blogs.it.ox.ac.uk Open in urlscan Pro
2001:630:440:107:0:2:0:17 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://blogs.it.ox.ac.uk/oxcert/2015/11/09/major-dridex-banking-malware-outbreak/
Submission: On September 28 via api (September 28th 2020, 10:06:46 pm UTC) from US

Summary HTTP 11 Redirects Links 2 Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 11 HTTP transactions. The main IP is 2001:630:440:107:0:2:0:17, located in United Kingdom and belongs to JANET Jisc Services Limited, GB. The main domain is blogs.it.ox.ac.uk.
TLS certificate: Issued by AffirmTrust Certificate Authority - OV1 on September 6th 2019. Valid for: 2 years.

This is the only time blogs.it.ox.ac.uk was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address		AS Autonomous System
9	2001:630:440:... 2001:630:440:107:0:2:0:17		786 (JANET Jis...) (JANET Jisc Services Limited)
1	2a00:1450:400... 2a00:1450:4001:819::2004		15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:801::2003		15169 (GOOGLE) (GOOGLE)
11	3

9 2001:630:440:107:0:2:0:17 (United Kingdom)

ASN786 (JANET Jisc Services Limited, GB)

blogs.it.ox.ac.uk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:819::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:801::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	ox.ac.uk blogs.it.ox.ac.uk	286 KB
1	gstatic.com www.gstatic.com	133 KB
1	google.com www.google.com	674 B
11	3

	Domain	Requested by
9	blogs.it.ox.ac.uk	blogs.it.ox.ac.uk
1	www.gstatic.com	www.google.com
1	www.google.com	blogs.it.ox.ac.uk
11	3

This site contains links to these domains. Also see Links.

Domain
wordpress.org
www.it.ox.ac.uk

Subject Issuer	Validity	Valid
blogs.it.ox.ac.uk AffirmTrust Certificate Authority - OV1	`2019-09-06` - `2021-10-06`	2 years	crt.sh
www.google.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
*.gstatic.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://blogs.it.ox.ac.uk/oxcert/2015/11/09/major-dridex-banking-malware-outbreak/
Frame ID: 7B2C2A4B577F366603643B0FF78A6D27
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i
meta generator /^WordPress ?([\d.]+)?/i
headers link /rel="https:\/\/api\.w\.org\/"/i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i
meta generator /^WordPress ?([\d.]+)?/i
headers link /rel="https:\/\/api\.w\.org\/"/i

MySQL (Databases) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i
meta generator /^WordPress ?([\d.]+)?/i
headers link /rel="https:\/\/api\.w\.org\/"/i

Debian (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Debian/i

OpenSSL (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
script /jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?/i

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?/i

Page Statistics

11
Requests

100 %
HTTPS

100 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

420 kB
Transfer

624 kB
Size

0
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: http://wordpress.org/
Title: WordPress

Search URL Search Domain Scan URL

URL: http://www.it.ox.ac.uk/
Title: University of Oxford IT Services

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 404
Not Found Primary Request / Show response
blogs.it.ox.ac.uk/oxcert/2015/11/09/major-dridex-banking-malware-outbreak/ 20 KB
20 KB 255ms
152ms Document
text/html 2001:630:440:107:0:2:0:17
JANET Jisc Servic...

General

Check archive.org

Show headers Download Go to

Full URL: https://blogs.it.ox.ac.uk/oxcert/2015/11/09/major-dridex-banking-malware-outbreak/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:630:440:107:0:2:0:17 , United Kingdom, ASN786 (JANET Jisc Services Limited, GB),
Reverse DNS
Software: Apache/2.4.10 (Debian) OpenSSL/1.0.1t /
Resource Hash: 292d178afc6d27ae9863fa2218c4b09e38ae1dbf4f1777be0a120a0d87588321

Request headers

Host: blogs.it.ox.ac.uk
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 28 Sep 2020 22:06:30 GMT
Server: Apache/2.4.10 (Debian) OpenSSL/1.0.1t
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Link: <https://blogs.it.ox.ac.uk/wp-json/>; rel="https://api.w.org/" <https://blogs.it.ox.ac.uk/0>; rel=shortlink
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK style.css
blogs.it.ox.ac.uk/wp-content/themes/oucs-default/ 21 KB
21 KB 71ms
23ms Stylesheet
text/css 2001:630:440:107:0:2:0:17
JANET Jisc Servic...

