%22%3A%22web%20shell%2C%20php%2C%20shell%2C%20cybersecurity%2C%20information%20security%2C%20watchTowr%2C%20c99shell%2C%20r57shell%22%2C%22title%22%3A%22Abandoned%20Backdoors%3A%20How%20Malicious%20Infrastructure%20Lives%20On%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.bankinfosecurity.com%2Fblogs%2Fabandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790&pageViewId=e840a489-c3b8-4bdc-8ee6-8c9ee40109d5&ipv6=2001%3A550%3A1d05%3A1%3A%3A13&v=1.1.31

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.205.106.73 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-205-106-73.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f02dad-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Thu, 09 Jan 2025 02:11:16 GMT
accept-ranges: bytes
content-length: 43
date: Thu, 09 Jan 2025 02:11:16 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)

GET sodar
ep1.adtrafficquality.google/pagead/ 0
0

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 58ms
57ms Image
image/gif 23.205.106.73
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=8cde4267f2ac828e1ae5d1fbcd5ef992&svisitor=null&visitor=bd87d981-3948-421a-8d77-a1c2f4a808c0&session=f9c357a0-9256-4d47-85b1-205b4158ccc6&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2009%20Jan%202025%2002%3A11%3A17%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2009%20Jan%202025%2002%3A11%3A16%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%225098%22%7D&isIframe=false&m=%7B%22description%22%3A%22How%20many%20servers%20are%20infected%20by%20web%20shells%20designed%20to%20give%20attackers%20remote%20access%20to%20systems%2C%20but%20now%20%26quot%3Bphone%20home%26quot%3B%20to%20malicious%20infrastructure%20that%27s%20now%20abandoned%20or%20expired%3F%20Security%20researchers%20who%20posed%20that%20question%20have%20counted%204%2C000%20such%20systems%2C%20including%20in%20government%20and%20education.%22%2C%22keywords%22%3A%22web%20shell%2C%20php%2C%20shell%2C%20cybersecurity%2C%20information%20security%2C%20watchTowr%2C%20c99shell%2C%20r57shell%22%2C%22title%22%3A%22Abandoned%20Backdoors%3A%20How%20Malicious%20Infrastructure%20Lives%20On%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.bankinfosecurity.com%2Fblogs%2Fabandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790&pageViewId=e840a489-c3b8-4bdc-8ee6-8c9ee40109d5&ipv6=2001%3A550%3A1d05%3A1%3A%3A13&v=1.1.31

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.205.106.73 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-205-106-73.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "615ccf10-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Thu, 09 Jan 2025 02:11:17 GMT
accept-ranges: bytes
content-length: 43
date: Thu, 09 Jan 2025 02:11:17 GMT
content-type: image/gif
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 80ms
79ms Fetch
text/plain 2001:4860:4802:36::178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-XJ8Q4QGGRH&gtm=45je5170v886765778z86625173za200zb6625173&_p=1736388669948&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&cid=387413935.1736388672&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=2&sid=1736388672&sct=1&seg=0&dl=https%3A%2F%2Fwww.bankinfosecurity.com%2Fblogs%2Fabandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790&dt=Abandoned%20Backdoors%3A%20How%20Malicious%20Infrastructure%20Lives%20On&en=6sense&ep.asset_type=blog3790&ep.asset_categories=416%2C409%2C421&ep.asset_keywords_1=web%20shell%2C%20php%2C%20shell%2C%20cybersecurity%2C%20information%20security%2C%20watchTowr%2C%20c99shell%2C%20r57shell&ep.asset_keywords_2=&ep.asset_keywords_3=&ep.asset_keywords_4=&ep.asset_keywords_5=&ep.asset_keywords_6=&ep.asset_keywords_7=&ep.asset_keywords_8=&ep.asset_keywords_9=&ep.asset_keywords_10=&_et=380&up.company_name_6s=&up.confidence_6s=NA&up.naics_6s=&up.domain_6s=&tfd=8780
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-XJ8Q4QGGRH&l=dataLayer&cx=c&gtm=45He5170v6625173za200
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:36::178 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.bankinfosecurity.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 09 Jan 2025 02:11:17 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 91ms
91ms Image
image/gif 23.205.106.73
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.205.106.73 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-205-106-73.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.bankinfosecurity.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f020a0-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Thu, 09 Jan 2025 02:11:17 GMT
accept-ranges: bytes
content-length: 43
date: Thu, 09 Jan 2025 02:11:17 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)

POST
H2 200 v Show response
v.eps.6sc.co/ 12 B
519 B 137ms
135ms XHR
application/json 3.171.76.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://v.eps.6sc.co/v
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.171.76.38 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-171-76-38.iad89.r.cloudfront.net
Software: /
Resource Hash: 512a4f403d30a587ad5ab0b9fa7b2fd4f078249ee03f9c23c445332838f6a436

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-type: application/json
Referer: https://www.bankinfosecurity.com/

Response headers

x-amz-apigw-id: EGR6_EZ4oAMEDdg=
x-amzn-trace-id: Root=1-677f3045-6a5ad3f7361c5f5663039b7f;Parent=51c7fe1253f791fc;Sampled=0;Lineage=1:56167173:0
access-control-allow-methods: OPTIONS,POST
x-amzn-requestid: cc742b24-3f67-44d1-a8a8-695199af5d1a
via: 1.1 21fe0e69004d87d63e0024c8e921008a.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-cache: Miss from cloudfront
content-length: 12
x-amz-cf-id: KfUQGSr9MitDEzner9qfigIqsKOVW3SRPsUTl0dmKE0Jsv6Sul7UwQ==
date: Thu, 09 Jan 2025 02:11:17 GMT
content-type: application/json
x-amz-cf-pop: IAD89-P4
access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token

GET img.gif
b.6sc.co/v1/beacon/ 0
0

POST v
v.eps.6sc.co/ 0
0

OPTIONS
H2 200 v
v.eps.6sc.co/ Frame 0
0 73ms
73ms Preflight
application/json 3.171.76.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://v.eps.6sc.co/v
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.171.76.38 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-171-76-38.iad89.r.cloudfront.net
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.bankinfosecurity.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token
access-control-allow-methods: OPTIONS,POST
access-control-allow-origin: *
content-length: 0
content-type: application/json
date: Thu, 09 Jan 2025 02:11:18 GMT
via: 1.1 21fe0e69004d87d63e0024c8e921008a.cloudfront.net (CloudFront)
x-amz-apigw-id: EGR7BEj5IAMEh0w=
x-amz-cf-id: guSJ5pMUUKUkhoAkfOheV-vbvV68PoK_PAIxDcDa0mb8pxuAtXzDhQ==
x-amz-cf-pop: IAD89-P4
x-amzn-requestid: c1b87e06-5bf2-41fa-847a-08d204101e62
x-cache: Miss from cloudfront

