blogs.vmware.com Open in urlscan Pro
2a02:26f0:1700:78e::2ef Public Scan

Go To Rescan
Add Verdict Report

URL:
https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html
Submission: On November 16 via api (November 16th 2022, 8:45:22 pm UTC) from DE — Scanned from DE

Summary HTTP 76 Redirects Links 43 Behaviour Indicators

Summary

This website contacted 10 IPs in 4 countries across 8 domains to perform 76 HTTP transactions. The main IP is 2a02:26f0:1700:78e::2ef, located in Frankfurt am Main, Germany and belongs to AKAMAI-ASN1, NL. The main domain is blogs.vmware.com. The Cisco Umbrella rank of the primary domain is 201213.
TLS certificate: Issued by DigiCert TLS RSA SHA256 2020 CA1 on May 22nd 2022. Valid for: a year.

This is the only time blogs.vmware.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
49	2a02:26f0:170... 2a02:26f0:1700:78e::2ef	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
5	23.35.236.209 23.35.236.209	16625 (AKAMAI-AS) (AKAMAI-AS)
3 3	2a04:fa87:fff... 2a04:fa87:fffe::c000:4902	2635 (AUTOMATTIC) (AUTOMATTIC)
3	192.0.77.2 192.0.77.2	2635 (AUTOMATTIC) (AUTOMATTIC)
7	2606:4700::68... 2606:4700::6810:9540	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a02:26f0:340... 2a02:26f0:3400:195::11a6	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1 3	2600:9000:206... 2600:9000:206f:dc00:4:d08a:2c40:93a1	16509 (AMAZON-02) (AMAZON-02)
5	2600:9000:206... 2600:9000:206f:de00:1b:f6e1:4540:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2a02:26f0:470... 2a02:26f0:4700:290::11a6	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2606:4700::68... 2606:4700::6812:1a55	13335 (CLOUDFLAR...) (CLOUDFLARENET)
76	10

49 2a02:26f0:1700:78e::2ef (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

blogs.vmware.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.vmware.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 23.35.236.209 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-35-236-209.deploy.static.akamaitechnologies.com

tags.tiqcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a04:fa87:fffe::c000:4902 (Ireland) 3 redirects

ASN2635 (AUTOMATTIC, US)

secure.gravatar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 192.0.77.2 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
PTR: i2.wp.com

i1.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2606:4700::6810:9540 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.cookielaw.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:3400:195::11a6 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

s.go-mpulse.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
02179917.akstat.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:9000:206f:dc00:4:d08a:2c40:93a1 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

feedback.esp.vmware.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2600:9000:206f:de00:1b:f6e1:4540:93a1 (United States)

ASN16509 (AMAZON-02, US)

lumos.vmware.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:4700:290::11a6 (Prague, Czech Republic)

ASN20940 (AKAMAI-ASN1, NL)

c.go-mpulse.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:1a55 (United States)

ASN13335 (CLOUDFLARENET, US)

geolocation.onetrust.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
57	vmware.com 1 redirects blogs.vmware.com — Cisco Umbrella Rank: 201213 www.vmware.com — Cisco Umbrella Rank: 40962 feedback.esp.vmware.com — Cisco Umbrella Rank: 32627 lumos.vmware.com — Cisco Umbrella Rank: 68968 lumos.esp.eng.vmware.com Failed	2 MB
7	cookielaw.org cdn.cookielaw.org — Cisco Umbrella Rank: 410	186 KB
5	tiqcdn.com tags.tiqcdn.com — Cisco Umbrella Rank: 944	110 KB
3	wp.com i1.wp.com — Cisco Umbrella Rank: 7457	76 KB
3	gravatar.com 3 redirects secure.gravatar.com — Cisco Umbrella Rank: 1744	724 B
2	go-mpulse.net s.go-mpulse.net — Cisco Umbrella Rank: 1270 c.go-mpulse.net — Cisco Umbrella Rank: 611	51 KB
1	akstat.io 02179917.akstat.io — Cisco Umbrella Rank: 58307	203 B
1	onetrust.com geolocation.onetrust.com — Cisco Umbrella Rank: 690	295 B
76	8

	Domain	Requested by
42	blogs.vmware.com	blogs.vmware.com s.go-mpulse.net
7	cdn.cookielaw.org	tags.tiqcdn.com cdn.cookielaw.org
7	www.vmware.com	blogs.vmware.com www.vmware.com
5	lumos.vmware.com	blogs.vmware.com s.go-mpulse.net
5	tags.tiqcdn.com	blogs.vmware.com tags.tiqcdn.com
3	feedback.esp.vmware.com	1 redirects feedback.esp.vmware.com
3	i1.wp.com	blogs.vmware.com
3	secure.gravatar.com	3 redirects
1	02179917.akstat.io	s.go-mpulse.net
1	geolocation.onetrust.com	cdn.cookielaw.org
1	c.go-mpulse.net	s.go-mpulse.net
1	s.go-mpulse.net	blogs.vmware.com
0	lumos.esp.eng.vmware.com Failed	feedback.esp.vmware.com
76	13

This site contains links to these domains. Also see Links.

Domain
www.vmware.com
communities.vmware.com
carbonblack.vmware.com
twitter.com
www.reddit.com
www.virustotal.com
community.carbonblack.com
www.advancedinstaller.com
news.vmware.com
ir.vmware.com
careers.vmware.com
cloud.vmware.com
docs.vmware.com
www.youtube.com
www.facebook.com
www.linkedin.com
www.onetrust.com

Subject Issuer	Validity	Valid
*.vmware.com DigiCert TLS RSA SHA256 2020 CA1	`2022-05-22` - `2023-05-23`	a year	crt.sh
*.tiqcdn.com DigiCert SHA2 Secure Server CA	`2022-02-27` - `2023-02-28`	a year	crt.sh
cookielaw.org Cloudflare Inc ECC CA-3	`2022-05-01` - `2023-05-01`	a year	crt.sh
akstat.io DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-04-15` - `2023-04-19`	a year	crt.sh
onetrust.com Cloudflare Inc ECC CA-3	`2022-01-12` - `2023-01-12`	a year	crt.sh
lumos.vmware.com Amazon	`2022-07-20` - `2023-08-18`	a year	crt.sh
*.esp.vmware.com Amazon	`2022-03-23` - `2023-04-21`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html
Frame ID: 8B2ADA2DC3F540016BE56F53B305EE95
Requests: 76 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

BATLOADER: The Evasive Downloader Malware - VMware Security Blog - VMwareBack ButtonFilter Button

Detected technologies

Adobe Experience Manager (CMS) Expand

Overall confidence: 100%
Detected patterns

/etc\.clientlibs/

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

Akamai Bot Manager (Security) Expand

Overall confidence: 100%
Detected patterns

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

OneTrust (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

cdn\.cookielaw\.org
otSDKStub\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

76
Requests

93 %
HTTPS

80 %
IPv6

8
Domains

13
Subdomains

10
IPs

4
Countries

2347 kB
Transfer

4967 kB
Size

6
Cookies

43 Outgoing links

These are links going to different origins than the main page.

URL: https://www.vmware.com/

Search URL Search Domain Scan URL

URL: https://communities.vmware.com/
Title: Communities

Search URL Search Domain Scan URL

URL: https://carbonblack.vmware.com/
Title: Tech Zone

Search URL Search Domain Scan URL

URL: https://www.vmware.com/security.html
Title: VMware Security

Search URL Search Domain Scan URL

URL: https://www.vmware.com/resources/security/carbon-black-live-demo.html
Title: Get A Demo

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?url=https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html&text=BATLOADER%3A+The+Evasive+Downloader+Malware
Title: Share on Twitter

Search URL Search Domain Scan URL

URL: https://www.reddit.com/submit?url=https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html&title=BATLOADER%3A+The+Evasive+Downloader+Malware
Title: Share on Reddit

Search URL Search Domain Scan URL

URL: https://www.virustotal.com/gui/file/2c0d8fc0740598fa97c5d1b21edb011c8026740b77029d29c20f3275438ebfbd/detection
Title: this file

Search URL Search Domain Scan URL

URL: https://community.carbonblack.com/t5/Threat-Research-Docs/TAU-TIN-ZLoader/ta-p/98523
Title: TAU-TIN ZLoader

Search URL Search Domain Scan URL

URL: https://www.advancedinstaller.com/powershell-custom-actions-msi.html
Title: here

Search URL Search Domain Scan URL

URL: https://www.vmware.com/company.html
Title: About Us

Search URL Search Domain Scan URL

URL: https://www.vmware.com/company/leadership.html
Title: Executive Leadership

Search URL Search Domain Scan URL

URL: https://news.vmware.com/
Title: News & Stories

Search URL Search Domain Scan URL

URL: https://ir.vmware.com/
Title: Investor Relations

Search URL Search Domain Scan URL

URL: https://www.vmware.com/company/customers.html
Title: Customer Stories

Search URL Search Domain Scan URL

URL: https://www.vmware.com/company/diversity.html
Title: Diversity, Equity & Inclusion

Search URL Search Domain Scan URL

URL: https://www.vmware.com/company/esg.html
Title: Environment, Social & Governance

Search URL Search Domain Scan URL

URL: https://careers.vmware.com/
Title: Careers

Search URL Search Domain Scan URL

URL: https://www.vmware.com/company/acquisitions.html
Title: Acquisitions

Search URL Search Domain Scan URL

URL: https://www.vmware.com/company/office_locations.html
Title: Office Locations

Search URL Search Domain Scan URL

URL: https://cloud.vmware.com/trust-center
Title: VMware Cloud Trust Center

Search URL Search Domain Scan URL

URL: https://news.vmware.com/vmware-global-response-to-covid-19
Title: COVID-19 Resources

Search URL Search Domain Scan URL

URL: https://www.vmware.com/go/customerconnect
Title: VMware Customer Connect

Search URL Search Domain Scan URL

URL: https://www.vmware.com/support/policies.html
Title: Support Policies

Search URL Search Domain Scan URL

URL: https://docs.vmware.com/
Title: Product Documentation

Search URL Search Domain Scan URL

URL: https://www.vmware.com/resources/compatibility/search.php
Title: Compatibility Guide

Search URL Search Domain Scan URL

URL: https://www.vmware.com/download/eula.html
Title: End User Terms & Conditions

Search URL Search Domain Scan URL

URL: https://www.vmware.com/content/dam/digitalmarketing/vmware/en/pdf/company/vmw-modern-slavery-california-statement-2021.pdf
Title: California Transparency Act Statement

Search URL Search Domain Scan URL

URL: https://twitter.com/VMware
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/vmwaretv
Title: YouTube

Search URL Search Domain Scan URL

URL: https://www.facebook.com/vmware
Title: Facebook

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/vmware/mycompany/
Title: LinkedIn

Search URL Search Domain Scan URL

URL: https://www.vmware.com/company/contact_sales.html
Title: Contact Sales

Search URL Search Domain Scan URL

URL: https://www.vmware.com/help/legal.html
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://www.vmware.com/help/privacy/california-privacy-rights.html
Title: Your California Privacy Rights

Search URL Search Domain Scan URL

URL: https://www.vmware.com/help/privacy.html
Title: Privacy

Search URL Search Domain Scan URL

URL: https://www.vmware.com/help/accessibility.html
Title: Accessibility

Search URL Search Domain Scan URL

URL: https://www.vmware.com/site_index.html
Title: Site Map

Search URL Search Domain Scan URL

URL: https://www.vmware.com/help/trademarks.html
Title: Trademarks

Search URL Search Domain Scan URL

URL: https://www.vmware.com/topics/glossary
Title: Glossary

Search URL Search Domain Scan URL

URL: https://www.vmware.com/help.html
Title: Help

Search URL Search Domain Scan URL

URL: https://www.vmware.com/help/privacy/cookie-notice.html
Title: Cookie Policy.

