blog.lumen.com Open in urlscan Pro
50.112.230.199 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/
Submission: On March 16 via api (March 16th 2021, 6:58:25 pm UTC) from US

Summary HTTP 147 Redirects Links 30 Behaviour Indicators

Summary

This website contacted 34 IPs in 5 countries across 24 domains to perform 147 HTTP transactions. The main IP is 50.112.230.199, located in Boardman, United States and belongs to AMAZON-02, US. The main domain is blog.lumen.com.
TLS certificate: Issued by R3 on March 12th 2021. Valid for: 3 months.

This is the only time blog.lumen.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
58	50.112.230.199 50.112.230.199	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:829::200a	15169 (GOOGLE) (GOOGLE)
6	2606:4700::68... 2606:4700::6810:9440	13335 (CLOUDFLAR...) (CLOUDFLARENET)
11	2a02:26f0:10c... 2a02:26f0:10c:4a5::1e80	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2a00:1450:400... 2a00:1450:4001:800::200e	15169 (GOOGLE) (GOOGLE)
2	2606:4700:10:... 2606:4700:10::ac43:2794	13335 (CLOUDFLAR...) (CLOUDFLARENET)
19	2a00:1450:400... 2a00:1450:4001:813::200e	15169 (GOOGLE) (GOOGLE)
1	2606:4700:10:... 2606:4700:10::6814:b844	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:810::2003	15169 (GOOGLE) (GOOGLE)
4	2600:9000:211... 2600:9000:211e:9800:f:fcff:7940:93a1	16509 (AMAZON-02) (AMAZON-02)
3	2a00:1450:400... 2a00:1450:4001:827::200e	15169 (GOOGLE) (GOOGLE)
1 4	52.17.73.77 52.17.73.77	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:827::2008	15169 (GOOGLE) (GOOGLE)
2	88.221.60.75 88.221.60.75	16625 (AKAMAI-AS) (AKAMAI-AS)
2	2a00:1450:400... 2a00:1450:4001:800::2003	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c09::9b	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:803::2008	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c0c::9d	15169 (GOOGLE) (GOOGLE)
1 1	2a00:1450:400... 2a00:1450:4001:829::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:810::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:80e::2006	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:810::2004	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:803::2001	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:80e::2016	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:813::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80f::2003	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:809::2003	15169 (GOOGLE) (GOOGLE)
2	15.237.136.106 15.237.136.106	16509 (AMAZON-02) (AMAZON-02)
1 1	34.253.145.149 34.253.145.149	16509 (AMAZON-02) (AMAZON-02)
1	2a02:26f0:170... 2a02:26f0:1700:38c::2db0	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2 4	142.250.185.230 142.250.185.230	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f02... 2a03:2880:f02d:12:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1 2	2620:119:50e4... 2620:119:50e4:101::6cae:b55	14413 (LINKEDIN) (LINKEDIN)
1 1	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
3	2a03:2880:f12... 2a03:2880:f12d:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
2	2a00:1450:400... 2a00:1450:4001:828::2002	15169 (GOOGLE) (GOOGLE)
147	34

58 50.112.230.199 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-50-112-230-199.us-west-2.compute.amazonaws.com

blog.lumen.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:829::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2606:4700::6810:9440 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.cookielaw.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2a02:26f0:10c:4a5::1e80 (Düsseldorf, Germany)

ASN20940 (AKAMAI-ASN1, NL)

assets.adobedtm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:800::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:10::ac43:2794 (United States)

ASN13335 (CLOUDFLARENET, US)

static.addtoany.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

19 2a00:1450:4001:813::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.youtube.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:10::6814:b844 (United States)

ASN13335 (CLOUDFLARENET, US)

geolocation.onetrust.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:810::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2600:9000:211e:9800:f:fcff:7940:93a1 (United States)

ASN16509 (AMAZON-02, US)

images-cdn.newscred.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:827::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 52.17.73.77 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-17-73-77.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
centurylink.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:827::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 88.221.60.75 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a88-221-60-75.deploy.static.akamaitechnologies.com

munchkin.marketo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:800::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c09::9b (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:803::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c0c::9d (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:829::2002 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:810::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80e::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

static.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:810::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:803::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

yt3.ggpht.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80e::2016 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

i.ytimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:813::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:809::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 15.237.136.106 (Paris, France)

ASN16509 (AMAZON-02, US)
PTR: ec2-15-237-136-106.eu-west-3.compute.amazonaws.com

smetrics.centurylink.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.253.145.149 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-34-253-145-149.eu-west-1.compute.amazonaws.com

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:1700:38c::2db0 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

cdnssl.clicktale.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.250.185.230 (United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s53-in-f6.1e100.net

9129572.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f02d:12:face:b00c:0:3 (United States)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:119:50e4:101::6cae:b55 (United States) 1 redirects

ASN14413 (LINKEDIN, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:21::14 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a03:2880:f12d:83:face:b00c:0:25de (United States)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:828::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
58	lumen.com blog.lumen.com	643 KB
19	youtube.com www.youtube.com	1 MB
11	doubleclick.net 3 redirects stats.g.doubleclick.net googleads.g.doubleclick.net static.doubleclick.net 9129572.fls.doubleclick.net	5 KB
11	adobedtm.com assets.adobedtm.com	147 KB
6	cookielaw.org cdn.cookielaw.org	112 KB
5	google.com www.google.com adservice.google.com	12 KB
5	gstatic.com fonts.gstatic.com www.gstatic.com	51 KB
4	demdex.net 1 redirects dpm.demdex.net centurylink.demdex.net	6 KB
4	newscred.com images-cdn.newscred.com	148 KB
4	google-analytics.com www.google-analytics.com	20 KB
3	facebook.com www.facebook.com	703 B
3	linkedin.com 2 redirects px.ads.linkedin.com www.linkedin.com	2 KB
3	googletagmanager.com www.googletagmanager.com	117 KB
2	facebook.net connect.facebook.net	93 KB
2	centurylink.com smetrics.centurylink.com	734 B
2	ytimg.com i.ytimg.com	38 KB
2	ggpht.com yt3.ggpht.com	3 KB
2	marketo.net munchkin.marketo.net	7 KB
2	addtoany.com static.addtoany.com	60 KB
1	clicktale.net cdnssl.clicktale.net	43 KB
1	everesttech.net 1 redirects cm.everesttech.net	517 B
1	google.de www.google.de	107 B
1	onetrust.com geolocation.onetrust.com	363 B
1	googleapis.com fonts.googleapis.com	2 KB
147	24

	Domain	Requested by
58	blog.lumen.com	blog.lumen.com
19	www.youtube.com	blog.lumen.com www.youtube.com assets.adobedtm.com
11	assets.adobedtm.com	blog.lumen.com assets.adobedtm.com
6	cdn.cookielaw.org	blog.lumen.com cdn.cookielaw.org
4	9129572.fls.doubleclick.net	2 redirects www.googletagmanager.com
4	images-cdn.newscred.com	blog.lumen.com
4	www.google-analytics.com	blog.lumen.com www.google-analytics.com
3	www.facebook.com	blog.lumen.com connect.facebook.net
3	www.google.com	www.youtube.com blog.lumen.com
3	googleads.g.doubleclick.net	1 redirects www.youtube.com
3	www.googletagmanager.com	assets.adobedtm.com www.googletagmanager.com
3	dpm.demdex.net	1 redirects blog.lumen.com
3	fonts.gstatic.com	fonts.googleapis.com www.youtube.com
2	adservice.google.com	9129572.fls.doubleclick.net
2	px.ads.linkedin.com	1 redirects blog.lumen.com
2	connect.facebook.net	blog.lumen.com connect.facebook.net
2	smetrics.centurylink.com	assets.adobedtm.com blog.lumen.com
2	www.gstatic.com	www.youtube.com
2	i.ytimg.com	www.youtube.com
2	yt3.ggpht.com	www.youtube.com
2	static.doubleclick.net	www.youtube.com
2	stats.g.doubleclick.net	www.google-analytics.com
2	munchkin.marketo.net	assets.adobedtm.com munchkin.marketo.net
2	static.addtoany.com	blog.lumen.com static.addtoany.com
1	www.linkedin.com	1 redirects
1	cdnssl.clicktale.net	blog.lumen.com
1	cm.everesttech.net	1 redirects
1	centurylink.demdex.net	assets.adobedtm.com
1	www.google.de	blog.lumen.com
1	geolocation.onetrust.com	cdn.cookielaw.org
1	fonts.googleapis.com	blog.lumen.com
147	31

This site contains links to these domains. Also see Links.

Domain
news.lumen.com
latamblog.lumen.com
www.facebook.com
twitter.com
www.pinterest.com
plus.google.com
www.addtoany.com
www.exploit-db.com
blog.netlab.360.com
en.wikipedia.org
securityaffairs.co
www.youtube.com
www.linkedin.com
instagram.com
www.lumen.com
onetrust.com

Subject Issuer	Validity	Valid
blog.lumen.com R3	`2021-03-12` - `2021-06-10`	3 months	crt.sh
upload.video.google.com GTS CA 1O1	`2021-02-23` - `2021-05-18`	3 months	crt.sh
cookielaw.org Cloudflare Inc ECC CA-3	`2020-07-01` - `2021-07-01`	a year	crt.sh
assets.adobedtm.com DigiCert TLS RSA SHA256 2020 CA1	`2021-01-08` - `2021-09-30`	9 months	crt.sh
*.google-analytics.com GTS CA 1O1	`2021-02-23` - `2021-05-18`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-08-05` - `2021-08-05`	a year	crt.sh
*.google.com GTS CA 1O1	`2021-02-23` - `2021-05-18`	3 months	crt.sh
onetrust.com Cloudflare Inc ECC CA-3	`2021-02-12` - `2022-02-11`	a year	crt.sh
*.gstatic.com GTS CA 1O1	`2021-02-23` - `2021-05-18`	3 months	crt.sh
*.newscred.com Amazon	`2020-09-19` - `2021-10-21`	a year	crt.sh
*.demdex.net DigiCert TLS RSA SHA256 2020 CA1	`2020-12-02` - `2022-01-02`	a year	crt.sh
*.marketo.net DigiCert SHA2 Secure Server CA	`2020-03-14` - `2021-04-13`	a year	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2021-02-23` - `2021-05-18`	3 months	crt.sh
*.doubleclick.net GTS CA 1O1	`2021-02-23` - `2021-05-18`	3 months	crt.sh
www.google.com GTS CA 1O1	`2021-02-23` - `2021-05-18`	3 months	crt.sh
*.googleusercontent.com GTS CA 1O1	`2021-02-23` - `2021-05-18`	3 months	crt.sh
edgestatic.com GTS CA 1O1	`2021-02-23` - `2021-05-18`	3 months	crt.sh
www.google.de GTS CA 1O1	`2021-02-23` - `2021-05-18`	3 months	crt.sh
smetrics.centurylink.com DigiCert SHA2 High Assurance Server CA	`2020-05-11` - `2021-08-12`	a year	crt.sh
*.clicktale.net DigiCert SHA2 Secure Server CA	`2020-10-26` - `2021-11-24`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2021-02-10` - `2021-05-10`	3 months	crt.sh
px.ads.linkedin.com DigiCert SHA2 Secure Server CA	`2021-01-06` - `2021-07-05`	6 months	crt.sh

This page contains 5 frames:

Primary Page: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/
Frame ID: F2FCD1789280EF77CAC1006C13A6059E
Requests: 111 HTTP requests in this frame

Frame: https://www.youtube.com/embed/tqiYhn2fQIY?rel=0&enablejsapi=1&origin=https://blog.lumen.com
Frame ID: 5372C92FFC18D519737244F4497C7BB3
Requests: 34 HTTP requests in this frame

Frame: https://centurylink.demdex.net/dest5.html?d_nsid=0
Frame ID: 704255A89C92F10C9553ACB15B77224C
Requests: 1 HTTP requests in this frame

Frame: https://9129572.fls.doubleclick.net/activityi;dc_pre=CPzQkpO_te8CFWqgUQodIVwGxQ;src=9129572;type=audie0;cat=tdnae00;ord=9451237117431;gtm=2od330;auiddc=2099659997.1615921087;u1=https%3A%2F%2Fblog.lumen.com%2Fnew-mozi-malware-family-quietly-amasses-iot-bots%2F;u3=ctl%7Cblog%7Cnew-mozi-malware-family-quietly-amasses-iot-bots;u4=70116968814373863882098440057776203657;u6=;~oref=https%3A%2F%2Fblog.lumen.com%2Fnew-mozi-malware-family-quietly-amasses-iot-bots%2F
Frame ID: 48C16F2DDE792635B811FE8F8F805B97
Requests: 2 HTTP requests in this frame

Frame: https://9129572.fls.doubleclick.net/activityi;dc_pre=CMrRkpO_te8CFQyr1Qodd5sJoA;src=9129572;type=audie0;cat=tdnae002;ord=1;num=4868752723814;gtm=2od330;auiddc=2099659997.1615921087;u1=https%3A%2F%2Fblog.lumen.com%2Fnew-mozi-malware-family-quietly-amasses-iot-bots%2F;u3=ctl%7Cblog%7Cnew-mozi-malware-family-quietly-amasses-iot-bots;u4=70116968814373863882098440057776203657;u6=;~oref=https%3A%2F%2Fblog.lumen.com%2Fnew-mozi-malware-family-quietly-amasses-iot-bots%2F
Frame ID: D366C26E15371041DF9A28FDE2B4FE4D
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

headers link /rel="https:\/\/api\.w\.org\/"/i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers link /rel="https:\/\/api\.w\.org\/"/i

MySQL (Databases) Expand

Overall confidence: 100%
Detected patterns

headers link /rel="https:\/\/api\.w\.org\/"/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

147
Requests

99 %
HTTPS

83 %
IPv6

24
Domains

31
Subdomains

34
IPs

5
Countries

2901 kB
Transfer

8229 kB
Size

16
Cookies

30 Outgoing links

These are links going to different origins than the main page.

URL: https://news.lumen.com/
Title: NewsRoom

Search URL Search Domain Scan URL

URL: https://latamblog.lumen.com/
Title: LATAM Blog

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/
Title: Share On Facebook

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?original_referer=https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/&text=New%20Mozi%20malware%20family%20quietly%20amasses%20IoT%20bots&url=https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/
Title: Tweet It

Search URL Search Domain Scan URL

URL: http://www.pinterest.com/pin/create/button/?url=https%3A%2F%2Fblog.lumen.com%2Fnew-mozi-malware-family-quietly-amasses-iot-bots%2F&media=https%3A%2F%2Fblog.lumen.com%2Fwp-content%2Fuploads%2F2020%2F04%2Fthumbnail-6103a2591a3e2e6098e2466260daaed6.jpeg

Search URL Search Domain Scan URL

URL: https://plus.google.com/share?url=https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/

Search URL Search Domain Scan URL

URL: https://www.addtoany.com/share#url=https%3A%2F%2Fblog.lumen.com%2Fnew-mozi-malware-family-quietly-amasses-iot-bots%2F&title=New%20Mozi%20malware%20family%20quietly%20amasses%20IoT%20bots
Title: Share

Search URL Search Domain Scan URL

URL: https://www.exploit-db.com/exploits/40740
Title: Eir D1000 Wireless Router RCI

Search URL Search Domain Scan URL

URL: https://www.exploit-db.com/exploits/6864/
Title: Vacron NVR RCE

Search URL Search Domain Scan URL

URL: https://www.exploit-db.com/exploits/37169/
Title: CVE-2014-8361

Search URL Search Domain Scan URL

URL: https://www.exploit-db.com/exploits/41598/
Title: Netgear cig-bin Command Injection

Search URL Search Domain Scan URL

URL: https://www.exploit-db.com/exploits/43055
Title: Netgear setup.cgi unauthenticated RCE

Search URL Search Domain Scan URL

URL: https://www.exploit-db.com/exploits/41471/
Title: JAWS Webserver unauthenticated shell command execution

Search URL Search Domain Scan URL

URL: https://www.exploit-db.com/exploits/43414/
Title: CVE-2017-17215

Search URL Search Domain Scan URL

URL: https://www.exploit-db.com/exploits/37171/
Title: HNAP SoapAction-Header Command Execution

Search URL Search Domain Scan URL

URL: https://www.exploit-db.com/exploits/44576/
Title: CVE-2018-10561, CVE-2018-10562

Search URL Search Domain Scan URL

URL: https://www.exploit-db.com/exploits/28333/
Title: UPnP SOAP TelnetD Command Execution

Search URL Search Domain Scan URL

URL: https://www.exploit-db.com/exploits/39596/
Title: CCTV/DVR Remote Code Execution

Search URL Search Domain Scan URL

URL: https://blog.netlab.360.com/mozi-another-botnet-using-dht/
Title: https://blog.netlab.360.com/mozi-another-botnet-using-dht/

Search URL Search Domain Scan URL

URL: https://en.wikipedia.org/wiki/Distributed_hash_table
Title: https://en.wikipedia.org/wiki/Distributed_hash_table

Search URL Search Domain Scan URL

URL: https://securityaffairs.co/wordpress/95608/malware/mozi-p2p-botnet.html
Title: https://securityaffairs.co/wordpress/95608/malware/mozi-p2p-botnet.html

Search URL Search Domain Scan URL

URL: https://en.wikipedia.org/wiki/Bencode
Title: https://en.wikipedia.org/wiki/Bencode

Search URL Search Domain Scan URL

URL: https://www.facebook.com/lumentechnologies

Search URL Search Domain Scan URL

URL: http://twitter.com/lumentechco

Search URL Search Domain Scan URL

URL: https://www.youtube.com/lumentechnologies

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/lumentechnologies/about/

Search URL Search Domain Scan URL

URL: http://instagram.com/lumentechnologies

Search URL Search Domain Scan URL

URL: https://www.addtoany.com/
Title: AddToAny

Search URL Search Domain Scan URL

URL: https://www.lumen.com/en-us/about/legal/privacy-notice.html
Title: Privacy Notice

Search URL Search Domain Scan URL

URL: https://onetrust.com/poweredbyonetrust

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 72

https://dpm.demdex.net/id?d_visid_ver=5.2.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=AA683BC75245B3880A490D4D%40AdobeOrg&d_nsid=0&ts=1615921086540 HTTP 302
https://dpm.demdex.net/id/rd?d_visid_ver=5.2.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=AA683BC75245B3880A490D4D%40AdobeOrg&d_nsid=0&ts=1615921086540

Request Chain 90

https://googleads.g.doubleclick.net/pagead/id HTTP 302
https://googleads.g.doubleclick.net/pagead/id?slf_rd=1

Request Chain 107

https://cm.everesttech.net/cm/dd?d_uuid=77034679176884585461637500979132304431 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=YFD-vwAAAJEG_w_u

Request Chain 117

https://9129572.fls.doubleclick.net/activityi;src=9129572;type=audie0;cat=tdnae00;ord=9451237117431;gtm=2od330;auiddc=2099659997.1615921087;u1=https%3A%2F%2Fblog.lumen.com%2Fnew-mozi-malware-family-quietly-amasses-iot-bots%2F;u3=ctl%7Cblog%7Cnew-mozi-malware-family-quietly-amasses-iot-bots;u4=70116968814373863882098440057776203657;u6=;~oref=https%3A%2F%2Fblog.lumen.com%2Fnew-mozi-malware-family-quietly-amasses-iot-bots%2F HTTP 302
https://9129572.fls.doubleclick.net/activityi;dc_pre=CPzQkpO_te8CFWqgUQodIVwGxQ;src=9129572;type=audie0;cat=tdnae00;ord=9451237117431;gtm=2od330;auiddc=2099659997.1615921087;u1=https%3A%2F%2Fblog.lumen.com%2Fnew-mozi-malware-family-quietly-amasses-iot-bots%2F;u3=ctl%7Cblog%7Cnew-mozi-malware-family-quietly-amasses-iot-bots;u4=70116968814373863882098440057776203657;u6=;~oref=https%3A%2F%2Fblog.lumen.com%2Fnew-mozi-malware-family-quietly-amasses-iot-bots%2F

Request Chain 118

https://9129572.fls.doubleclick.net/activityi;src=9129572;type=audie0;cat=tdnae002;ord=1;num=4868752723814;gtm=2od330;auiddc=2099659997.1615921087;u1=https%3A%2F%2Fblog.lumen.com%2Fnew-mozi-malware-family-quietly-amasses-iot-bots%2F;u3=ctl%7Cblog%7Cnew-mozi-malware-family-quietly-amasses-iot-bots;u4=70116968814373863882098440057776203657;u6=;~oref=https%3A%2F%2Fblog.lumen.com%2Fnew-mozi-malware-family-quietly-amasses-iot-bots%2F HTTP 302
https://9129572.fls.doubleclick.net/activityi;dc_pre=CMrRkpO_te8CFQyr1Qodd5sJoA;src=9129572;type=audie0;cat=tdnae002;ord=1;num=4868752723814;gtm=2od330;auiddc=2099659997.1615921087;u1=https%3A%2F%2Fblog.lumen.com%2Fnew-mozi-malware-family-quietly-amasses-iot-bots%2F;u3=ctl%7Cblog%7Cnew-mozi-malware-family-quietly-amasses-iot-bots;u4=70116968814373863882098440057776203657;u6=;~oref=https%3A%2F%2Fblog.lumen.com%2Fnew-mozi-malware-family-quietly-amasses-iot-bots%2F

Request Chain 120

https://px.ads.linkedin.com/collect/?pid=7664&conversionId=3093564&fmt=gif HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fpid%3D7664%26conversionId%3D3093564%26fmt%3Dgif%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?pid=7664&conversionId=3093564&fmt=gif&liSync=true

147 HTTP transactions
3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request Cookie set / Show response
blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/ 91 KB
23 KB 778ms
393ms Document
text/html 50.112.230.199
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

50.112.230.199 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-50-112-230-199.us-west-2.compute.amazonaws.com

Software

Apache / PHP/7.3.18

Resource Hash

ec780ced174689407a04e1b0fbe0838fe37153421971ecaa81d18f4b1a969934

Security Headers

Name	Value
X-Frame-Options	https://discover.lumen.com

Request headers

Host: blog.lumen.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 16 Mar 2021 18:58:04 GMT
Server: Apache
X-Powered-By: PHP/7.3.18
Link: <https://blog.lumen.com/wp-json/>; rel="https://api.w.org/", <https://blog.lumen.com/wp-json/wp/v2/posts/10647>; rel="alternate"; type="application/json", <https://blog.lumen.com/?p=10647>; rel=shortlink
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate max-age=0, no-cache
Pragma: no-cache
Set-Cookie: PHPSESSID=rp6nvogbhmkiep4oqgatpfmhcv; path=/
X-Frame-Options: https://discover.lumen.com
X-Mod-Pagespeed: 1.13.35.2-0
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 22683
Keep-Alive: timeout=2, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK widget.css
blog.lumen.com/wp-content/plugins/yet-another-related-posts-plugin/style/ 623 B
692 B 362ms
192ms Stylesheet
text/css 50.112.230.199
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.lumen.com/wp-content/plugins/yet-another-related-posts-plugin/style/widget.css

