blogs.blackberry.com Open in urlscan Pro
2600:9000:224a:6c00:19:cd0a:2e00:93a1  Public Scan

Submitted URL: https://www.cylance.com/en_us/blog/threat-spotlight-the-return-of-qakbot-malware.html
Effective URL: https://blogs.blackberry.com/en/2017/05/threat-spotlight-the-return-of-qakbot-malware
Submission: On June 10 via api from US — Scanned from DE

Summary

This website contacted 50 IPs in 9 countries across 39 domains to perform 122 HTTP transactions. The main IP is 2600:9000:224a:6c00:19:cd0a:2e00:93a1, located in United States and belongs to AMAZON-02, US. The main domain is blogs.blackberry.com.
TLS certificate: Issued by DigiCert TLS RSA SHA256 2020 CA1 on July 8th 2021. Valid for: a year.
This is the only time blogs.blackberry.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 2600:9000:231... 16509 (AMAZON-02)
1 1 74.82.70.131 18705 (RIMBLACKB...)
18 2600:9000:224... 16509 (AMAZON-02)
7 2a02:26f0:b60... 20940 (AKAMAI-ASN1)
5 152.195.15.58 15133 (EDGECAST)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
3 2a06:98c1:312... 13335 (CLOUDFLAR...)
3 2a00:1450:400... 15169 (GOOGLE)
2 108.128.0.238 16509 (AMAZON-02)
5 2a00:1450:400... 15169 (GOOGLE)
1 199.232.188.157 54113 (FASTLY)
1 142.250.186.34 15169 (GOOGLE)
1 2a02:26f0:f7:... 20940 (AKAMAI-ASN1)
2 5 172.217.18.6 15169 (GOOGLE)
1 4 2620:1ec:c11:... 8068 (MICROSOFT...)
3 2a03:2880:f01... 32934 (FACEBOOK)
1 65.9.65.116 16509 (AMAZON-02)
1 69.16.175.42 20446 (STACKPATH...)
1 2606:4700:440... 13335 (CLOUDFLAR...)
1 2a04:4e42:200... 54113 (FASTLY)
1 2 52.208.8.226 16509 (AMAZON-02)
4 4 2620:1ec:21::14 8068 (MICROSOFT...)
2 13.107.42.14 8068 (MICROSOFT...)
2 2a00:1450:400... 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
1 34.250.172.3 16509 (AMAZON-02)
1 1 34.246.128.161 16509 (AMAZON-02)
1 54.194.254.72 16509 (AMAZON-02)
1 206.19.49.24 7018 (ATT-INTER...)
2 2a00:1450:400... 15169 (GOOGLE)
1 151.101.65.140 54113 (FASTLY)
5 2a00:1450:400... 15169 (GOOGLE)
5 2a00:1450:400... 15169 (GOOGLE)
1 2620:1ec:27::... 8075 (MICROSOFT...)
1 104.244.42.69 13414 (TWITTER)
1 104.244.42.195 13414 (TWITTER)
1 2 2a00:1450:400... 15169 (GOOGLE)
1 13.36.218.177 16509 (AMAZON-02)
3 52.184.204.244 8075 (MICROSOFT...)
4 104.79.88.164 16625 (AKAMAI-AS)
3 2a03:2880:f11... 32934 (FACEBOOK)
2 52.54.96.194 14618 (AMAZON-AES)
1 34.251.139.24 16509 (AMAZON-02)
1 2 20.234.93.27 8075 (MICROSOFT...)
1 15.197.193.217 16509 (AMAZON-02)
2 8 2600:9000:225... 16509 (AMAZON-02)
7 12 52.31.148.217 16509 (AMAZON-02)
1 2 35.157.1.22 16509 (AMAZON-02)
2 2 172.217.23.98 15169 (GOOGLE)
1 34.98.64.218 15169 (GOOGLE)
1 2a00:1288:80:... 203220 (YAHOO-DEB)
1 2 185.33.221.119 29990 (ASN-APPNEX)
1 3.215.172.219 14618 (AMAZON-AES)
122 50
Apex Domain
Subdomains
Transfer
20 adroll.com
s.adroll.com — Cisco Umbrella Rank: 2164
d.adroll.com — Cisco Umbrella Rank: 1450
34 KB
19 blackberry.com
blogs.blackberry.com
bb.blackberry.com — Cisco Umbrella Rank: 614978
1 MB
12 doubleclick.net
10049132.fls.doubleclick.net
9632625.fls.doubleclick.net
googleads.g.doubleclick.net — Cisco Umbrella Rank: 48
stats.g.doubleclick.net — Cisco Umbrella Rank: 104
cm.g.doubleclick.net — Cisco Umbrella Rank: 206
7 KB
7 google.de
www.google.de — Cisco Umbrella Rank: 5859
adservice.google.de — Cisco Umbrella Rank: 8201
2 KB
7 google.com
adservice.google.com — Cisco Umbrella Rank: 82
www.google.com — Cisco Umbrella Rank: 4
2 KB
7 adobedtm.com
assets.adobedtm.com — Cisco Umbrella Rank: 441
148 KB
6 clarity.ms
www.clarity.ms — Cisco Umbrella Rank: 561
n.clarity.ms — Cisco Umbrella Rank: 8484
c.clarity.ms — Cisco Umbrella Rank: 1045
26 KB
6 linkedin.com
px.ads.linkedin.com — Cisco Umbrella Rank: 315
www.linkedin.com — Cisco Umbrella Rank: 482
px4.ads.linkedin.com — Cisco Umbrella Rank: 5732
4 KB
5 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 47
60 KB
4 mathtag.com
pixel.mathtag.com — Cisco Umbrella Rank: 1200
4 KB
4 bing.com
bat.bing.com — Cisco Umbrella Rank: 341
c.bing.com — Cisco Umbrella Rank: 202
13 KB
4 fontawesome.com
kit.fontawesome.com — Cisco Umbrella Rank: 1771
ka-f.fontawesome.com — Cisco Umbrella Rank: 3691
24 KB
4 bizible.com
cdn.bizible.com — Cisco Umbrella Rank: 7193
26 KB
3 facebook.com
www.facebook.com — Cisco Umbrella Rank: 97
403 B
3 argusplatform.com
argusplatform.com — Cisco Umbrella Rank: 183041
www.argusplatform.com — Cisco Umbrella Rank: 216077
pixels.argusplatform.com — Cisco Umbrella Rank: 238456
3 KB
3 facebook.net
connect.facebook.net — Cisco Umbrella Rank: 152
193 KB
3 demdex.net
dpm.demdex.net — Cisco Umbrella Rank: 194
blackberry.demdex.net — Cisco Umbrella Rank: 744068
5 KB
3 gstatic.com
fonts.gstatic.com
47 KB
2 adnxs.com
ib.adnxs.com — Cisco Umbrella Rank: 231
2 KB
2 bidswitch.net
x.bidswitch.net — Cisco Umbrella Rank: 286
1 KB
2 pardot.com
pi.pardot.com — Cisco Umbrella Rank: 3968
4 KB
2 omtrdc.net
blackberrylimited.tt.omtrdc.net — Cisco Umbrella Rank: 667008
blackberrylimited.sc.omtrdc.net — Cisco Umbrella Rank: 766799
1 KB
2 techtarget.com
trk.techtarget.com — Cisco Umbrella Rank: 12184
apt.techtarget.com — Cisco Umbrella Rank: 15762
2 KB
2 adsrvr.org
js.adsrvr.org — Cisco Umbrella Rank: 1332
insight.adsrvr.org — Cisco Umbrella Rank: 589
3 KB
2 cylance.com
www.cylance.com
threatvector.cylance.com
753 B
1 yahoo.com
ads.yahoo.com — Cisco Umbrella Rank: 1078
194 B
1 openx.net
us-u.openx.net — Cisco Umbrella Rank: 364
275 B
1 twitter.com
analytics.twitter.com — Cisco Umbrella Rank: 507
354 B
1 t.co
t.co — Cisco Umbrella Rank: 467
337 B
1 reddit.com
alb.reddit.com — Cisco Umbrella Rank: 1492
157 B
1 everesttech.net
cm.everesttech.net — Cisco Umbrella Rank: 866
517 B
1 redditstatic.com
www.redditstatic.com — Cisco Umbrella Rank: 1383
7 KB
1 bttrack.com
cdn.bttrack.com — Cisco Umbrella Rank: 7027
4 KB
1 licdn.com
snap.licdn.com — Cisco Umbrella Rank: 775
3 KB
1 googleadservices.com
www.googleadservices.com — Cisco Umbrella Rank: 127
15 KB
1 ads-twitter.com
static.ads-twitter.com — Cisco Umbrella Rank: 632
14 KB
1 bizibly.com
cdn.bizibly.com — Cisco Umbrella Rank: 8838
203 B
1 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 80
96 KB
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 55
1 KB
122 39
Domain Requested by
18 blogs.blackberry.com blogs.blackberry.com
12 d.adroll.com 7 redirects s.adroll.com
8 s.adroll.com 2 redirects blogs.blackberry.com
s.adroll.com
d.adroll.com
7 assets.adobedtm.com blogs.blackberry.com
assets.adobedtm.com
5 www.google.de blogs.blackberry.com
5 www.google.com blogs.blackberry.com
5 www.google-analytics.com www.googletagmanager.com
blogs.blackberry.com
cdn.bizible.com
4 pixel.mathtag.com 10049132.fls.doubleclick.net
pixel.mathtag.com
4 cdn.bizible.com blogs.blackberry.com
cdn.bizible.com
3 www.facebook.com blogs.blackberry.com
3 n.clarity.ms www.clarity.ms
cdn.bizible.com
3 stats.g.doubleclick.net cdn.bizible.com
3 px.ads.linkedin.com 3 redirects
3 connect.facebook.net blogs.blackberry.com
connect.facebook.net
3 bat.bing.com www.googletagmanager.com
bat.bing.com
blogs.blackberry.com
3 10049132.fls.doubleclick.net 1 redirects www.googletagmanager.com
adservice.google.com
3 fonts.gstatic.com fonts.googleapis.com
3 ka-f.fontawesome.com kit.fontawesome.com
2 ib.adnxs.com 1 redirects
2 cm.g.doubleclick.net 2 redirects
2 x.bidswitch.net 1 redirects
2 c.clarity.ms 1 redirects
2 pi.pardot.com blogs.blackberry.com
pi.pardot.com
2 adservice.google.de 1 redirects adservice.google.com
2 adservice.google.com 10049132.fls.doubleclick.net
9632625.fls.doubleclick.net
2 googleads.g.doubleclick.net www.googleadservices.com
2 px4.ads.linkedin.com blogs.blackberry.com
2 9632625.fls.doubleclick.net 1 redirects www.googletagmanager.com
2 dpm.demdex.net cdn.bizible.com
blogs.blackberry.com
1 bb.blackberry.com pi.pardot.com
1 ads.yahoo.com
1 us-u.openx.net
1 insight.adsrvr.org js.adsrvr.org
1 c.bing.com 1 redirects
1 pixels.argusplatform.com cdn.bizible.com
1 blackberrylimited.sc.omtrdc.net blogs.blackberry.com
1 analytics.twitter.com blogs.blackberry.com
1 t.co blogs.blackberry.com
1 www.clarity.ms bat.bing.com
1 alb.reddit.com blogs.blackberry.com
1 apt.techtarget.com blogs.blackberry.com
1 blackberrylimited.tt.omtrdc.net cdn.bizible.com
1 cm.everesttech.net 1 redirects
1 blackberry.demdex.net assets.adobedtm.com
1 www.linkedin.com 1 redirects
1 www.argusplatform.com blogs.blackberry.com
1 argusplatform.com 1 redirects
1 www.redditstatic.com blogs.blackberry.com
1 trk.techtarget.com blogs.blackberry.com
1 cdn.bttrack.com www.googletagmanager.com
1 js.adsrvr.org www.googletagmanager.com
1 snap.licdn.com www.googletagmanager.com
1 www.googleadservices.com www.googletagmanager.com
1 static.ads-twitter.com www.googletagmanager.com
1 cdn.bizibly.com blogs.blackberry.com
1 www.googletagmanager.com blogs.blackberry.com
1 fonts.googleapis.com blogs.blackberry.com
1 kit.fontawesome.com blogs.blackberry.com
1 threatvector.cylance.com 1 redirects
1 www.cylance.com 1 redirects
122 60
Subject Issuer Validity Valid
*.blackberry.com
DigiCert TLS RSA SHA256 2020 CA1
2021-07-08 -
2022-08-08
a year crt.sh
assets.adobedtm.com
DigiCert TLS RSA SHA256 2020 CA1
2021-09-10 -
2022-09-10
a year crt.sh
io.bizible.com
DigiCert TLS RSA SHA256 2020 CA1
2021-06-30 -
2022-07-05
a year crt.sh
*.fontawesome.com
DigiCert TLS RSA SHA256 2020 CA1
2021-12-01 -
2023-01-01
a year crt.sh
upload.video.google.com
GTS CA 1C3
2022-05-25 -
2022-08-17
3 months crt.sh
*.google-analytics.com
GTS CA 1C3
2022-05-25 -
2022-08-17
3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2021-09-12 -
2022-09-11
a year crt.sh
*.gstatic.com
GTS CA 1C3
2022-05-25 -
2022-08-17
3 months crt.sh
*.demdex.net
DigiCert TLS RSA SHA256 2020 CA1
2021-10-19 -
2022-11-19
a year crt.sh
ads-twitter.com
DigiCert TLS RSA SHA256 2020 CA1
2021-07-21 -
2022-07-26
a year crt.sh
www.googleadservices.com
GTS CA 1C3
2022-05-25 -
2022-08-17
3 months crt.sh
snap.licdn.com
DigiCert SHA2 Secure Server CA
2022-03-01 -
2023-03-01
a year crt.sh
*.doubleclick.net
GTS CA 1C3
2022-05-25 -
2022-08-17
3 months crt.sh
www.bing.com
Microsoft RSA TLS CA 01
2022-06-10 -
2022-12-10
6 months crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA
2022-03-20 -
2022-06-18
3 months crt.sh
*.adsrvr.org
GlobalSign GCC R3 DV TLS CA 2020
2022-03-31 -
2023-05-02
a year crt.sh
*.bttrack.com
Sectigo RSA Domain Validation Secure Server CA
2022-03-21 -
2023-04-20
a year crt.sh
www.redditstatic.com
DigiCert TLS RSA SHA256 2020 CA1
2022-02-17 -
2022-08-16
6 months crt.sh
*.g.doubleclick.net
GTS CA 1C3
2022-05-25 -
2022-08-17
3 months crt.sh
*.tt.omtrdc.net
DigiCert TLS RSA SHA256 2020 CA1
2021-10-11 -
2022-10-12
a year crt.sh
*.techtarget.com
Sectigo RSA Domain Validation Secure Server CA
2021-10-13 -
2022-11-12
a year crt.sh
*.google.com
GTS CA 1C3
2022-05-25 -
2022-08-17
3 months crt.sh
*.reddit.com
DigiCert TLS RSA SHA256 2020 CA1
2022-02-17 -
2022-08-16
6 months crt.sh
www.google.com
GTS CA 1C3
2022-05-25 -
2022-08-17
3 months crt.sh
www.google.de
GTS CA 1C3
2022-05-25 -
2022-08-17
3 months crt.sh
www.clarity.ms
DigiCert TLS RSA SHA256 2020 CA1
2022-02-27 -
2023-02-27
a year crt.sh
t.co
DigiCert TLS Hybrid ECC SHA384 2020 CA1
2022-03-07 -
2023-03-06
a year crt.sh
*.twitter.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1
2022-03-07 -
2023-03-06
a year crt.sh
*.google.de
GTS CA 1C3
2022-05-25 -
2022-08-17
3 months crt.sh
*.sc.omtrdc.net
DigiCert TLS Hybrid ECC SHA384 2020 CA1
2022-02-17 -
2023-03-07
a year crt.sh
a.clarity.ms
Microsoft Azure TLS Issuing CA 02
2022-06-07 -
2023-06-02
a year crt.sh
pixel.mathtag.com
DigiCert SHA2 Secure Server CA
2021-06-29 -
2022-07-07
a year crt.sh
pi.pardot.com
DigiCert TLS RSA SHA256 2020 CA1
2021-11-08 -
2022-11-07
a year crt.sh
pixels.argusplatform.com
R3
2022-04-12 -
2022-07-11
3 months crt.sh
s.adroll.com
Amazon
2021-08-02 -
2022-08-31
a year crt.sh
adroll.mgr.consensu.org
Amazon
2021-09-09 -
2022-10-08
a year crt.sh
bb.blackberry.com
R3
2022-05-02 -
2022-07-31
3 months crt.sh

This page contains 11 frames:

Primary Page: https://blogs.blackberry.com/en/2017/05/threat-spotlight-the-return-of-qakbot-malware
Frame ID: 02BB45897901C8BE1FCEFA3D3344B30E
Requests: 109 HTTP requests in this frame

Frame: https://10049132.fls.doubleclick.net/activityi;dc_pre=CJW1te_Wo_gCFZkgBgAdeygOUQ;src=10049132;type=sitep0;cat=allpa0;ord=8870997497988;gtm=2wg680;auiddc=1731650709.1654891397;u1=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware;~oref=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware
Frame ID: 8CE5177BB50740534913F113150B5193
Requests: 1 HTTP requests in this frame

Frame: https://9632625.fls.doubleclick.net/activityi;dc_pre=CMP4te_Wo_gCFYgfBgAdJAYJxg;src=9632625;type=apac-0;cat=black0;ord=6598555999121;gtm=2wg680;auiddc=1731650709.1654891397;~oref=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware
Frame ID: 1B72CA14B972DFBDE7E9B67A2809FE59
Requests: 1 HTTP requests in this frame

Frame: https://blackberry.demdex.net/dest5.html?d_nsid=0
Frame ID: EBEDD6740B8E50504C1BF2D3A2057D39
Requests: 1 HTTP requests in this frame

Frame: https://adservice.google.com/ddm/fls/i/dc_pre=CJW1te_Wo_gCFZkgBgAdeygOUQ;src=10049132;type=sitep0;cat=allpa0;ord=8870997497988;gtm=2wg680;auiddc=1731650709.1654891397;u1=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware;~oref=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware
Frame ID: DCCCFB4D1EA53B7EF56D5058443F1FAC
Requests: 1 HTTP requests in this frame

Frame: https://adservice.google.com/ddm/fls/i/dc_pre=CMP4te_Wo_gCFYgfBgAdJAYJxg;src=9632625;type=apac-0;cat=black0;ord=6598555999121;gtm=2wg680;auiddc=1731650709.1654891397;~oref=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware
Frame ID: 33F904C348A2E0C9FDC0500BF8248752
Requests: 1 HTTP requests in this frame

Frame: https://adservice.google.de/ddm/fls/i/dc_pre=CMP4te_Wo_gCFYgfBgAdJAYJxg;src=9632625;type=apac-0;cat=black0;ord=6598555999121;gtm=2wg680;auiddc=1731650709.1654891397;~oref=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware
Frame ID: 40CE90B08D2C7584C89DE11DB6E679F4
Requests: 1 HTTP requests in this frame

Frame: https://10049132.fls.doubleclick.net/ddm/fls/r/dc_pre=CJW1te_Wo_gCFZkgBgAdeygOUQ;src=10049132;type=sitep0;cat=allpa0;ord=8870997497988;gtm=2wg680;auiddc=1731650709.1654891397;u1=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware;~oref=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware
Frame ID: 044442F004B26FB360A71D06FCC67CB4
Requests: 3 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: D615D218540A423BC66DC4B6A3EEBD55
Requests: 1 HTTP requests in this frame

Frame: https://pixel.mathtag.com/sync/iframe?mt_uuid=e67f62a3-a387-4a00-919e-11037532e1d4&no_iframe=1&mt_adid=237288&source=mathtag
Frame ID: D7C17F7A041BF8D9F0D8C344DC4A9A52
Requests: 2 HTTP requests in this frame

Frame: https://insight.adsrvr.org/track/up?adv=xdd0wy7&ref=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware&upid=ynlwqiy&upv=1.1.0
Frame ID: DCEA3DA066EB180FDAF6891280610CB7
Requests: 1 HTTP requests in this frame

Screenshot

Page Title

Threat Spotlight: The Return of Qakbot Malware

Page URL History Show full URLs

  1. https://www.cylance.com/en_us/blog/threat-spotlight-the-return-of-qakbot-malware.html HTTP 301
    https://threatvector.cylance.com/en_us/home/threat-spotlight-the-return-of-qakbot-malware.html HTTP 301
    https://blogs.blackberry.com/en/2017/05/threat-spotlight-the-return-of-qakbot-malware Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • /etc\.clientlibs/

Overall confidence: 100%
Detected patterns
  • (?:a|s)\.adroll\.com

Overall confidence: 100%
Detected patterns
  • adnxs\.(?:net|com)

Overall confidence: 100%
Detected patterns
  • //connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Overall confidence: 100%
Detected patterns
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
  • kit\.fontawesome\.com/([0-9a-z]+).js

Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js

Overall confidence: 100%
Detected patterns
  • <!-- (?:End )?Google Tag Manager -->
  • googletagmanager\.com/gtm\.js

Overall confidence: 100%
Detected patterns
  • snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.openx\.net

