www.bitdefender.com Open in urlscan Pro
2606:4700::6812:a8de Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://labs.bitdefender.com/2020/03/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/
Effective URL:
https://www.bitdefender.com/blog/labs/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/
Submission Tags: falconsandbox
Submission: On September 05 via api (September 5th 2022, 7:11:43 pm UTC) from US — Scanned from DE

Summary HTTP 84 Redirects Links 41 Behaviour Indicators

Summary

This website contacted 36 IPs in 5 countries across 27 domains to perform 84 HTTP transactions. The main IP is 2606:4700::6812:a8de, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.bitdefender.com. The Cisco Umbrella rank of the primary domain is 100416.
TLS certificate: Issued by DigiCert TLS RSA SHA256 2020 CA1 on November 8th 2021. Valid for: a year.

This is the only time www.bitdefender.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2 34	2606:4700::68... 2606:4700::6812:a8de	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	2a02:26f0:350... 2a02:26f0:3500:592::1e80	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2a02:26f0:ea:... 2a02:26f0:ea::215:ac21	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	159.89.102.253 159.89.102.253	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
1	2a04:fa87:fff... 2a04:fa87:fffe::c000:4902	2635 (AUTOMATTIC) (AUTOMATTIC)
1 6	34.249.157.182 34.249.157.182	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:801::2008	15169 (GOOGLE) (GOOGLE)
2	18.66.97.17 18.66.97.17	16509 (AMAZON-02) (AMAZON-02)
1	2a02:26f0:350... 2a02:26f0:3500:16::215:149b	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	35.201.112.186 35.201.112.186	15169 (GOOGLE) (GOOGLE)
1	18.66.97.37 18.66.97.37	16509 (AMAZON-02) (AMAZON-02)
1	18.66.147.110 18.66.147.110	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:400e:810::200a	15169 (GOOGLE) (GOOGLE)
1	2a02:26f0:10e... 2a02:26f0:10e:2b1::f09	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
4	2a00:1450:400... 2a00:1450:4001:801::2003	15169 (GOOGLE) (GOOGLE)
1	52.19.103.22 52.19.103.22	16509 (AMAZON-02) (AMAZON-02)
2	13.36.218.177 13.36.218.177	16509 (AMAZON-02) (AMAZON-02)
1 1	34.248.32.199 34.248.32.199	16509 (AMAZON-02) (AMAZON-02)
1	52.208.60.7 52.208.60.7	16509 (AMAZON-02) (AMAZON-02)
3 3	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	108.138.7.111 108.138.7.111	16509 (AMAZON-02) (AMAZON-02)
2	13.32.99.38 13.32.99.38	16509 (AMAZON-02) (AMAZON-02)
1	35.186.194.58 35.186.194.58	15169 (GOOGLE) (GOOGLE)
1	216.58.212.162 216.58.212.162	15169 (GOOGLE) (GOOGLE)
1	18.66.147.116 18.66.147.116	16509 (AMAZON-02) (AMAZON-02)
1	142.250.184.198 142.250.184.198	15169 (GOOGLE) (GOOGLE)
1	18.153.3.78 18.153.3.78	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:810::2002	15169 (GOOGLE) (GOOGLE)
1	35.244.174.68 35.244.174.68	15169 (GOOGLE) (GOOGLE)
1	34.117.30.199 34.117.30.199	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	63.34.154.154 63.34.154.154	16509 (AMAZON-02) (AMAZON-02)
1	108.138.17.47 108.138.17.47	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:802::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80f::2003	15169 (GOOGLE) (GOOGLE)
1 1	172.217.16.194 172.217.16.194	15169 (GOOGLE) (GOOGLE)
1	104.244.42.131 104.244.42.131	13414 (TWITTER) (TWITTER)
1 1	34.111.234.236 34.111.234.236	15169 (GOOGLE) (GOOGLE)
2 2	34.251.71.171 34.251.71.171	16509 (AMAZON-02) (AMAZON-02)
1 2	52.54.217.46 52.54.217.46	14618 (AMAZON-AES) (AMAZON-AES)
84	36

34 2606:4700::6812:a8de (United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

labs.bitdefender.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.bitdefender.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
blogapp.bitdefender.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a02:26f0:3500:592::1e80 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

assets.adobedtm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:ea::215:ac21 (Vienna, Austria)

ASN20940 (AKAMAI-ASN1, NL)

consent.cookiebot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 159.89.102.253 (Frankfurt am Main, Germany)

ASN14061 (DIGITALOCEAN-ASN, US)

geolocation-db.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:fa87:fffe::c000:4902 (Ireland)

ASN2635 (AUTOMATTIC, US)

2.gravatar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 34.249.157.182 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-34-249-157-182.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:801::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.66.97.17 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-97-17.fra56.r.cloudfront.net

api.company-target.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:3500:16::215:149b (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.201.112.186 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 186.112.201.35.bc.googleusercontent.com

edge.fullstory.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.97.37 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-97-37.fra56.r.cloudfront.net

static.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.147.110 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-147-110.fra60.r.cloudfront.net

cdn.scarabresearch.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400e:810::200a (Ireland)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:10e:2b1::f09 (Vienna, Austria)

ASN20940 (AKAMAI-ASN1, NL)

consentcdn.cookiebot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:801::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.19.103.22 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-19-103-22.eu-west-1.compute.amazonaws.com

bitdefender.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.36.218.177 (Paris, France)

ASN16509 (AMAZON-02, US)
PTR: ec2-13-36-218-177.eu-west-3.compute.amazonaws.com

sstats.bitdefender.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.248.32.199 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-34-248-32-199.eu-west-1.compute.amazonaws.com

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.208.60.7 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-208-60-7.eu-west-1.compute.amazonaws.com

starget.bitdefender.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:21::14 (United States) 3 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 108.138.7.111 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-138-7-111.fra56.r.cloudfront.net

script.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.32.99.38 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-99-38.fra60.r.cloudfront.net

static.scarabresearch.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.186.194.58 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 58.194.186.35.bc.googleusercontent.com

rs.fullstory.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.58.212.162 (United States)