Requested by

Host: blog.lumen.com
URL: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

50.112.230.199 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-50-112-230-199.us-west-2.compute.amazonaws.com

Software

Apache /

Resource Hash

bc73d188090ccf54462917db72c1cc11fc803e1ef26b1ef397d542690bed3fdf

Security Headers

Name	Value
X-Frame-Options	https://discover.lumen.com

Request headers

Referer: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 16 Mar 2021 18:58:05 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Mon, 31 Aug 2020 23:00:11 GMT
Server: Apache
ETag: "26f-5ae345d5a3d4b-gzip"
X-Frame-Options: https://discover.lumen.com
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=99
Content-Length: 328

GET
H/1.1 200
OK style.min.css
blog.lumen.com/wp-includes/css/dist/block-library/ 53 KB
8 KB 557ms
194ms Stylesheet
text/css 50.112.230.199
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.lumen.com/wp-includes/css/dist/block-library/style.min.css

Requested by

Host: blog.lumen.com
URL: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

50.112.230.199 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-50-112-230-199.us-west-2.compute.amazonaws.com

Software

Apache /

Resource Hash

8c626f0f9b5c109539b256b73e72c02b300a184f46b4535c2eb86599215c78af

Security Headers

Name	Value
X-Frame-Options	https://discover.lumen.com

Request headers

Referer: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 16 Mar 2021 18:58:05 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Wed, 02 Sep 2020 15:08:06 GMT
Server: Apache
ETag: "d293-5ae5600ba78c4-gzip"
X-Frame-Options: https://discover.lumen.com
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=98
Content-Length: 7907

GET
H/1.1 200
OK uaf.css
blog.lumen.com/wp-content/uploads/useanyfont/ 510 B
638 B 565ms
189ms Stylesheet
text/css 50.112.230.199
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.lumen.com/wp-content/uploads/useanyfont/uaf.css

Requested by

Host: blog.lumen.com
URL: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

50.112.230.199 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-50-112-230-199.us-west-2.compute.amazonaws.com

Software

Apache /

Resource Hash

50f82bda03703f719cff748e32ecd69e4724092fe2ae76a522e4270ff133d6ce

Security Headers

Name	Value
X-Frame-Options	https://discover.lumen.com

Request headers

Referer: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 16 Mar 2021 18:58:05 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Mon, 31 Aug 2020 23:00:01 GMT
Server: Apache
ETag: "1fe-5ae345cc0002e-gzip"
X-Frame-Options: https://discover.lumen.com
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=100
Content-Length: 273

GET
H/1.1 200
OK reset.css
blog.lumen.com/wp-content/themes/grandnews/css/ 547 B
690 B 566ms
189ms Stylesheet
text/css 50.112.230.199
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.lumen.com/wp-content/themes/grandnews/css/reset.css

Requested by

Host: blog.lumen.com
URL: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

50.112.230.199 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-50-112-230-199.us-west-2.compute.amazonaws.com

Software

Apache /

Resource Hash

f0c7be55f463c02bbd134c6e2afd2e4137a16468073856266042151fb8057609

Security Headers

Name	Value
X-Frame-Options	https://discover.lumen.com

Request headers

Referer: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 16 Mar 2021 18:58:05 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Wed, 02 Sep 2020 15:14:22 GMT
Server: Apache
ETag: "223-5ae561721cec4-gzip"
X-Frame-Options: https://discover.lumen.com
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=100
Content-Length: 325

GET
H/1.1 200
OK wordpress.css
blog.lumen.com/wp-content/themes/grandnews/css/ 3 KB
1 KB 567ms
189ms Stylesheet
text/css 50.112.230.199
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.lumen.com/wp-content/themes/grandnews/css/wordpress.css

Requested by

Host: blog.lumen.com
URL: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

50.112.230.199 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-50-112-230-199.us-west-2.compute.amazonaws.com

Software

Apache /

Resource Hash

27bd3b47f7d1b9adb2575bbf0e960d25fdb28b2e1610d335bf42c62177a32a28

Security Headers

Name	Value
X-Frame-Options	https://discover.lumen.com

Request headers

Referer: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 16 Mar 2021 18:58:05 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Wed, 02 Sep 2020 15:14:22 GMT
Server: Apache
ETag: "bfd-5ae561721cec4-gzip"
X-Frame-Options: https://discover.lumen.com
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=100
Content-Length: 1018

GET
H/1.1 200
OK animation.css
blog.lumen.com/wp-content/themes/grandnews/css/ 7 KB
1 KB 575ms
192ms Stylesheet
text/css 50.112.230.199
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.lumen.com/wp-content/themes/grandnews/css/animation.css

Requested by

Host: blog.lumen.com
URL: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

50.112.230.199 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-50-112-230-199.us-west-2.compute.amazonaws.com

Software

Apache /

Resource Hash

0edd6b41260434bd366c0aa048e8f33fdf659603f62f1a997ca64c03b3f004be

Security Headers

Name	Value
X-Frame-Options	https://discover.lumen.com

Request headers

Referer: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 16 Mar 2021 18:58:05 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Wed, 02 Sep 2020 15:14:22 GMT
Server: Apache
ETag: "1d9b-5ae561721bf24-gzip"
X-Frame-Options: https://discover.lumen.com
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=100
Content-Length: 927

GET
H/1.1 200
OK ilightbox.css
blog.lumen.com/wp-content/themes/grandnews/css/ilightbox/ 7 KB
2 KB 577ms
193ms Stylesheet
text/css 50.112.230.199
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.lumen.com/wp-content/themes/grandnews/css/ilightbox/ilightbox.css

Requested by

Host: blog.lumen.com
URL: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

50.112.230.199 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-50-112-230-199.us-west-2.compute.amazonaws.com

Software

Apache /

Resource Hash

cbe20461a1710866e2834c9ce87f0f31d61ef09ba3db1d9eca72b957dfc066b9

Security Headers

Name	Value
X-Frame-Options	https://discover.lumen.com

Request headers

Referer: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 16 Mar 2021 18:58:05 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Wed, 02 Sep 2020 15:14:22 GMT
Server: Apache
ETag: "1dee-5ae561721af84-gzip"
X-Frame-Options: https://discover.lumen.com
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=100
Content-Length: 1520

GET
H/1.1 200
OK custom.css
blog.lumen.com/wp-content/themes/grandnews/css/jqueryui/ 19 KB
4 KB 753ms
193ms Stylesheet
text/css 50.112.230.199
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.lumen.com/wp-content/themes/grandnews/css/jqueryui/custom.css

Requested by

Host: blog.lumen.com
URL: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

50.112.230.199 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-50-112-230-199.us-west-2.compute.amazonaws.com

Software

Apache /

Resource Hash

80ccff5d5ffccfb54d9645d87ee2def16f0dbc4354edee193f87f7156088fdd7

Security Headers

Name	Value
X-Frame-Options	https://discover.lumen.com

Request headers

Referer: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 16 Mar 2021 18:58:05 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Wed, 02 Sep 2020 15:14:22 GMT
Server: Apache
ETag: "4d50-5ae561721de64-gzip"
X-Frame-Options: https://discover.lumen.com
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=97
Content-Length: 3747

GET
H/1.1 200
OK flexslider.css
blog.lumen.com/wp-content/themes/grandnews/js/flexslider/ 5 KB
2 KB 754ms
189ms Stylesheet
text/css 50.112.230.199
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.lumen.com/wp-content/themes/grandnews/js/flexslider/flexslider.css

Requested by

Host: blog.lumen.com
URL: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

50.112.230.199 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-50-112-230-199.us-west-2.compute.amazonaws.com

Software

Apache /

Resource Hash

85b3833b74166fdd5117d2932dfd70194654224487768a33450ac6fae2eaabf2

Security Headers

Name	Value
X-Frame-Options	https://discover.lumen.com

Request headers

Referer: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 16 Mar 2021 18:58:05 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Wed, 02 Sep 2020 15:14:22 GMT
Server: Apache
ETag: "13bc-5ae561722a985-gzip"
X-Frame-Options: https://discover.lumen.com
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=99
Content-Length: 1621

GET
H/1.1 200
OK tooltipster.css
blog.lumen.com/wp-content/themes/grandnews/css/ 9 KB
2 KB 755ms
189ms Stylesheet
text/css 50.112.230.199
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.lumen.com/wp-content/themes/grandnews/css/tooltipster.css

Requested by

Host: blog.lumen.com
URL: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

50.112.230.199 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-50-112-230-199.us-west-2.compute.amazonaws.com

Software

Apache /

Resource Hash

0c75d452f31db2e3597de899da1030a5482b121f6bbad925606c6acc7e4f6190

Security Headers

Name	Value
X-Frame-Options	https://discover.lumen.com

Request headers

Referer: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 16 Mar 2021 18:58:05 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Wed, 02 Sep 2020 15:14:22 GMT
Server: Apache
ETag: "2300-5ae561721de64-gzip"
X-Frame-Options: https://discover.lumen.com
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=99
Content-Length: 1647

GET
H/1.1 200
OK screen.css
blog.lumen.com/wp-content/themes/grandnews/css/ 150 KB
23 KB 771ms
204ms Stylesheet
text/css 50.112.230.199
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.lumen.com/wp-content/themes/grandnews/css/screen.css

Requested by

Host: blog.lumen.com
URL: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

50.112.230.199 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-50-112-230-199.us-west-2.compute.amazonaws.com

Software

Apache /

Resource Hash

9f2ae0cd6aba41f079d3ee56c0518081cafd8704bf8f6336df2553c48ea0f52b

Security Headers

Name	Value
X-Frame-Options	https://discover.lumen.com

Request headers

Referer: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 16 Mar 2021 18:58:05 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Wed, 02 Sep 2020 15:14:22 GMT
Server: Apache
ETag: "25859-5ae561721bf24-gzip"
X-Frame-Options: https://discover.lumen.com
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=99
Content-Length: 23387

GET
H/1.1 200
OK left-align.css
blog.lumen.com/wp-content/themes/grandnews/css/menu/ 1 KB
817 B 766ms
192ms Stylesheet
text/css 50.112.230.199
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.lumen.com/wp-content/themes/grandnews/css/menu/left-align.css

Requested by

Host: blog.lumen.com
URL: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

50.112.230.199 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-50-112-230-199.us-west-2.compute.amazonaws.com

Software

Apache /

Resource Hash

b52cc4be6a05df6efda2ceb5ecdf84f34f97a70ebc8c65751cb4b3bf97030ea2

Security Headers

Name	Value
X-Frame-Options	https://discover.lumen.com

Request headers

Referer: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 16 Mar 2021 18:58:05 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Wed, 02 Sep 2020 15:14:22 GMT
Server: Apache
ETag: "481-5ae561721bf24-gzip"
X-Frame-Options: https://discover.lumen.com
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=99
Content-Length: 453

GET
H/1.1 200
OK font-awesome.min.css
blog.lumen.com/wp-content/themes/grandnews/css/ 28 KB
7 KB 771ms
194ms Stylesheet
text/css 50.112.230.199
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.lumen.com/wp-content/themes/grandnews/css/font-awesome.min.css

Requested by

Host: blog.lumen.com
URL: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

50.112.230.199 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-50-112-230-199.us-west-2.compute.amazonaws.com

Software

Apache /

Resource Hash

008a1d103902f15fdb1c191fcb1ce8954330e7b8de43d09abb08555ba609f420

Security Headers

Name	Value
X-Frame-Options	https://discover.lumen.com

Request headers

Referer: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 16 Mar 2021 18:58:05 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Wed, 02 Sep 2020 15:14:22 GMT
Server: Apache
ETag: "7187-5ae561721bf24-gzip"
X-Frame-Options: https://discover.lumen.com
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=99
Content-Length: 6666

GET
H/1.1 200
OK wp-review.css
blog.lumen.com/wp-content/plugins/wp-review/public/css/ 30 KB
5 KB 947ms
193ms Stylesheet
text/css 50.112.230.199
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.lumen.com/wp-content/plugins/wp-review/public/css/wp-review.css

Requested by

Host: blog.lumen.com
URL: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

50.112.230.199 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-50-112-230-199.us-west-2.compute.amazonaws.com

Software

Apache /

Resource Hash

dbfb69d1031a947b7794a20d38f0d34f17608d4e7f74026f6920c916dd45101d

Security Headers

Name	Value
X-Frame-Options	https://discover.lumen.com

Request headers

Referer: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 16 Mar 2021 18:58:05 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Wed, 15 Apr 2020 22:09:05 GMT
Server: Apache
ETag: "7808-5a35b907cc240-gzip"
X-Frame-Options: https://discover.lumen.com
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=96
Content-Length: 5262

GET
H/1.1 200
OK addtoany.min.css
blog.lumen.com/wp-content/plugins/add-to-any/ 1 KB
826 B 942ms
189ms Stylesheet
text/css 50.112.230.199
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.lumen.com/wp-content/plugins/add-to-any/addtoany.min.css

Requested by

Host: blog.lumen.com
URL: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

50.112.230.199 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-50-112-230-199.us-west-2.compute.amazonaws.com

Software

Apache /

Resource Hash

20a84f304abfaf56bb829a84199344bca40bf7d4dba451e109a840cbdf728436

Security Headers

Name	Value
X-Frame-Options	https://discover.lumen.com

Request headers

Referer: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 16 Mar 2021 18:58:05 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Mon, 31 Aug 2020 22:53:35 GMT
Server: Apache
ETag: "5ba-5ae3445c2e181-gzip"
X-Frame-Options: https://discover.lumen.com
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=98
Content-Length: 462

GET
H2 200 css
fonts.googleapis.com/ 51 KB
2 KB 19ms
17ms Stylesheet
text/css 2a00:1450:4001:829::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A800%2C700%2C700%2C800%2C400%2C900%2C700%2C100%2C100italic%2C300%2C300italic%2Cregular%2Citalic%2C500%2C500italic%2C700%2C700italic%2C900%2C900italic%7CRaleway%3A700%2C700%2C800%2C400%2C900%2C700%2C100%2C100italic%2C200%2C200italic%2C300%2C300italic%2Cregular%2Citalic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic&subset

Requested by

Host: blog.lumen.com
URL: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

a3e72097d14d7b806d713203903cad54361712292ba3e851ae30e3f06107f5bb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://blog.lumen.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 16 Mar 2021 18:58:04 GMT
server: ESF
date: Tue, 16 Mar 2021 18:58:04 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 16 Mar 2021 18:58:04 GMT

GET
H/1.1 200
OK kirki-styles.css
blog.lumen.com/wp-content/themes/grandnews/modules/kirki/assets/css/ 0
308 B 943ms
188ms Stylesheet
text/css 50.112.230.199
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.lumen.com/wp-content/themes/grandnews/modules/kirki/assets/css/kirki-styles.css

Requested by

Host: blog.lumen.com
URL: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

50.112.230.199 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-50-112-230-199.us-west-2.compute.amazonaws.com

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Frame-Options	https://discover.lumen.com

Request headers

Referer: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 16 Mar 2021 18:58:05 GMT
Last-Modified: Wed, 02 Sep 2020 15:14:22 GMT
Server: Apache
ETag: "0-5ae561721fda4"
X-Frame-Options: https://discover.lumen.com
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=98
Content-Length: 0

GET
H/1.1 200
OK grid.css
blog.lumen.com/wp-content/themes/grandnews/css/ 45 KB
7 KB 961ms
195ms Stylesheet
text/css 50.112.230.199
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.lumen.com/wp-content/themes/grandnews/css/grid.css

Requested by

Host: blog.lumen.com
URL: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

50.112.230.199 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-50-112-230-199.us-west-2.compute.amazonaws.com

Software

Apache /

Resource Hash

69f06f02087358cfdf71ea8c1db996682a2b35ff4cadc602c00c3f4d20071fd9

Security Headers

Name	Value
X-Frame-Options	https://discover.lumen.com

Request headers

Referer: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 16 Mar 2021 18:58:05 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Wed, 02 Sep 2020 15:14:22 GMT
Server: Apache
ETag: "b5d6-5ae561721cec4-gzip"
X-Frame-Options: https://discover.lumen.com
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=98
Content-Length: 7003

GET
H/1.1 200
OK left-align-grid.css
blog.lumen.com/wp-content/themes/grandnews/css/menu/ 1 KB
749 B 965ms
192ms Stylesheet
text/css 50.112.230.199
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.lumen.com/wp-content/themes/grandnews/css/menu/left-align-grid.css

Requested by

Host: blog.lumen.com
URL: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

50.112.230.199 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-50-112-230-199.us-west-2.compute.amazonaws.com

Software

Apache /

Resource Hash

5012972953bac6293f8af3138102e6870b5aa9e04a8385c00f629063222639c4

Security Headers

Name	Value
X-Frame-Options	https://discover.lumen.com

Request headers

Referer: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 16 Mar 2021 18:58:05 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Wed, 02 Sep 2020 15:14:22 GMT
Server: Apache
ETag: "59f-5ae561721bf24-gzip"
X-Frame-Options: https://discover.lumen.com
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=98
Content-Length: 385

GET
H/1.1 200
OK admin-ajax.php
blog.lumen.com/wp-admin/ 1 KB
1 KB 1268ms
325ms Stylesheet
text/css 50.112.230.199
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.lumen.com/wp-admin/admin-ajax.php?action=grandnews_custom_css

Requested by

Host: blog.lumen.com
URL: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

50.112.230.199 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-50-112-230-199.us-west-2.compute.amazonaws.com

Software

Apache / PHP/7.3.18

Resource Hash

36f49c3349b36ba14678127a8cd6c90108b403a591824c0266d5cc1da2a8f10a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 16 Mar 2021 18:58:05 GMT
Content-Encoding: gzip
Referrer-Policy: strict-origin-when-cross-origin
Server: Apache
X-Powered-By: PHP/7.3.18
X-Frame-Options: SAMEORIGIN
Content-Type: text/css;charset=UTF-8
Cache-Control: no-cache, must-revalidate, max-age=0
Connection: Keep-Alive
X-Robots-Tag: noindex
Vary: Accept-Encoding
Content-Length: 588
X-Content-Type-Options: nosniff
Keep-Alive: timeout=2, max=97
Expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H/1.1 200
OK frontend.min.js Show response
blog.lumen.com/wp-content/plugins/google-analytics-for-wordpress/assets/js/ 9 KB
3 KB 1341ms
200ms Script
application/javascript 50.112.230.199
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.lumen.com/wp-content/plugins/google-analytics-for-wordpress/assets/js/frontend.min.js

Requested by

Host: blog.lumen.com
URL: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

50.112.230.199 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-50-112-230-199.us-west-2.compute.amazonaws.com

Software

Apache /

Resource Hash

63a6d926d277a3d64d30e349fa0ea2b0630e9801d173e1947ff3bd6060147ef4

Security Headers

Name	Value
X-Frame-Options	https://discover.lumen.com

Request headers

Referer: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 16 Mar 2021 18:58:06 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Mon, 31 Aug 2020 22:59:35 GMT
Server: Apache
ETag: "2452-5ae345b3e2116-gzip"
X-Frame-Options: https://discover.lumen.com
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=94
Content-Length: 2766

GET
H/1.1 200
OK jquery.js Show response
blog.lumen.com/wp-includes/js/jquery/ 95 KB
33 KB 1373ms
218ms Script
application/javascript 50.112.230.199
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.lumen.com/wp-includes/js/jquery/jquery.js

Requested by

Host: blog.lumen.com
URL: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

50.112.230.199 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-50-112-230-199.us-west-2.compute.amazonaws.com

Software

Apache /

Resource Hash

1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df

Security Headers

Name	Value
X-Frame-Options	https://discover.lumen.com

Request headers

Referer: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 16 Mar 2021 18:58:06 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Fri, 17 May 2019 04:25:54 GMT
Server: Apache
ETag: "17a69-5890dc7401880-gzip"
X-Frame-Options: https://discover.lumen.com
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=96
Content-Length: 33776

GET
H/1.1 200
OK addtoany.min.js Show response
blog.lumen.com/wp-content/plugins/add-to-any/ 129 B
503 B 1351ms
193ms Script
application/javascript 50.112.230.199
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.lumen.com/wp-content/plugins/add-to-any/addtoany.min.js

Requested by

Host: blog.lumen.com
URL: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

50.112.230.199 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-50-112-230-199.us-west-2.compute.amazonaws.com

Software

Apache /

Resource Hash

50679e0e3933c945348a2db0cc128bb14b57a60a74fabf8cae13acc14efbb2e1

Security Headers

Name	Value
X-Frame-Options	https://discover.lumen.com

Request headers

Referer: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 16 Mar 2021 18:58:06 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Mon, 31 Aug 2020 22:53:35 GMT
Server: Apache
ETag: "81-5ae3445c2a301-gzip"
X-Frame-Options: https://discover.lumen.com
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=96
Content-Length: 126

GET
H2 200 otSDKStub.js Show response
cdn.cookielaw.org/scripttemplates/ 16 KB
6 KB 13ms
12ms Script
application/javascript 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Requested by

Host: blog.lumen.com
URL: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d98430b79bd481c608eb50058778fc3a919b996494f209c1546d11280d7bc14f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.lumen.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 16 Mar 2021 18:58:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: 8g79L9PKY/vudZazgfW0YA==
age: 1238
vary: Accept-Encoding
content-length: 5578
cf-request-id: 08de0011620000beb51a1ff000000001
x-ms-lease-status: unlocked
last-modified: Tue, 16 Mar 2021 01:59:40 GMT
server: cloudflare
etag: 0x8D8E81F2906DDF6
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: f058fc1d-901e-0118-7e0d-1ab326000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 631035fbc8bbbeb5-FRA

GET
H2 200 launch-22e49494a283.min.js Show response
assets.adobedtm.com/c58e7dfcc1ae/65c3c535dbf4/ 433 KB
114 KB 30ms
9ms Script
application/x-javascript 2a02:26f0:10c:4a5::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/c58e7dfcc1ae/65c3c535dbf4/launch-22e49494a283.min.js
Requested by: Host: blog.lumen.com
URL: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10c:4a5::1e80 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: b581ad07a822854930eeba93f78b22faf87c7647ddf1ca2ce265d731b82d888d