Overall confidence: 100%
Detected patterns
  • tracker\.js

Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

122
Requests

89 %
HTTPS

45 %
IPv6

39
Domains

60
Subdomains

50
IPs

9
Countries

2252 kB
Transfer

4228 kB
Size

73
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://www.cylance.com/en_us/blog/threat-spotlight-the-return-of-qakbot-malware.html HTTP 301
    https://threatvector.cylance.com/en_us/home/threat-spotlight-the-return-of-qakbot-malware.html HTTP 301
    https://blogs.blackberry.com/en/2017/05/threat-spotlight-the-return-of-qakbot-malware Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 43
  • https://10049132.fls.doubleclick.net/activityi;src=10049132;type=sitep0;cat=allpa0;ord=8870997497988;gtm=2wg680;auiddc=1731650709.1654891397;u1=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware;~oref=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware HTTP 302
  • https://10049132.fls.doubleclick.net/activityi;dc_pre=CJW1te_Wo_gCFZkgBgAdeygOUQ;src=10049132;type=sitep0;cat=allpa0;ord=8870997497988;gtm=2wg680;auiddc=1731650709.1654891397;u1=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware;~oref=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware
Request Chain 45
  • https://9632625.fls.doubleclick.net/activityi;src=9632625;type=apac-0;cat=black0;ord=6598555999121;gtm=2wg680;auiddc=1731650709.1654891397;~oref=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware HTTP 302
  • https://9632625.fls.doubleclick.net/activityi;dc_pre=CMP4te_Wo_gCFYgfBgAdJAYJxg;src=9632625;type=apac-0;cat=black0;ord=6598555999121;gtm=2wg680;auiddc=1731650709.1654891397;~oref=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware
Request Chain 51
  • https://argusplatform.com/js/wid.tracker.js HTTP 301
  • https://www.argusplatform.com/js/wid.tracker.js
Request Chain 52
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1537657&time=1654891396756&url=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware HTTP 302
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D1537657%26time%3D1654891396756%26url%3Dhttps%253A%252F%252Fblogs.blackberry.com%252Fen%252F2017%252F05%252Fthreat-spotlight-the-return-of-qakbot-malware%26liSync%3Dtrue HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1537657&time=1654891396756&url=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware&liSync=true HTTP 302
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1537657&time=1654891396756&url=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware&liSync=true&e_ipv6=AQJw-RSsATkdxQAAAYFPNsYhvL2Tdb5bY79nPEi3l4nfc0d35Tau18jO10iiPqqBuhwmT6pb
Request Chain 60
  • https://cm.everesttech.net/cm/dd?d_uuid=89068391059403092171126752195410223259 HTTP 302
  • https://dpm.demdex.net/ibs:dpid=411&dpuuid=YqOjhgAAAE6vtgOJ
Request Chain 81
  • https://adservice.google.de/ddm/fls/i/dc_pre=CJW1te_Wo_gCFZkgBgAdeygOUQ;src=10049132;type=sitep0;cat=allpa0;ord=8870997497988;gtm=2wg680;auiddc=1731650709.1654891397;u1=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware;~oref=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware HTTP 302
  • https://10049132.fls.doubleclick.net/ddm/fls/r/dc_pre=CJW1te_Wo_gCFZkgBgAdeygOUQ;src=10049132;type=sitep0;cat=allpa0;ord=8870997497988;gtm=2wg680;auiddc=1731650709.1654891397;u1=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware;~oref=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware
Request Chain 93
  • https://c.clarity.ms/c.gif HTTP 302
  • https://c.bing.com/c.gif?CtsSyncId=0A9E178EB85A4E2DBED6C065AEC5C7C7&RedC=c.clarity.ms&MXFR=16179E8F071E6B5800E38F30031E6576 HTTP 302
  • https://c.clarity.ms/c.gif?CtsSyncId=0A9E178EB85A4E2DBED6C065AEC5C7C7&MUID=3D2B5718EA9566DC2AA346A7EB476707
Request Chain 97
  • https://s.adroll.com/j/exp/OU3SUNRJWBHPTCY5X23OHE/index.js HTTP 302
  • https://s.adroll.com/j/exp/index.js
Request Chain 98
  • https://s.adroll.com/j/pre/OU3SUNRJWBHPTCY5X23OHE/JFQUMKJ3NRFIFLRA5FOQKB/fpconsent.js HTTP 302
  • https://s.adroll.com/j/pre/index.js
Request Chain 102
  • https://d.adroll.com/pixel/OU3SUNRJWBHPTCY5X23OHE/JFQUMKJ3NRFIFLRA5FOQKB?adroll_fpc=044c10e45112ff87f9ad8bb5816c6149-1654891398954&arrfrr=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware&pv=37656411927.26168&cookie=&adroll_s_ref=&keyw= HTTP 302
  • https://s.adroll.com/pixel/OU3SUNRJWBHPTCY5X23OHE/JFQUMKJ3NRFIFLRA5FOQKB/DK5HUUTRTBGDVAEMEQ4DX3.js
Request Chain 106
  • https://px.ads.linkedin.com/collect/?pid=2133314&fmt=gif HTTP 302
  • https://px4.ads.linkedin.com/collect?pid=2133314&fmt=gif&e_ipv6=AQIsBWg-OyU4EgAAAYFPNs0nokBALDRWTHzqafuFor5FqGHQ3bobd3LmdY6E01abPXTZKlT1
Request Chain 107
  • https://d.adroll.com/cm/b/out?adroll_fpc=044c10e45112ff87f9ad8bb5816c6149-1654891398954&arrfrr=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware&advertisable=OU3SUNRJWBHPTCY5X23OHE HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=44&user_id=MjJkZWJkZmYxMGRhNzUwMmU3M2QzNDkxODk0YzI1ZDE HTTP 302
  • https://x.bidswitch.net/ul_cb/sync?dsp_id=44&user_id=MjJkZWJkZmYxMGRhNzUwMmU3M2QzNDkxODk0YzI1ZDE
Request Chain 108
  • https://d.adroll.com/cm/g/out?adroll_fpc=044c10e45112ff87f9ad8bb5816c6149-1654891398954&arrfrr=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware&advertisable=OU3SUNRJWBHPTCY5X23OHE HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_sc&google_nid=artb&google_hm=It69_xDadQLnPTSRiUwl0Q HTTP 302
  • https://d.adroll.com/cm/g/in
Request Chain 109
  • https://d.adroll.com/cm/o/out?adroll_fpc=044c10e45112ff87f9ad8bb5816c6149-1654891398954&arrfrr=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware&advertisable=OU3SUNRJWBHPTCY5X23OHE HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537103138&val=22debdff10da7502e73d3491894c25d1&gdpr=1&gdpr_consent=
Request Chain 110
  • https://d.adroll.com/cm/r/out?adroll_fpc=044c10e45112ff87f9ad8bb5816c6149-1654891398954&arrfrr=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware&advertisable=OU3SUNRJWBHPTCY5X23OHE HTTP 302
  • https://ads.yahoo.com/cms/v1?esig=1~bf4e7dc4546a90c08591652d78a230d3f2ef5733&nwid=10001032567&sigv=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA
Request Chain 111
  • https://d.adroll.com/cm/x/out?adroll_fpc=044c10e45112ff87f9ad8bb5816c6149-1654891398954&arrfrr=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware&advertisable=OU3SUNRJWBHPTCY5X23OHE HTTP 302
  • https://ib.adnxs.com/setuid?entity=172&code=MjJkZWJkZmYxMGRhNzUwMmU3M2QzNDkxODk0YzI1ZDE HTTP 307
  • https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D172%26code%3DMjJkZWJkZmYxMGRhNzUwMmU3M2QzNDkxODk0YzI1ZDE
Request Chain 113
  • https://d.adroll.com/cm/g/out?adroll_fpc=044c10e45112ff87f9ad8bb5816c6149-1654891398954&arrfrr=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware&advertisable=OU3SUNRJWBHPTCY5X23OHE&google_nid=adroll5 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_sc&google_nid=artb&google_hm=It69_xDadQLnPTSRiUwl0Q HTTP 302
  • https://d.adroll.com/cm/g/in

122 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request threat-spotlight-the-return-of-qakbot-malware
blogs.blackberry.com/en/2017/05/
Redirect Chain
  • https://www.cylance.com/en_us/blog/threat-spotlight-the-return-of-qakbot-malware.html
  • https://threatvector.cylance.com/en_us/home/threat-spotlight-the-return-of-qakbot-malware.html
  • https://blogs.blackberry.com/en/2017/05/threat-spotlight-the-return-of-qakbot-malware
78 KB
19 KB
Document
General
Full URL
https://blogs.blackberry.com/en/2017/05/threat-spotlight-the-return-of-qakbot-malware
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:224a:6c00:19:cd0a:2e00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
1ee55b7f67c4a10c2b25ec199e100fb1f406821811cee1533006204c205e78e9
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
Strict-Transport-Security max-age=63072000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
age
16
cache-control
no-cache="set-cookie"
content-encoding
gzip
content-length
19298
content-security-policy
frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
content-type
text/html;charset=utf-8
date
Fri, 10 Jun 2022 20:03:00 GMT
etag
"136e3-5e10aad341ceb-gzip"
last-modified
Thu, 09 Jun 2022 21:40:55 GMT
server
Apache
strict-transport-security
max-age=63072000; includeSubdomains;
vary
Accept-Encoding
via
1.1 6b2d62d60926d8d51fdcbcc94fce643a.cloudfront.net (CloudFront)
x-amz-cf-id
fkp8UbEFVg90YDVfmyYUVKyQ76K6urVCrCmpenFuH53aFnr3zek6Sw==
x-amz-cf-pop
DUS51-P1
x-cache
Hit from cloudfront
x-content-type-options
nosniff
x-dispatcher
dispatcher4uswest2
x-frame-options
SAMEORIGIN
x-vhost
publish
x-xss-protection
1; mode=block

Redirect headers

Connection
Keep-Alive
Content-Length
293
Content-Type
text/html; charset=iso-8859-1
Date
Fri, 10 Jun 2022 20:03:17 GMT
Keep-Alive
timeout=5, max=100
Location
https://blogs.blackberry.com/en/2017/05/threat-spotlight-the-return-of-qakbot-malware
Server
Apache
clientlib-site.min.bbc0c5e28b641071137768a3f706cfae.css
blogs.blackberry.com/etc.clientlibs/blogs-bbcom/clientlibs/
207 KB
32 KB
Stylesheet
General
Full URL
https://blogs.blackberry.com/etc.clientlibs/blogs-bbcom/clientlibs/clientlib-site.min.bbc0c5e28b641071137768a3f706cfae.css
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2017/05/threat-spotlight-the-return-of-qakbot-malware
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:224a:6c00:19:cd0a:2e00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
f432c2e4fa2ca222a00f0b2a6ea2c68c4b3268616cc8c83cb08388dd6fe4541d
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
Strict-Transport-Security max-age=63072000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/en/2017/05/threat-spotlight-the-return-of-qakbot-malware
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

x-dispatcher
dispatcher3uswest2
content-security-policy
frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
content-encoding
gzip
x-content-type-options
nosniff
age
32279
x-vhost
publish
x-cache
Hit from cloudfront
vary
Accept-Encoding
content-length
32091
x-xss-protection
1; mode=block
last-modified
Tue, 19 Apr 2022 17:45:14 GMT
server
Apache
x-frame-options
SAMEORIGIN
date
Fri, 10 Jun 2022 11:05:18 GMT
strict-transport-security
max-age=63072000; includeSubdomains;
content-type
text/css;charset=utf-8
via
1.1 6b2d62d60926d8d51fdcbcc94fce643a.cloudfront.net (CloudFront)
cache-control
no-cache="set-cookie"
etag
"33a8a-5dd0570681e80-gzip"
x-amz-cf-pop
DUS51-P1
accept-ranges
bytes
x-amz-cf-id
eLTMwe-nEHfwAwVbXadSbMse7qrvyZTY0jF2iPPingYqRkpCmxqCYQ==
launch-17c42c38011b.min.js
assets.adobedtm.com/cb3160b9e813/dd47d4a7a48e/
518 KB
131 KB
Script
General
Full URL
https://assets.adobedtm.com/cb3160b9e813/dd47d4a7a48e/launch-17c42c38011b.min.js
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2017/05/threat-spotlight-the-return-of-qakbot-malware
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:b600:183::1e80 Milan, Italy, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
6070ae2e12a541dea96954e8697d468a1e5e406ca61b7ca7051986abfe0333bf

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Fri, 10 Jun 2022 20:03:17 GMT
content-encoding
gzip
last-modified
Fri, 10 Jun 2022 18:57:06 GMT
server
AkamaiNetStorage
etag
"023e4b427382ebd7fcd55e496634d56c:1654887426.045669"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://blogs.blackberry.com
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
133149
expires
Fri, 10 Jun 2022 21:03:17 GMT
bizible.js
cdn.bizible.com/scripts/
83 KB
25 KB
Script
General
Full URL
https://cdn.bizible.com/scripts/bizible.js
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2017/05/threat-spotlight-the-return-of-qakbot-malware
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.195.15.58 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/67D4) /
Resource Hash
65dad26d197878fdddaaa0ab1990b6a0bc7f6853c6db2af3e1970ba6c2f5b2a8

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Fri, 10 Jun 2022 20:03:17 GMT
content-encoding
gzip
last-modified
Thu, 09 Jun 2022 19:34:52 GMT
server
ECS (frb/67D4)
age
82114
etag
"9fd95ffd377cd81:0+gzip"
vary
Accept-Encoding
x-cache
HIT
content-type
application/x-javascript
cache-control
max-age=86400
content-length
25492
3c243f8233.js
kit.fontawesome.com/
11 KB
4 KB
Script
General
Full URL
https://kit.fontawesome.com/3c243f8233.js
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2017/05/threat-spotlight-the-return-of-qakbot-malware
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1734 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
22b22ab6217c7b299e896ac9bd55044fd72c25cf99410b1a724bf4eba90cb8e5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload

Request headers

Referer
https://blogs.blackberry.com/
Origin
https://blogs.blackberry.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Fri, 10 Jun 2022 20:03:17 GMT
content-encoding
gzip
cf-cache-status
REVALIDATED
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
origin, accept-encoding, access-control-request-headers, access-control-request-method
access-control-allow-methods
GET, OPTIONS
content-type
text/javascript
access-control-allow-origin
*
access-control-max-age
3000
cache-control
max-age=60, public, must-revalidate
strict-transport-security
max-age=31536000; preload
cf-ray
7194b5a259705bf1-FRA
access-control-allow-headers
accept, accept-langauge, content-language, content-type, fa-kit-token
x-request-id
FvRC8cH1e_jT2SoUNuVD
000_Qakbot_FINAL_LRG.png
blogs.blackberry.com/content/dam/blogs-blackberry-com/images/blogs/2017/05/
387 KB
388 KB
Image
General
Full URL
https://blogs.blackberry.com/content/dam/blogs-blackberry-com/images/blogs/2017/05/000_Qakbot_FINAL_LRG.png
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2017/05/threat-spotlight-the-return-of-qakbot-malware
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:224a:6c00:19:cd0a:2e00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
89a743f5b1bd2e857d2eb4150994f75bd4473728458934af97a6b82fa496d67e
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
Strict-Transport-Security max-age=63072000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/en/2017/05/threat-spotlight-the-return-of-qakbot-malware
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

x-dispatcher
dispatcher2uswest2
content-security-policy
frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
via
1.1 6b2d62d60926d8d51fdcbcc94fce643a.cloudfront.net (CloudFront)
x-content-type-options
nosniff
age
16
x-vhost
publish
x-cache
Hit from cloudfront
content-disposition
attachment
content-length
396451
x-xss-protection
1; mode=block
last-modified
Wed, 29 Jul 2020 21:51:55 GMT
server
Apache
x-frame-options
SAMEORIGIN
date
Fri, 10 Jun 2022 20:03:01 GMT
strict-transport-security
max-age=63072000; includeSubdomains;
content-type
image/png
cache-control
no-cache="set-cookie"
etag
"60ca3-5ab9b906e94c0"
x-amz-cf-pop
DUS51-P1
accept-ranges
bytes
x-amz-cf-id
WtrnLfmEJn8JGTLiB6ioqzHrYTVCwbKwdLTSoQOz5x3G2dYhPjxX6A==
Fig1-Qakbot.png
blogs.blackberry.com/content/dam/blogs-blackberry-com/images/blogs/2017/05/
41 KB
42 KB
Image
General
Full URL
https://blogs.blackberry.com/content/dam/blogs-blackberry-com/images/blogs/2017/05/Fig1-Qakbot.png
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2017/05/threat-spotlight-the-return-of-qakbot-malware
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:224a:6c00:19:cd0a:2e00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
0742c26ce98bb3775d7a7a90a8d55b8e8da1af0379177c4404bda91b1401348f
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
Strict-Transport-Security max-age=63072000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/en/2017/05/threat-spotlight-the-return-of-qakbot-malware
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

x-dispatcher
dispatcher4uswest2
content-security-policy
frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
via
1.1 6b2d62d60926d8d51fdcbcc94fce643a.cloudfront.net (CloudFront)
x-content-type-options
nosniff
age
15
x-vhost
publish
x-cache
Hit from cloudfront
content-disposition
attachment
content-length
42396
x-xss-protection
1; mode=block
last-modified
Wed, 29 Jul 2020 21:51:11 GMT
server
Apache
x-frame-options
SAMEORIGIN
date
Fri, 10 Jun 2022 20:03:01 GMT
strict-transport-security
max-age=63072000; includeSubdomains;
content-type
image/png
cache-control
no-cache="set-cookie"
etag
"a59c-5ab9b8dcf31c0"
x-amz-cf-pop
DUS51-P1
accept-ranges
bytes
x-amz-cf-id
5rZm3yfnbcTIcDUrbg-CF5mF9XaC3dHvHd9FbsE5vr9CshFk3PuLpg==
Fig2-Qakbot.png
blogs.blackberry.com/content/dam/blogs-blackberry-com/images/blogs/2017/05/
236 KB
237 KB
Image
General
Full URL
https://blogs.blackberry.com/content/dam/blogs-blackberry-com/images/blogs/2017/05/Fig2-Qakbot.png
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2017/05/threat-spotlight-the-return-of-qakbot-malware
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:224a:6c00:19:cd0a:2e00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
6ebb1bc6f0cbbdf624730687c443fac5d444cd399938707e358a1876a040bfce
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
Strict-Transport-Security max-age=63072000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/en/2017/05/threat-spotlight-the-return-of-qakbot-malware
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

x-dispatcher
dispatcher3uswest2
content-security-policy
frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
via
1.1 6b2d62d60926d8d51fdcbcc94fce643a.cloudfront.net (CloudFront)
x-content-type-options
nosniff
age
16
x-vhost
publish
x-cache
Hit from cloudfront
content-disposition
attachment
content-length
241328
x-xss-protection
1; mode=block
last-modified
Wed, 29 Jul 2020 21:51:21 GMT
server
Apache
x-frame-options
SAMEORIGIN
date
Fri, 10 Jun 2022 20:03:01 GMT
strict-transport-security
max-age=63072000; includeSubdomains;
content-type
image/png
cache-control
no-cache="set-cookie"
etag
"3aeb0-5ab9b8e67c840"
x-amz-cf-pop
DUS51-P1
accept-ranges
bytes
x-amz-cf-id
_QN_HG_4ZSVu9gWh4kwAxjG5xa9LXt68bQTAqL4whi0DXBpQeK0NkA==
Fig3-Qakbot.png
blogs.blackberry.com/content/dam/blogs-blackberry-com/images/blogs/2017/05/
17 KB
17 KB
Image
General
Full URL
https://blogs.blackberry.com/content/dam/blogs-blackberry-com/images/blogs/2017/05/Fig3-Qakbot.png
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2017/05/threat-spotlight-the-return-of-qakbot-malware
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:224a:6c00:19:cd0a:2e00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
70368a9d6b125873d7c493c9288b816b62b28b726f0c03827475ae1076582592
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
Strict-Transport-Security max-age=63072000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/en/2017/05/threat-spotlight-the-return-of-qakbot-malware
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

x-dispatcher
dispatcher2uswest2
content-security-policy
frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
via
1.1 6b2d62d60926d8d51fdcbcc94fce643a.cloudfront.net (CloudFront)
x-content-type-options
nosniff
age
16
x-vhost
publish
x-cache
Hit from cloudfront
content-disposition
attachment
content-length
17162
x-xss-protection
1; mode=block
last-modified
Wed, 29 Jul 2020 21:51:23 GMT
server
Apache
x-frame-options
SAMEORIGIN
date
Fri, 10 Jun 2022 20:03:01 GMT
strict-transport-security
max-age=63072000; includeSubdomains;
content-type
image/png
cache-control
no-cache="set-cookie"
etag
"430a-5ab9b8e864cc0"
x-amz-cf-pop
DUS51-P1
accept-ranges
bytes
x-amz-cf-id
9BfmRVaYVyEO0IJvTyJt7Z5Y3e8tfAv0Ewwujh9UF4tx0wXX7Qb1-w==
Fig4-Qakbot.png
blogs.blackberry.com/content/dam/blogs-blackberry-com/images/blogs/2017/05/
183 KB
184 KB
Image
General
Full URL
https://blogs.blackberry.com/content/dam/blogs-blackberry-com/images/blogs/2017/05/Fig4-Qakbot.png
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2017/05/threat-spotlight-the-return-of-qakbot-malware
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:224a:6c00:19:cd0a:2e00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
719ee0cce9e7b5e8fa0e16e936f3dd8635e9d1bd5533dbb964ddc6aac088e733
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
Strict-Transport-Security max-age=63072000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/en/2017/05/threat-spotlight-the-return-of-qakbot-malware
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

x-dispatcher
dispatcher3uswest2
content-security-policy
frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
via
1.1 6b2d62d60926d8d51fdcbcc94fce643a.cloudfront.net (CloudFront)
x-content-type-options
nosniff
age
16
x-vhost
publish
x-cache
Hit from cloudfront
content-disposition
attachment
content-length
187270
x-xss-protection
1; mode=block
last-modified
Wed, 29 Jul 2020 21:51:26 GMT
server
Apache
x-frame-options
SAMEORIGIN
date
Fri, 10 Jun 2022 20:03:01 GMT
strict-transport-security
max-age=63072000; includeSubdomains;
content-type
image/png
cache-control
no-cache="set-cookie"
etag
"2db86-5ab9b8eb41380"
x-amz-cf-pop
DUS51-P1
accept-ranges
bytes
x-amz-cf-id
oTA4ErtY0OJtKIURWRRa8L0UJso05zTA81td7C4yXi-ulHlI3uAN3g==
Fig5-Qakbot.png
blogs.blackberry.com/content/dam/blogs-blackberry-com/images/blogs/2017/05/
157 KB
158 KB
Image
General
Full URL
https://blogs.blackberry.com/content/dam/blogs-blackberry-com/images/blogs/2017/05/Fig5-Qakbot.png
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2017/05/threat-spotlight-the-return-of-qakbot-malware
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:224a:6c00:19:cd0a:2e00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
5b50b97f1c1fb016ca2a19fd93491deb804d383c7b51f7ff2148cb8d3510b82a
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
Strict-Transport-Security max-age=63072000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/en/2017/05/threat-spotlight-the-return-of-qakbot-malware
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

x-dispatcher
dispatcher4uswest2
content-security-policy
frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
via
1.1 6b2d62d60926d8d51fdcbcc94fce643a.cloudfront.net (CloudFront)
x-content-type-options
nosniff
age
16
x-vhost
publish
x-cache
Hit from cloudfront
content-disposition
attachment
content-length
160853
x-xss-protection
1; mode=block
last-modified
Wed, 29 Jul 2020 21:51:34 GMT
server
Apache
x-frame-options
SAMEORIGIN
date
Fri, 10 Jun 2022 20:03:01 GMT
strict-transport-security
max-age=63072000; includeSubdomains;
content-type
image/png
cache-control
no-cache="set-cookie"
etag
"27455-5ab9b8f2e2580"
x-amz-cf-pop
DUS51-P1
accept-ranges
bytes
x-amz-cf-id
qvsp29zs2r1SN86U-B1fw1ex1WYOfF6aDk1NqRa0Qc0U2KqLqeg-vA==
Fig6-Qakbot.png
blogs.blackberry.com/content/dam/blogs-blackberry-com/images/blogs/2017/05/
129 KB
129 KB
Image
General
Full URL
https://blogs.blackberry.com/content/dam/blogs-blackberry-com/images/blogs/2017/05/Fig6-Qakbot.png
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2017/05/threat-spotlight-the-return-of-qakbot-malware
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:224a:6c00:19:cd0a:2e00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
695a37a60dc759b7c004dd71efa5557b5dc370baccbb3cd7b635489e345843cb
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
Strict-Transport-Security max-age=63072000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/en/2017/05/threat-spotlight-the-return-of-qakbot-malware
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