Search URL Search Domain Scan URL

URL: https://www.onetrust.com/products/cookie-consent/

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 20

https://secure.gravatar.com/avatar/8c3400ff217316ed0ff2bee4b61d1ef6?s=70&d=https%3A%2F%2Fuser-images.githubusercontent.com%2F969755%2F61500768-7d535780-a981-11e9-8578-dc6bf989ffb2.png&r=g HTTP 302
https://i1.wp.com/user-images.githubusercontent.com/969755/61500768-7d535780-a981-11e9-8578-dc6bf989ffb2.png?ssl=1

Request Chain 21

https://secure.gravatar.com/avatar/7a6141c3ad82cc6df21a10b76e7af77d?s=70&d=https%3A%2F%2Fuser-images.githubusercontent.com%2F969755%2F61500768-7d535780-a981-11e9-8578-dc6bf989ffb2.png&r=g HTTP 302
https://i1.wp.com/user-images.githubusercontent.com/969755/61500768-7d535780-a981-11e9-8578-dc6bf989ffb2.png?ssl=1

Request Chain 22

https://secure.gravatar.com/avatar/43a9d98249ee028187b4bebc197c0783?s=70&d=https%3A%2F%2Fuser-images.githubusercontent.com%2F969755%2F61500768-7d535780-a981-11e9-8578-dc6bf989ffb2.png&r=g HTTP 302
https://i1.wp.com/user-images.githubusercontent.com/969755/61500768-7d535780-a981-11e9-8578-dc6bf989ffb2.png?ssl=1

Request Chain 53

https://feedback.esp.vmware.com/assets/ipf/esp.js?client_id=esp-prod-131-fxsxf HTTP 303
https://lumos.vmware.com/assets/lumos.js?namespace=esp&client_id=esp-prod-131-fxsxf

76 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request batloader-the-evasive-downloader-malware.html Show response
blogs.vmware.com/security/2022/11/ 91 KB
26 KB 335ms
38ms Document
text/html 2a02:26f0:1700:78e::2ef
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:78e::2ef Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

nginx / PHP/7.4.30

Resource Hash

b1877e7e523910578bdcd6127ddeff087539b01b4ea9c251a523ec7e3d72ff48

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: max-age=0, no-cache, no-store
content-encoding: gzip
content-length: 24791
content-type: text/html; charset=UTF-8
date: Wed, 16 Nov 2022 20:45:16 GMT
dc-pool-id: bgf8w2at
expires: Wed, 16 Nov 2022 20:45:16 GMT
pragma: no-cache
server: nginx
server-timing: cdn-cache; desc=HIT edge; dur=1
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-akamai-transformed: 9 - 0 pmb=mTOE,3mRUM,1
x-frame-options: SAMEORIGIN
x-powered-by: PHP/7.4.30

GET
H2 200 responsive.css
www.vmware.com/content/dam/vmwaredesigns/scrapercontent/ 164 KB
26 KB 126ms
85ms Stylesheet
text/css 2a02:26f0:1700:78e::2ef
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.vmware.com/content/dam/vmwaredesigns/scrapercontent/responsive.css

Requested by

Host: blogs.vmware.com
URL: https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:78e::2ef Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Apache /

Resource Hash

af62bfb9ed9811c4fd15dafcf734659b8cdb86443fbaf183974a15323e29d733

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://*.vmware.com;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blogs.vmware.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Wed, 16 Nov 2022 20:45:17 GMT
content-encoding: gzip
content-security-policy: frame-ancestors 'self' https://*.vmware.com;
server: Apache
access-control-max-age: 1000
access-control-allow-methods: GET
content-type: text/css
vary: Accept-Encoding
dc-pool-id: 4vbxp420
cache-control: public, must-revalidate, max-age=3600
access-control-allow-credentials: true
server-timing: cdn-cache; desc=HIT, edge; dur=1
accept-ranges: bytes
access-control-allow-headers: X-Requested-With, Content-Type, Origin, Authorization, Accept, Client-Security-Token, Accept-Encoding
content-length: 25876

GET
H2 200 style.min.css
blogs.vmware.com/security/wp-includes/css/dist/block-library/ 87 KB
12 KB 77ms
74ms Stylesheet
text/css 2a02:26f0:1700:78e::2ef
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.vmware.com/security/wp-includes/css/dist/block-library/style.min.css?ver=6.0

Requested by

Host: blogs.vmware.com
URL: https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:78e::2ef Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

nginx /

Resource Hash

d678ab3b4e7dddf5615012cc1a930e50dfbc967181b8fbeb1b98d61549f5ed08

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Wed, 16 Nov 2022 20:45:17 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Tue, 17 May 2022 15:43:41 GMT
server: nginx
vary: Accept-Encoding
content-type: text/css
dc-pool-id: dcf6w1ns
cache-control: max-age=3600
server-timing: cdn-cache; desc=HIT, edge; dur=1
accept-ranges: bytes
content-length: 11677

GET
H2 200 g_onetrust.css
blogs.vmware.com/security/wp-content/plugins/onetrust-vmware-mu/css/ 782 B
984 B 75ms
72ms Stylesheet
text/css 2a02:26f0:1700:78e::2ef
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.vmware.com/security/wp-content/plugins/onetrust-vmware-mu/css/g_onetrust.css?ver=6.0

Requested by

Host: blogs.vmware.com
URL: https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:78e::2ef Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

nginx /

Resource Hash

2f090a05f250f0f8854ef4db0a845f890f4c5735b41acf0c9b0a83fda98a4a09

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Wed, 16 Nov 2022 20:45:17 GMT
strict-transport-security: max-age=31536000
last-modified: Mon, 21 Sep 2020 05:37:05 GMT
server: nginx
content-type: text/css
dc-pool-id: bgf8w2at
cache-control: max-age=3600
server-timing: cdn-cache; desc=HIT, edge; dur=1
accept-ranges: bytes
content-length: 782

GET
H2 200 rounded-thumbs.min.css
blogs.vmware.com/security/wp-content/plugins/contextual-related-posts/css/ 1 KB
687 B 76ms
73ms Stylesheet
text/css 2a02:26f0:1700:78e::2ef
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.vmware.com/security/wp-content/plugins/contextual-related-posts/css/rounded-thumbs.min.css?ver=3.2.3

Requested by

Host: blogs.vmware.com
URL: https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:78e::2ef Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

nginx /

Resource Hash

088cb0b5b803bbf57403577861d1f063b6a45fe9fd7adcfab7944f962ac81be9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Wed, 16 Nov 2022 20:45:17 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Tue, 02 Aug 2022 00:37:26 GMT
server: nginx
vary: Accept-Encoding
content-type: text/css
dc-pool-id: bgf8w2at
cache-control: max-age=3600
server-timing: cdn-cache; desc=HIT, edge; dur=1
accept-ranges: bytes
content-length: 465

GET
H2 200 style.css
blogs.vmware.com/security/wp-content/plugins/meks-smart-author-widget/css/ 234 B
436 B 74ms
71ms Stylesheet
text/css 2a02:26f0:1700:78e::2ef
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.vmware.com/security/wp-content/plugins/meks-smart-author-widget/css/style.css?ver=1.1.1

Requested by

Host: blogs.vmware.com
URL: https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:78e::2ef Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

nginx /

Resource Hash

832f350d6d5335f0c7dd62bf45c30d5808a7d35249be1711e699b5ac68ffc9af

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Wed, 16 Nov 2022 20:45:17 GMT
strict-transport-security: max-age=31536000
last-modified: Fri, 07 Feb 2020 12:57:32 GMT
server: nginx
content-type: text/css
dc-pool-id: bgf8w2at
cache-control: max-age=3600
server-timing: cdn-cache; desc=HIT, edge; dur=1
accept-ranges: bytes
content-length: 234

GET
H2 200 main-3089d13a45.css
blogs.vmware.com/security/wp-content/themes/vmware-security-0.2.2/dist/styles/ 256 KB
36 KB 76ms
73ms Stylesheet
text/css 2a02:26f0:1700:78e::2ef
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.vmware.com/security/wp-content/themes/vmware-security-0.2.2/dist/styles/main-3089d13a45.css

Requested by

Host: blogs.vmware.com
URL: https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:78e::2ef Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

nginx /

Resource Hash

fe7f18f5cc3719144a794426f0608bb6ce73bd5f9ad3929a59f8106763dca2d9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Wed, 16 Nov 2022 20:45:17 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Tue, 28 Jun 2022 23:07:24 GMT
server: nginx
vary: Accept-Encoding
content-type: text/css
dc-pool-id: bgf8w2at
cache-control: max-age=3600
server-timing: cdn-cache; desc=HIT, edge; dur=1
accept-ranges: bytes
content-length: 36780

GET
H2 200 g_onetrust.js Show response
blogs.vmware.com/security/wp-content/plugins/onetrust-vmware-mu/js/ 1 KB
841 B 76ms
73ms Script
application/javascript 2a02:26f0:1700:78e::2ef
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.vmware.com/security/wp-content/plugins/onetrust-vmware-mu/js/g_onetrust.js?ver=6.0

Requested by

Host: blogs.vmware.com
URL: https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:78e::2ef Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

nginx /

Resource Hash

6a44c4e95239008073f3d2a30763492443d0a72ba3f31f34c9c097b5a9046c58

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Wed, 16 Nov 2022 20:45:17 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Wed, 19 Aug 2020 11:40:49 GMT
server: nginx
vary: Accept-Encoding
content-type: application/javascript
dc-pool-id: bgf8w2at
cache-control: max-age=3600
server-timing: cdn-cache; desc=HIT, edge; dur=1
accept-ranges: bytes
content-length: 610

GET
H2 200 jquery.min.js Show response
blogs.vmware.com/security/wp-includes/js/jquery/ 87 KB
31 KB 75ms
73ms Script
application/javascript 2a02:26f0:1700:78e::2ef
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.vmware.com/security/wp-includes/js/jquery/jquery.min.js?ver=3.6.0

Requested by

Host: blogs.vmware.com
URL: https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:78e::2ef Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

nginx /

Resource Hash

bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Wed, 16 Nov 2022 20:45:17 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Wed, 10 Mar 2021 15:07:24 GMT
server: nginx
vary: Accept-Encoding
content-type: application/javascript
dc-pool-id: bgf8w2at
cache-control: max-age=3600
server-timing: cdn-cache; desc=HIT, edge; dur=1
accept-ranges: bytes
content-length: 30953

GET
H2 200 jquery-migrate.min.js Show response
blogs.vmware.com/security/wp-includes/js/jquery/ 11 KB
4 KB 74ms
72ms Script
application/javascript 2a02:26f0:1700:78e::2ef
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.vmware.com/security/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2

Requested by

Host: blogs.vmware.com
URL: https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:78e::2ef Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

nginx /

Resource Hash

029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Wed, 16 Nov 2022 20:45:17 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Wed, 18 Nov 2020 09:06:06 GMT
server: nginx
vary: Accept-Encoding
content-type: application/javascript
dc-pool-id: bgf8w2at
cache-control: max-age=3600
server-timing: cdn-cache; desc=HIT, edge; dur=1
accept-ranges: bytes
content-length: 4169

GET
H2 200 utag.sync.js Show response
tags.tiqcdn.com/utag/vmware/microsites-privacy/prod/ 200 KB
61 KB 129ms
44ms Script
application/x-javascript 23.35.236.209
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/vmware/microsites-privacy/prod/utag.sync.js?ver=6.0
Requested by: Host: blogs.vmware.com
URL: https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.35.236.209 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-236-209.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: d26f0ef4dec593d0dc576b40b1c41397ec1dda474810b7d019dd884ed9e062db

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blogs.vmware.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Wed, 16 Nov 2022 20:45:17 GMT
content-encoding: gzip
last-modified: Wed, 16 Nov 2022 10:56:04 GMT
server: AkamaiNetStorage
etag: "02ae991cdd6607f6e86bc91643bef48d:1668596164.351901"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=300
accept-ranges: bytes
expires: Wed, 16 Nov 2022 20:50:17 GMT

GET
H2 200 marker-animation.js Show response
blogs.vmware.com/security/wp-content/themes/vmware-security-0.2.2/inc/wp-scripts/ 6 KB
3 KB 153ms
151ms Script
application/javascript 2a02:26f0:1700:78e::2ef
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.vmware.com/security/wp-content/themes/vmware-security-0.2.2/inc/wp-scripts/marker-animation.js?ver=6.0

Requested by

Host: blogs.vmware.com
URL: https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:78e::2ef Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

nginx /

Resource Hash

c68deba0294e0ed06089c2500441dd15e4155a4291355719cd6804defc75da5d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Wed, 16 Nov 2022 20:45:17 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Tue, 28 Jun 2022 23:07:24 GMT
server: nginx
vary: Accept-Encoding
content-type: application/javascript
dc-pool-id: bgf8w2at
cache-control: max-age=3600
server-timing: cdn-cache; desc=HIT, edge; dur=1
accept-ranges: bytes
content-length: 2336

GET
H2 200 utag_data.js Show response
www.vmware.com/files/templates/inc/ 8 KB
3 KB 123ms
85ms Script
application/javascript 2a02:26f0:1700:78e::2ef
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.vmware.com/files/templates/inc/utag_data.js

Requested by

Host: blogs.vmware.com
URL: https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:78e::2ef Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Apache /

Resource Hash

324e55267685920cf7f331734a3a05d006d308b0fe2fdfa3ff9400b101efc7ab

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://*.vmware.com;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blogs.vmware.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Wed, 16 Nov 2022 20:45:17 GMT
content-encoding: gzip
content-security-policy: frame-ancestors 'self' https://*.vmware.com;
server: Apache
access-control-max-age: 1000
access-control-allow-methods: GET
content-type: application/javascript
vary: Accept-Encoding
dc-pool-id: u33xp12k
cache-control: public, must-revalidate, max-age=3600
access-control-allow-credentials: true
server-timing: cdn-cache; desc=HIT, edge; dur=1
accept-ranges: bytes
access-control-allow-headers: X-Requested-With, Content-Type, Origin, Authorization, Accept, Client-Security-Token, Accept-Encoding
content-length: 2733

GET
H2 200 49c04f9a Show response
blogs.vmware.com/akam/13/ 26 KB
9 KB 90ms
84ms Script
application/javascript 2a02:26f0:1700:78e::2ef
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.vmware.com/akam/13/49c04f9a

Requested by

Host: blogs.vmware.com
URL: https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:78e::2ef Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

6feb8825b331e458c390691ad137e08442b33b86efc089b2761b50c3319e46ea

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 16 Nov 2022 20:45:17 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Wed, 09 Feb 2022 15:08:06 GMT
etag: "224eeefee93fab5cac5c0c94fae44a3cfd4e4b252fe379f6c0574465d304eef9"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=0, no-cache, no-store
server-timing: cdn-cache; desc=HIT, edge; dur=14
content-length: 8758
expires: Wed, 16 Nov 2022 20:45:17 GMT

GET
H2 200 vmware-logo-large.png
blogs.vmware.com/security/wp-content/themes/vmware-security-0.2.2/dist/images/ 4 KB
4 KB 49ms
44ms Image
image/png 2a02:26f0:1700:78e::2ef
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.vmware.com/security/wp-content/themes/vmware-security-0.2.2/dist/images/vmware-logo-large.png

Requested by

Host: blogs.vmware.com
URL: https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:78e::2ef Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

nginx /

Resource Hash

528f6be3592f46be7126029a99daa89c1dd3711cf5fab20939309de97ebbc31a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Wed, 16 Nov 2022 20:45:17 GMT
strict-transport-security: max-age=31536000
last-modified: Tue, 28 Jun 2022 23:07:24 GMT
server: nginx
content-type: image/png
dc-pool-id: bgf8w2at
cache-control: max-age=3600
server-timing: cdn-cache; desc=HIT, edge; dur=1
accept-ranges: bytes
content-length: 4250