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: ep1.adtrafficquality.google
URL: https://ep1.adtrafficquality.google/pagead/sodar?id=sodar2&v=232&t=2&li=gpt_m202501030202&jk=3533049612149708&bg=!4uGl4a7NAAYsEuUeDBI7ADQBe5WfOK4nICOgSZGVssgG3iw94GJ8MaWMclX-VPxkiREiiIXZorb9ciJxZMxVIw7_OxIjAgAAAD9SAAAAAmgBB34ANkozy56n3ZhPp2yABqlo_EhRudafnG38Yz7vcDYTKXro8JPz21qYMVpMI4jlCnJmidtZDJSIypkCrW94EF0qQqTf3j7zSTwvf9JQ3vQoruwaKBrVYnkE3KUohHt8IbTWA3zmtfuys9QJHvm9lRNEppL5FsKVEYBq5hTSkrLT_JhREBgWStQ0mnUrtz-6F7RTRGZY6pxM6_0IWV27oosWVANneupR7Gw5Vn3f7vhgahd8g43ZLxZN9xYZhqlgmKLByIUtwXK_pBTB5_5KWvl26ALS1PNEsZpUGPySF5pGEcf_kInTmIUjRx9oMdCMcTaTJquzISibabJrlq6-Ltp2e2y98au0f718GcP1_mQmVVAJAYO5rW_Sk_ou-pzYzay7CrvwayT4uvsUA6msfv2k6aypcqkzY76DiyQkjtv8xcjjIE8uqGQ8TtDVWqNC_Grb6hpoXAm-PJc_3DtRueIT3DtGQ0DRXgS2X13iZ-DHQ_I6KJbHq-Qe5aOls4V89Y0nzIF7fj_aGqfAXixAVLxJua3DI2ROzigWEDnIkkeWciJS4IMLhJfhvS-OueiCMQdgGUVgx5UC2KHpyPijCe1NufGBADHwRrN2ZPKpBdsEwjQnnYY6Ad2hGfPAV3dv7WYeCrci_1z3UvoyAX86l4iwq_JSbH2LAYeBhEhIMuuvsAhhAfpQkPji_alwYAFa_h-fQH5cImMZ9I7Xgc8xqx1wpEvTiqtico3npBpCV1CvQdTtCgaOF_AlpAI1zBIVj0YcgN4EhzfXZqRAfCU4677Ap4QiPTHMrIrjn9k4YC0EiGO7IMKX7K4a8qToOh6CYN5TG51Us4WkGjXLX82wphC-a3q-0DRdxAMX7jKYn2avlzy2dXD2l9kuM33KlHtBK2aCeL0DsSLDwWT5xkoUKX9yS4zrfsYb83ZtkEOTutltsVAHyBW5Bgfaw3-HZlzpSvPm2NTYDKV3Qc8mpybppZCojmFUfggYZzQ

Domain: b.6sc.co
URL: https://b.6sc.co/v1/beacon/img.gif?token=6sense-temp-analytics&svisitor=null&visitor=bd87d981-3948-421a-8d77-a1c2f4a808c0&session=f9c357a0-9256-4d47-85b1-205b4158ccc6&event=https%3A%2F%2Feps.6sc.co&q=%7B%22name%22%3A%22https%3A%2F%2Feps.6sc.co%2Fv3%2Fcompany%2Fdetails%22%2C%22entryType%22%3A%22resource%22%2C%22startTime%22%3A3781.300001144409%2C%22duration%22%3A272.6999988555908%2C%22initiatorType%22%3A%22fetch%22%2C%22deliveryType%22%3A%22%22%2C%22nextHopProtocol%22%3A%22%22%2C%22renderBlockingStatus%22%3A%22non-blocking%22%2C%22workerStart%22%3A0%2C%22redirectStart%22%3A0%2C%22redirectEnd%22%3A0%2C%22fetchStart%22%3A3781.300001144409%2C%22domainLookupStart%22%3A0%2C%22domainLookupEnd%22%3A0%2C%22connectStart%22%3A0%2C%22secureConnectionStart%22%3A0%2C%22connectEnd%22%3A0%2C%22requestStart%22%3A0%2C%22responseStart%22%3A0%2C%22firstInterimResponseStart%22%3A0%2C%22responseEnd%22%3A4054%2C%22transferSize%22%3A0%2C%22encodedBodySize%22%3A0%2C%22decodedBodySize%22%3A0%2C%22responseStatus%22%3A200%2C%22serverTiming%22%3A%5B%5D%2C%22metadata%22%3A%7B%7D%7D&isIframe=false&m=%7B%22endpoint%22%3A%22epsilon.6sense.com%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.bankinfosecurity.com%2Fblogs%2Fabandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790&pageViewId=&d=1&v=1.1.31

