secure.lavasoft.com Open in urlscan Pro
64.18.87.93 Public Scan

Go To Rescan
Add Verdict Report

URL:
http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950
Submission: On April 07 via manual (April 7th 2023, 8:55:45 pm UTC) from US — Scanned from CA

Summary HTTP 81 Redirects Links 56 Behaviour Indicators

Summary

This website contacted 15 IPs in 3 countries across 13 domains to perform 81 HTTP transactions. The main IP is 64.18.87.93, located in Montreal, Canada and belongs to MTO, CA. The main domain is secure.lavasoft.com.

This is the only time secure.lavasoft.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
55	64.18.87.93 64.18.87.93	21548 (MTO) (MTO)
1	2607:f8b0:400... 2607:f8b0:400d:c09::5f	15169 (GOOGLE) (GOOGLE)
8 8	64.18.87.105 64.18.87.105	21548 (MTO) (MTO)
8	104.18.68.73 104.18.68.73	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:190e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	64.18.87.81 64.18.87.81	21548 (MTO) (MTO)
2	64.18.92.73 64.18.92.73	21548 (MTO) (MTO)
1	173.194.207.156 173.194.207.156	15169 (GOOGLE) (GOOGLE)
2	2607:f8b0:400... 2607:f8b0:400d:c0b::5e	15169 (GOOGLE) (GOOGLE)
1	2a03:2880:f11... 2a03:2880:f112:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	2607:f8b0:400... 2607:f8b0:400d:c02::8a	15169 (GOOGLE) (GOOGLE)
1 3	2607:f8b0:400... 2607:f8b0:400d:c00::9b	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:400d:c0c::9b	15169 (GOOGLE) (GOOGLE)
1	151.139.128.10 151.139.128.10	20446 (STACKPATH...) (STACKPATH-CDN)
1 2	2607:f8b0:400... 2607:f8b0:4009:819::2004	15169 (GOOGLE) (GOOGLE)
2	2607:f8b0:400... 2607:f8b0:4009:801::2003	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f01... 2a03:2880:f012:8:face:b00c:0:1	32934 (FACEBOOK) (FACEBOOK)
81	15

55 64.18.87.93 (Montreal, Canada)

ASN21548 (MTO, CA)
PTR: 64-18-87-93.beanfield.net

secure.lavasoft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:400d:c09::5f (Morganton, United States)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 64.18.87.105 (Montreal, Canada) 8 redirects

ASN21548 (MTO, CA)
PTR: 64-18-87-105.beanfield.net

maps.lavasoft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 104.18.68.73 (None, )

ASN13335 (CLOUDFLARENET, US)

www.adaware.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:190e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 64.18.87.81 (Montreal, Canada) 1 redirects

ASN21548 (MTO, CA)
PTR: 64-18-87-81.beanfield.net

store.lavasoft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 64.18.92.73 (Lorraine, Canada)

ASN21548 (MTO, CA)
PTR: 64-18-92-73.beanfield.net

store.adaware.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 173.194.207.156 (United States)

ASN15169 (GOOGLE, US)
PTR: qk-in-f156.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:400d:c0b::5e (Morganton, United States)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f112:83:face:b00c:0:25de (Secaucus, United States)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:400d:c02::8a (Morganton, United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2607:f8b0:400d:c00::9b (Morganton, United States) 1 redirects

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:400d:c0c::9b (Morganton, United States)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.139.128.10 (United States)

ASN20446 (STACKPATH-CDN, US)
PTR: map3.hwcdn.net

cdn.mouseflow.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4009:819::2004 (Gary, United States) 1 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4009:801::2003 (Gary, United States)

ASN15169 (GOOGLE, US)

www.google.ca	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f012:8:face:b00c:0:1 (Secaucus, United States)

ASN32934 (FACEBOOK, US)

static.xx.fbcdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
64	lavasoft.com 9 redirects secure.lavasoft.com maps.lavasoft.com store.lavasoft.com	891 KB
10	adaware.com www.adaware.com — Cisco Umbrella Rank: 163524 store.adaware.com	135 KB
4	doubleclick.net 1 redirects stats.g.doubleclick.net — Cisco Umbrella Rank: 100 googleads.g.doubleclick.net — Cisco Umbrella Rank: 41	19 KB
2	fbcdn.net static.xx.fbcdn.net — Cisco Umbrella Rank: 760	133 KB
2	google.ca www.google.ca — Cisco Umbrella Rank: 8209	562 B
2	google.com 1 redirects www.google.com — Cisco Umbrella Rank: 2	649 B
2	gstatic.com fonts.gstatic.com	63 KB
1	mouseflow.com cdn.mouseflow.com — Cisco Umbrella Rank: 7597
1	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 35	17 KB
1	facebook.com www.facebook.com — Cisco Umbrella Rank: 109	17 KB
1	googleadservices.com www.googleadservices.com — Cisco Umbrella Rank: 176	18 KB
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 220	1 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 47	2 KB
81	13

	Domain	Requested by
55	secure.lavasoft.com	secure.lavasoft.com
8	www.adaware.com	secure.lavasoft.com
8	maps.lavasoft.com	8 redirects
3	stats.g.doubleclick.net	1 redirects secure.lavasoft.com
2	static.xx.fbcdn.net	www.facebook.com
2	www.google.ca	secure.lavasoft.com
2	www.google.com	1 redirects secure.lavasoft.com
2	fonts.gstatic.com	fonts.googleapis.com
2	store.adaware.com	secure.lavasoft.com
1	cdn.mouseflow.com	secure.lavasoft.com
1	googleads.g.doubleclick.net	www.googleadservices.com
1	www.google-analytics.com	secure.lavasoft.com
1	www.facebook.com	secure.lavasoft.com
1	www.googleadservices.com	secure.lavasoft.com
1	store.lavasoft.com	1 redirects
1	cdnjs.cloudflare.com	secure.lavasoft.com
1	fonts.googleapis.com	secure.lavasoft.com
81	17

This site contains links to these domains. Also see Links.

Domain
www.lavasoft.com
www.facebook.com
twitter.com
www.pinterest.com
plus.google.com
www.linkedin.com
lavasoft.com
www.webcompanion.com
fr.lavasoft.com
es.lavasoft.com
it.lavasoft.com
de.lavasoft.com
pt.lavasoft.com
chrome.google.com
addons.mozilla.org
www.adaware.com
affiliates.lavasoft.com

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-08-03` - `2023-08-02`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2023-01-15` - `2023-04-15`	3 months	crt.sh
*.adaware.com Go Daddy Secure Certificate Authority - G2	`2022-05-30` - `2023-07-01`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-03-20` - `2023-06-12`	3 months	crt.sh
www.google.com GTS CA 1C3	`2023-03-20` - `2023-06-12`	3 months	crt.sh
*.google.ca GTS CA 1C3	`2023-03-20` - `2023-06-12`	3 months	crt.sh

This page contains 2 frames:

Primary Page: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950
Frame ID: CA0475FB7AB8DE466033CEA6D4B02361
Requests: 78 HTTP requests in this frame

Frame: https://www.facebook.com/plugins/like.php?href=http%3A%2F%2Fsecure.lavasoft.com%2Fmylavasoft%2Fmalware-descriptions%2Fblog%2FTrojanWin32SwrortProxy6892b50950&layout=standard&show_faces=false&width=800&action=like&colorscheme=light&height=80
Frame ID: 97B0930A339E385DBD9D9D48DFADE062
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Trojan.Win32.SwrortProxy_6892b50950 | Lavasoft

Detected technologies

Drupal (CMS) Expand

Overall confidence: 100%
Detected patterns

drupal\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Mouse Flow (Analytics) Expand

Overall confidence: 100%
Detected patterns

cdn\.mouseflow\.com

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

prettyPhoto (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

(?:<link [^>]*href="[^"]*prettyPhoto(?:\.min)?\.css|<a [^>]*rel="prettyPhoto)
jquery\.prettyPhoto\.js

Page Statistics

81
Requests

10 %
HTTPS

59 %
IPv6

13
Domains

17
Subdomains

15
IPs

3
Countries

1295 kB
Transfer

3004 kB
Size

16
Cookies

56 Outgoing links

These are links going to different origins than the main page.

URL: http://www.lavasoft.com/
Title: Lavasoft

Search URL Search Domain Scan URL

URL: http://www.facebook.com/lavasoft.adaware

Search URL Search Domain Scan URL

URL: http://twitter.com/#!/lavasoft

Search URL Search Domain Scan URL

URL: https://www.pinterest.com/Lavasoft/

Search URL Search Domain Scan URL

URL: https://plus.google.com/+adaware

Search URL Search Domain Scan URL

URL: http://www.linkedin.com/company/lavasoft

Search URL Search Domain Scan URL

URL: http://lavasoft.com/mylavasoft/securitycenter/blog/feed
Title: Security Center

Search URL Search Domain Scan URL

URL: http://lavasoft.com/mylavasoft/securitycenter/malware_desc/blog/feed
Title: Malware Encyclopedia

Search URL Search Domain Scan URL

URL: http://lavasoft.com/mylavasoft/company/blog/feed
Title: Lavasoft Blog

Search URL Search Domain Scan URL

URL: http://lavasoft.com/mylavasoft/securitycenter/whitepapers/blog/feed
Title: Lavasoft Whitepaper

Search URL Search Domain Scan URL

URL: http://www.lavasoft.com/products/ad_aware_free.php
Title: Ad-Aware Free Antivirus+

Search URL Search Domain Scan URL

URL: http://www.lavasoft.com/products/ad_aware_personal_security.php
Title: Ad-Aware Personal Security

Search URL Search Domain Scan URL

URL: http://www.lavasoft.com/products/ad_aware_pro.php
Title: Ad-Aware Pro Security

Search URL Search Domain Scan URL

URL: http://www.lavasoft.com/products/ad_aware_total_security.php
Title: Ad-Aware Total Security

Search URL Search Domain Scan URL

URL: http://www.lavasoft.com/free_download/trial/
Title: Products

Search URL Search Domain Scan URL

URL: http://www.lavasoft.com/products/ad_aware.php
Title: Ad-Aware Antivirus

Search URL Search Domain Scan URL

URL: http://www.lavasoft.com/products/ad_block.php
Title: Ad-Aware Ad Block

Search URL Search Domain Scan URL

URL: http://www.lavasoft.com/products/pc-tuneup.php
Title: PC Tuneup

Search URL Search Domain Scan URL

URL: http://lavasoft.com/products/lavasoft-tuneup-kit.php
Title: Lavasoft Tuneup Kit

Search URL Search Domain Scan URL

URL: http://lavasoft.com/products/lavasoft-pc-optimizer.php
Title: Lavasoft PC Optimizer

Search URL Search Domain Scan URL

URL: http://lavasoft.com/products/lavasoft-driver-updater.php
Title: Lavasoft Driver Updater

Search URL Search Domain Scan URL

URL: http://www.lavasoft.com/products/lavasoft_registry_tuner.php
Title: Lavasoft Registry Tuner

Search URL Search Domain Scan URL

URL: http://www.lavasoft.com/products/data_security.php
Title: Data Security

Search URL Search Domain Scan URL

URL: http://www.lavasoft.com/products/lavasoft_privacy_toolbox.php
Title: Lavasoft Privacy Toolbox

Search URL Search Domain Scan URL

URL: http://www.lavasoft.com/products/lavasoft_digital_lock.php
Title: Lavasoft Digital Lock

Search URL Search Domain Scan URL

URL: http://www.lavasoft.com/products/lavasoft_file_shredder.php
Title: Lavasoft File Shredder

Search URL Search Domain Scan URL

URL: http://www.lavasoft.com/trial_center/
Title: Trial Center

Search URL Search Domain Scan URL

URL: http://www.webcompanion.com/
Title: Ad-Aware Web Companion

Search URL Search Domain Scan URL

URL: http://www.lavasoft.com/support/supportforums/
Title: Support Forums

Search URL Search Domain Scan URL

URL: http://www.lavasoft.com/support/supportcenter/product_manuals.php
Title: Product Manuals

Search URL Search Domain Scan URL

URL: http://www.lavasoft.com/support/securitycenter/threatwork_alliance.php
Title: Threatwork Alliance

Search URL Search Domain Scan URL

URL: http://www.lavasoft.com/support/securitycenter/file_upload.php
Title: Upload Malware Samples

Search URL Search Domain Scan URL

URL: http://www.lavasoft.com/support/securitycenter/report_false_positives.php
Title: Report False Positives

Search URL Search Domain Scan URL

URL: http://www.lavasoft.com/mylavasoft/contact
Title: Contact Us

Search URL Search Domain Scan URL

URL: http://lavasoft.com/?lang=en
Title: English ▾

Search URL Search Domain Scan URL

URL: http://fr.lavasoft.com/
Title: Français

Search URL Search Domain Scan URL

URL: http://es.lavasoft.com/
Title: Español

Search URL Search Domain Scan URL

URL: http://it.lavasoft.com/
Title: Italiano

Search URL Search Domain Scan URL

URL: http://de.lavasoft.com/
Title: Deutsch

Search URL Search Domain Scan URL

URL: http://pt.lavasoft.com/
Title: Português

Search URL Search Domain Scan URL

URL: http://lavasoft.com/thankyou.php?internal=true&inter=encyclopedia
Title: here

Search URL Search Domain Scan URL

URL: http://www.lavasoft.com/mylavasoft/malware-removal-support/blog/how-to-end-a-process-with-the-task-manager
Title: How to End a Process With the Task Manager

Search URL Search Domain Scan URL

URL: http://www.lavasoft.com/mylavasoft/malware-removal-support/blog/how-to-work-with-the-system-registry
Title: How to Work with System Registry

Search URL Search Domain Scan URL

URL: http://www.lavasoft.com/mylavasoft/malware-removal-support/blog/how-to-clean-the-temporary-internet-files-folder
Title: How to clean Temporary Internet Files folder

Search URL Search Domain Scan URL

URL: http://www.pinterest.com/pin/create/button/?url=secure.lavasoft.com%2Fmylavasoft%2Fmalware-descriptions%2Fblog%2FTrojanWin32SwrortProxy6892b50950&media=http%3A%2F%2Fwww.lavasoft.com%2Fmylavasoft%2Fsites%2Fdefault%2Ffiles%2Fpictures%2Fthumbnail_138bb0696595b338afbab333c555292a-picture-116235.png&description=Trojan.Win32.SwrortProxy_6892b50950

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?hashtags=Lavasoft&original_referer=http%3A%2F%2Fwww.lavasoft.com%2Fmylavasoft%2Fmalware-descriptions%2Fblog%2FTrojanWin32SwrortProxy6892b50950&text=Lavasoft%20Blog%20%7C%20Trojan.Win32.SwrortProxy_6892b50950&tw_p=tweetbutton&url=http%3A%2F%2Fwww.lavasoft.com%2Fmylavasoft%2Fmalware-descriptions%2Fblog%2FTrojanWin32SwrortProxy6892b50950
Title: Twitter