Request headers

Referer: https://blog.lumen.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 16 Mar 2021 18:58:06 GMT
content-encoding: gzip
last-modified: Tue, 16 Mar 2021 14:45:24 GMT
server: AkamaiNetStorage
etag: "93141df57b5776be909c9a21b8581cb1:1615905924.003112"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://blog.lumen.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 116065
expires: Tue, 16 Mar 2021 19:58:06 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 46 KB
19 KB 7ms
5ms Script
text/javascript 2a00:1450:4001:800::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: blog.lumen.com
URL: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

0f3be44690ae9914ae3e47b7752e1bdea316f09938e9094f99e0de19ccd8987a

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.lumen.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 05 Feb 2021 21:33:27 GMT
server: Golfe2
age: 3331
date: Tue, 16 Mar 2021 18:02:35 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18980
expires: Tue, 16 Mar 2021 20:02:35 GMT

GET
H/1.1 200
OK wp-emoji-release.min.js Show response
blog.lumen.com/wp-includes/js/ 14 KB
5 KB 189ms
189ms Script
application/javascript 50.112.230.199
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.lumen.com/wp-includes/js/wp-emoji-release.min.js

Requested by

Host: blog.lumen.com
URL: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

50.112.230.199 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-50-112-230-199.us-west-2.compute.amazonaws.com

Software

Apache /

Resource Hash

537b0c4d86ce61f6e50bbd36d8c206260b6914ab8f5dea27bad195d33b71ebc1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	https://discover.lumen.com

Request headers

Referer: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 16 Mar 2021 18:58:07 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Original-Content-Length: 14246
Server: Apache
Etag: W/"PSA-aj-PfH4Vveu6j"
X-Frame-Options: https://discover.lumen.com
Content-Type: application/javascript
Cache-Control: max-age=127
Connection: Keep-Alive
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Length: 4563
Keep-Alive: timeout=2, max=93
Expires: Tue, 16 Mar 2021 19:00:15 GMT

GET
H/1.1 200
OK Lumen-Logo.png
blog.lumen.com/wp-content/uploads/2020/09/ 2 KB
2 KB 274ms
188ms Image
image/png 50.112.230.199
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.lumen.com/wp-content/uploads/2020/09/Lumen-Logo.png

Requested by

Host: blog.lumen.com
URL: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

50.112.230.199 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-50-112-230-199.us-west-2.compute.amazonaws.com

Software

Apache /

Resource Hash

96c76a7af27cb509867c24dc39e493bf5d3a3c7abcabc7c1ee56a3907a495cf2

Security Headers

Name	Value
X-Frame-Options	https://discover.lumen.com

Request headers

Referer: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 16 Mar 2021 18:58:06 GMT
Last-Modified: Mon, 14 Sep 2020 02:10:56 GMT
Server: Apache
ETag: "6df-5af3c8b7a7e38"
X-Frame-Options: https://discover.lumen.com
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=94
Content-Length: 1759

GET
H/1.1 200
OK BLL-Square-No-Border-65x65.png
blog.lumen.com/wp-content/uploads/2021/01/ 1005 B
1 KB 278ms
189ms Image
image/png 50.112.230.199
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.lumen.com/wp-content/uploads/2021/01/BLL-Square-No-Border-65x65.png

Requested by

Host: blog.lumen.com
URL: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

50.112.230.199 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-50-112-230-199.us-west-2.compute.amazonaws.com

Software

Apache /

Resource Hash

72e1f4b24380d6707ac1181f875e255dd37b71628602b59523f854b63b619429

Security Headers

Name	Value
X-Frame-Options	https://discover.lumen.com

Request headers

Referer: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 16 Mar 2021 18:58:06 GMT
Last-Modified: Mon, 25 Jan 2021 23:11:16 GMT
Server: Apache
ETag: "3ed-5b9c1a7b0db0a"
X-Frame-Options: https://discover.lumen.com
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=95
Content-Length: 1005

GET
H/1.1 200
OK thumbnail-6103a2591a3e2e6098e2466260daaed6-960x640.jpeg
blog.lumen.com/wp-content/uploads/2020/04/ 80 KB
81 KB 281ms
189ms Image
image/jpeg 50.112.230.199
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.lumen.com/wp-content/uploads/2020/04/thumbnail-6103a2591a3e2e6098e2466260daaed6-960x640.jpeg

Requested by

Host: blog.lumen.com
URL: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

50.112.230.199 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-50-112-230-199.us-west-2.compute.amazonaws.com

Software

Apache /

Resource Hash

76c12f9f4902c87beddf6c8fd4ca4a092f6ac696263cb7e9e44230c0ece27eae

Security Headers

Name	Value
X-Frame-Options	https://discover.lumen.com

Request headers

Referer: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 16 Mar 2021 18:58:06 GMT
Last-Modified: Thu, 09 Apr 2020 21:27:54 GMT
Server: Apache
ETag: "141e7-5a2e24a280a80"
X-Frame-Options: https://discover.lumen.com
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=95
Content-Length: 82407

GET
H/1.1 200
OK BLL-Square-No-Border-300x300.png
blog.lumen.com/wp-content/uploads/2021/01/ 7 KB
7 KB 192ms
192ms Image
image/png 50.112.230.199
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.lumen.com/wp-content/uploads/2021/01/BLL-Square-No-Border-300x300.png

Requested by

Host: blog.lumen.com
URL: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

50.112.230.199 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-50-112-230-199.us-west-2.compute.amazonaws.com

Software

Apache /

Resource Hash

5a87da688bb4ee5a5fc733416d7200546ca989356bee3bf24765bbb9eed111c1

Security Headers

Name	Value
X-Frame-Options	https://discover.lumen.com

Request headers

Referer: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 16 Mar 2021 18:58:07 GMT
Last-Modified: Mon, 25 Jan 2021 23:11:16 GMT
Server: Apache
ETag: "1aba-5b9c1a7aaef75"
X-Frame-Options: https://discover.lumen.com
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=90
Content-Length: 6842

GET
H/1.1 200
OK Nemertes-700x466.jpg
blog.lumen.com/wp-content/uploads/2021/03/ 39 KB
40 KB 195ms
195ms Image
image/jpeg 50.112.230.199
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.lumen.com/wp-content/uploads/2021/03/Nemertes-700x466.jpg

Requested by

Host: blog.lumen.com
URL: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

50.112.230.199 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-50-112-230-199.us-west-2.compute.amazonaws.com

Software

Apache /

Resource Hash

9b75673e1929973dc3d72cd1089dba19b1f7c659091c9201c244dd73624afacd

Security Headers

Name	Value
X-Frame-Options	https://discover.lumen.com

Request headers

Referer: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 16 Mar 2021 18:58:07 GMT
Last-Modified: Tue, 16 Mar 2021 17:20:54 GMT
Server: Apache
ETag: "9d42-5bdaa96b9f662"
X-Frame-Options: https://discover.lumen.com
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=92
Content-Length: 40258

GET
H/1.1 200
OK Ron-Pfaff-Blog-700x466.jpeg
blog.lumen.com/wp-content/uploads/2021/03/ 41 KB
41 KB 189ms
189ms Image
image/jpeg 50.112.230.199
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.lumen.com/wp-content/uploads/2021/03/Ron-Pfaff-Blog-700x466.jpeg

Requested by

Host: blog.lumen.com
URL: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

50.112.230.199 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-50-112-230-199.us-west-2.compute.amazonaws.com

Software

Apache /

Resource Hash

f56a7261891c1aac6141dc84cec4561ecc7db6d48514540ad26695ef673bbac2

Security Headers

Name	Value
X-Frame-Options	https://discover.lumen.com

Request headers

Referer: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 16 Mar 2021 18:58:07 GMT
Last-Modified: Fri, 12 Mar 2021 19:00:32 GMT
Server: Apache
ETag: "a2b9-5bd5b83ab928a"
X-Frame-Options: https://discover.lumen.com
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=94
Content-Length: 41657

GET
H/1.1 200
OK DDoS-WAF-700x466.jpg
blog.lumen.com/wp-content/uploads/2021/03/ 52 KB
53 KB 192ms
192ms Image
image/jpeg 50.112.230.199
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.lumen.com/wp-content/uploads/2021/03/DDoS-WAF-700x466.jpg

Requested by

Host: blog.lumen.com
URL: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

50.112.230.199 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-50-112-230-199.us-west-2.compute.amazonaws.com

Software

Apache /

Resource Hash

af7fc9737422788530fa18e1bc056ec26078ff72f2b1da78b04f8a5b21e89d07

Security Headers

Name	Value
X-Frame-Options	https://discover.lumen.com

Request headers

Referer: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 16 Mar 2021 18:58:07 GMT
Last-Modified: Mon, 01 Mar 2021 14:30:09 GMT
Server: Apache
ETag: "d195-5bc7a7474fc6a"
X-Frame-Options: https://discover.lumen.com
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=91
Content-Length: 53653

GET
H/1.1 200
OK WAF-700x466.jpg
blog.lumen.com/wp-content/uploads/2021/02/ 42 KB
42 KB 193ms
192ms Image
image/jpeg 50.112.230.199
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.lumen.com/wp-content/uploads/2021/02/WAF-700x466.jpg

Requested by

Host: blog.lumen.com
URL: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

50.112.230.199 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-50-112-230-199.us-west-2.compute.amazonaws.com

Software

Apache /

Resource Hash

f9c9cfec3a47c38750e96d40e8556429d91745a9a678de18fcb5cbfd10f02fe0

Security Headers

Name	Value
X-Frame-Options	https://discover.lumen.com

Request headers

Referer: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 16 Mar 2021 18:58:07 GMT
Last-Modified: Wed, 17 Feb 2021 21:07:28 GMT
Server: Apache
ETag: "a7db-5bb8e9b45fa72"
X-Frame-Options: https://discover.lumen.com
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=91
Content-Length: 42971

GET
H/1.1 200
OK Privacy-Day-700x466.jpg
blog.lumen.com/wp-content/uploads/2021/01/ 33 KB
33 KB 193ms
191ms Image
image/jpeg 50.112.230.199
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.lumen.com/wp-content/uploads/2021/01/Privacy-Day-700x466.jpg

Requested by

Host: blog.lumen.com
URL: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

50.112.230.199 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-50-112-230-199.us-west-2.compute.amazonaws.com

Software

Apache /

Resource Hash

d12e293148f372449f7667ae6b0dea6251ef13ee64c5cca9dc46886f97786734

Security Headers

Name	Value
X-Frame-Options	https://discover.lumen.com

Request headers

Referer: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 16 Mar 2021 18:58:07 GMT
Last-Modified: Thu, 21 Jan 2021 16:10:04 GMT
Server: Apache
ETag: "830a-5b96b4dfaffce"
X-Frame-Options: https://discover.lumen.com
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=92
Content-Length: 33546

GET
H/1.1 200
OK thumbnail-dc9c7730a239cc131f5875d0bbeb72c9-700x466.jpeg
blog.lumen.com/wp-content/uploads/2020/04/ 46 KB
46 KB 195ms
194ms Image
image/jpeg 50.112.230.199
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.lumen.com/wp-content/uploads/2020/04/thumbnail-dc9c7730a239cc131f5875d0bbeb72c9-700x466.jpeg

Requested by

Host: blog.lumen.com
URL: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

50.112.230.199 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-50-112-230-199.us-west-2.compute.amazonaws.com

Software

Apache /

Resource Hash

91a6dd643e76992bb7ef691f48a040b8621bf4c1cafad90f999d0f2b2d6010a8

Security Headers

Name	Value
X-Frame-Options	https://discover.lumen.com

Request headers

Referer: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 16 Mar 2021 18:58:07 GMT
Last-Modified: Thu, 16 Apr 2020 15:28:17 GMT
Server: Apache
ETag: "b6b1-5a36a14f4c640"
X-Frame-Options: https://discover.lumen.com
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=89
Content-Length: 46769

GET
H/1.1 200
OK related.css
blog.lumen.com/wp-content/plugins/yet-another-related-posts-plugin/style/ 647 B
686 B 194ms
193ms Stylesheet
text/css 50.112.230.199
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.lumen.com/wp-content/plugins/yet-another-related-posts-plugin/style/related.css

Requested by

Host: blog.lumen.com
URL: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

50.112.230.199 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-50-112-230-199.us-west-2.compute.amazonaws.com

Software

Apache /

Resource Hash

6ca28839ba7e005b11dcf8d6de4c24f13f2cc988393ed7a570c41ee88ab092fc

Security Headers

Name	Value
X-Frame-Options	https://discover.lumen.com

Request headers

Referer: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 16 Mar 2021 18:58:06 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Mon, 31 Aug 2020 23:00:11 GMT
Server: Apache
ETag: "287-5ae345d5a3d4b-gzip"
X-Frame-Options: https://discover.lumen.com
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=95
Content-Length: 322

GET
H/1.1 200
OK ilightbox.packed.js Show response
blog.lumen.com/wp-content/themes/grandnews/js/ 50 KB
23 KB 199ms
198ms Script
application/javascript 50.112.230.199
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.lumen.com/wp-content/themes/grandnews/js/ilightbox.packed.js

Requested by

Host: blog.lumen.com
URL: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

50.112.230.199 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-50-112-230-199.us-west-2.compute.amazonaws.com

Software

Apache /

Resource Hash

fd96d9b3f117bd211bf9c6450e287560b6bcc50871852a51b46271c6bb26c520

Security Headers

Name	Value
X-Frame-Options	https://discover.lumen.com

Request headers

Referer: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 16 Mar 2021 18:58:06 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Wed, 02 Sep 2020 15:14:22 GMT
Server: Apache
ETag: "c939-5ae561722a985-gzip"
X-Frame-Options: https://discover.lumen.com
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=95
Content-Length: 22699

GET
H/1.1 200
OK jquery.easing.js Show response
blog.lumen.com/wp-content/themes/grandnews/js/ 8 KB
2 KB 194ms
193ms Script
application/javascript 50.112.230.199
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.lumen.com/wp-content/themes/grandnews/js/jquery.easing.js

Requested by

Host: blog.lumen.com
URL: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

50.112.230.199 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-50-112-230-199.us-west-2.compute.amazonaws.com

Software

Apache /

Resource Hash

0757f7ff6e5f6a581922a5e2d42c5e0cf7475d880885a9802e8bdd5e4188dd34

Security Headers

Name	Value
X-Frame-Options	https://discover.lumen.com

Request headers

Referer: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 16 Mar 2021 18:58:06 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Wed, 02 Sep 2020 15:14:22 GMT
Server: Apache
ETag: "1fa1-5ae561722a985-gzip"
X-Frame-Options: https://discover.lumen.com
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=94
Content-Length: 1986

GET
H/1.1 200
OK jquery.sticky-kit.min.js Show response
blog.lumen.com/wp-content/themes/grandnews/js/ 3 KB
2 KB 198ms
194ms Script
application/javascript 50.112.230.199
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.lumen.com/wp-content/themes/grandnews/js/jquery.sticky-kit.min.js

Requested by

Host: blog.lumen.com
URL: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

50.112.230.199 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-50-112-230-199.us-west-2.compute.amazonaws.com

Software

Apache /

Resource Hash

8e8230f2d1e6e230d63f5bd3091ea092eb8d1f447b5f6c84c5b776cf4f50a65d

Security Headers

Name	Value
X-Frame-Options	https://discover.lumen.com

Request headers

Referer: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 16 Mar 2021 18:58:06 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Wed, 02 Sep 2020 15:14:22 GMT
Server: Apache
ETag: "aee-5ae561722a985-gzip"
X-Frame-Options: https://discover.lumen.com
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=93
Content-Length: 1295

GET
H/1.1 200
OK jquery.lazy.min.js Show response
blog.lumen.com/wp-content/themes/grandnews/js/ 4 KB
2 KB 192ms
189ms Script
application/javascript 50.112.230.199
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.lumen.com/wp-content/themes/grandnews/js/jquery.lazy.min.js

Requested by

Host: blog.lumen.com
URL: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

50.112.230.199 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-50-112-230-199.us-west-2.compute.amazonaws.com

Software

Apache /

Resource Hash

6829c1878e43fdd02c7244b48260f1ff88f6fcac41d1c301ba0ae1377e73a445

Security Headers

Name	Value
X-Frame-Options	https://discover.lumen.com

Request headers

Referer: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 16 Mar 2021 18:58:06 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Wed, 02 Sep 2020 15:14:22 GMT
Server: Apache
ETag: "f48-5ae561722a985-gzip"
X-Frame-Options: https://discover.lumen.com
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=95
Content-Length: 1765

GET
H/1.1 200
OK jquery.cookie.js Show response
blog.lumen.com/wp-content/themes/grandnews/js/ 3 KB
2 KB 195ms
191ms Script
application/javascript 50.112.230.199
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.lumen.com/wp-content/themes/grandnews/js/jquery.cookie.js

Requested by

Host: blog.lumen.com
URL: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

50.112.230.199 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-50-112-230-199.us-west-2.compute.amazonaws.com

Software

Apache /

Resource Hash

8c0301b3dba5061632d7321cd8bb7bd527f48288d5cb15ff614ea0c1dcc1ad69

Security Headers

Name	Value
X-Frame-Options	https://discover.lumen.com

Request headers

Referer: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 16 Mar 2021 18:58:06 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Wed, 02 Sep 2020 15:14:22 GMT
Server: Apache
ETag: "c44-5ae561722a985-gzip"
X-Frame-Options: https://discover.lumen.com
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=96
Content-Length: 1395

GET
H/1.1 200
OK jquery.tooltipster.min.js Show response
blog.lumen.com/wp-content/themes/grandnews/js/ 17 KB
5 KB 196ms
193ms Script
application/javascript 50.112.230.199
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.lumen.com/wp-content/themes/grandnews/js/jquery.tooltipster.min.js

Requested by

Host: blog.lumen.com
URL: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

50.112.230.199 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-50-112-230-199.us-west-2.compute.amazonaws.com

Software

Apache /

Resource Hash

da1ba35a2a2d6ce67672b81a8bd061e3eb6cfdb6d7369252c89b059150631787

Security Headers

Name	Value
X-Frame-Options	https://discover.lumen.com

Request headers

Referer: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 16 Mar 2021 18:58:06 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Wed, 02 Sep 2020 15:14:22 GMT
Server: Apache
ETag: "420c-5ae561722a985-gzip"
X-Frame-Options: https://discover.lumen.com
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=96
Content-Length: 4701

GET
H/1.1 200
OK custom_plugins.js Show response
blog.lumen.com/wp-content/themes/grandnews/js/ 7 KB
2 KB 193ms
193ms Script
application/javascript 50.112.230.199
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.lumen.com/wp-content/themes/grandnews/js/custom_plugins.js

Requested by

Host: blog.lumen.com
URL: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

50.112.230.199 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-50-112-230-199.us-west-2.compute.amazonaws.com

Software

Apache /

Resource Hash

a21b30b2a786682f0d591c7efecd653f038607546881ada1af46a9a25850e789

Security Headers

Name	Value
X-Frame-Options	https://discover.lumen.com

Request headers

Referer: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 16 Mar 2021 18:58:06 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Wed, 02 Sep 2020 15:14:22 GMT
Server: Apache
ETag: "1c36-5ae561722b925-gzip"
X-Frame-Options: https://discover.lumen.com
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=92
Content-Length: 1685

GET
H/1.1 200
OK custom.js Show response
blog.lumen.com/wp-content/themes/grandnews/js/ 13 KB
4 KB 190ms
189ms Script
application/javascript 50.112.230.199
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.lumen.com/wp-content/themes/grandnews/js/custom.js

Requested by

Host: blog.lumen.com
URL: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

50.112.230.199 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-50-112-230-199.us-west-2.compute.amazonaws.com

Software

Apache /

Resource Hash

e701b8c32867d0e3d7421103495316d2b3709ca3568a83bfad9ea816f12aaf6d

Security Headers

Name	Value
X-Frame-Options	https://discover.lumen.com

Request headers

Referer: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 16 Mar 2021 18:58:06 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Fri, 04 Sep 2020 20:49:55 GMT
Server: Apache
ETag: "3594-5ae8302d6fba1-gzip"
X-Frame-Options: https://discover.lumen.com
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=93
Content-Length: 3209

GET
H/1.1 200
OK js.cookie.min.js Show response
blog.lumen.com/wp-content/plugins/wp-review/public/js/ 2 KB
1 KB 192ms
192ms Script
application/javascript 50.112.230.199
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.lumen.com/wp-content/plugins/wp-review/public/js/js.cookie.min.js

Requested by

Host: blog.lumen.com
URL: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

50.112.230.199 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-50-112-230-199.us-west-2.compute.amazonaws.com

Software

Apache /

Resource Hash

d5b071fda01315f271998e251812dcf8465dcf34bb9e436bb502235700c40eac

Security Headers

Name	Value
X-Frame-Options	https://discover.lumen.com

Request headers

Referer: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 16 Mar 2021 18:58:06 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Wed, 15 Apr 2020 22:09:05 GMT
Server: Apache
ETag: "69f-5a35b907cc240-gzip"
X-Frame-Options: https://discover.lumen.com
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=93
Content-Length: 866

GET
H/1.1 200
OK underscore.min.js Show response
blog.lumen.com/wp-includes/js/ 16 KB
6 KB 192ms
192ms Script
application/javascript 50.112.230.199
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.lumen.com/wp-includes/js/underscore.min.js

Requested by

Host: blog.lumen.com
URL: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

50.112.230.199 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-50-112-230-199.us-west-2.compute.amazonaws.com

Software

Apache /

Resource Hash

7b5fc275c98a58b1073a713920cefa54fab60ad9d85a67cf6907aaf8fbb3c474

Security Headers

Name	Value
X-Frame-Options	https://discover.lumen.com

Request headers

Referer: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 16 Mar 2021 18:58:06 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Sat, 26 Oct 2019 00:17:07 GMT
Server: Apache
ETag: "3f1a-595c52fd2e6c0-gzip"
X-Frame-Options: https://discover.lumen.com
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=94
Content-Length: 5705

GET
H/1.1 200
OK wp-util.min.js Show response
blog.lumen.com/wp-includes/js/ 1 KB
969 B 192ms
192ms Script
application/javascript 50.112.230.199
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.lumen.com/wp-includes/js/wp-util.min.js

Requested by

Host: blog.lumen.com
URL: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

50.112.230.199 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-50-112-230-199.us-west-2.compute.amazonaws.com

Software

Apache /

Resource Hash

622bd29e595894b02f5c5ab95628f99d6e6d46483bac342b4fff38bbc64a8a35

Security Headers

Name	Value
X-Frame-Options	https://discover.lumen.com

Request headers

Referer: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 16 Mar 2021 18:58:06 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Sat, 26 Oct 2019 00:17:07 GMT
Server: Apache
ETag: "437-595c52fd2e6c0-gzip"
X-Frame-Options: https://discover.lumen.com
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=91
Content-Length: 591