GET
H2 200 Tom-Gillis_VMware-Security_Contexa-Threat-Intelligence-410x222.jpg
blogs.vmware.com/security/files/2022/06/ 23 KB
23 KB 50ms
45ms Image
image/jpeg 2a02:26f0:1700:78e::2ef
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.vmware.com/security/files/2022/06/Tom-Gillis_VMware-Security_Contexa-Threat-Intelligence-410x222.jpg

Requested by

Host: blogs.vmware.com
URL: https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:78e::2ef Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

nginx / PHP/7.4.29

Resource Hash

e5fdb43f2c7f1a5596e4dfe55b42b07a0718479f2f01aef135e0bbf75b119494

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Wed, 16 Nov 2022 20:45:17 GMT
strict-transport-security: max-age=31536000
last-modified: Wed, 01 Jun 2022 23:58:48 GMT
server: nginx
x-powered-by: PHP/7.4.29
etag: "9e33053592d35fdd34dc19e43e84953f"
x-frame-options: SAMEORIGIN
content-type: image/jpeg
dc-pool-id: bgf8w2at
cache-control: max-age=3600
server-timing: cdn-cache; desc=HIT, edge; dur=1
content-length: 23378

GET
H2 200 Threat-Research_Featured-410x222.png
blogs.vmware.com/security/files/2022/03/ 85 KB
86 KB 50ms
45ms Image
image/png 2a02:26f0:1700:78e::2ef
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.vmware.com/security/files/2022/03/Threat-Research_Featured-410x222.png

Requested by

Host: blogs.vmware.com
URL: https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:78e::2ef Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

nginx / PHP/7.4.29

Resource Hash

4419ebe4c794bc0ae0967f648f2cf6a625476ec59d56d24c93c91c2fde08815d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Wed, 16 Nov 2022 20:45:17 GMT
strict-transport-security: max-age=31536000
last-modified: Thu, 17 Mar 2022 03:40:54 GMT
server: nginx
x-powered-by: PHP/7.4.29
etag: "04d6852f84afec988c8faf92f9d1da65"
x-frame-options: SAMEORIGIN
content-type: image/png
dc-pool-id: bgf8w2at
cache-control: max-age=3600
server-timing: cdn-cache; desc=HIT, edge; dur=1
content-length: 87532

GET
H2 200 photo_security9_screens-410x222.jpg
blogs.vmware.com/security/files/2022/03/ 20 KB
20 KB 47ms
43ms Image
image/jpeg 2a02:26f0:1700:78e::2ef
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.vmware.com/security/files/2022/03/photo_security9_screens-410x222.jpg

Requested by

Host: blogs.vmware.com
URL: https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:78e::2ef Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

nginx / PHP/7.4.29

Resource Hash

0667f1d5e6d4928d7f140a72ad4970fecb5c6a7caf09e26d08d526a831aa073b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Wed, 16 Nov 2022 20:45:17 GMT
strict-transport-security: max-age=31536000
last-modified: Thu, 17 Mar 2022 03:37:42 GMT
server: nginx
x-powered-by: PHP/7.4.29
etag: "948649835c8783caa1cc3184492713ba"
x-frame-options: SAMEORIGIN
content-type: image/jpeg
dc-pool-id: bgf8w2at
cache-control: max-age=3600
server-timing: cdn-cache; desc=HIT, edge; dur=1
content-length: 20164

GET
H2 200 globecyberattack-e1647877118160-410x222.jpg
blogs.vmware.com/security/files/2022/02/ 21 KB
22 KB 47ms
43ms Image
image/jpeg 2a02:26f0:1700:78e::2ef
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.vmware.com/security/files/2022/02/globecyberattack-e1647877118160-410x222.jpg

Requested by

Host: blogs.vmware.com
URL: https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:78e::2ef Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

nginx / PHP/7.4.29

Resource Hash

8f200f9561e423ae6563d09abe143d4ecf57783d4915832a2496d599530b1a3b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Wed, 16 Nov 2022 20:45:17 GMT
strict-transport-security: max-age=31536000
last-modified: Mon, 21 Mar 2022 15:37:51 GMT
server: nginx
x-powered-by: PHP/7.4.29
etag: "90943aaaa5a1aaaf5ecd9c8e91d54c69"
x-frame-options: SAMEORIGIN
content-type: image/jpeg
dc-pool-id: bgf8w2at
cache-control: max-age=3600
server-timing: cdn-cache; desc=HIT, edge; dur=1
content-length: 21787

GET
H2 200 Malware_Featured-410x222.png
blogs.vmware.com/security/files/2022/03/ 93 KB
94 KB 47ms
42ms Image
image/png 2a02:26f0:1700:78e::2ef
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.vmware.com/security/files/2022/03/Malware_Featured-410x222.png

Requested by

Host: blogs.vmware.com
URL: https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:78e::2ef Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

nginx / PHP/7.4.29

Resource Hash

d72cd2b47109ae3d37dd5b5f44a14178d4b2b07c8adcbca202898e865d809fa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Wed, 16 Nov 2022 20:45:17 GMT
strict-transport-security: max-age=31536000
last-modified: Thu, 17 Mar 2022 03:39:45 GMT
server: nginx
x-powered-by: PHP/7.4.29
etag: "3a8e34af78558acc530919c5230f4dd3"
x-frame-options: SAMEORIGIN
content-type: image/png
dc-pool-id: dcf6w1ns
cache-control: max-age=3600
server-timing: cdn-cache; desc=HIT, edge; dur=1
content-length: 95389

GET
H2 200 Screen-Shot-2022-11-10-at-10.34.31-AM-1024x311.png
blogs.vmware.com/security/files/2022/11/ 98 KB
99 KB 48ms
43ms Image
image/png 2a02:26f0:1700:78e::2ef
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.vmware.com/security/files/2022/11/Screen-Shot-2022-11-10-at-10.34.31-AM-1024x311.png

Requested by

Host: blogs.vmware.com
URL: https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:78e::2ef Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

nginx / PHP/7.4.30

Resource Hash

ebd13a676213c7528e229d5358cd578a30eb800275d0563ad1e6dd68caed1fde

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Wed, 16 Nov 2022 20:45:17 GMT
strict-transport-security: max-age=31536000
last-modified: Thu, 10 Nov 2022 18:33:17 GMT
server: nginx
x-powered-by: PHP/7.4.30
etag: "284a8c7f376d3a0b9796bfcdf9d1d92c"
x-frame-options: SAMEORIGIN
content-type: image/png
dc-pool-id: bgf8w2at
cache-control: max-age=3600
server-timing: cdn-cache; desc=HIT, edge; dur=1
content-length: 100634

GET
H2

200

61500768-7d535780-a981-11e9-8578-dc6bf989ffb2.png
i1.wp.com/user-images.githubusercontent.com/969755/
Redirect Chain

https://secure.gravatar.com/avatar/8c3400ff217316ed0ff2bee4b61d1ef6?s=70&d=https%3A%2F%2Fuser-images.githubusercontent.com%2F969755%2F61500768-7d535780-a981-11e9-8578-dc6bf989ffb2.png&r=g
https://i1.wp.com/user-images.githubusercontent.com/969755/61500768-7d535780-a981-11e9-8578-dc6bf989ffb2.png?ssl=1

25 KB
25 KB

267ms
60ms

Image
image/webp

192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i1.wp.com/user-images.githubusercontent.com/969755/61500768-7d535780-a981-11e9-8578-dc6bf989ffb2.png?ssl=1

Requested by

Host: blogs.vmware.com
URL: https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html

Protocol

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i2.wp.com

Software

nginx /

Resource Hash

39cc21ca9b7ed1c403459527d74576906bc7091b1a6cc5ac08cfe5337708289c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blogs.vmware.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Wed, 16 Nov 2022 20:45:17 GMT
x-content-type-options: nosniff
last-modified: Wed, 02 Nov 2022 10:44:57 GMT
server: nginx
etag: "a24ccbad0e7febb2"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
timing-allow-origin: *
link: <https://user-images.githubusercontent.com/969755/61500768-7d535780-a981-11e9-8578-dc6bf989ffb2.png>; rel="canonical"
content-length: 25696
expires: Fri, 01 Nov 2024 22:44:57 GMT

Redirect headers

x-nc: HIT hhn 2
date: Wed, 16 Nov 2022 20:45:17 GMT
last-modified: Wed, 11 Jan 1984 08:00:00 GMT
server: nginx
content-type: text/html; charset=utf-8
location: https://i1.wp.com/user-images.githubusercontent.com/969755/61500768-7d535780-a981-11e9-8578-dc6bf989ffb2.png?ssl=1
cache-control: max-age=300
link: <https://www.gravatar.com/avatar/8c3400ff217316ed0ff2bee4b61d1ef6?s=70&d=https%3A%2F%2Fuser-images.githubusercontent.com%2F969755%2F61500768-7d535780-a981-11e9-8578-dc6bf989ffb2.png&r=g>; rel="canonical"
content-length: 0
expires: Wed, 16 Nov 2022 20:50:17 GMT

GET
H2

200

61500768-7d535780-a981-11e9-8578-dc6bf989ffb2.png
i1.wp.com/user-images.githubusercontent.com/969755/
Redirect Chain

https://secure.gravatar.com/avatar/7a6141c3ad82cc6df21a10b76e7af77d?s=70&d=https%3A%2F%2Fuser-images.githubusercontent.com%2F969755%2F61500768-7d535780-a981-11e9-8578-dc6bf989ffb2.png&r=g
https://i1.wp.com/user-images.githubusercontent.com/969755/61500768-7d535780-a981-11e9-8578-dc6bf989ffb2.png?ssl=1

25 KB
25 KB

227ms
19ms

Image
image/webp

192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i1.wp.com/user-images.githubusercontent.com/969755/61500768-7d535780-a981-11e9-8578-dc6bf989ffb2.png?ssl=1

Requested by

Host: blogs.vmware.com
URL: https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html

Protocol

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i2.wp.com

Software

nginx /

Resource Hash

39cc21ca9b7ed1c403459527d74576906bc7091b1a6cc5ac08cfe5337708289c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blogs.vmware.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Wed, 16 Nov 2022 20:45:17 GMT
x-content-type-options: nosniff
last-modified: Wed, 02 Nov 2022 10:44:57 GMT
server: nginx
etag: "a24ccbad0e7febb2"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
timing-allow-origin: *
link: <https://user-images.githubusercontent.com/969755/61500768-7d535780-a981-11e9-8578-dc6bf989ffb2.png>; rel="canonical"
content-length: 25696
expires: Fri, 01 Nov 2024 22:44:57 GMT

Redirect headers

x-nc: HIT hhn 2
date: Wed, 16 Nov 2022 20:45:17 GMT
last-modified: Wed, 11 Jan 1984 08:00:00 GMT
server: nginx
content-type: text/html; charset=utf-8
location: https://i1.wp.com/user-images.githubusercontent.com/969755/61500768-7d535780-a981-11e9-8578-dc6bf989ffb2.png?ssl=1
cache-control: max-age=300
link: <https://www.gravatar.com/avatar/7a6141c3ad82cc6df21a10b76e7af77d?s=70&d=https%3A%2F%2Fuser-images.githubusercontent.com%2F969755%2F61500768-7d535780-a981-11e9-8578-dc6bf989ffb2.png&r=g>; rel="canonical"
content-length: 0
expires: Wed, 16 Nov 2022 20:50:17 GMT

GET
H2

200

61500768-7d535780-a981-11e9-8578-dc6bf989ffb2.png
i1.wp.com/user-images.githubusercontent.com/969755/
Redirect Chain

https://secure.gravatar.com/avatar/43a9d98249ee028187b4bebc197c0783?s=70&d=https%3A%2F%2Fuser-images.githubusercontent.com%2F969755%2F61500768-7d535780-a981-11e9-8578-dc6bf989ffb2.png&r=g
https://i1.wp.com/user-images.githubusercontent.com/969755/61500768-7d535780-a981-11e9-8578-dc6bf989ffb2.png?ssl=1

25 KB
25 KB

249ms
41ms

Image
image/webp

192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i1.wp.com/user-images.githubusercontent.com/969755/61500768-7d535780-a981-11e9-8578-dc6bf989ffb2.png?ssl=1

Requested by

Host: blogs.vmware.com
URL: https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html

Protocol

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i2.wp.com

Software

nginx /

Resource Hash

39cc21ca9b7ed1c403459527d74576906bc7091b1a6cc5ac08cfe5337708289c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blogs.vmware.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Wed, 16 Nov 2022 20:45:17 GMT
x-content-type-options: nosniff
last-modified: Wed, 02 Nov 2022 10:44:57 GMT
server: nginx
etag: "a24ccbad0e7febb2"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
timing-allow-origin: *
link: <https://user-images.githubusercontent.com/969755/61500768-7d535780-a981-11e9-8578-dc6bf989ffb2.png>; rel="canonical"
content-length: 25696
expires: Fri, 01 Nov 2024 22:44:57 GMT

Redirect headers

x-nc: HIT hhn 2
date: Wed, 16 Nov 2022 20:45:17 GMT
last-modified: Wed, 11 Jan 1984 08:00:00 GMT
server: nginx
content-type: text/html; charset=utf-8
location: https://i1.wp.com/user-images.githubusercontent.com/969755/61500768-7d535780-a981-11e9-8578-dc6bf989ffb2.png?ssl=1
cache-control: max-age=300
link: <https://www.gravatar.com/avatar/43a9d98249ee028187b4bebc197c0783?s=70&d=https%3A%2F%2Fuser-images.githubusercontent.com%2F969755%2F61500768-7d535780-a981-11e9-8578-dc6bf989ffb2.png&r=g>; rel="canonical"
content-length: 0
expires: Wed, 16 Nov 2022 20:50:17 GMT

GET
H2 200 Endpoint-Security_Thumbnail-e1658437535835-410x222.png
blogs.vmware.com/security/files/2022/03/ 31 KB
32 KB 47ms
44ms Image
image/png 2a02:26f0:1700:78e::2ef
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.vmware.com/security/files/2022/03/Endpoint-Security_Thumbnail-e1658437535835-410x222.png