ASN15169 (GOOGLE, US)
PTR: ams15s22-in-f162.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.147.116 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-147-116.fra60.r.cloudfront.net

vars.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.184.198 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s11-in-f6.1e100.net

fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.153.3.78 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-153-3-78.eu-central-1.compute.amazonaws.com

recommender.scarabresearch.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:810::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.244.174.68 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 68.174.244.35.bc.googleusercontent.com

idsync.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.117.30.199 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 199.30.117.34.bc.googleusercontent.com

webchannel-content-service.scarabresearch.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 63.34.154.154 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-63-34-154-154.eu-west-1.compute.amazonaws.com

in.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.138.17.47 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-138-17-47.fra56.r.cloudfront.net

tag.demandbase.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:802::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.16.194 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s65-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.131 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.111.234.236 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 236.234.111.34.bc.googleusercontent.com

ml314.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.251.71.171 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-34-251-71-171.eu-west-1.compute.amazonaws.com

sync.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.54.217.46 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-54-217-46.compute-1.amazonaws.com

mid.rkdms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
37	bitdefender.com 2 redirects labs.bitdefender.com www.bitdefender.com — Cisco Umbrella Rank: 100416 blogapp.bitdefender.com sstats.bitdefender.com — Cisco Umbrella Rank: 154591 starget.bitdefender.com — Cisco Umbrella Rank: 571141	1 MB
7	demdex.net 1 redirects dpm.demdex.net — Cisco Umbrella Rank: 297 bitdefender.demdex.net — Cisco Umbrella Rank: 552261	9 KB
6	adobedtm.com assets.adobedtm.com — Cisco Umbrella Rank: 553	138 KB
5	scarabresearch.com cdn.scarabresearch.com — Cisco Umbrella Rank: 12115 static.scarabresearch.com — Cisco Umbrella Rank: 16904 recommender.scarabresearch.com — Cisco Umbrella Rank: 7296 webchannel-content-service.scarabresearch.com — Cisco Umbrella Rank: 152632	64 KB
5	hotjar.com static.hotjar.com — Cisco Umbrella Rank: 871 script.hotjar.com — Cisco Umbrella Rank: 1152 vars.hotjar.com — Cisco Umbrella Rank: 1247 in.hotjar.com — Cisco Umbrella Rank: 2418	74 KB
4	linkedin.com 3 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 894 www.linkedin.com — Cisco Umbrella Rank: 847 px4.ads.linkedin.com — Cisco Umbrella Rank: 6869	3 KB
4	gstatic.com fonts.gstatic.com	59 KB
3	doubleclick.net 1 redirects fls.doubleclick.net — Cisco Umbrella Rank: 687 googleads.g.doubleclick.net — Cisco Umbrella Rank: 73 cm.g.doubleclick.net — Cisco Umbrella Rank: 303	3 KB
3	cookiebot.com consent.cookiebot.com — Cisco Umbrella Rank: 5180 consentcdn.cookiebot.com — Cisco Umbrella Rank: 5970	91 KB
2	rkdms.com 1 redirects mid.rkdms.com — Cisco Umbrella Rank: 1500	71 B
2	crwdcntrl.net 2 redirects sync.crwdcntrl.net — Cisco Umbrella Rank: 1087	586 B
2	fullstory.com edge.fullstory.com — Cisco Umbrella Rank: 3822 rs.fullstory.com — Cisco Umbrella Rank: 3456	62 KB
2	company-target.com api.company-target.com — Cisco Umbrella Rank: 8494	2 KB
1	ml314.com 1 redirects ml314.com — Cisco Umbrella Rank: 2659	343 B
1	twitter.com analytics.twitter.com — Cisco Umbrella Rank: 870	354 B
1	google.de www.google.de — Cisco Umbrella Rank: 3469	548 B
1	google.com www.google.com — Cisco Umbrella Rank: 19	548 B
1	demandbase.com tag.demandbase.com — Cisco Umbrella Rank: 11985	16 KB
1	rlcdn.com idsync.rlcdn.com — Cisco Umbrella Rank: 607	98 B
1	googleadservices.com www.googleadservices.com — Cisco Umbrella Rank: 159	16 KB
1	everesttech.net 1 redirects cm.everesttech.net — Cisco Umbrella Rank: 1651	517 B
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 120	1 KB
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 1614	3 KB
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 141	62 KB
1	gravatar.com 2.gravatar.com — Cisco Umbrella Rank: 11001	38 KB
1	geolocation-db.com geolocation-db.com — Cisco Umbrella Rank: 28377	257 B
0	hotjar.io Failed vc.hotjar.io Failed
84	27

	Domain	Requested by
23	www.bitdefender.com	1 redirects www.bitdefender.com
10	blogapp.bitdefender.com	www.bitdefender.com
6	dpm.demdex.net	1 redirects www.bitdefender.com
6	assets.adobedtm.com	www.bitdefender.com assets.adobedtm.com
4	fonts.gstatic.com	fonts.googleapis.com
2	mid.rkdms.com	1 redirects
2	sync.crwdcntrl.net	2 redirects
2	static.scarabresearch.com	cdn.scarabresearch.com
2	script.hotjar.com	static.hotjar.com script.hotjar.com
2	px.ads.linkedin.com	2 redirects
2	sstats.bitdefender.com	www.bitdefender.com assets.adobedtm.com
2	api.company-target.com	www.bitdefender.com
2	consent.cookiebot.com	www.bitdefender.com consent.cookiebot.com
1	ml314.com	1 redirects
1	analytics.twitter.com	www.bitdefender.com
1	cm.g.doubleclick.net	1 redirects
1	www.google.de	www.bitdefender.com
1	www.google.com	www.bitdefender.com
1	tag.demandbase.com	www.bitdefender.com
1	in.hotjar.com	www.bitdefender.com
1	webchannel-content-service.scarabresearch.com	www.bitdefender.com
1	idsync.rlcdn.com	www.bitdefender.com
1	googleads.g.doubleclick.net	www.googleadservices.com
1	recommender.scarabresearch.com	www.bitdefender.com
1	fls.doubleclick.net	assets.adobedtm.com
1	vars.hotjar.com	static.hotjar.com
1	www.googleadservices.com	www.googletagmanager.com
1	rs.fullstory.com	www.bitdefender.com
1	px4.ads.linkedin.com	www.bitdefender.com
1	www.linkedin.com	1 redirects
1	starget.bitdefender.com	www.bitdefender.com
1	cm.everesttech.net	1 redirects
1	bitdefender.demdex.net	assets.adobedtm.com
1	consentcdn.cookiebot.com	consent.cookiebot.com
1	fonts.googleapis.com	www.bitdefender.com
1	cdn.scarabresearch.com	www.bitdefender.com
1	static.hotjar.com	www.bitdefender.com
1	edge.fullstory.com	www.bitdefender.com
1	snap.licdn.com	www.bitdefender.com
1	www.googletagmanager.com	assets.adobedtm.com
1	2.gravatar.com	www.bitdefender.com
1	geolocation-db.com	www.bitdefender.com
1	labs.bitdefender.com	1 redirects
0	vc.hotjar.io Failed	www.bitdefender.com
84	44

This site contains links to these domains. Also see Links.