Search URL Search Domain Scan URL

URL: http://www.facebook.com/share.php?u=http%3A%2F%2Fwww.lavasoft.com%2Fmylavasoft%2Fmalware-descriptions%2Fblog%2FTrojanWin32SwrortProxy6892b50950&t=Trojan.Win32.SwrortProxy_6892b50950
Title: Facebook

Search URL Search Domain Scan URL

URL: https://chrome.google.com/webstore/detail/adaware-ad-block/cmllgdnjnkbapbchnebiedipojhmnjej
Title: Ad block for Chrome

Search URL Search Domain Scan URL

URL: https://addons.mozilla.org/en-US/firefox/addon/ad-aware-ad-block
Title: Ad block for Firefox

Search URL Search Domain Scan URL

URL: https://www.adaware.com/
Title: Visit our new Adaware website

Search URL Search Domain Scan URL

URL: https://www.adaware.com/antivirus
Title: Take a look at our new Antivirus & Anti Spyware solution

Search URL Search Domain Scan URL

URL: http://affiliates.lavasoft.com/
Title: Affiliates

Search URL Search Domain Scan URL

URL: http://www.lavasoft.com/terms_of_use/
Title: Terms Of Use

Search URL Search Domain Scan URL

URL: http://www.lavasoft.com/privacy_policy/
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://www.adaware.com/antivirus?utm_campaign=aa12launch1&utm_medium=homepage_banner&utm_source=lavasoft_com&mkey1=aa12launch1&mkey2=homepage_banner
Title: Download adaware antivirus 12

Search URL Search Domain Scan URL

URL: https://www.adaware.com/antivirus?utm_campaign=aa12launch1&utm_medium=bottom_banner&utm_source=lavasoft_com&mkey1=aa12launch1&mkey2=bottom_banner
Title: Download Now

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 33

http://maps.lavasoft.com/flags/u/United%20States.png HTTP 301
https://www.adaware.com/es

Request Chain 34

http://maps.lavasoft.com/flags/u/Ukraine.png HTTP 301
https://www.adaware.com/es

Request Chain 35

http://maps.lavasoft.com/flags/n/Netherlands.png HTTP 301
https://www.adaware.com/es

Request Chain 36

http://maps.lavasoft.com/flags/e/Europe.png HTTP 301
https://www.adaware.com/es

Request Chain 37

http://maps.lavasoft.com/flags/c/Canada.png HTTP 301
https://www.adaware.com/es

Request Chain 38

http://maps.lavasoft.com/flags/f/France.png HTTP 301
https://www.adaware.com/es

Request Chain 39

http://maps.lavasoft.com/flags/i/Ireland.png HTTP 301
https://www.adaware.com/es

Request Chain 40

http://maps.lavasoft.com/flags/u/United%20Kingdom.png HTTP 301
https://www.adaware.com/es

Request Chain 43

https://store.lavasoft.com/clickgate/btn/visitor.min.js HTTP 302
https://store.adaware.com/clickgate/btn/visitor.min.js

Request Chain 52

http://www.facebook.com/plugins/like.php?href=http%3A%2F%2Fsecure.lavasoft.com%2Fmylavasoft%2Fmalware-descriptions%2Fblog%2FTrojanWin32SwrortProxy6892b50950&layout=standard&show_faces=false&width=800&action=like&colorscheme=light&height=80 HTTP 307
https://www.facebook.com/plugins/like.php?href=http%3A%2F%2Fsecure.lavasoft.com%2Fmylavasoft%2Fmalware-descriptions%2Fblog%2FTrojanWin32SwrortProxy6892b50950&layout=standard&show_faces=false&width=800&action=like&colorscheme=light&height=80

Request Chain 60

http://www.google-analytics.com/ga.js HTTP 307
https://www.google-analytics.com/ga.js

Request Chain 61

http://stats.g.doubleclick.net/dc.js HTTP 307
https://stats.g.doubleclick.net/dc.js

Request Chain 69

http://cdn.mouseflow.com/projects/3b1c981d-f5e8-40be-a336-fad403852321.js HTTP 307
https://cdn.mouseflow.com/projects/3b1c981d-f5e8-40be-a336-fad403852321.js

Request Chain 74

http://stats.g.doubleclick.net/r/__utm.gif?utmwv=5.7.2dc&utms=1&utmn=1545085457&utmhn=secure.lavasoft.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Trojan.Win32.SwrortProxy_6892b50950%20%7C%20Lavasoft&utmhid=1742701107&utmr=-&utmp=%2Fmylavasoft%2Fmalware-descriptions%2Fblog%2FTrojanWin32SwrortProxy6892b50950&utmht=1680900940209&utmac=UA-2689090-1&utmcc=__utma%3D173852449.108947392.1680900940.1680900940.1680900940.1%3B%2B__utmz%3D173852449.1680900940.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=857080507&utmredir=3&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~ HTTP 307
https://stats.g.doubleclick.net/r/__utm.gif?utmwv=5.7.2dc&utms=1&utmn=1545085457&utmhn=secure.lavasoft.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Trojan.Win32.SwrortProxy_6892b50950%20%7C%20Lavasoft&utmhid=1742701107&utmr=-&utmp=%2Fmylavasoft%2Fmalware-descriptions%2Fblog%2FTrojanWin32SwrortProxy6892b50950&utmht=1680900940209&utmac=UA-2689090-1&utmcc=__utma%3D173852449.108947392.1680900940.1680900940.1680900940.1%3B%2B__utmz%3D173852449.1680900940.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=857080507&utmredir=3&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~ HTTP 302
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-2689090-1&cid=108947392.1680900940&jid=857080507&_v=5.7.2dc&z=1545085457 HTTP 302
https://www.google.ca/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-2689090-1&cid=108947392.1680900940&jid=857080507&_v=5.7.2dc&z=1545085457&slf_rd=1&random=2320769501

Request Chain 75

http://stats.g.doubleclick.net/__utm.gif?utmwv=5.7.2dc&utms=2&utmn=694727308&utmhn=secure.lavasoft.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Trojan.Win32.SwrortProxy_6892b50950%20%7C%20Lavasoft&utmhid=1742701107&utmr=-&utmp=%2Fmylavasoft%2Fmalware-descriptions%2Fblog%2FTrojanWin32SwrortProxy6892b50950&utmht=1680900940212&utmac=UA-2689090-1&utmcc=__utma%3D173852449.108947392.1680900940.1680900940.1680900940.1%3B%2B__utmz%3D173852449.1680900940.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=&utmu=qhAAAAAAAAAAAAAAAAAAAAAE~ HTTP 307
https://stats.g.doubleclick.net/__utm.gif?utmwv=5.7.2dc&utms=2&utmn=694727308&utmhn=secure.lavasoft.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Trojan.Win32.SwrortProxy_6892b50950%20%7C%20Lavasoft&utmhid=1742701107&utmr=-&utmp=%2Fmylavasoft%2Fmalware-descriptions%2Fblog%2FTrojanWin32SwrortProxy6892b50950&utmht=1680900940212&utmac=UA-2689090-1&utmcc=__utma%3D173852449.108947392.1680900940.1680900940.1680900940.1%3B%2B__utmz%3D173852449.1680900940.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=&utmu=qhAAAAAAAAAAAAAAAAAAAAAE~

81 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request TrojanWin32SwrortProxy6892b50950 Show response
secure.lavasoft.com/mylavasoft/malware-descriptions/blog/ 1 MB
145 KB 157ms
97ms Document
text/html 64.18.87.93
MTO

General

Check archive.org

Show headers Download Go to

Full URL

http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950

Protocol

HTTP/1.1

Server

64.18.87.93 Montreal, Canada, ASN21548 (MTO, CA),

Reverse DNS

64-18-87-93.beanfield.net

Software

nginx /

Resource Hash

00fe0d46a52be52ec7609297cd34be57bc56be2e9f238668541024beae31bfa2

Security Headers

Name	Value
X-Content-Security-Policy	allow 'self';
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: must-revalidate
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=utf-8
Date: Fri, 07 Apr 2023 20:55:39 GMT
ETag: "7db715ca1a845e4f39c2a0cf6f810ecd"
Expires: Sun, 19 Nov 1978 05:00:00 GMT
Last-Modified: Sun, 05 Mar 2023 02:42:30 GMT
Server: nginx
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Content-Security-Policy: allow 'self';
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1

GET
H/1.1 200
OK css
fonts.googleapis.com/ 18 KB
2 KB 66ms
35ms Stylesheet
text/css 2607:f8b0:400d:c09::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.googleapis.com/css?family=Open+Sans:400italic,400,300,500,600,700,800

Requested by

Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950

Protocol

HTTP/1.1

Server

2607:f8b0:400d:c09::5f Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

c1c4629db259c980ce608f591f9828a971b512bd8cbfcf10cffb5556cead97be

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 20:55:39 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Content-Security-Policy-Report-Only: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/bcfae741e379a885f2ab2cf83ebe6d32
Transfer-Encoding: chunked
Cross-Origin-Resource-Policy: cross-origin
X-XSS-Protection: 0
Last-Modified: Fri, 07 Apr 2023 20:55:39 GMT
Server: ESF
Cross-Origin-Opener-Policy: same-origin-allow-popups
X-Frame-Options: SAMEORIGIN
Content-Type: text/css; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: private, max-age=86400, stale-while-revalidate=604800
Timing-Allow-Origin: *
Link: <http://fonts.gstatic.com>; rel=preconnect; crossorigin
Expires: Fri, 07 Apr 2023 20:55:39 GMT

GET
H/1.1 200
OK img_assist.css
secure.lavasoft.com/mylavasoft/modules/img_assist/ 463 B
659 B 98ms
86ms Stylesheet
text/css 64.18.87.93
MTO

General

Check archive.org

Show headers Download Go to

Full URL

http://secure.lavasoft.com/mylavasoft/modules/img_assist/img_assist.css?5

Requested by

Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950

Protocol

HTTP/1.1

Server

64.18.87.93 Montreal, Canada, ASN21548 (MTO, CA),

Reverse DNS

64-18-87-93.beanfield.net

Software

nginx /

Resource Hash

a8741eef44f5437d137a3b96b3a77c194c4cfa559050cde94628525eae06d0ff

Security Headers

Name	Value
X-Content-Security-Policy	allow 'self';
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 20:55:39 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Mon, 19 Dec 2011 12:10:23 GMT
Server: nginx
ETag: "c03f-1cf-4b470d5ca89c0"
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 247
X-XSS-Protection: 1
X-Content-Security-Policy: allow 'self';

GET
H/1.1 200
OK node.css
secure.lavasoft.com/mylavasoft/modules/node/ 740 B
780 B 104ms
93ms Stylesheet
text/css 64.18.87.93
MTO

General

Check archive.org

Show headers Download Go to

Full URL

http://secure.lavasoft.com/mylavasoft/modules/node/node.css?5

Requested by

Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950

Protocol

HTTP/1.1

Server

64.18.87.93 Montreal, Canada, ASN21548 (MTO, CA),

Reverse DNS

64-18-87-93.beanfield.net

Software

nginx /

Resource Hash

7cb6bb2d1fcc4440a2bc17d268db1ddd407e93726f539f44cb4e529363b8c383

Security Headers

Name	Value
X-Content-Security-Policy	allow 'self';
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 20:55:39 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Mon, 19 Dec 2011 12:10:24 GMT
Server: nginx
ETag: "c720-2e4-4b470d5d9cc00"
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 368
X-XSS-Protection: 1
X-Content-Security-Policy: allow 'self';

GET
H/1.1 200
OK quote.css
secure.lavasoft.com/mylavasoft/modules/quote/ 252 B
617 B 112ms
100ms Stylesheet
text/css 64.18.87.93
MTO

General

Check archive.org

Show headers Download Go to

Full URL

http://secure.lavasoft.com/mylavasoft/modules/quote/quote.css?5

Requested by

Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950

Protocol

HTTP/1.1

Server

64.18.87.93 Montreal, Canada, ASN21548 (MTO, CA),

Reverse DNS

64-18-87-93.beanfield.net

Software

nginx /

Resource Hash

1c502ba07f93bc5f6dd6dc23ec3f5ce43ef65ae26fe7f2c627bc2dcb0538ad87

Security Headers

Name	Value
X-Content-Security-Policy	allow 'self';
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 20:55:39 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Mon, 19 Dec 2011 12:10:23 GMT
Server: nginx
ETag: "c066-fc-4b470d5ca89c0"
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 206
X-XSS-Protection: 1
X-Content-Security-Policy: allow 'self';

GET
H/1.1 200
OK defaults.css
secure.lavasoft.com/mylavasoft/modules/system/ 757 B
839 B 113ms
97ms Stylesheet
text/css 64.18.87.93
MTO

General

Check archive.org

Show headers Download Go to

Full URL

http://secure.lavasoft.com/mylavasoft/modules/system/defaults.css?5

Requested by

Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950

Protocol

HTTP/1.1

Server

64.18.87.93 Montreal, Canada, ASN21548 (MTO, CA),

Reverse DNS

64-18-87-93.beanfield.net

Software

nginx /

Resource Hash

d71c4ede4adb08cee902dd2a598461fb2c8e1057bed997f705ddaaf29cc81de2

Security Headers

Name	Value
X-Content-Security-Policy	allow 'self';
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 20:55:39 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Mon, 19 Dec 2011 12:10:22 GMT
Server: nginx
ETag: "c562-2f5-4b470d5bb4780"
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 427
X-XSS-Protection: 1
X-Content-Security-Policy: allow 'self';

GET
H/1.1 200
OK system.css
secure.lavasoft.com/mylavasoft/modules/system/ 10 KB
3 KB 111ms
96ms Stylesheet
text/css 64.18.87.93
MTO

General

Check archive.org

Show headers Download Go to

Full URL

http://secure.lavasoft.com/mylavasoft/modules/system/system.css?5

Requested by

Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950

Protocol

HTTP/1.1

Server

64.18.87.93 Montreal, Canada, ASN21548 (MTO, CA),

Reverse DNS

64-18-87-93.beanfield.net

Software

nginx /

Resource Hash

2a112cc02d74db96758ae7f9cc56ee290ff51e21f7158066b97e1b14f67e1ddd

Security Headers

Name	Value
X-Content-Security-Policy	allow 'self';
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 20:55:39 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Mon, 19 Dec 2011 12:10:22 GMT
Server: nginx
ETag: "c568-2729-4b470d5bb4780"
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2850
X-XSS-Protection: 1
X-Content-Security-Policy: allow 'self';