Domain: v.eps.6sc.co
URL: https://v.eps.6sc.co/v

Verdicts & Comments Add Verdict or Comment

271 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

103 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.bankinfosecurity.com/	1970-01-21 02:20:03	Name: PHPSESSID Value: 34oq2i7a12od8aaoujemcrdjl3
www.bankinfosecurity.com/	1970-01-21 02:21:15	Name: _advert Value: false
www.bankinfosecurity.com/	1970-01-21 02:19:52	Name: visitorip Value: 10.187.187.9
.sharethis.com/	1970-01-21 11:05:24	Name: __stid Value: ZHuAA2d/MD4AAAAICGnUAw==
.sharethis.com/	1970-01-21 11:05:24	Name: __stidv Value: 2
.bankinfosecurity.com/	1970-01-21 11:05:24	Name: fpestid Value: xpWB5j2K2zlAScyvaRnFWIPDpJlZg77nkgQRCBXV2ioY0Jka9GGFrT7-iAqaOki1t29Rfg
.bankinfosecurity.com/	1970-01-21 02:19:48	Name: lotame_domain_check Value: bankinfosecurity.com
.crwdcntrl.net/	1970-01-21 08:48:36	Name: _cc_dc Value: 0
.crwdcntrl.net/	1970-01-21 08:48:36	Name: _cc_id Value: fd8fd2b36947557f8de91de6303753bf
.bankinfosecurity.com/	1970-01-21 08:48:36	Name: _cc_id Value: fd8fd2b36947557f8de91de6303753bf
.bankinfosecurity.com/	1970-01-21 02:21:15	Name: panoramaId_expiry Value: 1736475070926
.ml314.com/	1970-01-21 11:05:24	Name: pi Value: 3649708125471637511
.ml314.com/	1970-01-21 02:39:58	Name: tp Value: 4%253B01%252F09%252F2025%2B02%253A11%253A12
www.bankinfosecurity.com/	1970-01-21 11:55:48	Name: _gd_visitor Value: bd87d981-3948-421a-8d77-a1c2f4a808c0
www.bankinfosecurity.com/	1970-01-21 02:20:03	Name: _gd_session Value: f9c357a0-9256-4d47-85b1-205b4158ccc6
.bankinfosecurity.com/	1970-01-21 11:55:48	Name: _mkto_trk Value: id:051-ZXI-237&token:_mch-bankinfosecurity.com-fa3f40c0a4cc1debf321231c34da7690
.adsrvr.org/	1970-01-21 11:05:24	Name: TDID Value: e919bb23-4ac0-4883-b0fa-f765eeb0f13c
.demdex.net/	1970-01-21 06:39:00	Name: demdex Value: 59967476515269698411099131570334069125
.bankinfosecurity.com/	1970-01-21 11:55:48	Name: _ga Value: GA1.1.387413935.1736388672
.adnxs.com/	1970-01-21 04:29:24	Name: XANDR_PANID Value: 8_mHWPRkgirRGegUg-sAJ77P_Fy_T1gODwz401ioyD5SVC-DHYr3NqKRpcYyx5EJppQUuMLi2Q6ocWy6rK5AsHJLFPJIP5a__xmAjPovx6I.
.adnxs.com/	1970-01-21 11:55:48	Name: receive-cookie-deprecation Value: 1
.adnxs.com/	1970-01-21 04:29:24	Name: uuid2 Value: 3258195736511359540
.bankinfosecurity.com/	1970-01-21 11:55:48	Name: _ga_2RK1HGW2E4 Value: GS1.1.1736388672.1.0.1736388672.0.0.0
.dpm.demdex.net/	1970-01-21 06:39:00	Name: dpm Value: 59967476515269698411099131570334069125
.ml314.com/	1970-01-21 02:19:48	Name: u Value: aHR0cHM6Ly93d3cuYmFua2luZm9zZWN1cml0eS5jb20v
.linkedin.com/	1970-01-21 02:21:15	Name: lidc Value: "b=VGST01:s=V:r=V:a=V:p=V:g=3422:u=1:x=1:i=1736388672:t=1736475072:v=2:sig=AQEXxt6Xag3YuopNa2yUpSR3fJf9AZgG"
.linkedin.com/	1970-01-21 04:29:24	Name: li_sugr Value: 10b28277-5eb8-42ac-8550-431d7d90aade
.linkedin.com/	1970-01-21 11:05:24	Name: bcookie Value: "v=2&505a2e16-7099-4cfe-8e08-07a3d48d0600"
www.clarity.ms/	1970-01-21 11:05:24	Name: CLID Value: 8fede6fad50b4e15a9cbd24528e6d87f.20250109.20260109
.linkedin.com/	1970-01-21 03:03:00	Name: UserMatchHistory Value: AQKOuHDDHGsbCgAAAZRI1Hy97jqhdMHvLsio-jOvPbLMjCNYhmi91L3cXZDALALaTTPDdBiwxBGr9g
.linkedin.com/	1970-01-21 03:03:00	Name: AnalyticsSyncHistory Value: AQJdajZoXk4UjgAAAZRI1Hy9qUuM0TgO_cBoX5kNkQMsgoJiakaUi29zWYxu1Bh7B4-gR1_rpOLuHPaxllGRgQ
.bankinfosecurity.com/	1970-01-21 11:05:24	Name: _clck Value: 1sjsil2%7C2%7Cfsf%7C0%7C1835
.bankinfosecurity.com/	1970-01-21 11:55:48	Name: _ga_XJ8Q4QGGRH Value: GS1.1.1736388672.1.0.1736388672.0.0.0
www.bankinfosecurity.com/	1970-01-21 02:19:50	Name: 57942 Value:
www.bankinfosecurity.com/	1970-01-21 02:19:50	Name: 58312 Value:
www.bankinfosecurity.com/	1970-01-21 02:19:50	Name: 58313 Value:
www.bankinfosecurity.com/	1970-01-21 02:19:50	Name: 59942 Value:
www.bankinfosecurity.com/	1970-01-21 02:19:50	Name: 57928 Value:
www.bankinfosecurity.com/	1970-01-21 02:19:50	Name: 58306 Value:
www.bankinfosecurity.com/	1970-01-21 02:19:50	Name: 59941 Value:
www.bankinfosecurity.com/	1970-01-21 02:19:50	Name: 57927 Value:
www.bankinfosecurity.com/	1970-01-21 02:19:50	Name: 57941 Value:
www.bankinfosecurity.com/	1970-01-21 02:19:50	Name: 58305 Value:
.bankinfosecurity.com/	1970-01-21 11:41:24	Name: __gads Value: ID=3566653a9acf41fe:T=1736388672:RT=1736388672:S=ALNI_Ma02gphxotMHwlJOUH5w3mvx6wnLw
.bankinfosecurity.com/	1970-01-21 11:41:24	Name: __gpi Value: UID=00000fcc5ee39d3d:T=1736388672:RT=1736388672:S=ALNI_MZfyRZhNF1C-chi2WIHHlZKkUM7Xg
.www.linkedin.com/	1970-01-21 11:05:24	Name: bscookie Value: "v=1&20250109021112fdbb5537-8ba6-46ef-8be0-28eab77d9d59AQEfu1gygCJucCsE8m9_UWL67pu2BJ9q"
.bankinfosecurity.com/	1970-01-21 06:39:00	Name: __eoi Value: ID=20ee1aaa17f8f2fe:T=1736388672:RT=1736388672:S=AA-AfjaB_l16-x7HpOiBlInoBnEO
.t.sharethis.com/	1970-01-21 03:03:00	Name: pxcelPage_default_c010_B Value: 0_6_1736388672982
.doubleclick.net/	1970-01-21 11:55:48	Name: IDE Value: AHWqTUldrTh_L18MMVvh7tfBwNBwJ101A24QqCoXsUTcuh3SWCQv94afcTHMdTKpt3o
.bankinfosecurity.com/	1970-01-21 02:21:15	Name: _clsk Value: gvgecj%7C1736388673109%7C1%7C1%7Cu.clarity.ms%2Fcollect
.exelator.com/	1970-01-21 05:12:36	Name: EE Value: "9621d637d102c8866cefd0543ca942d1"
.yahoo.com/	1970-01-21 11:05:46	Name: A3 Value: d=AQABBEEwf2cCECgdufl8VCSBMDJQZ2t7rVUFEgEBAQGBgGeJZ9ww0iMA_eMAAA&S=AQAAAoNTFw7I6sAP3EqkBas90f4
.exelator.com/	1970-01-21 05:12:36	Name: ud Value: "eJxrXxzq6XKLQcHSzMgwxczYPMXQwCjZwsLMLDk1LcXA1MQ4OdHSxCjFcHFZatGCpaXFqSlJh5ZU5JTkNK0uiw91jHdz9PX0iVzmnFGUn5u6AiwU5hq02NDYcEl%252BUWb6otDgxUUpaQyLSopPBZ9SyQIAfnopqw%253D%253D"
disqus.com/	1970-01-21 02:19:50	Name: __jid Value: 5sutpeg1hqcgfn
.disqus.com/	1970-01-21 11:05:24	Name: disqus_unique Value: 5sutpj21u0m39r
.eyeota.net/	1970-01-21 11:05:24	Name: mako_uid Value: 19448d47feb-50240000010a51a5
.eyeota.net/	1970-01-21 02:19:49	Name: SERVERID Value: 20901~DM
.pippio.com/	1970-01-21 11:05:24	Name: did Value: vnYGcjlkdfEiDSoS
.pippio.com/	1970-01-21 11:05:24	Name: didts Value: 1736388673
.pippio.com/	1970-01-21 03:46:12	Name: nnls Value:
io.narrative.io/	1970-01-21 11:55:48	Name: io.narrative.guid.v2 Value: 523c976d-0afd-4899-93bf-74e18b5c2add
.rqtrk.eu/	1970-01-21 02:29:53	Name: browser_id Value: 1:400753ca-28e4-4926-8f79-dfb2ed70aab4
.rezync.com/	1970-01-21 11:41:24	Name: zync-uuid Value: d0ac037c-52f7-463d-8785-69e0cf968616:1736388674.0096993
.pippio.com/	1970-01-21 03:46:12	Name: pxrc Value: CMHg/LsGEgUIlCkQABIFCOUrEAASBQjmKxAAEgUI5ysQABIFCOgrEAASBQjpKxAAEgUI6isQABIFCOsrEAASBQjsKxAAEgUI7SsQABIFCO4rEAASBQjVQxAAEgYI36wrEAESBgjjrysQABIGCO2vKxAAEgYI7q8rEAASBgjvrysQABIGCPCvKxAAEgYI8a8rEAASBgjyrysQABIGCPOvKxAA
.tapad.com/	1970-01-21 03:46:12	Name: TapAd_TS Value: 1736388674203
.tapad.com/	1970-01-21 03:46:12	Name: TapAd_DID Value: da55c2b5-e08d-427d-b451-3baeb57d8cd1
.analytics.yahoo.com/	1970-01-21 11:05:24	Name: IDSYNC Value: "19b8~2muq:19cg~2muq"
.tapad.com/	1970-01-21 03:46:12	Name: TapAd_3WAY_SYNCS Value: 1!218
sync.srv.stackadapt.com/	1970-01-21 11:05:24	Name: sa-user-id Value: s%3A0-a4533711-055c-547a-73ad-a9b8e938b7fc.3UjGAUtZ3J6exqeD7PWzxhaOb%2BLgLSuby3HJ%2BhbjPYk
.srv.stackadapt.com/	1970-01-21 11:05:24	Name: sa-user-id Value: s%3A0-a4533711-055c-547a-73ad-a9b8e938b7fc.3UjGAUtZ3J6exqeD7PWzxhaOb%2BLgLSuby3HJ%2BhbjPYk