Domain
www.jazzhr.com
www.scarabresearch.com
www.adobe.com
www.cookiebot.com
legal.hubspot.com
policies.google.com
www.linkedin.com
newrelic.com
outgrow.co
www.bizible.com
privacy.microsoft.com
www.hotjar.com
twitter.com
www.redditinc.com
www.facebook.com
neilpatel.com
www.outbrain.com
www.lotame.com
liveramp.com
login.bitdefender.com
gravityzone.bitdefender.com
community.bitdefender.com
businessresources.bitdefender.com
threatmap.bitdefender.com
businessinsights.bitdefender.com
pan.bitdefender.com
research.bitdefender.com
labs.bitdefender.com
hotforsecurity.bitdefender.com
facebook.com
instagram.com
www.youtube.com

Subject Issuer	Validity	Valid
*.bitdefender.com DigiCert TLS RSA SHA256 2020 CA1	`2021-11-08` - `2022-11-08`	a year	crt.sh
assets.adobedtm.com DigiCert TLS RSA SHA256 2020 CA1	`2022-07-19` - `2023-08-19`	a year	crt.sh
consent.cookiebot.com DigiCert TLS RSA SHA256 2020 CA1	`2022-06-04` - `2023-06-06`	a year	crt.sh
geolocation-db.com R3	`2022-08-18` - `2022-11-16`	3 months	crt.sh
*.gravatar.com Sectigo RSA Domain Validation Secure Server CA	`2020-08-14` - `2022-11-16`	2 years	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-08-15` - `2022-11-07`	3 months	crt.sh
api.demandbase.com Go Daddy Secure Certificate Authority - G2	`2021-10-20` - `2022-09-26`	a year	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2022-03-01` - `2023-03-01`	a year	crt.sh
edge.fullstory.com GTS CA 1D4	`2022-08-08` - `2022-11-06`	3 months	crt.sh
*.hotjar.com Amazon	`2021-11-25` - `2022-12-23`	a year	crt.sh
*.scarabresearch.com Amazon	`2021-10-24` - `2022-11-21`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2022-08-15` - `2022-11-07`	3 months	crt.sh
*.cookiebot.com DigiCert TLS RSA SHA256 2020 CA1	`2022-06-15` - `2023-06-17`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2022-08-15` - `2022-11-07`	3 months	crt.sh
*.demdex.net DigiCert TLS RSA SHA256 2020 CA1	`2021-10-19` - `2022-11-19`	a year	crt.sh
sstats.bitdefender.com DigiCert TLS RSA SHA256 2020 CA1	`2022-03-04` - `2023-04-04`	a year	crt.sh
starget.bitdefender.com DigiCert TLS RSA SHA256 2020 CA1	`2022-03-18` - `2023-03-21`	a year	crt.sh
*.fullstory.com R3	`2022-08-13` - `2022-11-11`	3 months	crt.sh
www.googleadservices.com GTS CA 1C3	`2022-08-15` - `2022-11-07`	3 months	crt.sh
*.doubleclick.net GTS CA 1C3	`2022-08-15` - `2022-11-07`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-08-15` - `2022-11-07`	3 months	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2022-02-03` - `2023-02-25`	a year	crt.sh
webchannel-content.eservice.emarsys.net R3	`2022-08-27` - `2022-11-25`	3 months	crt.sh
tag.demandbase.com Go Daddy Secure Certificate Authority - G2	`2022-08-17` - `2023-09-18`	a year	crt.sh
www.google.com GTS CA 1C3	`2022-08-15` - `2022-11-07`	3 months	crt.sh
www.google.de GTS CA 1C3	`2022-08-22` - `2022-11-14`	3 months	crt.sh
*.twitter.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-03-07` - `2023-03-06`	a year	crt.sh

This page contains 4 frames:

Primary Page: https://www.bitdefender.com/blog/labs/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/
Frame ID: DDE11C67C204B4EAAD2F23B03B05E444
Requests: 80 HTTP requests in this frame

Frame: https://consentcdn.cookiebot.com/sdk/bc-v4.min.html
Frame ID: CD068C31F362ED0C6CFC9C5CC9EEE5FD
Requests: 1 HTTP requests in this frame

Frame: https://bitdefender.demdex.net/dest5.html?d_nsid=0
Frame ID: A92B24431C06DC94E532723B7571CF4C
Requests: 7 HTTP requests in this frame

Frame: https://vars.hotjar.com/box-1ada912494ba7fc7aca15fcef1c2a7ae.html
Frame ID: 8CD94C9FC2A14D393FF31D1760314832
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

New Router DNS Hijacking Attacks Abuse Bitbucket to Host Infostealer

Page URL History Show full URLs

https://labs.bitdefender.com/2020/03/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/ HTTP 301
https://www.bitdefender.com/blog/labs/2020/03/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-i... HTTP 301
https://www.bitdefender.com/blog/labs/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/ Page URL

Detected technologies

Nuxt.js (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

/_nuxt/

Cookiebot (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

consent\.cookiebot\.com

DoubleClick Floodlight (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://fls\.doubleclick\.net

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/ns\.html[^>]+></iframe>
googletagmanager\.com/gtag/js

Hotjar (Analytics) Expand

Overall confidence: 100%
Detected patterns

//static\.hotjar\.com/

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Page Statistics

84
Requests

90 %
HTTPS

33 %
IPv6

27
Domains

44
Subdomains

36
IPs

5
Countries

1785 kB
Transfer

4147 kB
Size

43
Cookies

41 Outgoing links

These are links going to different origins than the main page.

URL: https://www.jazzhr.com/privacy-policy/
Title: JazzHR

Search URL Search Domain Scan URL

URL: https://www.scarabresearch.com/privacy/
Title: Scarab Research

Search URL Search Domain Scan URL

URL: https://www.adobe.com/privacy.html
Title: Adobe Inc.