x-dispatcher
dispatcher2uswest2
content-security-policy
frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
via
1.1 6b2d62d60926d8d51fdcbcc94fce643a.cloudfront.net (CloudFront)
x-content-type-options
nosniff
age
16
x-vhost
publish
x-cache
Hit from cloudfront
content-disposition
attachment
content-length
131631
x-xss-protection
1; mode=block
last-modified
Wed, 29 Jul 2020 21:51:37 GMT
server
Apache
x-frame-options
SAMEORIGIN
date
Fri, 10 Jun 2022 20:03:01 GMT
strict-transport-security
max-age=63072000; includeSubdomains;
content-type
image/png
cache-control
no-cache="set-cookie"
etag
"2022f-5ab9b8f5bec40"
x-amz-cf-pop
DUS51-P1
accept-ranges
bytes
x-amz-cf-id
AMDjlQlXT0H0qy5c8m5-BTvNl6PXC9djirMqJQQnGNz2T60WDADYdw==
Fig7-Qakbot.png
blogs.blackberry.com/content/dam/blogs-blackberry-com/images/blogs/2017/05/
32 KB
33 KB
Image
General
Full URL
https://blogs.blackberry.com/content/dam/blogs-blackberry-com/images/blogs/2017/05/Fig7-Qakbot.png
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2017/05/threat-spotlight-the-return-of-qakbot-malware
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:224a:6c00:19:cd0a:2e00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
1f560975d9c8dd1b983de070ac170d94c20f2c04b6a3025398761b19588b6d0a
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
Strict-Transport-Security max-age=63072000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/en/2017/05/threat-spotlight-the-return-of-qakbot-malware
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

x-dispatcher
dispatcher4uswest2
content-security-policy
frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
via
1.1 6b2d62d60926d8d51fdcbcc94fce643a.cloudfront.net (CloudFront)
x-content-type-options
nosniff
age
16
x-vhost
publish
x-cache
Hit from cloudfront
content-disposition
attachment
content-length
32923
x-xss-protection
1; mode=block
last-modified
Wed, 29 Jul 2020 21:51:40 GMT
server
Apache
x-frame-options
SAMEORIGIN
date
Fri, 10 Jun 2022 20:03:01 GMT
strict-transport-security
max-age=63072000; includeSubdomains;
content-type
image/png
cache-control
no-cache="set-cookie"
etag
"809b-5ab9b8f89b300"
x-amz-cf-pop
DUS51-P1
accept-ranges
bytes
x-amz-cf-id
7KOII4BAl9Y-BPjSk6dHSXjl7qXc5505GysDP4zxIj1shk0TLoPcLg==
Fig8-Qakbot.png
blogs.blackberry.com/content/dam/blogs-blackberry-com/images/blogs/2017/05/
158 KB
158 KB
Image
General
Full URL
https://blogs.blackberry.com/content/dam/blogs-blackberry-com/images/blogs/2017/05/Fig8-Qakbot.png
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2017/05/threat-spotlight-the-return-of-qakbot-malware
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:224a:6c00:19:cd0a:2e00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
93a8b5d49340388d77b55240e81365ca4e3e68334d5bf45f2d672aec9e6d830f
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
Strict-Transport-Security max-age=63072000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/en/2017/05/threat-spotlight-the-return-of-qakbot-malware
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

x-dispatcher
dispatcher3uswest2
content-security-policy
frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
via
1.1 6b2d62d60926d8d51fdcbcc94fce643a.cloudfront.net (CloudFront)
x-content-type-options
nosniff
age
16
x-vhost
publish
x-cache
Hit from cloudfront
content-disposition
attachment
content-length
161485
x-xss-protection
1; mode=block
last-modified
Wed, 29 Jul 2020 21:51:42 GMT
server
Apache
x-frame-options
SAMEORIGIN
date
Fri, 10 Jun 2022 20:03:01 GMT
strict-transport-security
max-age=63072000; includeSubdomains;
content-type
image/png
cache-control
no-cache="set-cookie"
etag
"276cd-5ab9b8fa83780"
x-amz-cf-pop
DUS51-P1
accept-ranges
bytes
x-amz-cf-id
OaPMSx0d3EuFZTCvgzx7IwT4Xn-Q26Ls4k1Zasq54wdR6mpmMwnF9A==
generic-profile-image.png
blogs.blackberry.com/content/dam/blogs-blackberry-com/images/blogs/blackberry-blogs/img/
544 B
1 KB
Image
General
Full URL
https://blogs.blackberry.com/content/dam/blogs-blackberry-com/images/blogs/blackberry-blogs/img/generic-profile-image.png
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2017/05/threat-spotlight-the-return-of-qakbot-malware
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:224a:6c00:19:cd0a:2e00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
530b64892df953de23115ceeb9fcc58e063a266ae2ffda8805dc7a5a487bd44b
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
Strict-Transport-Security max-age=63072000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/en/2017/05/threat-spotlight-the-return-of-qakbot-malware
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

x-dispatcher
dispatcher2uswest2
content-security-policy
frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
via
1.1 6b2d62d60926d8d51fdcbcc94fce643a.cloudfront.net (CloudFront)
x-content-type-options
nosniff
age
16
x-vhost
publish
x-cache
Hit from cloudfront
content-disposition
attachment
content-length
544
x-xss-protection
1; mode=block
last-modified
Tue, 02 Apr 2019 20:38:32 GMT
server
Apache
x-frame-options
SAMEORIGIN
date
Fri, 10 Jun 2022 20:03:01 GMT
strict-transport-security
max-age=63072000; includeSubdomains;
content-type
image/png
cache-control
no-cache="set-cookie"
etag
"220-585921ecca200"
x-amz-cf-pop
DUS51-P1
accept-ranges
bytes
x-amz-cf-id
gn-Gv37CdQSK6dGC8kWKuOgi9jg-Rwd8ai-4d4AQJ1XftrEZrowooA==
jquery.min.4db6e885829bd8fc24f238a73222cb0e.js
blogs.blackberry.com/etc.clientlibs/shared/clientlibs/
86 KB
31 KB
Script
General
Full URL
https://blogs.blackberry.com/etc.clientlibs/shared/clientlibs/jquery.min.4db6e885829bd8fc24f238a73222cb0e.js
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2017/05/threat-spotlight-the-return-of-qakbot-malware
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:224a:6c00:19:cd0a:2e00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
0afeb0c59cda1372d24a059afe9de618c353070363a486cb04bdf8d4cad55d80
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
Strict-Transport-Security max-age=63072000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/en/2017/05/threat-spotlight-the-return-of-qakbot-malware
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

x-dispatcher
dispatcher3uswest2
content-security-policy
frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
content-encoding
gzip
x-content-type-options
nosniff
age
31891
x-vhost
publish
x-cache
Hit from cloudfront
vary
Accept-Encoding
content-length
31577
x-xss-protection
1; mode=block
last-modified
Wed, 19 Aug 2020 17:35:03 GMT
server
Apache
x-frame-options
SAMEORIGIN
date
Fri, 10 Jun 2022 11:11:46 GMT
strict-transport-security
max-age=63072000; includeSubdomains;
content-type
application/javascript;charset=utf-8
via
1.1 6b2d62d60926d8d51fdcbcc94fce643a.cloudfront.net (CloudFront)
cache-control
no-cache="set-cookie"
etag
"15950-5ad3e6c78ffc0-gzip"
x-amz-cf-pop
DUS51-P1
accept-ranges
bytes
x-amz-cf-id
jkq5zLj4TJwcbavGSvxHISa_BihK55pyEwfhE1qIliLxvEMfQQinyQ==
clientlib-dependencies.min.d41d8cd98f00b204e9800998ecf8427e.js
blogs.blackberry.com/etc.clientlibs/blogs-bbcom/clientlibs/
0
575 B
Script
General
Full URL
https://blogs.blackberry.com/etc.clientlibs/blogs-bbcom/clientlibs/clientlib-dependencies.min.d41d8cd98f00b204e9800998ecf8427e.js
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2017/05/threat-spotlight-the-return-of-qakbot-malware
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:224a:6c00:19:cd0a:2e00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
Strict-Transport-Security max-age=63072000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/en/2017/05/threat-spotlight-the-return-of-qakbot-malware
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

x-dispatcher
dispatcher3uswest2
content-security-policy
frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
via
1.1 6b2d62d60926d8d51fdcbcc94fce643a.cloudfront.net (CloudFront)
x-content-type-options
nosniff
age
31892
x-vhost
publish
x-cache
Hit from cloudfront
content-length
0
x-xss-protection
1; mode=block
last-modified
Wed, 19 Aug 2020 17:34:51 GMT
server
Apache
x-frame-options
SAMEORIGIN
date
Fri, 10 Jun 2022 11:11:45 GMT
strict-transport-security
max-age=63072000; includeSubdomains;
content-type
application/javascript;charset=utf-8
cache-control
no-cache="set-cookie"
etag
"0-5ad3e6bc1e4c0"
x-amz-cf-pop
DUS51-P1
accept-ranges
bytes
x-amz-cf-id
urD1pLXEqVL8Wpzf4hZEyS38xsEemZUj0T8inRHWNmX5Ct6qlOlCtA==
clientlib-site.min.e0d7ef5084ec9bf1817d23b07a2443e7.js
blogs.blackberry.com/etc.clientlibs/blogs-bbcom/clientlibs/
83 KB
25 KB
Script
General
Full URL
https://blogs.blackberry.com/etc.clientlibs/blogs-bbcom/clientlibs/clientlib-site.min.e0d7ef5084ec9bf1817d23b07a2443e7.js
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2017/05/threat-spotlight-the-return-of-qakbot-malware
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:224a:6c00:19:cd0a:2e00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
13480b9040646b2081af9ef2f1d640cf81b0780d1de18e9b4b9e57a0f726168b
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
Strict-Transport-Security max-age=63072000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/en/2017/05/threat-spotlight-the-return-of-qakbot-malware
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

x-dispatcher
dispatcher2uswest2
content-security-policy
frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
content-encoding
gzip
x-content-type-options
nosniff
age
31891
x-vhost
publish
x-cache
Hit from cloudfront
vary
Accept-Encoding
content-length
24980
x-xss-protection
1; mode=block
last-modified
Tue, 31 May 2022 15:41:00 GMT
server
Apache
x-frame-options
SAMEORIGIN
date
Fri, 10 Jun 2022 11:11:46 GMT
strict-transport-security
max-age=63072000; includeSubdomains;
content-type
application/javascript;charset=utf-8
via
1.1 6b2d62d60926d8d51fdcbcc94fce643a.cloudfront.net (CloudFront)
cache-control
no-cache="set-cookie"
etag
"14ac1-5e0509972db00-gzip"
x-amz-cf-pop
DUS51-P1
accept-ranges
bytes
x-amz-cf-id
gUtwwO2iuabjRrrpp4pUaGq2fMcZKGiyUDLCtAw4GPcegXqQ-Noqkg==
close.png
blogs.blackberry.com/content/dam/blackberry-com/Images/icons/
982 B
2 KB
Image
General
Full URL
https://blogs.blackberry.com/content/dam/blackberry-com/Images/icons/close.png
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2017/05/threat-spotlight-the-return-of-qakbot-malware
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:224a:6c00:19:cd0a:2e00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
b83a72a5c6851b1debd7a313f8929bf54ccc4629ef000301405eabd081dfacfb
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
Strict-Transport-Security max-age=63072000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/en/2017/05/threat-spotlight-the-return-of-qakbot-malware
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

x-dispatcher
dispatcher2uswest2
content-security-policy
frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
via
1.1 6b2d62d60926d8d51fdcbcc94fce643a.cloudfront.net (CloudFront)
x-content-type-options
nosniff
age
31891
x-vhost
publish
x-cache
Hit from cloudfront
content-disposition
attachment
content-length
982
x-xss-protection
1; mode=block
last-modified
Thu, 25 Apr 2019 15:53:12 GMT
server
Apache
x-frame-options
SAMEORIGIN
date
Fri, 10 Jun 2022 11:11:46 GMT
strict-transport-security
max-age=63072000; includeSubdomains;
content-type
image/png
cache-control
no-cache="set-cookie"
etag
"3d6-5875cd0b7ca00"
x-amz-cf-pop
DUS51-P1
accept-ranges
bytes
x-amz-cf-id
k-KLO2WwK-XYTnuy0PgqwmLw_Pxqye-FIcHw9JRZ3Y4-YZbzEHWhKg==
css
fonts.googleapis.com/
6 KB
1 KB
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Roboto:300,400,900&display=swap
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/etc.clientlibs/blogs-bbcom/clientlibs/clientlib-site.min.bbc0c5e28b641071137768a3f706cfae.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400e:811::200a , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
4c8417349722c7f6afdd6ff0124b20d345c952d91f46aa0192dae089bd007eef
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Fri, 10 Jun 2022 20:03:17 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
date
Fri, 10 Jun 2022 20:03:17 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Fri, 10 Jun 2022 20:03:17 GMT
gtm.js
www.googletagmanager.com/
416 KB
96 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-TXGFP23
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2017/05/threat-spotlight-the-return-of-qakbot-malware
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
42c68ba70eb0382c010a722e6fd025048fcce3db70c23fb03ba5919469493f1d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Fri, 10 Jun 2022 20:03:17 GMT
content-encoding
br
server
Google Tag Manager
access-control-allow-headers
Cache-Control
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
strict-transport-security
max-age=31536000; includeSubDomains
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
98117
x-xss-protection
0
expires
Fri, 10 Jun 2022 20:03:17 GMT
free.min.css
ka-f.fontawesome.com/releases/v5.15.4/css/
59 KB
13 KB
Fetch
General
Full URL
https://ka-f.fontawesome.com/releases/v5.15.4/css/free.min.css?token=3c243f8233
Requested by
Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/3c243f8233.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fc5128dfdcdfa0c3a9967a6d2f19399d7bf1aaae6ad7571b96b03915a1f30dda

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Fri, 10 Jun 2022 20:03:17 GMT
via
1.1 a51cc6644cb69546ec2778155f5f6288.cloudfront.net (CloudFront)
vary
Accept-Encoding
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
11771524
x-cache
Hit from cloudfront
access-control-allow-methods
GET
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Wed, 04 Aug 2021 18:53:09 GMT
server
cloudflare
etag
W/"a12ec7ebe75a4d59a5dd6b79e2ba2e16"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age
3000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gl2F%2F4FeNDL8rpgmDrGGqIMSJWL%2Bhr2Z%2BOFmFGJHqdzmUz1X3CiU5eu0pj4tckWlYGs10QICy8lmpFFiQJ%2BAaprF3kgkjNch1M1EfvO3gVdlB3tKrEW6QrYgBaHsfhBL8oXo8vLlL1IiPKI%2FiX8G3e6u2A%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31556926
x-amz-cf-pop
SLC50-C1
cf-ray
7194b5a39a2791d8-FRA
access-control-allow-headers
fa-kit-token
x-amz-cf-id
NJhiCYzdSG-q2opi0JAAdjV6cOhIQdcZhsLo_A0ysKDrJ0l8Bb4a5g==
free-v4-shims.min.css
ka-f.fontawesome.com/releases/v5.15.4/css/
26 KB
5 KB
Fetch
General
Full URL
https://ka-f.fontawesome.com/releases/v5.15.4/css/free-v4-shims.min.css?token=3c243f8233
Requested by
Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/3c243f8233.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6dea47458a4cd7cd7312cc780a53c62e0c8b3ccc8d0b13c1ac0ea6e3dfcecea8

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Fri, 10 Jun 2022 20:03:17 GMT
via
1.1 89cfaf7130b791496ae5b9cd16f7eb0a.cloudfront.net (CloudFront)
vary
Accept-Encoding
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
4154786
x-cache
Hit from cloudfront
access-control-allow-methods
GET
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Wed, 04 Aug 2021 18:53:09 GMT
server
cloudflare
etag
W/"76f34b71fc9fb641507ff6a822cc07f5"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age
3000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ktq6bLzXPXMbuKB%2BBpuf2U4aOQWIuTrwBLGSRErSA2ySufFVxhjYqMcb6YRyuMtG2nGND0DfkSPxLVYm3nwvs6DKmfPCEs7bGPBkjK68OKTdnd26lfecJkEo%2Bko3nDFBeUssmJfOxnzRl4lYmQhA%2BpD%2Fyw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31556926
x-amz-cf-pop
TXL50-P2
cf-ray
7194b5a39a2c91d8-FRA
access-control-allow-headers
fa-kit-token
x-amz-cf-id
loBMK1Oy_rNnREDdirT9S7iEOCgacNr4MM5QsdTHxBtFBBjbQy21MQ==
free-v4-font-face.min.css
ka-f.fontawesome.com/releases/v5.15.4/css/
3 KB
1 KB
Fetch
General
Full URL
https://ka-f.fontawesome.com/releases/v5.15.4/css/free-v4-font-face.min.css?token=3c243f8233
Requested by
Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/3c243f8233.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7f8b63bff49fba3c5bae30f4eb39f2fd6d088fbe9d7292bdf37b0ef4a1ec68d6

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Fri, 10 Jun 2022 20:03:17 GMT
via
1.1 b4e6a1301a11439372334aa14fb7d310.cloudfront.net (CloudFront)
vary
Accept-Encoding
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
4154786
x-cache
Hit from cloudfront
access-control-allow-methods
GET
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Wed, 04 Aug 2021 18:53:09 GMT
server
cloudflare
etag
W/"f2e0b2680d9b0bcb6e0039c4424e5a59"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age
3000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=76WK2uScd8zifACVk92pdLIjsfNm%2F%2FHy6u%2B%2FY1p8qybYfauxh0cbSNJA6Wt8uXYkX0SObQ4zoI3%2FZvmKFNuGQEcU54VRAlLW5D1Sp9dNKMjmsyJwGFslMzWWbyrtdSjtmkETYKst2XZcfNkzM2jeizcTdQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31556926
x-amz-cf-pop
TXL50-P2
cf-ray
7194b5a39a3191d8-FRA
access-control-allow-headers
fa-kit-token
x-amz-cf-id
5ZAAz0ocEbXgr3t0Nw8iuDxbg7OEV2W8LOnWaOaMA32PHraqyNbtVw==
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/
15 KB
16 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:300,400,900&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://blogs.blackberry.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Mon, 06 Jun 2022 11:07:47 GMT
x-content-type-options
nosniff
age
377730
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15744
x-xss-protection
0
last-modified
Wed, 11 May 2022 19:24:48 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 06 Jun 2023 11:07:47 GMT
KFOlCnqEu92Fr1MmSU5fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/
15 KB
15 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBBc4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:300,400,900&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f75911313e1c7802c23345ab57e754d87801581706780c993fb23ff4e0fe62ef
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://blogs.blackberry.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Mon, 06 Jun 2022 11:47:17 GMT
x-content-type-options
nosniff
age
375360
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15740
x-xss-protection
0
last-modified
Wed, 11 May 2022 19:24:56 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 06 Jun 2023 11:47:17 GMT
bnr-blue-gradient-crop.jpg
blogs.blackberry.com/content/dam/blackberry-com/Images/support/bgs/
48 KB
49 KB
Image
General
Full URL
https://blogs.blackberry.com/content/dam/blackberry-com/Images/support/bgs/bnr-blue-gradient-crop.jpg
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2017/05/threat-spotlight-the-return-of-qakbot-malware
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:224a:6c00:19:cd0a:2e00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
d104b74bae6e524bb21bfede62a270ff318122d005772d94e6d7cebbc53017fc
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
Strict-Transport-Security max-age=63072000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/en/2017/05/threat-spotlight-the-return-of-qakbot-malware
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

x-dispatcher
dispatcher1uswest2
content-security-policy
frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
via
1.1 6b2d62d60926d8d51fdcbcc94fce643a.cloudfront.net (CloudFront)
x-content-type-options
nosniff
age
31890
x-vhost
publish
x-cache
Hit from cloudfront
content-disposition
attachment
content-length
49272
x-xss-protection
1; mode=block
last-modified
Fri, 02 Nov 2018 16:55:27 GMT
server
Apache
x-frame-options
SAMEORIGIN
date
Fri, 10 Jun 2022 11:11:47 GMT
strict-transport-security
max-age=63072000; includeSubdomains;
content-type
image/jpeg
cache-control
no-cache="set-cookie"
etag
"c078-579b166f41dc0"
x-amz-cf-pop
DUS51-P1
accept-ranges
bytes
x-amz-cf-id
g0OQSGYvpyk2MJnxJMyz7rs-w6HrwlJY4IMRQ875zDygjD3KrTJZ2w==
KFOlCnqEu92Fr1MmYUtfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/
15 KB
15 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmYUtfBBc4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:300,400,900&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
7e262106f82cc52663e403f5b73795bbeab9ca0630c33c03579354fbcd4fae1e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://blogs.blackberry.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Mon, 06 Jun 2022 19:06:05 GMT
x-content-type-options
nosniff
age
349032
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15752
x-xss-protection
0
last-modified
Wed, 11 May 2022 19:24:56 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 06 Jun 2023 19:06:05 GMT
jquery.touchSwipe.min.js
blogs.blackberry.com/etc.clientlibs/bbcom/clientlibs/clientlib-etc-legacy/resources/bbcom-aem-project/scripts/plugins/touchswipe/
20 KB
6 KB
XHR
General
Full URL
https://blogs.blackberry.com/etc.clientlibs/bbcom/clientlibs/clientlib-etc-legacy/resources/bbcom-aem-project/scripts/plugins/touchswipe/jquery.touchSwipe.min.js?_=1654891396395
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/etc.clientlibs/shared/clientlibs/jquery.min.4db6e885829bd8fc24f238a73222cb0e.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:224a:6c00:19:cd0a:2e00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
9167cb37ed21405ef9556646b83789a2099c15398f5cea867470df1e81752e17
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
Strict-Transport-Security max-age=63072000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Referer
https://blogs.blackberry.com/en/2017/05/threat-spotlight-the-return-of-qakbot-malware
X-Requested-With
XMLHttpRequest
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

x-dispatcher
dispatcher3uswest2
content-security-policy
frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
content-encoding
gzip
x-content-type-options
nosniff
age
32278
x-vhost
publish
x-cache
Hit from cloudfront
vary
Accept-Encoding
content-length
5051
x-xss-protection
1; mode=block
last-modified
Wed, 19 Aug 2020 17:34:39 GMT
server
Apache
x-frame-options
SAMEORIGIN
date
Fri, 10 Jun 2022 11:05:19 GMT
strict-transport-security
max-age=63072000; includeSubdomains;
content-type
application/javascript
via
1.1 6b2d62d60926d8d51fdcbcc94fce643a.cloudfront.net (CloudFront)
cache-control
max-age=86400, public, no-cache="set-cookie"
x-amz-cf-pop
DUS51-P1
x-amz-cf-id
Rdvt7JicZcRoZE0WIDYKbYMfhUREyi65wEmFqY7A1hi5Uum8irFpCQ==
ipv
cdn.bizible.com/m/
43 B
309 B
Image
General
Full URL
https://cdn.bizible.com/m/ipv?_biz_r=&_biz_h=-1906410348&_biz_u=9742e70dc8724dc7f70b90bdd781a9ba&_biz_s=dec5c&_biz_l=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware&_biz_t=1654891396492&_biz_i=Threat%20Spotlight%3A%20The%20Return%20of%20Qakbot%20Malware&_biz_n=0&rnd=101857&cdn_o=a&_biz_z=1654891396493
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2017/05/threat-spotlight-the-return-of-qakbot-malware
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.195.15.58 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/6739) /
Resource Hash
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 10 Jun 2022 20:03:17 GMT
last-modified
Thu, 09 Jun 2022 01:07:02 GMT
server
ECS (frb/6739)
age
154575
x-cache
HIT
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
cache-control
no-cache, no-store
accept-ranges
bytes
content-type
Image/GIF
content-length
43
expires
-1
u
cdn.bizibly.com/
43 B
203 B
Image
General
Full URL
https://cdn.bizibly.com/u?_biz_u=9742e70dc8724dc7f70b90bdd781a9ba&_biz_s=dec5c&_biz_l=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware&_biz_t=1654891396496&_biz_i=Threat%20Spotlight%3A%20The%20Return%20of%20Qakbot%20Malware&rnd=37639&cdn_o=a&_biz_z=1654891396496
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2017/05/threat-spotlight-the-return-of-qakbot-malware
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.195.15.58 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/67C2) /
Resource Hash
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 10 Jun 2022 20:03:17 GMT
last-modified
Thu, 09 Jun 2022 23:58:11 GMT
server
ECS (frb/67C2)
age
72306
x-cache
HIT
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
cache-control
no-cache, no-store
accept-ranges
bytes
content-type
Image/GIF
content-length
43
expires
-1
id
dpm.demdex.net/
369 B
1 KB
XHR
General
Full URL
https://dpm.demdex.net/id?d_visid_ver=5.2.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=85522AC5562681557F000101%40AdobeOrg&d_nsid=0&ts=1654891396519
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
108.128.0.238 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-108-128-0-238.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
9669f8a9f73d1619c41d568ae4d785e961015ebc2b4368c11e388993990f8925
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://blogs.blackberry.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