GET
H/1.1 200
OK system-menus.css
secure.lavasoft.com/mylavasoft/modules/system/ 935 B
785 B 152ms
57ms Stylesheet
text/css 64.18.87.93
MTO

General

Check archive.org

Show headers Download Go to

Full URL

http://secure.lavasoft.com/mylavasoft/modules/system/system-menus.css?5

Requested by

Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950

Protocol

HTTP/1.1

Server

64.18.87.93 Montreal, Canada, ASN21548 (MTO, CA),

Reverse DNS

64-18-87-93.beanfield.net

Software

nginx /

Resource Hash

79cd557d6d9f52f12657ec3b469ee3692920720af96b573d591d44c45914788c

Security Headers

Name	Value
X-Content-Security-Policy	allow 'self';
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 20:55:39 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Mon, 19 Dec 2011 12:10:22 GMT
Server: nginx
ETag: "c56d-3a7-4b470d5bb4780"
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 373
X-XSS-Protection: 1
X-Content-Security-Policy: allow 'self';

GET
H/1.1 200
OK user.css
secure.lavasoft.com/mylavasoft/modules/user/ 1 KB
893 B 164ms
63ms Stylesheet
text/css 64.18.87.93
MTO

General

Check archive.org

Show headers Download Go to

Full URL

http://secure.lavasoft.com/mylavasoft/modules/user/user.css?5

Requested by

Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950

Protocol

HTTP/1.1

Server

64.18.87.93 Montreal, Canada, ASN21548 (MTO, CA),

Reverse DNS

64-18-87-93.beanfield.net

Software

nginx /

Resource Hash

36273eefecf92422ef4ed8271bd027cacb855fcf437390d41f8ce7216b2e912f

Security Headers

Name	Value
X-Content-Security-Policy	allow 'self';
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 20:55:39 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Mon, 19 Dec 2011 12:10:25 GMT
Server: nginx
ETag: "c680-467-4b470d5e90e40"
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 481
X-XSS-Protection: 1
X-Content-Security-Policy: allow 'self';

GET
H/1.1 200
OK content-module.css
secure.lavasoft.com/mylavasoft/sites/all/modules/cck/theme/ 2 KB
1 KB 166ms
57ms Stylesheet
text/css 64.18.87.93
MTO

General

Check archive.org

Show headers Download Go to

Full URL

http://secure.lavasoft.com/mylavasoft/sites/all/modules/cck/theme/content-module.css?5

Requested by

Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950

Protocol

HTTP/1.1

Server

64.18.87.93 Montreal, Canada, ASN21548 (MTO, CA),

Reverse DNS

64-18-87-93.beanfield.net

Software

nginx /

Resource Hash

a04f69a9f04ebc959863ef3b06fc47a361b51830d14e3c1cfec0ec99f830065a

Security Headers

Name	Value
X-Content-Security-Policy	allow 'self';
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 20:55:39 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Mon, 19 Dec 2011 12:10:03 GMT
Server: nginx
ETag: "3f52-95d-4b470d4995cc0"
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 871
X-XSS-Protection: 1
X-Content-Security-Policy: allow 'self';

GET
H/1.1 200
OK filefield.css
secure.lavasoft.com/mylavasoft/sites/all/modules/cck/modules/filefield/ 1 KB
903 B 166ms
56ms Stylesheet
text/css 64.18.87.93
MTO

General

Check archive.org

Show headers Download Go to

Full URL

http://secure.lavasoft.com/mylavasoft/sites/all/modules/cck/modules/filefield/filefield.css?5

Requested by

Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950

Protocol

HTTP/1.1

Server

64.18.87.93 Montreal, Canada, ASN21548 (MTO, CA),

Reverse DNS

64-18-87-93.beanfield.net

Software

nginx /

Resource Hash

a02f0fa297455984913d1000a98414b166fce1ff0d1f69221145e755c5092528

Security Headers

Name	Value
X-Content-Security-Policy	allow 'self';
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 20:55:39 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Mon, 19 Dec 2011 12:10:04 GMT
Server: nginx
ETag: "412d-51a-4b470d4a89f00"
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 491
X-XSS-Protection: 1
X-Content-Security-Policy: allow 'self';

GET
H/1.1 200
OK date.css
secure.lavasoft.com/mylavasoft/sites/all/modules/date/ 4 KB
2 KB 165ms
56ms Stylesheet
text/css 64.18.87.93
MTO

General

Check archive.org

Show headers Download Go to

Full URL

http://secure.lavasoft.com/mylavasoft/sites/all/modules/date/date.css?5

Requested by

Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950

Protocol

HTTP/1.1

Server

64.18.87.93 Montreal, Canada, ASN21548 (MTO, CA),

Reverse DNS

64-18-87-93.beanfield.net

Software

nginx /

Resource Hash

e70ef046542d0f50b2fd5aa9440702750c97097ad4cbbaa416a3814491d33b0f

Security Headers

Name	Value
X-Content-Security-Policy	allow 'self';
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 20:55:39 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Mon, 19 Dec 2011 12:10:08 GMT
Server: nginx
ETag: "4931-edc-4b470d4e5a800"
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1184
X-XSS-Protection: 1
X-Content-Security-Policy: allow 'self';

GET
H/1.1 200
OK fivestar.css
secure.lavasoft.com/mylavasoft/sites/all/modules/fivestar/css/ 2 KB
972 B 263ms
114ms Stylesheet
text/css 64.18.87.93
MTO

General

Check archive.org

Show headers Download Go to

Full URL

http://secure.lavasoft.com/mylavasoft/sites/all/modules/fivestar/css/fivestar.css?5

Requested by

Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950

Protocol

HTTP/1.1

Server

64.18.87.93 Montreal, Canada, ASN21548 (MTO, CA),

Reverse DNS

64-18-87-93.beanfield.net

Software

nginx /

Resource Hash

34859190a8e10c87708c4f09dcca14b1626f59f3a9aefc015232914fda0e98c9

Security Headers

Name	Value
X-Content-Security-Policy	allow 'self';
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 20:55:39 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Mon, 19 Dec 2011 12:10:09 GMT
Server: nginx
ETag: "425b-861-4b470d4f4ea40"
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 560
X-XSS-Protection: 1
X-Content-Security-Policy: allow 'self';

GET
H/1.1 200
OK basic.css
secure.lavasoft.com/mylavasoft/sites/default/files/fivestar/basic/ 591 B
606 B 263ms
111ms Stylesheet
text/css 64.18.87.93
MTO

General

Check archive.org

Show headers Download Go to

Full URL

http://secure.lavasoft.com/mylavasoft/sites/default/files/fivestar/basic/basic.css?5

Requested by

Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950

Protocol

HTTP/1.1

Server

64.18.87.93 Montreal, Canada, ASN21548 (MTO, CA),

Reverse DNS

64-18-87-93.beanfield.net

Software

nginx /

Resource Hash

bc04f4ebcb09d6539c5802dde5663e33a9fbb5fa6ff7a95af8b13bcef7962507

Security Headers

Name	Value
X-Content-Security-Policy	allow 'self';
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 20:55:39 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Tue, 13 Dec 2011 15:16:19 GMT
Server: nginx
ETag: "7134-24f-4b3fabbb156c0"
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 194
X-XSS-Protection: 1
X-Content-Security-Policy: allow 'self';

GET
H/1.1 200
OK nice_menus.css
secure.lavasoft.com/mylavasoft/sites/all/modules/nice_menus/ 4 KB
1 KB 264ms
103ms Stylesheet
text/css 64.18.87.93
MTO

General

Check archive.org

Show headers Download Go to

Full URL

http://secure.lavasoft.com/mylavasoft/sites/all/modules/nice_menus/nice_menus.css?5

Requested by

Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950

Protocol

HTTP/1.1

Server

64.18.87.93 Montreal, Canada, ASN21548 (MTO, CA),

Reverse DNS

64-18-87-93.beanfield.net

Software

nginx /

Resource Hash

296eab3be31343ee72fdf3917a9ca5376b7de316439e2a8699cedcad8c77d0a5

Security Headers

Name	Value
X-Content-Security-Policy	allow 'self';
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 20:55:39 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Mon, 19 Dec 2011 12:10:09 GMT
Server: nginx
ETag: "4829-e2b-4b470d4f4ea40"
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 906
X-XSS-Protection: 1
X-Content-Security-Policy: allow 'self';

GET
H/1.1 200
OK nice_menus_default.css
secure.lavasoft.com/mylavasoft/sites/all/modules/nice_menus/ 4 KB
1 KB 264ms
102ms Stylesheet
text/css 64.18.87.93
MTO

General

Check archive.org

Show headers Download Go to

Full URL

http://secure.lavasoft.com/mylavasoft/sites/all/modules/nice_menus/nice_menus_default.css?5

Requested by

Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950

Protocol

HTTP/1.1

Server

64.18.87.93 Montreal, Canada, ASN21548 (MTO, CA),

Reverse DNS

64-18-87-93.beanfield.net

Software

nginx /

Resource Hash

775cd52c321057f7377214dcc2ee58c7f1af671c3c4432b8775edd265534505e

Security Headers

Name	Value
X-Content-Security-Policy	allow 'self';
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 20:55:39 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Mon, 19 Dec 2011 12:10:09 GMT
Server: nginx
ETag: "482e-11ea-4b470d4f4ea40"
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1100
X-XSS-Protection: 1
X-Content-Security-Policy: allow 'self';

GET
H/1.1 200
OK quiz.css
secure.lavasoft.com/mylavasoft/sites/all/modules/quiz/ 4 KB
2 KB 263ms
100ms Stylesheet
text/css 64.18.87.93
MTO

General

Check archive.org

Show headers Download Go to

Full URL

http://secure.lavasoft.com/mylavasoft/sites/all/modules/quiz/quiz.css?5

Requested by

Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950

Protocol

HTTP/1.1

Server

64.18.87.93 Montreal, Canada, ASN21548 (MTO, CA),

Reverse DNS

64-18-87-93.beanfield.net

Software

nginx /

Resource Hash

4c865db644a3e7722567295b80195ee592829d0de2dd4c82fa0e20dec8ce1079

Security Headers

Name	Value
X-Content-Security-Policy	allow 'self';
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 20:55:39 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Mon, 19 Dec 2011 12:10:02 GMT
Server: nginx
ETag: "4905-e75-4b470d48a1a80"
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1126
X-XSS-Protection: 1
X-Content-Security-Policy: allow 'self';

GET
H/1.1 200
OK forum.css
secure.lavasoft.com/mylavasoft/modules/forum/ 1 KB
854 B 261ms
99ms Stylesheet
text/css 64.18.87.93
MTO

General

Check archive.org

Show headers Download Go to

Full URL

http://secure.lavasoft.com/mylavasoft/modules/forum/forum.css?5

Requested by

Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950

Protocol

HTTP/1.1

Server

64.18.87.93 Montreal, Canada, ASN21548 (MTO, CA),

Reverse DNS

64-18-87-93.beanfield.net

Software

nginx /

Resource Hash

268a230591586780e44a16d91401e28060be3c7affaadbb3b3e23d09e09c3f3a

Security Headers

Name	Value
X-Content-Security-Policy	allow 'self';
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 20:55:39 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Mon, 19 Dec 2011 12:10:24 GMT
Server: nginx
ETag: "c5cb-421-4b470d5d9cc00"
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 442
X-XSS-Protection: 1
X-Content-Security-Policy: allow 'self';

GET
H/1.1 200
OK fieldgroup.css
secure.lavasoft.com/mylavasoft/sites/all/modules/cck/modules/fieldgroup/ 166 B
563 B 374ms
110ms Stylesheet
text/css 64.18.87.93
MTO

General

Check archive.org

Show headers Download Go to

Full URL

http://secure.lavasoft.com/mylavasoft/sites/all/modules/cck/modules/fieldgroup/fieldgroup.css?5

Requested by

Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950

Protocol

HTTP/1.1

Server

64.18.87.93 Montreal, Canada, ASN21548 (MTO, CA),

Reverse DNS

64-18-87-93.beanfield.net

Software

nginx /

Resource Hash

59f1d75c38f397d42594afd183a3c34c05fd3f5c0441975f129f520260409b8d

Security Headers

Name	Value
X-Content-Security-Policy	allow 'self';
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 20:55:39 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Mon, 19 Dec 2011 12:10:03 GMT
Server: nginx
ETag: "3f5d-a6-4b470d4995cc0"
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 152
X-XSS-Protection: 1
X-Content-Security-Policy: allow 'self';

GET
H/1.1 200
OK views.css
secure.lavasoft.com/mylavasoft/sites/all/modules/views/css/ 2 KB
1 KB 374ms
111ms Stylesheet
text/css 64.18.87.93
MTO

General

Check archive.org

Show headers Download Go to

Full URL

http://secure.lavasoft.com/mylavasoft/sites/all/modules/views/css/views.css?5

Requested by

Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950

Protocol

HTTP/1.1

Server

64.18.87.93 Montreal, Canada, ASN21548 (MTO, CA),

Reverse DNS

64-18-87-93.beanfield.net

Software

nginx /

Resource Hash

3a6021d49de175f0d6b0867cfdfb11c606be01bcd1946cfc3b5a0bcc82cf3642

Security Headers

Name	Value
X-Content-Security-Policy	allow 'self';
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 20:55:39 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Mon, 19 Dec 2011 12:10:10 GMT
Server: nginx
ETag: "45b9-6fc-4b470d5042c80"
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 679
X-XSS-Protection: 1
X-Content-Security-Policy: allow 'self';

GET
H/1.1 200
OK comment.css
secure.lavasoft.com/mylavasoft/modules/comment/ 211 B
583 B 372ms
109ms Stylesheet
text/css 64.18.87.93
MTO

General

Check archive.org

Show headers Download Go to

Full URL

http://secure.lavasoft.com/mylavasoft/modules/comment/comment.css?5

Requested by

Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950

Protocol

HTTP/1.1

Server

64.18.87.93 Montreal, Canada, ASN21548 (MTO, CA),

Reverse DNS

64-18-87-93.beanfield.net

Software

nginx /

Resource Hash

6e28418d769f44d7f297ba9d92e8b9a420b9f0255e67df413d4b6459e7306413

Security Headers

Name	Value
X-Content-Security-Policy	allow 'self';
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 20:55:39 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Mon, 19 Dec 2011 12:10:24 GMT
Server: nginx
ETag: "c5b6-d3-4b470d5d9cc00"
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 172
X-XSS-Protection: 1
X-Content-Security-Policy: allow 'self';

GET
H/1.1 200
OK base.css
secure.lavasoft.com/mylavasoft/sites/all/themes/lava/css/ 29 KB
7 KB 374ms
112ms Stylesheet
text/css 64.18.87.93
MTO