Search URL Search Domain Scan URL

URL: https://www.cookiebot.com/goto/privacy-policy/
Title: Cookiebot

Search URL Search Domain Scan URL

URL: https://legal.hubspot.com/privacy-policy
Title: Hubspot

Search URL Search Domain Scan URL

URL: https://policies.google.com/privacy
Title: Google

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/legal/privacy-policy
Title: LinkedIn

Search URL Search Domain Scan URL

URL: https://newrelic.com/termsandconditions/privacy
Title: New Relic

Search URL Search Domain Scan URL

URL: https://outgrow.co/privacy-policy/?utm_source=footer
Title: Outgrow

Search URL Search Domain Scan URL

URL: https://legal.hubspot.com/privacy-policy?hubs_signup-url=www.hubspot.com/&hubs_signup-cta=null&_ga=2.233684958.1918253292.1599215465-564717415.1599033587&_gac=1.204737188.1599033588.EAIaIQobChMI-_PzpIDK6wIViLh3Ch01XAS2EAAYASAAEgJK6vD_BwE
Title: Hubspot

Search URL Search Domain Scan URL

URL: https://www.bizible.com/privacy-policy
Title: Bizible

Search URL Search Domain Scan URL

URL: https://privacy.microsoft.com/en-us/privacystatement
Title: Microsoft

Search URL Search Domain Scan URL

URL: https://www.hotjar.com/legal/policies/privacy
Title: Hotjar

Search URL Search Domain Scan URL

URL: https://www.adobe.com/uk/privacy.html
Title: Adobe

Search URL Search Domain Scan URL

URL: https://twitter.com/en/privacy
Title: Twitter Inc.

Search URL Search Domain Scan URL

URL: https://www.redditinc.com/policies/privacy-policy
Title: Reddit

Search URL Search Domain Scan URL

URL: https://privacy.microsoft.com/en-US/privacystatement
Title: Microsoft

Search URL Search Domain Scan URL

URL: https://www.facebook.com/policy.php/
Title: Meta Platforms, Inc.

Search URL Search Domain Scan URL

URL: https://neilpatel.com/privacy/
Title: Neilpatel

Search URL Search Domain Scan URL

URL: https://www.outbrain.com/legal/privacy#privacy-policy
Title: Outbrain

Search URL Search Domain Scan URL

URL: https://www.lotame.com/about-lotame/privacy/lotames-products-services-privacy-policy/
Title: Lotame

Search URL Search Domain Scan URL

URL: https://liveramp.com/privacy/
Title: LiveRamp

Search URL Search Domain Scan URL

URL: https://www.cookiebot.com/
Title: Cookiebot

Search URL Search Domain Scan URL

URL: https://login.bitdefender.com/central/login.html?lang=en_US&redirect_url=https:%2F%2Fcentral.bitdefender.com%2F
Title: Bitdefender Central

Search URL Search Domain Scan URL

URL: https://gravityzone.bitdefender.com/
Title: GravityZone CLOUD Control Center

Search URL Search Domain Scan URL

URL: https://community.bitdefender.com/
Title: Join the community!

Search URL Search Domain Scan URL

URL: https://businessresources.bitdefender.com/replace-symantec?utm_campaign=symrep2020&utm_source=web&utm_medium=menu
Title: Switching from Symantec?

Search URL Search Domain Scan URL

URL: https://businessresources.bitdefender.com/gartner-datacenter-revolution-security
Title: Datacenter Revolution and Security

Search URL Search Domain Scan URL

URL: https://threatmap.bitdefender.com/
Title: Threat Map

Search URL Search Domain Scan URL

URL: https://businessresources.bitdefender.com/business-threat-landscape-report-2020
Title: Annual Threat Report

Search URL Search Domain Scan URL

URL: https://businessinsights.bitdefender.com/
Title: Business Insights Blog

Search URL Search Domain Scan URL

URL: https://pan.bitdefender.com/partners/save/
Title: Become a Reseller

Search URL Search Domain Scan URL

URL: https://pan.bitdefender.com/
Title: Log in to PAN Portal

Search URL Search Domain Scan URL

URL: https://research.bitdefender.com/
Title: Research

Search URL Search Domain Scan URL

URL: https://labs.bitdefender.com/2020/03/5-times-more-coronavirus-themed-malware-reports-during-march/
Title: involving coronavirus-themed malware have increased five-fold

Search URL Search Domain Scan URL

URL: https://hotforsecurity.bitdefender.com/blog/coronavirus-phishing-scams-exploit-misinformation-22599.html
Title: scams that exploit Coronavirus misinformation

Search URL Search Domain Scan URL

URL: https://hotforsecurity.bitdefender.com/blog/coronavirus-medical-supply-scams-prey-on-fear-22570.html
Title: fear regarding medical supply shortage

Search URL Search Domain Scan URL

URL: https://facebook.com/Bitdefender/

Search URL Search Domain Scan URL

URL: https://twitter.com/bitdefender/

Search URL Search Domain Scan URL

URL: https://instagram.com/bitdefender/

Search URL Search Domain Scan URL

URL: https://www.youtube.com/Bitdefender/

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://labs.bitdefender.com/2020/03/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/ HTTP 301
https://www.bitdefender.com/blog/labs/2020/03/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/ HTTP 301
https://www.bitdefender.com/blog/labs/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 29

https://dpm.demdex.net/id?d_visid_ver=5.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=0E920C0F53DA9E9B0A490D45%40AdobeOrg&d_nsid=0&ts=1662405095413 HTTP 302
https://dpm.demdex.net/id/rd?d_visid_ver=5.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=0E920C0F53DA9E9B0A490D45%40AdobeOrg&d_nsid=0&ts=1662405095413

Request Chain 49

https://cm.everesttech.net/cm/dd?d_uuid=33619390861099198522578824315854892490 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=YxZJ4AAAAMMFTQN-

Request Chain 51

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=359890&time=1662405095879&url=https%3A%2F%2Fwww.bitdefender.com%2Fblog%2Flabs%2Fnew-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer%2F HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D359890%26time%3D1662405095879%26url%3Dhttps%253A%252F%252Fwww.bitdefender.com%252Fblog%252Flabs%252Fnew-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer%252F%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=359890&time=1662405095879&url=https%3A%2F%2Fwww.bitdefender.com%2Fblog%2Flabs%2Fnew-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer%2F&liSync=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=359890&time=1662405095879&url=https%3A%2F%2Fwww.bitdefender.com%2Fblog%2Flabs%2Fnew-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer%2F&liSync=true&e_ipv6=AQIzkylaIFw0SwAAAYMPEJeA9lOMvzyV79JkS_fYOoausC6evbQIz9o4lRiJdkeHIA