sync.srv.stackadapt.com/	1970-01-21 11:05:24	Name: sa-user-id-v2 Value: s%3ApFM3EQVcVHpzram46Ti3_CaEdkk.acoDXVJAypx4d7jxGhPzxKlVvNhuAEuyqcZMCmSsVZc
.srv.stackadapt.com/	1970-01-21 11:05:24	Name: sa-user-id-v2 Value: s%3ApFM3EQVcVHpzram46Ti3_CaEdkk.acoDXVJAypx4d7jxGhPzxKlVvNhuAEuyqcZMCmSsVZc
sync.srv.stackadapt.com/	1970-01-21 11:05:24	Name: sa-user-id-v3 Value: s%3AAQAKIOEPig05Vqz7wDFSZnir7E4XyBt1YVycXWaR4RSf1G3eEGcYBCDC4Py7BjABOgSAOSS3QgRP4CQ-.PHyboH5Mvy0lfN3nWtEFMtNE1zDm0m89t9BhiV77U74
.srv.stackadapt.com/	1970-01-21 11:05:24	Name: sa-user-id-v3 Value: s%3AAQAKIOEPig05Vqz7wDFSZnir7E4XyBt1YVycXWaR4RSf1G3eEGcYBCDC4Py7BjABOgSAOSS3QgRP4CQ-.PHyboH5Mvy0lfN3nWtEFMtNE1zDm0m89t9BhiV77U74
.adsrvr.org/	1970-01-21 11:05:24	Name: TDCPM Value: CAESFgoHZDB0cm8xahILCLT2ocKdl9g9EAUSEgoDYWFtEgsIkOTz7-PkzD0QBRIVCgZnb29nbGUSCwj4pMLUnZfYPRAFEhcKCGxpdmVyYW1wEgsIoqfY0p2X2D0QBRIUCgV0YXBhZBILCISu8tOdl9g9EAUYASACKAIyCwjEpPWAtJfYPRAFOAFaBXRhcGFkYAI.
.amazon-adsystem.com/	1970-01-21 08:41:24	Name: ad-id Value: A0g88aOHwESosvm0JRq7t-0
.amazon-adsystem.com/	1970-01-21 11:55:48	Name: ad-privacy Value: 0
.kargo.com/	1970-01-21 11:05:24	Name: ktcid Value: df75d1d7-f4a2-0a47-52be-6fc01288d85b
.rfihub.com/	1970-01-21 11:41:24	Name: rud Value: H4sIAAAAAAAA_-MSNrQ0NzM2MDMyMDM0NTCzNLc0NBLiM9SNNM7TrfLxyMxPz8gEAGc4xSElAAAA
.rfihub.com/	1969-12-31 23:59:59	Name: euds Value: H4sIAAAAAAAA_wXBwRGAIAwEwI_txDkM3CV24wQohMrdPZcmvoKrbDxb1unTQjGMuVA7GWx8m5weQfUbSGb6D2Bpif86AAAA
.rfihub.com/	1969-12-31 23:59:59	Name: ruds Value: H4sIAAAAAAAA_-MSNrQ0NzM2MDMyMDM0NTCzNLc0NBLiM9SNNM7TrfLxyMxPz8gEAGc4xSElAAAA
.scorecardresearch.com/	1970-01-21 11:41:24	Name: UID Value: 12Bb0e5d0cc0b946c0cfb401736388674
.scorecardresearch.com/	1970-01-21 11:41:24	Name: XID Value: 12Bb0e5d0cc0b946c0cfb401736388674
.reson8.com/	1970-01-21 11:05:24	Name: RCID2 Value: C3E6EE52219CE5D23CFC523EB505CE60
.contextweb.com/	1970-01-21 10:58:12	Name: V Value: MxVce99gzcYt
.contextweb.com/	1970-01-21 10:58:12	Name: VP Value: part_MxVce99gzcYt
bh.contextweb.com/	1969-12-31 23:59:59	Name: INGRESSCOOKIE Value: ebf32185b427354d
live.rezync.com/	1970-01-21 11:41:24	Name: sd-session-id Value: .eJwNikEOgyAQAP-yZ2kWkF3WzxgDmNBWawUuNf693GYyc8F8pHNb9rRXmOrZ0gDhnbsVmC6IuXxbJwiutHo8jW64WTlhgJJ_W3r1pIXJIhkk7ZCERRu4e0-l5M8-59ifiEtAy0E5s7IayUbl2TtFkjCsQp40TZotWe-JxweikIiF-w_IVC3b.Z38wQg.3qQz7djXJry00mcIqH-UXwHMAMI
.rlcdn.com/	1970-01-21 03:46:12	Name: pxrc Value: CMDg/LsGEgUI6AcQABIFCO5HEAISBQjbThAAEgYIxOoBEAISBgjS6gEQAg==
.rfihub.com/	1970-01-21 11:41:24	Name: eud Value: H4sIAAAAAAAA_zvFyGtobmxmbGFhZm5iZmE2Sdg8xSAx2cDYPFnX1CjNXNfEzDhF18LcwlTXzDLVIDnNEqjI0MwKoUnPwMDSzNLSeJYwkkmmhmaL0PgAdex2p2oAAAA
.turn.com/	1970-01-21 06:39:00	Name: uid Value: 3628373636666219125
.w55c.net/	1970-01-21 11:50:03	Name: wfivefivec Value: Lk3m1hsf1TvI0W5
.bidr.io/	1970-01-21 11:48:18	Name: bito Value: AAbaLE7O_mEAABY6qsfz8g
.bidr.io/	1970-01-21 11:48:18	Name: bitoIsSecure Value: ok
.w55c.net/	1970-01-21 03:03:00	Name: matchliveramp Value: 5
.rlcdn.com/	1970-01-21 11:05:24	Name: rlas3 Value: xRZS9RvK0FS5bBS4w+iYLyRAKU1RyLQE/OIqjwByDgI=
.bing.com/	1970-01-21 11:41:24	Name: MUID Value: 020073F4376F648D287C669B36FF6531
.c.bing.com/	1970-01-21 02:29:53	Name: MR Value: 0
.c.bing.com/	1970-01-21 11:41:24	Name: SRM_B Value: 020073F4376F648D287C669B36FF6531
.c.clarity.ms/	1969-12-31 23:59:59	Name: SM Value: C
.clarity.ms/	1970-01-21 11:41:24	Name: MUID Value: 020073F4376F648D287C669B36FF6531
.c.clarity.ms/	1970-01-21 02:29:53	Name: MR Value: 0
.c.clarity.ms/	1970-01-21 02:19:49	Name: ANONCHK Value: 0