General

Check archive.org

Show headers Download Go to

Full URL

http://secure.lavasoft.com/mylavasoft/sites/all/themes/lava/css/base.css?5

Requested by

Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950

Protocol

HTTP/1.1

Server

64.18.87.93 Montreal, Canada, ASN21548 (MTO, CA),

Reverse DNS

64-18-87-93.beanfield.net

Software

nginx /

Resource Hash

471da3ad66222e404ec9b47403311858e37cfeabe578429b1e6c5765dac3f50f

Security Headers

Name	Value
X-Content-Security-Policy	allow 'self';
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 20:55:39 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Tue, 14 Feb 2017 17:00:37 GMT
Server: nginx
ETag: "9064-7410-5488080d29a23"
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 6435
X-XSS-Protection: 1
X-Content-Security-Policy: allow 'self';

GET
H/1.1 200
OK blocks.css
secure.lavasoft.com/mylavasoft/sites/all/themes/lava/css/ 21 KB
5 KB 373ms
111ms Stylesheet
text/css 64.18.87.93
MTO

General

Check archive.org

Show headers Download Go to

Full URL

http://secure.lavasoft.com/mylavasoft/sites/all/themes/lava/css/blocks.css?5

Requested by

Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950

Protocol

HTTP/1.1

Server

64.18.87.93 Montreal, Canada, ASN21548 (MTO, CA),

Reverse DNS

64-18-87-93.beanfield.net

Software

nginx /

Resource Hash

2112f6987b673113815dbea386a09325bfea6c99edef11374566859b7c2a64fc

Security Headers

Name	Value
X-Content-Security-Policy	allow 'self';
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 20:55:39 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Tue, 08 Nov 2016 16:41:16 GMT
Server: nginx
ETag: "4aa9-5363-540cccf25f50e"
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4301
X-XSS-Protection: 1
X-Content-Security-Policy: allow 'self';

GET
H/1.1 200
OK blog.css
secure.lavasoft.com/mylavasoft/sites/all/themes/lava/css/ 17 KB
4 KB 373ms
112ms Stylesheet
text/css 64.18.87.93
MTO

General

Check archive.org

Show headers Download Go to

Full URL

http://secure.lavasoft.com/mylavasoft/sites/all/themes/lava/css/blog.css?5

Requested by

Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950

Protocol

HTTP/1.1

Server

64.18.87.93 Montreal, Canada, ASN21548 (MTO, CA),

Reverse DNS

64-18-87-93.beanfield.net

Software

nginx /

Resource Hash

d5d61220d67b9838d02c9bb8de0293a55a051bd516848b1486ec95f078c3f87a

Security Headers

Name	Value
X-Content-Security-Policy	allow 'self';
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 20:55:39 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Tue, 08 Nov 2016 16:19:23 GMT
Server: nginx
ETag: "4aad-4553-540cc80e738e4"
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3549
X-XSS-Protection: 1
X-Content-Security-Policy: allow 'self';

GET
H/1.1 200
OK jquery.js Show response
secure.lavasoft.com/mylavasoft/misc/ 93 KB
33 KB 493ms
118ms Script
application/javascript 64.18.87.93
MTO

General

Check archive.org

Show headers Download Go to

Full URL

http://secure.lavasoft.com/mylavasoft/misc/jquery.js?5

Requested by

Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950

Protocol

HTTP/1.1

Server

64.18.87.93 Montreal, Canada, ASN21548 (MTO, CA),

Reverse DNS

64-18-87-93.beanfield.net

Software

nginx /

Resource Hash

47b68dce8cb6805ad5b3ea4d27af92a241f4e29a5c12a274c852e4346a0500b4

Security Headers

Name	Value
X-Content-Security-Policy	allow 'self';
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 20:55:39 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Fri, 22 Jun 2012 19:55:14 GMT
Server: nginx
ETag: "3fb8-17278-4c31502b52c80"
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 33622
X-XSS-Protection: 1
X-Content-Security-Policy: allow 'self';

GET
H/1.1 200
OK drupal.js Show response
secure.lavasoft.com/mylavasoft/misc/ 10 KB
4 KB 488ms
113ms Script
application/javascript 64.18.87.93
MTO

General

Check archive.org

Show headers Download Go to

Full URL

http://secure.lavasoft.com/mylavasoft/misc/drupal.js?5

Requested by

Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950

Protocol

HTTP/1.1

Server

64.18.87.93 Montreal, Canada, ASN21548 (MTO, CA),

Reverse DNS

64-18-87-93.beanfield.net

Software

nginx /

Resource Hash

37dbbc0da918410d4fd1662e1534f3389b603a7c95dfedf3a97049a6713ea42d

Security Headers

Name	Value
X-Content-Security-Policy	allow 'self';
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 20:55:39 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Mon, 19 Dec 2011 12:10:15 GMT
Server: nginx
ETag: "3fbc-266a-4b470d55077c0"
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3558
X-XSS-Protection: 1
X-Content-Security-Policy: allow 'self';

GET
H/1.1 200
OK img_assist.js Show response
secure.lavasoft.com/mylavasoft/modules/img_assist/ 2 KB
1 KB 487ms
112ms Script
application/javascript 64.18.87.93
MTO

General

Check archive.org

Show headers Download Go to

Full URL

http://secure.lavasoft.com/mylavasoft/modules/img_assist/img_assist.js?5

Requested by

Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950

Protocol

HTTP/1.1

Server

64.18.87.93 Montreal, Canada, ASN21548 (MTO, CA),

Reverse DNS

64-18-87-93.beanfield.net

Software

nginx /

Resource Hash

e6920a09e61879f3b97662aac7ccf53b7d78f6430d0a1d0aae48bbd69431b5c1

Security Headers

Name	Value
X-Content-Security-Policy	allow 'self';
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 20:55:39 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Mon, 19 Dec 2011 12:10:23 GMT
Server: nginx
ETag: "c04b-75b-4b470d5ca89c0"
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 807
X-XSS-Protection: 1
X-Content-Security-Policy: allow 'self';

GET
H/1.1 200
OK fivestar.js Show response
secure.lavasoft.com/mylavasoft/sites/all/modules/fivestar/js/ 16 KB
4 KB 490ms
109ms Script
application/javascript 64.18.87.93
MTO

General

Check archive.org

Show headers Download Go to

Full URL

http://secure.lavasoft.com/mylavasoft/sites/all/modules/fivestar/js/fivestar.js?5

Requested by

Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950

Protocol

HTTP/1.1

Server

64.18.87.93 Montreal, Canada, ASN21548 (MTO, CA),

Reverse DNS

64-18-87-93.beanfield.net

Software

nginx /

Resource Hash

62c53d8848db5c8251b277e9335e317af46c20f9599b69799256d81b4b3a67b1

Security Headers

Name	Value
X-Content-Security-Policy	allow 'self';
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 20:55:39 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Mon, 19 Dec 2011 12:10:09 GMT
Server: nginx
ETag: "4255-3fd0-4b470d4f4ea40"
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4004
X-XSS-Protection: 1
X-Content-Security-Policy: allow 'self';

GET
H/1.1 200
OK googleanalytics.js Show response
secure.lavasoft.com/mylavasoft/sites/all/modules/google_analytics/ 3 KB
2 KB 601ms
115ms Script
application/javascript 64.18.87.93
MTO

General

Check archive.org

Show headers Download Go to

Full URL

http://secure.lavasoft.com/mylavasoft/sites/all/modules/google_analytics/googleanalytics.js?5

Requested by

Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950

Protocol

HTTP/1.1

Server

64.18.87.93 Montreal, Canada, ASN21548 (MTO, CA),

Reverse DNS

64-18-87-93.beanfield.net

Software

nginx /

Resource Hash

82bd572749e920742fedc7aad8f261d575837201594885e1483bb893f329c0a4

Security Headers

Name	Value
X-Content-Security-Policy	allow 'self';
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 20:55:39 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Mon, 19 Dec 2011 12:10:09 GMT
Server: nginx
ETag: "4484-beb-4b470d4f4ea40"
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1205
X-XSS-Protection: 1
X-Content-Security-Policy: allow 'self';

GET
H/1.1 200
OK rss.js Show response
secure.lavasoft.com/js/ 249 B
590 B 600ms
114ms Script
application/javascript 64.18.87.93
MTO

General

Check archive.org

Show headers Download Go to

Full URL

http://secure.lavasoft.com/js/rss.js

Requested by

Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950

Protocol

HTTP/1.1

Server

64.18.87.93 Montreal, Canada, ASN21548 (MTO, CA),

Reverse DNS

64-18-87-93.beanfield.net

Software

nginx /

Resource Hash

409fc4ae4a567b56bb3addc0dd6caf3e0d5b38b648a4cfc62631d75eb70794fa

Security Headers

Name	Value
X-Content-Security-Policy	allow 'self';
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 20:55:39 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Tue, 10 Sep 2013 18:41:28 GMT
Server: nginx
ETag: "c7ec-f9-4e60bda47a600"
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 153
X-XSS-Protection: 1; mode=block
X-Content-Security-Policy: allow 'self';

GET
H/1.1 200
OK prettyPhoto.css
secure.lavasoft.com/css/prettyphoto/css/ 19 KB
3 KB 485ms
111ms Stylesheet
text/css 64.18.87.93
MTO

General

Check archive.org

Show headers Download Go to

Full URL

http://secure.lavasoft.com/css/prettyphoto/css/prettyPhoto.css

Requested by

Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950

Protocol

HTTP/1.1

Server

64.18.87.93 Montreal, Canada, ASN21548 (MTO, CA),

Reverse DNS

64-18-87-93.beanfield.net

Software

nginx /

Resource Hash

c63be02717683d2efdc8c887d77d289092a50b7d51210e87033045ea2b7c9eed

Security Headers

Name	Value
X-Content-Security-Policy	allow 'self';
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 20:55:39 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Fri, 06 Sep 2013 16:47:09 GMT
Server: nginx
ETag: "c90a-4db0-4e5b9ca161d40"
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2769
X-XSS-Protection: 1; mode=block
X-Content-Security-Policy: allow 'self';

GET
H/1.1 200
OK whylavasoftrock.css
secure.lavasoft.com/css/ 3 KB
1 KB 483ms
110ms Stylesheet
text/css 64.18.87.93
MTO

General

Check archive.org

Show headers Download Go to

Full URL

http://secure.lavasoft.com/css/whylavasoftrock.css

Requested by

Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950

Protocol

HTTP/1.1

Server

64.18.87.93 Montreal, Canada, ASN21548 (MTO, CA),

Reverse DNS

64-18-87-93.beanfield.net

Software

nginx /

Resource Hash

8e547ab18030f4fd75ab1c5bffa4d47583598a7e38d6e0e49ffe9a2641a794fc

Security Headers

Name	Value
X-Content-Security-Policy	allow 'self';
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 20:55:39 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Tue, 28 Jul 2015 14:14:17 GMT
Server: nginx
ETag: "d195-b15-51bf015e54040"
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1049
X-XSS-Protection: 1; mode=block
X-Content-Security-Policy: allow 'self';

GET
H/1.1 200
OK jquery.prettyPhoto.js Show response
secure.lavasoft.com/css/prettyphoto/js/ 25 KB
7 KB 601ms
115ms Script
application/javascript 64.18.87.93
MTO

General

Check archive.org

Show headers Download Go to

Full URL

http://secure.lavasoft.com/css/prettyphoto/js/jquery.prettyPhoto.js

Requested by

Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950

Protocol

HTTP/1.1

Server

64.18.87.93 Montreal, Canada, ASN21548 (MTO, CA),

Reverse DNS

64-18-87-93.beanfield.net

Software

nginx /

Resource Hash

1da5f59155c22eb4c6f2d49d4bba26e584802a910ed5a2ebbc137b2a68c3cb8b

Security Headers

Name	Value
X-Content-Security-Policy	allow 'self';
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 20:55:39 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Wed, 13 Aug 2014 18:09:36 GMT
Server: nginx
ETag: "c923-62ec-50086b0d66984"
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 6592
X-XSS-Protection: 1; mode=block
X-Content-Security-Policy: allow 'self';

GET
H/1.1 200
OK jquery.colorbox-min.js Show response
secure.lavasoft.com/js/ 12 KB
5 KB 606ms
119ms Script
application/javascript 64.18.87.93
MTO

General

Check archive.org

Show headers Download Go to

Full URL

http://secure.lavasoft.com/js/jquery.colorbox-min.js

Requested by

Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950

Protocol

HTTP/1.1

Server

64.18.87.93 Montreal, Canada, ASN21548 (MTO, CA),

Reverse DNS

64-18-87-93.beanfield.net

Software

nginx /

Resource Hash

ed19121aba7ecee54f935138f2ebfa21c9c1fbfbcbc5c4f32cc45feb9f49e379

Security Headers

Name	Value
X-Content-Security-Policy	allow 'self';
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 20:55:39 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Wed, 15 Jul 2015 11:39:42 GMT
Server: nginx
ETag: "d182-2e7c-51ae869201b80"
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4711
X-XSS-Protection: 1; mode=block
X-Content-Security-Policy: allow 'self';

GET
H2

200

es
www.adaware.com/
Redirect Chain

http://maps.lavasoft.com/flags/u/United%20States.png
https://www.adaware.com/es

34 KB
34 KB

169ms
100ms

Image
text/html

104.18.68.73
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.adaware.com/es
Requested by: Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950
Protocol: H2
Server: 104.18.68.73 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Fri, 07 Apr 2023 20:55:40 GMT
backend: k8s
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 7b452c3b6953a1ed-YYZ

Redirect headers

Location: https://www.adaware.com/es
Date: Fri, 07 Apr 2023 20:55:39 GMT
Server: nginx
Connection: keep-alive
Content-Length: 162
Content-Type: text/html

GET
H2

200

es
www.adaware.com/
Redirect Chain

http://maps.lavasoft.com/flags/u/Ukraine.png
https://www.adaware.com/es

17 KB
17 KB

165ms
96ms

Image
text/html

104.18.68.73
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.adaware.com/es
Requested by: Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950
Protocol: H2
Server: 104.18.68.73 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Fri, 07 Apr 2023 20:55:40 GMT
backend: k8s
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 7b452c3b6956a1ed-YYZ

Redirect headers

Location: https://www.adaware.com/es
Date: Fri, 07 Apr 2023 20:55:39 GMT
Server: nginx
Connection: keep-alive
Content-Length: 162
Content-Type: text/html

GET
H2

200

es
www.adaware.com/
Redirect Chain

http://maps.lavasoft.com/flags/n/Netherlands.png
https://www.adaware.com/es

4 KB
4 KB

130ms
62ms

Image
text/html

104.18.68.73
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.adaware.com/es
Requested by: Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950
Protocol: H2
Server: 104.18.68.73 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Fri, 07 Apr 2023 20:55:40 GMT
backend: k8s
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 7b452c3b695ba1ed-YYZ