Requested by

Host: blogs.vmware.com
URL: https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:78e::2ef Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

nginx / PHP/7.4.29

Resource Hash

e60033926a73b04b4ebb06ca9d926e5ee54dca7e5fe41f2823e09d9ed732a10f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Wed, 16 Nov 2022 20:45:17 GMT
strict-transport-security: max-age=31536000
last-modified: Thu, 21 Jul 2022 21:04:39 GMT
server: nginx
x-powered-by: PHP/7.4.29
etag: "1326ff9186a37e37f5c32a402a1a42ef"
x-frame-options: SAMEORIGIN
content-type: image/png
dc-pool-id: bgf8w2at
cache-control: max-age=3600
server-timing: cdn-cache; desc=HIT, edge; dur=1
content-length: 32183

GET
H2 200 Ransomware-2C_Featured-410x222.png
blogs.vmware.com/security/files/2022/03/ 67 KB
68 KB 48ms
45ms Image
image/png 2a02:26f0:1700:78e::2ef
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.vmware.com/security/files/2022/03/Ransomware-2C_Featured-410x222.png

Requested by

Host: blogs.vmware.com
URL: https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:78e::2ef Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

nginx / PHP/7.4.30

Resource Hash

44c19c3337beb6cf1a7cc25f38ac4fc32e1e4d5e6d50d270287659cad80c80ae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Wed, 16 Nov 2022 20:45:17 GMT
strict-transport-security: max-age=31536000
last-modified: Thu, 17 Mar 2022 03:40:47 GMT
server: nginx
x-powered-by: PHP/7.4.30
etag: "5ef0b40f65b047cf54015add35c8eaa4"
x-frame-options: SAMEORIGIN
content-type: image/png
dc-pool-id: bgf8w2at
cache-control: max-age=3600
server-timing: cdn-cache; desc=HIT, edge; dur=1
content-length: 68861

GET
H2 200 main-77d5692421.js Show response
blogs.vmware.com/security/wp-content/themes/vmware-security-0.2.2/dist/scripts/ 198 KB
57 KB 49ms
49ms Script
application/javascript 2a02:26f0:1700:78e::2ef
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.vmware.com/security/wp-content/themes/vmware-security-0.2.2/dist/scripts/main-77d5692421.js?ver=1656457644

Requested by

Host: blogs.vmware.com
URL: https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:78e::2ef Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

nginx /

Resource Hash

c778db3f26d8857d58085536b2e4f36f9abb03da6eb2626f883aaf97952ccda5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Wed, 16 Nov 2022 20:45:17 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Tue, 28 Jun 2022 23:07:24 GMT
server: nginx
vary: Accept-Encoding
content-type: application/javascript
dc-pool-id: dcf6w1ns
cache-control: max-age=3600
server-timing: cdn-cache; desc=HIT, edge; dur=1
accept-ranges: bytes

GET
H2 200 scrapercontent.us.js Show response
www.vmware.com/bin/vmware/template/ 200 KB
21 KB 33ms
33ms Script
application/javascript 2a02:26f0:1700:78e::2ef
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.vmware.com/bin/vmware/template/scrapercontent.us.js

Requested by

Host: blogs.vmware.com
URL: https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:78e::2ef Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Apache /

Resource Hash

b63d49856ca1db040770736dec01e14708f914b8e4a164fa3ced2e661bd88e6e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://*.vmware.com;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blogs.vmware.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Wed, 16 Nov 2022 20:45:17 GMT
content-encoding: gzip
content-security-policy: frame-ancestors 'self' https://*.vmware.com;
server: Apache
vary: Accept-Encoding
content-type: application/javascript
dc-pool-id: u33xp12k
cache-control: public, must-revalidate, max-age=3600
server-timing: cdn-cache; desc=HIT, edge; dur=1
accept-ranges: bytes
content-length: 21152

GET
H2 200 responsive.js Show response
www.vmware.com/content/dam/vmwaredesigns/scrapercontent/ 197 KB
47 KB 32ms
28ms Script
application/javascript 2a02:26f0:1700:78e::2ef
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.vmware.com/content/dam/vmwaredesigns/scrapercontent/responsive.js

Requested by

Host: blogs.vmware.com
URL: https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:78e::2ef Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Apache /

Resource Hash

8c925c49ef36b7be79a38d9bb5d210e1be96e9443caf5a5cf3e332f829c1104f

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://*.vmware.com;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blogs.vmware.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Wed, 16 Nov 2022 20:45:17 GMT
content-encoding: gzip
content-security-policy: frame-ancestors 'self' https://*.vmware.com;
server: Apache
access-control-max-age: 1000
access-control-allow-methods: GET
content-type: application/javascript
vary: Accept-Encoding
dc-pool-id: 6530p3tf
cache-control: public, must-revalidate, max-age=3600
access-control-allow-credentials: true
server-timing: cdn-cache; desc=HIT, edge; dur=1
accept-ranges: bytes
access-control-allow-headers: X-Requested-With, Content-Type, Origin, Authorization, Accept, Client-Security-Token, Accept-Encoding
content-length: 47857

GET
H2 200 DzQB Show response
blogs.vmware.com/1EOAw5AP_zerPm7Ysg/a1aODhwb/aDtvbS14Ag/cB58dCBV/ 197 KB
77 KB 47ms
42ms Script
application/javascript 2a02:26f0:1700:78e::2ef
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.vmware.com/1EOAw5AP_zerPm7Ysg/a1aODhwb/aDtvbS14Ag/cB58dCBV/DzQB

Requested by

Host: blogs.vmware.com
URL: https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:78e::2ef Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

25939f220c38d945f2ae4f69830e034fee59316410dac70da21c0fa2a21f2df5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Wed, 16 Nov 2022 20:45:17 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Mon, 31 Oct 2022 15:58:52 GMT
etag: "8b355d6bca1317b4c911d21b4157363ca643c74fa9fa56f315f23e81f9149305"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=21600
server-timing: cdn-cache; desc=HIT, edge; dur=1
content-length: 77912

GET
H2 200 wp-emoji-release.min.js Show response
blogs.vmware.com/security/wp-includes/js/ 18 KB
5 KB 47ms
44ms Script
application/javascript 2a02:26f0:1700:78e::2ef
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.vmware.com/security/wp-includes/js/wp-emoji-release.min.js?ver=6.0

Requested by

Host: blogs.vmware.com
URL: https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:78e::2ef Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

nginx /

Resource Hash

5aad5fbd4238981a9ff5e2772ff1353dfe1a801fb49542fe157418c1438f7782

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Wed, 16 Nov 2022 20:45:17 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Tue, 12 Apr 2022 05:56:23 GMT
server: nginx
vary: Accept-Encoding
content-type: application/javascript
dc-pool-id: bgf8w2at
cache-control: max-age=3600
server-timing: cdn-cache; desc=HIT, edge; dur=1
accept-ranges: bytes
content-length: 5004

GET
H2 200 otSDKStub.js Show response
cdn.cookielaw.org/scripttemplates/ 21 KB
8 KB 97ms
46ms Script
application/javascript 2606:4700::6810:9540
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/vmware/microsites-privacy/prod/utag.sync.js?ver=6.0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bbc4456bca95006683a8f081d0d2ed645eef5b14c62eca12c70f7e1cec26c1a0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blogs.vmware.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 16 Nov 2022 20:45:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: HNx4bdEmRgn5g09KulPi7w==
age: 77001
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 7151
x-ms-lease-status: unlocked
last-modified: Mon, 14 Nov 2022 03:33:57 GMT
server: cloudflare
etag: 0x8DAC5F10FDD1A08
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 19cac252-901e-0118-0b86-f8b326000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 76b311c6fb265c85-FRA

GET
H/1.1 200
OK rendercontent Show response
www.vmware.com/bin/vmware/entityid/ 4 B
2 KB 405ms
361ms XHR
application/json 2a02:26f0:1700:78e::2ef
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.vmware.com/bin/vmware/entityid/rendercontent?assetpath=blogs.vmware.com%2Fsecurity%2F2022%2F11%2Fbatloader-the-evasive-downloader-malware.html

Requested by

Host: blogs.vmware.com
URL: https://blogs.vmware.com/security/wp-includes/js/jquery/jquery.min.js?ver=3.6.0

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:78e::2ef Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Apache /

Resource Hash

74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://*.vmware.com;
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Referer: https://blogs.vmware.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 16 Nov 2022 20:45:17 GMT
Content-Security-Policy: frame-ancestors 'self' https://*.vmware.com;
X-Content-Type-Options: nosniff
Server: Apache
Access-Control-Allow-Methods: GET
Content-Type: application/json;charset=utf-8
Access-Control-Allow-Origin: *
DC-Pool-ID: u33xp12k
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Server-Timing: cdn-cache; desc=MISS, edge; dur=243, origin; dur=88
Content-Length: 4
Expires: Wed, 16 Nov 2022 20:45:17 GMT

GET
H2 200 H9GEV-4J3F8-PCWZW-5GPKQ-BKVPH Show response
s.go-mpulse.net/boomerang/ 205 KB
49 KB 73ms
20ms Script
application/javascript 2a02:26f0:3400:195::11a6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://s.go-mpulse.net/boomerang/H9GEV-4J3F8-PCWZW-5GPKQ-BKVPH
Requested by: Host: blogs.vmware.com
URL: https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2a02:26f0:3400:195::11a6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 09ebd7f407439990aac227e70da23e1a819e8e30282928e324370805f480bec4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blogs.vmware.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Wed, 16 Nov 2022 20:45:17 GMT
content-encoding: br
last-modified: Fri, 28 Oct 2022 04:08:22 GMT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=604800
timing-allow-origin: *
content-length: 50393

GET
H2 200 icon-magnifying-glass-cobalt.svg
blogs.vmware.com/security/wp-content/themes/vmware-security-0.2.2/dist/images/ 434 B
641 B 43ms
42ms Image
image/svg+xml 2a02:26f0:1700:78e::2ef
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.vmware.com/security/wp-content/themes/vmware-security-0.2.2/dist/images/icon-magnifying-glass-cobalt.svg

Requested by

Host: blogs.vmware.com
URL: https://blogs.vmware.com/security/wp-content/themes/vmware-security-0.2.2/dist/styles/main-3089d13a45.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:78e::2ef Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

nginx /

Resource Hash

8ff02af5bffd2c74d16f20fddb34bc7ec51c93e13544fdf2e1f4a1c5845da82c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blogs.vmware.com/security/wp-content/themes/vmware-security-0.2.2/dist/styles/main-3089d13a45.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Wed, 16 Nov 2022 20:45:17 GMT
strict-transport-security: max-age=31536000
last-modified: Tue, 28 Jun 2022 23:07:24 GMT
server: nginx
content-type: image/svg+xml
dc-pool-id: bgf8w2at
cache-control: max-age=3600
server-timing: cdn-cache; desc=HIT, edge; dur=1
accept-ranges: bytes
content-length: 434

GET
H2 200 Metropolis-Regular.woff2
blogs.vmware.com/security/wp-content/themes/vmware-security-0.2.2/dist/fonts/ 11 KB
12 KB 44ms
44ms Font
font/woff2 2a02:26f0:1700:78e::2ef
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.vmware.com/security/wp-content/themes/vmware-security-0.2.2/dist/fonts/Metropolis-Regular.woff2

Requested by

Host: blogs.vmware.com
URL: https://blogs.vmware.com/security/wp-content/themes/vmware-security-0.2.2/dist/styles/main-3089d13a45.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:78e::2ef Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

nginx /

Resource Hash

7eab176359f9cb1dec55ae347dd45d3f1947a54f367e7a8011302711296e264d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://blogs.vmware.com/security/wp-content/themes/vmware-security-0.2.2/dist/styles/main-3089d13a45.css
Origin: https://blogs.vmware.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Wed, 16 Nov 2022 20:45:17 GMT
strict-transport-security: max-age=31536000
last-modified: Tue, 28 Jun 2022 23:07:24 GMT
server: nginx
content-type: font/woff2
dc-pool-id: dcf6w1ns
cache-control: max-age=3600
server-timing: cdn-cache; desc=HIT, edge; dur=1
accept-ranges: bytes
content-length: 11544

GET
H2 200 Metropolis-Light.woff2
blogs.vmware.com/security/wp-content/themes/vmware-security-0.2.2/dist/fonts/ 11 KB
12 KB 85ms
85ms Font
font/woff2 2a02:26f0:1700:78e::2ef
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.vmware.com/security/wp-content/themes/vmware-security-0.2.2/dist/fonts/Metropolis-Light.woff2

Requested by

Host: blogs.vmware.com
URL: https://blogs.vmware.com/security/wp-content/themes/vmware-security-0.2.2/dist/styles/main-3089d13a45.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:78e::2ef Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

nginx /

Resource Hash

b82ac9377577170cb4e1e0c1b2bc4512fda7340087e7ec9706e5d79de66a2ed5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://blogs.vmware.com/security/wp-content/themes/vmware-security-0.2.2/dist/styles/main-3089d13a45.css
Origin: https://blogs.vmware.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Wed, 16 Nov 2022 20:45:17 GMT
strict-transport-security: max-age=31536000
last-modified: Tue, 28 Jun 2022 23:07:24 GMT
server: nginx
content-type: font/woff2
dc-pool-id: bgf8w2at
cache-control: max-age=3600
server-timing: cdn-cache; desc=HIT, edge; dur=1
accept-ranges: bytes
content-length: 11680

GET
H2 200 icon-twitter-cobalt.svg
blogs.vmware.com/security/wp-content/themes/vmware-security-0.2.2/dist/images/ 956 B
1 KB 56ms
55ms Image
image/svg+xml 2a02:26f0:1700:78e::2ef
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.vmware.com/security/wp-content/themes/vmware-security-0.2.2/dist/images/icon-twitter-cobalt.svg