GET
H/1.1 200
OK main.js Show response
blog.lumen.com/wp-content/plugins/wp-review/public/js/ 3 KB
1 KB 189ms
189ms Script
application/javascript 50.112.230.199
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.lumen.com/wp-content/plugins/wp-review/public/js/main.js

Requested by

Host: blog.lumen.com
URL: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

50.112.230.199 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-50-112-230-199.us-west-2.compute.amazonaws.com

Software

Apache /

Resource Hash

435bfd29d257cc1e948ef62f88e07a41ee836cfdbb6d775ee48ffca764636e64

Security Headers

Name	Value
X-Frame-Options	https://discover.lumen.com

Request headers

Referer: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 16 Mar 2021 18:58:07 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Wed, 15 Apr 2020 22:09:05 GMT
Server: Apache
ETag: "a26-5a35b907cc240-gzip"
X-Frame-Options: https://discover.lumen.com
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=92
Content-Length: 1014

GET
H/1.1 200
OK wp-embed.min.js Show response
blog.lumen.com/wp-includes/js/ 1 KB
1 KB 192ms
192ms Script
application/javascript 50.112.230.199
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.lumen.com/wp-includes/js/wp-embed.min.js

Requested by

Host: blog.lumen.com
URL: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

50.112.230.199 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-50-112-230-199.us-west-2.compute.amazonaws.com

Software

Apache /

Resource Hash

6ebcda7a3a41ef97f0b4071160ceb1020e540fdc0f790079a5c2ef01ab654fe0

Security Headers

Name	Value
X-Frame-Options	https://discover.lumen.com

Request headers

Referer: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 16 Mar 2021 18:58:07 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Sat, 26 Oct 2019 00:17:07 GMT
Server: Apache
ETag: "59a-595c52fd2e6c0-gzip"
X-Frame-Options: https://discover.lumen.com
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=92
Content-Length: 769

GET
H/1.1 200
OK skin.css
blog.lumen.com/wp-content/themes/grandnews/css/dark-skin/ 6 KB
2 KB 558ms
191ms Stylesheet
text/css 50.112.230.199
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.lumen.com/wp-content/themes/grandnews/css/dark-skin/skin.css

Requested by

Host: blog.lumen.com
URL: https://blog.lumen.com/wp-content/themes/grandnews/css/ilightbox/ilightbox.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

50.112.230.199 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-50-112-230-199.us-west-2.compute.amazonaws.com

Software

Apache /

Resource Hash

8a823c69222e7e596cb40af4b5145ad2de4e371b2af364fecf7aafe898bec3d9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	https://discover.lumen.com

Request headers

Referer: https://blog.lumen.com/wp-content/themes/grandnews/css/ilightbox/ilightbox.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 16 Mar 2021 18:58:05 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Original-Content-Length: 7289
Server: Apache
Etag: W/"PSA-aj-ygG7YJg8Rt"
X-Frame-Options: https://discover.lumen.com
Content-Type: text/css
Cache-Control: max-age=145
Connection: Keep-Alive
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Length: 1152
Keep-Alive: timeout=2, max=97
Expires: Tue, 16 Mar 2021 19:00:31 GMT

GET
H/1.1 200
OK skin.css
blog.lumen.com/wp-content/themes/grandnews/css/light-skin/ 6 KB
2 KB 557ms
190ms Stylesheet
text/css 50.112.230.199
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.lumen.com/wp-content/themes/grandnews/css/light-skin/skin.css

Requested by

Host: blog.lumen.com
URL: https://blog.lumen.com/wp-content/themes/grandnews/css/ilightbox/ilightbox.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

50.112.230.199 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-50-112-230-199.us-west-2.compute.amazonaws.com

Software

Apache /

Resource Hash

0939e46fe6e5cfa377f5256a4ab8b71443f972de88c9234f29c53f42a1bb1712

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	https://discover.lumen.com

Request headers

Referer: https://blog.lumen.com/wp-content/themes/grandnews/css/ilightbox/ilightbox.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 16 Mar 2021 18:58:05 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Original-Content-Length: 7451
Server: Apache
Etag: W/"PSA-aj-cA2OdAZylZ"
X-Frame-Options: https://discover.lumen.com
Content-Type: text/css
Cache-Control: max-age=145
Connection: Keep-Alive
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Length: 1158
Keep-Alive: timeout=2, max=98
Expires: Tue, 16 Mar 2021 19:00:31 GMT

GET
H/1.1 200
OK skin.css
blog.lumen.com/wp-content/themes/grandnews/css/parade-skin/ 2 KB
987 B 563ms
192ms Stylesheet
text/css 50.112.230.199
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.lumen.com/wp-content/themes/grandnews/css/parade-skin/skin.css

Requested by

Host: blog.lumen.com
URL: https://blog.lumen.com/wp-content/themes/grandnews/css/ilightbox/ilightbox.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

50.112.230.199 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-50-112-230-199.us-west-2.compute.amazonaws.com

Software

Apache /

Resource Hash

6e6007f22b1ae1aeaad3ad38b730c098b3e698aa2f62194586832f5c24977516

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	https://discover.lumen.com

Request headers

Referer: https://blog.lumen.com/wp-content/themes/grandnews/css/ilightbox/ilightbox.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 16 Mar 2021 18:58:05 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Original-Content-Length: 2269
Server: Apache
Etag: W/"PSA-aj-rX8iHnZyiw"
X-Frame-Options: https://discover.lumen.com
Content-Type: text/css
Cache-Control: max-age=145
Connection: Keep-Alive
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Length: 538
Keep-Alive: timeout=2, max=95
Expires: Tue, 16 Mar 2021 19:00:31 GMT

GET
H/1.1 200
OK skin.css
blog.lumen.com/wp-content/themes/grandnews/css/metro-black-skin/ 5 KB
1 KB 578ms
192ms Stylesheet
text/css 50.112.230.199
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.lumen.com/wp-content/themes/grandnews/css/metro-black-skin/skin.css

Requested by

Host: blog.lumen.com
URL: https://blog.lumen.com/wp-content/themes/grandnews/css/ilightbox/ilightbox.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

50.112.230.199 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-50-112-230-199.us-west-2.compute.amazonaws.com

Software

Apache /

Resource Hash

785691245376d470ef742734e34c4d5907a26242bb8f21dbc9a50cfeaa86be42

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	https://discover.lumen.com

Request headers

Referer: https://blog.lumen.com/wp-content/themes/grandnews/css/ilightbox/ilightbox.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 16 Mar 2021 18:58:05 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Original-Content-Length: 5919
Server: Apache
Etag: W/"PSA-aj-6GxWGPtd18"
X-Frame-Options: https://discover.lumen.com
Content-Type: text/css
Cache-Control: max-age=145
Connection: Keep-Alive
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Length: 1068
Keep-Alive: timeout=2, max=97
Expires: Tue, 16 Mar 2021 19:00:31 GMT

GET
H/1.1 200
OK skin.css
blog.lumen.com/wp-content/themes/grandnews/css/metro-white-skin/ 6 KB
2 KB 581ms
192ms Stylesheet
text/css 50.112.230.199
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.lumen.com/wp-content/themes/grandnews/css/metro-white-skin/skin.css

Requested by

Host: blog.lumen.com
URL: https://blog.lumen.com/wp-content/themes/grandnews/css/ilightbox/ilightbox.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

50.112.230.199 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-50-112-230-199.us-west-2.compute.amazonaws.com

Software

Apache /

Resource Hash

02e87da822ac986c75223804fa7b867343ac35df9c9c022cbbcbeda040e83569

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	https://discover.lumen.com

Request headers

Referer: https://blog.lumen.com/wp-content/themes/grandnews/css/ilightbox/ilightbox.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 16 Mar 2021 18:58:05 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Original-Content-Length: 7958
Server: Apache
Etag: W/"PSA-aj-hL97wnZXdq"
X-Frame-Options: https://discover.lumen.com
Content-Type: text/css
Cache-Control: max-age=145
Connection: Keep-Alive
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Length: 1194
Keep-Alive: timeout=2, max=97
Expires: Tue, 16 Mar 2021 19:00:31 GMT

GET
H/1.1 200
OK skin.css
blog.lumen.com/wp-content/themes/grandnews/css/mac-skin/ 9 KB
2 KB 750ms
193ms Stylesheet
text/css 50.112.230.199
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.lumen.com/wp-content/themes/grandnews/css/mac-skin/skin.css

Requested by

Host: blog.lumen.com
URL: https://blog.lumen.com/wp-content/themes/grandnews/css/ilightbox/ilightbox.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

50.112.230.199 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-50-112-230-199.us-west-2.compute.amazonaws.com

Software

Apache /

Resource Hash

e1a14e5eaf9894bf95b58aa8afa56fea3f01385e3acae98fe5229f9d706ec073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	https://discover.lumen.com

Request headers

Referer: https://blog.lumen.com/wp-content/themes/grandnews/css/ilightbox/ilightbox.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 16 Mar 2021 18:58:06 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Original-Content-Length: 11639
Server: Apache
Etag: W/"PSA-aj-g5GWw6mQ9U"
X-Frame-Options: https://discover.lumen.com
Content-Type: text/css
Cache-Control: max-age=144
Connection: Keep-Alive
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Length: 1443
Keep-Alive: timeout=2, max=97
Expires: Tue, 16 Mar 2021 19:00:31 GMT

GET
H/1.1 200
OK skin.css
blog.lumen.com/wp-content/themes/grandnews/css/smooth-skin/ 6 KB
2 KB 751ms
194ms Stylesheet
text/css 50.112.230.199
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.lumen.com/wp-content/themes/grandnews/css/smooth-skin/skin.css

Requested by

Host: blog.lumen.com
URL: https://blog.lumen.com/wp-content/themes/grandnews/css/ilightbox/ilightbox.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

50.112.230.199 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-50-112-230-199.us-west-2.compute.amazonaws.com

Software

Apache /

Resource Hash

26500e258c44472f70b852592d16dabd8260ea07db06d5da22a9a9e60ee8c414

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	https://discover.lumen.com

Request headers

Referer: https://blog.lumen.com/wp-content/themes/grandnews/css/ilightbox/ilightbox.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 16 Mar 2021 18:58:06 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Original-Content-Length: 7374
Server: Apache
Etag: W/"PSA-aj-l-MuF2Jz1E"
X-Frame-Options: https://discover.lumen.com
Content-Type: text/css
Cache-Control: max-age=144
Connection: Keep-Alive
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Length: 1248
Keep-Alive: timeout=2, max=96
Expires: Tue, 16 Mar 2021 19:00:31 GMT

GET
H2 200 page.js Show response
static.addtoany.com/menu/ 82 KB
27 KB 34ms
17ms Script
application/javascript 2606:4700:10::ac43:2794
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.addtoany.com/menu/page.js

Requested by

Host: blog.lumen.com
URL: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::ac43:2794 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bd3bd81ea6cf3bbc82f89913fecca492e79318fef844c664a790ff2db72e5590

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.lumen.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 16 Mar 2021 18:58:06 GMT
via: e2s
x-content-type-options: nosniff
cf-cache-status: HIT
age: 114768
p3p: CP="ALL DSP COR CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT"
content-encoding: br
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08de0017a50000176696bb2000000001
last-modified: Mon, 15 Mar 2021 11:04:59 GMT
server: cloudflare
etag: W/"146fb-5bd91388499a9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=172800
cf-ray: 63103605d9701766-FRA
cf-bgj: minify

GET
H2 200 e733a0d8-63ff-4a39-b870-9ef50b603bcf.json Show response
cdn.cookielaw.org/consent/e733a0d8-63ff-4a39-b870-9ef50b603bcf/ 3 KB
2 KB 15ms
15ms XHR
application/x-javascript 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/e733a0d8-63ff-4a39-b870-9ef50b603bcf/e733a0d8-63ff-4a39-b870-9ef50b603bcf.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

16f21dbcc45584c1196fdde65f7eb25ea05759ca9e05fbb0694cc3bee71604ab

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.lumen.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 16 Mar 2021 18:58:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: Z58kqv03tnM1FlPWZ8G05A==
age: 30
vary: Accept-Encoding
content-length: 1373
cf-request-id: 08de001791000005f5433a4000000001
x-ms-lease-status: unlocked
last-modified: Tue, 26 Jan 2021 16:26:08 GMT
server: cloudflare
etag: 0x8D8C2171637AF95
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 9f90a88d-a01e-0139-2d0f-f4de17000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 63103605ba9d05f5-FRA

GET
H/1.1 200
OK fontawesome-webfont.woff2
blog.lumen.com/wp-content/themes/grandnews/fonts/ 70 KB
71 KB 347ms
193ms Font
font/woff2 50.112.230.199
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.lumen.com/wp-content/themes/grandnews/fonts/fontawesome-webfont.woff2?v=4.6.3

Requested by

Host: blog.lumen.com
URL: https://blog.lumen.com/wp-content/themes/grandnews/css/font-awesome.min.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

50.112.230.199 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-50-112-230-199.us-west-2.compute.amazonaws.com

Software

Apache /

Resource Hash

7dacf83f51179de8d7980a513e67ab3a08f2c6272bb5946df8fd77c0d1763b73

Security Headers

Name	Value
X-Frame-Options	https://discover.lumen.com

Request headers

Origin: https://blog.lumen.com
Referer: https://blog.lumen.com/wp-content/themes/grandnews/css/font-awesome.min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 16 Mar 2021 18:58:06 GMT
Last-Modified: Wed, 02 Sep 2020 15:14:22 GMT
Server: Apache
ETag: "118d8-5ae561721ee04"
X-Frame-Options: https://discover.lumen.com
Content-Type: font/woff2
Cache-Control: s-maxage=10
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=93
Content-Length: 71896

GET
H/1.1 200
OK 190628074915MaisonNeue.woff
blog.lumen.com/wp-content/uploads/useanyfont/ 29 KB
30 KB 357ms
192ms Font
font/woff 50.112.230.199
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.lumen.com/wp-content/uploads/useanyfont/190628074915MaisonNeue.woff

Requested by

Host: blog.lumen.com
URL: https://blog.lumen.com/wp-content/uploads/useanyfont/uaf.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

50.112.230.199 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-50-112-230-199.us-west-2.compute.amazonaws.com

Software

Apache /

Resource Hash

7e29c072a03e9825f54a07dbecb8cbd7f1fc934fa4886692717e18b3d393f8ff

Security Headers

Name	Value
X-Frame-Options	https://discover.lumen.com

Request headers

Origin: https://blog.lumen.com
Referer: https://blog.lumen.com/wp-content/uploads/useanyfont/uaf.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 16 Mar 2021 18:58:06 GMT
Last-Modified: Fri, 28 Jun 2019 19:49:15 GMT
Server: Apache
ETag: "757c-58c6792be04c0"
X-Frame-Options: https://discover.lumen.com
Content-Type: font/woff
Cache-Control: s-maxage=10
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=94
Content-Length: 30076

GET
H2 200 tqiYhn2fQIY Show response
www.youtube.com/embed/ Frame 5372 50 KB
21 KB 49ms
47ms Document
text/html 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/embed/tqiYhn2fQIY?rel=0

Requested by

Host: blog.lumen.com
URL: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

214941d5a39aa06a611b8c92857ca06015355cc867b4fea16d46d0056cd4e760

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.youtube.com
:scheme: https
:path: /embed/tqiYhn2fQIY?rel=0
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://blog.lumen.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://blog.lumen.com/

Response headers

content-type: text/html; charset=utf-8
x-content-type-options: nosniff
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Tue, 16 Mar 2021 18:58:06 GMT
strict-transport-security: max-age=31536000
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."
content-encoding: br
server: ESF
x-xss-protection: 0
set-cookie: YSC=4V4CU-N5ZV0; Domain=.youtube.com; Path=/; Secure; HttpOnly; SameSite=none VISITOR_INFO1_LIVE=GlXbV8OeS9k; Domain=.youtube.com; Expires=Sun, 12-Sep-2021 18:58:06 GMT; Path=/; Secure; HttpOnly; SameSite=none CONSENT=PENDING+077; expires=Fri, 01-Jan-2038 00:00:00 GMT; path=/; domain=.youtube.com
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 location Show response
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 164 B
363 B 26ms
25ms Script
text/javascript 2606:4700:10::6814:b844
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6814:b844 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1b94f9074fc2ef1b63132fc70fe244cc5d5322e5982a80b6273a45a935ae335f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://blog.lumen.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 16 Mar 2021 18:58:06 GMT
content-encoding: gzip
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 63103605ed271f55-FRA
cf-request-id: 08de0017b400001f553c9b7000000001

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v20/ 15 KB
16 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A800%2C700%2C700%2C800%2C400%2C900%2C700%2C100%2C100italic%2C300%2C300italic%2Cregular%2Citalic%2C500%2C500italic%2C700%2C700italic%2C900%2C900italic%7CRaleway%3A700%2C700%2C800%2C400%2C900%2C700%2C100%2C100italic%2C200%2C200italic%2C300%2C300italic%2Cregular%2Citalic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic&subset

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b4d07892cde715d50bb69c1982df496385d1dfd8f9d1867c31f19a3c8634cfae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://blog.lumen.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 10 Mar 2021 19:52:31 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:19:00 GMT
server: sffe
age: 515135
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15816
x-xss-protection: 0
expires: Thu, 10 Mar 2022 19:52:31 GMT

GET
H2 200 Zz1kMDUyM2UzM2Y5YzU4NzE1NmQwNGE1ZGY4M2YyMzUyNw==
images-cdn.newscred.com/ 13 KB
13 KB 53ms
14ms Image
image/png 2600:9000:211e:9800:f:fcff:7940:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images-cdn.newscred.com/Zz1kMDUyM2UzM2Y5YzU4NzE1NmQwNGE1ZGY4M2YyMzUyNw==
Requested by: Host: blog.lumen.com
URL: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:211e:9800:f:fcff:7940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: ad0d07fb08891d54edd452e54b864a671d6427547cadbb85cc95cadc9b9edd3b

Request headers

Referer: https://blog.lumen.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 05 Mar 2021 05:04:34 GMT
via: 1.1 93b0598b43d63761f1a129690721f888.cloudfront.net (CloudFront)
age: 1000412
x-amz-server-side-encryption: AES256
x-cache-status: EXPIRED
x-cache: Hit from cloudfront
content-length: 12979
last-modified: Thu, 09 Apr 2020 21:11:51 GMT
server: nginx
etag: "35e5f4632e32135c9cbe9814eee4642d"
x-amz-version-id: zqaZHghdmvTBibqQHihD58d56Gsx5hPM
access-control-allow-origin: *
x-amz-cf-pop: FRA56-C2
accept-ranges: bytes
content-type: image/png
x-amz-cf-id: iPn2-i1rvWtWT1Fj8E0o-f3_XH5iBQFMI6HflCtBbgbkLwj5JiPBzA==

GET
H2 200 Zz1mNWEwNzMwZjJkMWVjNDhmNTE3MGIyMzFmYjJiNjE3Nw==
images-cdn.newscred.com/ 93 KB
93 KB 58ms
19ms Image
image/png 2600:9000:211e:9800:f:fcff:7940:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images-cdn.newscred.com/Zz1mNWEwNzMwZjJkMWVjNDhmNTE3MGIyMzFmYjJiNjE3Nw==
Requested by: Host: blog.lumen.com
URL: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:211e:9800:f:fcff:7940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 32277d02eac332d26639c6c9dd6909c6acc53f46e816614182c9d7ca6fe67210

Request headers

Referer: https://blog.lumen.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 05 Mar 2021 05:04:34 GMT
via: 1.1 93b0598b43d63761f1a129690721f888.cloudfront.net (CloudFront)
age: 1000412
x-amz-server-side-encryption: AES256
x-cache-status: EXPIRED
x-cache: Hit from cloudfront
content-length: 94821
last-modified: Thu, 09 Apr 2020 21:12:33 GMT
server: nginx
etag: "967becbdf6531ff0fa9c7acf72ac666e"
x-amz-version-id: ybenRsGJuSuN27EAtl4PE0luAHkmWGwn
access-control-allow-origin: *
x-amz-cf-pop: FRA56-C2
accept-ranges: bytes
content-type: image/png
x-amz-cf-id: OMhgfA7KEMHRMOg71cVX4cMl7O0ZOhLdU4NNzk-fzPsCvR5PkwfW3Q==

GET
H2 200 Zz02MWRhMWQyZWRjNGVkNzQ5MmU4MmNmZGFkNmZkZmNiYw==
images-cdn.newscred.com/ 7 KB
8 KB 51ms
13ms Image
image/png 2600:9000:211e:9800:f:fcff:7940:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images-cdn.newscred.com/Zz02MWRhMWQyZWRjNGVkNzQ5MmU4MmNmZGFkNmZkZmNiYw==
Requested by: Host: blog.lumen.com
URL: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:211e:9800:f:fcff:7940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 0e6afb6c84dc34efaa387df4a35c59497059606826e161c4825eeab8009d0508

Request headers

Referer: https://blog.lumen.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 05 Mar 2021 05:04:34 GMT
via: 1.1 93b0598b43d63761f1a129690721f888.cloudfront.net (CloudFront)
age: 1000412
x-amz-server-side-encryption: AES256
x-cache-status: EXPIRED
x-cache: Hit from cloudfront
content-length: 7454
last-modified: Thu, 09 Apr 2020 21:13:52 GMT
server: nginx
etag: "2797f9132afe65046ec0225b2395ae6a"
x-amz-version-id: wLZGr3gJtB2fFGMwY5ubfEycnFTkLFRB
access-control-allow-origin: *
x-amz-cf-pop: FRA56-C2
accept-ranges: bytes
content-type: image/png
x-amz-cf-id: q8xMpoV-JYi713PiGCHuAFvb6j8lAWczOw2KezJHXjtVxpym7Pf01w==

GET
H2 200 Zz01NWU4MTA1NWI5NmQyNDNiMTE1YzIwMjRkMGI5YjAxMw==
images-cdn.newscred.com/ 34 KB
35 KB 56ms
18ms Image
image/png 2600:9000:211e:9800:f:fcff:7940:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images-cdn.newscred.com/Zz01NWU4MTA1NWI5NmQyNDNiMTE1YzIwMjRkMGI5YjAxMw==
Requested by: Host: blog.lumen.com
URL: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:211e:9800:f:fcff:7940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 3a1187097630a483fb7feb35f8cf67b069777034b88e4c088c82256c4be588a0