Redirect headers

Location: https://www.adaware.com/es
Date: Fri, 07 Apr 2023 20:55:39 GMT
Server: nginx
Connection: keep-alive
Content-Length: 162
Content-Type: text/html

GET
H2

200

es
www.adaware.com/
Redirect Chain

http://maps.lavasoft.com/flags/e/Europe.png
https://www.adaware.com/es

17 KB
17 KB

150ms
82ms

Image
text/html

104.18.68.73
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.adaware.com/es
Requested by: Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950
Protocol: H2
Server: 104.18.68.73 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Fri, 07 Apr 2023 20:55:40 GMT
backend: k8s
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 7b452c3b6958a1ed-YYZ

Redirect headers

Location: https://www.adaware.com/es
Date: Fri, 07 Apr 2023 20:55:39 GMT
Server: nginx
Connection: keep-alive
Content-Length: 162
Content-Type: text/html

GET
H2

200

es
www.adaware.com/
Redirect Chain

http://maps.lavasoft.com/flags/c/Canada.png
https://www.adaware.com/es

34 KB
34 KB

169ms
101ms

Image
text/html

104.18.68.73
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.adaware.com/es
Requested by: Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950
Protocol: H2
Server: 104.18.68.73 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Fri, 07 Apr 2023 20:55:40 GMT
backend: k8s
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 7b452c3b695ea1ed-YYZ

Redirect headers

Location: https://www.adaware.com/es
Date: Fri, 07 Apr 2023 20:55:39 GMT
Server: nginx
Connection: keep-alive
Content-Length: 162
Content-Type: text/html

GET
H2

200

es
www.adaware.com/
Redirect Chain

http://maps.lavasoft.com/flags/f/France.png
https://www.adaware.com/es

1 KB
1 KB

625ms
557ms

Image
text/html

104.18.68.73
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.adaware.com/es
Requested by: Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950
Protocol: H2
Server: 104.18.68.73 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Fri, 07 Apr 2023 20:55:40 GMT
backend: k8s
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 7b452c3b695ca1ed-YYZ

Redirect headers

Location: https://www.adaware.com/es
Date: Fri, 07 Apr 2023 20:55:39 GMT
Server: nginx
Connection: keep-alive
Content-Length: 162
Content-Type: text/html

GET
H2

200

es
www.adaware.com/
Redirect Chain

http://maps.lavasoft.com/flags/i/Ireland.png
https://www.adaware.com/es

24 KB
24 KB

67ms
66ms

Image
text/html

104.18.68.73
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.adaware.com/es
Requested by: Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950
Protocol: H2
Server: 104.18.68.73 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Fri, 07 Apr 2023 20:55:40 GMT
backend: k8s
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 7b452c3bea0fa1ed-YYZ

Redirect headers

Location: https://www.adaware.com/es
Date: Fri, 07 Apr 2023 20:55:40 GMT
Server: nginx
Connection: keep-alive
Content-Length: 162
Content-Type: text/html

GET
H2

200

es
www.adaware.com/
Redirect Chain

http://maps.lavasoft.com/flags/u/United%20Kingdom.png
https://www.adaware.com/es

1 KB
1 KB

908ms
907ms

Image
text/html

104.18.68.73
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.adaware.com/es
Requested by: Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950
Protocol: H2
Server: 104.18.68.73 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Fri, 07 Apr 2023 20:55:41 GMT
backend: k8s
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 7b452c3c0a41a1ed-YYZ

Redirect headers

Location: https://www.adaware.com/es
Date: Fri, 07 Apr 2023 20:55:40 GMT
Server: nginx
Connection: keep-alive
Content-Length: 162
Content-Type: text/html

GET
H/1.1 200
OK malware-blog-tab.js Show response
secure.lavasoft.com/mylavasoft/misc/ 465 B
679 B 96ms
96ms Script
application/javascript 64.18.87.93
MTO

General

Check archive.org

Show headers Download Go to

Full URL

http://secure.lavasoft.com/mylavasoft/misc/malware-blog-tab.js

Requested by

Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950

Protocol

HTTP/1.1

Server

64.18.87.93 Montreal, Canada, ASN21548 (MTO, CA),

Reverse DNS

64-18-87-93.beanfield.net

Software

nginx /

Resource Hash

755a76ecada60a0509a53ec4423fc2adcc6e2cc96e11fea5d647dd6a1e1cbf08

Security Headers

Name	Value
X-Content-Security-Policy	allow 'self';
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 20:55:40 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Wed, 17 Apr 2013 15:16:10 GMT
Server: nginx
ETag: "3fbd-1d1-4da8ff73d2280"
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 253
X-XSS-Protection: 1
X-Content-Security-Policy: allow 'self';

GET
H2 200 jquery.cookie.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery-cookie/1.4.1/ 1 KB
1 KB 50ms
23ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery-cookie/1.4.1/jquery.cookie.min.js

Requested by

Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d40efcac911d8964f3728eaa767de281306ff55ba9377435a3364d4d1e1613f6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Fri, 07 Apr 2023 20:55:39 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 179265
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 591
last-modified: Mon, 04 May 2020 16:11:45 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03ec1-514"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7oaWO8VpyzUSRmddwLiqh7pTv%2Fm78iVuZ1fwEIiabBg%2BXgzLaWwZWkqgSCgFARdwEGzvIroGgCUiBxnBTNgqcB1x%2B4JZSpPo8%2F1bqTgYhPFhmYzSBy%2Fe1xHC5KLTd40oSFeJQfdpoKvrfROF2xNjRIZz"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 7b452c3acb6b7156-YUL
expires: Wed, 27 Mar 2024 20:55:39 GMT

GET
H2

200

visitor.min.js Show response
store.adaware.com/clickgate/btn/
Redirect Chain

https://store.lavasoft.com/clickgate/btn/visitor.min.js
https://store.adaware.com/clickgate/btn/visitor.min.js

6 KB
2 KB

70ms
14ms

Script
text/javascript

64.18.92.73
MTO

General

Check archive.org

Show headers Download Go to

Full URL: https://store.adaware.com/clickgate/btn/visitor.min.js
Requested by: Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950
Protocol: H2
Server: 64.18.92.73 Lorraine, Canada, ASN21548 (MTO, CA),
Reverse DNS: 64-18-92-73.beanfield.net
Software: / ASP.NET
Resource Hash: fad7a230bf2330af1de4da75f66f063f52947f066248b56bee7fbf50640aec4c

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 07 Apr 2023 20:55:39 GMT
content-encoding: gzip
server
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
cache-control: no-cache
content-length: 2269
expires: -1

Redirect headers

Date: Fri, 07 Apr 2023 20:55:40 GMT
Server: nginx
X-Powered-By: PHP/5.5.38
Transfer-Encoding: chunked
Content-Type: text/html
Location: https://store.adaware.com/clickgate/btn/visitor.min.js
Access-Control-Allow-Origin: *
Connection: keep-alive

GET
H/1.1 200
OK conversion.js Show response
www.googleadservices.com/pagead/ 47 KB
18 KB 83ms
40ms Script
text/javascript 173.194.207.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://www.googleadservices.com/pagead/conversion.js

Requested by

Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950

Protocol

HTTP/1.1

Server

173.194.207.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

qk-in-f156.1e100.net

Software

cafe /

Resource Hash

ec39fa48c05b26765111b2b3ca71c2bcbcf77f189aa90c409d0c28fe19db1f55

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 20:55:39 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: cafe
ETag: 397160442380803869
Vary: Accept-Encoding
Content-Type: text/javascript; charset=UTF-8
P3P: policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Cache-Control: private, max-age=3600
Cross-Origin-Resource-Policy: cross-origin
Content-Disposition: attachment; filename="f.txt"
Timing-Allow-Origin: *
Content-Length: 18357
X-XSS-Protection: 0
Expires: Fri, 07 Apr 2023 20:55:39 GMT

GET
H/1.1 200
OK hdr_main.png
secure.lavasoft.com/img/index_page/ 6 KB
6 KB 117ms
116ms Image
image/png 64.18.87.93
MTO

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://secure.lavasoft.com/img/index_page/hdr_main.png

Requested by

Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/sites/all/themes/lava/css/base.css?5

Protocol

HTTP/1.1

Server

64.18.87.93 Montreal, Canada, ASN21548 (MTO, CA),

Reverse DNS

64-18-87-93.beanfield.net

Software

nginx /

Resource Hash

f640de288557df7049a22138aabb2e339908c37857dde652f75362e1bda8d583

Security Headers

Name	Value
X-Content-Security-Policy	allow 'self';
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/mylavasoft/sites/all/themes/lava/css/base.css?5
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 20:55:40 GMT
X-Content-Type-Options: nosniff
Last-Modified: Fri, 13 Sep 2013 16:28:13 GMT
Server: nginx
ETag: "d258-16ca-4e6465743c140"
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 5834
X-XSS-Protection: 1; mode=block
X-Content-Security-Policy: allow 'self';

GET
H/1.1 200
OK social_icons.png
secure.lavasoft.com/img/index_page/ 3 KB
4 KB 119ms
118ms Image
image/png 64.18.87.93
MTO

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://secure.lavasoft.com/img/index_page/social_icons.png

Requested by

Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/sites/all/themes/lava/css/base.css?5

Protocol

HTTP/1.1

Server

64.18.87.93 Montreal, Canada, ASN21548 (MTO, CA),

Reverse DNS

64-18-87-93.beanfield.net

Software

nginx /

Resource Hash

bf65ebe578015dad3ba49c97165ef3f093f115759afe6d51a31933966876a37e

Security Headers

Name	Value
X-Content-Security-Policy	allow 'self';
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/mylavasoft/sites/all/themes/lava/css/base.css?5
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 20:55:40 GMT
X-Content-Type-Options: nosniff
Last-Modified: Wed, 26 Aug 2015 20:19:06 GMT
Server: nginx
ETag: "d28e-cc2-51e3c8ffbac52"
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3266
X-XSS-Protection: 1; mode=block
X-Content-Security-Policy: allow 'self';

GET
H/1.1 200
OK blog.css
secure.lavasoft.com/mylavasoft/sites/all/themes/lava/css/ 17 KB
17 KB 117ms
117ms Image
text/css 64.18.87.93
MTO

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://secure.lavasoft.com/mylavasoft/sites/all/themes/lava/css/blog.css?5

Requested by

Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/sites/all/themes/lava/css/blog.css?5

Protocol

HTTP/1.1

Server

64.18.87.93 Montreal, Canada, ASN21548 (MTO, CA),

Reverse DNS

64-18-87-93.beanfield.net

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Security-Policy	allow 'self';
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/mylavasoft/sites/all/themes/lava/css/blog.css?5
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 20:55:40 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Tue, 08 Nov 2016 16:19:23 GMT
Server: nginx
ETag: "4aad-4553-540cc80e738e4"
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3549
X-XSS-Protection: 1
X-Content-Security-Policy: allow 'self';

GET
H/1.1 200
OK thumbnail_default_128.gif
secure.lavasoft.com/mylavasoft/sites/default/files/avatar_selection/ 3 KB
4 KB 116ms
115ms Image
image/gif 64.18.87.93
MTO

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://secure.lavasoft.com/mylavasoft/sites/default/files/avatar_selection/thumbnail_default_128.gif

Requested by

Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950

Protocol

HTTP/1.1

Server

64.18.87.93 Montreal, Canada, ASN21548 (MTO, CA),

Reverse DNS

64-18-87-93.beanfield.net

Software

nginx /

Resource Hash

9905fc483147fca07bfa4fcc1c9cce0accce6963037f3f6b70d8ee28ac779b94

Security Headers

Name	Value
X-Content-Security-Policy	allow 'self';
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 20:55:40 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 13 Dec 2011 15:16:20 GMT
Server: nginx
ETag: "5fa8-cdc-4b3fabbc09900"
X-Frame-Options: SAMEORIGIN
Content-Type: image/gif
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3292
X-XSS-Protection: 1
X-Content-Security-Policy: allow 'self';

GET
H/1.1 200
OK gradient_bg.png
secure.lavasoft.com/img/misc_page/ 980 B
1 KB 95ms
95ms Image
image/png 64.18.87.93
MTO

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://secure.lavasoft.com/img/misc_page/gradient_bg.png

Requested by

Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/sites/all/themes/lava/css/blog.css?5

Protocol

HTTP/1.1

Server

64.18.87.93 Montreal, Canada, ASN21548 (MTO, CA),

Reverse DNS

64-18-87-93.beanfield.net

Software

nginx /

Resource Hash

e7361551ebf564fab1a7309734979523872d3ee466f7426916d18636dc2fcfd9

Security Headers

Name	Value
X-Content-Security-Policy	allow 'self';
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/mylavasoft/sites/all/themes/lava/css/blog.css?5
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 20:55:40 GMT
X-Content-Type-Options: nosniff
Last-Modified: Wed, 11 Sep 2013 17:11:31 GMT
Server: nginx
ETag: "e540-3d4-4e61eb66f56c0"
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 980
X-XSS-Protection: 1; mode=block
X-Content-Security-Policy: allow 'self';

GET
H/1.1 200
OK memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v34/ 44 KB
45 KB 68ms
35ms Font
font/woff2 2607:f8b0:400d:c0b::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.gstatic.com/s/opensans/v34/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: fonts.googleapis.com
URL: http://fonts.googleapis.com/css?family=Open+Sans:400italic,400,300,500,600,700,800

Protocol

HTTP/1.1

Server

2607:f8b0:400d:c0b::5e Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8778e9af2422858d7052ff9a0f3c12c08ae976bdd6e0316db144cd5579cd97db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://fonts.googleapis.com/
Origin: http://secure.lavasoft.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Mon, 03 Apr 2023 09:17:42 GMT
X-Content-Type-Options: nosniff
Age: 387477
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
Cross-Origin-Resource-Policy: cross-origin
Content-Length: 44856
X-XSS-Protection: 0
Last-Modified: Mon, 15 Aug 2022 18:20:18 GMT
Server: sffe
Cross-Origin-Opener-Policy: same-origin; report-to="apps-themes"
Report-To: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000
Accept-Ranges: bytes
Timing-Allow-Origin: *
Expires: Tue, 02 Apr 2024 09:17:42 GMT

GET
H/1.1 200
OK memQYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWq8tWZ0Pw86hd0Rk8ZkWVAewA.woff2
fonts.gstatic.com/s/opensans/v34/ 17 KB
18 KB 62ms
32ms Font
font/woff2 2607:f8b0:400d:c0b::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.gstatic.com/s/opensans/v34/memQYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWq8tWZ0Pw86hd0Rk8ZkWVAewA.woff2

Requested by

Host: fonts.googleapis.com
URL: http://fonts.googleapis.com/css?family=Open+Sans:400italic,400,300,500,600,700,800

Protocol

HTTP/1.1

Server

2607:f8b0:400d:c0b::5e Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9ad0a22b0c58240a7a92b4c01aa31f39a5918dea6a8fdfa77e63042abc4fca31

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://fonts.googleapis.com/
Origin: http://secure.lavasoft.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Mon, 03 Apr 2023 06:21:41 GMT
X-Content-Type-Options: nosniff
Age: 398039
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
Cross-Origin-Resource-Policy: cross-origin
Content-Length: 17820
X-XSS-Protection: 0
Last-Modified: Mon, 15 Aug 2022 18:13:12 GMT
Server: sffe
Cross-Origin-Opener-Policy: same-origin; report-to="apps-themes"
Report-To: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000
Accept-Ranges: bytes
Timing-Allow-Origin: *
Expires: Tue, 02 Apr 2024 06:21:41 GMT

GET
H2

200

like.php Show response
www.facebook.com/plugins/ Frame 97B0
Redirect Chain

http://www.facebook.com/plugins/like.php?href=http%3A%2F%2Fsecure.lavasoft.com%2Fmylavasoft%2Fmalware-descriptions%2Fblog%2FTrojanWin32SwrortProxy6892b50950&layout=standard&show_faces=false&width=8...
https://www.facebook.com/plugins/like.php?href=http%3A%2F%2Fsecure.lavasoft.com%2Fmylavasoft%2Fmalware-descriptions%2Fblog%2FTrojanWin32SwrortProxy6892b50950&layout=standard&show_faces=false&width=...