Requested by

Host: blogs.vmware.com
URL: https://blogs.vmware.com/security/wp-content/themes/vmware-security-0.2.2/dist/styles/main-3089d13a45.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:78e::2ef Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

nginx /

Resource Hash

86c45fc889b11a40296913e5f00d8fefe29d23d342d47a7e481b61bd982d0206

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blogs.vmware.com/security/wp-content/themes/vmware-security-0.2.2/dist/styles/main-3089d13a45.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Wed, 16 Nov 2022 20:45:17 GMT
strict-transport-security: max-age=31536000
last-modified: Tue, 28 Jun 2022 23:07:24 GMT
server: nginx
content-type: image/svg+xml
dc-pool-id: dcf6w1ns
cache-control: max-age=3600
server-timing: cdn-cache; desc=HIT, edge; dur=1
accept-ranges: bytes
content-length: 956

GET
H2 200 icon-linkedin-cobalt.svg
blogs.vmware.com/security/wp-content/themes/vmware-security-0.2.2/dist/images/ 728 B
935 B 65ms
63ms Image
image/svg+xml 2a02:26f0:1700:78e::2ef
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.vmware.com/security/wp-content/themes/vmware-security-0.2.2/dist/images/icon-linkedin-cobalt.svg

Requested by

Host: blogs.vmware.com
URL: https://blogs.vmware.com/security/wp-content/themes/vmware-security-0.2.2/dist/styles/main-3089d13a45.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:78e::2ef Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

nginx /

Resource Hash

c206dacd2a003950891d02fd15180cd7a8a740658cc1c6ebc9a7c87935c5dea1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blogs.vmware.com/security/wp-content/themes/vmware-security-0.2.2/dist/styles/main-3089d13a45.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Wed, 16 Nov 2022 20:45:17 GMT
strict-transport-security: max-age=31536000
last-modified: Tue, 28 Jun 2022 23:07:24 GMT
server: nginx
content-type: image/svg+xml
dc-pool-id: bgf8w2at
cache-control: max-age=3600
server-timing: cdn-cache; desc=HIT, edge; dur=1
accept-ranges: bytes
content-length: 728

GET
H2 200 icon-fb-cobalt.svg
blogs.vmware.com/security/wp-content/themes/vmware-security-0.2.2/dist/images/ 282 B
488 B 60ms
58ms Image
image/svg+xml 2a02:26f0:1700:78e::2ef
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.vmware.com/security/wp-content/themes/vmware-security-0.2.2/dist/images/icon-fb-cobalt.svg

Requested by

Host: blogs.vmware.com
URL: https://blogs.vmware.com/security/wp-content/themes/vmware-security-0.2.2/dist/styles/main-3089d13a45.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:78e::2ef Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

nginx /

Resource Hash

67afc6a58a5afbace5d49bb88a65fe76e29125ea7063ccc06c103ea4b57a5ce5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blogs.vmware.com/security/wp-content/themes/vmware-security-0.2.2/dist/styles/main-3089d13a45.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Wed, 16 Nov 2022 20:45:17 GMT
strict-transport-security: max-age=31536000
last-modified: Tue, 28 Jun 2022 23:07:24 GMT
server: nginx
content-type: image/svg+xml
dc-pool-id: bgf8w2at
cache-control: max-age=3600
server-timing: cdn-cache; desc=HIT, edge; dur=1
accept-ranges: bytes
content-length: 282

GET
H2 200 icon-reddit-cobalt.svg
blogs.vmware.com/security/wp-content/themes/vmware-security-0.2.2/dist/images/ 2 KB
2 KB 58ms
57ms Image
image/svg+xml 2a02:26f0:1700:78e::2ef
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.vmware.com/security/wp-content/themes/vmware-security-0.2.2/dist/images/icon-reddit-cobalt.svg

Requested by

Host: blogs.vmware.com
URL: https://blogs.vmware.com/security/wp-content/themes/vmware-security-0.2.2/dist/styles/main-3089d13a45.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:78e::2ef Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

nginx /

Resource Hash

4d3bacb83d218f128d734b7dbebf1a2d0db7dfd681525917c189eea1b3cf6f30

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blogs.vmware.com/security/wp-content/themes/vmware-security-0.2.2/dist/styles/main-3089d13a45.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Wed, 16 Nov 2022 20:45:17 GMT
strict-transport-security: max-age=31536000
last-modified: Tue, 28 Jun 2022 23:07:24 GMT
server: nginx
content-type: image/svg+xml
dc-pool-id: bgf8w2at
cache-control: max-age=3600
server-timing: cdn-cache; desc=HIT, edge; dur=1
accept-ranges: bytes
content-length: 1750

GET
H2 200 icon-mail-cobalt.svg
blogs.vmware.com/security/wp-content/themes/vmware-security-0.2.2/dist/images/ 552 B
759 B 59ms
58ms Image
image/svg+xml 2a02:26f0:1700:78e::2ef
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.vmware.com/security/wp-content/themes/vmware-security-0.2.2/dist/images/icon-mail-cobalt.svg

Requested by

Host: blogs.vmware.com
URL: https://blogs.vmware.com/security/wp-content/themes/vmware-security-0.2.2/dist/styles/main-3089d13a45.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:78e::2ef Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

nginx /

Resource Hash

55d19f9e782ceeeff91c07d74d1b62cfab6c5fd76fefb65c0361eaee0d5055ea

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blogs.vmware.com/security/wp-content/themes/vmware-security-0.2.2/dist/styles/main-3089d13a45.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Wed, 16 Nov 2022 20:45:17 GMT
strict-transport-security: max-age=31536000
last-modified: Tue, 28 Jun 2022 23:07:24 GMT
server: nginx
content-type: image/svg+xml
dc-pool-id: bgf8w2at
cache-control: max-age=3600
server-timing: cdn-cache; desc=HIT, edge; dur=1
accept-ranges: bytes
content-length: 552

GET
H2 200 icon-copy-link-cobalt.svg
blogs.vmware.com/security/wp-content/themes/vmware-security-0.2.2/dist/images/ 648 B
855 B 58ms
57ms Image
image/svg+xml 2a02:26f0:1700:78e::2ef
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.vmware.com/security/wp-content/themes/vmware-security-0.2.2/dist/images/icon-copy-link-cobalt.svg

Requested by

Host: blogs.vmware.com
URL: https://blogs.vmware.com/security/wp-content/themes/vmware-security-0.2.2/dist/styles/main-3089d13a45.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:78e::2ef Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

nginx /

Resource Hash

77c89f758760f6d85fceea091c6ad7b538f6eff18b625a89bb15f1748ccc2e99

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blogs.vmware.com/security/wp-content/themes/vmware-security-0.2.2/dist/styles/main-3089d13a45.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Wed, 16 Nov 2022 20:45:17 GMT
strict-transport-security: max-age=31536000
last-modified: Tue, 28 Jun 2022 23:07:24 GMT
server: nginx
content-type: image/svg+xml
dc-pool-id: bgf8w2at
cache-control: max-age=3600
server-timing: cdn-cache; desc=HIT, edge; dur=1
accept-ranges: bytes
content-length: 648

GET
H2 200 Metropolis-SemiBold.woff2
blogs.vmware.com/security/wp-content/themes/vmware-security-0.2.2/dist/fonts/ 11 KB
12 KB 56ms
55ms Font
font/woff2 2a02:26f0:1700:78e::2ef
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.vmware.com/security/wp-content/themes/vmware-security-0.2.2/dist/fonts/Metropolis-SemiBold.woff2

Requested by

Host: blogs.vmware.com
URL: https://blogs.vmware.com/security/wp-content/themes/vmware-security-0.2.2/dist/styles/main-3089d13a45.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:78e::2ef Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

nginx /

Resource Hash

db3dad39e95eed93512050a0fbbb2bc27c0e65b5c87646ca44aaea45fadab90f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://blogs.vmware.com/security/wp-content/themes/vmware-security-0.2.2/dist/styles/main-3089d13a45.css
Origin: https://blogs.vmware.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Wed, 16 Nov 2022 20:45:17 GMT
strict-transport-security: max-age=31536000
last-modified: Tue, 28 Jun 2022 23:07:24 GMT
server: nginx
content-type: font/woff2
dc-pool-id: bgf8w2at
cache-control: max-age=3600
server-timing: cdn-cache; desc=HIT, edge; dur=1
accept-ranges: bytes
content-length: 11740

GET
H2 200 Metropolis-Medium.woff2
blogs.vmware.com/security/wp-content/themes/vmware-security-0.2.2/dist/fonts/ 11 KB
12 KB 54ms
54ms Font
font/woff2 2a02:26f0:1700:78e::2ef
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.vmware.com/security/wp-content/themes/vmware-security-0.2.2/dist/fonts/Metropolis-Medium.woff2

Requested by

Host: blogs.vmware.com
URL: https://blogs.vmware.com/security/wp-content/themes/vmware-security-0.2.2/dist/styles/main-3089d13a45.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:78e::2ef Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

nginx /

Resource Hash

2114f81b0fd9980770e14c6da5ca4c2b84d2f1a73c119570d242a614743f3b6a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://blogs.vmware.com/security/wp-content/themes/vmware-security-0.2.2/dist/styles/main-3089d13a45.css
Origin: https://blogs.vmware.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Wed, 16 Nov 2022 20:45:17 GMT
strict-transport-security: max-age=31536000
last-modified: Tue, 28 Jun 2022 23:07:24 GMT
server: nginx
content-type: font/woff2
dc-pool-id: bgf8w2at
cache-control: max-age=3600
server-timing: cdn-cache; desc=HIT, edge; dur=1
accept-ranges: bytes
content-length: 11692

GET
H2 200 Metropolis-LightItalic.woff2
blogs.vmware.com/security/wp-content/themes/vmware-security-0.2.2/dist/fonts/ 12 KB
12 KB 55ms
54ms Font
font/woff2 2a02:26f0:1700:78e::2ef
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.vmware.com/security/wp-content/themes/vmware-security-0.2.2/dist/fonts/Metropolis-LightItalic.woff2

Requested by

Host: blogs.vmware.com
URL: https://blogs.vmware.com/security/wp-content/themes/vmware-security-0.2.2/dist/styles/main-3089d13a45.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:78e::2ef Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

nginx /

Resource Hash

0ede3245cacb5015a1babbfcf0871f6183e87c9ba3a6bb93694acf764e644731

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://blogs.vmware.com/security/wp-content/themes/vmware-security-0.2.2/dist/styles/main-3089d13a45.css
Origin: https://blogs.vmware.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Wed, 16 Nov 2022 20:45:17 GMT
strict-transport-security: max-age=31536000
last-modified: Tue, 28 Jun 2022 23:07:24 GMT
server: nginx
content-type: font/woff2
dc-pool-id: bgf8w2at
cache-control: max-age=3600
server-timing: cdn-cache; desc=HIT, edge; dur=1
accept-ranges: bytes
content-length: 12472

GET
H2 200 Screen-Shot-2022-11-10-at-2.06.26-PM-1024x117.png
blogs.vmware.com/security/files/2022/11/ 76 KB
76 KB 40ms
39ms Image
image/png 2a02:26f0:1700:78e::2ef
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.vmware.com/security/files/2022/11/Screen-Shot-2022-11-10-at-2.06.26-PM-1024x117.png

Requested by

Host: blogs.vmware.com
URL: https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:78e::2ef Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

nginx / PHP/7.4.30

Resource Hash

6eb0532f07f4e37a0309c55f77c19ea3c454363e080cd3a26566b447f31403c8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Wed, 16 Nov 2022 20:45:17 GMT
strict-transport-security: max-age=31536000
last-modified: Thu, 10 Nov 2022 22:05:20 GMT
server: nginx
x-powered-by: PHP/7.4.30
etag: "db41dad0f98b929ddec66823e2196a9b"
x-frame-options: SAMEORIGIN
content-type: image/png
dc-pool-id: dcf6w1ns
cache-control: max-age=3600
server-timing: cdn-cache; desc=HIT, edge; dur=1
content-length: 77782

GET
H2 200 Screen-Shot-2022-11-10-at-2.07.39-PM-1024x517.png
blogs.vmware.com/security/files/2022/11/ 203 KB
203 KB 32ms
32ms Image
image/png 2a02:26f0:1700:78e::2ef
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.vmware.com/security/files/2022/11/Screen-Shot-2022-11-10-at-2.07.39-PM-1024x517.png

Requested by

Host: blogs.vmware.com
URL: https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:78e::2ef Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

nginx / PHP/7.4.30

Resource Hash

738863ef3bb90d22fef3494acc26d0d31e2f290456ecfebc273941f683b1abbb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Wed, 16 Nov 2022 20:45:17 GMT
strict-transport-security: max-age=31536000
last-modified: Thu, 10 Nov 2022 22:06:25 GMT
server: nginx
x-powered-by: PHP/7.4.30
etag: "519f490d103d7c0e2e406dd9de7f09fc"
x-frame-options: SAMEORIGIN
content-type: image/png
dc-pool-id: bgf8w2at
cache-control: max-age=3600
server-timing: cdn-cache; desc=HIT, edge; dur=1
content-length: 207566

GET
H2 200 Screen-Shot-2022-11-10-at-2.08.46-PM-1024x897.png
blogs.vmware.com/security/files/2022/11/ 594 KB
596 KB 40ms
39ms Image
image/png 2a02:26f0:1700:78e::2ef
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.vmware.com/security/files/2022/11/Screen-Shot-2022-11-10-at-2.08.46-PM-1024x897.png