Request headers

Referer: https://blog.lumen.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 05 Mar 2021 05:04:34 GMT
via: 1.1 93b0598b43d63761f1a129690721f888.cloudfront.net (CloudFront)
age: 1000412
x-amz-server-side-encryption: AES256
x-cache-status: EXPIRED
x-cache: Hit from cloudfront
content-length: 34886
last-modified: Thu, 09 Apr 2020 21:15:51 GMT
server: nginx
etag: "ddd82f85b7da215b64713e27a6231f8a"
x-amz-version-id: CQD09X_0GEPAx6wbd.ngrNzpNsuyr49n
access-control-allow-origin: *
x-amz-cf-pop: FRA56-C2
accept-ranges: bytes
content-type: image/png
x-amz-cf-id: VaSaEgF2z_P7S_ZarfkquEJIy6s-rwcNg8AVbRp5HlhtFOYKDUVb8w==

GET
H3-Q050 200 linkid.js Show response
www.google-analytics.com/plugins/ua/ 2 KB
1 KB 36ms
21ms Script
text/javascript 2a00:1450:4001:827::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/plugins/ua/linkid.js

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://blog.lumen.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 16 Mar 2021 18:16:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
age: 2501
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=3600
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 859
x-xss-protection: 0
expires: Tue, 16 Mar 2021 19:16:25 GMT

GET
H2 200 otBannerSdk.js Show response
cdn.cookielaw.org/scripttemplates/6.12.0/ 361 KB
80 KB 13ms
13ms Script
application/javascript 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.12.0/otBannerSdk.js

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fb267645649f8c0c35b5e1731fb8ce8b7292513621aeb9009b3ba8dcb36310af

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.lumen.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 16 Mar 2021 18:58:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: yyQXAISCXjz2OMk2mDzAmA==
age: 5565321
vary: Accept-Encoding
content-length: 81327
cf-request-id: 08de0018210000beb5103fe000000001
x-ms-lease-status: unlocked
last-modified: Wed, 06 Jan 2021 15:14:26 GMT
server: cloudflare
etag: 0x8D8B255C198CF34
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: d2e7b189-f01e-0025-69f8-e74055000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=691200
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 631036069c8ebeb5-FRA
expires: Wed, 24 Mar 2021 18:58:06 GMT

GET
DATA 200
OK truncated
/ 34 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1e85ec81b9800b4c443d39caca0d0926089a3ac201120db1ceb45b93789480b8

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif

GET
H/1.1

200
OK

rd Show response
dpm.demdex.net/id/
Redirect Chain

https://dpm.demdex.net/id?d_visid_ver=5.2.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=AA683BC75245B3880A490D4D%40AdobeOrg&d_nsid=0&ts=1615921086540
https://dpm.demdex.net/id/rd?d_visid_ver=5.2.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=AA683BC75245B3880A490D4D%40AdobeOrg&d_nsid=0&ts=1615921086540

370 B
1 KB

64ms
64ms

XHR
application/json

52.17.73.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id/rd?d_visid_ver=5.2.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=AA683BC75245B3880A490D4D%40AdobeOrg&d_nsid=0&ts=1615921086540

Requested by

Host: blog.lumen.com
URL: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.17.73.77 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-17-73-77.eu-west-1.compute.amazonaws.com

Software

Resource Hash

df01ed1e908e5eb47cc14dc28740b10c1afe81e2b7d1e4aa592f3e08a81f7e30

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://blog.lumen.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

DCS: dcs-prod-irl1-v090-0ff724c1e.edge-irl1.demdex.com 5.80.7.20210304103356 8ms (+0ms)
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
X-TID: G+A0KBQLSPg=
Vary: Origin, Accept-Encoding, User-Agent
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://blog.lumen.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 306
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Access-Control-Allow-Origin: https://blog.lumen.com
X-TID: bq6zc1FzTBw=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://dpm.demdex.net/id/rd?d_visid_ver=5.2.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=AA683BC75245B3880A490D4D%40AdobeOrg&d_nsid=0&ts=1615921086540
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 AppMeasurement.min.js Show response
assets.adobedtm.com/extensions/EPbde2f7ca14e540399dcc1f8208860b7b/ 33 KB
12 KB 10ms
10ms Script
application/x-javascript 2a02:26f0:10c:4a5::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EPbde2f7ca14e540399dcc1f8208860b7b/AppMeasurement.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/c58e7dfcc1ae/65c3c535dbf4/launch-22e49494a283.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10c:4a5::1e80 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: d6b423c91328eec9c218dd8b21ae1e676987d574e5432411a32806e5dd2bde32

Request headers

Referer: https://blog.lumen.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 16 Mar 2021 18:58:06 GMT
content-encoding: gzip
last-modified: Wed, 12 Aug 2020 22:09:52 GMT
server: AkamaiNetStorage
etag: "f259ee6445c19c2ce3c64a1b117a4f35:1597270192.577101"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://blog.lumen.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 12184
expires: Tue, 16 Mar 2021 19:58:06 GMT

GET
H2 200 AppMeasurement_Module_ActivityMap.min.js Show response
assets.adobedtm.com/extensions/EPbde2f7ca14e540399dcc1f8208860b7b/ 3 KB
2 KB 11ms
10ms Script
application/x-javascript 2a02:26f0:10c:4a5::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EPbde2f7ca14e540399dcc1f8208860b7b/AppMeasurement_Module_ActivityMap.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/c58e7dfcc1ae/65c3c535dbf4/launch-22e49494a283.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10c:4a5::1e80 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 0486530f1e98818865754a08e1b5442ac5a6a36a6bf6042e3b3338a532e998d2

Request headers

Referer: https://blog.lumen.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 16 Mar 2021 18:58:06 GMT
content-encoding: gzip
last-modified: Wed, 12 Aug 2020 22:09:52 GMT
server: AkamaiNetStorage
etag: "5dedcda2c8a6c3a51fd419d306427010:1597270192.857753"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://blog.lumen.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 1594
expires: Tue, 16 Mar 2021 19:58:06 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 99 KB
39 KB 21ms
21ms Script
application/javascript 2a00:1450:4001:827::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-41153014-10

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/c58e7dfcc1ae/65c3c535dbf4/launch-22e49494a283.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

b28123c901bc9556103cc09f2268041ce9b2e0f5128b9a5e82c5efd450358920

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://blog.lumen.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 16 Mar 2021 18:58:06 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39799
x-xss-protection: 0
last-modified: Tue, 16 Mar 2021 18:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 16 Mar 2021 18:58:06 GMT

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/ 1 KB
1 KB 106ms
36ms Script
application/x-javascript 88.221.60.75
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/munchkin.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/c58e7dfcc1ae/65c3c535dbf4/launch-22e49494a283.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 88.221.60.75 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a88-221-60-75.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 5cc2628039ee08964a5f46fb8abb1d5e1ec87e1200d12862ef1232bbfed7da55

Request headers

Referer: https://blog.lumen.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 16 Mar 2021 18:58:06 GMT
Content-Encoding: gzip
Last-Modified: Wed, 05 Aug 2020 03:11:00 GMT
Server: AkamaiNetStorage
ETag: "a67ed8ce0a86706b9f73a86806ce5bd3:1596597060.25158"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 752

GET
H2 200 icons.29.svg.js Show response
static.addtoany.com/menu/svg/ 78 KB
33 KB 19ms
19ms Script
application/javascript 2606:4700:10::ac43:2794
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.addtoany.com/menu/svg/icons.29.svg.js

Requested by

Host: static.addtoany.com
URL: https://static.addtoany.com/menu/page.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::ac43:2794 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e30f848c353b8ab801c18d2109527cb32a27f145262dccb3cd4db9f309cc53bb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.lumen.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 16 Mar 2021 18:58:06 GMT
via: e2s
x-content-type-options: nosniff
cf-cache-status: HIT
age: 11115050
p3p: CP="ALL DSP COR CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT"
content-encoding: br
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08de00186500001766300de000000001
last-modified: Mon, 31 Dec 2018 23:29:11 GMT
server: cloudflare
etag: W/"13937-57e59c7b88bd6"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
cache-control: max-age=315360000, immutable
cf-ray: 631036070b0d1766-FRA
cf-bgj: minify

GET
H3-Q050 200 www-player-webp.css
www.youtube.com/s/player/b2e56c01/ Frame 5372 341 KB
51 KB 38ms
22ms Stylesheet
text/css 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/b2e56c01/www-player-webp.css

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/tqiYhn2fQIY?rel=0

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4f3d44464550faae5daa4a090d801ef80ffb455b2c82e9a41b2864b1b5edc7c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/embed/tqiYhn2fQIY?rel=0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 15:45:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 15 Mar 2021 00:15:17 GMT
server: sffe
age: 97946
vary: Accept-Encoding, Origin
content-type: text/css
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 52229
x-xss-protection: 0
expires: Tue, 15 Mar 2022 15:45:40 GMT

GET
H3-Q050 200 www-embed-player.js Show response
www.youtube.com/s/player/b2e56c01/www-embed-player.vflset/ Frame 5372 161 KB
58 KB 37ms
22ms Script
text/javascript 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/b2e56c01/www-embed-player.vflset/www-embed-player.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/tqiYhn2fQIY?rel=0

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4e82bd8f567840279d47dc169ac57460b3195b6e9d8c138964534620fcbdce6f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/embed/tqiYhn2fQIY?rel=0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 15:45:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 15 Mar 2021 00:15:17 GMT
server: sffe
age: 97946
vary: Accept-Encoding, Origin
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 59637
x-xss-protection: 0
expires: Tue, 15 Mar 2022 15:45:40 GMT

GET
H3-Q050 200 base.js Show response
www.youtube.com/s/player/b2e56c01/player_ias.vflset/en_US/ Frame 5372 2 MB
505 KB 35ms
20ms Script
text/javascript 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/b2e56c01/player_ias.vflset/en_US/base.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/tqiYhn2fQIY?rel=0

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1ec9dc99e8e7db9c1048749c68a76e2738e2a60ffa59dc79bad31f8f6eab5bba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/embed/tqiYhn2fQIY?rel=0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 15:46:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 15 Mar 2021 00:15:17 GMT
server: sffe
age: 97914
vary: Accept-Encoding, Origin
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 517196
x-xss-protection: 0
expires: Tue, 15 Mar 2022 15:46:12 GMT

GET
H3-Q050 200 fetch-polyfill.js Show response
www.youtube.com/s/player/b2e56c01/fetch-polyfill.vflset/ Frame 5372 8 KB
3 KB 37ms
21ms Script
text/javascript 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/b2e56c01/fetch-polyfill.vflset/fetch-polyfill.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/tqiYhn2fQIY?rel=0

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

de6c4ffa2bd9fd283610e28d0db2ec48607aab39d213a51aef248673a0a7e980

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/embed/tqiYhn2fQIY?rel=0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 15:45:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 15 Mar 2021 00:15:17 GMT
server: sffe
age: 97944
vary: Accept-Encoding, Origin
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3027
x-xss-protection: 0
expires: Tue, 15 Mar 2022 15:45:42 GMT

GET
H3-Q050 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 5372 15 KB
15 KB 36ms
21ms Font
font/woff2 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/tqiYhn2fQIY?rel=0

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://www.youtube.com
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 11 Mar 2021 19:41:25 GMT
x-content-type-options: nosniff
last-modified: Mon, 16 Oct 2017 17:32:55 GMT
server: sffe
age: 429401
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15344
x-xss-protection: 0
expires: Fri, 11 Mar 2022 19:41:25 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
84 B 15ms
13ms XHR
text/plain 2a00:1450:400c:c09::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j88&tid=UA-41153014-24&cid=877143443.1615921086&jid=700465796&gjid=1123379203&_gid=91848163.1615921086&_u=aGBAgUAjCAAAAE~&z=322996721

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c09::9b Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.lumen.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Tue, 16 Mar 2021 18:58:06 GMT
content-type: text/plain
access-control-allow-origin: https://blog.lumen.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 collect
www.google-analytics.com/ 35 B
190 B 11ms
7ms Image
image/gif 2a00:1450:4001:827::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j88&a=194198901&t=pageview&_s=1&dl=https%3A%2F%2Fblog.lumen.com%2Fnew-mozi-malware-family-quietly-amasses-iot-bots%2F&ul=en-us&de=UTF-8&dt=New%20Mozi%20malware%20family%20quietly%20amasses%20IoT%20bots&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aGBAgUAjC~&jid=700465796&gjid=1123379203&cid=877143443.1615921086&tid=UA-41153014-24&_gid=91848163.1615921086&z=152439878

Requested by

Host: blog.lumen.com
URL: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.lumen.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 16 Mar 2021 12:34:41 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 23005
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 en.json Show response
cdn.cookielaw.org/consent/e733a0d8-63ff-4a39-b870-9ef50b603bcf/2734b29e-995c-4a56-bfda-f9fdab7418db/ 29 KB
10 KB 16ms
15ms Fetch
application/x-javascript 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/e733a0d8-63ff-4a39-b870-9ef50b603bcf/2734b29e-995c-4a56-bfda-f9fdab7418db/en.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.12.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0dd1eb5d05ab00522c9faa40376de66157d61877f8586a9179f710ad7b8f0a4f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.lumen.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 16 Mar 2021 18:58:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: TI5wZcFfbD7sZvKRpVyskw==
age: 29
vary: Accept-Encoding
content-length: 9836
cf-request-id: 08de001894000005f59e3bd000000001
x-ms-lease-status: unlocked
last-modified: Tue, 26 Jan 2021 16:26:17 GMT
server: cloudflare
etag: 0x8D8C2171BB23627
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 0c99cf99-001e-0116-30ee-185f2d000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 631036075dd605f5-FRA

POST
H3-Q050 200 collect Show response
www.google-analytics.com/j/ 2 B
125 B 14ms
14ms XHR
text/plain 2a00:1450:4001:827::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j88&a=194198901&t=pageview&_s=1&dl=https%3A%2F%2Fblog.lumen.com%2Fnew-mozi-malware-family-quietly-amasses-iot-bots%2F&ul=en-us&de=UTF-8&dt=New%20Mozi%20malware%20family%20quietly%20amasses%20IoT%20bots&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aGDAAUAjCAAAAG~&jid=97771907&gjid=298597166&cid=877143443.1615921086&tid=UA-41153014-10&_gid=91848163.1615921086&_r=1&gtm=2ou330&z=2118075903

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.lumen.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 16 Mar 2021 18:58:06 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://blog.lumen.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 js Show response
www.googletagmanager.com/gtag/ 99 KB
39 KB 40ms
25ms Script
application/javascript 2a00:1450:4001:803::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-10006467&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-41153014-10

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

c55e2307202fb04c390eea7a3355f0736c248c4427cb330123d3dae05c2d55ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://blog.lumen.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 16 Mar 2021 18:58:06 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39888
x-xss-protection: 0
last-modified: Tue, 16 Mar 2021 18:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 16 Mar 2021 18:58:06 GMT

GET
H3-Q050 200 js Show response
www.googletagmanager.com/gtag/ 99 KB
39 KB 37ms
22ms Script
application/javascript 2a00:1450:4001:803::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-9129572&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-41153014-10

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

64a30f69c089200aa04feea4210151b0dc611148971699787feac074e38fd832

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://blog.lumen.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 16 Mar 2021 18:58:06 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39817
x-xss-protection: 0
last-modified: Tue, 16 Mar 2021 18:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 16 Mar 2021 18:58:06 GMT

POST
H3-Q050 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
423 B 85ms
14ms XHR
text/plain 2a00:1450:400c:c0c::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j88&tid=UA-41153014-10&cid=877143443.1615921086&jid=97771907&gjid=298597166&_gid=91848163.1615921086&_u=aGDAAUAjCAAAAG~&z=278606089

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400c:c0c::9d Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.lumen.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Tue, 16 Mar 2021 18:58:06 GMT
content-type: text/plain
access-control-allow-origin: https://blog.lumen.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050

200

id Show response
googleads.g.doubleclick.net/pagead/ Frame 5372
Redirect Chain

https://googleads.g.doubleclick.net/pagead/id
https://googleads.g.doubleclick.net/pagead/id?slf_rd=1

113 B
920 B

67ms
52ms

XHR
application/json

2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/id?slf_rd=1

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/tqiYhn2fQIY?rel=0

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

458c5de5d7f31cd810ad073e84f5160d4abcbc07a3d94e634bd5cbfda55eec76

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 16 Mar 2021 18:58:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 133
x-xss-protection: 0
pragma: no-cache
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://www.youtube.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Tue, 16 Mar 2021 18:58:06 GMT
x-content-type-options: nosniff
access-control-allow-origin: https://www.youtube.com
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
pragma: no-cache
server: cafe
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/id?slf_rd=1
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ad_status.js Show response
static.doubleclick.net/instream/ Frame 5372 29 B
406 B 26ms
5ms Script
text/javascript 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.doubleclick.net/instream/ad_status.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/b2e56c01/www-embed-player.vflset/www-embed-player.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eed0dc1fdb5d97ed188ae16fd5e1024a5bb744af47340346be2146300a6c54b9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 16 Mar 2021 18:56:04 GMT
x-content-type-options: nosniff
last-modified: Thu, 12 Dec 2013 23:40:16 GMT
server: sffe
age: 122
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=900
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29
x-xss-protection: 0
expires: Tue, 16 Mar 2021 19:11:04 GMT

GET
H2 200 otFloatingRoundedCorner.json Show response
cdn.cookielaw.org/scripttemplates/6.12.0/assets/ 9 KB
3 KB 12ms
12ms Fetch
application/json 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.12.0/assets/otFloatingRoundedCorner.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.12.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

13325828883928a094f076ae64cc942ee542c9d38b405397cccb4757aee0c734

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.lumen.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 16 Mar 2021 18:58:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: +3Hr7/51+YugPxLO2thMDQ==
age: 271159
vary: Accept-Encoding
content-length: 2553
cf-request-id: 08de00192a000005f59e3c8000000001
x-ms-lease-status: unlocked
last-modified: Wed, 20 Jan 2021 07:04:03 GMT
server: cloudflare
etag: 0x8D8BD1191D91597
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: 5bc0d0b7-e01e-0153-7d1e-1882bc000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=691200
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 631036084fb105f5-FRA
expires: Wed, 24 Mar 2021 18:58:06 GMT

GET
H2 200 otPcPanel.json Show response
cdn.cookielaw.org/scripttemplates/6.12.0/assets/v2/ 47 KB
11 KB 13ms
13ms Fetch
application/json 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.12.0/assets/v2/otPcPanel.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.12.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1490910b508b1bc1ff2c9953fb0837b98e4733e25e83496c6f325463ad122e97

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.lumen.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 16 Mar 2021 18:58:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: tRUTpXLiIQoChcNtfqWhEA==
age: 4236063
vary: Accept-Encoding
content-length: 11355
cf-request-id: 08de00192a000005f5b3026000000001
x-ms-lease-status: unlocked
last-modified: Wed, 20 Jan 2021 07:04:04 GMT
server: cloudflare
etag: 0x8D8BD11925C411B
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: 9f001f46-201e-008d-5d0f-f49440000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=691200
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 631036084fb405f5-FRA
expires: Wed, 24 Mar 2021 18:58:06 GMT

GET
H3-Q050 200 remote.js Show response
www.youtube.com/s/player/b2e56c01/player_ias.vflset/en_US/ Frame 5372 97 KB
32 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/b2e56c01/player_ias.vflset/en_US/remote.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/b2e56c01/player_ias.vflset/en_US/base.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4265eaa975ba51f71d28969829a092f38c84dd0ad29ded35534eefe503db5d24

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/embed/tqiYhn2fQIY?rel=0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 15:46:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 15 Mar 2021 00:15:17 GMT
server: sffe
age: 97913
vary: Accept-Encoding, Origin
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 32719
x-xss-protection: 0
expires: Tue, 15 Mar 2022 15:46:13 GMT

GET
H2 200 OqSalp92o-4AtfYt583RauVJYevBmhjij2pcg0zPe10.js Show response
www.google.com/js/bg/ Frame 5372 14 KB
6 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/js/bg/OqSalp92o-4AtfYt583RauVJYevBmhjij2pcg0zPe10.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/b2e56c01/player_ias.vflset/en_US/base.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3aa49a969f76a3ee00b5f62de7cdd16ae54961ebc19a18e28f6a5c834ccf7b5d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 14 Mar 2021 19:38:00 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Mon, 08 Mar 2021 18:00:00 GMT
server: sffe
age: 170406
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5732
x-xss-protection: 0
expires: Mon, 14 Mar 2022 19:38:00 GMT

GET
H3-Q050 200 embed.js Show response
www.youtube.com/s/player/b2e56c01/player_ias.vflset/en_US/ Frame 5372 23 KB
7 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/b2e56c01/player_ias.vflset/en_US/embed.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/b2e56c01/player_ias.vflset/en_US/base.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5d61ca3e7e8a15ea0b45ae62105c7fbb784d5f89137e0d5fd411f3d603511346

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/embed/tqiYhn2fQIY?rel=0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 15:46:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 15 Mar 2021 00:15:17 GMT
server: sffe
age: 97913
vary: Accept-Encoding, Origin
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7323
x-xss-protection: 0
expires: Tue, 15 Mar 2022 15:46:13 GMT

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/159/ 11 KB
5 KB 45ms
44ms Script
application/x-javascript 88.221.60.75
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/159/munchkin.js
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 88.221.60.75 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a88-221-60-75.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 459e23d23ffe65a86f3a1f67c07edc92e0c69461ff83fbd63764d7b36cac92fc

Request headers

Referer: https://blog.lumen.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 16 Mar 2021 18:58:06 GMT
Content-Encoding: gzip
Last-Modified: Fri, 08 May 2020 02:24:14 GMT
Server: AkamaiNetStorage
ETag: "79274ffc293e4f76fc372b953f780d16:1588904654.430334"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control: max-age=8640000
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 4810
Expires: Thu, 24 Jun 2021 18:58:06 GMT

GET
DATA 200
OK truncated
/ Frame 5372 175 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 67ea46bc3d15351067faccb3613bd833dd3f15137a4b4a09f2e873fd41d024d2

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 AAUvwnjqoBY1VfwKn2TE2pGY4mAMv589d3y2m1XPiJMc=s68-c-k-c0x00ffffff-no-rj
yt3.ggpht.com/ytc/ Frame 5372 1 KB
2 KB 48ms
15ms Image
image/jpeg 2a00:1450:4001:803::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://yt3.ggpht.com/ytc/AAUvwnjqoBY1VfwKn2TE2pGY4mAMv589d3y2m1XPiJMc=s68-c-k-c0x00ffffff-no-rj

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/tqiYhn2fQIY?rel=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

84c63f9a0a37a08acf57e5c8a8c76c8955fb720f7a08f3a8153088e09ef0b559

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 16 Mar 2021 15:05:41 GMT
x-content-type-options: nosniff
age: 13945
content-disposition: inline;filename="unnamed.jpg"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1215
x-xss-protection: 0
server: fife
etag: "v9"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sat, 27 Feb 2021 18:04:00 GMT