48 KB
17 KB

1632ms
1591ms

Document
text/html

2a03:2880:f112:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/plugins/like.php?href=http%3A%2F%2Fsecure.lavasoft.com%2Fmylavasoft%2Fmalware-descriptions%2Fblog%2FTrojanWin32SwrortProxy6892b50950&layout=standard&show_faces=false&width=800&action=like&colorscheme=light&height=80

Requested by

Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f112:83:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

d7d2f24a21c4bae148fbca0c6df2ab03d3e975dd293a1873908b939a577286f3

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval';style-src fonts.googleapis.com .fbcdn.net data: .facebook.com 'unsafe-inline';connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com;font-src data: .gstatic.com .facebook.com .fbcdn.net .fbsbx.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com .tenor.co media.tenor.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net .giphy.com connect.facebook.net .carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com .whatsapp.net .fb.com .oculuscdn.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com https://.giphy.com data:;frame-src .doubleclick.net .google.com .facebook.com www.googleadservices.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com https://sandbox.paywithmybank.com;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://secure.lavasoft.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: private, no-cache, no-store, must-revalidate
content-encoding: br
content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval';style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com https://sandbox.paywithmybank.com;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
content-type: text/html; charset="utf-8"
cross-origin-opener-policy: unsafe-none
date: Fri, 07 Apr 2023 20:55:41 GMT
document-policy: force-load-at-top
expires: Sat, 01 Jan 2000 00:00:00 GMT
nel: {"report_to":"network-errors","max_age":3600,"failure_fraction":0.01}
origin-agent-cluster: ?0
pragma: no-cache
report-to: {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":3600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}],"group":"network-errors"}
strict-transport-security: max-age=15552000; preload
vary: Accept-Encoding
x-content-type-options: nosniff
x-fb-debug: CHrU7X1DiaEwx7iSupYo+NZ0p1PwadE9QIW07GjUw1Hr+PVUkZReD4iFs8Z2z1sfwrN5RHYvn1jFHJMgIrwUcA==
x-fb-rlafr: 0
x-xss-protection: 0

Redirect headers

Cross-Origin-Resource-Policy: Cross-Origin
Location: https://www.facebook.com/plugins/like.php?href=http%3A%2F%2Fsecure.lavasoft.com%2Fmylavasoft%2Fmalware-descriptions%2Fblog%2FTrojanWin32SwrortProxy6892b50950&layout=standard&show_faces=false&width=800&action=like&colorscheme=light&height=80
Non-Authoritative-Reason: HSTS

GET
H/1.1 200
OK red_arrow_left.gif
secure.lavasoft.com/img/ 98 B
474 B 81ms
81ms Image
image/gif 64.18.87.93
MTO

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://secure.lavasoft.com/img/red_arrow_left.gif

Requested by

Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/sites/all/themes/lava/css/blog.css?5

Protocol

HTTP/1.1

Server

64.18.87.93 Montreal, Canada, ASN21548 (MTO, CA),

Reverse DNS

64-18-87-93.beanfield.net

Software

nginx /

Resource Hash

103d434ae58dfdbf701c33e5b24532c4e4b9280f1cb1ba2130b525db47d50e2f

Security Headers

Name	Value
X-Content-Security-Policy	allow 'self';
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/mylavasoft/sites/all/themes/lava/css/blog.css?5
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 20:55:40 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 19 Dec 2011 12:13:25 GMT
Server: nginx
ETag: "d563-62-4b470e0a3a340"
X-Frame-Options: SAMEORIGIN
Content-Type: image/gif
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 98
X-XSS-Protection: 1; mode=block
X-Content-Security-Policy: allow 'self';

GET
H/1.1 200
OK email_32.png
secure.lavasoft.com/mylavasoft/sites/all/themes/lava/img/ 2 KB
2 KB 81ms
26ms Image
image/png 64.18.87.93
MTO

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://secure.lavasoft.com/mylavasoft/sites/all/themes/lava/img/email_32.png

Requested by

Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/sites/all/themes/lava/css/blog.css?5

Protocol

HTTP/1.1

Server

64.18.87.93 Montreal, Canada, ASN21548 (MTO, CA),

Reverse DNS

64-18-87-93.beanfield.net

Software

nginx /

Resource Hash

985e867eef3b26baa8bfb84f8c4c5a2627f4d187b82078590e762d43f467db06

Security Headers

Name	Value
X-Content-Security-Policy	allow 'self';
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/mylavasoft/sites/all/themes/lava/css/blog.css?5
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 20:55:40 GMT
X-Content-Type-Options: nosniff
Last-Modified: Wed, 26 Aug 2015 15:45:24 GMT
Server: nginx
ETag: "b596-6bb-51e38bd34d4bb"
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1723
X-XSS-Protection: 1
X-Content-Security-Policy: allow 'self';

GET
H/1.1 200
OK linkedin_32.png
secure.lavasoft.com/mylavasoft/sites/all/themes/lava/img/ 2 KB
2 KB 183ms
98ms Image
image/png 64.18.87.93
MTO

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://secure.lavasoft.com/mylavasoft/sites/all/themes/lava/img/linkedin_32.png

Requested by

Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/sites/all/themes/lava/css/blog.css?5

Protocol

HTTP/1.1

Server

64.18.87.93 Montreal, Canada, ASN21548 (MTO, CA),

Reverse DNS

64-18-87-93.beanfield.net

Software

nginx /

Resource Hash

35cd1e29be6018bcf6a83237afae4dfafb080cae6b9524823aae4dada771a925

Security Headers

Name	Value
X-Content-Security-Policy	allow 'self';
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/mylavasoft/sites/all/themes/lava/css/blog.css?5
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 20:55:40 GMT
X-Content-Type-Options: nosniff
Last-Modified: Wed, 26 Aug 2015 15:45:24 GMT
Server: nginx
ETag: "b598-71b-51e38bd35327b"
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1819
X-XSS-Protection: 1
X-Content-Security-Policy: allow 'self';

GET
H/1.1 200
OK google_32.png
secure.lavasoft.com/mylavasoft/sites/all/themes/lava/img/ 2 KB
3 KB 79ms
24ms Image
image/png 64.18.87.93
MTO

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://secure.lavasoft.com/mylavasoft/sites/all/themes/lava/img/google_32.png

Requested by

Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/sites/all/themes/lava/css/blog.css?5

Protocol

HTTP/1.1

Server

64.18.87.93 Montreal, Canada, ASN21548 (MTO, CA),

Reverse DNS

64-18-87-93.beanfield.net

Software

nginx /

Resource Hash

feb08b2286979021b4d6bdeec2ad5b473b9c5873599be3bcc58d54e105d26275

Security Headers

Name	Value
X-Content-Security-Policy	allow 'self';
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/mylavasoft/sites/all/themes/lava/css/blog.css?5
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 20:55:40 GMT
X-Content-Type-Options: nosniff
Last-Modified: Wed, 26 Aug 2015 15:45:24 GMT
Server: nginx
ETag: "b599-9b7-51e38bd35327b"
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2487
X-XSS-Protection: 1
X-Content-Security-Policy: allow 'self';

GET
H/1.1 200
OK pinterest_32.png
secure.lavasoft.com/mylavasoft/sites/all/themes/lava/img/ 3 KB
3 KB 81ms
26ms Image
image/png 64.18.87.93
MTO

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://secure.lavasoft.com/mylavasoft/sites/all/themes/lava/img/pinterest_32.png

Requested by

Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/sites/all/themes/lava/css/blog.css?5

Protocol

HTTP/1.1

Server

64.18.87.93 Montreal, Canada, ASN21548 (MTO, CA),

Reverse DNS

64-18-87-93.beanfield.net

Software

nginx /

Resource Hash

deca17186c096444b58bec61e7297697df6856b783948659e767013728d68f53

Security Headers

Name	Value
X-Content-Security-Policy	allow 'self';
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/mylavasoft/sites/all/themes/lava/css/blog.css?5
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 20:55:40 GMT
X-Content-Type-Options: nosniff
Last-Modified: Wed, 26 Aug 2015 15:45:24 GMT
Server: nginx
ETag: "b59a-b58-51e38bd35809c"
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2904
X-XSS-Protection: 1
X-Content-Security-Policy: allow 'self';

GET
H/1.1 200
OK twitter_32.png
secure.lavasoft.com/mylavasoft/sites/all/themes/lava/img/ 2 KB
2 KB 80ms
25ms Image
image/png 64.18.87.93
MTO

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://secure.lavasoft.com/mylavasoft/sites/all/themes/lava/img/twitter_32.png

Requested by

Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/sites/all/themes/lava/css/blog.css?5

Protocol

HTTP/1.1

Server

64.18.87.93 Montreal, Canada, ASN21548 (MTO, CA),

Reverse DNS

64-18-87-93.beanfield.net

Software

nginx /

Resource Hash

c55ec560b64a44529906feeea5dbc9f73b92a17d431095ca7b6fcfce441f1600

Security Headers

Name	Value
X-Content-Security-Policy	allow 'self';
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/mylavasoft/sites/all/themes/lava/css/blog.css?5
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 20:55:40 GMT
X-Content-Type-Options: nosniff
Last-Modified: Wed, 26 Aug 2015 15:45:25 GMT
Server: nginx
ETag: "b59b-6c8-51e38bd363c1c"
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1736
X-XSS-Protection: 1
X-Content-Security-Policy: allow 'self';

GET
H/1.1 200
OK facebook_32.png
secure.lavasoft.com/mylavasoft/sites/all/themes/lava/img/ 2 KB
2 KB 182ms
100ms Image
image/png 64.18.87.93
MTO

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://secure.lavasoft.com/mylavasoft/sites/all/themes/lava/img/facebook_32.png

Requested by

Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/sites/all/themes/lava/css/blog.css?5

Protocol

HTTP/1.1

Server

64.18.87.93 Montreal, Canada, ASN21548 (MTO, CA),

Reverse DNS

64-18-87-93.beanfield.net

Software

nginx /

Resource Hash

bfb91c2a7ae4929779d549fdb02e26b2d4a79d9a9e6b3028dc92224e8b1b7f94

Security Headers

Name	Value
X-Content-Security-Policy	allow 'self';
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/mylavasoft/sites/all/themes/lava/css/blog.css?5
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 20:55:40 GMT
X-Content-Type-Options: nosniff
Last-Modified: Wed, 26 Aug 2015 15:45:24 GMT
Server: nginx
ETag: "b597-65a-51e38bd35327b"
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1626
X-XSS-Protection: 1
X-Content-Security-Policy: allow 'self';

GET
H2

200

ga.js Show response
www.google-analytics.com/
Redirect Chain

http://www.google-analytics.com/ga.js
https://www.google-analytics.com/ga.js

45 KB
17 KB

98ms
32ms

Script
text/javascript

2607:f8b0:400d:c02::8a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/ga.js

Requested by

Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950

Protocol

Server

2607:f8b0:400d:c02::8a Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Fri, 07 Apr 2023 20:41:22 GMT
last-modified: Tue, 10 Jan 2023 21:29:14 GMT
server: Golfe2
age: 858
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 17168
expires: Fri, 07 Apr 2023 22:41:22 GMT

Redirect headers

Location: https://www.google-analytics.com/ga.js
Non-Authoritative-Reason: HSTS
Cross-Origin-Resource-Policy: Cross-Origin

GET
H2

200

dc.js Show response
stats.g.doubleclick.net/
Redirect Chain

http://stats.g.doubleclick.net/dc.js
https://stats.g.doubleclick.net/dc.js

45 KB
17 KB

99ms
31ms

Script
text/javascript

2607:f8b0:400d:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/dc.js

Requested by

Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950

Protocol

Server

2607:f8b0:400d:c00::9b Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6181cd98fe270c2826d416574446841f86778bc45a0ab0bdd0c667b4e70fd6e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Fri, 07 Apr 2023 19:29:27 GMT
last-modified: Tue, 10 Jan 2023 21:29:14 GMT
server: Golfe2
age: 5173
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 17093
expires: Fri, 07 Apr 2023 21:29:27 GMT

Redirect headers

Location: https://stats.g.doubleclick.net/dc.js
Non-Authoritative-Reason: HSTS
Cross-Origin-Resource-Policy: Cross-Origin

GET
H/1.1 200
OK footer_seperator.png
secure.lavasoft.com/img/index_page/ 1 KB
2 KB 259ms
90ms Image
image/png 64.18.87.93
MTO

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://secure.lavasoft.com/img/index_page/footer_seperator.png

Requested by

Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/sites/all/themes/lava/css/base.css?5

Protocol

HTTP/1.1

Server

64.18.87.93 Montreal, Canada, ASN21548 (MTO, CA),

Reverse DNS

64-18-87-93.beanfield.net

Software

nginx /

Resource Hash

7838e0d4119ce9a48d65faea83042ce7b86ea3887a884734d64f793a7500d5d1

Security Headers

Name	Value
X-Content-Security-Policy	allow 'self';
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/mylavasoft/sites/all/themes/lava/css/base.css?5
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 20:55:40 GMT
X-Content-Type-Options: nosniff
Last-Modified: Fri, 06 Sep 2013 16:00:22 GMT
Server: nginx
ETag: "d285-58f-4e5b922c6b180"
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1423
X-XSS-Protection: 1; mode=block
X-Content-Security-Policy: allow 'self';

GET
H/1.1 200
OK footer_logo.png
secure.lavasoft.com/img/index_page/ 1 KB
2 KB 166ms
100ms Image
image/png 64.18.87.93
MTO