Requested by

Host: blogs.vmware.com
URL: https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:78e::2ef Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

nginx / PHP/7.4.30

Resource Hash

9b6823a5a9c082eb8ad40231dada88cfefe97c545c1a22825d50b5525874266c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Wed, 16 Nov 2022 20:45:17 GMT
strict-transport-security: max-age=31536000
last-modified: Thu, 10 Nov 2022 22:07:36 GMT
server: nginx
x-powered-by: PHP/7.4.30
etag: "88f8a985ec3621f349524a01a533cbab"
x-frame-options: SAMEORIGIN
content-type: image/png
dc-pool-id: bgf8w2at
cache-control: max-age=3600
server-timing: cdn-cache; desc=HIT, edge; dur=1
content-length: 608326

GET
H/1.1 200
OK metropolis-light-webfont.woff2
www.vmware.com/etc.clientlibs/vmware-modernize-cms/componentlibrary/clientlibs/clientlib-dependencies/resources/fonts/ 19 KB
19 KB 75ms
36ms Font
application/octet-stream 2a02:26f0:1700:78e::2ef
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.vmware.com/etc.clientlibs/vmware-modernize-cms/componentlibrary/clientlibs/clientlib-dependencies/resources/fonts/metropolis-light-webfont.woff2

Requested by

Host: www.vmware.com
URL: https://www.vmware.com/content/dam/vmwaredesigns/scrapercontent/responsive.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:78e::2ef Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Apache /

Resource Hash

8501c833e508c85ca35969513569fa47bc62bd66321ac204ecc24c92c3a6bff6

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://*.vmware.com;

Request headers

Referer: https://www.vmware.com/content/dam/vmwaredesigns/scrapercontent/responsive.css
Origin: https://blogs.vmware.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Wed, 16 Nov 2022 20:45:17 GMT
Content-Security-Policy: frame-ancestors 'self' https://*.vmware.com;
Server: Apache
Access-Control-Allow-Origin: *
DC-Pool-ID: p3tx622k
Cache-Control: public, must-revalidate, max-age=3600
Connection: keep-alive
Accept-Ranges: bytes
Server-Timing: cdn-cache; desc=HIT, edge; dur=1
Content-Length: 18952

GET
H/1.1 200
OK fontawesome-webfont.woff2
www.vmware.com/etc.clientlibs/vmware-modernize-cms/componentlibrary/clientlibs/clientlib-dependencies/resources/fonts/ 123 KB
123 KB 72ms
30ms Font
application/octet-stream 2a02:26f0:1700:78e::2ef
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.vmware.com/etc.clientlibs/vmware-modernize-cms/componentlibrary/clientlibs/clientlib-dependencies/resources/fonts/fontawesome-webfont.woff2

Requested by

Host: www.vmware.com
URL: https://www.vmware.com/content/dam/vmwaredesigns/scrapercontent/responsive.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:78e::2ef Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Apache /

Resource Hash

4f01c7ac30cf937559ed8790e81398fe0f3fd191f77f09e11d5f0cc33981afa9

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://*.vmware.com;

Request headers

Referer: https://www.vmware.com/content/dam/vmwaredesigns/scrapercontent/responsive.css
Origin: https://blogs.vmware.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Wed, 16 Nov 2022 20:45:17 GMT
Content-Security-Policy: frame-ancestors 'self' https://*.vmware.com;
Server: Apache
Access-Control-Allow-Origin: *
DC-Pool-ID: p3tx622k
Cache-Control: public, must-revalidate, max-age=3600
Connection: keep-alive
Accept-Ranges: bytes
Server-Timing: cdn-cache; desc=HIT, edge; dur=1
Content-Length: 125836

POST
H2 201 DzQB Show response
blogs.vmware.com/1EOAw5AP_zerPm7Ysg/a1aODhwb/aDtvbS14Ag/cB58dCBV/ 18 B
768 B 172ms
171ms XHR
application/json 2a02:26f0:1700:78e::2ef
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.vmware.com/1EOAw5AP_zerPm7Ysg/a1aODhwb/aDtvbS14Ag/cB58dCBV/DzQB

Requested by

Host: blogs.vmware.com
URL: https://blogs.vmware.com/1EOAw5AP_zerPm7Ysg/a1aODhwb/aDtvbS14Ag/cB58dCBV/DzQB

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:78e::2ef Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

bef9393fcdfc7a7299c058ba2a69253c32e0964dd3e97834e17a8cdb5dce7cf6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 16 Nov 2022 20:45:17 GMT
strict-transport-security: max-age=31536000
vary: Origin
content-type: application/json
access-control-allow-origin: https://blogs.vmware.com
access-control-allow-credentials: true
x_req_id: 207721e0-c21a-4bb4-a356-6c34e447e02c
server-timing: edge; dur=3, origin; dur=141, cdn-cache; desc=MISS
access-control-allow-headers: Content-Type
content-length: 18

GET
DATA 200
OK truncated
/ 9 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 63b693778274923011281f0c339ac4116f8a31b9d186d0657849380cd5bd34b7

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 157 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 80d54533f80e8233621f965ae0a7713928bdb4d491ed0eb5e90434550f1894cb

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Type: image/png

GET
H2

200

lumos.js Show response
lumos.vmware.com/assets/
Redirect Chain

https://feedback.esp.vmware.com/assets/ipf/esp.js?client_id=esp-prod-131-fxsxf
https://lumos.vmware.com/assets/lumos.js?namespace=esp&client_id=esp-prod-131-fxsxf

59 KB
23 KB

267ms
171ms

Script
application/javascript

2600:9000:206f:de00:1b:f6e1:4540:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://lumos.vmware.com/assets/lumos.js?namespace=esp&client_id=esp-prod-131-fxsxf

Requested by

Host: blogs.vmware.com
URL: https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html

Protocol

Server

2600:9000:206f:de00:1b:f6e1:4540:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

73ff4103627eb73810ed2dfd0184c69b9fca7218504dbe3bc4ac95882667b1a8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blogs.vmware.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Wed, 16 Nov 2022 20:45:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 47a7b8b932d91b0edbfc42f1ba94ebc0.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: master-only
x-amz-cf-pop: FRA56-C1
x-cache: Miss from cloudfront
x-xss-protection: 1; mode=block
referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
etag: W/"467486965a36492e27724b728d1ac526"
x-frame-options: DENY
access-control-allow-methods: HEAD,GET
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=3600
vary: Accept-Encoding,Origin
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-amz-cf-id: x6OOYTMUcwkMRyUB0jmJpg7Z5Hr3ZcI2Z2IZOHtV957f_aeGToICUQ==

Redirect headers

date: Wed, 16 Nov 2022 20:45:18 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
via: 1.1 579a21a67e4dc50a655a7c0e9675261c.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: master-only
x-amz-cf-pop: FRA56-C1
x-cache: Miss from cloudfront
content-length: 0
x-xss-protection: 1; mode=block
referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
x-frame-options: DENY
access-control-allow-methods: HEAD,DELETE,POST,GET,PUT
location: https://lumos.vmware.com/assets/lumos.js?namespace=esp&client_id=esp-prod-131-fxsxf
access-control-allow-origin: *
vary: Origin
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-amz-cf-id: tvspYlLktorSZXxtCin1O45Do1HEG2ae8WEwTD4JmKqcFAL2i1oQsg==

GET
H2 200 b9242434-9feb-47be-a894-3a9e658fdd50.json Show response
cdn.cookielaw.org/consent/b9242434-9feb-47be-a894-3a9e658fdd50/ 8 KB
3 KB 140ms
58ms XHR
application/x-javascript 2606:4700::6810:9540
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/b9242434-9feb-47be-a894-3a9e658fdd50/b9242434-9feb-47be-a894-3a9e658fdd50.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8a9fa0d261f613974b829b7dca37a99340f3a4ddbfca96faebd43e475c74f402

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blogs.vmware.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 16 Nov 2022 20:45:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: iaoO/UIqZ/Altq7bJi3q+g==
age: 50826
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 2109
x-ms-lease-status: unlocked
last-modified: Wed, 02 Nov 2022 14:24:39 GMT
server: cloudflare
etag: 0x8DABCDDFA47785E
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: ab196e5e-001e-005d-33c6-ee28e2000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 76b311c91ac69974-FRA
expires: Thu, 17 Nov 2022 20:45:17 GMT

GET
H/1.1 200
OK config.json Show response
c.go-mpulse.net/api/ 855 B
1 KB 225ms
40ms XHR
application/json 2a02:26f0:4700:290::11a6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.go-mpulse.net/api/config.json?key=H9GEV-4J3F8-PCWZW-5GPKQ-BKVPH&d=blogs.vmware.com&t=5562105&v=1.720.0&sl=0&si=6cb63347-49a9-4904-91df-8e296952a82b-rlgkbh&plugins=AK,ConfigOverride,Continuity,PageParams,IFrameDelay,AutoXHR,SPA,History,Angular,Backbone,Ember,RT,CrossDomain,BW,PaintTiming,NavigationTiming,ResourceTiming,Memory,CACHE_RELOAD,Errors,TPAnalytics,UserTiming,Akamai,Early,EventTiming,LOGN&acao=&ak.ai=196942
Requested by: Host: s.go-mpulse.net
URL: https://s.go-mpulse.net/boomerang/H9GEV-4J3F8-PCWZW-5GPKQ-BKVPH
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2a02:26f0:4700:290::11a6 Prague, Czech Republic, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 2366c611d0fe95569b075c974cd1b953a09c8562b0be8e42e2bf28ac3088020b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blogs.vmware.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Wed, 16 Nov 2022 20:45:17 GMT
Cache-Control: private, max-age=300, stale-while-revalidate=60, stale-if-error=120
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 855
Content-Type: application/json

POST
H2 201 DzQB Show response
blogs.vmware.com/1EOAw5AP_zerPm7Ysg/a1aODhwb/aDtvbS14Ag/cB58dCBV/ 18 B
756 B 160ms
160ms XHR
application/json 2a02:26f0:1700:78e::2ef
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.vmware.com/1EOAw5AP_zerPm7Ysg/a1aODhwb/aDtvbS14Ag/cB58dCBV/DzQB

Requested by

Host: blogs.vmware.com
URL: https://blogs.vmware.com/1EOAw5AP_zerPm7Ysg/a1aODhwb/aDtvbS14Ag/cB58dCBV/DzQB

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:78e::2ef Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

bef9393fcdfc7a7299c058ba2a69253c32e0964dd3e97834e17a8cdb5dce7cf6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 16 Nov 2022 20:45:17 GMT
strict-transport-security: max-age=31536000
vary: Origin
content-type: application/json
access-control-allow-origin: https://blogs.vmware.com
access-control-allow-credentials: true
x_req_id: f3960ac3-11f7-454a-9a38-f8d5bd048f67
server-timing: edge; dur=5, origin; dur=128, cdn-cache; desc=MISS
access-control-allow-headers: Content-Type
content-length: 18

GET
H2 200 location Show response
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 59 B
295 B 101ms
53ms XHR
application/json 2606:4700::6812:1a55
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1a55 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2157361193375a79ade3559e960f982daa8d599cf7f4a92d36e3eef257738f16

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept: application/json
Referer: https://blogs.vmware.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Wed, 16 Nov 2022 20:45:17 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS
content-type: application/json
access-control-allow-origin: *
cf-ray: 76b311c9dc1ebb3d-FRA
access-control-allow-headers: Content-Type

GET
H2 200 otBannerSdk.js Show response
cdn.cookielaw.org/scripttemplates/6.31.0/ 334 KB
79 KB 40ms
40ms Script
application/javascript 2606:4700::6810:9540
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.31.0/otBannerSdk.js

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fe4946db1f133c18e59bde7de4f6e87a50d288f85ec8440451b998e0f3f17e66

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blogs.vmware.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 16 Nov 2022 20:45:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: D263R6OySncrpIc5uRH3nQ==
age: 76999
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 80955
x-ms-lease-status: unlocked
last-modified: Fri, 11 Mar 2022 07:14:24 GMT
server: cloudflare
etag: 0x8DA032EC5D12B02
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 392e54eb-f01e-000c-4b24-353617000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 76b311ca3ad75c85-FRA

GET
H2 200 en-us.json Show response
cdn.cookielaw.org/consent/b9242434-9feb-47be-a894-3a9e658fdd50/9282bda9-6b70-4d37-9142-66a71a8d4602/ 431 KB
75 KB 35ms
35ms Fetch
application/x-javascript 2606:4700::6810:9540
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/b9242434-9feb-47be-a894-3a9e658fdd50/9282bda9-6b70-4d37-9142-66a71a8d4602/en-us.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.31.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

30ed0c6940854fd56a07028cdb1c9add025acc4c57c1481b51f29289ef88884e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blogs.vmware.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 16 Nov 2022 20:45:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: OgpiIKiI97BRCMHDuGM0aw==
age: 36967
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 76965
x-ms-lease-status: unlocked
last-modified: Wed, 02 Nov 2022 14:24:39 GMT
server: cloudflare
etag: 0x8DABCDDFA35A07B
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 89d3250d-001e-00d5-7ec6-ee903b000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 76b311cabde29974-FRA
expires: Thu, 17 Nov 2022 20:45:17 GMT

GET
H2 200 otFlat.json Show response
cdn.cookielaw.org/scripttemplates/6.31.0/assets/ 13 KB
3 KB 35ms
34ms Fetch
application/json 2606:4700::6810:9540
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.31.0/assets/otFlat.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.31.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b8b8fa76143b1e3d6bcd32187df721f7ad888aeb09fef2dc15b485c98d09e362

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blogs.vmware.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 16 Nov 2022 20:45:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: EXbJt9InrxA+LlZTe81nFg==
age: 47625
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 2960
x-ms-lease-status: unlocked
last-modified: Fri, 11 Mar 2022 07:14:13 GMT
server: cloudflare
etag: 0x8DA032EBEE58F18
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: 9d6982dd-f01e-0180-3295-353d19000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 76b311cb3ef29974-FRA