GET
H2 200 sddefault.webp
i.ytimg.com/vi_webp/tqiYhn2fQIY/ Frame 5372 19 KB
19 KB 28ms
7ms Image
image/webp 2a00:1450:4001:80e::2016
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.ytimg.com/vi_webp/tqiYhn2fQIY/sddefault.webp

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/tqiYhn2fQIY?rel=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2016 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c503eecf1acd77cd695259e9c52e65efb25ca415f9ab2f1c32bd30bbfcec35e2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 16 Mar 2021 17:59:25 GMT
x-content-type-options: nosniff
server: sffe
age: 3521
etag: "1599943083"
vary: Origin
content-type: image/webp
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19308
x-xss-protection: 0
expires: Tue, 16 Mar 2021 19:59:25 GMT

GET
H3-Q050 200 ga-audiences
www.google.com/ads/ 42 B
271 B 29ms
29ms Image
image/gif 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j88&tid=UA-41153014-10&cid=877143443.1615921086&jid=97771907&_u=aGDAAUAjCAAAAG~&z=2017799921

Requested by

Host: blog.lumen.com
URL: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://blog.lumen.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 16 Mar 2021 18:58:06 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
107 B 33ms
32ms Image
image/gif 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j88&tid=UA-41153014-10&cid=877143443.1615921086&jid=97771907&_u=aGDAAUAjCAAAAG~&z=2017799921

Requested by

Host: blog.lumen.com
URL: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://blog.lumen.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 16 Mar 2021 18:58:06 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cast_sender.js Show response
www.gstatic.com/cv/js/sender/v1/ Frame 5372 4 KB
2 KB 32ms
13ms Script
text/javascript 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/cv/js/sender/v1/cast_sender.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/b2e56c01/player_ias.vflset/en_US/base.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ee147e859ad0f09aa50367974e38ab53e7c7054c4a51d400a7f45b0eb251454f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 16 Mar 2021 18:58:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 16 Feb 2021 23:57:06 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2007
x-xss-protection: 0
expires: Tue, 16 Mar 2021 18:58:06 GMT

GET
H3-Q050 204 generate_204
www.youtube.com/ Frame 5372 0
38 B 6ms
6ms Image
text/plain 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.youtube.com/generate_204?ESw0Yw
Requested by: Host: blog.lumen.com
URL: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/
Protocol: H3-Q050
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.youtube.com/embed/tqiYhn2fQIY?rel=0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 16 Mar 2021 18:58:07 GMT
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H/1.1 200
OK Cookie set dest5.html Show response
centurylink.demdex.net/ Frame 7042 7 KB
3 KB 238ms
60ms Document
text/html 52.17.73.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://centurylink.demdex.net/dest5.html?d_nsid=0

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/c58e7dfcc1ae/65c3c535dbf4/launch-22e49494a283.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.17.73.77 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-17-73-77.eu-west-1.compute.amazonaws.com

Software

Resource Hash

7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Host: centurylink.demdex.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://blog.lumen.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: demdex=77034679176884585461637500979132304431
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://blog.lumen.com/

Response headers

Accept-Ranges: bytes
Cache-Control: max-age=21600
Content-Encoding: gzip
Content-Type: text/html
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Last-Modified: Wed, 10 Mar 2021 16:01:43 GMT
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Set-Cookie: demdex=77034679176884585461637500979132304431;Path=/;Domain=.demdex.net;Expires=Sun, 12-Sep-2021 18:58:07 GMT;Max-Age=15552000;Secure;SameSite=None
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Accept-Encoding, User-Agent
X-TID: r+h98sbBQJM=
Content-Length: 2785
Connection: keep-alive

GET
H2 200 id Show response
smetrics.centurylink.com/ 48 B
512 B 121ms
39ms XHR
application/x-javascript 15.237.136.106
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://smetrics.centurylink.com/id?d_visid_ver=5.2.0&d_fieldgroup=A&mcorgid=AA683BC75245B3880A490D4D%40AdobeOrg&mid=70116968814373863882098440057776203657&ts=1615921087043

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/c58e7dfcc1ae/65c3c535dbf4/launch-22e49494a283.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.237.136.106 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-15-237-136-106.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

37d2b5eadcb8c0cece3d129b2b69dcf40198cfd4c53c9addba8f6bebd85ec91e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://blog.lumen.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Tue, 16 Mar 2021 18:58:07 GMT
x-content-type-options: nosniff
server: jag
xserver: anedge-7df884dd44-6qcqk
vary: Origin
x-c: main-1434.I637bed.M0-481
p3p: CP="This is not a P3P policy"
access-control-allow-origin: https://blog.lumen.com
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/x-javascript;charset=utf-8
content-length: 48
x-xss-protection: 1; mode=block

GET
H/1.1

200
OK

ibs:dpid=411&dpuuid=YFD-vwAAAJEG_w_u
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=77034679176884585461637500979132304431
https://dpm.demdex.net/ibs:dpid=411&dpuuid=YFD-vwAAAJEG_w_u

42 B
915 B

57ms
56ms

Image
image/gif

52.17.73.77
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=411&dpuuid=YFD-vwAAAJEG_w_u

Requested by

Host: blog.lumen.com
URL: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.17.73.77 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-17-73-77.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.lumen.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

DCS: dcs-prod-irl1-v090-0142885fa.edge-irl1.demdex.com 5.80.7.20210304103356 0ms (+1ms)
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-TID: YOLmfKhHRyM=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 42
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=YFD-vwAAAJEG_w_u
Date: Tue, 16 Mar 2021 18:58:07 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H2 200 RC3e65ea4ae668430cbf34be11d12743cd-source.min.js Show response
assets.adobedtm.com/c58e7dfcc1ae/65c3c535dbf4/b970bfea3a97/ 38 KB
11 KB 12ms
9ms Script
application/x-javascript 2a02:26f0:10c:4a5::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/c58e7dfcc1ae/65c3c535dbf4/b970bfea3a97/RC3e65ea4ae668430cbf34be11d12743cd-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/c58e7dfcc1ae/65c3c535dbf4/launch-22e49494a283.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10c:4a5::1e80 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 3df26e7c1926b93582c537a4e7e164775c98b0e2cbbb8fca4492e4617ab4b78c

Request headers

Referer: https://blog.lumen.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 16 Mar 2021 18:58:07 GMT
content-encoding: gzip
last-modified: Tue, 16 Mar 2021 14:45:25 GMT
server: AkamaiNetStorage
etag: "ace0c9725dd1dba99d71f1790acffd53:1615905925.354545"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://blog.lumen.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 11026
expires: Tue, 16 Mar 2021 19:58:07 GMT

GET
H2 200 RC096c88e0a7534510abf123c5095dcc30-source.min.js Show response
assets.adobedtm.com/c58e7dfcc1ae/65c3c535dbf4/b970bfea3a97/ 18 KB
3 KB 13ms
10ms Script
application/x-javascript 2a02:26f0:10c:4a5::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/c58e7dfcc1ae/65c3c535dbf4/b970bfea3a97/RC096c88e0a7534510abf123c5095dcc30-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/c58e7dfcc1ae/65c3c535dbf4/launch-22e49494a283.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10c:4a5::1e80 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: d4136390257ec223f983e045417585b67e9621bd8773cd5baa4cd1b2face05f2

Request headers

Referer: https://blog.lumen.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 16 Mar 2021 18:58:07 GMT
content-encoding: gzip
last-modified: Tue, 16 Mar 2021 14:45:25 GMT
server: AkamaiNetStorage
etag: "ace0c9725dd1dba99d71f1790acffd53:1615905925.354545"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://blog.lumen.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 3048
expires: Tue, 16 Mar 2021 19:58:07 GMT

GET
H2 200 RC76c030d2fbd94c5593f6b953894a4a89-source.min.js Show response
assets.adobedtm.com/c58e7dfcc1ae/65c3c535dbf4/b970bfea3a97/ 1 KB
898 B 13ms
11ms Script
application/x-javascript 2a02:26f0:10c:4a5::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/c58e7dfcc1ae/65c3c535dbf4/b970bfea3a97/RC76c030d2fbd94c5593f6b953894a4a89-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/c58e7dfcc1ae/65c3c535dbf4/launch-22e49494a283.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10c:4a5::1e80 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 3f4c554de6bd81dbb5f6cfec913e8f8ce8a76cbb16cbfdeabb96efdd4243b4c1

Request headers

Referer: https://blog.lumen.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 16 Mar 2021 18:58:07 GMT
content-encoding: gzip
last-modified: Tue, 16 Mar 2021 14:45:25 GMT
server: AkamaiNetStorage
etag: "ace0c9725dd1dba99d71f1790acffd53:1615905925.354545"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://blog.lumen.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 634
expires: Tue, 16 Mar 2021 19:58:07 GMT

GET
H2 200 RC144ef5d42de24cd4b97aea5454f675ad-source.min.js Show response
assets.adobedtm.com/c58e7dfcc1ae/65c3c535dbf4/b970bfea3a97/ 1 KB
846 B 13ms
11ms Script
application/x-javascript 2a02:26f0:10c:4a5::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/c58e7dfcc1ae/65c3c535dbf4/b970bfea3a97/RC144ef5d42de24cd4b97aea5454f675ad-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/c58e7dfcc1ae/65c3c535dbf4/launch-22e49494a283.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10c:4a5::1e80 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: f6bf08b8b4f9ff55ad2ebc9113cb57ecc052a9c24658a95b717c5b24cdfc4565

Request headers

Referer: https://blog.lumen.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 16 Mar 2021 18:58:07 GMT
content-encoding: gzip
last-modified: Tue, 16 Mar 2021 14:45:25 GMT
server: AkamaiNetStorage
etag: "ace0c9725dd1dba99d71f1790acffd53:1615905925.354545"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://blog.lumen.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 582
expires: Tue, 16 Mar 2021 19:58:07 GMT

GET
H2 200 RCf14e3ab3c1f340b18e8134414ffa8ae4-source.min.js Show response
assets.adobedtm.com/c58e7dfcc1ae/65c3c535dbf4/b970bfea3a97/ 1 KB
674 B 14ms
12ms Script
application/x-javascript 2a02:26f0:10c:4a5::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/c58e7dfcc1ae/65c3c535dbf4/b970bfea3a97/RCf14e3ab3c1f340b18e8134414ffa8ae4-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/c58e7dfcc1ae/65c3c535dbf4/launch-22e49494a283.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10c:4a5::1e80 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 21c1a8787305236f67b83c93c642471b80a5503176044399eb6e2b1bc98c0e5d

Request headers

Referer: https://blog.lumen.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 16 Mar 2021 18:58:07 GMT
content-encoding: gzip
last-modified: Tue, 16 Mar 2021 14:45:25 GMT
server: AkamaiNetStorage
etag: "ace0c9725dd1dba99d71f1790acffd53:1615905925.354545"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://blog.lumen.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 411
expires: Tue, 16 Mar 2021 19:58:07 GMT

GET
H2 200 RC15d2b24dce8343119de6440985295e78-source.min.js Show response
assets.adobedtm.com/c58e7dfcc1ae/65c3c535dbf4/b970bfea3a97/ 1 KB
878 B 14ms
13ms Script
application/x-javascript 2a02:26f0:10c:4a5::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/c58e7dfcc1ae/65c3c535dbf4/b970bfea3a97/RC15d2b24dce8343119de6440985295e78-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/c58e7dfcc1ae/65c3c535dbf4/launch-22e49494a283.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10c:4a5::1e80 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 7121bfd706495783f9a69331d47a78c6fe56e56b614f87330bcbd5a04df30474

Request headers

Referer: https://blog.lumen.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 16 Mar 2021 18:58:07 GMT
content-encoding: gzip
last-modified: Tue, 16 Mar 2021 14:45:25 GMT
server: AkamaiNetStorage
etag: "ace0c9725dd1dba99d71f1790acffd53:1615905925.354545"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://blog.lumen.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 614
expires: Tue, 16 Mar 2021 19:58:07 GMT

GET
H2 200 RCe802f5df4be2483aad86b1bbdf506705-source.min.js Show response
assets.adobedtm.com/c58e7dfcc1ae/65c3c535dbf4/b970bfea3a97/ 754 B
681 B 15ms
14ms Script
application/x-javascript 2a02:26f0:10c:4a5::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/c58e7dfcc1ae/65c3c535dbf4/b970bfea3a97/RCe802f5df4be2483aad86b1bbdf506705-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/c58e7dfcc1ae/65c3c535dbf4/launch-22e49494a283.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10c:4a5::1e80 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: c6889bb907bfa553105207650d530aece44a5a364df31822f9ee618d927fb80d

Request headers

Referer: https://blog.lumen.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 16 Mar 2021 18:58:07 GMT
content-encoding: gzip
last-modified: Tue, 16 Mar 2021 14:45:25 GMT
server: AkamaiNetStorage
etag: "ace0c9725dd1dba99d71f1790acffd53:1615905925.354545"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://blog.lumen.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 417
expires: Tue, 16 Mar 2021 19:58:07 GMT

GET
H2 200 RC44e31984f9724bf39a43aac78b95d8d0-source.min.js Show response
assets.adobedtm.com/c58e7dfcc1ae/65c3c535dbf4/b970bfea3a97/ 946 B
769 B 15ms
14ms Script
application/x-javascript 2a02:26f0:10c:4a5::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/c58e7dfcc1ae/65c3c535dbf4/b970bfea3a97/RC44e31984f9724bf39a43aac78b95d8d0-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/c58e7dfcc1ae/65c3c535dbf4/launch-22e49494a283.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10c:4a5::1e80 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 5f2368721bf7acabb8738582ae7d860790a9b5225f5ca64582e32c7f0608d644

Request headers

Referer: https://blog.lumen.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 16 Mar 2021 18:58:07 GMT
content-encoding: gzip
last-modified: Tue, 16 Mar 2021 14:45:25 GMT
server: AkamaiNetStorage
etag: "ace0c9725dd1dba99d71f1790acffd53:1615905925.354545"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://blog.lumen.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 505
expires: Tue, 16 Mar 2021 19:58:07 GMT

GET
H2 200 31c5892c-0834-4705-9963-6ce6c5f92ca2.js Show response
cdnssl.clicktale.net/www29/ptc/ 249 KB
43 KB 27ms
8ms Script
application/javascript 2a02:26f0:1700:38c::2db0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdnssl.clicktale.net/www29/ptc/31c5892c-0834-4705-9963-6ce6c5f92ca2.js
Requested by: Host: blog.lumen.com
URL: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:1700:38c::2db0 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 5212e75a28109076157426098aa6103bc7c22577ee27d0a7eaa22312e2879611

Request headers

Origin: https://blog.lumen.com
Referer: https://blog.lumen.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: f2gvnOzHP3I8jy66YtrSDs_05SiLBFRw
content-encoding: br
last-modified: Thu, 11 Mar 2021 13:46:14 GMT
server: AmazonS3
x-amz-request-id: G1C6P6RRX2TR9WA2
etag: "6e96d1cd688526de9102043240416256"
content-type: application/javascript;charset=utf-8
access-control-allow-origin: *
cache-control: max-age=600
date: Tue, 16 Mar 2021 18:58:07 GMT
accept-ranges: bytes
content-length: 43661
x-amz-id-2: AbvJQiZY09lU5fTtOB+kE3a1c0dSYm4IIzviqP+siHLBOZtobbAcfVQI8TyaiME0vfwsnk0ENSQ=
expires: Tue, 16 Mar 2021 19:08:07 GMT

GET
H3-Q050

200

activityi;dc_pre=CPzQkpO_te8CFWqgUQodIVwGxQ;src=9129572;type=audie0;cat=tdnae00;ord=9451237117431;gtm=2od330;auiddc=2099659997.1615921087;u1=https%3A%2F%2Fblog.lumen.com%2Fnew-mozi-malware-family-q... Show response
9129572.fls.doubleclick.net/ Frame 48C1
Redirect Chain

https://9129572.fls.doubleclick.net/activityi;src=9129572;type=audie0;cat=tdnae00;ord=9451237117431;gtm=2od330;auiddc=2099659997.1615921087;u1=https%3A%2F%2Fblog.lumen.com%2Fnew-mozi-malware-family...
https://9129572.fls.doubleclick.net/activityi;dc_pre=CPzQkpO_te8CFWqgUQodIVwGxQ;src=9129572;type=audie0;cat=tdnae00;ord=9451237117431;gtm=2od330;auiddc=2099659997.1615921087;u1=https%3A%2F%2Fblog.l...

639 B
453 B

163ms
125ms

Document
text/html

142.250.185.230
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://9129572.fls.doubleclick.net/activityi;dc_pre=CPzQkpO_te8CFWqgUQodIVwGxQ;src=9129572;type=audie0;cat=tdnae00;ord=9451237117431;gtm=2od330;auiddc=2099659997.1615921087;u1=https%3A%2F%2Fblog.lumen.com%2Fnew-mozi-malware-family-quietly-amasses-iot-bots%2F;u3=ctl%7Cblog%7Cnew-mozi-malware-family-quietly-amasses-iot-bots;u4=70116968814373863882098440057776203657;u6=;~oref=https%3A%2F%2Fblog.lumen.com%2Fnew-mozi-malware-family-quietly-amasses-iot-bots%2F?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-9129572&l=dataLayer&cx=c

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.185.230 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f6.1e100.net

Software

cafe /

Resource Hash

5c9623fa4cd352771494422b6c41e4713c78333b8ac533e131a6d399d608f104

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 9129572.fls.doubleclick.net
:scheme: https
:path: /activityi;dc_pre=CPzQkpO_te8CFWqgUQodIVwGxQ;src=9129572;type=audie0;cat=tdnae00;ord=9451237117431;gtm=2od330;auiddc=2099659997.1615921087;u1=https%3A%2F%2Fblog.lumen.com%2Fnew-mozi-malware-family-quietly-amasses-iot-bots%2F;u3=ctl%7Cblog%7Cnew-mozi-malware-family-quietly-amasses-iot-bots;u4=70116968814373863882098440057776203657;u6=;~oref=https%3A%2F%2Fblog.lumen.com%2Fnew-mozi-malware-family-quietly-amasses-iot-bots%2F?
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://blog.lumen.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUkx3_pASTly8MqusLq71gUaK0qbvODhsKpxV6Nne1Tz3ya8vJ-TaFwn75bf
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: about:blank

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Tue, 16 Mar 2021 18:58:07 GMT
expires: Tue, 16 Mar 2021 18:58:07 GMT
cache-control: private, max-age=0
strict-transport-security: max-age=21600
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 425
x-xss-protection: 0
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Tue, 16 Mar 2021 18:58:07 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
follow-only-when-prerender-shown: 1
strict-transport-security: max-age=21600
location: https://9129572.fls.doubleclick.net/activityi;dc_pre=CPzQkpO_te8CFWqgUQodIVwGxQ;src=9129572;type=audie0;cat=tdnae00;ord=9451237117431;gtm=2od330;auiddc=2099659997.1615921087;u1=https%3A%2F%2Fblog.lumen.com%2Fnew-mozi-malware-family-quietly-amasses-iot-bots%2F;u3=ctl%7Cblog%7Cnew-mozi-malware-family-quietly-amasses-iot-bots;u4=70116968814373863882098440057776203657;u6=;~oref=https%3A%2F%2Fblog.lumen.com%2Fnew-mozi-malware-family-quietly-amasses-iot-bots%2F?
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050

200

activityi;dc_pre=CMrRkpO_te8CFQyr1Qodd5sJoA;src=9129572;type=audie0;cat=tdnae002;ord=1;num=4868752723814;gtm=2od330;auiddc=2099659997.1615921087;u1=https%3A%2F%2Fblog.lumen.com%2Fnew-mozi-malware-f... Show response
9129572.fls.doubleclick.net/ Frame D366
Redirect Chain

https://9129572.fls.doubleclick.net/activityi;src=9129572;type=audie0;cat=tdnae002;ord=1;num=4868752723814;gtm=2od330;auiddc=2099659997.1615921087;u1=https%3A%2F%2Fblog.lumen.com%2Fnew-mozi-malware...
https://9129572.fls.doubleclick.net/activityi;dc_pre=CMrRkpO_te8CFQyr1Qodd5sJoA;src=9129572;type=audie0;cat=tdnae002;ord=1;num=4868752723814;gtm=2od330;auiddc=2099659997.1615921087;u1=https%3A%2F%2...