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://secure.lavasoft.com/img/index_page/footer_logo.png

Requested by

Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/sites/all/themes/lava/css/base.css?5

Protocol

HTTP/1.1

Server

64.18.87.93 Montreal, Canada, ASN21548 (MTO, CA),

Reverse DNS

64-18-87-93.beanfield.net

Software

nginx /

Resource Hash

c39bec85303099514e8bfbc4d3d368d935156b31af3945e6f4d379294eac11c0

Security Headers

Name	Value
X-Content-Security-Policy	allow 'self';
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/mylavasoft/sites/all/themes/lava/css/base.css?5
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 20:55:40 GMT
X-Content-Type-Options: nosniff
Last-Modified: Fri, 06 Sep 2013 16:00:22 GMT
Server: nginx
ETag: "d281-598-4e5b922c6b180"
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1432
X-XSS-Protection: 1; mode=block
X-Content-Security-Policy: allow 'self';

GET
H/1.1 200
OK blub-left.png
secure.lavasoft.com/images/adaware_popup/ 49 KB
49 KB 165ms
99ms Image
image/png 64.18.87.93
MTO

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://secure.lavasoft.com/images/adaware_popup/blub-left.png

Requested by

Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/sites/all/themes/lava/css/base.css?5

Protocol

HTTP/1.1

Server

64.18.87.93 Montreal, Canada, ASN21548 (MTO, CA),

Reverse DNS

64-18-87-93.beanfield.net

Software

nginx /

Resource Hash

2546e75c04e05b3b19480724a39f87595fe1a4742276c0dc116d23484e4a95a8

Security Headers

Name	Value
X-Content-Security-Policy	allow 'self';
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/mylavasoft/sites/all/themes/lava/css/base.css?5
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 20:55:40 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 14 Feb 2017 16:56:29 GMT
Server: nginx
ETag: "2809ca-c40d-54880720c8824"
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 50189
X-XSS-Protection: 1; mode=block
X-Content-Security-Policy: allow 'self';

GET
H/1.1 200
OK blub-right.png
secure.lavasoft.com/images/adaware_popup/ 45 KB
46 KB 165ms
99ms Image
image/png 64.18.87.93
MTO

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://secure.lavasoft.com/images/adaware_popup/blub-right.png

Requested by

Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/sites/all/themes/lava/css/base.css?5

Protocol

HTTP/1.1

Server

64.18.87.93 Montreal, Canada, ASN21548 (MTO, CA),

Reverse DNS

64-18-87-93.beanfield.net

Software

nginx /

Resource Hash

cfb5777c663bb3df35ca8d1b920d14ce9baa4c5cb00466817bbc3dbd575f5e12

Security Headers

Name	Value
X-Content-Security-Policy	allow 'self';
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/mylavasoft/sites/all/themes/lava/css/base.css?5
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 20:55:40 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 14 Feb 2017 16:56:30 GMT
Server: nginx
ETag: "2809cf-b48f-54880720cd644"
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 46223
X-XSS-Protection: 1; mode=block
X-Content-Security-Policy: allow 'self';

GET
H/1.1 200
OK canaro-book.ttf
secure.lavasoft.com/fonts/ 127 KB
127 KB 67ms
48ms Font
text/plain 64.18.87.93
MTO

General

Check archive.org

Show headers Download Go to

Full URL

http://secure.lavasoft.com/fonts/canaro-book.ttf

Requested by

Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/sites/all/themes/lava/css/base.css?5

Protocol

HTTP/1.1

Server

64.18.87.93 Montreal, Canada, ASN21548 (MTO, CA),

Reverse DNS

64-18-87-93.beanfield.net

Software

nginx /

Resource Hash

20f264f8184284224b996184c5360bb779e28f5138b274722f24229f892972e3

Security Headers

Name	Value
X-Content-Security-Policy	allow 'self';
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://secure.lavasoft.com/mylavasoft/sites/all/themes/lava/css/base.css?5
Origin: http://secure.lavasoft.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 20:55:40 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 14 Feb 2017 16:55:43 GMT
Server: nginx
ETag: "2c0d1d-1fc18-548806f479a7a"
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 130072
X-XSS-Protection: 1; mode=block
X-Content-Security-Policy: allow 'self';

GET
H2 200 click.aspx
store.adaware.com/clickgate/ 58 B
387 B 42ms
42ms Image
image/bmp 64.18.92.73
MTO

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://store.adaware.com/clickgate/click.aspx?wID=1587&uid=1002069&vst=1
Requested by: Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 64.18.92.73 Lorraine, Canada, ASN21548 (MTO, CA),
Reverse DNS: 64-18-92-73.beanfield.net
Software: / ASP.NET
Resource Hash: f16c13f141125424df9ae0409f37af05fcfdd25c13ce09cb2321144bf6f54f11

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Fri, 07 Apr 2023 20:55:39 GMT
cache-control: private
server
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
content-type: image/bmp

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/965084835/ 3 KB
2 KB 102ms
37ms Script
text/javascript 2607:f8b0:400d:c0c::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/965084835/?random=1680900940151&cv=9&fst=1680900940151&num=1&guid=ON&resp=GooglemKTybQhCsO&eid=375603260%2C466465925%2C512247838&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&ig=1&frm=0&url=http%3A%2F%2Fsecure.lavasoft.com%2Fmylavasoft%2Fmalware-descriptions%2Fblog%2FTrojanWin32SwrortProxy6892b50950&tiba=Trojan.Win32.SwrortProxy_6892b50950%20%7C%20Lavasoft&hn=www.googleadservices.com&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: http://www.googleadservices.com/pagead/conversion.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c0c::9b Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5b19f44aba5d03e8d4e052e7b6c937a347ee48f9d3a9c04a68285c077cebed11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 07 Apr 2023 20:55:40 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1323
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

404

3b1c981d-f5e8-40be-a336-fad403852321.js
cdn.mouseflow.com/projects/
Redirect Chain

http://cdn.mouseflow.com/projects/3b1c981d-f5e8-40be-a336-fad403852321.js
https://cdn.mouseflow.com/projects/3b1c981d-f5e8-40be-a336-fad403852321.js

0
0

96ms
28ms

Script
text/html

151.139.128.10
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.mouseflow.com/projects/3b1c981d-f5e8-40be-a336-fad403852321.js
Requested by: Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950
Protocol: H2
Server: 151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS: map3.hwcdn.net
Software: /
Resource Hash

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Redirect headers

Location: https://cdn.mouseflow.com/projects/3b1c981d-f5e8-40be-a336-fad403852321.js
Non-Authoritative-Reason: HSTS
Cross-Origin-Resource-Policy: Cross-Origin

GET
H/1.1 200
OK star.png
secure.lavasoft.com/mylavasoft/sites/default/files/fivestar/basic/ 588 B
954 B 152ms
99ms Image
image/png 64.18.87.93
MTO

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://secure.lavasoft.com/mylavasoft/sites/default/files/fivestar/basic/star.png

Requested by

Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/sites/default/files/fivestar/basic/basic.css?5

Protocol

HTTP/1.1

Server

64.18.87.93 Montreal, Canada, ASN21548 (MTO, CA),

Reverse DNS

64-18-87-93.beanfield.net

Software

nginx /

Resource Hash

73ff354d8f01460d87eee972e813d127124d859cdc15b64add1ab67f3edb5b97

Security Headers

Name	Value
X-Content-Security-Policy	allow 'self';
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/mylavasoft/sites/default/files/fivestar/basic/basic.css?5
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 20:55:40 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 13 Dec 2011 15:16:20 GMT
Server: nginx
ETag: "7136-24c-4b3fabbc09900"
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 588
X-XSS-Protection: 1
X-Content-Security-Policy: allow 'self';

GET
H/1.1 200
OK adaware_bg.png
secure.lavasoft.com/images/adaware_popup/ 332 KB
333 KB 121ms
87ms Image
image/png 64.18.87.93
MTO

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://secure.lavasoft.com/images/adaware_popup/adaware_bg.png

Requested by

Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/sites/all/themes/lava/css/base.css?5

Protocol

HTTP/1.1

Server

64.18.87.93 Montreal, Canada, ASN21548 (MTO, CA),

Reverse DNS

64-18-87-93.beanfield.net

Software

nginx /

Resource Hash

7ba1a5ac29899c70e90ddd52f747548e7f329852da828ed4f880e5d7ca777ba8

Security Headers

Name	Value
X-Content-Security-Policy	allow 'self';
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/mylavasoft/sites/all/themes/lava/css/base.css?5
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 20:55:40 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 14 Feb 2017 16:56:29 GMT
Server: nginx
ETag: "2809c8-531b8-54880720c0b24"
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 340408
X-XSS-Protection: 1; mode=block
X-Content-Security-Policy: allow 'self';

GET
H/1.1 404
Not Found close-x.png
secure.lavasoft.com/images/adaware_popup/ 20 KB
20 KB 253ms
129ms Image
text/html 64.18.87.93
MTO

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://secure.lavasoft.com/images/adaware_popup/close-x.png

Requested by

Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/sites/all/themes/lava/css/base.css?5

Protocol

HTTP/1.1

Server

64.18.87.93 Montreal, Canada, ASN21548 (MTO, CA),

Reverse DNS

64-18-87-93.beanfield.net

Software

nginx /

Resource Hash

c54048cb8d49387523ef871bad8b0caceeb04f9259e8074e662691774ed86138

Security Headers

Name	Value
X-Content-Security-Policy	allow 'self';
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/mylavasoft/sites/all/themes/lava/css/base.css?5
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Expires: Thu, 19 Nov 1981 08:52:00 GMT
Pragma: no-cache
Date: Fri, 07 Apr 2023 20:55:40 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: nginx
X-Frame-Options: SAMEORIGIN
Vary: Accept-Encoding
Content-Type: text/html
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: keep-alive
Content-Length: 5697
X-XSS-Protection: 1; mode=block
X-Content-Security-Policy: allow 'self';

GET
H/1.1 200
OK adaware_logo.png
secure.lavasoft.com/images/adaware_popup/ 21 KB
21 KB 136ms
48ms Image
image/png 64.18.87.93
MTO

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://secure.lavasoft.com/images/adaware_popup/adaware_logo.png

Requested by

Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/sites/all/themes/lava/css/base.css?5

Protocol

HTTP/1.1

Server

64.18.87.93 Montreal, Canada, ASN21548 (MTO, CA),

Reverse DNS

64-18-87-93.beanfield.net

Software

nginx /

Resource Hash

c41885455f7c8419325ec65c33570c7ff6d14dfe65346bab427f613d3404181f

Security Headers

Name	Value
X-Content-Security-Policy	allow 'self';
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/mylavasoft/sites/all/themes/lava/css/base.css?5
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Fri, 07 Apr 2023 20:55:40 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 14 Feb 2017 16:56:29 GMT
Server: nginx
ETag: "2809c9-5391-54880720bebe4"
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 21393
X-XSS-Protection: 1; mode=block
X-Content-Security-Policy: allow 'self';

GET
H2

200

ga-audiences
www.google.ca/ads/
Redirect Chain

http://stats.g.doubleclick.net/r/__utm.gif?utmwv=5.7.2dc&utms=1&utmn=1545085457&utmhn=secure.lavasoft.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=...
https://stats.g.doubleclick.net/r/__utm.gif?utmwv=5.7.2dc&utms=1&utmn=1545085457&utmhn=secure.lavasoft.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt...
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-2689090-1&cid=108947392.1680900940&jid=857080507&_v=5.7.2dc&z=1545085457
https://www.google.ca/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-2689090-1&cid=108947392.1680900940&jid=857080507&_v=5.7.2dc&z=1545085457&slf_rd=1&random=2320769501

42 B
107 B

45ms
44ms

Image
image/gif

2607:f8b0:4009:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-2689090-1&cid=108947392.1680900940&jid=857080507&_v=5.7.2dc&z=1545085457&slf_rd=1&random=2320769501

Requested by

Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950

Protocol

Server

2607:f8b0:4009:801::2003 Gary, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 07 Apr 2023 20:55:40 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 07 Apr 2023 20:55:40 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
location: https://www.google.ca/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-2689090-1&cid=108947392.1680900940&jid=857080507&_v=5.7.2dc&z=1545085457&slf_rd=1&random=2320769501
content-type: text/html; charset=UTF-8
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

__utm.gif
stats.g.doubleclick.net/
Redirect Chain

http://stats.g.doubleclick.net/__utm.gif?utmwv=5.7.2dc&utms=2&utmn=694727308&utmhn=secure.lavasoft.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Tro...
https://stats.g.doubleclick.net/__utm.gif?utmwv=5.7.2dc&utms=2&utmn=694727308&utmhn=secure.lavasoft.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Tr...