GET
H2 200 otPcTab.json Show response
cdn.cookielaw.org/scripttemplates/6.31.0/assets/ 58 KB
14 KB 32ms
32ms Fetch
application/json 2606:4700::6810:9540
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.31.0/assets/otPcTab.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.31.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2e02bee0e07e55b5375ce1666aedda58acaa6adc8d86dcefbe8e7c491bf0e7ed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blogs.vmware.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 16 Nov 2022 20:45:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: bHuEGwmXEYacCHzgWFGP/Q==
age: 50826
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 14247
x-ms-lease-status: unlocked
last-modified: Fri, 11 Mar 2022 07:14:15 GMT
server: cloudflare
etag: 0x8DA032EC0130DE3
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: ad77582c-b01e-004f-6a8e-351cfe000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 76b311cb3ef79974-FRA

GET
H2 200 otCommonStyles.css Show response
cdn.cookielaw.org/scripttemplates/6.31.0/assets/ 21 KB
4 KB 37ms
37ms Fetch
text/css 2606:4700::6810:9540
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.31.0/assets/otCommonStyles.css

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.31.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

42da203fcc4325bd58c8c868e9213def8ca9b8d58e79d68e86c0fd8a5744e72d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blogs.vmware.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 16 Nov 2022 20:45:17 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
content-md5: 2HSefDmVwJneRQMu6SXIPw==
age: 50826
x-ms-lease-status: unlocked
last-modified: Fri, 11 Mar 2022 07:14:31 GMT
server: cloudflare
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-ms-request-id: 1888171c-b01e-0044-0390-35048a000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
cf-ray: 76b311cb3ef89974-FRA

POST
H2 200 pixel_49c04f9a Show response
blogs.vmware.com/akam/13/ 0
687 B 30ms
30ms XHR
text/html 2a02:26f0:1700:78e::2ef
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.vmware.com/akam/13/pixel_49c04f9a

Requested by

Host: s.go-mpulse.net
URL: https://s.go-mpulse.net/boomerang/H9GEV-4J3F8-PCWZW-5GPKQ-BKVPH

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:78e::2ef Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Wed, 16 Nov 2022 20:45:18 GMT
strict-transport-security: max-age=31536000
server-timing: cdn-cache; desc=HIT, edge; dur=4
content-length: 0
content-type: text/html

GET
H2 200 utag.js Show response
tags.tiqcdn.com/utag/vmware/microsites-privacy/prod/ 435 KB
43 KB 34ms
33ms Script
application/x-javascript 23.35.236.209
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/vmware/microsites-privacy/prod/utag.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/vmware/microsites-privacy/prod/utag.sync.js?ver=6.0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.35.236.209 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-236-209.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 2d7cd5a9b4b58256d06ca15d9ca0c666218c71aa9de4902935cbfe1b37be484a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blogs.vmware.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Wed, 16 Nov 2022 20:45:18 GMT
content-encoding: gzip
last-modified: Wed, 16 Nov 2022 10:56:05 GMT
server: AkamaiNetStorage
etag: "255891a99749d4239327cd27aa0f1a0c:1668596165.476178"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=300
accept-ranges: bytes
expires: Wed, 16 Nov 2022 20:50:18 GMT

GET
H2 200 utag.156.js Show response
tags.tiqcdn.com/utag/vmware/microsites-privacy/prod/ 8 KB
3 KB 27ms
27ms Script
application/x-javascript 23.35.236.209
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/vmware/microsites-privacy/prod/utag.156.js?utv=202104300611
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/vmware/microsites-privacy/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.35.236.209 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-236-209.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: e8c9849a93c1930ad34e6d333726ef2a8d2faed7ffd6d64b9f448e4e210fb64c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blogs.vmware.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

unused62: 8096267
date: Wed, 16 Nov 2022 20:45:18 GMT
content-encoding: gzip
last-modified: Fri, 30 Apr 2021 06:11:31 GMT
server: AkamaiNetStorage
etag: "87917e55127a28cccc20cbf7f3f16f48:1619763091.402585"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 2786
expires: Thu, 01 Dec 2022 20:45:18 GMT

GET
H2 200 utag.168.js Show response
tags.tiqcdn.com/utag/vmware/microsites-privacy/prod/ 9 KB
3 KB 28ms
28ms Script
application/x-javascript 23.35.236.209
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/vmware/microsites-privacy/prod/utag.168.js?utv=202107090717
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/vmware/microsites-privacy/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.35.236.209 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-236-209.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 0c3260989047367be1e35bb9b31cfb379336b7ae8eafe410cdecd5e2e5986a62

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blogs.vmware.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

unused62: 8096267
date: Wed, 16 Nov 2022 20:45:18 GMT
content-encoding: gzip
last-modified: Fri, 02 Jul 2021 01:51:16 GMT
server: AkamaiNetStorage
etag: "39e897f0857557c21e71abb4fefef2f7:1625190676.906531"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 2967
expires: Thu, 01 Dec 2022 20:45:18 GMT

GET
H2 200 utag.v.js Show response
tags.tiqcdn.com/utag/tiqapp/ 2 B
216 B 22ms
21ms Script
application/x-javascript 23.35.236.209
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/tiqapp/utag.v.js?a=vmware/microsites-privacy/202211161055&cb=1668631518146
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/vmware/microsites-privacy/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.35.236.209 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-236-209.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blogs.vmware.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

unused62: 8096267
date: Wed, 16 Nov 2022 20:45:18 GMT
last-modified: Thu, 14 Apr 2016 16:57:51 GMT
server: AkamaiNetStorage
etag: "7bc0ee636b3b83484fc3b9348863bd22:1460653071"
content-type: application/x-javascript
cache-control: max-age=600
accept-ranges: bytes
content-length: 2
expires: Wed, 16 Nov 2022 20:55:18 GMT

GET
H2 200 features Show response
lumos.vmware.com/api/lumos/v1/client/esp-prod-131-fxsxf/ 197 B
826 B 175ms
175ms XHR
application/json 2600:9000:206f:de00:1b:f6e1:4540:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://lumos.vmware.com/api/lumos/v1/client/esp-prod-131-fxsxf/features

Requested by

Host: s.go-mpulse.net
URL: https://s.go-mpulse.net/boomerang/H9GEV-4J3F8-PCWZW-5GPKQ-BKVPH

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:206f:de00:1b:f6e1:4540:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

3f522546cc75ce54c6baafc268ac7d9698087b98412f4d56ccd3499e3f98e082

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://blogs.vmware.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36
Content-Type: application/json

Response headers

date: Wed, 16 Nov 2022 20:45:19 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
via: 1.1 df7c0ba7857d5300ae11e7566c926f16.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: master-only
x-amz-cf-pop: FRA56-C1
x-cache: Miss from cloudfront
content-length: 197
x-xss-protection: 1; mode=block
referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
x-frame-options: DENY
access-control-allow-methods: HEAD,GET
content-type: application/json
access-control-allow-origin: *
vary: Origin
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-amz-cf-id: ctBYONEASl1AUiYsd-Vdoo3sGPRSUKEO9662d0Vf36Dls5KZuvxoXg==

HEAD health
lumos.esp.eng.vmware.com/ 0
0

OPTIONS
H2 204 features
lumos.vmware.com/api/lumos/v1/client/esp-prod-131-fxsxf/ 0
0 631ms
587ms Preflight 2600:9000:206f:de00:1b:f6e1:4540:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://lumos.vmware.com/api/lumos/v1/client/esp-prod-131-fxsxf/features

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:206f:de00:1b:f6e1:4540:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://blogs.vmware.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
access-control-allow-methods: HEAD,GET
access-control-allow-origin: *
access-control-max-age: 1728000
date: Wed, 16 Nov 2022 20:45:18 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 df7c0ba7857d5300ae11e7566c926f16.cloudfront.net (CloudFront)
x-amz-cf-id: CGXo6-iJXJXcUS9-X3ym4n8gpacNSjsbBOjBgCwSt4WQTAABSscagg==
x-amz-cf-pop: FRA56-C1
x-cache: Miss from cloudfront

POST
H2 201 DzQB Show response
blogs.vmware.com/1EOAw5AP_zerPm7Ysg/a1aODhwb/aDtvbS14Ag/cB58dCBV/ 18 B
748 B 205ms
205ms XHR
application/json 2a02:26f0:1700:78e::2ef
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.vmware.com/1EOAw5AP_zerPm7Ysg/a1aODhwb/aDtvbS14Ag/cB58dCBV/DzQB

Requested by

Host: s.go-mpulse.net
URL: https://s.go-mpulse.net/boomerang/H9GEV-4J3F8-PCWZW-5GPKQ-BKVPH

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:78e::2ef Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

bef9393fcdfc7a7299c058ba2a69253c32e0964dd3e97834e17a8cdb5dce7cf6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 16 Nov 2022 20:45:18 GMT
strict-transport-security: max-age=31536000
vary: Origin
content-type: application/json
access-control-allow-origin: https://blogs.vmware.com
access-control-allow-credentials: true
x_req_id: 63665bb9-7eab-4205-ae51-936d19ba5af3
server-timing: edge; dur=5, origin; dur=174, cdn-cache; desc=MISS
access-control-allow-headers: Content-Type
content-length: 18

POST
H2 204 /
02179917.akstat.io/ 0
203 B 59ms
58ms Ping
image/gif 2a02:26f0:3400:195::11a6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://02179917.akstat.io/

Requested by

Host: s.go-mpulse.net
URL: https://s.go-mpulse.net/boomerang/H9GEV-4J3F8-PCWZW-5GPKQ-BKVPH

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:3400:195::11a6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://blogs.vmware.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Wed, 16 Nov 2022 20:45:18 GMT
content-type: image/gif
access-control-allow-origin: https://blogs.vmware.com
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
timing-allow-origin: *
x-xss-protection: 0
expires: Wed, 16 Nov 2022 20:45:18 GMT

GET
H2 200 trigger-events Show response
feedback.esp.vmware.com/api/feedback/v1/ 534 B
914 B 213ms
171ms Fetch
application/json 2600:9000:206f:dc00:4:d08a:2c40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://feedback.esp.vmware.com/api/feedback/v1/trigger-events?client_id=esp-prod-131-fxsxf&user_id=09f277c098cfb8391311438970b16e2f97c20c1e30cd71e9c657477829668097

Requested by

Host: feedback.esp.vmware.com
URL: https://feedback.esp.vmware.com/assets/ipf/esp.js?client_id=esp-prod-131-fxsxf

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:206f:dc00:4:d08a:2c40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

72ee5ac8794ec2ae209c7c806e3a25df3e3b859c179386ea6316e0e74eac1dac

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blogs.vmware.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Wed, 16 Nov 2022 20:45:19 GMT
content-encoding: gzip
via: 1.1 120ade321ed0e3697c81eb1eb19b5f62.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
x-permitted-cross-domain-policies: master-only
x-amz-cf-pop: FRA56-C1
x-cache: Miss from cloudfront
x-xss-protection: 1; mode=block
referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
x-frame-options: DENY
access-control-allow-methods: HEAD,DELETE,POST,GET,PUT
content-type: application/json
access-control-allow-origin: *
vary: Accept-Encoding,Origin
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-amz-cf-id: PdsaWLamsccFrV9qq2oqXzFP6Dqhv3uob8JcDuzfemjJ6dU4qybiig==

GET
H2 200 feedback.js Show response
feedback.esp.vmware.com/assets/ipf/ 9 KB
4 KB 191ms
190ms Script
application/javascript 2600:9000:206f:dc00:4:d08a:2c40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://feedback.esp.vmware.com/assets/ipf/feedback.js?client_id=esp-prod-131-fxsxf&namespace=feedback&lumos_namespace=esp

Requested by

Host: feedback.esp.vmware.com
URL: https://feedback.esp.vmware.com/assets/ipf/esp.js?client_id=esp-prod-131-fxsxf

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:206f:dc00:4:d08a:2c40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

c794df4ac6f5f43918e8ac8e7681f158a6c953f0c3a24616f25301561799743e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blogs.vmware.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Wed, 16 Nov 2022 20:45:19 GMT
content-encoding: gzip
via: 1.1 579a21a67e4dc50a655a7c0e9675261c.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
x-permitted-cross-domain-policies: master-only
x-amz-cf-pop: FRA56-C1
x-cache: Miss from cloudfront
x-xss-protection: 1; mode=block
referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
x-frame-options: DENY
access-control-allow-methods: HEAD,DELETE,POST,GET,PUT
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=3600
vary: Accept-Encoding,Origin
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-amz-cf-id: rpegTEHFxxS5znWvKmwKYPSOtw-IJ-Ze2TbpWFdNO-N0Y_5Kl4cq7w==

POST
H2 200 metadata Show response
lumos.vmware.com/api/lumos/v1/client/esp-prod-131-fxsxf/ 2 B
629 B 453ms
453ms XHR
application/json 2600:9000:206f:de00:1b:f6e1:4540:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://lumos.vmware.com/api/lumos/v1/client/esp-prod-131-fxsxf/metadata?user_id=1234

Requested by

Host: s.go-mpulse.net
URL: https://s.go-mpulse.net/boomerang/H9GEV-4J3F8-PCWZW-5GPKQ-BKVPH

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:206f:de00:1b:f6e1:4540:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://blogs.vmware.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36
Content-Type: application/json

Response headers

date: Wed, 16 Nov 2022 20:45:20 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
via: 1.1 df7c0ba7857d5300ae11e7566c926f16.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: master-only
x-amz-cf-pop: FRA56-C1
x-cache: Miss from cloudfront
content-length: 2
x-xss-protection: 1; mode=block
referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
vary: Origin
access-control-allow-methods: HEAD,GET
content-type: application/json
access-control-allow-origin: *
x-frame-options: DENY
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-amz-cf-id: 8NXuQ1wvLRGavA3_kvHMdHomQtezIyiv47UmBJW_boftbCU22Gd8tg==

OPTIONS
H2 204 metadata
lumos.vmware.com/api/lumos/v1/client/esp-prod-131-fxsxf/ 0
0 441ms
441ms Preflight 2600:9000:206f:de00:1b:f6e1:4540:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://lumos.vmware.com/api/lumos/v1/client/esp-prod-131-fxsxf/metadata?user_id=1234