20 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	warning	URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790 Message: [DOM] Found 2 elements with non-unique id #asset_url: (More info: https://goo.gl/9p2vKq) %o %o
recommendation	warning	URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790 Message: [DOM] Found 2 elements with non-unique id #chk_stp1-1: (More info: https://goo.gl/9p2vKq) %o %o
recommendation	warning	URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790 Message: [DOM] Found 2 elements with non-unique id #chk_stp1-2: (More info: https://goo.gl/9p2vKq) %o %o
recommendation	warning	URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790 Message: [DOM] Found 2 elements with non-unique id #chk_stp1-3: (More info: https://goo.gl/9p2vKq) %o %o
recommendation	warning	URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790 Message: [DOM] Found 2 elements with non-unique id #newsletter-pop-under-txt-other-job-function: (More info: https://goo.gl/9p2vKq) %o %o
recommendation	warning	URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790 Message: [DOM] Found 2 elements with non-unique id #newsletter-pop-under-txt-other-title-level: (More info: https://goo.gl/9p2vKq) %o %o
recommendation	warning	URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790 Message: [DOM] Found 2 elements with non-unique id #pop_BIS_enews1: (More info: https://goo.gl/9p2vKq) %o %o
recommendation	warning	URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790 Message: [DOM] Found 2 elements with non-unique id #pop_CAIS_enews1: (More info: https://goo.gl/9p2vKq) %o %o
recommendation	warning	URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790 Message: [DOM] Found 2 elements with non-unique id #pop_DBT_enews1: (More info: https://goo.gl/9p2vKq) %o %o
recommendation	warning	URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790 Message: [DOM] Found 2 elements with non-unique id #pop_IR_enews1: (More info: https://goo.gl/9p2vKq) %o %o
recommendation	warning	URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790 Message: [DOM] Found 2 elements with non-unique id #registration-select-country: (More info: https://goo.gl/9p2vKq) %o %o
recommendation	warning	URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790 Message: [DOM] Found 3 elements with non-unique id #registration-select-job-function: (More info: https://goo.gl/9p2vKq) %o %o %o
recommendation	warning	URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790 Message: [DOM] Found 3 elements with non-unique id #registration-select-title-level: (More info: https://goo.gl/9p2vKq) %o %o %o
recommendation	warning	URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790 Message: [DOM] Found 3 elements with non-unique id #registration-text-phone: (More info: https://goo.gl/9p2vKq) %o %o %o
recommendation	warning	URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790 Message: [DOM] Found 2 elements with non-unique id #registration-txt-company: (More info: https://goo.gl/9p2vKq) %o %o
recommendation	warning	URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790 Message: [DOM] Found 2 elements with non-unique id #registration-txt-email: (More info: https://goo.gl/9p2vKq) %o %o
recommendation	warning	URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790 Message: [DOM] Found 3 elements with non-unique id #request-share-txt-email: (More info: https://goo.gl/9p2vKq) %o %o %o
recommendation	warning	URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790 Message: [DOM] Found 3 elements with non-unique id #request-share-txt-first-name: (More info: https://goo.gl/9p2vKq) %o %o %o
recommendation	verbose	URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790 Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o
recommendation	verbose	URL: https://www.bankinfosecurity.com/blogs/abandoned-backdoors-how-malicious-infrastructure-lives-on-p-3790 Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com
051-zxi-237.mktoresp.com
130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com
21aaef15263171502b5a-3fc6a64a094676b060fa7dc8c4490be9.ssl.cf1.rackcdn.com
4a7efb2d53317100f611-1d7064c4f7b6de25658a4199efb34975.ssl.cf1.rackcdn.com
5e8e59f6e1ebb9fa9791aec59a922de3.safeframe.googlesyndication.com
6d63d49ccb7c52435540-5070aa97eaa2b8df4eb5a91600e69901.ssl.cf1.rackcdn.com
752b069ec945bee67d86-1021436e05aad7b2347bf3096cc7e309.ssl.cf1.rackcdn.com
75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com
b.6sc.co
bankinfosecurity.disqus.com
bcp.crwdcntrl.net
buttons-config.sharethis.com
c.6sc.co
c.bing.com
c.clarity.ms
c.disquscdn.com
d1eoo1tco6rr5e.cloudfront.net
dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com
disqus.com
dnn506yrbagrg.cloudfront.net
dpm.demdex.net
ep1.adtrafficquality.google
ep2.adtrafficquality.google
eps.6sc.co
epsilon.6sense.com
fa94d5c47256403c613d-7164cafcaac68bfd3318486ab257f999.ssl.cf1.rackcdn.com
fonts.googleapis.com
fonts.gstatic.com
ib.adnxs.com
idsync.rlcdn.com
in.ml314.com
insight.adsrvr.org
ipv6.6sc.co
j.6sc.co
l.sharethis.com
match.adsrvr.org
ml314.com
munchkin.marketo.net
nexus.ensighten.com
pagead2.googlesyndication.com
platform-api.sharethis.com
platform-cdn.sharethis.com
ps.eyeota.net
px.ads.linkedin.com
px4.ads.linkedin.com
script.crazyegg.com
securepubads.g.doubleclick.net
sjs.bizographics.com
snap.licdn.com
t.sharethis.com
tpc.googlesyndication.com
u.clarity.ms
v.eps.6sc.co
worker.ismgcorp.com
www.bankinfosecurity.com
www.clarity.ms
www.google-analytics.com
www.google.com
www.googletagmanager.com
www.googletagservices.com
www.linkedin.com
b.6sc.co
ep1.adtrafficquality.google
v.eps.6sc.co
104.130.251.6
104.19.147.8
13.107.42.14
142.251.179.157
142.251.179.94
15.197.193.217
151.101.0.134
172.253.115.155
172.253.63.147
18.160.45.62
18.165.83.61
18.233.177.54
192.28.147.68
199.232.192.134
20.110.205.119
2001:4860:4802:36::178
23.205.106.73
23.205.106.74
23.205.106.89
23.43.207.143
23.60.78.137
23.9.166.209
2600:1408:c400:24::17da:d815