35 B
194 B

33ms
32ms

Image
image/gif

2607:f8b0:400d:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://stats.g.doubleclick.net/__utm.gif?utmwv=5.7.2dc&utms=2&utmn=694727308&utmhn=secure.lavasoft.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Trojan.Win32.SwrortProxy_6892b50950%20%7C%20Lavasoft&utmhid=1742701107&utmr=-&utmp=%2Fmylavasoft%2Fmalware-descriptions%2Fblog%2FTrojanWin32SwrortProxy6892b50950&utmht=1680900940212&utmac=UA-2689090-1&utmcc=__utma%3D173852449.108947392.1680900940.1680900940.1680900940.1%3B%2B__utmz%3D173852449.1680900940.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=&utmu=qhAAAAAAAAAAAAAAAAAAAAAE~

Requested by

Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950

Protocol

Server

2607:f8b0:400d:c00::9b Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 07 Apr 2023 12:15:52 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 31188
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://stats.g.doubleclick.net/__utm.gif?utmwv=5.7.2dc&utms=2&utmn=694727308&utmhn=secure.lavasoft.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Trojan.Win32.SwrortProxy_6892b50950%20%7C%20Lavasoft&utmhid=1742701107&utmr=-&utmp=%2Fmylavasoft%2Fmalware-descriptions%2Fblog%2FTrojanWin32SwrortProxy6892b50950&utmht=1680900940212&utmac=UA-2689090-1&utmcc=__utma%3D173852449.108947392.1680900940.1680900940.1680900940.1%3B%2B__utmz%3D173852449.1680900940.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=&utmu=qhAAAAAAAAAAAAAAAAAAAAAE~
Non-Authoritative-Reason: HSTS
Cross-Origin-Resource-Policy: Cross-Origin

GET
H2 200 /
www.google.com/pagead/1p-user-list/965084835/ 42 B
165 B 108ms
45ms Image
image/gif 2607:f8b0:4009:819::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/965084835/?random=1680900940151&cv=9&fst=1680897600000&num=1&guid=ON&eid=375603260%2C466465925%2C512247838&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&frm=0&url=http%3A%2F%2Fsecure.lavasoft.com%2Fmylavasoft%2Fmalware-descriptions%2Fblog%2FTrojanWin32SwrortProxy6892b50950&tiba=Trojan.Win32.SwrortProxy_6892b50950%20%7C%20Lavasoft&fmt=3&is_vtc=1&random=2880107293&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4009:819::2004 Gary, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 07 Apr 2023 20:55:40 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.ca/pagead/1p-user-list/965084835/ 42 B
455 B 116ms
46ms Image
image/gif 2607:f8b0:4009:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/pagead/1p-user-list/965084835/?random=1680900940151&cv=9&fst=1680897600000&num=1&guid=ON&eid=375603260%2C466465925%2C512247838&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&frm=0&url=http%3A%2F%2Fsecure.lavasoft.com%2Fmylavasoft%2Fmalware-descriptions%2Fblog%2FTrojanWin32SwrortProxy6892b50950&tiba=Trojan.Win32.SwrortProxy_6892b50950%20%7C%20Lavasoft&fmt=3&is_vtc=1&random=2880107293&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: secure.lavasoft.com
URL: http://secure.lavasoft.com/mylavasoft/malware-descriptions/blog/TrojanWin32SwrortProxy6892b50950

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4009:801::2003 Gary, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://secure.lavasoft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 07 Apr 2023 20:55:40 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 FEppCFCt76d.png
static.xx.fbcdn.net/rsrc.php/v3/yD/r/ Frame 97B0 299 B
708 B 60ms
20ms Image
image/png 2a03:2880:f012:8:face:b00c:0:1
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yD/r/FEppCFCt76d.png

Requested by

Host: www.facebook.com
URL: https://www.facebook.com/plugins/like.php?href=http%3A%2F%2Fsecure.lavasoft.com%2Fmylavasoft%2Fmalware-descriptions%2Fblog%2FTrojanWin32SwrortProxy6892b50950&layout=standard&show_faces=false&width=800&action=like&colorscheme=light&height=80

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f012:8:face:b00c:0:1 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

d65f4b2e8eee94ddc7f762d098de19558d879a3b597c8913b4d075532e3ed4b4

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Fri, 07 Apr 2023 20:55:41 GMT
x-content-type-options: nosniff
content-md5: OIlAxCmR79nrM/Ez4ygGlg==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 299
x-fb-rlafr: 0
x-fb-debug: iPeELyAeEGyY4mrlFBp0yLa8wl/GXbxzmgvBRvBCaY/xMv6KePVN+I4VMavSIcjbHltdpZ+1uSOhrR84bc/pag==
x-fb-trip-id: 1512268381
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
expires: Thu, 28 Mar 2024 09:33:01 GMT

GET
H2 200 I89DZUSIvGt.js Show response
static.xx.fbcdn.net/rsrc.php/v3i7244/yO/l/en_GB/ Frame 97B0 510 KB
132 KB 58ms
21ms Script
application/x-javascript 2a03:2880:f012:8:face:b00c:0:1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3i7244/yO/l/en_GB/I89DZUSIvGt.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f012:8:face:b00c:0:1 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

e8f6ffaec0bf272b005db9b3d54ecca2aa0d8a76cb3a1c631b2f98cd18cfaacc

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Fri, 07 Apr 2023 20:55:41 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: L2RF8CNjqiGw/FMKn6HcRg==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 135344
x-fb-rlafr: 0
x-fb-debug: eObbwtNXul+WXtwyaU0CODBG0pWVyudstjois14LWg+NzVKPYCwpTswg3cbx2OzWMHdgF4olr7UkSG0Ws1+MYg==
x-fb-trip-id: 1512268381
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
origin-agent-cluster: ?0
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
expires: Sat, 06 Apr 2024 02:26:23 GMT

Verdicts & Comments Add Verdict or Comment

112 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

16 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
secure.lavasoft.com/images/adaware_popup	1970-01-20 20:31:00	Name: adcamp Value: uid%3DN%252FA%26cmp%3DN%252FA%26keyb%3DN%252FA%26key1%3DN%252FA%26key2%3DN%252FA
secure.lavasoft.com/	1970-01-20 11:28:20	Name: SESS18988db9dbd08f63383a79eefcfa4e8d Value: cj1hjlh1llo5r3ke029l5cl7v1
secure.lavasoft.com/	1969-12-31 23:59:59	Name: has_js Value: 1
.adaware.com/	1970-01-20 15:14:12	Name: 1587 Value: uid=1002069&vst=1&wID=1587&Country=CA&dest=http%3A%2F%2Flavasoft.com&type_1=2023-04-07%2020%3A55%3A40Z&clientID=0e030c42-d20d-46e5-a3ca-c46e03ffee4c&umID=0e030c42-d20d-46e5-a3ca-c46e03ffee4c&affcookiename=1587
.secure.lavasoft.com/	1970-01-20 20:31:00	Name: __utma Value: 173852449.108947392.1680900940.1680900940.1680900940.1
.secure.lavasoft.com/	1969-12-31 23:59:59	Name: __utmc Value: 173852449
.secure.lavasoft.com/	1970-01-20 15:17:48	Name: __utmz Value: 173852449.1680900940.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none)
.secure.lavasoft.com/	1970-01-20 10:55:01	Name: __utmt Value: 1
.secure.lavasoft.com/	1970-01-20 10:55:02	Name: __utmb Value: 173852449.1.10.1680900940
.lavasoft.com/	1970-01-20 20:31:00	Name: __utma Value: 173852449.108947392.1680900940.1680900940.1680900940.1
.lavasoft.com/	1970-01-20 10:55:02	Name: __utmb Value: 173852449.2.10.1680900940
.lavasoft.com/	1969-12-31 23:59:59	Name: __utmc Value: 173852449
.lavasoft.com/	1970-01-20 15:17:48	Name: __utmz Value: 173852449.1680900940.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none)
.doubleclick.net/	1970-01-20 10:55:01	Name: test_cookie Value: CheckForPermission
secure.lavasoft.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: ft0kv3kbsgsmpip1hon50nkr57
secure.lavasoft.com/	1970-01-20 10:56:27	Name: cookiesetting Value: targeting

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://cdn.mouseflow.com/projects/3b1c981d-f5e8-40be-a336-fad403852321.js Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: http://secure.lavasoft.com/images/adaware_popup/close-x.png Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Security-Policy	allow 'self';
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.mouseflow.com
cdnjs.cloudflare.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
maps.lavasoft.com
secure.lavasoft.com
static.xx.fbcdn.net
stats.g.doubleclick.net
store.adaware.com
store.lavasoft.com
www.adaware.com
www.facebook.com
www.google-analytics.com
www.google.ca
www.google.com
www.googleadservices.com
104.18.68.73
151.139.128.10
173.194.207.156
2606:4700::6811:190e
2607:f8b0:4009:801::2003
2607:f8b0:4009:819::2004
2607:f8b0:400d:c00::9b
2607:f8b0:400d:c02::8a
2607:f8b0:400d:c09::5f
2607:f8b0:400d:c0b::5e
2607:f8b0:400d:c0c::9b
2a03:2880:f012:8:face:b00c:0:1
2a03:2880:f112:83:face:b00c:0:25de
64.18.87.105
64.18.87.81
64.18.87.93
64.18.92.73
00fe0d46a52be52ec7609297cd34be57bc56be2e9f238668541024beae31bfa2
103d434ae58dfdbf701c33e5b24532c4e4b9280f1cb1ba2130b525db47d50e2f
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
1c502ba07f93bc5f6dd6dc23ec3f5ce43ef65ae26fe7f2c627bc2dcb0538ad87
1da5f59155c22eb4c6f2d49d4bba26e584802a910ed5a2ebbc137b2a68c3cb8b
20f264f8184284224b996184c5360bb779e28f5138b274722f24229f892972e3
2112f6987b673113815dbea386a09325bfea6c99edef11374566859b7c2a64fc
2546e75c04e05b3b19480724a39f87595fe1a4742276c0dc116d23484e4a95a8
268a230591586780e44a16d91401e28060be3c7affaadbb3b3e23d09e09c3f3a
296eab3be31343ee72fdf3917a9ca5376b7de316439e2a8699cedcad8c77d0a5
2a112cc02d74db96758ae7f9cc56ee290ff51e21f7158066b97e1b14f67e1ddd
34859190a8e10c87708c4f09dcca14b1626f59f3a9aefc015232914fda0e98c9
35cd1e29be6018bcf6a83237afae4dfafb080cae6b9524823aae4dada771a925
36273eefecf92422ef4ed8271bd027cacb855fcf437390d41f8ce7216b2e912f
37dbbc0da918410d4fd1662e1534f3389b603a7c95dfedf3a97049a6713ea42d
3a6021d49de175f0d6b0867cfdfb11c606be01bcd1946cfc3b5a0bcc82cf3642
409fc4ae4a567b56bb3addc0dd6caf3e0d5b38b648a4cfc62631d75eb70794fa
471da3ad66222e404ec9b47403311858e37cfeabe578429b1e6c5765dac3f50f
47b68dce8cb6805ad5b3ea4d27af92a241f4e29a5c12a274c852e4346a0500b4
4c865db644a3e7722567295b80195ee592829d0de2dd4c82fa0e20dec8ce1079
59f1d75c38f397d42594afd183a3c34c05fd3f5c0441975f129f520260409b8d
5b19f44aba5d03e8d4e052e7b6c937a347ee48f9d3a9c04a68285c077cebed11
6181cd98fe270c2826d416574446841f86778bc45a0ab0bdd0c667b4e70fd6e8
62c53d8848db5c8251b277e9335e317af46c20f9599b69799256d81b4b3a67b1
6e28418d769f44d7f297ba9d92e8b9a420b9f0255e67df413d4b6459e7306413
73ff354d8f01460d87eee972e813d127124d859cdc15b64add1ab67f3edb5b97
755a76ecada60a0509a53ec4423fc2adcc6e2cc96e11fea5d647dd6a1e1cbf08
775cd52c321057f7377214dcc2ee58c7f1af671c3c4432b8775edd265534505e
7838e0d4119ce9a48d65faea83042ce7b86ea3887a884734d64f793a7500d5d1
79cd557d6d9f52f12657ec3b469ee3692920720af96b573d591d44c45914788c
7ba1a5ac29899c70e90ddd52f747548e7f329852da828ed4f880e5d7ca777ba8
7cb6bb2d1fcc4440a2bc17d268db1ddd407e93726f539f44cb4e529363b8c383
82bd572749e920742fedc7aad8f261d575837201594885e1483bb893f329c0a4
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8778e9af2422858d7052ff9a0f3c12c08ae976bdd6e0316db144cd5579cd97db
8e547ab18030f4fd75ab1c5bffa4d47583598a7e38d6e0e49ffe9a2641a794fc
985e867eef3b26baa8bfb84f8c4c5a2627f4d187b82078590e762d43f467db06
9905fc483147fca07bfa4fcc1c9cce0accce6963037f3f6b70d8ee28ac779b94
9ad0a22b0c58240a7a92b4c01aa31f39a5918dea6a8fdfa77e63042abc4fca31
a02f0fa297455984913d1000a98414b166fce1ff0d1f69221145e755c5092528
a04f69a9f04ebc959863ef3b06fc47a361b51830d14e3c1cfec0ec99f830065a
a8741eef44f5437d137a3b96b3a77c194c4cfa559050cde94628525eae06d0ff
bc04f4ebcb09d6539c5802dde5663e33a9fbb5fa6ff7a95af8b13bcef7962507
bf65ebe578015dad3ba49c97165ef3f093f115759afe6d51a31933966876a37e
bfb91c2a7ae4929779d549fdb02e26b2d4a79d9a9e6b3028dc92224e8b1b7f94
c1c4629db259c980ce608f591f9828a971b512bd8cbfcf10cffb5556cead97be
c39bec85303099514e8bfbc4d3d368d935156b31af3945e6f4d379294eac11c0
c41885455f7c8419325ec65c33570c7ff6d14dfe65346bab427f613d3404181f
c54048cb8d49387523ef871bad8b0caceeb04f9259e8074e662691774ed86138
c55ec560b64a44529906feeea5dbc9f73b92a17d431095ca7b6fcfce441f1600
c63be02717683d2efdc8c887d77d289092a50b7d51210e87033045ea2b7c9eed
cfb5777c663bb3df35ca8d1b920d14ce9baa4c5cb00466817bbc3dbd575f5e12
d40efcac911d8964f3728eaa767de281306ff55ba9377435a3364d4d1e1613f6
d5d61220d67b9838d02c9bb8de0293a55a051bd516848b1486ec95f078c3f87a
d65f4b2e8eee94ddc7f762d098de19558d879a3b597c8913b4d075532e3ed4b4
d71c4ede4adb08cee902dd2a598461fb2c8e1057bed997f705ddaaf29cc81de2
d7d2f24a21c4bae148fbca0c6df2ab03d3e975dd293a1873908b939a577286f3
deca17186c096444b58bec61e7297697df6856b783948659e767013728d68f53
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e6920a09e61879f3b97662aac7ccf53b7d78f6430d0a1d0aae48bbd69431b5c1
e70ef046542d0f50b2fd5aa9440702750c97097ad4cbbaa416a3814491d33b0f
e7361551ebf564fab1a7309734979523872d3ee466f7426916d18636dc2fcfd9
e8f6ffaec0bf272b005db9b3d54ecca2aa0d8a76cb3a1c631b2f98cd18cfaacc
ec39fa48c05b26765111b2b3ca71c2bcbcf77f189aa90c409d0c28fe19db1f55
ed19121aba7ecee54f935138f2ebfa21c9c1fbfbcbc5c4f32cc45feb9f49e379
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f16c13f141125424df9ae0409f37af05fcfdd25c13ce09cb2321144bf6f54f11
f640de288557df7049a22138aabb2e339908c37857dde652f75362e1bda8d583
fad7a230bf2330af1de4da75f66f063f52947f066248b56bee7fbf50640aec4c
feb08b2286979021b4d6bdeec2ad5b473b9c5873599be3bcc58d54e105d26275

secure.lavasoft.com Open in urlscan Pro 64.18.87.93 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

81 Requests

10 %HTTPS

59 %IPv6

13 Domains

17 Subdomains

15 IPs

3 Countries

1295 kBTransfer

3004 kBSize

16 Cookies

56 Outgoing links

Redirected requests

81 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

secure.lavasoft.com Open in urlscan Pro
64.18.87.93 Public Scan

Screenshot
Live screenshot

Full Image

81
Requests

10 %
HTTPS

59 %
IPv6

13
Domains

17
Subdomains

15
IPs

3
Countries

1295 kB
Transfer

3004 kB
Size

16
Cookies

81 HTTP transactions
0 data transactions