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:206f:de00:1b:f6e1:4540:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://blogs.vmware.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
access-control-allow-methods: HEAD,GET
access-control-allow-origin: *
access-control-max-age: 1728000
date: Wed, 16 Nov 2022 20:45:19 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 df7c0ba7857d5300ae11e7566c926f16.cloudfront.net (CloudFront)
x-amz-cf-id: sbmlhBeehlPCrNcJV84J1sSEtUCuzKCn_DJFVTmX7lxsLgs-9gy-WA==
x-amz-cf-pop: FRA56-C1
x-cache: Miss from cloudfront

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: lumos.esp.eng.vmware.com
URL: https://lumos.esp.eng.vmware.com/health

Verdicts & Comments Add Verdict or Comment

180 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

6 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.vmware.com/	1970-01-20 07:30:45	Name: bm_sz Value: 301F01BB154ED770D10BE09F9C6C8036~YAAQEthUuIymbn+EAQAAPVcwghH1G7Nht/88SIbehTIF+0E0VgoN3B2K2BUmn6UUF5PIMVw+IEQqIz7sQLXWPQ0wGWb98t0SoRTaS6Se1GVzz6ra0cjzpiWC2+DhduiG/MgQ61BtvGR3KQoqUS0Zzg2BN0Ya0NGabKo4BvbcItrG7/stSLuvqmHH+3euifrDkbAeu/todxtTWVciiv9+WwLb3ZdZCVmWvQQue86ly3ZXD5lpNpLyV0hMxD98VYE1uRh25E+gSjTkMuuZ8g0MDbn650NQtG3dpNHxOwY1F6uj5rQ=~4337968~3421508
.vmware.com/	1970-01-20 16:16:07	Name: OptanonConsent Value: isGpcEnabled=0&datestamp=Wed+Nov+16+2022+20%3A45%3A18+GMT%2B0000+(GMT)&version=6.31.0&isIABGlobal=false&hosts=&consentId=a76259a5-60a4-4306-9553-ae50d5e5e992&interactionCount=0&landingPath=https%3A%2F%2Fblogs.vmware.com%2Fsecurity%2F2022%2F11%2Fbatloader-the-evasive-downloader-malware.html&groups=C0001%3A1%2CC0002%3A0%2CC0003%3A0%2CC0004%3A0%2CC0005%3A0
.vmware.com/	1970-01-20 07:30:38	Name: ak_bmsc Value: 3929C6B4EB059EFF6CB010A76F3CC28E~000000000000000000000000000000~YAAQEthUuLKmbn+EAQAAY1swghF9N0Fb1l+EjdV900E1gj9cvMk4iAiI7RbBajaVOo2dabiIKMJwrFLJH6SY4OaiWPOVzIRL1qzsNVPRJy+yvyYlV0KE0hxLUL1N5a4g+4hQqN7VUkfGJNAVwBg1xug13IOK4xYLM9tiITaCX1PXHXwofXd7WtbXgJzB//Yqb9Z4IpT16mqvskYFVN9w8I1+yUcFPIhmIvstkFBDKXYJVa2Hbz+JpOUeuo3L4034bXpGrVN4HBgz/nVLtXgq3L4OHM0ssRCWLSFMTUlPOCyIqYpKo70/iw/jQPrubUTssZ9k0nheorUaUCHsKsonLeySLSc+SOVNdogD2n1/vnQsZOtD+P/fnVQA0CmWXmcdwiywfvOQLlvoDUXJSowqm7OuozGURA7jwBwBv1OrgjnznnDrYrbnFe76U2eeZvIhHnv5umS5yJKmmXNIve3JReerWFXJfTAYmp6QUEj+Ih0+TobAsawvCY081z1UOUwHW8hL7NIF9Zk2BbvY3pS1Sy50
.vmware.com/	1970-01-20 16:16:07	Name: utag_main Value: v_id:018482305b920018e9e17a63df2a03074005706c00b08$_sn:1$_ss:1$_pn:1%3Bexp-session$_st:1668633318098$ses_id:1668631518098%3Bexp-session
.blogs.vmware.com/	1970-01-20 07:40:36	Name: RT Value: "z=1&dm=blogs.vmware.com&si=ba2c7f16-b26b-48cd-8ce7-771ec494279c&ss=lak44ef2&sl=1&tt=1ca&bcn=%2F%2F02179917.akstat.io%2F&ld=1cb"
.vmware.com/	1970-01-20 16:16:07	Name: _abck Value: 3CB77D3D2A121A7FEB12B977E59DED99~-1~YAAQEthUuL6mbn+EAQAAuF0wggg1uNG/G9zxbUlyNSc+iG6RSm40xfNd49RiLX47L7hMK9zMe84wJUKhSpnVmr8BGbLIpa69Dl5o0GSjp96wSwQMtzRoSi0k8lSpVDVI5NTgl8BBeraSihEBqyBhrHAU9htpUw/Od45Siy77/x165k+J5R1n9EAOckEUYWc8cTiQedCNjJyOm5XEPLtD/qHyj5e80zCpJrsLges8s+VvDRhP/jzIy3flkgpXwRJ460NEV6kXqXY/twnW5kW4+XjNC0nTszZe25E+5M1bGWIUEirkBMEEgRaTWsSeVf0cXCBeBtqeZ5Jl9vJnbVg6ZwklRSObEL2ww54mWtwD9kez4cZiCSJcvfuf3jSp1jZZSxK+pSLZrjnfMw==~-1~-1~-1

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://lumos.esp.eng.vmware.com/health Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

02179917.akstat.io
blogs.vmware.com
c.go-mpulse.net
cdn.cookielaw.org
feedback.esp.vmware.com
geolocation.onetrust.com
i1.wp.com
lumos.esp.eng.vmware.com
lumos.vmware.com
s.go-mpulse.net
secure.gravatar.com
tags.tiqcdn.com
www.vmware.com
lumos.esp.eng.vmware.com
192.0.77.2
23.35.236.209
2600:9000:206f:dc00:4:d08a:2c40:93a1
2600:9000:206f:de00:1b:f6e1:4540:93a1
2606:4700::6810:9540
2606:4700::6812:1a55
2a02:26f0:1700:78e::2ef
2a02:26f0:3400:195::11a6
2a02:26f0:4700:290::11a6
2a04:fa87:fffe::c000:4902
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300
0667f1d5e6d4928d7f140a72ad4970fecb5c6a7caf09e26d08d526a831aa073b
088cb0b5b803bbf57403577861d1f063b6a45fe9fd7adcfab7944f962ac81be9
09ebd7f407439990aac227e70da23e1a819e8e30282928e324370805f480bec4
0c3260989047367be1e35bb9b31cfb379336b7ae8eafe410cdecd5e2e5986a62
0ede3245cacb5015a1babbfcf0871f6183e87c9ba3a6bb93694acf764e644731
2114f81b0fd9980770e14c6da5ca4c2b84d2f1a73c119570d242a614743f3b6a
2157361193375a79ade3559e960f982daa8d599cf7f4a92d36e3eef257738f16
2366c611d0fe95569b075c974cd1b953a09c8562b0be8e42e2bf28ac3088020b
25939f220c38d945f2ae4f69830e034fee59316410dac70da21c0fa2a21f2df5
2d7cd5a9b4b58256d06ca15d9ca0c666218c71aa9de4902935cbfe1b37be484a
2e02bee0e07e55b5375ce1666aedda58acaa6adc8d86dcefbe8e7c491bf0e7ed
2f090a05f250f0f8854ef4db0a845f890f4c5735b41acf0c9b0a83fda98a4a09
30ed0c6940854fd56a07028cdb1c9add025acc4c57c1481b51f29289ef88884e
324e55267685920cf7f331734a3a05d006d308b0fe2fdfa3ff9400b101efc7ab
39cc21ca9b7ed1c403459527d74576906bc7091b1a6cc5ac08cfe5337708289c
3f522546cc75ce54c6baafc268ac7d9698087b98412f4d56ccd3499e3f98e082
42da203fcc4325bd58c8c868e9213def8ca9b8d58e79d68e86c0fd8a5744e72d
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
4419ebe4c794bc0ae0967f648f2cf6a625476ec59d56d24c93c91c2fde08815d
44c19c3337beb6cf1a7cc25f38ac4fc32e1e4d5e6d50d270287659cad80c80ae
4d3bacb83d218f128d734b7dbebf1a2d0db7dfd681525917c189eea1b3cf6f30
4f01c7ac30cf937559ed8790e81398fe0f3fd191f77f09e11d5f0cc33981afa9
528f6be3592f46be7126029a99daa89c1dd3711cf5fab20939309de97ebbc31a
55d19f9e782ceeeff91c07d74d1b62cfab6c5fd76fefb65c0361eaee0d5055ea
5aad5fbd4238981a9ff5e2772ff1353dfe1a801fb49542fe157418c1438f7782
63b693778274923011281f0c339ac4116f8a31b9d186d0657849380cd5bd34b7
67afc6a58a5afbace5d49bb88a65fe76e29125ea7063ccc06c103ea4b57a5ce5
6a44c4e95239008073f3d2a30763492443d0a72ba3f31f34c9c097b5a9046c58
6eb0532f07f4e37a0309c55f77c19ea3c454363e080cd3a26566b447f31403c8
6feb8825b331e458c390691ad137e08442b33b86efc089b2761b50c3319e46ea
72ee5ac8794ec2ae209c7c806e3a25df3e3b859c179386ea6316e0e74eac1dac
738863ef3bb90d22fef3494acc26d0d31e2f290456ecfebc273941f683b1abbb
73ff4103627eb73810ed2dfd0184c69b9fca7218504dbe3bc4ac95882667b1a8
74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
77c89f758760f6d85fceea091c6ad7b538f6eff18b625a89bb15f1748ccc2e99
7eab176359f9cb1dec55ae347dd45d3f1947a54f367e7a8011302711296e264d
80d54533f80e8233621f965ae0a7713928bdb4d491ed0eb5e90434550f1894cb
832f350d6d5335f0c7dd62bf45c30d5808a7d35249be1711e699b5ac68ffc9af
8501c833e508c85ca35969513569fa47bc62bd66321ac204ecc24c92c3a6bff6
86c45fc889b11a40296913e5f00d8fefe29d23d342d47a7e481b61bd982d0206
8a9fa0d261f613974b829b7dca37a99340f3a4ddbfca96faebd43e475c74f402
8c925c49ef36b7be79a38d9bb5d210e1be96e9443caf5a5cf3e332f829c1104f
8f200f9561e423ae6563d09abe143d4ecf57783d4915832a2496d599530b1a3b
8ff02af5bffd2c74d16f20fddb34bc7ec51c93e13544fdf2e1f4a1c5845da82c
9b6823a5a9c082eb8ad40231dada88cfefe97c545c1a22825d50b5525874266c
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb
af62bfb9ed9811c4fd15dafcf734659b8cdb86443fbaf183974a15323e29d733
b1877e7e523910578bdcd6127ddeff087539b01b4ea9c251a523ec7e3d72ff48
b63d49856ca1db040770736dec01e14708f914b8e4a164fa3ced2e661bd88e6e
b82ac9377577170cb4e1e0c1b2bc4512fda7340087e7ec9706e5d79de66a2ed5
b8b8fa76143b1e3d6bcd32187df721f7ad888aeb09fef2dc15b485c98d09e362
bbc4456bca95006683a8f081d0d2ed645eef5b14c62eca12c70f7e1cec26c1a0
bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea
bef9393fcdfc7a7299c058ba2a69253c32e0964dd3e97834e17a8cdb5dce7cf6
c206dacd2a003950891d02fd15180cd7a8a740658cc1c6ebc9a7c87935c5dea1
c68deba0294e0ed06089c2500441dd15e4155a4291355719cd6804defc75da5d
c778db3f26d8857d58085536b2e4f36f9abb03da6eb2626f883aaf97952ccda5
c794df4ac6f5f43918e8ac8e7681f158a6c953f0c3a24616f25301561799743e
d26f0ef4dec593d0dc576b40b1c41397ec1dda474810b7d019dd884ed9e062db
d678ab3b4e7dddf5615012cc1a930e50dfbc967181b8fbeb1b98d61549f5ed08
d72cd2b47109ae3d37dd5b5f44a14178d4b2b07c8adcbca202898e865d809fa4
db3dad39e95eed93512050a0fbbb2bc27c0e65b5c87646ca44aaea45fadab90f
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e5fdb43f2c7f1a5596e4dfe55b42b07a0718479f2f01aef135e0bbf75b119494
e60033926a73b04b4ebb06ca9d926e5ee54dca7e5fe41f2823e09d9ed732a10f
e8c9849a93c1930ad34e6d333726ef2a8d2faed7ffd6d64b9f448e4e210fb64c
ebd13a676213c7528e229d5358cd578a30eb800275d0563ad1e6dd68caed1fde
fe4946db1f133c18e59bde7de4f6e87a50d288f85ec8440451b998e0f3f17e66
fe7f18f5cc3719144a794426f0608bb6ce73bd5f9ad3929a59f8106763dca2d9

blogs.vmware.com Open in urlscan Pro 2a02:26f0:1700:78e::2ef Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

76 Requests

93 %HTTPS

80 %IPv6

8 Domains

13 Subdomains

10 IPs

4 Countries

2347 kBTransfer

4967 kBSize

6 Cookies

43 Outgoing links

Redirected requests

76 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

blogs.vmware.com Open in urlscan Pro
2a02:26f0:1700:78e::2ef Public Scan

Screenshot
Live screenshot

Full Image

76
Requests

93 %
HTTPS

80 %
IPv6

8
Domains

13
Subdomains

10
IPs

4
Countries

2347 kB
Transfer

4967 kB
Size

6
Cookies

76 HTTP transactions
2 data transactions