General

Check archive.org

Show headers Download Go to

Full URL: https://blogs.it.ox.ac.uk/wp-content/themes/oucs-default/style.css
Requested by: Host: blogs.it.ox.ac.uk
URL: https://blogs.it.ox.ac.uk/oxcert/2015/11/09/major-dridex-banking-malware-outbreak/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:630:440:107:0:2:0:17 , United Kingdom, ASN786 (JANET Jisc Services Limited, GB),
Reverse DNS
Software: Apache/2.4.10 (Debian) OpenSSL/1.0.1t /
Resource Hash: ec90e8ad3578bc63fe890dea629d31a6121d4dcdb67b8d0f087ecca022dd6883

Request headers

Referer: https://blogs.it.ox.ac.uk/oxcert/2015/11/09/major-dridex-banking-malware-outbreak/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 28 Sep 2020 22:06:30 GMT
Last-Modified: Tue, 30 Apr 2013 12:33:49 GMT
Server: Apache/2.4.10 (Debian) OpenSSL/1.0.1t
ETag: "5404-4db9336912540"
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=100
Content-Length: 21508

GET
H/1.1 200
OK style.css
blogs.it.ox.ac.uk/wp-content/plugins/uk-cookie-consent/assets/css/ 4 KB
4 KB 74ms
26ms Stylesheet
text/css 2001:630:440:107:0:2:0:17
JANET Jisc Servic...

General

Check archive.org

Show headers Download Go to

Full URL: https://blogs.it.ox.ac.uk/wp-content/plugins/uk-cookie-consent/assets/css/style.css?ver=4.7.18
Requested by: Host: blogs.it.ox.ac.uk
URL: https://blogs.it.ox.ac.uk/oxcert/2015/11/09/major-dridex-banking-malware-outbreak/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:630:440:107:0:2:0:17 , United Kingdom, ASN786 (JANET Jisc Services Limited, GB),
Reverse DNS
Software: Apache/2.4.10 (Debian) OpenSSL/1.0.1t /
Resource Hash: 5e99510e1a7932a03e4c1acfd2be07d9557a5965800b93202c32feead42d844b

Request headers

Referer: https://blogs.it.ox.ac.uk/oxcert/2015/11/09/major-dridex-banking-malware-outbreak/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 28 Sep 2020 22:06:30 GMT
Last-Modified: Wed, 09 Aug 2017 17:48:42 GMT
Server: Apache/2.4.10 (Debian) OpenSSL/1.0.1t
ETag: "105c-55655b0cd3280"
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=100
Content-Length: 4188

GET
H/1.1 200
OK jquery.js Show response
blogs.it.ox.ac.uk/wp-includes/js/jquery/ 95 KB
95 KB 73ms
24ms Script
application/javascript 2001:630:440:107:0:2:0:17
JANET Jisc Servic...

General

Check archive.org

Show headers Download Go to

Full URL: https://blogs.it.ox.ac.uk/wp-includes/js/jquery/jquery.js?ver=1.12.4
Requested by: Host: blogs.it.ox.ac.uk
URL: https://blogs.it.ox.ac.uk/oxcert/2015/11/09/major-dridex-banking-malware-outbreak/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:630:440:107:0:2:0:17 , United Kingdom, ASN786 (JANET Jisc Services Limited, GB),
Reverse DNS
Software: Apache/2.4.10 (Debian) OpenSSL/1.0.1t /
Resource Hash: cf34e1b87bbfd9d9b185dec994924a496e279d8dc9387ad8d35bc0110134c4d3

Request headers

Referer: https://blogs.it.ox.ac.uk/oxcert/2015/11/09/major-dridex-banking-malware-outbreak/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 28 Sep 2020 22:06:30 GMT
Last-Modified: Wed, 04 Sep 2019 21:48:07 GMT
Server: Apache/2.4.10 (Debian) OpenSSL/1.0.1t
ETag: "17a6a-591c1290d33c0"
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=100
Content-Length: 96874

GET
H/1.1 200
OK jquery-migrate.min.js Show response
blogs.it.ox.ac.uk/wp-includes/js/jquery/ 10 KB
10 KB 75ms
26ms Script
application/javascript 2001:630:440:107:0:2:0:17
JANET Jisc Servic...

General

Check archive.org

Show headers Download Go to

Full URL: https://blogs.it.ox.ac.uk/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1
Requested by: Host: blogs.it.ox.ac.uk
URL: https://blogs.it.ox.ac.uk/oxcert/2015/11/09/major-dridex-banking-malware-outbreak/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:630:440:107:0:2:0:17 , United Kingdom, ASN786 (JANET Jisc Services Limited, GB),
Reverse DNS
Software: Apache/2.4.10 (Debian) OpenSSL/1.0.1t /
Resource Hash: 48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d