2600:1408:c400:24::17da:d819
2600:1408:c400:d::17cd:6a49
2600:9000:250b:ce00:c:abe:f440:93a1
2600:9000:26c1:b000:1d:85c3:6640:93a1
2600:9000:27d1:5200:6:8656:f5c0:93a1
2600:9000:28ac:a600:2:8f43:5780:93a1
2607:f8b0:4004:c07::84
2607:f8b0:4004:c09::84
2607:f8b0:4004:c1b::5f
2607:f8b0:4004:c1d::61
2607:f8b0:4004:c1f::9b
2620:1ec:21::14
2620:1ec:bdf::40
2620:1ec:c11::237
3.13.151.97
3.167.119.120
3.171.100.53
3.171.76.38
3.33.220.150
34.117.77.79
34.228.175.96
35.175.32.137
35.244.154.8
4.227.249.197
44.196.77.126
50.56.167.254
64.233.180.156
68.67.181.230
75.2.108.141
99.83.231.3
00607e74a1323e12d3cbbd248cceba1fc202fadfaff07f486c5e6b9e209d4992
0332f2d43c66bd180b78010f21d4e7ea26a972885b3e9e475a9d46374345dcf7
03ecdc990f13413dbd1948f27773064ab143a4ae4ddac0cb3b1fe3953932d94f
04d304d7ee49ac157f146382a46f02a666279bd7f29074f50e863b88f2affae9
05f2bd204d6a112236e1cdfc2fbb4fa8f678628bf20d77b00fba7c1cbbb06052
07bfb0d3a8042b211ef193a2ac689dbb3b95a3f501c6754557c259cedfe96aca
081ad4206bfeb1950c8382b5bc32aac31c4698598563d87080ee67a8fc5318d0
0bf225d89007baa905f895a86688c43f28331d0ff721b8ea0c95abbf8541ebf7
0d4bd3f0ceb717b4b3d8e265d9ad3e082fb0aaf2da61a1c2b4df0e84c704b7fc
0d8601a776b7dc777cd23bc42392d05a43df0d6402328e8913b58811083b513d
0d93c445a67d71996119f9eff796d49f0345670d58ce927b278fa2de7b9397e9
0f923e8e4eed10ce979b73e6a23151dd251c53d87e8add85498e557c9889a873
0fd28fece9ebd606b8b071460ebd3fc2ed7bc7a66ef91c8834f11dfacab4a849
0fe54b2d311e56b08c2f94ba0cf9cd656f16faadc4ca50899cc8dac904119f29
1024c10cc5d758e65707a1e8374a350873cce5b6d94e9845da7ba39b98b60d6f
113748801759e566d21145852c42316606436b6b916e629061e14266471272be
12ee11d0b7e5180cd74d66f09b6c6a9a0525eda351ce2e6b732454346791f6d4
1a0bbdba57f90a60fef89419fc940d8eae55c5b0d12ecbadde2beaef32ab2d90
1a2c5fa3e14be0421b0524cea968dc24656f6129df9d7ccc7a71f827bf725bac
1ba34b6430aca50d20ac17d7d2e523ad9a3d7ba764a0c85fec35f91afd480bef
200ea2792715456ea62f7de0ab54444d6f417f183f61ecfb53bbfa78476194f9
20b9ebf817b8dc640c06e993e5ae1127a6eb6b0c9fc6acbfb288f3b3a82405be
222f138c4f37e63eae6a92faa98fb389c5724edc99eceff153d45d32951746fc
23da1dd7c3c9ea31b5cba0b16ddc8bd521f11ba2b622692f4ec5703fc7555221
247d04c4d14c60a79c16245a74a792a662f9e7adf784d68edd4520a35ec90251
256a489beea4a14eca458f6e5436758f1fcb8dd34034d3c36dd21b22a5841f3b
26d0fa36f3c233c5b08ee8e56fd1525bd432967905b05b1303da8b3dcd1c2823
2c1571db2b0e3d38ea6db662c445b6abad4fa93c341d0b86f81f73752048cee2
2c44dc80bb23cfd60d76addb8444f0f70f435fe736e1b1db1e04805726d0d4f2
2c4a5aac7fb6351c30888a6f8073d313a19aad966543d1faaa10e75a6a1e062c
321ddda1f2272a2c711cadec06908c4bab712cbf7c364e0e8ad81f756170a9a8
3247aea10f4255589a28a38f85499a9772991f6150ebd9d61fdc47b15cbf47a5
32c004bf0287e5e7442846d1c7978405dca03c3eed0af09e658d21e2bac9adc5
34dafcef59776ba3b559c86c0996b3a11866b5121e7706fffccd1aff8ef8556d
34f6a8e7792bc499cdcfcfae70d35a02766db4471551ec36844c3214357d6163
3571f8456a5b0cb9535c6971a5145aeead7fb99334e9e30d7c21daca413d9f67
369bffbe203ed6d6454c3b45ee0a20f216518f676d7520bc5ed03a87ddc3f2b8
3b8b9025df7dbdf3b20fd4931d763b190ad46a80de9e14ae5ab1db491a6bde59
3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa
3e505267f44a11bf0168bcaec3ca176dae6b1cc0d3bde4237ed79ea02ecb18a9
3fede2d0c0a8c93b0c5d0ab0c38289a5743bb88720255b8298c520d2e3d90939
40c1dd784124aa07cb110d6f61620f6eb991acae58b1b7cbc963961d7fee5c67
420b8db005b9223c5e1d9ba4140abc2356eac8069735ad8c870fcc8313828de4
43f87e4bfd7daf44d35bbec88d39c7a4f13322821f2c001ff2e125cdc01d1bb9
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
45613a1070573b208d73c7919993b67c5a9ebf0c4450a00aadc671017fc01dd7
4c57a77761f2639985b760e69c5bbaffceb6100559dcf3296d3cc96ea6a0d305
4e2db1bef009e01901b4083a153f1607301428277a76f508e659dc2849cefa04
4e7304371ef9bcaea396e8928a9647f8306c296b9195c8763848d70c7f6f1390
4e88dcbac59e33817a032b1c1666118c6bdf3d140fe07f6943ae5cf9c4767adc
50072ae7930cf008d6493766b86605cb41373e07a04f2b2e17bc8d508425ac28
512a4f403d30a587ad5ab0b9fa7b2fd4f078249ee03f9c23c445332838f6a436
5133e2e1a213ca44a8adb1f42f103a2d2e495849dfa4d42bf67c04fcc962e577
52a3375d3e617f1dbf29bab11c5942193fba6263802c4b2cec96a0a26970e4a9
55096bdb72819db90b109af46d94fce8e71551e9c7a8464a6dcf930f60bb7f39
55d1c842ceae117300fd3220131eb6c306ba65da20d3e5da96d56353946b6c4e
562d36d2795c96712917263a0534870011a5b0291045504ff02f96f03a54c3b2
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
56a9fb61a8920c2f06cad160e7ed7a521c0c384ed72379e5f236e1d557c0e34d
56d67bff3c0d11af3f7b09d825eca83408c0017d7c34a03678f0f9433a97819d
573860cbe93b28320024b6b7be1859bb87c236947aa7af25e37af26175c15d9c
589c63e27d66d704b2484604035c62fbe5250943ac3f1c83f6bb6fc8e80440ae
58bfe7b806ee50b2dcafe2c659acb2eaf66aef4c77e03a64bbf77bf5ce63b0ea
59400de556b42dee4aa3e6f7b73676a81e260d35481b6d8d77656ee45ae9484b
5983be7036fc26270495fd1a318795ac3538b9e8e8a34dff25685a3e4fbe3858
5a5672523abbb16f5eac375b98f12d7bb28dc8f476d8ce8e01caafd4efd85c84
602d8ece71d11c8fe67abef151f2b984296c1c20f2670e5d4f72039998a26069
624c34a5245d2d14f6e741da5da91a1adb26b29c17f364f24628c509d91e7008
65aa03b8baf6c12db882c7ff9194eac095cb6107256cc9b05889c368ba2f5e90
69278fe35261286939e10f3832f461f9bf6addf267ffe0134e26be3d313dbd7d
699e4d441a6c069832f33550b732d90d5263edf82da5c2ddffd9236e3910a994
6caf904d3dfc096ae3b4e40aed43181686bdf1bac4722b3dd2a775ab6d2a9992
719087413e175004c74e34af6ef370b257e42f589df16014f8cee92c91aa30c8
75819104c325a7041c8e863ca354d37fd40602627c1a7ba3c929d7ebfd075f37
768d97ec0916217ae82c70aeda3a61b9b0dab344edc4a3240a4f7cd94af00307
76d3bbf6509834b8e39342ef129df55612a7db03356366abb13399b8d389d25a
76ffdc5337cd5a509f15d70767b85a793aead82975d0d86912e1607e963c9aed
78cf63898c91ce3b95e37bc53e07adba5c2ee705ff28c2dd1dd784173c264ad1
7c1f9970a3c60af9df93f0a37b87a459d0ca5684ac291dd18d566bc542197556
7caf9fb1d97edb1a1459b0de03b4fa7c78df380d1e19e034e6e857e1f76bbedf
7d5e2f10ede290b4ad0d1bb2861dfacae9754453f352923e85e7d101a7686b00
7e7a3444709b6476152c274f3deafaa6f238c20d9badd36ce9ec56c67a86a1b9
7eec79b40363103fe8930508db7a14e4e4c2e2bcd90e97448b487bd50958694b