646 B
908 B

103ms
64ms

Document
text/html

142.250.185.230
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://9129572.fls.doubleclick.net/activityi;dc_pre=CMrRkpO_te8CFQyr1Qodd5sJoA;src=9129572;type=audie0;cat=tdnae002;ord=1;num=4868752723814;gtm=2od330;auiddc=2099659997.1615921087;u1=https%3A%2F%2Fblog.lumen.com%2Fnew-mozi-malware-family-quietly-amasses-iot-bots%2F;u3=ctl%7Cblog%7Cnew-mozi-malware-family-quietly-amasses-iot-bots;u4=70116968814373863882098440057776203657;u6=;~oref=https%3A%2F%2Fblog.lumen.com%2Fnew-mozi-malware-family-quietly-amasses-iot-bots%2F?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-9129572&l=dataLayer&cx=c

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.185.230 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f6.1e100.net

Software

cafe /

Resource Hash

0e658d0bb714995cd0977ceee3392ddbc2a21fd77ebef662f8fa112a718da8ac

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 9129572.fls.doubleclick.net
:scheme: https
:path: /activityi;dc_pre=CMrRkpO_te8CFQyr1Qodd5sJoA;src=9129572;type=audie0;cat=tdnae002;ord=1;num=4868752723814;gtm=2od330;auiddc=2099659997.1615921087;u1=https%3A%2F%2Fblog.lumen.com%2Fnew-mozi-malware-family-quietly-amasses-iot-bots%2F;u3=ctl%7Cblog%7Cnew-mozi-malware-family-quietly-amasses-iot-bots;u4=70116968814373863882098440057776203657;u6=;~oref=https%3A%2F%2Fblog.lumen.com%2Fnew-mozi-malware-family-quietly-amasses-iot-bots%2F?
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://blog.lumen.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUkx3_pASTly8MqusLq71gUaK0qbvODhsKpxV6Nne1Tz3ya8vJ-TaFwn75bf
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: about:blank

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Tue, 16 Mar 2021 18:58:07 GMT
expires: Tue, 16 Mar 2021 18:58:07 GMT
cache-control: private, max-age=0
strict-transport-security: max-age=21600
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 426
x-xss-protection: 0
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Tue, 16 Mar 2021 18:58:07 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
follow-only-when-prerender-shown: 1
strict-transport-security: max-age=21600
location: https://9129572.fls.doubleclick.net/activityi;dc_pre=CMrRkpO_te8CFQyr1Qodd5sJoA;src=9129572;type=audie0;cat=tdnae002;ord=1;num=4868752723814;gtm=2od330;auiddc=2099659997.1615921087;u1=https%3A%2F%2Fblog.lumen.com%2Fnew-mozi-malware-family-quietly-amasses-iot-bots%2F;u3=ctl%7Cblog%7Cnew-mozi-malware-family-quietly-amasses-iot-bots;u4=70116968814373863882098440057776203657;u6=;~oref=https%3A%2F%2Fblog.lumen.com%2Fnew-mozi-malware-family-quietly-amasses-iot-bots%2F?
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 91 KB
23 KB 6ms
6ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: blog.lumen.com
URL: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

9e7ea2b4ba8e2bcc4a964d6192e4671dc5f6863a1c7e35b52b229a3c1e67a68d

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://blog.lumen.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 23762
x-fb-rlafr: 0
pragma: public
x-fb-debug: HD278uvIRwrHaHrRsNHL6c3YHMtf8Lna7ggpx0sA1e3fiYrO0Fu4d0mTRiyTNH4q90XpHt/aiPExEo8ChLAzYQ==
x-fb-trip-id: 917726464
x-frame-options: DENY
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
date: Tue, 16 Mar 2021 18:58:07 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"group":"coop_report","max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}],"include_subdomains":true}, {"group":"coep_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
cross-origin-opener-policy-report-only: same-origin-allow-popups;report-to="coop_report"
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2

200

collect
px.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect/?pid=7664&conversionId=3093564&fmt=gif
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fpid%3D7664%26conversionId%3D3093564%26fmt%3Dgif%26liSync%3Dtrue
https://px.ads.linkedin.com/collect?pid=7664&conversionId=3093564&fmt=gif&liSync=true

43 B
152 B

113ms
113ms

Image
image/gif

2620:119:50e4:101::6cae:b55
LINKEDIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/collect?pid=7664&conversionId=3093564&fmt=gif&liSync=true
Requested by: Host: blog.lumen.com
URL: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:119:50e4:101::6cae:b55 , United States, ASN14413 (LINKEDIN, US),
Reverse DNS
Software: Play /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Referer: https://blog.lumen.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 16 Mar 2021 18:58:07 GMT
content-encoding: gzip
server: Play
linkedin-action: 1
vary: Accept-Encoding
x-li-fabric: prod-lva1
x-li-proto: http/2
x-li-pop: prod-edc2
content-type: image/gif
content-length: 65
x-li-uuid: biCk5arnbBbwyvbNGSsAAA==

Redirect headers

strict-transport-security: max-age=31536000
x-content-type-options: nosniff
linkedin-action: 1
content-length: 0
x-li-uuid: 3Mk03qrnbBZgncDzTisAAA==
pragma: no-cache
x-li-pop: afd-prod-edc2
x-msedge-ref: Ref A: A4633BDAD1B148059922D72C9C121F3C Ref B: FRAEDGE1408 Ref C: 2021-03-16T18:58:07Z
date: Tue, 16 Mar 2021 18:58:07 GMT
expect-ct: max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct"
x-frame-options: sameorigin
x-li-fabric: prod-lva1
location: https://px.ads.linkedin.com/collect?pid=7664&conversionId=3093564&fmt=gif&liSync=true
cache-control: no-cache, no-store
content-security-policy: default-src *; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id lnkd.demdex.net blob: https://accounts.google.com/gsi/status https://linkedin.sc.omtrdc.net/b/ss/ www.google-analytics.com static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com https://snap.licdn.com/li.lms-analytics/ platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'; report-uri https://www.linkedin.com/platform-telemetry/csp?f=l
x-li-proto: http/2
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 384393978803312 Show response
connect.facebook.net/signals/config/ 242 KB
69 KB 7ms
7ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/384393978803312?v=2.9.33&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

a26c94b741461917251ee87baa31120f6534528a50d16056548e1b4c564812bf

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://blog.lumen.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 70762
x-fb-rlafr: 0
pragma: public
x-fb-debug: e0XtW+UVnhcNHb46o9BNVdiqQExysM2w50eV+CAX//hoTwH09cfa+ZmaLo5sWdh1U23hAdqGd7fAKGKlEFdOkQ==
x-fb-trip-id: 917726464
x-frame-options: DENY
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
date: Tue, 16 Mar 2021 18:58:07 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"group":"coop_report","max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}],"include_subdomains":true}, {"group":"coep_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
priority: u=3,i
cross-origin-opener-policy-report-only: same-origin-allow-popups;report-to="coop_report"
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 s29591885679603
smetrics.centurylink.com/b/ss/clinkcompany/1/JS-2.22.0-LBQ1/ 43 B
222 B 41ms
41ms Image
image/gif 15.237.136.106
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://smetrics.centurylink.com/b/ss/clinkcompany/1/JS-2.22.0-LBQ1/s29591885679603?AQB=1&ndh=1&pf=1&t=16%2F2%2F2021%2019%3A58%3A7%202%20-60&mid=70116968814373863882098440057776203657&aamlh=6&ce=UTF-8&ns=centurylink&pageName=ctl%7Cblog%7Cnew-mozi-malware-family-quietly-amasses-iot-bots&g=https%3A%2F%2Fblog.lumen.com%2Fnew-mozi-malware-family-quietly-amasses-iot-bots%2F&cc=USD&ch=blog&server=blog.lumen.com&events=event24&aamb=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&c3=D%3Dv24&c6=clinkcompany&v8=desktop_wide&v9=70116968814373863882098440057776203657&c11=D%3Dv8&c17=12%3A58%20PM%7CTuesday&c24=D%3Dv53&c25=D%3Dv54&c26=D%3Dv55&c27=D%3Dv57&v41=blog&c48=22&c52=D%3Dv56&v53=blog%7Cnew-mozi-malware-family-quietly-amasses-iot-bots&v56=ctl&c58=Launch%3A%20Ancillary%20Sites&c59=D%3Dv9&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=AA683BC75245B3880A490D4D%40AdobeOrg&AQE=1

Requested by

Host: blog.lumen.com
URL: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.237.136.106 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-15-237-136-106.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://blog.lumen.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 16 Mar 2021 18:58:07 GMT
x-content-type-options: nosniff
x-c: main-1434.I637bed.M0-481
p3p: CP="This is not a P3P policy"
vary: *
content-length: 43
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Wed, 17 Mar 2021 18:58:07 GMT
server: jag
xserver: anedge-7df884dd44-f7f7f
etag: 3470164111700623360-4622007663672805099
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, no-transform, private
expires: Mon, 15 Mar 2021 18:58:07 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
408 B 19ms
6ms Image
image/gif 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=384393978803312&ev=PageView&dl=https%3A%2F%2Fblog.lumen.com%2Fnew-mozi-malware-family-quietly-amasses-iot-bots%2F&rl=&if=false&ts=1615921087287&sw=1600&sh=1200&v=2.9.33&r=stable&ec=0&o=30&fbp=fb.1.1615921087285.130216705&it=1615921087228&coo=false&rqm=GET

Requested by

Host: blog.lumen.com
URL: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://blog.lumen.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 16 Mar 2021 18:58:07 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Tue, 16 Mar 2021 18:58:07 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
212 B 19ms
6ms Image
image/gif 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=384393978803312&ev=NAESiteVisit&dl=https%3A%2F%2Fblog.lumen.com%2Fnew-mozi-malware-family-quietly-amasses-iot-bots%2F&rl=&if=false&ts=1615921087289&sw=1600&sh=1200&v=2.9.33&r=stable&ec=1&o=30&fbp=fb.1.1615921087285.130216705&it=1615921087228&coo=false&rqm=GET

Requested by

Host: blog.lumen.com
URL: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://blog.lumen.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 16 Mar 2021 18:58:07 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Tue, 16 Mar 2021 18:58:07 GMT

GET
H2 200 dc_pre=CMrRkpO_te8CFQyr1Qodd5sJoA;src=9129572;type=audie0;cat=tdnae002;ord=1;num=4868752723814;gtm=2od330;auiddc=*;u1=https%3A%2F%2Fblog.lumen.com%2Fnew-mozi-malware-family-quietly-amasses-iot-bots...
adservice.google.com/ddm/fls/z/ Frame D366 42 B
107 B 44ms
43ms Image
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CMrRkpO_te8CFQyr1Qodd5sJoA;src=9129572;type=audie0;cat=tdnae002;ord=1;num=4868752723814;gtm=2od330;auiddc=*;u1=https%3A%2F%2Fblog.lumen.com%2Fnew-mozi-malware-family-quietly-amasses-iot-bots%2F;u3=ctl%7Cblog%7Cnew-mozi-malware-family-quietly-amasses-iot-bots;u4=70116968814373863882098440057776203657;u6=;~oref=https%3A%2F%2Fblog.lumen.com%2Fnew-mozi-malware-family-quietly-amasses-iot-bots%2F

Requested by

Host: 9129572.fls.doubleclick.net
URL: https://9129572.fls.doubleclick.net/activityi;dc_pre=CMrRkpO_te8CFQyr1Qodd5sJoA;src=9129572;type=audie0;cat=tdnae002;ord=1;num=4868752723814;gtm=2od330;auiddc=2099659997.1615921087;u1=https%3A%2F%2Fblog.lumen.com%2Fnew-mozi-malware-family-quietly-amasses-iot-bots%2F;u3=ctl%7Cblog%7Cnew-mozi-malware-family-quietly-amasses-iot-bots;u4=70116968814373863882098440057776203657;u6=;~oref=https%3A%2F%2Fblog.lumen.com%2Fnew-mozi-malware-family-quietly-amasses-iot-bots%2F?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://9129572.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 16 Mar 2021 18:58:07 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dc_pre=CPzQkpO_te8CFWqgUQodIVwGxQ;src=9129572;type=audie0;cat=tdnae00;ord=9451237117431;gtm=2od330;auiddc=*;u1=https%3A%2F%2Fblog.lumen.com%2Fnew-mozi-malware-family-quietly-amasses-iot-bots%2F;u3=...
adservice.google.com/ddm/fls/z/ Frame 48C1 42 B
107 B 43ms
42ms Image
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CPzQkpO_te8CFWqgUQodIVwGxQ;src=9129572;type=audie0;cat=tdnae00;ord=9451237117431;gtm=2od330;auiddc=*;u1=https%3A%2F%2Fblog.lumen.com%2Fnew-mozi-malware-family-quietly-amasses-iot-bots%2F;u3=ctl%7Cblog%7Cnew-mozi-malware-family-quietly-amasses-iot-bots;u4=70116968814373863882098440057776203657;u6=;~oref=https%3A%2F%2Fblog.lumen.com%2Fnew-mozi-malware-family-quietly-amasses-iot-bots%2F

Requested by

Host: 9129572.fls.doubleclick.net
URL: https://9129572.fls.doubleclick.net/activityi;dc_pre=CPzQkpO_te8CFWqgUQodIVwGxQ;src=9129572;type=audie0;cat=tdnae00;ord=9451237117431;gtm=2od330;auiddc=2099659997.1615921087;u1=https%3A%2F%2Fblog.lumen.com%2Fnew-mozi-malware-family-quietly-amasses-iot-bots%2F;u3=ctl%7Cblog%7Cnew-mozi-malware-family-quietly-amasses-iot-bots;u4=70116968814373863882098440057776203657;u6=;~oref=https%3A%2F%2Fblog.lumen.com%2Fnew-mozi-malware-family-quietly-amasses-iot-bots%2F?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://9129572.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 16 Mar 2021 18:58:07 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 iframe_api Show response
www.youtube.com/ 810 B
659 B 23ms
23ms Script
text/javascript 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/iframe_api

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/c58e7dfcc1ae/65c3c535dbf4/launch-22e49494a283.min.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

a6f5d0168fe2630efb22b8c891766e987596dfd8dc01696dcc8b58bd9c2acac9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://blog.lumen.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 16 Mar 2021 18:58:07 GMT
content-encoding: br
x-content-type-options: nosniff
server: ESF
x-frame-options: SAMEORIGIN
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
cache-control: private, max-age=0
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000
content-type: text/javascript; charset=utf-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
expires: Tue, 16 Mar 2021 18:58:07 GMT

POST
H/1.1 204
No Content mod_pagespeed_beacon Show response
blog.lumen.com/ 0
216 B 191ms
191ms XHR
text/plain 50.112.230.199
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.lumen.com/mod_pagespeed_beacon?url=https%3A%2F%2Fblog.lumen.com%2Fnew-mozi-malware-family-quietly-amasses-iot-bots%2F

Requested by

Host: blog.lumen.com
URL: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

50.112.230.199 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-50-112-230-199.us-west-2.compute.amazonaws.com

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Frame-Options	https://discover.lumen.com

Request headers

Referer: https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

Date: Tue, 16 Mar 2021 18:58:07 GMT
Cache-Control: max-age=0, no-cache
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=2, max=90
X-Frame-Options: https://discover.lumen.com

GET
H3-Q050 200 www-widgetapi.js Show response
www.youtube.com/s/player/b2e56c01/www-widgetapi.vflset/ 108 KB
38 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/b2e56c01/www-widgetapi.vflset/www-widgetapi.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/iframe_api

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4f81591ca3d32d431084702c1941be16fada77ee7768f41401b0d2fb76d5ef01

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://blog.lumen.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 15:47:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 15 Mar 2021 00:15:17 GMT
server: sffe
age: 97810
vary: Accept-Encoding, Origin
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39074
x-xss-protection: 0
expires: Tue, 15 Mar 2022 15:47:57 GMT

GET
H3-Q050 200 tqiYhn2fQIY Show response
www.youtube.com/embed/ Frame 5372 51 KB
21 KB 56ms
56ms Document
text/html 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/embed/tqiYhn2fQIY?rel=0&enablejsapi=1&origin=https://blog.lumen.com

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/c58e7dfcc1ae/65c3c535dbf4/launch-22e49494a283.min.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

1346bf253bc107b80f01b357a419723baa3050cccee97a0fbc08bb5469e1baf1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.youtube.com
:scheme: https
:path: /embed/tqiYhn2fQIY?rel=0&enablejsapi=1&origin=https://blog.lumen.com
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://blog.lumen.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: YSC=4V4CU-N5ZV0; VISITOR_INFO1_LIVE=GlXbV8OeS9k
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://blog.lumen.com/

Response headers

content-type: text/html; charset=utf-8
x-content-type-options: nosniff
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Tue, 16 Mar 2021 18:58:07 GMT
strict-transport-security: max-age=31536000
content-encoding: br
server: ESF
x-xss-protection: 0
set-cookie: CONSENT=PENDING+688; expires=Fri, 01-Jan-2038 00:00:00 GMT; path=/; domain=.youtube.com
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST atr
www.youtube.com/api/stats/ Frame 5372 0
0

POST
H2 200 /
www.facebook.com/tr/ 0
83 B 6ms
6ms Other
text/plain 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://blog.lumen.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryaXePYy0zdHYtGgdX

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
server: proxygen-bolt
date: Tue, 16 Mar 2021 18:58:07 GMT
content-type: text/plain
access-control-allow-origin: https://blog.lumen.com
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 0

GET
H3-Q050 200 www-player-webp.css
www.youtube.com/s/player/b2e56c01/ Frame 5372 341 KB
51 KB 8ms
7ms Stylesheet
text/css 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/b2e56c01/www-player-webp.css

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/tqiYhn2fQIY?rel=0&enablejsapi=1&origin=https://blog.lumen.com

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4f3d44464550faae5daa4a090d801ef80ffb455b2c82e9a41b2864b1b5edc7c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/embed/tqiYhn2fQIY?rel=0&enablejsapi=1&origin=https://blog.lumen.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 15:45:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 15 Mar 2021 00:15:17 GMT
server: sffe
age: 97947
vary: Accept-Encoding, Origin
content-type: text/css
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 52229
x-xss-protection: 0
expires: Tue, 15 Mar 2022 15:45:40 GMT

GET
H3-Q050 200 www-embed-player.js Show response
www.youtube.com/s/player/b2e56c01/www-embed-player.vflset/ Frame 5372 161 KB
58 KB 9ms
9ms Script
text/javascript 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/b2e56c01/www-embed-player.vflset/www-embed-player.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/tqiYhn2fQIY?rel=0&enablejsapi=1&origin=https://blog.lumen.com

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4e82bd8f567840279d47dc169ac57460b3195b6e9d8c138964534620fcbdce6f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/embed/tqiYhn2fQIY?rel=0&enablejsapi=1&origin=https://blog.lumen.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 15:45:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 15 Mar 2021 00:15:17 GMT
server: sffe
age: 97947
vary: Accept-Encoding, Origin
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 59637
x-xss-protection: 0
expires: Tue, 15 Mar 2022 15:45:40 GMT

GET
H3-Q050 200 base.js Show response
www.youtube.com/s/player/b2e56c01/player_ias.vflset/en_US/ Frame 5372 2 MB
505 KB 11ms
10ms Script
text/javascript 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/b2e56c01/player_ias.vflset/en_US/base.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/tqiYhn2fQIY?rel=0&enablejsapi=1&origin=https://blog.lumen.com

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1ec9dc99e8e7db9c1048749c68a76e2738e2a60ffa59dc79bad31f8f6eab5bba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/embed/tqiYhn2fQIY?rel=0&enablejsapi=1&origin=https://blog.lumen.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 15:46:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 15 Mar 2021 00:15:17 GMT
server: sffe
age: 97915
vary: Accept-Encoding, Origin
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 517196
x-xss-protection: 0
expires: Tue, 15 Mar 2022 15:46:12 GMT

GET
H3-Q050 200 fetch-polyfill.js Show response
www.youtube.com/s/player/b2e56c01/fetch-polyfill.vflset/ Frame 5372 8 KB
3 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/b2e56c01/fetch-polyfill.vflset/fetch-polyfill.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/tqiYhn2fQIY?rel=0&enablejsapi=1&origin=https://blog.lumen.com

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

de6c4ffa2bd9fd283610e28d0db2ec48607aab39d213a51aef248673a0a7e980

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/embed/tqiYhn2fQIY?rel=0&enablejsapi=1&origin=https://blog.lumen.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 15:45:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 15 Mar 2021 00:15:17 GMT
server: sffe
age: 97945
vary: Accept-Encoding, Origin
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3027
x-xss-protection: 0
expires: Tue, 15 Mar 2022 15:45:42 GMT

GET
H3-Q050 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 5372 15 KB
15 KB 11ms
11ms Font
font/woff2 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/tqiYhn2fQIY?rel=0&enablejsapi=1&origin=https://blog.lumen.com

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://www.youtube.com
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 11 Mar 2021 19:41:25 GMT
x-content-type-options: nosniff
last-modified: Mon, 16 Oct 2017 17:32:55 GMT
server: sffe
age: 429402
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15344
x-xss-protection: 0
expires: Fri, 11 Mar 2022 19:41:25 GMT

GET
H3-Q050 200 id Show response
googleads.g.doubleclick.net/pagead/ Frame 5372 113 B
183 B 38ms
38ms XHR
application/json 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/id

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/b2e56c01/www-embed-player.vflset/www-embed-player.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ed989c61663a06e1b846f61ae0e2d08d7c3943e6f28aa8b14bf07b347b48f564

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 16 Mar 2021 18:58:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 133
x-xss-protection: 0
pragma: no-cache
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://www.youtube.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 ad_status.js Show response
static.doubleclick.net/instream/ Frame 5372 29 B
393 B 34ms
20ms Script
text/javascript 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.doubleclick.net/instream/ad_status.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/b2e56c01/www-embed-player.vflset/www-embed-player.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eed0dc1fdb5d97ed188ae16fd5e1024a5bb744af47340346be2146300a6c54b9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 16 Mar 2021 18:56:04 GMT
x-content-type-options: nosniff
last-modified: Thu, 12 Dec 2013 23:40:16 GMT
server: sffe
age: 123
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=900
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29
x-xss-protection: 0
expires: Tue, 16 Mar 2021 19:11:04 GMT

GET
H3-Q050 200 remote.js Show response
www.youtube.com/s/player/b2e56c01/player_ias.vflset/en_US/ Frame 5372 97 KB
32 KB 9ms
9ms Script
text/javascript 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/b2e56c01/player_ias.vflset/en_US/remote.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/b2e56c01/player_ias.vflset/en_US/base.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4265eaa975ba51f71d28969829a092f38c84dd0ad29ded35534eefe503db5d24

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/embed/tqiYhn2fQIY?rel=0&enablejsapi=1&origin=https://blog.lumen.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 15:46:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 15 Mar 2021 00:15:17 GMT
server: sffe
age: 97914
vary: Accept-Encoding, Origin
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 32719
x-xss-protection: 0
expires: Tue, 15 Mar 2022 15:46:13 GMT

GET
H3-Q050 200 OqSalp92o-4AtfYt583RauVJYevBmhjij2pcg0zPe10.js Show response
www.google.com/js/bg/ Frame 5372 14 KB
6 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/js/bg/OqSalp92o-4AtfYt583RauVJYevBmhjij2pcg0zPe10.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/b2e56c01/player_ias.vflset/en_US/base.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3aa49a969f76a3ee00b5f62de7cdd16ae54961ebc19a18e28f6a5c834ccf7b5d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 14 Mar 2021 19:38:00 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Mon, 08 Mar 2021 18:00:00 GMT
server: sffe
age: 170407
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5732
x-xss-protection: 0
expires: Mon, 14 Mar 2022 19:38:00 GMT

GET
H3-Q050 200 embed.js Show response
www.youtube.com/s/player/b2e56c01/player_ias.vflset/en_US/ Frame 5372 23 KB
7 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/b2e56c01/player_ias.vflset/en_US/embed.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/b2e56c01/player_ias.vflset/en_US/base.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5d61ca3e7e8a15ea0b45ae62105c7fbb784d5f89137e0d5fd411f3d603511346

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/embed/tqiYhn2fQIY?rel=0&enablejsapi=1&origin=https://blog.lumen.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 15:46:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 15 Mar 2021 00:15:17 GMT
server: sffe
age: 97914
vary: Accept-Encoding, Origin
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7323
x-xss-protection: 0
expires: Tue, 15 Mar 2022 15:46:13 GMT

GET
DATA 200
OK truncated
/ Frame 5372 175 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 67ea46bc3d15351067faccb3613bd833dd3f15137a4b4a09f2e873fd41d024d2

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-Q050 200 AAUvwnjqoBY1VfwKn2TE2pGY4mAMv589d3y2m1XPiJMc=s68-c-k-c0x00ffffff-no-rj
yt3.ggpht.com/ytc/ Frame 5372 1 KB
2 KB 27ms
14ms Image
image/jpeg 2a00:1450:4001:803::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://yt3.ggpht.com/ytc/AAUvwnjqoBY1VfwKn2TE2pGY4mAMv589d3y2m1XPiJMc=s68-c-k-c0x00ffffff-no-rj