Request Chain 80

https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm&gdpr=0&gdpr_consent=&google_hm=MzM2MTkzOTA4NjEwOTkxOTg1MjI1Nzg4MjQzMTU4NTQ4OTI0OTA= HTTP 302
https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEJqKPgvNiQDTrDe_rXiM1ko&google_cver=1?gdpr=0&gdpr_consent=

Request Chain 85

https://ml314.com/utsync.ashx?eid=50112&et=0&gdpr=0&gdpr_consent=&return=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D22052%26dpuuid%3D[PersonID] HTTP 302
https://dpm.demdex.net/ibs:dpid=22052&dpuuid=3629848308637761626

Request Chain 86

https://sync.crwdcntrl.net/map/c=9828/tp=ADBE/gdpr=0/gdpr_consent=/tpid=33619390861099198522578824315854892490?https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D121998%26dpuuid%3D${profile_id} HTTP 302
https://sync.crwdcntrl.net/map/ct=y/c=9828/tp=ADBE/gdpr=0/gdpr_consent=/tpid=33619390861099198522578824315854892490?https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D121998%26dpuuid%3D${profile_id} HTTP 302
https://dpm.demdex.net/ibs:dpid=121998&dpuuid=

Request Chain 87

https://mid.rkdms.com/bct?pid=8bc436aa-e0fc-4baa-9c9a-06fbeca87826&puid=33619390861099198522578824315854892490&_ct=img HTTP 302
https://mid.rkdms.com/restricted

84 HTTP transactions
5 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
www.bitdefender.com/blog/labs/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/
Redirect Chain

https://labs.bitdefender.com/2020/03/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/
https://www.bitdefender.com/blog/labs/2020/03/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/
https://www.bitdefender.com/blog/labs/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/

364 KB
48 KB

1507ms
1506ms

Document
text/html

2606:4700::6812:a8de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bitdefender.com/blog/labs/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:a8de , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

be06c55f906df7a2bd324a5b5e55c78e602128750fca18e095522ea6fd6fea3f

Security Headers

Name

Value

Content-Security-Policy

default-src 'self'; img-src https: http: data:; style-src 'self' 'unsafe-inline' *.bitdefender.com fonts.googleapis.com; script-src 'self' 'self' assets.adobedtm.com consentcdn.cookiebot.com bitdefender.demdex.net consent.cookiebot.com www.googletagmanager.com www.googleadservices.com tag.demandbase.com *.doubleclick.net sentry.nmbapp.net snap.licdn.com edge.fullstory.com *.hotjar.com cdn.scarabresearch.com bat.bing.com static.ads-twitter.com www.redditstatic.com d.impactradius-event.com connect.facebook.net *.clarity.ms *.bitdefender.com *.scarabresearch.com www.dwin1.com *.taboola.com *.outbrain.com retrack-kupona.kuponacdn.de ad4m.at *.google-analytics.com 'unsafe-inline' 'unsafe-eval'; frame-ancestors 'none'; object-src 'none'; frame-src consentcdn.cookiebot.com bitdefender.demdex.net 5165113.fls.doubleclick.net vars.hotjar.com hal9000.redintelligence.net ad.ad-srv.net ad4m.at; connect-src api.company-target.com *.bitdefender.com geolocation-db.com dpm.demdex.net consent.cookiebot.com www.google.com *.scarabresearch.com rs.fullstory.com googleads.g.doubleclick.net region1.google-analytics.com consentcdn.cookiebot.com region1.analytics.google.com *.clarity.ms *.doubleclick.net *.hotjar.com *.taboola.com 'self'; font-src 'self' data: www.bitdefender.com fonts.googleapis.com fonts.gstatic.com; base-uri *.bitdefender.com *.bitdefender.com.au *.bitdefender.co.uk *.bitdefender.ro *.bitdefender.fr *.bitdefender.de

Strict-Transport-Security

max-age=15724800; includeSubDomains

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cf-cache-status: DYNAMIC
cf-ray: 7461454c6aba9125-FRA
content-encoding: br
content-security-policy: default-src 'self'; img-src https: http: data:; style-src 'self' 'unsafe-inline' *.bitdefender.com fonts.googleapis.com; script-src 'self' 'self' assets.adobedtm.com consentcdn.cookiebot.com bitdefender.demdex.net consent.cookiebot.com www.googletagmanager.com www.googleadservices.com tag.demandbase.com *.doubleclick.net sentry.nmbapp.net snap.licdn.com edge.fullstory.com *.hotjar.com cdn.scarabresearch.com bat.bing.com static.ads-twitter.com www.redditstatic.com d.impactradius-event.com connect.facebook.net *.clarity.ms *.bitdefender.com *.scarabresearch.com www.dwin1.com *.taboola.com *.outbrain.com retrack-kupona.kuponacdn.de ad4m.at *.google-analytics.com 'unsafe-inline' 'unsafe-eval'; frame-ancestors 'none'; object-src 'none'; frame-src consentcdn.cookiebot.com bitdefender.demdex.net 5165113.fls.doubleclick.net vars.hotjar.com hal9000.redintelligence.net ad.ad-srv.net ad4m.at; connect-src api.company-target.com *.bitdefender.com geolocation-db.com dpm.demdex.net consent.cookiebot.com www.google.com *.scarabresearch.com rs.fullstory.com googleads.g.doubleclick.net region1.google-analytics.com consentcdn.cookiebot.com region1.analytics.google.com *.clarity.ms *.doubleclick.net *.hotjar.com *.taboola.com 'self'; font-src 'self' data: www.bitdefender.com fonts.googleapis.com fonts.gstatic.com; base-uri *.bitdefender.com *.bitdefender.com.au *.bitdefender.co.uk *.bitdefender.ro *.bitdefender.fr *.bitdefender.de
content-type: text/html; charset=utf-8
date: Mon, 05 Sep 2022 19:11:27 GMT
etag: W/"5b0ae-YpqxJ1ZA18CeXG8XF/PAVGeUrzg"
server: cloudflare
strict-transport-security: max-age=15724800; includeSubDomains
vary: Accept-Encoding

Redirect headers

cf-cache-status: DYNAMIC
cf-ray: 7461454b995d9125-FRA
date: Mon, 05 Sep 2022 19:11:26 GMT
location: /blog/labs/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/
server: cloudflare
strict-transport-security: max-age=15724800; includeSubDomains