7fd4326338952187b22295242cd4fa2c18a0a45061b6c3c448500e8bf6b61b7f
83146c62110f911cbc9e66daa824d1f4e1d8f8aa6508aa45fe061932db65fa27
899d1ec3c095342571d3be2091ec6f984d4cc82390d1f61945c391fa035b00d9
8a8d2287ffb5696820d375d1ccda78fb7121a19726ba0beaff1a5e6f16330111
8d3c5d3745d81d914406a42405c43f0d9cb66bfe29f3f1f24a0729dae7fc2cc8
8e87002c7c7950edfcba2fcc16efb4a10cc88a96b98700a5ae9fe6d8a9449fb6
8f5384cbf460f5da0c25faeecfa5e8be312f5bd1b4e2c8f80c81f30d1066bebf
91283916a6e9695687bb57ed913fe6fae10324ebfcfa06d31209357e56ebc004
93f466f6b1a81c848140e51c839a5372034ab22182601e86dd86947ad3a7fe94
941cbbc71aff530567694df4b6753b0a72279ae87fb83cbf6e5c08dd52e01284
944a37f694b55de268a0bf52dbae4e12f12c4ae09ee5c8d213ba05075c2865dd
966532d57c30c928493774e71d48b17683c4197d670851f4a5a84ec3bebff61d
96cd9c1e55d92a0f67176a4c06a40a9c4a5f4974e3d82255da3f171c2e705361
9868d92483cafd2077c0f23bdded0f15eb319f9302c9ea3817da9d1bdceaa596
98d32b00fca86fc6994df33302e051a6ad03461a43ff5797d5b10ace4cf4772f
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
9a13fb5949ace41b41f2baafd0749b4a9e3b98a86082246980d785c0f0e2f494
9a78701f6e49e71ab4a15f85c515418a37fb8e7e179b2686faa795765a402bac
9b65740b89a4c7a62b7ddb6e50baa1f552d0753954a20e5143f37da7b3026058
9e932fc7917418932aac3cda29691c2efb46f8f849b8c38ac7b04696ee42396b
9ef059261896ab1fd56a7f7b47dd35ccb70099fc3ba4871089c3e121e077265d
a297bfad6d37def57f78fa6e2a2c3b48269a1507b0280f547df0c597b5cfa7c5
a48d321e1f30c017b6d9407b160c7253ee3dee7e1b28c9f49e57e40c52b4a71e
a49d2f06cb9d6255bdc47902f601bd515ff40df3f08bc0d186d5f126950816ad
a73c52320a301cf788b5de8381cdada7066bfee0d60e9edf91d68f2cac6a3c2b
a782015ceceb595c8305a944456587c4f2c4b3f0ca82aac8e5c6d7b33138f392
a98945419e4fe40565e179dbfe55c164440b599c74a63d47c8dceec5fdc6eae4
ad5199d07e0c2af95f5a9b771bcdad7bfc9630daa166cb02423b5b696b2a8bd4
adb521de8a2d2756a97673c7a83fe2ec7d8892cbdb31efbaec231fbb52553bed
ae3c472ff47a96820c1acdf9574b231a88f62a006b84d320eb313af40f32f2db
af4445e937d150f1780fa6d1b3d7bd433b5c6d0489dc5d09a5777c20ba5950a7
af6b15d8917bd5ab039b73db5f939c17df1aca2acf7d4ac9d8f44a005edaf6d6
b05c82faf0ced5798edf1f2e7f14918bcc89c8cdeea841a7bf776b12f2d02326
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b15c967bba9169e509c9efdb0603036e4f2e25745caf138d1e621c487df267d5
b28d69a486c2ebd13c3799e9bbe336c9ae42fedd82a88b668dbd09dbca49b990
b79264897c57ba1c56f43633b42ae372c48b812627c87fd50b53d54a2b546d79
b8f1a2e5ae298b7083365faa7dc3c97c173c1e4607f4c625cd195b41fb33e606
c1f9c7df78fdc65bf710385a6ed02bb7e6459e8b0f9115d13816ee81dc9b1111
c2377b781a7da01b324dc4aa3b643cd2ecd0fedb5a57bac46d4f983c611709e3
c284dcb06ef882b1b45e11e0a16baa223b4117eca94e243c8e725c4ce3f909b3
c397eda55501b6850428c6af5aa386bdc46dab5b4fe4a24d4af2d85dd139d8b7
c3f75006aec18ce713124dac3c3fa6d605a7b53802c32bf977ce5760430aafd2
c610b098992666ef336e1a0600fca9a78890f6c721e757c768fed19ac8b8bcea
c6160c3fe2c0f80af0d2fc7026570f9b0895a5ae51c6b21f720c2626724d9447
c70242480ad0a0ecc7c305d659f1fdb3a9cb1eb480927b46f8bd62d33ed0f8b2
c7e8a65fea836b76d6173012252cd6ec988f474f42ec97ef8323946371100a9e
c8879b289784c2f0e524c601ee26bd458ab9d35a527c22ce582904004e47d018
c9a09b4a436150c644d56fabe528bb174ad06085859c5c3d275984e8b515258c
cac0f817700f204d8c78ee37a1da48eb893d4d84e5e59d0d138e9b3caabb0a22
cb7ae215db84229feac0b45bbbcdc0c83df395d6bd0d4897695f50b41a50bcbc
cb8c2b19fd9b56c41db14bd71b5c0616c1ba4e99b08c8e75084cf695f74b7120
d0e12af8c4e560fe89643639e0c3ed4dc76125c62adeb2879b761d73dbaecf50
d0e4a6372d6fb5ffe9505dbe9e94aee8f1b9b96ec8e5e20684cce8b4c5a88fa7
d7299f53c4e3975280f5d8e9245bb5404f203f29b5313288e32f50e1f2a05ceb
dc4b06990df4609085f1450fada968380da66a8fd1d2cb8bdb4068371cb1ec0c
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
dea9df0145848ffeb3c6931228d41e833341b4837c0e713d321c5bfcf6dcd4e6
debf2783b523e3fd55ee708f4a351259be048377011b44a756caa91c73d0dccd
e1c1edc48f52ea38e75aceb1d0fa7d521ca26387f6f4d17a0e2eb0784010c410
e228891b15bd5240c2da3a0d8e01c9795f13239c94de6ee383f7f8f908dbc417
e2df2aa43ccae63e60dafddef949eda35ce389d91fcf65b386a69bfe62993ad4
e3499ee00a95b255fbe46521bf05e0dafd636ffd53cd77edc7ed808a54a3c0ec
e38d21eebc8657374beb023fd20aff7fe78c433d34cd95bd002312b6ed851939
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e430ac99d48aa7aa291fe9ef82398d2e7f599643dd1732d026947ba15edf718f
e51831d751ef667b1f703a47bb05802b681e6a30816f5cce0d56c3552a4eaa31
e5c508bafba73ec42c846248bd50bf39e3dc03872adf3133cca16a14a9acf4d7
e6b8a90a2870483ace67380ff4a64b39bfecb7952a432393470d76a6614fc62c
ea3325c2094d82033ce9583d4180194fb82729dfae65b62925831a88a6838d7c
eb9ec684a7198fded61e248eaff2d28d0c9f8a15dfee8d9afff66aa6ff200461
eccabf5cc7613433c3ddc71ff34391ae850d304d3aceb5666868c4947134f3b5
ed8f02bdd4fa786645522f9d95a9a151b1e487063d6e8fcbe675ae60d444d8be
eeaece944fcb879b3345ea46bb228f9e02d0ee4d73b8ea71549cee3a4275ddfd
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f076b905f97bfcc9f85ae929b89b9f1ef536e9bc3348cbfa4845c04c7fb760e6
f1a5717fcfb5a691957184c2eae91691228aaa0e2f4d3d209230242a99b3deaa
f4e12557ccfa5b634378089ef3a8045180368eebd0e0677666d5c1b158312a8e
fc54c09a7a71615ec35a22ed20afa4034588986ed88c3fc184b2c0bc637c33fb
fc914abef5985cda118c262ac69b47cac07fbc94d51c5254cb055961590b6a98
fcbcf165908dd18a9e49f7ff27810176db8e9f63b4352213741664245224f8aa
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a
ff3de130872fe0fb5b770dfa2bc9f0daf8ab320403a34a60d089436f08d24f99

www.bankinfosecurity.com Open in urlscan Pro 50.56.167.254 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

246 Requests

96 %HTTPS

30 %IPv6

34 Domains

62 Subdomains

49 IPs

2 Countries

11117 kBTransfer

15864 kBSize

103 Cookies

53 Outgoing links

Redirected requests

246 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 6 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.bankinfosecurity.com Open in urlscan Pro
50.56.167.254 Public Scan

Screenshot
Live screenshot

Full Image

246
Requests

96 %
HTTPS

30 %
IPv6

34
Domains

62
Subdomains

49
IPs

2
Countries

11117 kB
Transfer

15864 kB
Size

103
Cookies

246 HTTP transactions
6 data transactions