DCS
dcs-prod-irl1-1-v034-07885c986.edge-irl1.demdex.com UNKNOWN
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
content-encoding
gzip
X-TID
/u2FVqxzT/U=
Vary
Origin
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin
https://blogs.blackberry.com
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json;charset=utf-8
Content-Length
313
Expires
Thu, 01 Jan 1970 00:00:00 UTC
AppMeasurement.min.js
assets.adobedtm.com/extensions/EPbde2f7ca14e540399dcc1f8208860b7b/
33 KB
12 KB
Script
General
Full URL
https://assets.adobedtm.com/extensions/EPbde2f7ca14e540399dcc1f8208860b7b/AppMeasurement.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/cb3160b9e813/dd47d4a7a48e/launch-17c42c38011b.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:b600:183::1e80 Milan, Italy, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
d6b423c91328eec9c218dd8b21ae1e676987d574e5432411a32806e5dd2bde32

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Fri, 10 Jun 2022 20:03:17 GMT
content-encoding
gzip
last-modified
Wed, 12 Aug 2020 22:09:52 GMT
server
AkamaiNetStorage
etag
"f259ee6445c19c2ce3c64a1b117a4f35:1597270192.577101"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://blogs.blackberry.com
cache-control
no-cache
accept-ranges
bytes
timing-allow-origin
*
content-length
12184
expires
Fri, 10 Jun 2022 21:03:17 GMT
AppMeasurement_Module_ActivityMap.min.js
assets.adobedtm.com/extensions/EPbde2f7ca14e540399dcc1f8208860b7b/
3 KB
2 KB
Script
General
Full URL
https://assets.adobedtm.com/extensions/EPbde2f7ca14e540399dcc1f8208860b7b/AppMeasurement_Module_ActivityMap.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/cb3160b9e813/dd47d4a7a48e/launch-17c42c38011b.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:b600:183::1e80 Milan, Italy, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
0486530f1e98818865754a08e1b5442ac5a6a36a6bf6042e3b3338a532e998d2

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Fri, 10 Jun 2022 20:03:17 GMT
content-encoding
gzip
last-modified
Wed, 12 Aug 2020 22:09:52 GMT
server
AkamaiNetStorage
etag
"5dedcda2c8a6c3a51fd419d306427010:1597270192.857753"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://blogs.blackberry.com
cache-control
no-cache
accept-ranges
bytes
timing-allow-origin
*
content-length
1594
expires
Fri, 10 Jun 2022 21:03:17 GMT
RC893dfb150d504ddd90bdbeaa1344e88c-source.min.js
assets.adobedtm.com/cb3160b9e813/dd47d4a7a48e/5441bfaaa330/
787 B
730 B
Script
General
Full URL
https://assets.adobedtm.com/cb3160b9e813/dd47d4a7a48e/5441bfaaa330/RC893dfb150d504ddd90bdbeaa1344e88c-source.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/cb3160b9e813/dd47d4a7a48e/launch-17c42c38011b.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:b600:183::1e80 Milan, Italy, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
fac090fb3cce5397bdc8a6d76b91f68ab0125114b8af211e65d4ebd0ce8dbf1b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Fri, 10 Jun 2022 20:03:17 GMT
content-encoding
gzip
last-modified
Fri, 10 Jun 2022 18:57:06 GMT
server
AkamaiNetStorage
etag
"43baa33505504fa322bcaee3b36e80d1:1654887426.977238"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://blogs.blackberry.com
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
461
expires
Fri, 10 Jun 2022 21:03:17 GMT
RCe72439bdf9bb4cf1b31863f77917404a-source.min.js
assets.adobedtm.com/cb3160b9e813/dd47d4a7a48e/5441bfaaa330/
772 B
749 B
Script
General
Full URL
https://assets.adobedtm.com/cb3160b9e813/dd47d4a7a48e/5441bfaaa330/RCe72439bdf9bb4cf1b31863f77917404a-source.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/cb3160b9e813/dd47d4a7a48e/launch-17c42c38011b.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:b600:183::1e80 Milan, Italy, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
9035d9c6ec8e6558bef5e0382a84871c5b1c4db470806ca19e8c0181b757dba6

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Fri, 10 Jun 2022 20:03:17 GMT
content-encoding
gzip
last-modified
Fri, 10 Jun 2022 18:57:06 GMT
server
AkamaiNetStorage
etag
"43baa33505504fa322bcaee3b36e80d1:1654887426.977238"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://blogs.blackberry.com
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
480
expires
Fri, 10 Jun 2022 21:03:17 GMT
RCe3cb7aafc0ac4830bc990c1893b34104-source.min.js
assets.adobedtm.com/cb3160b9e813/dd47d4a7a48e/5441bfaaa330/
1 KB
892 B
Script
General
Full URL
https://assets.adobedtm.com/cb3160b9e813/dd47d4a7a48e/5441bfaaa330/RCe3cb7aafc0ac4830bc990c1893b34104-source.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/cb3160b9e813/dd47d4a7a48e/launch-17c42c38011b.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:b600:183::1e80 Milan, Italy, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
d61de641350857348e74f3cc62441d3927106a296c73bc48fa4c7c0230ae5f2b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Fri, 10 Jun 2022 20:03:17 GMT
content-encoding
gzip
last-modified
Fri, 10 Jun 2022 18:57:06 GMT
server
AkamaiNetStorage
etag
"43baa33505504fa322bcaee3b36e80d1:1654887426.977238"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://blogs.blackberry.com
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
623
expires
Fri, 10 Jun 2022 21:03:17 GMT
RCc01965bb53cc433f9c0f9f179432557c-source.min.js
assets.adobedtm.com/cb3160b9e813/dd47d4a7a48e/5441bfaaa330/
924 B
722 B
Script
General
Full URL
https://assets.adobedtm.com/cb3160b9e813/dd47d4a7a48e/5441bfaaa330/RCc01965bb53cc433f9c0f9f179432557c-source.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/cb3160b9e813/dd47d4a7a48e/launch-17c42c38011b.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:b600:183::1e80 Milan, Italy, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
7266d887ea9327e1e862de9cfb631fdcc5f9653d5f68f20df21efed61dd87360

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Fri, 10 Jun 2022 20:03:17 GMT
content-encoding
gzip
last-modified
Fri, 10 Jun 2022 18:57:06 GMT
server
AkamaiNetStorage
etag
"43baa33505504fa322bcaee3b36e80d1:1654887426.977238"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://blogs.blackberry.com
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
453
expires
Fri, 10 Jun 2022 21:03:17 GMT
xdc.js
cdn.bizible.com/
116 B
526 B
Script
General
Full URL
https://cdn.bizible.com/xdc.js?_biz_u=9742e70dc8724dc7f70b90bdd781a9ba&_biz_h=-1906410348&cdn_o=a&jsVer=4.22.05.27
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.195.15.58 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/6711) /
Resource Hash
bb0e7b3385c6fc42b0e4894226c01e6e42b1e43f1233857678eddcf0781fff09

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Fri, 10 Jun 2022 20:03:17 GMT
content-encoding
gzip
server
ECS (frb/6711)
etag
BB263B1A
vary
Accept-Encoding
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
cache-control
private, must-revalidate, max-age=21600
content-type
text/javascript; charset=utf-8
content-length
218
optimize.js
www.google-analytics.com/gtm/
106 KB
40 KB
Script
General
Full URL
https://www.google-analytics.com/gtm/optimize.js?id=GTM-WFTQC9H
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXGFP23
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
c5fe76c8204885b3c3c0425c8b6adf273659bef30bd84097540b24a6bd9a0bbe
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Fri, 10 Jun 2022 20:03:18 GMT
content-encoding
br
server
Google Tag Manager
access-control-allow-headers
Cache-Control
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
strict-transport-security
max-age=31536000; includeSubDomains
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
40536
x-xss-protection
0
expires
Fri, 10 Jun 2022 20:03:18 GMT
analytics.js
www.google-analytics.com/
49 KB
20 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXGFP23
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 13 Apr 2022 21:02:38 GMT
server
Golfe2
age
1712
date
Fri, 10 Jun 2022 19:34:46 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
20006
expires
Fri, 10 Jun 2022 21:34:46 GMT
uwt.js
static.ads-twitter.com/
49 KB
14 KB
Script
General
Full URL
https://static.ads-twitter.com/uwt.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXGFP23
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.232.188.157 Munich, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
05448e9440e5f8a66395d7d66a9bfcb9614a80e4e181f6347cd742ec36725ca6

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Fri, 10 Jun 2022 20:03:18 GMT
content-encoding
gzip
last-modified
Wed, 08 Jun 2022 18:52:59 GMT
etag
"90b3a450b1a5741eca2aac717f3ebbc2+gzip+gzip"
vary
Accept-Encoding,Host
x-tw-cdn
FT
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
cache-control
no-cache
x-cache
HIT, HIT
accept-ranges
bytes
content-type
application/javascript; charset=utf-8
content-length
13714
x-served-by
cache-iad-kcgs7200048-IAD, cache-muc13974-MUC
conversion_async.js
www.googleadservices.com/pagead/
39 KB
15 KB
Script
General
Full URL
https://www.googleadservices.com/pagead/conversion_async.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXGFP23
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s04-in-f2.1e100.net
Software
cafe /
Resource Hash
22f38bcd5544708fe83348bf6b068d4f521e0cb16c32d0256b7e027760114bad
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Fri, 10 Jun 2022 20:03:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15069
x-xss-protection
0
server
cafe
etag
11223643544955582496
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Fri, 10 Jun 2022 20:03:18 GMT
insight.min.js
snap.licdn.com/li.lms-analytics/
8 KB
3 KB
Script
General
Full URL
https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXGFP23
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:f7::5c7b:e06b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
14f2ec002b176e0dee403cb7dd4ef2274a1353080e1e3e4084678770f4c15b9c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

X-EdgeConnect-Origin-MEX-Latency
662
Date
Fri, 10 Jun 2022 20:03:18 GMT
Content-Encoding
gzip
Last-Modified
Wed, 13 Apr 2022 23:25:22 GMT
X-CDN
AKAM
X-EdgeConnect-MidMile-RTT
0
Vary
Accept-Encoding
Content-Type
application/x-javascript;charset=utf-8
Cache-Control
max-age=86265
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
3085
activityi;dc_pre=CJW1te_Wo_gCFZkgBgAdeygOUQ;src=10049132;type=sitep0;cat=allpa0;ord=8870997497988;gtm=2wg680;auiddc=1731650709.1654891397;u1=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fth...
10049132.fls.doubleclick.net/ Frame 8CE5
Redirect Chain
  • https://10049132.fls.doubleclick.net/activityi;src=10049132;type=sitep0;cat=allpa0;ord=8870997497988;gtm=2wg680;auiddc=1731650709.1654891397;u1=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2...
  • https://10049132.fls.doubleclick.net/activityi;dc_pre=CJW1te_Wo_gCFZkgBgAdeygOUQ;src=10049132;type=sitep0;cat=allpa0;ord=8870997497988;gtm=2wg680;auiddc=1731650709.1654891397;u1=https%3A%2F%2Fblogs...
651 B
610 B
Document
General
Full URL
https://10049132.fls.doubleclick.net/activityi;dc_pre=CJW1te_Wo_gCFZkgBgAdeygOUQ;src=10049132;type=sitep0;cat=allpa0;ord=8870997497988;gtm=2wg680;auiddc=1731650709.1654891397;u1=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware;~oref=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware?
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXGFP23
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.18.6 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s22-in-f6.1e100.net
Software
cafe /
Resource Hash
2c14ab968f7de8be805e40a91ecd9a307d6d03130724fb9bf15ec0c4b44d2f24
Security Headers
Name Value
Strict-Transport-Security max-age=21600
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
about:blank
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
no-cache, must-revalidate
content-encoding
gzip
content-length
433
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Fri, 10 Jun 2022 20:03:18 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma
no-cache
server
cafe
strict-transport-security
max-age=21600
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0

Redirect headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
no-cache, must-revalidate
content-length
0
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Fri, 10 Jun 2022 20:03:18 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown
1
location
https://10049132.fls.doubleclick.net/activityi;dc_pre=CJW1te_Wo_gCFZkgBgAdeygOUQ;src=10049132;type=sitep0;cat=allpa0;ord=8870997497988;gtm=2wg680;auiddc=1731650709.1654891397;u1=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware;~oref=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware?
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma
no-cache
server
cafe
strict-transport-security
max-age=21600
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
bat.js
bat.bing.com/
38 KB
12 KB
Script
General
Full URL
https://bat.bing.com/bat.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXGFP23
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
8540c5e2d2e85cc6c5d46b1b06b7f6642dce39e0314299a08976cfe6053c7c52
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
last-modified
Wed, 09 Feb 2022 23:54:49 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: DE1ABEECF8B44B2BB68B5DEEF07D9BAD Ref B: FRAEDGE1218 Ref C: 2022-06-10T20:03:18Z
etag
"806a236c101ed81:0"
vary
Accept-Encoding
x-cache
CONFIG_NOCACHE
content-type
application/javascript
access-control-allow-origin
*
cache-control
private,max-age=1800
date
Fri, 10 Jun 2022 20:03:17 GMT
accept-ranges
bytes
content-length
11333
activityi;dc_pre=CMP4te_Wo_gCFYgfBgAdJAYJxg;src=9632625;type=apac-0;cat=black0;ord=6598555999121;gtm=2wg680;auiddc=1731650709.1654891397;~oref=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2F...
9632625.fls.doubleclick.net/ Frame 1B72
Redirect Chain
  • https://9632625.fls.doubleclick.net/activityi;src=9632625;type=apac-0;cat=black0;ord=6598555999121;gtm=2wg680;auiddc=1731650709.1654891397;~oref=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%...
  • https://9632625.fls.doubleclick.net/activityi;dc_pre=CMP4te_Wo_gCFYgfBgAdJAYJxg;src=9632625;type=apac-0;cat=black0;ord=6598555999121;gtm=2wg680;auiddc=1731650709.1654891397;~oref=https%3A%2F%2Fblog...
547 B
602 B
Document
General
Full URL
https://9632625.fls.doubleclick.net/activityi;dc_pre=CMP4te_Wo_gCFYgfBgAdJAYJxg;src=9632625;type=apac-0;cat=black0;ord=6598555999121;gtm=2wg680;auiddc=1731650709.1654891397;~oref=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware?
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXGFP23
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.18.6 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s22-in-f6.1e100.net
Software
cafe /
Resource Hash
c27efd3681b18f5317af088e1307dede0daf9f55de8923cce38857e5aa947c1c
Security Headers
Name Value
Strict-Transport-Security max-age=21600
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
about:blank
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
no-cache, must-revalidate
content-encoding
gzip
content-length
425
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Fri, 10 Jun 2022 20:03:18 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma
no-cache
server
cafe
strict-transport-security
max-age=21600
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0

Redirect headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
no-cache, must-revalidate
content-length
0
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Fri, 10 Jun 2022 20:03:18 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown
1
location
https://9632625.fls.doubleclick.net/activityi;dc_pre=CMP4te_Wo_gCFYgfBgAdJAYJxg;src=9632625;type=apac-0;cat=black0;ord=6598555999121;gtm=2wg680;auiddc=1731650709.1654891397;~oref=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware?
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma
no-cache
server
cafe
strict-transport-security
max-age=21600
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
fbevents.js
connect.facebook.net/en_US/
100 KB
27 KB
Script
General
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2017/05/threat-spotlight-the-return-of-qakbot-malware
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:216:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
3d79854e01d0c79408c548889dcfddd23e4ef10f11c698c831b570573ee13b97
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding
gzip
x-content-type-options
nosniff
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length
26344
x-xss-protection
0
pragma
public
x-fb-debug
D1Iwmva04yWfm43I1IdBVkbs+uoj9tpaP+FNd9t7eJpdWzbsJsbwOv3vnXWz2cssoBtDpLN5bhLDPMnB697ngg==
x-fb-trip-id
2050670934
x-frame-options
DENY
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
date
Fri, 10 Jun 2022 20:03:18 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
report-to
{"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
x-fb-rlafr
0
priority
u=3,i
expires
Sat, 01 Jan 2000 00:00:00 GMT
up_loader.1.1.0.js
js.adsrvr.org/
4 KB
2 KB
Script
General
Full URL
https://js.adsrvr.org/up_loader.1.1.0.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXGFP23
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
65.9.65.116 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-65-9-65-116.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
ee3a7301fe1e0c0f6bf6acff0d7a8d107f5cb3f62a2566740c0416d8e61f00b9

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Fri, 10 Jun 2022 06:17:53 GMT
Content-Encoding
gzip
Last-Modified
Thu, 24 Sep 2020 15:15:34 GMT
Server
AmazonS3
Age
49526
ETag
W/"98d98b3499058b76d58073cf8ede2f10"
Vary
Accept-Encoding
X-Cache
Hit from cloudfront
Content-Type
application/x-javascript
Via
1.1 cc763905c39a59494c951c09271b0422.cloudfront.net (CloudFront)
Connection
keep-alive
Transfer-Encoding
chunked
X-Amz-Cf-Pop
FRA56-C1
X-Amz-Cf-Id
p6iEWgGF4DlovCkC7AnpEWJEj-ZJQG-akGz4zlP86vuZND0y5WjznA==
44231
cdn.bttrack.com/universal/
4 KB
4 KB
Script
General
Full URL
https://cdn.bttrack.com/universal/44231
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXGFP23
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
69.16.175.42 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
hwcdn.net
Software
/
Resource Hash
59145d1e607b102b2a0c67dcee22de29d29aeaac7418c817a94fe45599e6f3a1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Fri, 10 Jun 2022 20:03:18 GMT
Cache-Control
max-age=900
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
3728
X-HW
1654891398.dop216.fr8.t,1654891398.cds041.fr8.shn,1654891398.dop216.fr8.t,1654891398.cds143.fr8.c
Content-Type
application/javascript; charset=utf-8
tracking.js
trk.techtarget.com/
2 KB
1 KB
Script
General
Full URL
https://trk.techtarget.com/tracking.js
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2017/05/threat-spotlight-the-return-of-qakbot-malware
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::ac40:91d9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ac5000602bb127a5a07be117df96c48667d2e2a9fb1bb33d5ebb7c50e4480a88

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Fri, 10 Jun 2022 20:03:18 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Fri, 15 Oct 2021 14:31:37 GMT
server
cloudflare
age
192
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/javascript
expires
Fri, 10 Jun 2022 20:10:06 GMT
cache-control
max-age=1200
cf-ray
7194b5a63bd26973-FRA
cf-bgj
minify
pixel.js
www.redditstatic.com/ads/
24 KB
7 KB
Script
General
Full URL
https://www.redditstatic.com/ads/pixel.js
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2017/05/threat-spotlight-the-return-of-qakbot-malware
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:200::396 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
snooserv /
Resource Hash
ea011956164ed15022fb5732fd6d810bf75bb104babed05a29beb5c50302b926

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Fri, 10 Jun 2022 20:03:18 GMT
via
1.1 varnish, 1.1 varnish
last-modified
Mon, 18 Apr 2022 22:30:59 GMT
server
snooserv
etag
"5dcf2f59e7a6e0d30193fedad78db790"
vary
Accept-Encoding,Origin
content-type
application/javascript
cache-control
public, max-age=60
accept-ranges
bytes
content-encoding
gzip
content-length
7461
wid.tracker.js
www.argusplatform.com/js/
Redirect Chain
  • https://argusplatform.com/js/wid.tracker.js
  • https://www.argusplatform.com/js/wid.tracker.js
6 KB
2 KB
Script
General
Full URL
https://www.argusplatform.com/js/wid.tracker.js
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2017/05/threat-spotlight-the-return-of-qakbot-malware
Protocol
H2
Server
52.208.8.226 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-208-8-226.eu-west-1.compute.amazonaws.com
Software
Kestrel /
Resource Hash
6fe9f9f7b377dc96c8b87655739234ae33479d20c2d8993f4ab01d3d8e4adb2a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Fri, 10 Jun 2022 20:03:18 GMT
content-encoding
gzip
last-modified
Mon, 06 Jun 2022 09:51:22 GMT
server
Kestrel
etag
"1d8798afa58d073-gzip"
vary
Accept-Encoding
content-type
application/javascript
accept-ranges
bytes
content-length
2323