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/tqiYhn2fQIY?rel=0&enablejsapi=1&origin=https://blog.lumen.com

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

84c63f9a0a37a08acf57e5c8a8c76c8955fb720f7a08f3a8153088e09ef0b559

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 16 Mar 2021 15:05:41 GMT
x-content-type-options: nosniff
age: 13946
content-disposition: inline;filename="unnamed.jpg"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1215
x-xss-protection: 0
server: fife
etag: "v9"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sat, 27 Feb 2021 18:04:00 GMT

GET
H3-Q050 200 sddefault.webp
i.ytimg.com/vi_webp/tqiYhn2fQIY/ Frame 5372 19 KB
19 KB 36ms
22ms Image
image/webp 2a00:1450:4001:80e::2016
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.ytimg.com/vi_webp/tqiYhn2fQIY/sddefault.webp

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/tqiYhn2fQIY?rel=0&enablejsapi=1&origin=https://blog.lumen.com

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2016 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c503eecf1acd77cd695259e9c52e65efb25ca415f9ab2f1c32bd30bbfcec35e2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 16 Mar 2021 17:59:25 GMT
x-content-type-options: nosniff
server: sffe
age: 3522
etag: "1599943083"
vary: Origin
content-type: image/webp
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19308
x-xss-protection: 0
expires: Tue, 16 Mar 2021 19:59:25 GMT

GET
H3-Q050 200 cast_sender.js Show response
www.gstatic.com/cv/js/sender/v1/ Frame 5372 4 KB
2 KB 66ms
52ms Script
text/javascript 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/cv/js/sender/v1/cast_sender.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/b2e56c01/player_ias.vflset/en_US/base.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ee147e859ad0f09aa50367974e38ab53e7c7054c4a51d400a7f45b0eb251454f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 16 Mar 2021 18:58:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 16 Feb 2021 23:57:06 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2007
x-xss-protection: 0
expires: Tue, 16 Mar 2021 18:58:07 GMT

GET
H3-Q050 204 generate_204
www.youtube.com/ Frame 5372 0
36 B 6ms
5ms Image
text/plain 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.youtube.com/generate_204?xL7NQA
Requested by: Host: www.youtube.com
URL: https://www.youtube.com/embed/tqiYhn2fQIY?rel=0&enablejsapi=1&origin=https://blog.lumen.com
Protocol: H3-Q050
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.youtube.com/embed/tqiYhn2fQIY?rel=0&enablejsapi=1&origin=https://blog.lumen.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 16 Mar 2021 18:58:08 GMT
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

POST
H3-Q050 200 log_event Show response
www.youtube.com/youtubei/v1/ Frame 5372 28 B
224 B 20ms
19ms XHR
application/json 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/b2e56c01/www-embed-player.vflset/www-embed-player.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

d7d5e54ad1e33d7ab49c664323ced79cb9723ff15e9764cd0edc3e15208e8336

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json
X-YouTube-Utc-Offset: 60
X-YouTube-Client-Name: 56
Referer: https://www.youtube.com/embed/tqiYhn2fQIY?rel=0&enablejsapi=1&origin=https://blog.lumen.com
X-YouTube-Client-Version: 1.20210314.0.0
X-YouTube-Time-Zone: Europe/Berlin
X-Goog-Visitor-Id: CgtHbFhiVjhPZVM5ayi__8OCBg%3D%3D
X-YouTube-Ad-Signals: dt=1615921087830&flash=0&frm=2&u_tz=60&u_his=3&u_java&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug&u_nmime&bc=31&bih=-12245933&biw=-12245933&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C560%2C316&vis=1&wgl=true&ca_type=image&bid=ANyPxKrR0evQJIMBNbQk-2AZ1jydCT3Z5uZ2z8hUlFgEizuXprrEVsjzeD69vuDKNH_SLC2VUrIs0R-8U5drJw1jm50CPcCMig

Response headers

date: Tue, 16 Mar 2021 18:58:18 GMT
content-encoding: br
x-content-type-options: nosniff
server: ESF
x-frame-options: SAMEORIGIN
vary: Origin, X-Origin, Referer
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
cache-control: private
content-type: application/json; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31
x-xss-protection: 0
expires: Tue, 16 Mar 2021 18:58:18 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.youtube.com
URL: https://www.youtube.com/api/stats/atr?ns=yt&el=embedded&cpn=QeeGQ6UJJPnCpFGT&docid=tqiYhn2fQIY&ver=2&cmt=0&fs=0&rt=0&euri=https%3A%2F%2Fblog.lumen.com%2F&lact=1003&cl=362833189&mos=0&volume=100&cbr=Chrome&cbrver=89.0.4389.72&c=WEB_EMBEDDED_PLAYER&cver=1.20210314.0.0&cplayer=UNIPLAYER&cos=Windows&cosver=10.0&cplatform=DESKTOP&hl=en_US&cr=DE&len=61&fexp=23969934%2C23983297%2C23991314%2C24001374%2C24005870%2C24006795%2C24007246&vis=3

Verdicts & Comments Add Verdict or Comment

130 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

16 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.demdex.net/	1970-01-19 21:11:13	Name: demdex Value: 77034679176884585461637500979132304431
.youtube.com/	1969-12-31 23:59:59	Name: YSC Value: 4V4CU-N5ZV0
.doubleclick.net/	1970-01-20 02:13:37	Name: IDE Value: AHWqTUkx3_pASTly8MqusLq71gUaK0qbvODhsKpxV6Nne1Tz3ya8vJ-TaFwn75bf
.lumen.com/	1970-01-19 16:52:01	Name: _gat Value: 1
.lumen.com/	1970-01-19 19:01:37	Name: _fbp Value: fb.1.1615921087285.130216705
.blog.lumen.com/	1970-01-20 01:37:37	Name: OptanonConsent Value: isIABGlobal=false&datestamp=Tue+Mar+16+2021+19%3A58%3A07+GMT%2B0100+(Central+European+Standard+Time)&version=6.12.0&hosts=&consentId=908f0530-6064-4bb1-aea9-63d5c919c750&interactionCount=0&landingPath=https%3A%2F%2Fblog.lumen.com%2Fnew-mozi-malware-family-quietly-amasses-iot-bots%2F&groups=1%3A1%2C2%3A1%2C4%3A1
.lumen.com/	1970-01-20 10:23:13	Name: _ga Value: GA1.2.877143443.1615921086
.lumen.com/	1969-12-31 23:59:59	Name: s_cc Value: true
.lumen.com/	1970-01-20 10:23:13	Name: AMCV_AA683BC75245B3880A490D4D%40AdobeOrg Value: -1124106680%7CMCIDTS%7C18703%7CMCMID%7C70116968814373863882098440057776203657%7CMCAAMLH-1616525887%7C6%7CMCAAMB-1616525887%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1615928287s%7CNONE%7CMCAID%7CNONE%7CMCSYNCSOP%7C411-18710%7CvVersion%7C5.2.0
.lumen.com/	1970-01-19 16:52:01	Name: _gat_gtag_UA_41153014_10 Value: 1
.lumen.com/	1970-01-19 19:01:37	Name: _gcl_au Value: 1.1.2099659997.1615921087
.youtube.com/	1970-01-19 21:11:13	Name: VISITOR_INFO1_LIVE Value: GlXbV8OeS9k
blog.lumen.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: rp6nvogbhmkiep4oqgatpfmhcv
.lumen.com/	1970-01-19 16:53:27	Name: _gid Value: GA1.2.91848163.1615921086
.lumen.com/	1969-12-31 23:59:59	Name: AMCVS_AA683BC75245B3880A490D4D%40AdobeOrg Value: 1
.lumen.com/	1970-01-19 16:52:02	Name: gpv_pn Value: ctl%7Cblog%7Cnew-mozi-malware-family-quietly-amasses-iot-bots

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	debug	URL: https://munchkin.marketo.net/159/munchkin.js(Line 22) Message: Munchkin.init("%s") options: 926-HYV-740 [object Object]
console-api	warning	URL: https://connect.facebook.net/en_US/fbevents.js(Line 23) Message: [Facebook Pixel] - You are sending a non-standard event 'NAESiteVisit'. The preferred way to send these events is using trackCustom. See 'https://developers.facebook.com/docs/ads-for-websites/pixel-events/#events' for more information.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Frame-Options	https://discover.lumen.com

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

9129572.fls.doubleclick.net
adservice.google.com
assets.adobedtm.com
blog.lumen.com
cdn.cookielaw.org
cdnssl.clicktale.net
centurylink.demdex.net
cm.everesttech.net
connect.facebook.net
dpm.demdex.net
fonts.googleapis.com
fonts.gstatic.com
geolocation.onetrust.com
googleads.g.doubleclick.net
i.ytimg.com
images-cdn.newscred.com
munchkin.marketo.net
px.ads.linkedin.com
smetrics.centurylink.com
static.addtoany.com
static.doubleclick.net
stats.g.doubleclick.net
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.gstatic.com
www.linkedin.com
www.youtube.com
yt3.ggpht.com
www.youtube.com
142.250.185.230
15.237.136.106
2600:9000:211e:9800:f:fcff:7940:93a1
2606:4700:10::6814:b844
2606:4700:10::ac43:2794
2606:4700::6810:9440
2620:119:50e4:101::6cae:b55
2620:1ec:21::14
2a00:1450:4001:800::2003
2a00:1450:4001:800::200e
2a00:1450:4001:803::2001
2a00:1450:4001:803::2008
2a00:1450:4001:809::2003
2a00:1450:4001:80e::2006
2a00:1450:4001:80e::2016
2a00:1450:4001:80f::2003
2a00:1450:4001:810::2002
2a00:1450:4001:810::2003
2a00:1450:4001:810::2004
2a00:1450:4001:813::2004
2a00:1450:4001:813::200e
2a00:1450:4001:827::2008
2a00:1450:4001:827::200e
2a00:1450:4001:828::2002
2a00:1450:4001:829::2002
2a00:1450:4001:829::200a
2a00:1450:400c:c09::9b
2a00:1450:400c:c0c::9d
2a02:26f0:10c:4a5::1e80
2a02:26f0:1700:38c::2db0
2a03:2880:f02d:12:face:b00c:0:3
2a03:2880:f12d:83:face:b00c:0:25de
34.253.145.149
50.112.230.199
52.17.73.77
88.221.60.75
008a1d103902f15fdb1c191fcb1ce8954330e7b8de43d09abb08555ba609f420
02e87da822ac986c75223804fa7b867343ac35df9c9c022cbbcbeda040e83569
0486530f1e98818865754a08e1b5442ac5a6a36a6bf6042e3b3338a532e998d2
0757f7ff6e5f6a581922a5e2d42c5e0cf7475d880885a9802e8bdd5e4188dd34
0939e46fe6e5cfa377f5256a4ab8b71443f972de88c9234f29c53f42a1bb1712
0c75d452f31db2e3597de899da1030a5482b121f6bbad925606c6acc7e4f6190
0dd1eb5d05ab00522c9faa40376de66157d61877f8586a9179f710ad7b8f0a4f
0e658d0bb714995cd0977ceee3392ddbc2a21fd77ebef662f8fa112a718da8ac
0e6afb6c84dc34efaa387df4a35c59497059606826e161c4825eeab8009d0508
0edd6b41260434bd366c0aa048e8f33fdf659603f62f1a997ca64c03b3f004be
0f3be44690ae9914ae3e47b7752e1bdea316f09938e9094f99e0de19ccd8987a
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
13325828883928a094f076ae64cc942ee542c9d38b405397cccb4757aee0c734
1346bf253bc107b80f01b357a419723baa3050cccee97a0fbc08bb5469e1baf1
1490910b508b1bc1ff2c9953fb0837b98e4733e25e83496c6f325463ad122e97
16f21dbcc45584c1196fdde65f7eb25ea05759ca9e05fbb0694cc3bee71604ab
1b94f9074fc2ef1b63132fc70fe244cc5d5322e5982a80b6273a45a935ae335f
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df
1e85ec81b9800b4c443d39caca0d0926089a3ac201120db1ceb45b93789480b8
1ec9dc99e8e7db9c1048749c68a76e2738e2a60ffa59dc79bad31f8f6eab5bba
20a84f304abfaf56bb829a84199344bca40bf7d4dba451e109a840cbdf728436
214941d5a39aa06a611b8c92857ca06015355cc867b4fea16d46d0056cd4e760
21c1a8787305236f67b83c93c642471b80a5503176044399eb6e2b1bc98c0e5d
26500e258c44472f70b852592d16dabd8260ea07db06d5da22a9a9e60ee8c414
27bd3b47f7d1b9adb2575bbf0e960d25fdb28b2e1610d335bf42c62177a32a28
32277d02eac332d26639c6c9dd6909c6acc53f46e816614182c9d7ca6fe67210
36f49c3349b36ba14678127a8cd6c90108b403a591824c0266d5cc1da2a8f10a
37d2b5eadcb8c0cece3d129b2b69dcf40198cfd4c53c9addba8f6bebd85ec91e
3a1187097630a483fb7feb35f8cf67b069777034b88e4c088c82256c4be588a0
3aa49a969f76a3ee00b5f62de7cdd16ae54961ebc19a18e28f6a5c834ccf7b5d
3df26e7c1926b93582c537a4e7e164775c98b0e2cbbb8fca4492e4617ab4b78c
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
3f4c554de6bd81dbb5f6cfec913e8f8ce8a76cbb16cbfdeabb96efdd4243b4c1
4265eaa975ba51f71d28969829a092f38c84dd0ad29ded35534eefe503db5d24
435bfd29d257cc1e948ef62f88e07a41ee836cfdbb6d775ee48ffca764636e64
458c5de5d7f31cd810ad073e84f5160d4abcbc07a3d94e634bd5cbfda55eec76
459e23d23ffe65a86f3a1f67c07edc92e0c69461ff83fbd63764d7b36cac92fc
4e82bd8f567840279d47dc169ac57460b3195b6e9d8c138964534620fcbdce6f
4f3d44464550faae5daa4a090d801ef80ffb455b2c82e9a41b2864b1b5edc7c2
4f81591ca3d32d431084702c1941be16fada77ee7768f41401b0d2fb76d5ef01
5012972953bac6293f8af3138102e6870b5aa9e04a8385c00f629063222639c4
50679e0e3933c945348a2db0cc128bb14b57a60a74fabf8cae13acc14efbb2e1
50f82bda03703f719cff748e32ecd69e4724092fe2ae76a522e4270ff133d6ce
5212e75a28109076157426098aa6103bc7c22577ee27d0a7eaa22312e2879611
537b0c4d86ce61f6e50bbd36d8c206260b6914ab8f5dea27bad195d33b71ebc1
5a87da688bb4ee5a5fc733416d7200546ca989356bee3bf24765bbb9eed111c1
5c9623fa4cd352771494422b6c41e4713c78333b8ac533e131a6d399d608f104
5cc2628039ee08964a5f46fb8abb1d5e1ec87e1200d12862ef1232bbfed7da55
5d61ca3e7e8a15ea0b45ae62105c7fbb784d5f89137e0d5fd411f3d603511346
5f2368721bf7acabb8738582ae7d860790a9b5225f5ca64582e32c7f0608d644
622bd29e595894b02f5c5ab95628f99d6e6d46483bac342b4fff38bbc64a8a35
63a6d926d277a3d64d30e349fa0ea2b0630e9801d173e1947ff3bd6060147ef4
64a30f69c089200aa04feea4210151b0dc611148971699787feac074e38fd832
67ea46bc3d15351067faccb3613bd833dd3f15137a4b4a09f2e873fd41d024d2
6829c1878e43fdd02c7244b48260f1ff88f6fcac41d1c301ba0ae1377e73a445
69f06f02087358cfdf71ea8c1db996682a2b35ff4cadc602c00c3f4d20071fd9
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6ca28839ba7e005b11dcf8d6de4c24f13f2cc988393ed7a570c41ee88ab092fc
6e6007f22b1ae1aeaad3ad38b730c098b3e698aa2f62194586832f5c24977516
6ebcda7a3a41ef97f0b4071160ceb1020e540fdc0f790079a5c2ef01ab654fe0
7121bfd706495783f9a69331d47a78c6fe56e56b614f87330bcbd5a04df30474
72e1f4b24380d6707ac1181f875e255dd37b71628602b59523f854b63b619429
76c12f9f4902c87beddf6c8fd4ca4a092f6ac696263cb7e9e44230c0ece27eae
785691245376d470ef742734e34c4d5907a26242bb8f21dbc9a50cfeaa86be42
7b5fc275c98a58b1073a713920cefa54fab60ad9d85a67cf6907aaf8fbb3c474
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
7dacf83f51179de8d7980a513e67ab3a08f2c6272bb5946df8fd77c0d1763b73
7e29c072a03e9825f54a07dbecb8cbd7f1fc934fa4886692717e18b3d393f8ff
80ccff5d5ffccfb54d9645d87ee2def16f0dbc4354edee193f87f7156088fdd7
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84c63f9a0a37a08acf57e5c8a8c76c8955fb720f7a08f3a8153088e09ef0b559
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
85b3833b74166fdd5117d2932dfd70194654224487768a33450ac6fae2eaabf2
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7
8a823c69222e7e596cb40af4b5145ad2de4e371b2af364fecf7aafe898bec3d9
8c0301b3dba5061632d7321cd8bb7bd527f48288d5cb15ff614ea0c1dcc1ad69
8c626f0f9b5c109539b256b73e72c02b300a184f46b4535c2eb86599215c78af
8e8230f2d1e6e230d63f5bd3091ea092eb8d1f447b5f6c84c5b776cf4f50a65d
91a6dd643e76992bb7ef691f48a040b8621bf4c1cafad90f999d0f2b2d6010a8
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
96c76a7af27cb509867c24dc39e493bf5d3a3c7abcabc7c1ee56a3907a495cf2
9b75673e1929973dc3d72cd1089dba19b1f7c659091c9201c244dd73624afacd
9e7ea2b4ba8e2bcc4a964d6192e4671dc5f6863a1c7e35b52b229a3c1e67a68d
9f2ae0cd6aba41f079d3ee56c0518081cafd8704bf8f6336df2553c48ea0f52b
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a21b30b2a786682f0d591c7efecd653f038607546881ada1af46a9a25850e789
a26c94b741461917251ee87baa31120f6534528a50d16056548e1b4c564812bf
a3e72097d14d7b806d713203903cad54361712292ba3e851ae30e3f06107f5bb
a6f5d0168fe2630efb22b8c891766e987596dfd8dc01696dcc8b58bd9c2acac9
ad0d07fb08891d54edd452e54b864a671d6427547cadbb85cc95cadc9b9edd3b
af7fc9737422788530fa18e1bc056ec26078ff72f2b1da78b04f8a5b21e89d07
b28123c901bc9556103cc09f2268041ce9b2e0f5128b9a5e82c5efd450358920
b4d07892cde715d50bb69c1982df496385d1dfd8f9d1867c31f19a3c8634cfae
b52cc4be6a05df6efda2ceb5ecdf84f34f97a70ebc8c65751cb4b3bf97030ea2
b581ad07a822854930eeba93f78b22faf87c7647ddf1ca2ce265d731b82d888d
bc73d188090ccf54462917db72c1cc11fc803e1ef26b1ef397d542690bed3fdf
bd3bd81ea6cf3bbc82f89913fecca492e79318fef844c664a790ff2db72e5590
c503eecf1acd77cd695259e9c52e65efb25ca415f9ab2f1c32bd30bbfcec35e2
c55e2307202fb04c390eea7a3355f0736c248c4427cb330123d3dae05c2d55ef
c6889bb907bfa553105207650d530aece44a5a364df31822f9ee618d927fb80d
cbe20461a1710866e2834c9ce87f0f31d61ef09ba3db1d9eca72b957dfc066b9
d12e293148f372449f7667ae6b0dea6251ef13ee64c5cca9dc46886f97786734
d4136390257ec223f983e045417585b67e9621bd8773cd5baa4cd1b2face05f2
d5b071fda01315f271998e251812dcf8465dcf34bb9e436bb502235700c40eac
d6b423c91328eec9c218dd8b21ae1e676987d574e5432411a32806e5dd2bde32
d7d5e54ad1e33d7ab49c664323ced79cb9723ff15e9764cd0edc3e15208e8336
d98430b79bd481c608eb50058778fc3a919b996494f209c1546d11280d7bc14f
da1ba35a2a2d6ce67672b81a8bd061e3eb6cfdb6d7369252c89b059150631787
dbfb69d1031a947b7794a20d38f0d34f17608d4e7f74026f6920c916dd45101d
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
de6c4ffa2bd9fd283610e28d0db2ec48607aab39d213a51aef248673a0a7e980
df01ed1e908e5eb47cc14dc28740b10c1afe81e2b7d1e4aa592f3e08a81f7e30
e1a14e5eaf9894bf95b58aa8afa56fea3f01385e3acae98fe5229f9d706ec073
e30f848c353b8ab801c18d2109527cb32a27f145262dccb3cd4db9f309cc53bb
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e701b8c32867d0e3d7421103495316d2b3709ca3568a83bfad9ea816f12aaf6d
ec780ced174689407a04e1b0fbe0838fe37153421971ecaa81d18f4b1a969934
ed989c61663a06e1b846f61ae0e2d08d7c3943e6f28aa8b14bf07b347b48f564
ee147e859ad0f09aa50367974e38ab53e7c7054c4a51d400a7f45b0eb251454f
eed0dc1fdb5d97ed188ae16fd5e1024a5bb744af47340346be2146300a6c54b9
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f0c7be55f463c02bbd134c6e2afd2e4137a16468073856266042151fb8057609
f56a7261891c1aac6141dc84cec4561ecc7db6d48514540ad26695ef673bbac2
f6bf08b8b4f9ff55ad2ebc9113cb57ecc052a9c24658a95b717c5b24cdfc4565
f9c9cfec3a47c38750e96d40e8556429d91745a9a678de18fcb5cbfd10f02fe0
fb267645649f8c0c35b5e1731fb8ce8b7292513621aeb9009b3ba8dcb36310af
fd96d9b3f117bd211bf9c6450e287560b6bcc50871852a51b46271c6bb26c520

blog.lumen.com Open in urlscan Pro 50.112.230.199 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

147 Requests

99 %HTTPS

83 %IPv6

24 Domains

31 Subdomains

34 IPs

5 Countries

2901 kBTransfer

8229 kBSize

16 Cookies

30 Outgoing links

Redirected requests

147 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

blog.lumen.com Open in urlscan Pro
50.112.230.199 Public Scan

Screenshot
Live screenshot

Full Image

147
Requests

99 %
HTTPS

83 %
IPv6

24
Domains

31
Subdomains

34
IPs

5
Countries

2901 kB
Transfer

8229 kB
Size

16
Cookies

147 HTTP transactions
3 data transactions