GET
H2 200 launch-b77a56f2d5f1.min.js Show response
assets.adobedtm.com/8a93f8486ba4/62c1fd5cdcbd/ 403 KB
114 KB 81ms
8ms Script
application/x-javascript 2a02:26f0:3500:592::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/8a93f8486ba4/62c1fd5cdcbd/launch-b77a56f2d5f1.min.js
Requested by: Host: www.bitdefender.com
URL: https://www.bitdefender.com/blog/labs/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:592::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 26a71c9ecb4291f514ff1eb15363cf97bf01e62d2e518ec0c0a5cf2805fb6872

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bitdefender.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 05 Sep 2022 19:11:27 GMT
content-encoding: gzip
last-modified: Wed, 31 Aug 2022 12:08:41 GMT
server: AkamaiNetStorage
etag: "d55aed87d6b4a83b59a7df928a45b442:1661947721.101804"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.bitdefender.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 116447
expires: Mon, 05 Sep 2022 20:11:27 GMT

GET
H2 200 uc.js Show response
consent.cookiebot.com/ 100 KB
31 KB 121ms
22ms Script
application/javascript 2a02:26f0:ea::215:ac21
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://consent.cookiebot.com/uc.js
Requested by: Host: www.bitdefender.com
URL: https://www.bitdefender.com/blog/labs/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:ea::215:ac21 Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: ec0e78ba3786d620f16943844c3da6aac1f029dc4ec6fb35456d019508679ff1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bitdefender.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 05 Sep 2022 19:11:27 GMT
content-encoding: gzip
last-modified: Tue, 23 Aug 2022 07:31:36 GMT
etag: "aeea9f60c2b6d81:0"
vary: Accept-Encoding
content-type: application/javascript
access-control-expose-headers: Request-Context
cache-control: public, max-age=1057
request-context: appId=cid-v1:89f47f4b-bed0-4db8-956b-d6e6dfac3fef
accept-ranges: bytes
content-length: 31207
expires: Mon, 05 Sep 2022 19:29:04 GMT

GET
H2 200 5dc6f2a.js Show response
www.bitdefender.com/blog/_nuxt/ 4 KB
2 KB 34ms
33ms Script
application/javascript 2606:4700::6812:a8de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bitdefender.com/blog/_nuxt/5dc6f2a.js

Requested by

Host: www.bitdefender.com
URL: https://www.bitdefender.com/blog/labs/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:a8de , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1cd4fbab743c32df47d7a7dda0199e27862f8de538e8ec28d4b5dee15ff5cba0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bitdefender.com/blog/labs/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 05 Sep 2022 19:11:27 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 04 Jul 2022 13:31:35 GMT
server: cloudflare
age: 5463062
etag: W/"1059-181c968c2d8"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000
strict-transport-security: max-age=15724800; includeSubDomains
cf-ray: 74614555ea819125-FRA

GET
H2 200 3d19cf0.js Show response
www.bitdefender.com/blog/_nuxt/ 229 KB
80 KB 43ms
42ms Script
application/javascript 2606:4700::6812:a8de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bitdefender.com/blog/_nuxt/3d19cf0.js

Requested by

Host: www.bitdefender.com
URL: https://www.bitdefender.com/blog/labs/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:a8de , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

30c87d4f6df218f3afec83c03c08c8986c3c8400a2b14a10e81868b6af37b693

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bitdefender.com/blog/labs/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 05 Sep 2022 19:11:27 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 04 Jul 2022 13:31:35 GMT
server: cloudflare
age: 5463062
etag: W/"39457-181c968c2d8"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000
strict-transport-security: max-age=15724800; includeSubDomains
cf-ray: 74614555ea859125-FRA

GET
H2 200 6a6d0e9.js Show response
www.bitdefender.com/blog/_nuxt/ 135 KB
47 KB 51ms
49ms Script
application/javascript 2606:4700::6812:a8de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bitdefender.com/blog/_nuxt/6a6d0e9.js

Requested by

Host: www.bitdefender.com
URL: https://www.bitdefender.com/blog/labs/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:a8de , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7071e48557899623807c0311b9feeaf4ed1de74f96cdf54485ad5a9f31dac25c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bitdefender.com/blog/labs/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 05 Sep 2022 19:11:27 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 04 Jul 2022 11:09:19 GMT
server: cloudflare
age: 5470910
etag: W/"21a70-181c8e68318"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000
strict-transport-security: max-age=15724800; includeSubDomains
cf-ray: 74614555ea869125-FRA

GET
H2 200 5a2419f.css
www.bitdefender.com/blog/_nuxt/css/ 75 KB
16 KB 59ms
58ms Stylesheet
text/css 2606:4700::6812:a8de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bitdefender.com/blog/_nuxt/css/5a2419f.css

Requested by

Host: www.bitdefender.com
URL: https://www.bitdefender.com/blog/labs/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:a8de , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

327819dae527134e53bbaa25f0c53b80017da2b541c22c0b3dcae0583e12d7f0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bitdefender.com/blog/labs/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 05 Sep 2022 19:11:27 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 04 Jul 2022 11:09:19 GMT
server: cloudflare
age: 5470910
etag: W/"12a34-181c8e68318"
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
cache-control: public, max-age=31536000
cf-polished: origSize=76340
strict-transport-security: max-age=15724800; includeSubDomains
cf-ray: 74614555ea839125-FRA
cf-bgj: minify

GET
H2 200 0710a8e.js Show response
www.bitdefender.com/blog/_nuxt/ 116 KB
30 KB 42ms
41ms Script
application/javascript 2606:4700::6812:a8de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bitdefender.com/blog/_nuxt/0710a8e.js

Requested by

Host: www.bitdefender.com
URL: https://www.bitdefender.com/blog/labs/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:a8de , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

04078c70085fe0cfa0fe98a25e33029189b753bacfa629aedee45c8b35b84b89

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bitdefender.com/blog/labs/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 05 Sep 2022 19:11:27 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 04 Jul 2022 13:31:35 GMT
server: cloudflare
age: 3277906
etag: W/"1ce72-181c968c2d8"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000
strict-transport-security: max-age=15724800; includeSubDomains
cf-ray: 74614555ea879125-FRA

GET
H2 200 e8d2461.js Show response
www.bitdefender.com/blog/_nuxt/ 9 KB
3 KB 40ms
38ms Script
application/javascript 2606:4700::6812:a8de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bitdefender.com/blog/_nuxt/e8d2461.js

Requested by

Host: www.bitdefender.com
URL: https://www.bitdefender.com/blog/labs/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:a8de , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