Redirect headers

location
https://www.argusplatform.com/js/wid.tracker.js
date
Fri, 10 Jun 2022 20:03:18 GMT
server
Apache/2.4.29 (Ubuntu)
content-length
338
content-type
text/html; charset=iso-8859-1
collect
px4.ads.linkedin.com/
Redirect Chain
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1537657&time=1654891396756&url=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D1537657%26time%3D1654891396756%26url%3Dhttps%253A%252F%252Fblogs.blackberry.com%2...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1537657&time=1654891396756&url=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware&liSync=true
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1537657&time=1654891396756&url=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware&liSync=true&e_...
0
481 B
Image
General
Full URL
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1537657&time=1654891396756&url=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware&liSync=true&e_ipv6=AQJw-RSsATkdxQAAAYFPNsYhvL2Tdb5bY79nPEi3l4nfc0d35Tau18jO10iiPqqBuhwmT6pb
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2017/05/threat-spotlight-the-return-of-qakbot-malware
Protocol
H2
Server
13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Fri, 10 Jun 2022 20:03:18 GMT
nel
{"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
x-li-pop
afd-prod-ltx1-x
x-msedge-ref
Ref A: C138FB972D904CF0922CD8A9CDEF2773 Ref B: FRAEDGE1307 Ref C: 2022-06-10T20:03:18Z
linkedin-action
1
report-to
{"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
content-type
application/javascript
x-li-proto
http/2
x-cache
CONFIG_NOCACHE
content-length
0
x-li-uuid
AAXhHW368CFkENchTCvxhg==
x-li-fabric
prod-ltx1

Redirect headers

date
Fri, 10 Jun 2022 20:03:17 GMT
nel
{"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
x-li-pop
afd-prod-ltx1-x
x-msedge-ref
Ref A: 3EA75BD36B624146B9316F721B2CA78D Ref B: FRAEDGE1111 Ref C: 2022-06-10T20:03:18Z
linkedin-action
1
report-to
{"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
x-li-fabric
prod-ltx1
location
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1537657&time=1654891396756&url=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware&liSync=true&e_ipv6=AQJw-RSsATkdxQAAAYFPNsYhvL2Tdb5bY79nPEi3l4nfc0d35Tau18jO10iiPqqBuhwmT6pb
x-li-proto
http/2
x-cache
CONFIG_NOCACHE
content-length
0
x-li-uuid
AAXhHW31xvSdpSf5aUU3aA==
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/796783834/
2 KB
2 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/796783834/?random=1654891396774&cv=9&fst=1654891396774&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg680&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware&tiba=Threat%20Spotlight%3A%20The%20Return%20of%20Qakbot%20Malware&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
2761c746e0f935c36101b9de940e18630c67728d6b689e0baddf44083063a199
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 10 Jun 2022 20:03:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1069
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/823974816/
2 KB
1 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/823974816/?random=1654891396776&cv=9&fst=1654891396776&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg680&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware&tiba=Threat%20Spotlight%3A%20The%20Return%20of%20Qakbot%20Malware&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
88422a02a5e69806582c0942c5e14eaa17c845152268cecf2879f967db642d28
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 10 Jun 2022 20:03:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1071
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/j/
4 B
446 B
XHR
General
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-42639814-3&cid=569856526.1654891397&jid=97494835&gjid=327068279&_gid=1068903746.1654891397&_u=aGBAgAABQAAAAE~&z=1529576858
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c02::9c Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blogs.blackberry.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Fri, 10 Jun 2022 20:03:18 GMT
content-type
text/plain
access-control-allow-origin
https://blogs.blackberry.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/
35 B
192 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j96&aip=1&a=755974502&t=pageview&_s=1&dl=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware&ul=en-us&de=UTF-8&dt=Threat%20Spotlight%3A%20The%20Return%20of%20Qakbot%20Malware&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aGBAgAABQ~&jid=97494835&gjid=327068279&cid=569856526.1654891397&tid=UA-42639814-3&_gid=1068903746.1654891397&gtm=2wg680TXGFP23&z=161147589
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2017/05/threat-spotlight-the-return-of-qakbot-malware
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 10 Jun 2022 12:06:51 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
28587
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/j/
4 B
70 B
XHR
General
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-42639814-33&cid=569856526.1654891397&jid=206916227&gjid=1339087786&_gid=1068903746.1654891397&_u=aGDAgAABQAAAAE~&z=1512740915
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c02::9c Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blogs.blackberry.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Fri, 10 Jun 2022 20:03:18 GMT
content-type
text/plain
access-control-allow-origin
https://blogs.blackberry.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/
35 B
91 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j96&aip=1&a=755974502&t=pageview&_s=1&dl=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware&ul=en-us&de=UTF-8&dt=Threat%20Spotlight%3A%20The%20Return%20of%20Qakbot%20Malware&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aGDAgAABQAAAAE~&jid=206916227&gjid=1339087786&cid=569856526.1654891397&tid=UA-42639814-33&_gid=1068903746.1654891397&gtm=2wg680TXGFP23&cd17=&cd20=No&z=860385813
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2017/05/threat-spotlight-the-return-of-qakbot-malware
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 10 Jun 2022 12:06:51 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
28587
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
dest5.html
blackberry.demdex.net/ Frame EBED
7 KB
3 KB
Document
General
Full URL
https://blackberry.demdex.net/dest5.html?d_nsid=0
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/cb3160b9e813/dd47d4a7a48e/launch-17c42c38011b.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.250.172.3 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-250-172-3.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://blogs.blackberry.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Accept-Ranges
bytes
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Length
2791
Content-Type
text/html;charset=UTF-8
DCS
dcs-prod-irl1-1-v034-079d20855.edge-irl1.demdex.com UNKNOWN
Expires
Thu, 01 Jan 1970 00:00:00 UTC
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-TID
fwlcx8xgTSE=
content-encoding
gzip
date
Fri, 10 Jun 2022 20:03:18 GMT
last-modified
Wed, 8 Jun 2022 12:46:11 GMT
vary
accept-encoding
ibs:dpid=411&dpuuid=YqOjhgAAAE6vtgOJ
dpm.demdex.net/
Redirect Chain
  • https://cm.everesttech.net/cm/dd?d_uuid=89068391059403092171126752195410223259
  • https://dpm.demdex.net/ibs:dpid=411&dpuuid=YqOjhgAAAE6vtgOJ
42 B
945 B
Image
General
Full URL
https://dpm.demdex.net/ibs:dpid=411&dpuuid=YqOjhgAAAE6vtgOJ
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2017/05/threat-spotlight-the-return-of-qakbot-malware
Protocol
HTTP/1.1
Server
108.128.0.238 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-108-128-0-238.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

DCS
dcs-prod-irl1-2-v034-0f71fc53b.edge-irl1.demdex.com UNKNOWN
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
content-encoding
gzip
X-Content-Type-Options
nosniff
X-TID
S0yDtEjWQ98=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Type
image/gif
Content-Length
59
Expires
Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Location
https://dpm.demdex.net/ibs:dpid=411&dpuuid=YqOjhgAAAE6vtgOJ
Date
Fri, 10 Jun 2022 20:03:18 GMT
Cache-Control
no-cache
Server
AMO-cookiemap/1.1
Connection
keep-alive
Content-Length
0
P3P
CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
delivery
blackberrylimited.tt.omtrdc.net/rest/v1/
360 B
727 B
XHR
General
Full URL
https://blackberrylimited.tt.omtrdc.net/rest/v1/delivery?client=blackberrylimited&sessionId=0da56586aabb406aa422e4d0b4abca5c&version=2.5.0
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.194.254.72 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-194-254-72.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
1c1a5432c62e9d6f8ec8bdb061b2ec2dc8da1700a4608a4e7e80709e7b50d03a

Request headers

Referer
https://blogs.blackberry.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
Content-Type
text/plain

Response headers

date
Fri, 10 Jun 2022 20:03:18 GMT
content-encoding
gzip
accept-ch
Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List
vary
origin,access-control-request-method,access-control-request-headers,accept-encoding
content-type
application/json;charset=UTF-8
access-control-allow-origin
https://blogs.blackberry.com
access-control-allow-credentials
true
timing-allow-origin
*
x-request-id
fc9a250089e17a26962e6480dbd9dddf
1727971320861491
connect.facebook.net/signals/config/
290 KB
83 KB
Script
General
Full URL
https://connect.facebook.net/signals/config/1727971320861491?v=2.9.62&r=stable
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:216:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
31843bc572f17a445861c370fb3df5a23d724827e5c09ad1d2d10481a49afd34
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding
gzip
x-content-type-options
nosniff
document-policy
force-load-at-top
report-to
{"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400,h3-29=":443"; ma=86400
x-xss-protection
0
pragma
public
x-fb-debug
h0Mx5X/uxaUOV/kIgQ2rCmhCQcqiig+Yj2ShC9AYFFlB9cgSnwf/YsEtdF8cvQXp1BhWMtfIjZ0ymIJ9Uutqhw==
x-fb-trip-id
2050670934
x-frame-options
DENY
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
date
Fri, 10 Jun 2022 20:03:18 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
x-content-cdn-origin-ts
1654891398690
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
x-fb-rlafr
0
expires
Sat, 01 Jan 2000 00:00:00 GMT
activity.gif
apt.techtarget.com/activity/
43 B
324 B
Image
General
Full URL
https://apt.techtarget.com/activity/activity.gif?activityTypeId=31&cid=2775629&version=2.1.1&ref=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware&r=1654891396877
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2017/05/threat-spotlight-the-return-of-qakbot-malware
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
206.19.49.24 , United States, ASN7018 (ATT-INTERNET4, US),
Reverse DNS
Software
Apache/2.4.6 (CentOS) /
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Fri, 10 Jun 2022 20:03:18 GMT
Last-Modified
Tue, 26 Mar 2019 18:30:29 GMT
Server
Apache/2.4.6 (CentOS)
ETag
"2b-5850384023492"
Content-Type
image/gif
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=97
Content-Length
43
149001552.js
bat.bing.com/p/action/
220 B
494 B
Script
General
Full URL
https://bat.bing.com/p/action/149001552.js
Requested by
Host: bat.bing.com
URL: https://bat.bing.com/bat.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/ ARR/3.0
Resource Hash
9b61c5a0528526362d6c6f4ae3bdd3720f7f81672480d2433e0556b545d933ff
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: C6FFD7A2708A4C9789785444AB034D4E Ref B: FRAEDGE1218 Ref C: 2022-06-10T20:03:18Z
x-powered-by
ARR/3.0
vary
Accept-Encoding
x-cache
CONFIG_NOCACHE
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
private,max-age=60
date
Fri, 10 Jun 2022 20:03:18 GMT
content-length
301
0
bat.bing.com/action/
0
175 B
Image
General
Full URL
https://bat.bing.com/action/0?ti=149001552&tm=gtm002&Ver=2&mid=b0a5a53d-d2e1-486b-a987-42b828fd9a31&sid=5e0e0e60e8f811ec9d01690337ec52a8&vid=5e0e5680e8f811ec8fdabfec172f81df&vids=1&gtm_tag_source=1&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=Threat%20Spotlight%3A%20The%20Return%20of%20Qakbot%20Malware&p=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware&r=&lt=1915&evt=pageLoad&msclkid=N&sv=1&rn=307321
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2017/05/threat-spotlight-the-return-of-qakbot-malware
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=31536000; includeSubDomains; preload
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: F5B81D17F4FF41A59F8725BF751C0A0F Ref B: FRAEDGE1218 Ref C: 2022-06-10T20:03:18Z
date
Fri, 10 Jun 2022 20:03:18 GMT
x-cache
CONFIG_NOCACHE
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
expires
Fri, 01 Jan 1990 00:00:00 GMT
dc_pre=CJW1te_Wo_gCFZkgBgAdeygOUQ;src=10049132;type=sitep0;cat=allpa0;ord=8870997497988;gtm=2wg680;auiddc=1731650709.1654891397;u1=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotl...
adservice.google.com/ddm/fls/i/ Frame DCCC
650 B
503 B
Document
General
Full URL
https://adservice.google.com/ddm/fls/i/dc_pre=CJW1te_Wo_gCFZkgBgAdeygOUQ;src=10049132;type=sitep0;cat=allpa0;ord=8870997497988;gtm=2wg680;auiddc=1731650709.1654891397;u1=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware;~oref=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware
Requested by
Host: 10049132.fls.doubleclick.net
URL: https://10049132.fls.doubleclick.net/activityi;dc_pre=CJW1te_Wo_gCFZkgBgAdeygOUQ;src=10049132;type=sitep0;cat=allpa0;ord=8870997497988;gtm=2wg680;auiddc=1731650709.1654891397;u1=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware;~oref=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware?
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
5de87d1219e1376353327e01e84e32aefd96be40dcf93f26f8b1ace5f6a16d5d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://10049132.fls.doubleclick.net/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
no-cache, must-revalidate
content-encoding
gzip
content-length
433
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Fri, 10 Jun 2022 20:03:18 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
pragma
no-cache
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
dc_pre=CMP4te_Wo_gCFYgfBgAdJAYJxg;src=9632625;type=apac-0;cat=black0;ord=6598555999121;gtm=2wg680;auiddc=1731650709.1654891397;~oref=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spo...
adservice.google.com/ddm/fls/i/ Frame 33F9
546 B
894 B
Document
General
Full URL
https://adservice.google.com/ddm/fls/i/dc_pre=CMP4te_Wo_gCFYgfBgAdJAYJxg;src=9632625;type=apac-0;cat=black0;ord=6598555999121;gtm=2wg680;auiddc=1731650709.1654891397;~oref=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware
Requested by
Host: 9632625.fls.doubleclick.net
URL: https://9632625.fls.doubleclick.net/activityi;dc_pre=CMP4te_Wo_gCFYgfBgAdJAYJxg;src=9632625;type=apac-0;cat=black0;ord=6598555999121;gtm=2wg680;auiddc=1731650709.1654891397;~oref=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware?
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ce9c25da12cd788f4bf4fea9a9db3014e66eb5241167efa9a114d188d282001f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://9632625.fls.doubleclick.net/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
no-cache, must-revalidate
content-encoding
gzip
content-length
425
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Fri, 10 Jun 2022 20:03:18 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
pragma
no-cache
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
rp.gif
alb.reddit.com/
42 B
157 B
Image
General
Full URL
https://alb.reddit.com/rp.gif?ts=1654891396953&id=t2_bjryqjau&event=PageVisit&m.itemCount=&m.value=&m.valueDecimal=&m.currency=&m.transactionId=&m.customEventName=&m.products=&uuid=1a0007ed-014a-4749-ace0-8bf6cec7d9aa&aaid=&em=&external_id=&idfa=&integration=reddit&opt_out=0&sh=1600&sw=1200&v=rdt_90e98f9f
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2017/05/threat-spotlight-the-return-of-qakbot-malware
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.65.140 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Varnish /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Fri, 10 Jun 2022 20:03:18 GMT
via
1.1 varnish
server
Varnish
content-type
image/gif
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
content-length
42
retry-after
0
/
www.google.com/pagead/1p-user-list/796783834/
42 B
548 B
Image
General
Full URL
https://www.google.com/pagead/1p-user-list/796783834/?random=1654891396774&cv=9&fst=1654891200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg680&sendb=1&frm=0&url=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware&tiba=Threat%20Spotlight%3A%20The%20Return%20of%20Qakbot%20Malware&async=1&fmt=3&is_vtc=1&random=1709579087&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2017/05/threat-spotlight-the-return-of-qakbot-malware
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 10 Jun 2022 20:03:18 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/796783834/
42 B
548 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/796783834/?random=1654891396774&cv=9&fst=1654891200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg680&sendb=1&frm=0&url=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware&tiba=Threat%20Spotlight%3A%20The%20Return%20of%20Qakbot%20Malware&async=1&fmt=3&is_vtc=1&random=1709579087&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2017/05/threat-spotlight-the-return-of-qakbot-malware
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 10 Jun 2022 20:03:18 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/823974816/
42 B
108 B
Image
General
Full URL
https://www.google.com/pagead/1p-user-list/823974816/?random=1654891396776&cv=9&fst=1654891200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg680&sendb=1&frm=0&url=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware&tiba=Threat%20Spotlight%3A%20The%20Return%20of%20Qakbot%20Malware&async=1&fmt=3&is_vtc=1&random=517675706&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2017/05/threat-spotlight-the-return-of-qakbot-malware
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 10 Jun 2022 20:03:18 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/823974816/
42 B
108 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/823974816/?random=1654891396776&cv=9&fst=1654891200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg680&sendb=1&frm=0&url=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware&tiba=Threat%20Spotlight%3A%20The%20Return%20of%20Qakbot%20Malware&async=1&fmt=3&is_vtc=1&random=517675706&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2017/05/threat-spotlight-the-return-of-qakbot-malware
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 10 Jun 2022 20:03:18 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
149001552
www.clarity.ms/tag/uet/
2 KB
2 KB
Script
General
Full URL
https://www.clarity.ms/tag/uet/149001552
Requested by
Host: bat.bing.com
URL: https://bat.bing.com/p/action/149001552.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:27::cafe:1824 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash
0045468743159014f6bde2ed98ce21e0581dea617cf50f56d39382ead24ae89c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Fri, 10 Jun 2022 20:03:17 GMT
x-powered-by
ASP.NET
x-azure-ref
0hqOjYgAAAAAjkLRi0FDHT55V/xgSCR2uUFJHMDFFREdFMDYyMQA2Y2ZiZWVlMC01MDI3LTQ4NGItODk2Ny00YTI5YWY3N2YxZTE=
x-cache
CONFIG_NOCACHE
content-type
application/x-javascript
cache-control
no-cache, no-store
request-context
appId=cid-v1:e97341f6-8fff-46a6-9229-fbbfe0892c78
content-length
1633
expires
-1
ga-audiences
www.google.com/ads/
42 B
107 B
Image
General
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-42639814-3&cid=569856526.1654891397&jid=97494835&_u=aGBAgAABQAAAAE~&z=382364605
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2017/05/threat-spotlight-the-return-of-qakbot-malware
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 10 Jun 2022 20:03:18 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/
42 B
107 B
Image
General
Full URL
https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-42639814-3&cid=569856526.1654891397&jid=97494835&_u=aGBAgAABQAAAAE~&z=382364605
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2017/05/threat-spotlight-the-return-of-qakbot-malware
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 10 Jun 2022 20:03:18 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.com/ads/
42 B
107 B
Image
General
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-42639814-33&cid=569856526.1654891397&jid=206916227&_u=aGDAgAABQAAAAE~&z=1810594299
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2017/05/threat-spotlight-the-return-of-qakbot-malware
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 10 Jun 2022 20:03:18 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/
42 B
107 B
Image
General
Full URL
https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-42639814-33&cid=569856526.1654891397&jid=206916227&_u=aGDAgAABQAAAAE~&z=1810594299
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2017/05/threat-spotlight-the-return-of-qakbot-malware
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 10 Jun 2022 20:03:18 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
adsct
t.co/i/
43 B
337 B
Image
General
Full URL
https://t.co/i/adsct?bci=3&eci=2&event_id=6c963e49-c25b-435e-b019-025a337158c0&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&p_id=Twitter&p_user_id=0&pl_id=bb736a30-c254-4f8a-a130-d696a71c6c35&tw_document_href=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o3fu4&type=javascript&version=2.3.20
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2017/05/threat-spotlight-the-return-of-qakbot-malware
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.69 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

x-response-time
110
date
Fri, 10 Jun 2022 20:03:18 GMT
server
tsa_o
strict-transport-security
max-age=0
content-type
image/gif;charset=utf-8
cache-control
no-cache, no-store, max-age=0
x-connection-hash
e3f432888f072e794c67de48d2d8faaaa7da9039ac01ec1037c84adb4a00e699
content-length
43
adsct
analytics.twitter.com/i/
43 B
354 B
Image
General
Full URL
https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=6c963e49-c25b-435e-b019-025a337158c0&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&p_id=Twitter&p_user_id=0&pl_id=bb736a30-c254-4f8a-a130-d696a71c6c35&tw_document_href=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o3fu4&type=javascript&version=2.3.20
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2017/05/threat-spotlight-the-return-of-qakbot-malware
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.195 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

x-response-time
105
date
Fri, 10 Jun 2022 20:03:18 GMT
server
tsa_o
strict-transport-security
max-age=631138519
content-type
image/gif;charset=utf-8
cache-control
no-cache, no-store, max-age=0
x-connection-hash
80d0cc885e8c2da6dbfee2445b9ad11c1173c8e872ba29158204b982a4b6aa96
content-length
43
dc_pre=CMP4te_Wo_gCFYgfBgAdJAYJxg;src=9632625;type=apac-0;cat=black0;ord=6598555999121;gtm=2wg680;auiddc=1731650709.1654891397;~oref=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spo...
adservice.google.de/ddm/fls/i/ Frame 40CE
194 B
870 B
Document
General
Full URL
https://adservice.google.de/ddm/fls/i/dc_pre=CMP4te_Wo_gCFYgfBgAdJAYJxg;src=9632625;type=apac-0;cat=black0;ord=6598555999121;gtm=2wg680;auiddc=1731650709.1654891397;~oref=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware
Requested by
Host: adservice.google.com
URL: https://adservice.google.com/ddm/fls/i/dc_pre=CMP4te_Wo_gCFYgfBgAdJAYJxg;src=9632625;type=apac-0;cat=black0;ord=6598555999121;gtm=2wg680;auiddc=1731650709.1654891397;~oref=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
05978957c6c8b028f2785dc77271c286bfac76e30b7bcd7e835c2927fbe897cf
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://adservice.google.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
cache-control
private, max-age=0
content-encoding
gzip
content-length
177
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Fri, 10 Jun 2022 20:03:18 GMT
expires
Fri, 10 Jun 2022 20:03:18 GMT
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
dc_pre=CJW1te_Wo_gCFZkgBgAdeygOUQ;src=10049132;type=sitep0;cat=allpa0;ord=8870997497988;gtm=2wg680;auiddc=1731650709.1654891397;u1=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotl...
10049132.fls.doubleclick.net/ddm/fls/r/ Frame 0444
Redirect Chain
  • https://adservice.google.de/ddm/fls/i/dc_pre=CJW1te_Wo_gCFZkgBgAdeygOUQ;src=10049132;type=sitep0;cat=allpa0;ord=8870997497988;gtm=2wg680;auiddc=1731650709.1654891397;u1=https%3A%2F%2Fblogs.blackber...
  • https://10049132.fls.doubleclick.net/ddm/fls/r/dc_pre=CJW1te_Wo_gCFZkgBgAdeygOUQ;src=10049132;type=sitep0;cat=allpa0;ord=8870997497988;gtm=2wg680;auiddc=1731650709.1654891397;u1=https%3A%2F%2Fblogs...
348 B
309 B
Document
General
Full URL
https://10049132.fls.doubleclick.net/ddm/fls/r/dc_pre=CJW1te_Wo_gCFZkgBgAdeygOUQ;src=10049132;type=sitep0;cat=allpa0;ord=8870997497988;gtm=2wg680;auiddc=1731650709.1654891397;u1=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware;~oref=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware
Requested by
Host: adservice.google.com
URL: https://adservice.google.com/ddm/fls/i/dc_pre=CJW1te_Wo_gCFZkgBgAdeygOUQ;src=10049132;type=sitep0;cat=allpa0;ord=8870997497988;gtm=2wg680;auiddc=1731650709.1654891397;u1=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware;~oref=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.217.18.6 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s22-in-f6.1e100.net
Software
cafe /
Resource Hash
0a2824c85e626327fecc7ce51aaf072be9addb1f2277293ee670838991fc9422
Security Headers
Name Value
Strict-Transport-Security max-age=21600
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://adservice.google.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
private, max-age=0
content-encoding
gzip
content-length
284
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Fri, 10 Jun 2022 20:03:18 GMT
expires
Fri, 10 Jun 2022 20:03:18 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
strict-transport-security
max-age=21600
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0