Request headers

Referer: https://blogs.it.ox.ac.uk/oxcert/2015/11/09/major-dridex-banking-malware-outbreak/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 28 Sep 2020 22:06:30 GMT
Last-Modified: Fri, 20 May 2016 06:11:28 GMT
Server: Apache/2.4.10 (Debian) OpenSSL/1.0.1t
ETag: "2748-5333ff613c400"
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=100
Content-Length: 10056

GET
H/1.1 200
OK itservices-header.png
blogs.it.ox.ac.uk/wp-content/themes/oucs-default/images/ 113 KB
113 KB 23ms
23ms Image
image/png 2001:630:440:107:0:2:0:17
JANET Jisc Servic...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blogs.it.ox.ac.uk/wp-content/themes/oucs-default/images/itservices-header.png
Requested by: Host: blogs.it.ox.ac.uk
URL: https://blogs.it.ox.ac.uk/wp-content/themes/oucs-default/style.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:630:440:107:0:2:0:17 , United Kingdom, ASN786 (JANET Jisc Services Limited, GB),
Reverse DNS
Software: Apache/2.4.10 (Debian) OpenSSL/1.0.1t /
Resource Hash: e8f891b100fb5be4871789c91d13d789722701c4487abd9573a38a5ebcc5a651

Request headers

Referer: https://blogs.it.ox.ac.uk/wp-content/themes/oucs-default/style.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 28 Sep 2020 22:06:30 GMT
Last-Modified: Fri, 01 Mar 2013 14:31:12 GMT
Server: Apache/2.4.10 (Debian) OpenSSL/1.0.1t
ETag: "1c24a-4d6dddbe24c00"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=99
Content-Length: 115274

GET
H/1.1 200
OK default_style.css
blogs.it.ox.ac.uk/wp-content/plugins/network-latest-posts/css/ 18 KB
19 KB 24ms
23ms Stylesheet
text/css 2001:630:440:107:0:2:0:17
JANET Jisc Servic...

General

Check archive.org

Show headers Download Go to

Full URL: https://blogs.it.ox.ac.uk/wp-content/plugins/network-latest-posts/css/default_style.css?ver=4.7.18
Requested by: Host: blogs.it.ox.ac.uk
URL: https://blogs.it.ox.ac.uk/oxcert/2015/11/09/major-dridex-banking-malware-outbreak/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:630:440:107:0:2:0:17 , United Kingdom, ASN786 (JANET Jisc Services Limited, GB),
Reverse DNS
Software: Apache/2.4.10 (Debian) OpenSSL/1.0.1t /
Resource Hash: 916eeee8f786b3ca52171d145a5b18b11adfcc97f88f2e046b5b425a4cdb70a2

Request headers

Referer: https://blogs.it.ox.ac.uk/oxcert/2015/11/09/major-dridex-banking-malware-outbreak/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 28 Sep 2020 22:06:31 GMT
Last-Modified: Thu, 24 Sep 2015 12:43:10 GMT
Server: Apache/2.4.10 (Debian) OpenSSL/1.0.1t
ETag: "49a0-5207d92d53380"
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=99
Content-Length: 18848

GET
H/1.1 200
OK uk-cookie-consent-js.js Show response
blogs.it.ox.ac.uk/wp-content/plugins/uk-cookie-consent/assets/js/ 2 KB
2 KB 25ms
24ms Script
application/javascript 2001:630:440:107:0:2:0:17
JANET Jisc Servic...

General

Check archive.org

Show headers Download Go to

Full URL: https://blogs.it.ox.ac.uk/wp-content/plugins/uk-cookie-consent/assets/js/uk-cookie-consent-js.js?ver=2.3.0
Requested by: Host: blogs.it.ox.ac.uk
URL: https://blogs.it.ox.ac.uk/oxcert/2015/11/09/major-dridex-banking-malware-outbreak/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:630:440:107:0:2:0:17 , United Kingdom, ASN786 (JANET Jisc Services Limited, GB),
Reverse DNS
Software: Apache/2.4.10 (Debian) OpenSSL/1.0.1t /
Resource Hash: c70eb486b28b3715c7bfe442e6629d131c320e75185c4f6ea15b753c2857238f

Request headers

Referer: https://blogs.it.ox.ac.uk/oxcert/2015/11/09/major-dridex-banking-malware-outbreak/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 28 Sep 2020 22:06:31 GMT
Last-Modified: Wed, 09 Aug 2017 17:48:42 GMT
Server: Apache/2.4.10 (Debian) OpenSSL/1.0.1t
ETag: "604-55655b0cd3280"
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=98
Content-Length: 1540

GET
H/1.1 200
OK wp-embed.min.js Show response
blogs.it.ox.ac.uk/wp-includes/js/ 1 KB
2 KB 23ms
23ms Script
application/javascript 2001:630:440:107:0:2:0:17
JANET Jisc Servic...