15c7f04701cb2e957680e851e86c0d539aa67ac60e7bf19e2191553fabdcdf5c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bitdefender.com/blog/labs/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 05 Sep 2022 19:11:27 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 04 Jul 2022 13:31:35 GMT
server: cloudflare
age: 5463061
etag: W/"23b6-181c968c2d8"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000
strict-transport-security: max-age=15724800; includeSubDomains
cf-ray: 74614555ea889125-FRA

GET
H2 200 a5a50e8.js Show response
www.bitdefender.com/blog/_nuxt/ 16 KB
6 KB 35ms
34ms Script
application/javascript 2606:4700::6812:a8de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bitdefender.com/blog/_nuxt/a5a50e8.js

Requested by

Host: www.bitdefender.com
URL: https://www.bitdefender.com/blog/labs/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:a8de , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

14efaaef6d7a177ecbe6afc0e91a4bb4ba2244c6d08b0370c5a16e3c9c09f462

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bitdefender.com/blog/labs/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 05 Sep 2022 19:11:27 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 04 Jul 2022 13:31:35 GMT
server: cloudflare
age: 5463061
etag: W/"3fe1-181c968c2d8"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000
strict-transport-security: max-age=15724800; includeSubDomains
cf-ray: 74614555ea8d9125-FRA

GET
H2 200 e59ee2e.js Show response
www.bitdefender.com/blog/_nuxt/ 916 B
629 B 34ms
33ms Script
application/javascript 2606:4700::6812:a8de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bitdefender.com/blog/_nuxt/e59ee2e.js

Requested by

Host: www.bitdefender.com
URL: https://www.bitdefender.com/blog/labs/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:a8de , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

386f886c139b9773b5c3ae95fce3c5651066ea68050bbf8babea761f15d894d3

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bitdefender.com/blog/labs/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 05 Sep 2022 19:11:27 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 04 Jul 2022 11:09:19 GMT
server: cloudflare
age: 5470910
etag: W/"394-181c8e68318"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000
strict-transport-security: max-age=15724800; includeSubDomains
cf-ray: 74614555ea8e9125-FRA

GET
H2 200 TagIT.v1.min.js Show response
www.bitdefender.com/scripts/ 15 KB
4 KB 68ms
67ms Script
application/x-javascript 2606:4700::6812:a8de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bitdefender.com/scripts/TagIT.v1.min.js?v=43
Requested by: Host: www.bitdefender.com
URL: https://www.bitdefender.com/blog/labs/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:a8de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1789e6bf0f139fc89e73756237ae433989a6d27e7effe2d1771c06d2566f889b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bitdefender.com/blog/labs/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: public
date: Mon, 05 Sep 2022 19:11:27 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Fri, 15 Mar 2019 11:31:57 GMT
server: cloudflare
etag: W/"5c8b8d2d-3b83"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 74614555ea8f9125-FRA

GET
H2 200 loader.svg
www.bitdefender.com/blog/images/ 3 KB
574 B 139ms
138ms Image
image/svg+xml 2606:4700::6812:a8de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bitdefender.com/blog/images/loader.svg

Requested by

Host: www.bitdefender.com
URL: https://www.bitdefender.com/blog/labs/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:a8de , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2202c4d20285e4859ee85d4e0cb1ef2816bedfb127e6505cf97f790ebf388db0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bitdefender.com/blog/labs/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 05 Sep 2022 19:11:27 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Mon, 04 Jul 2022 13:29:48 GMT
server: cloudflare
etag: W/"b14-181c96720e0"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=0
strict-transport-security: max-age=15724800; includeSubDomains
cf-ray: 746145565b3a9125-FRA

GET
H2 200 main.js Show response
www.bitdefender.com/blog/js/ 105 KB
36 KB 172ms
171ms Script
application/javascript 2606:4700::6812:a8de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bitdefender.com/blog/js/main.js

Requested by

Host: www.bitdefender.com
URL: https://www.bitdefender.com/blog/labs/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:a8de , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f30008d74bc7aca6a5b6d527eec92f69db95ec852784a7ba3b430f9198769a35

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bitdefender.com/blog/labs/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 05 Sep 2022 19:11:27 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Mon, 04 Jul 2022 13:29:48 GMT
server: cloudflare
etag: W/"1a3fe-181c96720e0"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=0
strict-transport-security: max-age=15724800; includeSubDomains
cf-ray: 746145565b3b9125-FRA

GET
H2 200 / Show response
www.bitdefender.com/site/Main/TagIT/newsessioninit/ 33 B
937 B 101ms
101ms Script
application/javascript 2606:4700::6812:a8de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bitdefender.com/site/Main/TagIT/newsessioninit/?callback=&l=en&ch=1662405096

Requested by

Host: www.bitdefender.com
URL: https://www.bitdefender.com/scripts/TagIT.v1.min.js?v=43

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:a8de , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fceba08a6bbdf2598e8f6d43e71b51854337da5f880c3fff252a25b9cd10b6ae

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bitdefender.com/blog/labs/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Sep 2022 19:11:27 GMT
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
strict-transport-security: max-age=63072000; includeSubdomains; preload
p3p: CP="NOI ADM DEV COM NAV OUR STP"
content-type: application/javascript
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray: 746145565b3d9125-FRA
expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H2 200 DNS_1.png
blogapp.bitdefender.com/labs/content/images/wordpress/2020/03/ 56 KB
56 KB 140ms
85ms Image
image/png 2606:4700::6812:a8de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blogapp.bitdefender.com/labs/content/images/wordpress/2020/03/DNS_1.png
Requested by: Host: www.bitdefender.com
URL: https://www.bitdefender.com/blog/labs/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:a8de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: cfa51627f00b7afde3a3cf4f88166512a85c14027b0ac05c8904787c374493af

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bitdefender.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 05 Sep 2022 19:11:27 GMT
etag: W/"e0b4-179810c2077"
cf-cache-status: MISS
last-modified: Tue, 18 May 2021 19:55:26 GMT
server: cloudflare
x-powered-by: Express
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 746145572cb19125-FRA
content-length: 57524

GET
H2 200 code1.png
blogapp.bitdefender.com/labs/content/images/wordpress/2020/03/ 7 KB
7 KB 158ms
103ms Image
image/png 2606:4700::6812:a8de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blogapp.bitdefender.com/labs/content/images/wordpress/2020/03/code1.png
Requested by: Host: www.bitdefender.com
URL: https://www.bitdefender.com/blog/labs/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:a8de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: b242dc131487657bc296b73be0c5326463d3eab45d089fb3d948f9ab1d45ff10