Redirect headers

alt-svc
h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
cache-control
no-cache, must-revalidate
content-length
0
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Fri, 10 Jun 2022 20:03:18 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
location
https://10049132.fls.doubleclick.net/ddm/fls/r/dc_pre=CJW1te_Wo_gCFZkgBgAdeygOUQ;src=10049132;type=sitep0;cat=allpa0;ord=8870997497988;gtm=2wg680;auiddc=1731650709.1654891397;u1=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware;~oref=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
pragma
no-cache
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
s09214976914750
blackberrylimited.sc.omtrdc.net/b/ss/bbl-blackberry-production/1/JS-2.22.0-LCS4/
43 B
394 B
Image
General
Full URL
https://blackberrylimited.sc.omtrdc.net/b/ss/bbl-blackberry-production/1/JS-2.22.0-LCS4/s09214976914750?AQB=1&ndh=1&pf=1&t=10%2F5%2F2022%2020%3A3%3A17%205%200&sdid=1A19B5C7D65EA6EF-0EBBED4CAE3D313B&mid=89048864270726745621129549020221218680&aamlh=6&ce=UTF-8&pageName=en%3A2017%3A05%3Athreat-spotlight-the-return-of-qakbot-malware&g=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware&c.&getTimeParting=6.3&getNewRepeat=3.0&getVisitNum=4.2&endOfDatePeriod=1.2&.c&cc=USD&ch=05&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&v1=blogs.blackberry.com&c2=D%3Dt&v3=Friday%20&v4=4%3A03%20PM%7CFriday%20&v6=en%3A2017%3A05%3Athreat-spotlight-the-return-of-qakbot-malware&v7=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware&c8=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F102.0.5005.61%20Safari%2F537.36&v8=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F102.0.5005.61%20Safari%2F537.36&c9=en&v9=en&c11=new&v11=first%20visit&v12=new&c16=1&c17=13&v35=The%20BlackBerry%20Cylance%20Threat%20Research%20Team&v36=Research%20%26%20Intelligence&v38=D%3Dmid&v41=05&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=85522AC5562681557F000101%40AdobeOrg&AQE=1
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2017/05/threat-spotlight-the-return-of-qakbot-malware
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.36.218.177 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-13-36-218-177.eu-west-3.compute.amazonaws.com
Software
jag /
Resource Hash
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Fri, 10 Jun 2022 20:03:18 GMT
x-content-type-options
nosniff
x-c
main-1645.Id526ce.M0-571
p3p
CP="This is not a P3P policy"
content-length
43
x-xss-protection
1; mode=block
pragma
no-cache
last-modified
Sat, 11 Jun 2022 20:03:18 GMT
server
jag
xserver
anedge-df488f754-w48sl
etag
3553852218538688512-4619776433130525237
vary
*
content-type
image/gif;charset=utf-8
access-control-allow-origin
*
cache-control
no-cache, no-store, max-age=0, no-transform, private
expires
Thu, 09 Jun 2022 20:03:18 GMT
clarity.js
n.clarity.ms/s/0.6.34/
53 KB
23 KB
Script
General
Full URL
https://n.clarity.ms/s/0.6.34/clarity.js
Requested by
Host: www.clarity.ms
URL: https://www.clarity.ms/tag/uet/149001552
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.184.204.244 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
ca63193ce799e4e00c9106349365981dc6e26cb77632ebf5df23dffba2aaccfa

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Fri, 10 Jun 2022 20:03:19 GMT
content-encoding
br
etag
"1d87b1f80a6c654"
last-modified
Wed, 08 Jun 2022 10:07:04 GMT
server
Microsoft-IIS/10.0
x-powered-by
ASP.NET
vary
Accept-Encoding
content-type
application/javascript;charset=utf-8
cache-control
public,max-age=86400
accept-ranges
bytes
request-context
appId=cid-v1:67bc0b23-8423-4b52-b1ca-6a87709ceaa2
js
pixel.mathtag.com/event/ Frame 0444
1 KB
2 KB
Script
General
Full URL
https://pixel.mathtag.com/event/js?mt_id=1476794&mt_adid=237288&mt_exem=&mt_excl=&v1=&v2=&v3=&s1=&s2=&s3=
Requested by
Host: 10049132.fls.doubleclick.net
URL: https://10049132.fls.doubleclick.net/ddm/fls/r/dc_pre=CJW1te_Wo_gCFZkgBgAdeygOUQ;src=10049132;type=sitep0;cat=allpa0;ord=8870997497988;gtm=2wg680;auiddc=1731650709.1654891397;u1=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware;~oref=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.79.88.164 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-79-88-164.deploy.static.akamaitechnologies.com
Software
MT3 4447 e18e916 master iad-pixel-x3 config:1.0.0 /
Resource Hash
550eba68765b553d5a9dbadff22f8cc6c09251a3764b95c00ce9e167381a0f64

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://10049132.fls.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Fri, 10 Jun 2022 20:03:19 GMT
Server
MT3 4447 e18e916 master iad-pixel-x3 config:1.0.0
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin
*
Cache-Control
no-cache
Connection
keep-alive
Content-Type
text/javascript
Content-Length
1411
Expires
Fri, 10 Jun 2022 20:03:18 GMT
/
www.facebook.com/tr/
44 B
297 B
Image
General
Full URL
https://www.facebook.com/tr/?id=1727971320861491&ev=PageView&dl=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware&rl=&if=false&ts=1654891397506&sw=1600&sh=1200&v=2.9.62&r=stable&ec=0&o=30&fbp=fb.1.1654891397502.1323707769&it=1654891396874&coo=false&exp=p1&rqm=GET
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2017/05/threat-spotlight-the-return-of-qakbot-malware
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f11c:8083:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Fri, 10 Jun 2022 20:03:18 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
cache-control
no-cache, must-revalidate, max-age=0
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
44
expires
Fri, 10 Jun 2022 20:03:18 GMT
u
cdn.bizible.com/m/
43 B
144 B
Image
General
Full URL
https://cdn.bizible.com/m/u?mapType=ecid&mapValue=85522AC5562681557F000101%40AdobeOrg_89048864270726745621129549020221218680&_biz_u=9742e70dc8724dc7f70b90bdd781a9ba&_biz_s=dec5c&_biz_l=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware&_biz_t=1654891397529&_biz_i=Threat%20Spotlight%3A%20The%20Return%20of%20Qakbot%20Malware&_biz_n=1&rnd=540050&cdn_o=a&_biz_z=1654891397531
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2017/05/threat-spotlight-the-return-of-qakbot-malware
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.195.15.58 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/6776) /
Resource Hash
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 10 Jun 2022 20:03:18 GMT
last-modified
Thu, 09 Jun 2022 23:59:46 GMT
server
ECS (frb/6776)
age
72212
x-cache
HIT
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
cache-control
no-cache, no-store
accept-ranges
bytes
content-type
Image/GIF
content-length
43
expires
-1
/
www.facebook.com/tr/ Frame D615
0
18 B
Document
General
Full URL
https://www.facebook.com/tr/
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2017/05/threat-spotlight-the-return-of-qakbot-malware
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f11c:8083:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Content-Type
application/x-www-form-urlencoded
Origin
https://blogs.blackberry.com
Referer
https://blogs.blackberry.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-origin
https://blogs.blackberry.com
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
0
content-type
text/plain
cross-origin-resource-policy
cross-origin
date
Fri, 10 Jun 2022 20:03:19 GMT
priority
u=0
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
collect
n.clarity.ms/
0
74 B
XHR
General
Full URL
https://n.clarity.ms/collect
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.184.204.244 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept
application/x-clarity-gzip
Referer
https://blogs.blackberry.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

access-control-allow-origin
https://blogs.blackberry.com
date
Fri, 10 Jun 2022 20:03:19 GMT
access-control-allow-credentials
true
server
Microsoft-IIS/10.0
x-powered-by
ASP.NET
request-context
appId=cid-v1:67bc0b23-8423-4b52-b1ca-6a87709ceaa2
iframe
pixel.mathtag.com/sync/ Frame D7C1
631 B
994 B
Document
General
Full URL
https://pixel.mathtag.com/sync/iframe?mt_uuid=e67f62a3-a387-4a00-919e-11037532e1d4&no_iframe=1&mt_adid=237288&source=mathtag
Requested by
Host: pixel.mathtag.com
URL: https://pixel.mathtag.com/event/js?mt_id=1476794&mt_adid=237288&mt_exem=&mt_excl=&v1=&v2=&v3=&s1=&s2=&s3=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.79.88.164 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-79-88-164.deploy.static.akamaitechnologies.com
Software
MT3 4447 e18e916 master iad-pixel-x15 config:1.0.0 /
Resource Hash
304a0259406001319e10acd097537e33bbc0157670417a48fdd527a889951f65

Request headers

Referer
https://10049132.fls.doubleclick.net/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Access-Control-Allow-Origin
*
Cache-Control
no-cache
Connection
keep-alive
Content-Length
631
Content-Type
text/html
Date
Fri, 10 Jun 2022 20:03:19 GMT
Expires
Fri, 10 Jun 2022 20:03:18 GMT
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Server
MT3 4447 e18e916 master iad-pixel-x15 config:1.0.0
img
pixel.mathtag.com/misc/ Frame 0444
43 B
525 B
Image
General
Full URL
https://pixel.mathtag.com/misc/img?mm_bnc&bcdv=0
Requested by
Host: 10049132.fls.doubleclick.net
URL: https://10049132.fls.doubleclick.net/ddm/fls/r/dc_pre=CJW1te_Wo_gCFZkgBgAdeygOUQ;src=10049132;type=sitep0;cat=allpa0;ord=8870997497988;gtm=2wg680;auiddc=1731650709.1654891397;u1=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware;~oref=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.79.88.164 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-79-88-164.deploy.static.akamaitechnologies.com
Software
MT3 4447 e18e916 master iad-pixel-x14 config:1.0.0 /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://10049132.fls.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Fri, 10 Jun 2022 20:03:19 GMT
Server
MT3 4447 e18e916 master iad-pixel-x14 config:1.0.0
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin
*
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Fri, 10 Jun 2022 20:03:18 GMT
pd.js
pi.pardot.com/
5 KB
2 KB
Script
General
Full URL
https://pi.pardot.com/pd.js
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2017/05/threat-spotlight-the-return-of-qakbot-malware
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.54.96.194 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-54-96-194.compute-1.amazonaws.com
Software
PardotServer /
Resource Hash
3b91e6a4b14493d67f9660e6d4a2e27c1eea54d97ccb7c30acf3b89998b3be99

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Fri, 10 Jun 2022 20:03:20 GMT
content-encoding
gzip
X-Pardot-Route
16b0ab393667a33fe86adedc3141e88c
last-modified
Fri, 10 Jun 2022 05:18:15 GMT
Server
PardotServer
etag
"1547-gzip"
vary
Accept-Encoding,User-Agent
Content-Type
application/javascript
cache-control
max-age=63072000
Connection
keep-alive
accept-ranges
bytes
Content-Length
1946
expires
Sun, 09 Jun 2024 20:03:20 GMT
/
pixels.argusplatform.com/wh/track/
33 B
286 B
XHR
General
Full URL
https://pixels.argusplatform.com/wh/track/?site_id=8C96EE79A37A4EA6AABF503434C285B0&visitor_id=1654891398397000801&event_type=page_request&timestamp=1654891398&page_title=Threat%20Spotlight%3A%20The%20Return%20of%20Qakbot%20Malware&page_url=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware&page_url_referer=
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
34.251.139.24 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-251-139-24.eu-west-1.compute.amazonaws.com
Software
Kestrel /
Resource Hash
eec6b719c1df15556a3581632c1010a34d2f19f42481c6f875ab3ff21337748c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Fri, 10 Jun 2022 20:03:19 GMT
Server
Kestrel
Connection
Keep-Alive
Keep-Alive
timeout=5, max=100
Transfer-Encoding
chunked
Content-Type
application/json; charset=utf-8
c.gif
c.clarity.ms/
Redirect Chain
  • https://c.clarity.ms/c.gif
  • https://c.bing.com/c.gif?CtsSyncId=0A9E178EB85A4E2DBED6C065AEC5C7C7&RedC=c.clarity.ms&MXFR=16179E8F071E6B5800E38F30031E6576
  • https://c.clarity.ms/c.gif?CtsSyncId=0A9E178EB85A4E2DBED6C065AEC5C7C7&MUID=3D2B5718EA9566DC2AA346A7EB476707
42 B
368 B
Image
General
Full URL
https://c.clarity.ms/c.gif?CtsSyncId=0A9E178EB85A4E2DBED6C065AEC5C7C7&MUID=3D2B5718EA9566DC2AA346A7EB476707
Protocol
H2
Server
20.234.93.27 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 10 Jun 2022 20:03:19 GMT
last-modified
Fri, 20 May 2022 21:53:17 GMT
server
Microsoft-IIS/10.0
x-powered-by
ASP.NET
etag
"17a28a3946cd81:0"
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control
private, no-cache, proxy-revalidate, no-store
accept-ranges
bytes
content-type
image/gif
content-length
42

Redirect headers

pragma
no-cache
date
Fri, 10 Jun 2022 20:03:19 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 6B160B03DEBA4011B1B1BFBD3E80CF81 Ref B: FRAEDGE1218 Ref C: 2022-06-10T20:03:20Z
x-powered-by
ASP.NET
x-cache
CONFIG_NOCACHE
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
location
https://c.clarity.ms/c.gif?CtsSyncId=0A9E178EB85A4E2DBED6C065AEC5C7C7&MUID=3D2B5718EA9566DC2AA346A7EB476707
cache-control
private, no-cache, proxy-revalidate, no-store
content-length
0
img
pixel.mathtag.com/misc/ Frame D7C1
43 B
525 B
Image
General
Full URL
https://pixel.mathtag.com/misc/img?mm_bnc&bcdv=0
Requested by
Host: pixel.mathtag.com
URL: https://pixel.mathtag.com/sync/iframe?mt_uuid=e67f62a3-a387-4a00-919e-11037532e1d4&no_iframe=1&mt_adid=237288&source=mathtag
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.79.88.164 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-79-88-164.deploy.static.akamaitechnologies.com
Software
MT3 4447 e18e916 master iad-pixel-x10 config:1.0.0 /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pixel.mathtag.com/sync/iframe?mt_uuid=e67f62a3-a387-4a00-919e-11037532e1d4&no_iframe=1&mt_adid=237288&source=mathtag
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Fri, 10 Jun 2022 20:03:19 GMT
Server
MT3 4447 e18e916 master iad-pixel-x10 config:1.0.0
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin
*
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Fri, 10 Jun 2022 20:03:18 GMT
up
insight.adsrvr.org/track/ Frame DCEA
0
182 B
Document
General
Full URL
https://insight.adsrvr.org/track/up?adv=xdd0wy7&ref=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware&upid=ynlwqiy&upv=1.1.0
Requested by
Host: js.adsrvr.org
URL: https://js.adsrvr.org/up_loader.1.1.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a12b7a488abeaa9e4.awsglobalaccelerator.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://blogs.blackberry.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
private,no-cache, must-revalidate
content-type
text/html
date
Fri, 10 Jun 2022 20:03:19 GMT
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pragma
no-cache
x-aspnet-version
4.0.30319
roundtrip.js
s.adroll.com/j/
51 KB
17 KB
Script
General
Full URL
https://s.adroll.com/j/roundtrip.js
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2017/05/threat-spotlight-the-return-of-qakbot-malware
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:225e:7200:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
2c510c691b7c0ac37b6d4037e3f73509accc0bd60246d85ccd3a196e75b1fd98

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

X-Amz-Version-Id
orWA146CD9P2lORNaQHGwaslIwc1AsG9
Content-Encoding
gzip
Etag
W/"406b8320e0c0d1d961ec82c086c1624d"
Age
1929
X-Amz-Server-Side-Encryption
AES256
Transfer-Encoding
chunked
X-Cache
Hit from cloudfront
Connection
keep-alive
Vary
Accept-Encoding
Via
1.1 013a54c6b9caf01f403c247789c7256c.cloudfront.net (CloudFront)
Last-Modified
Thu, 02 Jun 2022 20:06:29 GMT
Server
AmazonS3
Date
Fri, 10 Jun 2022 19:31:12 GMT
Access-Control-Max-Age
600
Access-Control-Allow-Methods
GET
Content-Type
text/javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=3600, must-revalidate
Access-Control-Allow-Credentials
false
X-Amz-Cf-Pop
FRA60-P4
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
XEwr5F27aNJi9WRe5GfItkx20M88aIUf2hHSd_b1udmm82majtEPig==
index.js
s.adroll.com/j/exp/
Redirect Chain
  • https://s.adroll.com/j/exp/OU3SUNRJWBHPTCY5X23OHE/index.js
  • https://s.adroll.com/j/exp/index.js
28 B
762 B
Script
General
Full URL
https://s.adroll.com/j/exp/index.js
Protocol
HTTP/1.1
Server
2600:9000:225e:7200:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

X-Amz-Version-Id
QCXe6z8Ijv28a3Z6pj7cPKMX4fdClAik
Via
1.1 cfa647edefc0769e715b9781478b0626.cloudfront.net (CloudFront)
Etag
"5816cced8568d223aa09d889f300692b"
Age
85549
X-Amz-Server-Side-Encryption
AES256
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
28
Last-Modified
Wed, 18 May 2022 19:09:46 GMT
Server
AmazonS3
Date
Fri, 10 Jun 2022 05:12:49 GMT
Access-Control-Max-Age
600
Access-Control-Allow-Methods
GET
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
false
X-Amz-Cf-Pop
FRA60-P4
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
jvX5wVVdQq1xKFy5LdoO_-hNzqmddDiL34kvBFbc5YwbodYOriBaEA==

Redirect headers

Date
Fri, 10 Jun 2022 02:23:56 GMT
Via
1.1 013a54c6b9caf01f403c247789c7256c.cloudfront.net (CloudFront)
Age
63563
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
0
Server
AmazonS3
Location
https://s.adroll.com/j/exp/index.js
Access-Control-Max-Age
600
Access-Control-Allow-Methods
GET
Content-Type
application/xml
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
false
X-Amz-Cf-Pop
FRA60-P4
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
qoe13836oQe58QNzTumk0J7YhwpWD_UHSPNZl_0K9Sqjbdmg2RnNDw==
index.js
s.adroll.com/j/pre/
Redirect Chain
  • https://s.adroll.com/j/pre/OU3SUNRJWBHPTCY5X23OHE/JFQUMKJ3NRFIFLRA5FOQKB/fpconsent.js
  • https://s.adroll.com/j/pre/index.js
0
733 B
Script
General
Full URL
https://s.adroll.com/j/pre/index.js
Protocol
HTTP/1.1
Server
2600:9000:225e:7200:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Thu, 09 Jun 2022 20:45:12 GMT
Via
1.1 013a54c6b9caf01f403c247789c7256c.cloudfront.net (CloudFront)
Age
83889
X-Amz-Server-Side-Encryption
AES256
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
0
Last-Modified
Wed, 15 Jan 2020 23:54:18 GMT
Server
AmazonS3
Etag
"d41d8cd98f00b204e9800998ecf8427e"
Access-Control-Max-Age
600
Access-Control-Allow-Methods
GET
X-Amz-Version-Id
nQEe8wQ7h0ROt7P4GJfDfstto6x684Hy
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
false
X-Amz-Cf-Pop
FRA60-P4
Accept-Ranges
bytes
Content-Type
application/javascript
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
mkqY_ZyA0q2ol1LdeTrhLdt9Wkr0ZH6BbGkgmP31-sv1qzOtQI7DWw==

Redirect headers

Date
Fri, 10 Jun 2022 19:13:28 GMT
Via
1.1 013a54c6b9caf01f403c247789c7256c.cloudfront.net (CloudFront)
Age
2992
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
0
Server
AmazonS3
Location
https://s.adroll.com/j/pre/index.js
Access-Control-Max-Age
600
Access-Control-Allow-Methods
GET
Content-Type
application/xml
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
false
X-Amz-Cf-Pop
FRA60-P4
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
Zrqrqcyr8WtPqeHf7XLYFbCSXsNIvuGZ3rPfajTyL2Y9_6UV6mRF3g==
index.js
s.adroll.com/j/pre/OU3SUNRJWBHPTCY5X23OHE/JFQUMKJ3NRFIFLRA5FOQKB/
0
785 B
Script
General
Full URL
https://s.adroll.com/j/pre/OU3SUNRJWBHPTCY5X23OHE/JFQUMKJ3NRFIFLRA5FOQKB/index.js
Requested by
Host: s.adroll.com
URL: https://s.adroll.com/j/roundtrip.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:225e:7200:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