General

Check archive.org

Show headers Download Go to

Full URL: https://blogs.it.ox.ac.uk/wp-includes/js/wp-embed.min.js?ver=4.7.18
Requested by: Host: blogs.it.ox.ac.uk
URL: https://blogs.it.ox.ac.uk/oxcert/2015/11/09/major-dridex-banking-malware-outbreak/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:630:440:107:0:2:0:17 , United Kingdom, ASN786 (JANET Jisc Services Limited, GB),
Reverse DNS
Software: Apache/2.4.10 (Debian) OpenSSL/1.0.1t /
Resource Hash: dcb5e540e62fc85857254a1066afb6a7e8999279c6d4c583eef855d39f9289c0

Request headers

Referer: https://blogs.it.ox.ac.uk/oxcert/2015/11/09/major-dridex-banking-malware-outbreak/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 28 Sep 2020 22:06:31 GMT
Last-Modified: Wed, 23 Nov 2016 13:38:33 GMT
Server: Apache/2.4.10 (Debian) OpenSSL/1.0.1t
ETag: "576-541f8014be840"
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=99
Content-Length: 1398

GET
H2 200 api.js Show response
www.google.com/recaptcha/ 915 B
674 B 19ms
19ms Script
text/javascript 2a00:1450:4001:819::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js?onload=bwpRecaptchaCallback&render=explicit

Requested by

Host: blogs.it.ox.ac.uk
URL: https://blogs.it.ox.ac.uk/oxcert/2015/11/09/major-dridex-banking-malware-outbreak/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

965bcd4e39326356bfe44fd407de392d28d9ad8f2c7b22b82ac75452f556722a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://blogs.it.ox.ac.uk/oxcert/2015/11/09/major-dridex-banking-malware-outbreak/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 22:06:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
status: 200
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
content-security-policy: frame-ancestors 'self'
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 582
x-xss-protection: 1; mode=block
expires: Mon, 28 Sep 2020 22:06:30 GMT

GET
H2 200 recaptcha__en.js Show response
www.gstatic.com/recaptcha/releases/yXSLJBpiFoTYkexaPhFknpU7/ 340 KB
133 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/yXSLJBpiFoTYkexaPhFknpU7/recaptcha__en.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?onload=bwpRecaptchaCallback&render=explicit

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2698f18de870d08f9b84a9e741e1ca17697c8a8ef90703564579bb42ae579d82

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://blogs.it.ox.ac.uk
Referer: https://blogs.it.ox.ac.uk/oxcert/2015/11/09/major-dridex-banking-malware-outbreak/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 21:34:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1904
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 136265
x-xss-protection: 0
last-modified: Tue, 22 Sep 2020 00:07:57 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 28 Sep 2021 21:34:47 GMT

Verdicts & Comments Add Verdict or Comment

18 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| trustedTypes object| _wpemojiSettings undefined| $ function| jQuery object| ctcc_vars function| catapultSetCookie function| catapultReadCookie function| catapultDeleteCookie function| catapultAcceptCookies function| ctccCloseNotification function| ctccFirstPage object| wp function| bwpRecaptchaCallback object| ___grecaptcha_cfg object| grecaptcha string| __recaptcha_api boolean| __google_recaptcha_client object| recaptcha

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://blogs.it.ox.ac.uk/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1(Line 2) Message: JQMIGRATE: Migrate is installed, version 1.4.1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

blogs.it.ox.ac.uk
www.google.com
www.gstatic.com
2001:630:440:107:0:2:0:17
2a00:1450:4001:801::2003
2a00:1450:4001:819::2004
2698f18de870d08f9b84a9e741e1ca17697c8a8ef90703564579bb42ae579d82
292d178afc6d27ae9863fa2218c4b09e38ae1dbf4f1777be0a120a0d87588321
48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d
5e99510e1a7932a03e4c1acfd2be07d9557a5965800b93202c32feead42d844b
916eeee8f786b3ca52171d145a5b18b11adfcc97f88f2e046b5b425a4cdb70a2
965bcd4e39326356bfe44fd407de392d28d9ad8f2c7b22b82ac75452f556722a
c70eb486b28b3715c7bfe442e6629d131c320e75185c4f6ea15b753c2857238f
cf34e1b87bbfd9d9b185dec994924a496e279d8dc9387ad8d35bc0110134c4d3
dcb5e540e62fc85857254a1066afb6a7e8999279c6d4c583eef855d39f9289c0
e8f891b100fb5be4871789c91d13d789722701c4487abd9573a38a5ebcc5a651
ec90e8ad3578bc63fe890dea629d31a6121d4dcdb67b8d0f087ecca022dd6883