X-Amz-Version-Id
YO4qgGsmPAPwUixa3S1O15MQLXlNB21Y
Via
1.1 d81b69368e6f8be2907e338480e58682.cloudfront.net (CloudFront)
Etag
"d41d8cd98f00b204e9800998ecf8427e"
Age
301
X-Amz-Server-Side-Encryption
AES256
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
0
Last-Modified
Mon, 06 Jun 2022 22:05:32 GMT
Server
AmazonS3
Date
Fri, 10 Jun 2022 19:58:30 GMT
Access-Control-Max-Age
600
Access-Control-Allow-Methods
GET
Content-Type
text/javascript; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=3600, must-revalidate
Access-Control-Allow-Credentials
false
X-Amz-Cf-Pop
FRA60-P4
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
bGnfN_jr44FtlwrJmZ-SgJRpin6rc0Nrq-ko1BMHzhQvDoyloa4Z5w==
OU3SUNRJWBHPTCY5X23OHE
d.adroll.com/consent/check/
448 B
916 B
Script
General
Full URL
https://d.adroll.com/consent/check/OU3SUNRJWBHPTCY5X23OHE?arrfrr=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware&_s=aae3aeb613f29146d197530a27985f26&_b=2
Requested by
Host: s.adroll.com
URL: https://s.adroll.com/j/roundtrip.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.31.148.217 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-31-148-217.eu-west-1.compute.amazonaws.com
Software
nginx/1.20.0 /
Resource Hash
aea6f4032a660ac26e52b3664a4526d8993f402089ae696e1bc58473aa9a813d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 10 Jun 2022 20:03:20 GMT
cache-control
no-store, no-cache, must-revalidate
server
nginx/1.20.0
content-type
application/javascript
content-length
448
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
analytics
pi.pardot.com/
1 KB
2 KB
Script
General
Full URL
https://pi.pardot.com/analytics?ver=3&visitor_id=&visitor_id_sign=&pi_opt_in=&campaign_id=1400&account_id=192232&title=Threat%20Spotlight%3A%20The%20Return%20of%20Qakbot%20Malware&url=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware&referrer=
Requested by
Host: pi.pardot.com
URL: https://pi.pardot.com/pd.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.54.96.194 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-54-96-194.compute-1.amazonaws.com
Software
PardotServer /
Resource Hash
b2fa4bbdae1bd5cfc0f1c1661af785543c1716590ba01be0ef3b42ef9f92238e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma
no-cache
Date
Fri, 10 Jun 2022 20:03:20 GMT
content-encoding
gzip
X-Pardot-Route
9b06e8e2308c32c7bf9ba8adfb7be2e1
x-pardot-rsp
0/0/1
vary
Accept-Encoding,User-Agent
Connection
keep-alive
p3p
CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT", policyref="/w3c/p3p.xml", CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT", policyref="/w3c/p3p.xml"
cache-control
no-store, no-cache, must-revalidate
strict-transport-security
max-age=31536000; includeSubDomains
Content-Type
text/javascript; charset=utf-8
Content-Length
549
Server
PardotServer
expires
Thu, 19 Nov 1981 08:52:00 GMT
DK5HUUTRTBGDVAEMEQ4DX3.js
s.adroll.com/pixel/OU3SUNRJWBHPTCY5X23OHE/JFQUMKJ3NRFIFLRA5FOQKB/
Redirect Chain
  • https://d.adroll.com/pixel/OU3SUNRJWBHPTCY5X23OHE/JFQUMKJ3NRFIFLRA5FOQKB?adroll_fpc=044c10e45112ff87f9ad8bb5816c6149-1654891398954&arrfrr=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthrea...
  • https://s.adroll.com/pixel/OU3SUNRJWBHPTCY5X23OHE/JFQUMKJ3NRFIFLRA5FOQKB/DK5HUUTRTBGDVAEMEQ4DX3.js
10 KB
4 KB
Script
General
Full URL
https://s.adroll.com/pixel/OU3SUNRJWBHPTCY5X23OHE/JFQUMKJ3NRFIFLRA5FOQKB/DK5HUUTRTBGDVAEMEQ4DX3.js
Protocol
HTTP/1.1
Server
2600:9000:225e:7200:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
ff31df3eab925f54f04b2a6c7fecc0fb639291c7c2b7cbdb18f28fe1246950e7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Fri, 10 Jun 2022 20:03:04 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Age
17
X-Amz-Server-Side-Encryption
AES256
Transfer-Encoding
chunked
X-Cache
Hit from cloudfront
Connection
keep-alive
Via
1.1 013a54c6b9caf01f403c247789c7256c.cloudfront.net (CloudFront)
Last-Modified
Mon, 06 Jun 2022 22:05:38 GMT
Server
AmazonS3
Etag
W/"82822bcd6e571c88dd12064f9e0732e3"
Access-Control-Max-Age
600
Access-Control-Allow-Methods
GET
X-Amz-Version-Id
fwdaBGZXzVhvPOaB2ZAoKrWmCXTneQDc
Access-Control-Allow-Origin
*
Cache-Control
max-age=3600, must-revalidate
Access-Control-Allow-Credentials
false
X-Amz-Cf-Pop
FRA60-P4
Content-Type
text/javascript; charset=utf-8
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
hvgqr8nj5yX1bs4nXhZ2wLWPgcw_jZxgR0Qj4AIR0nYXNzxY1RoPfQ==

Redirect headers

date
Fri, 10 Jun 2022 20:03:20 GMT
x-segment-display-name
Malware Last 30 Days
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
x-rule-type
l
content-length
0
pragma
no-cache
x-conversion-value
0.00
server
nginx/1.20.0
x-rule
*malware*
x-segment-eid
DK5HUUTRTBGDVAEMEQ4DX3
location
https://s.adroll.com/pixel/OU3SUNRJWBHPTCY5X23OHE/JFQUMKJ3NRFIFLRA5FOQKB/DK5HUUTRTBGDVAEMEQ4DX3.js
cache-control
no-store, no-cache, must-revalidate
x-pixel-eid
JFQUMKJ3NRFIFLRA5FOQKB
x-segment-name
3bb9b480
x-advertisable-eid
OU3SUNRJWBHPTCY5X23OHE
x-conversion-currency
sendrolling.js
s.adroll.com/j/
9 KB
3 KB
Script
General
Full URL
https://s.adroll.com/j/sendrolling.js
Requested by
Host: d.adroll.com
URL: https://d.adroll.com/pixel/OU3SUNRJWBHPTCY5X23OHE/JFQUMKJ3NRFIFLRA5FOQKB?adroll_fpc=044c10e45112ff87f9ad8bb5816c6149-1654891398954&arrfrr=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware&pv=37656411927.26168&cookie=&adroll_s_ref=&keyw=
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:225e:7200:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
8b4fb78c5e5599a29f86d20a29d4f69e3ed0654547b1a595cf038ee0553b58d2

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

X-Amz-Version-Id
ZF339xBDqZ1K9SKXIggpL0GW25oAXt0X
Content-Encoding
gzip
Etag
W/"156295addf985cb637d7863ee802fd77"
Age
137
X-Amz-Server-Side-Encryption
AES256
Transfer-Encoding
chunked
X-Cache
Hit from cloudfront
Connection
keep-alive
Vary
Accept-Encoding
Via
1.1 013a54c6b9caf01f403c247789c7256c.cloudfront.net (CloudFront)
Last-Modified
Mon, 11 Apr 2022 15:24:31 GMT
Server
AmazonS3
Date
Fri, 10 Jun 2022 20:01:04 GMT
Access-Control-Max-Age
600
Access-Control-Allow-Methods
GET
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=300, must-revalidate
Access-Control-Allow-Credentials
false
X-Amz-Cf-Pop
FRA60-P4
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
74DZehOvS5zoRDx1THy4oMtVWoSvPODOh6pJgZ0QvkxOwHLQgkbNlA==
user_attrs
d.adroll.com/
436 B
898 B
Script
General
Full URL
https://d.adroll.com/user_attrs?adroll_fpc=044c10e45112ff87f9ad8bb5816c6149-1654891398954&arrfrr=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware&advertisable_eid=OU3SUNRJWBHPTCY5X23OHE&keys_eid=4UON5JNDZJC7JIYU4Q8ATK&first_party=false&jsonp=__adroll._b2bPersonalizationDataCb
Requested by
Host: s.adroll.com
URL: https://s.adroll.com/j/roundtrip.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.31.148.217 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-31-148-217.eu-west-1.compute.amazonaws.com
Software
nginx/1.20.0 /
Resource Hash
15d4210b4ce69667481559011663c2ab9485f0af41ea4da7e230a6364770f54a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 10 Jun 2022 20:03:20 GMT
cache-control
no-store, no-cache, must-revalidate
server
nginx/1.20.0
content-type
text/javascript
content-length
436
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
1792927231029740
connect.facebook.net/signals/config/
289 KB
83 KB
Script
General
Full URL
https://connect.facebook.net/signals/config/1792927231029740?v=2.9.62&r=stable
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f01c:216:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
c27cf8b4142c3382b49573ef3a3e0f66765c447469557bd15cb2e2316ddb8246
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding
gzip
x-content-type-options
nosniff
document-policy
force-load-at-top
report-to
{"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400,h3-29=":443"; ma=86400
x-xss-protection
0
pragma
public
x-fb-debug
M1fML7vhAImal1t7EJ6DjdnDm2uuFGQkHmkhMkpdtJG757XLV685e/w1M0sCklvbnbAaT0BifeHl3L2QqzkMDg==
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
DENY
date
Fri, 10 Jun 2022 20:03:20 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
x-content-cdn-origin-ts
1654891400530
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
x-fb-rlafr
0
priority
u=3,i
expires
Sat, 01 Jan 2000 00:00:00 GMT
collect
px4.ads.linkedin.com/
Redirect Chain
  • https://px.ads.linkedin.com/collect/?pid=2133314&fmt=gif
  • https://px4.ads.linkedin.com/collect?pid=2133314&fmt=gif&e_ipv6=AQIsBWg-OyU4EgAAAYFPNs0nokBALDRWTHzqafuFor5FqGHQ3bobd3LmdY6E01abPXTZKlT1
43 B
248 B
Image
General
Full URL
https://px4.ads.linkedin.com/collect?pid=2133314&fmt=gif&e_ipv6=AQIsBWg-OyU4EgAAAYFPNs0nokBALDRWTHzqafuFor5FqGHQ3bobd3LmdY6E01abPXTZKlT1
Protocol
H2
Server
13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Fri, 10 Jun 2022 20:03:20 GMT
content-encoding
gzip
nel
{"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
x-li-pop
afd-prod-ltx1-x
x-msedge-ref
Ref A: F17CC3E82CDE45E785876C07CB1BC446 Ref B: FRAEDGE1307 Ref C: 2022-06-10T20:03:20Z
linkedin-action
1
vary
Accept-Encoding
report-to
{"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
x-li-fabric
prod-ltx1
x-li-proto
http/2
x-cache
CONFIG_NOCACHE
content-type
image/gif
content-length
65
x-li-uuid
AAXhHW4UDFyjpewxfhHB9w==

Redirect headers

date
Fri, 10 Jun 2022 20:03:19 GMT
nel
{"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
x-li-pop
afd-prod-ltx1-x
x-msedge-ref
Ref A: 519E3C7171444B7E86B90B4D964C375A Ref B: FRAEDGE1111 Ref C: 2022-06-10T20:03:20Z
linkedin-action
1
report-to
{"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
x-li-fabric
prod-ltx1
location
https://px4.ads.linkedin.com/collect?pid=2133314&fmt=gif&e_ipv6=AQIsBWg-OyU4EgAAAYFPNs0nokBALDRWTHzqafuFor5FqGHQ3bobd3LmdY6E01abPXTZKlT1
x-li-proto
http/2
x-cache
CONFIG_NOCACHE
content-length
0
x-li-uuid
AAXhHW4RN5xEF0TcKpJDng==
sync
x.bidswitch.net/ul_cb/
Redirect Chain
  • https://d.adroll.com/cm/b/out?adroll_fpc=044c10e45112ff87f9ad8bb5816c6149-1654891398954&arrfrr=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware&ad...
  • https://x.bidswitch.net/sync?dsp_id=44&user_id=MjJkZWJkZmYxMGRhNzUwMmU3M2QzNDkxODk0YzI1ZDE
  • https://x.bidswitch.net/ul_cb/sync?dsp_id=44&user_id=MjJkZWJkZmYxMGRhNzUwMmU3M2QzNDkxODk0YzI1ZDE
43 B
495 B
Image
General
Full URL
https://x.bidswitch.net/ul_cb/sync?dsp_id=44&user_id=MjJkZWJkZmYxMGRhNzUwMmU3M2QzNDkxODk0YzI1ZDE
Protocol
HTTP/1.1
Server
35.157.1.22 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-157-1-22.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Fri, 10 Jun 2022 20:03:20 GMT
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
43
Content-Type
image/gif

Redirect headers

Location
https://x.bidswitch.net/ul_cb/sync?dsp_id=44&user_id=MjJkZWJkZmYxMGRhNzUwMmU3M2QzNDkxODk0YzI1ZDE
Date
Fri, 10 Jun 2022 20:03:20 GMT
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
in
d.adroll.com/cm/g/
Redirect Chain
  • https://d.adroll.com/cm/g/out?adroll_fpc=044c10e45112ff87f9ad8bb5816c6149-1654891398954&arrfrr=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware&ad...
  • https://cm.g.doubleclick.net/pixel?google_sc&google_nid=artb&google_hm=It69_xDadQLnPTSRiUwl0Q
  • https://d.adroll.com/cm/g/in
42 B
536 B
Image

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 10 Jun 2022 20:03:20 GMT
server
nginx/1.20.0
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
cache-control
no-store, no-cache, must-revalidate
content-type
image/gif
content-length
42
x-result
g.-1.-1.-1

Redirect headers

pragma
no-cache
date
Fri, 10 Jun 2022 20:03:20 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://d.adroll.com/cm/g/in
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
225
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
sd
us-u.openx.net/w/1.0/
Redirect Chain
  • https://d.adroll.com/cm/o/out?adroll_fpc=044c10e45112ff87f9ad8bb5816c6149-1654891398954&arrfrr=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware&ad...
  • https://us-u.openx.net/w/1.0/sd?id=537103138&val=22debdff10da7502e73d3491894c25d1&gdpr=1&gdpr_consent=
43 B
275 B
Image
General
Full URL
https://us-u.openx.net/w/1.0/sd?id=537103138&val=22debdff10da7502e73d3491894c25d1&gdpr=1&gdpr_consent=
Protocol
H2
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/7f1e280 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 10 Jun 2022 20:03:20 GMT
via
1.1 google
server
OXGW/7f1e280
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location
https://us-u.openx.net/w/1.0/sd?id=537103138&val=22debdff10da7502e73d3491894c25d1&gdpr=1&gdpr_consent=
pragma
no-cache
date
Fri, 10 Jun 2022 20:03:20 GMT
cache-control
no-store, no-cache, must-revalidate
server
nginx/1.20.0
content-length
108
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
v1
ads.yahoo.com/cms/
Redirect Chain
  • https://d.adroll.com/cm/r/out?adroll_fpc=044c10e45112ff87f9ad8bb5816c6149-1654891398954&arrfrr=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware&ad...
  • https://ads.yahoo.com/cms/v1?esig=1~bf4e7dc4546a90c08591652d78a230d3f2ef5733&nwid=10001032567&sigv=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA
0
194 B
Image
General
Full URL
https://ads.yahoo.com/cms/v1?esig=1~bf4e7dc4546a90c08591652d78a230d3f2ef5733&nwid=10001032567&sigv=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA
Protocol
H2
Server
2a00:1288:80:807::1 , United Kingdom, ASN203220 (YAHOO-DEB, GB),
Reverse DNS
Software
ATS /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=15552000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Fri, 10 Jun 2022 20:03:21 GMT
cache-control
no-store
x-content-type-options
nosniff
server
ATS
strict-transport-security
max-age=15552000
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-xss-protection
1; mode=block

Redirect headers

location
https://ads.yahoo.com/cms/v1?esig=1~bf4e7dc4546a90c08591652d78a230d3f2ef5733&nwid=10001032567&sigv=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA
pragma
no-cache
date
Fri, 10 Jun 2022 20:03:20 GMT
cache-control
no-store, no-cache, must-revalidate
server
nginx/1.20.0
content-length
165
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
bounce
ib.adnxs.com/
Redirect Chain
  • https://d.adroll.com/cm/x/out?adroll_fpc=044c10e45112ff87f9ad8bb5816c6149-1654891398954&arrfrr=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware&ad...
  • https://ib.adnxs.com/setuid?entity=172&code=MjJkZWJkZmYxMGRhNzUwMmU3M2QzNDkxODk0YzI1ZDE
  • https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D172%26code%3DMjJkZWJkZmYxMGRhNzUwMmU3M2QzNDkxODk0YzI1ZDE
43 B
1 KB
Image
General
Full URL
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D172%26code%3DMjJkZWJkZmYxMGRhNzUwMmU3M2QzNDkxODk0YzI1ZDE
Protocol
HTTP/1.1
Server
185.33.221.119 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
917.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 10 Jun 2022 20:03:20 GMT
X-Proxy-Origin
80.255.7.106; 80.255.7.106; 917.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid
cde3f652-3a32-4409-ae46-9791565c0a6c
Server
nginx/1.21.3
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Fri, 10 Jun 2022 20:03:20 GMT
X-Proxy-Origin
80.255.7.106; 80.255.7.106; 917.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid
44621f82-5690-46a9-b6da-dc36229d55a9
Server
nginx/1.21.3
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D172%26code%3DMjJkZWJkZmYxMGRhNzUwMmU3M2QzNDkxODk0YzI1ZDE
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
out
d.adroll.com/cm/l/
42 B
180 B
Image
General
Full URL
https://d.adroll.com/cm/l/out?adroll_fpc=044c10e45112ff87f9ad8bb5816c6149-1654891398954&arrfrr=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware&advertisable=OU3SUNRJWBHPTCY5X23OHE
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.31.148.217 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-31-148-217.eu-west-1.compute.amazonaws.com
Software
nginx/1.20.0 /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Fri, 10 Jun 2022 20:03:20 GMT
cache-control
no-transform,public,max-age=300,s-maxage=900
server
nginx/1.20.0
content-length
42
vary
Cookie
content-type
image/gif
in
d.adroll.com/cm/g/
Redirect Chain
  • https://d.adroll.com/cm/g/out?adroll_fpc=044c10e45112ff87f9ad8bb5816c6149-1654891398954&arrfrr=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware&ad...
  • https://cm.g.doubleclick.net/pixel?google_sc&google_nid=artb&google_hm=It69_xDadQLnPTSRiUwl0Q
  • https://d.adroll.com/cm/g/in
42 B
536 B
Image

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 10 Jun 2022 20:03:20 GMT
server
nginx/1.20.0
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
cache-control
no-store, no-cache, must-revalidate
content-type
image/gif
content-length
42
x-result
g.-1.-1.-1

Redirect headers

pragma
no-cache
date
Fri, 10 Jun 2022 20:03:20 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://d.adroll.com/cm/g/in
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
225
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
n.clarity.ms/
0
48 B
XHR
General
Full URL
https://n.clarity.ms/collect
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.184.204.244 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept
application/x-clarity-gzip
Referer
https://blogs.blackberry.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

access-control-allow-origin
https://blogs.blackberry.com
date
Fri, 10 Jun 2022 20:03:20 GMT
access-control-allow-credentials
true
server
Microsoft-IIS/10.0
x-powered-by
ASP.NET
request-context
appId=cid-v1:67bc0b23-8423-4b52-b1ca-6a87709ceaa2
analytics
bb.blackberry.com/
50 B
1 KB
Script
General
Full URL
https://bb.blackberry.com/analytics?conly=true&visitor_id=480599249&visitor_id_sign=afdeb8fb178508aacb294f58be8974e9e78a122d5160d114a84e3bf3b5ee08bf357f1568a34fc0e8ad8d069587f25d592fbe8de6&pi_opt_in=&campaign_id=1400&account_id=192232&title=Threat%20Spotlight%3A%20The%20Return%20of%20Qakbot%20Malware&url=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware&referrer=
Requested by
Host: pi.pardot.com
URL: https://pi.pardot.com/analytics?ver=3&visitor_id=&visitor_id_sign=&pi_opt_in=&campaign_id=1400&account_id=192232&title=Threat%20Spotlight%3A%20The%20Return%20of%20Qakbot%20Malware&url=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware&referrer=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
3.215.172.219 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-215-172-219.compute-1.amazonaws.com
Software
PardotServer /
Resource Hash
dcf430710cdd1359115293f45d5023b2a560aef8a2c1e59d578b8b1e10a216d3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma
no-cache
Date
Fri, 10 Jun 2022 20:03:21 GMT
X-Pardot-Route
9b06e8e2308c32c7bf9ba8adfb7be2e1
x-pardot-rsp
0/0/1
vary
User-Agent
p3p
CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT", policyref="/w3c/p3p.xml", CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT", policyref="/w3c/p3p.xml"
cache-control
no-store, no-cache, must-revalidate
Connection
keep-alive
Content-Type
text/javascript; charset=utf-8
Content-Length
50
Server
PardotServer
expires
Thu, 19 Nov 1981 08:52:00 GMT
/
www.facebook.com/tr/
44 B
88 B
Image
General
Full URL
https://www.facebook.com/tr/?id=1792927231029740&ev=PageView&dl=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware&rl=&if=false&ts=1654891399314&cd[segment_eid]=DK5HUUTRTBGDVAEMEQ4DX3&sw=1600&sh=1200&v=2.9.62&r=stable&ec=0&o=29&fbp=fb.1.1654891397502.1323707769&it=1654891396874&coo=false&dpo=LDU&dpoco=0&dpost=0&exp=p1&rqm=GET
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f11c:8083:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Fri, 10 Jun 2022 20:03:20 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
cache-control
no-cache, must-revalidate, max-age=0
cross-origin-resource-policy
cross-origin
content-length
44
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
priority
u=3,i
expires
Fri, 10 Jun 2022 20:03:20 GMT
collect
www.google-analytics.com/j/
2 B
22 B
XHR
General
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j96&a=755974502&t=event&ni=1&_s=1&dl=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware&dp=%2Fen%2F2017%2F05%2Fthreat-spotlight-the-return-of-qakbot-malware&ul=en-us&de=UTF-8&dt=Threat%20Spotlight%3A%20The%20Return%20of%20Qakbot%20Malware&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=rollworks&ea=rollworks-company-data&el=rollworks-company-data&_u=aGDAAEABQAAAAG~&jid=1509029969&gjid=43167174&cid=569856526.1654891397&tid=UA-42639814-33&_gid=1068903746.1654891397&_r=1&gtm=2wg680TXGFP23&cd1=credit-suisse.com&cd2=credit%20suisse&cd3=investment%20banking&cd4=xxlarge%20(%241b%2B)&cd5=xxlarge%20(10%2C000%2B%20employees)&cd10=569856526.1654891397&z=900888701
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://blogs.blackberry.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Fri, 10 Jun 2022 20:03:20 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://blogs.blackberry.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/j/
4 B
25 B
XHR
General
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-42639814-33&cid=569856526.1654891397&jid=1509029969&gjid=43167174&_gid=1068903746.1654891397&_u=aGDAAEABQAAAAG~&z=15396279
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:400c:c02::9c Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blogs.blackberry.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Fri, 10 Jun 2022 20:03:20 GMT
content-type
text/plain
access-control-allow-origin
https://blogs.blackberry.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.com/ads/
42 B
63 B
Image
General
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-42639814-33&cid=569856526.1654891397&jid=1509029969&_u=aGDAAEABQAAAAG~&z=1114877056
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 10 Jun 2022 20:03:21 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/
42 B
63 B
Image
General
Full URL
https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-42639814-33&cid=569856526.1654891397&jid=1509029969&_u=aGDAAEABQAAAAG~&z=1114877056
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 10 Jun 2022 20:03:21 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

163 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails object| navigation object| digitalData object| dataLayer object| FontAwesomeKitConfig function| $ function| jQuery function| appendData function| scrollLoadFull function| scrollLoadAuthor function| scrollLoadCategory function| onDemandScript object| bootstrap object| lazySizesConfig object| lazySizes function| getGclidQueryParameter function| getExpiryRecord function| addGclid object| Bizible object| BizTrackingA object| BizA object| _vis_opt_queue object| LC_API object| _satellite boolean| __satelliteLoaded object| adobe function| Visitor object| s_c_il number| s_c_in object| cp_utils object| s object| ___target_traces function| mboxCreate function| mboxDefine function| mboxUpdate object| google_tag_manager function| postscribe object| google_tag_manager_external object| google_tag_data string| GoogleAnalyticsObject function| ga function| twq string| _linkedin_data_partner_id function| createCookie undefined| sources string| piAId string| piCId function| getCookieGTM number| loopCount number| interval function| fbq function| _fbq string| adroll_adv_id string| adroll_pix_id function| AppMeasurement function| s_gi function| s_pgicq number| s_objectID number| s_giq function| AppMeasurement_Module_ActivityMap function| getTimeParting function| getNewRepeat function| getVisitNum function| endOfDatePeriod object| techtargetic function| rdt string| wid_baseUrl object| wid_cmds function| lintrk boolean| _already_called_lintrk object| gaplugins function| GooglemKTybQhCsO function| google_trackConversion object| GooglebQhCsO function| ttd_dom_ready function| TTDUniversalPixelApi object| google_optimize object| gaGlobal object| gaData function| UET function| UET_init function| UET_push object| ueto_d6b8d264c4 object| uetq object| configArgs number| pixelRatio number| width number| height object| screenSize object| labels string| WID_VISITOR_ID string| WID_EVENT_TYPES string| WID_PAGE_TITLE string| WID_PAGE_URL string| WID_PAGE_REFERAL_URL number| WID_INTERVAL number| WID_IDLE_INTERVAL function| addListenerMulti function| wid_initAgain function| wid_handleAnchorClick function| wid_bundleParams function| wid_handleApiRequest function| wid_handleButtonClick function| wid_findParentByTagName function| wid_getCurrentUnixTimestamp function| wid_getCookie function| wid_setCookie function| wid_deleteCookie function| wid_generateRandomGuid function| wid_zeroFill function| wid_str_pad function| wid_rand object| regeneratorRuntime object| twttr string| f0 function| cookieWrite function| cookieRead string| g number| s_loadT object| s_i_bbl-blackberry-production function| clarity boolean| __adroll_loaded string| adroll_sid object| __adroll boolean| adroll_optout object| adroll_ext_network object| adroll_callbacks undefined| adroll_tpc_callback object| __adroll_consent_data object| adroll_exp_list function| checkNamespace function| getPardotUrl function| piTracker function| piGetParameter function| piGetCookie function| piSetCookie string| piVersion number| piScriptNum object| piScriptObj object| pi number| c_start string| property boolean| __adroll_consent boolean| __adroll_consent_is_gdpr string| __adroll_consent_user_country string| __adroll_consent_adv_country object| adroll_currency object| adroll_conversion_value object| adroll_conversion_value_in_dollars string| adroll_seg_eid boolean| adroll_sendrolling_cross_device object| adroll_form_fields string| adroll_rule_type function| piResponse

73 Cookies

Domain/Path Name / Value
.blackberry.com/ Name: _biz_uid
Value: 9742e70dc8724dc7f70b90bdd781a9ba
.blackberry.com/ Name: _biz_sid
Value: dec5c
.bizible.com/ Name: _BUID
Value: 9742e70dc8724dc7f70b90bdd781a9ba
.blackberry.com/ Name: at_check
Value: true
.bizibly.com/ Name: _BUID
Value: a38bd735f258da5fd528e97327ee52a8
.blackberry.com/ Name: _gcl_au
Value: 1.1.1731650709.1654891397
.demdex.net/ Name: demdex
Value: 89068391059403092171126752195410223259
.blogs.blackberry.com/ Name: _ga
Value: GA1.3.569856526.1654891397
.blogs.blackberry.com/ Name: _gid
Value: GA1.3.1068903746.1654891397
.blogs.blackberry.com/ Name: _dc_gtm_UA-42639814-3
Value: 1
.bing.com/ Name: MUID
Value: 3D2B5718EA9566DC2AA346A7EB476707
.blogs.blackberry.com/ Name: _dc_gtm_UA-42639814-33
Value: 1
.techtarget.com/ Name: __cf_bm
Value: T2nuE4gQi7bl72wWs0GOBHqev0cQ_oqAvhcqpRB5qXU-1654891398-0-AZTQl5/aupCQmOR3DzVl0nZvgaxHeTJHSb7xCwh6KqSpSKdXWS7yhoZN0CbQZHBvsW0dSrWpTEAosEdtEBK0TGM=
.blackberry.com/ Name: AMCVS_85522AC5562681557F000101%40AdobeOrg
Value: 1
.blackberry.com/ Name: _uetsid
Value: 5e0e0e60e8f811ec9d01690337ec52a8
.blackberry.com/ Name: _uetvid
Value: 5e0e5680e8f811ec8fdabfec172f81df
.blackberry.com/ Name: _rdt_uuid
Value: 1654891396952.1a0007ed-014a-4749-ace0-8bf6cec7d9aa
.linkedin.com/ Name: UserMatchHistory
Value: AQLK1G7PZ1cGqgAAAYFPNsSCLGRDBMiLZCaHAf5vMwtlyjSaMxJdXvlPufCPUFreQJ1A0Q67eblSyw
.linkedin.com/ Name: AnalyticsSyncHistory
Value: AQImmkgFUI8fUAAAAYFPNsSCxzypAVbxwx-5dVaPXJX8JetTjdimtswpIpXhJ-_D_xCmV9qeZbvX25siYrxlSw
.ads.linkedin.com/ Name: lang
Value: v=2&lang=en-us
.linkedin.com/ Name: bcookie
Value: "v=2&cedc97c6-d347-408b-8a86-ed4070763bba"
.linkedin.com/ Name: lidc
Value: "b=TGST03:s=T:r=T:a=T:p=T:g=2769:u=1:x=1:i=1654891398:t=1654977798:v=2:sig=AQEiz_4yovtHfuWPbwa3FEomXGMxVFz_"
.everesttech.net/ Name: everest_g_v2
Value: g_surferid~YqOjhgAAAE6vtgOJ
.blackberry.com/ Name: mbox
Value: session#0da56586aabb406aa422e4d0b4abca5c#1654893257|PC#0da56586aabb406aa422e4d0b4abca5c.37_0#1718136198
.dpm.demdex.net/ Name: dpm
Value: 89068391059403092171126752195410223259
.blackberry.com/ Name: AMCV_85522AC5562681557F000101%40AdobeOrg
Value: -1124106680%7CMCIDTS%7C19154%7CMCMID%7C89048864270726745621129549020221218680%7CMCAAMLH-1655496196%7C6%7CMCAAMB-1655496196%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1654898596s%7CNONE%7CMCSYNCSOP%7C411-19161%7CvVersion%7C5.2.0
.linkedin.com/ Name: lang
Value: v=2&lang=de-de
.www.linkedin.com/ Name: bscookie
Value: "v=1&20220610200318f3fe80fb-e6c5-4f70-8759-7a4391ee6bd8AQHNHBSj0xeIrXjIkukqsiQymRsEqtbP"
.linkedin.com/ Name: li_gc
Value: MTswOzE2NTQ4OTEzOTg7MjswMjFWOEQ6pHTucyRj51kW+u4V/lIb6DCHJo7MttY/P6sgbQ==
.blackberry.com/ Name: s_lv
Value: 1654891397248
.blackberry.com/ Name: s_lv_s
Value: First%20Visit
.blackberry.com/ Name: s_nr30
Value: 1654891397251-New
.blackberry.com/ Name: s_vncm
Value: 1656633599254%26vn%3D1
.blackberry.com/ Name: s_ivc
Value: true
.blackberry.com/ Name: s_tp
Value: 7971
.blackberry.com/ Name: s_ppv
Value: en%253A2017%253A05%253Athreat-spotlight-the-return-of-qakbot-malware%2C15%2C15%2C1200
.blackberry.com/ Name: s_cc
Value: true
.t.co/ Name: muc_ads
Value: 47e78cf7-2055-465a-a482-c48d8b608785
.doubleclick.net/ Name: IDE
Value: AHWqTUmzZt6gy149hTjyr6Rkd1qKW3ifRNIAFxDaRo-Zp0vgIh4T3ZAEdOEut_jQ6eU
www.clarity.ms/ Name: CLID
Value: a5e400f538054a5cb56a1b2edd4b90f1.20220610.20230610
.twitter.com/ Name: personalization_id
Value: "v1_8GW3uzy8TPcWwUdpmAQsHg=="
.blackberry.com/ Name: _fbp
Value: fb.1.1654891397502.1323707769
.blackberry.com/ Name: _biz_nA
Value: 2
.blackberry.com/ Name: _biz_flagsA
Value: %7B%22Version%22%3A1%2C%22ViewThrough%22%3A%221%22%2C%22XDomain%22%3A%221%22%2C%22Ecid%22%3A%22-1929940066%22%7D
.blackberry.com/ Name: _biz_pendingA
Value: %5B%5D
.blackberry.com/ Name: _clck
Value: 114jznj|1|f27|0
.mathtag.com/ Name: uuid
Value: e67f62a3-a387-4a00-919e-11037532e1d4
.mathtag.com/ Name: mt_misc
Value: mt_bt:1
blogs.blackberry.com/ Name: WID_VISITOR_ID
Value: 1654891398397000801
.blackberry.com/ Name: _clsk
Value: 18smcr1|1654891398438|1|1|n.clarity.ms/collect
.c.bing.com/ Name: SRM_B
Value: 3D2B5718EA9566DC2AA346A7EB476707
.c.clarity.ms/ Name: SM
Value: C
.clarity.ms/ Name: MUID
Value: 3D2B5718EA9566DC2AA346A7EB476707
.c.clarity.ms/ Name: ANONCHK
Value: 0
.blogs.blackberry.com/ Name: __adroll_fpc
Value: 044c10e45112ff87f9ad8bb5816c6149-1654891398954
.blogs.blackberry.com/ Name: __ar_v4
Value: %7COU3SUNRJWBHPTCY5X23OHE%3A20220610%3A1%7CJFQUMKJ3NRFIFLRA5FOQKB%3A20220610%3A1%7CDK5HUUTRTBGDVAEMEQ4DX3%3A20220610%3A1
.pardot.com/ Name: visitor_id191232
Value: 480599249
.pardot.com/ Name: visitor_id191232-hash
Value: afdeb8fb178508aacb294f58be8974e9e78a122d5160d114a84e3bf3b5ee08bf357f1568a34fc0e8ad8d069587f25d592fbe8de6
pi.pardot.com/ Name: lpv191232
Value: aHR0cHM6Ly9ibG9ncy5ibGFja2JlcnJ5LmNvbS9lbi8yMDE3LzA1L3RocmVhdC1zcG90bGlnaHQtdGhlLXJldHVybi1vZi1xYWtib3QtbWFsd2FyZQ%3D%3D
blogs.blackberry.com/ Name: visitor_id191232
Value: 480599249
blogs.blackberry.com/ Name: visitor_id191232-hash
Value: afdeb8fb178508aacb294f58be8974e9e78a122d5160d114a84e3bf3b5ee08bf357f1568a34fc0e8ad8d069587f25d592fbe8de6
.adnxs.com/ Name: uuid2
Value: 8656309645585960628
.adnxs.com/ Name: anj
Value: dTM7k!M4/rD>6NRF']wIg2C%1Hxk*w!@wnfH1Ya.O4]7Q=E?HO1r$7$Pn]ipM/3I4w5R-/M@1h<MBs@2w-9R]w-CX?/0-l<YOm'06kew2E[uP0D$25ADb6_:!8<YXt+Nfo
d.adroll.com/ Name: __adroll
Value: 22debdff10da7502e73d3491894c25d1-a_1654891400
.adroll.com/ Name: __adroll_shared
Value: 22debdff10da7502e73d3491894c25d1-a_1654891400
.blackberry.com/ Name: _ga
Value: GA1.2.569856526.1654891397
.blackberry.com/ Name: _gid
Value: GA1.2.1068903746.1654891397
.blackberry.com/ Name: _gat_UA-42639814-33
Value: 1
.bidswitch.net/ Name: tuuid
Value: 9fb11cef-82ef-482c-99be-93bf69509a24
.bidswitch.net/ Name: c
Value: 1654891400
.bidswitch.net/ Name: tuuid_lu
Value: 1654891400
bb.blackberry.com/ Name: visitor_id191232
Value: 480599249
bb.blackberry.com/ Name: visitor_id191232-hash
Value: afdeb8fb178508aacb294f58be8974e9e78a122d5160d114a84e3bf3b5ee08bf357f1568a34fc0e8ad8d069587f25d592fbe8de6

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
Strict-Transport-Security max-age=63072000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

10049132.fls.doubleclick.net
9632625.fls.doubleclick.net
ads.yahoo.com
adservice.google.com
adservice.google.de
alb.reddit.com
analytics.twitter.com
apt.techtarget.com
argusplatform.com
assets.adobedtm.com
bat.bing.com
bb.blackberry.com
blackberry.demdex.net
blackberrylimited.sc.omtrdc.net
blackberrylimited.tt.omtrdc.net
blogs.blackberry.com
c.bing.com
c.clarity.ms
cdn.bizible.com
cdn.bizibly.com
cdn.bttrack.com
cm.everesttech.net
cm.g.doubleclick.net
connect.facebook.net
d.adroll.com
dpm.demdex.net
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
ib.adnxs.com
insight.adsrvr.org
js.adsrvr.org
ka-f.fontawesome.com
kit.fontawesome.com
n.clarity.ms
pi.pardot.com
pixel.mathtag.com
pixels.argusplatform.com
px.ads.linkedin.com
px4.ads.linkedin.com
s.adroll.com
snap.licdn.com
static.ads-twitter.com
stats.g.doubleclick.net
t.co
threatvector.cylance.com
trk.techtarget.com
us-u.openx.net
www.argusplatform.com
www.clarity.ms
www.cylance.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.linkedin.com
www.redditstatic.com
x.bidswitch.net
104.244.42.195
104.244.42.69
104.79.88.164
108.128.0.238
13.107.42.14
13.36.218.177
142.250.186.34
15.197.193.217
151.101.65.140
152.195.15.58
172.217.18.6
172.217.23.98
185.33.221.119
199.232.188.157
20.234.93.27
206.19.49.24
2600:9000:224a:6c00:19:cd0a:2e00:93a1
2600:9000:225e:7200:6:9280:1080:93a1
2600:9000:2315:2400:1f:5cfb:7080:93a1
2606:4700:4400::ac40:91d9
2606:4700::6812:1734
2620:1ec:21::14
2620:1ec:27::cafe:1824
2620:1ec:c11::200
2a00:1288:80:807::1
2a00:1450:4001:801::2002
2a00:1450:4001:801::2004
2a00:1450:4001:809::2002
2a00:1450:4001:810::2003
2a00:1450:4001:812::2003
2a00:1450:4001:82a::2002
2a00:1450:4001:82a::2008
2a00:1450:4001:82f::200e
2a00:1450:400c:c02::9c
2a00:1450:400e:811::200a
2a02:26f0:b600:183::1e80
2a02:26f0:f7::5c7b:e06b
2a03:2880:f01c:216:face:b00c:0:3
2a03:2880:f11c:8083:face:b00c:0:25de
2a04:4e42:200::396
2a06:98c1:3121::3
3.215.172.219
34.246.128.161
34.250.172.3
34.251.139.24
34.98.64.218
35.157.1.22
52.184.204.244
52.208.8.226
52.31.148.217
52.54.96.194
54.194.254.72
65.9.65.116
69.16.175.42
74.82.70.131
0045468743159014f6bde2ed98ce21e0581dea617cf50f56d39382ead24ae89c
0486530f1e98818865754a08e1b5442ac5a6a36a6bf6042e3b3338a532e998d2
05448e9440e5f8a66395d7d66a9bfcb9614a80e4e181f6347cd742ec36725ca6
05978957c6c8b028f2785dc77271c286bfac76e30b7bcd7e835c2927fbe897cf
0742c26ce98bb3775d7a7a90a8d55b8e8da1af0379177c4404bda91b1401348f
0a2824c85e626327fecc7ce51aaf072be9addb1f2277293ee670838991fc9422
0afeb0c59cda1372d24a059afe9de618c353070363a486cb04bdf8d4cad55d80
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
13480b9040646b2081af9ef2f1d640cf81b0780d1de18e9b4b9e57a0f726168b
14f2ec002b176e0dee403cb7dd4ef2274a1353080e1e3e4084678770f4c15b9c
15d4210b4ce69667481559011663c2ab9485f0af41ea4da7e230a6364770f54a
1c1a5432c62e9d6f8ec8bdb061b2ec2dc8da1700a4608a4e7e80709e7b50d03a
1ee55b7f67c4a10c2b25ec199e100fb1f406821811cee1533006204c205e78e9
1f560975d9c8dd1b983de070ac170d94c20f2c04b6a3025398761b19588b6d0a
22b22ab6217c7b299e896ac9bd55044fd72c25cf99410b1a724bf4eba90cb8e5
22f38bcd5544708fe83348bf6b068d4f521e0cb16c32d0256b7e027760114bad
2761c746e0f935c36101b9de940e18630c67728d6b689e0baddf44083063a199
2c14ab968f7de8be805e40a91ecd9a307d6d03130724fb9bf15ec0c4b44d2f24
2c510c691b7c0ac37b6d4037e3f73509accc0bd60246d85ccd3a196e75b1fd98
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
304a0259406001319e10acd097537e33bbc0157670417a48fdd527a889951f65
31843bc572f17a445861c370fb3df5a23d724827e5c09ad1d2d10481a49afd34
3b91e6a4b14493d67f9660e6d4a2e27c1eea54d97ccb7c30acf3b89998b3be99
3d79854e01d0c79408c548889dcfddd23e4ef10f11c698c831b570573ee13b97
42c68ba70eb0382c010a722e6fd025048fcce3db70c23fb03ba5919469493f1d
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4c8417349722c7f6afdd6ff0124b20d345c952d91f46aa0192dae089bd007eef
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
530b64892df953de23115ceeb9fcc58e063a266ae2ffda8805dc7a5a487bd44b
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
550eba68765b553d5a9dbadff22f8cc6c09251a3764b95c00ce9e167381a0f64
59145d1e607b102b2a0c67dcee22de29d29aeaac7418c817a94fe45599e6f3a1
5b50b97f1c1fb016ca2a19fd93491deb804d383c7b51f7ff2148cb8d3510b82a
5de87d1219e1376353327e01e84e32aefd96be40dcf93f26f8b1ace5f6a16d5d
6070ae2e12a541dea96954e8697d468a1e5e406ca61b7ca7051986abfe0333bf
65dad26d197878fdddaaa0ab1990b6a0bc7f6853c6db2af3e1970ba6c2f5b2a8
695a37a60dc759b7c004dd71efa5557b5dc370baccbb3cd7b635489e345843cb
6dea47458a4cd7cd7312cc780a53c62e0c8b3ccc8d0b13c1ac0ea6e3dfcecea8
6ebb1bc6f0cbbdf624730687c443fac5d444cd399938707e358a1876a040bfce
6fe9f9f7b377dc96c8b87655739234ae33479d20c2d8993f4ab01d3d8e4adb2a
70368a9d6b125873d7c493c9288b816b62b28b726f0c03827475ae1076582592
719ee0cce9e7b5e8fa0e16e936f3dd8635e9d1bd5533dbb964ddc6aac088e733
7266d887ea9327e1e862de9cfb631fdcc5f9653d5f68f20df21efed61dd87360
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
7e262106f82cc52663e403f5b73795bbeab9ca0630c33c03579354fbcd4fae1e
7f8b63bff49fba3c5bae30f4eb39f2fd6d088fbe9d7292bdf37b0ef4a1ec68d6
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
8540c5e2d2e85cc6c5d46b1b06b7f6642dce39e0314299a08976cfe6053c7c52
88422a02a5e69806582c0942c5e14eaa17c845152268cecf2879f967db642d28
89a743f5b1bd2e857d2eb4150994f75bd4473728458934af97a6b82fa496d67e
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7
8b4fb78c5e5599a29f86d20a29d4f69e3ed0654547b1a595cf038ee0553b58d2
9035d9c6ec8e6558bef5e0382a84871c5b1c4db470806ca19e8c0181b757dba6
9167cb37ed21405ef9556646b83789a2099c15398f5cea867470df1e81752e17
93a8b5d49340388d77b55240e81365ca4e3e68334d5bf45f2d672aec9e6d830f
9669f8a9f73d1619c41d568ae4d785e961015ebc2b4368c11e388993990f8925
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
9b61c5a0528526362d6c6f4ae3bdd3720f7f81672480d2433e0556b545d933ff
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
ac5000602bb127a5a07be117df96c48667d2e2a9fb1bb33d5ebb7c50e4480a88
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
aea6f4032a660ac26e52b3664a4526d8993f402089ae696e1bc58473aa9a813d
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b2fa4bbdae1bd5cfc0f1c1661af785543c1716590ba01be0ef3b42ef9f92238e
b83a72a5c6851b1debd7a313f8929bf54ccc4629ef000301405eabd081dfacfb
bb0e7b3385c6fc42b0e4894226c01e6e42b1e43f1233857678eddcf0781fff09
c27cf8b4142c3382b49573ef3a3e0f66765c447469557bd15cb2e2316ddb8246
c27efd3681b18f5317af088e1307dede0daf9f55de8923cce38857e5aa947c1c
c5fe76c8204885b3c3c0425c8b6adf273659bef30bd84097540b24a6bd9a0bbe
ca63193ce799e4e00c9106349365981dc6e26cb77632ebf5df23dffba2aaccfa
ce9c25da12cd788f4bf4fea9a9db3014e66eb5241167efa9a114d188d282001f
d104b74bae6e524bb21bfede62a270ff318122d005772d94e6d7cebbc53017fc
d61de641350857348e74f3cc62441d3927106a296c73bc48fa4c7c0230ae5f2b
d6b423c91328eec9c218dd8b21ae1e676987d574e5432411a32806e5dd2bde32
dcf430710cdd1359115293f45d5023b2a560aef8a2c1e59d578b8b1e10a216d3
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ea011956164ed15022fb5732fd6d810bf75bb104babed05a29beb5c50302b926
ee3a7301fe1e0c0f6bf6acff0d7a8d107f5cb3f62a2566740c0416d8e61f00b9
eec6b719c1df15556a3581632c1010a34d2f19f42481c6f875ab3ff21337748c
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f432c2e4fa2ca222a00f0b2a6ea2c68c4b3268616cc8c83cb08388dd6fe4541d
f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
f75911313e1c7802c23345ab57e754d87801581706780c993fb23ff4e0fe62ef
fac090fb3cce5397bdc8a6d76b91f68ab0125114b8af211e65d4ebd0ce8dbf1b
fc5128dfdcdfa0c3a9967a6d2f19399d7bf1aaae6ad7571b96b03915a1f30dda
ff31df3eab925f54f04b2a6c7fecc0fb639291c7c2b7cbdb18f28fe1246950e7