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bitdefender.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 05 Sep 2022 19:11:27 GMT
etag: W/"1c14-179810c200f"
cf-cache-status: MISS
last-modified: Tue, 18 May 2021 19:55:26 GMT
server: cloudflare
x-powered-by: Express
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 746145572cb49125-FRA
content-length: 7188

GET
H2 200 bitbucket-1024x645.png
blogapp.bitdefender.com/labs/content/images/wordpress/2020/03/ 341 KB
341 KB 152ms
97ms Image
image/png 2606:4700::6812:a8de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blogapp.bitdefender.com/labs/content/images/wordpress/2020/03/bitbucket-1024x645.png
Requested by: Host: www.bitdefender.com
URL: https://www.bitdefender.com/blog/labs/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:a8de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: c20a6a38a4b63bbb198941b15d3f52bfdacfbad376eb01838947a852e8f498fe

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bitdefender.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 05 Sep 2022 19:11:27 GMT
etag: W/"553b7-179810c200b"
cf-cache-status: MISS
last-modified: Tue, 18 May 2021 19:55:26 GMT
server: cloudflare
x-powered-by: Express
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 746145572cb09125-FRA
content-length: 349111

GET
H2 200 mega_menu.css
www.bitdefender.com/themes/draco/menu_json/ 179 KB
25 KB 96ms
92ms Stylesheet
text/css 2606:4700::6812:a8de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bitdefender.com/themes/draco/menu_json/mega_menu.css
Requested by: Host: www.bitdefender.com
URL: https://www.bitdefender.com/blog/_nuxt/0710a8e.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:a8de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d71abdf4ebc13e8d2ebefd8e7f206f80798d2adef5339898d5a511b555da978b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bitdefender.com/blog/labs/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: public
date: Mon, 05 Sep 2022 19:11:28 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Mon, 27 Jun 2022 07:51:54 GMT
server: cloudflare
etag: W/"62b9619a-2ca9d"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 74614557fe469125-FRA

GET
H2 200 fontawesome.css
www.bitdefender.com/themes/draco/menu_json/font-awesome/css/ 99 KB
17 KB 135ms
131ms Stylesheet
text/css 2606:4700::6812:a8de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bitdefender.com/themes/draco/menu_json/font-awesome/css/fontawesome.css
Requested by: Host: www.bitdefender.com
URL: https://www.bitdefender.com/blog/_nuxt/0710a8e.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:a8de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c72d06f598a03fc5ea94f19031891b97f4b4abb3a42fc94974cbe7ccd26dd6fd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bitdefender.com/blog/labs/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: public
date: Mon, 05 Sep 2022 19:11:28 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Wed, 10 Jun 2020 15:46:57 GMT
server: cloudflare
etag: W/"5ee10071-18d6f"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 74614557fe489125-FRA

GET
H2 200 light.css
www.bitdefender.com/themes/draco/menu_json/font-awesome/css/ 679 B
403 B 89ms
85ms Stylesheet
text/css 2606:4700::6812:a8de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bitdefender.com/themes/draco/menu_json/font-awesome/css/light.css
Requested by: Host: www.bitdefender.com
URL: https://www.bitdefender.com/blog/_nuxt/0710a8e.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:a8de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c660fbb2eafabfce77b9c08b7203202a6f81dba21555196c56d1cbd433e75c4d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bitdefender.com/blog/labs/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: public
date: Mon, 05 Sep 2022 19:11:28 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Wed, 10 Jun 2020 15:46:57 GMT
server: cloudflare
etag: W/"5ee10071-2a7"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 74614557fe4c9125-FRA

GET
H2 200 / Show response
geolocation-db.com/json/ 145 B
257 B 168ms
30ms Fetch
text/html 159.89.102.253
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://geolocation-db.com/json/
Requested by: Host: www.bitdefender.com
URL: https://www.bitdefender.com/blog/_nuxt/0710a8e.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 159.89.102.253 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 75bbd9b3073784bd3c9f2ded5c0748c94a388a40ac96ebc8083b4c396caf3c91

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bitdefender.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

access-control-allow-origin: *
date: Mon, 05 Sep 2022 19:11:28 GMT
content-encoding: gzip
server: nginx/1.14.0 (Ubuntu)
content-type: text/html; charset=UTF-8

GET
H2 200 5a88bf5f4370b9e81beffe2eec2fdfeb
2.gravatar.com/avatar/ 38 KB
38 KB 115ms
7ms Image
image/jpeg 2a04:fa87:fffe::c000:4902
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://2.gravatar.com/avatar/5a88bf5f4370b9e81beffe2eec2fdfeb?s=512&d=mm&r=g
Requested by: Host: www.bitdefender.com
URL: https://www.bitdefender.com/blog/labs/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 605049831ba52638b7350f4da9d915fd398308a243c027dfd13eb55f0b1b1556

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bitdefender.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Mon, 05 Sep 2022 19:11:28 GMT
last-modified: Thu, 07 Apr 2016 13:28:19 GMT
server: nginx
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=300
content-disposition: inline; filename="5a88bf5f4370b9e81beffe2eec2fdfeb.jpeg"
accept-ranges: bytes
link: <https://www.gravatar.com/avatar/5a88bf5f4370b9e81beffe2eec2fdfeb?s=512&d=mm&r=g>; rel="canonical"
content-length: 38493
expires: Mon, 05 Sep 2022 19:16:28 GMT

GET
H2 200 Router-DNS-Hijacking.jpg
blogapp.bitdefender.com/labs/content/images/size/w1000/wordpress/2020/03/ 170 KB
170 KB 161ms
118ms Image
image/jpeg 2606:4700::6812:a8de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blogapp.bitdefender.com/labs/content/images/size/w1000/wordpress/2020/03/Router-DNS-Hijacking.jpg
Requested by: Host: www.bitdefender.com
URL: https://www.bitdefender.com/blog/labs/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:a8de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: ad182c97d0c274d70865102ba8ede3e9312666f30471b43f3c7236b93b100f0c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bitdefender.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 05 Sep 2022 19:11:28 GMT
etag: W/"2a8c4-179810d9c88"
cf-cache-status: MISS
last-modified: Tue, 18 May 2021 19:57:03 GMT
server: cloudflare
x-powered-by: Express
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 74614558cf729125-FRA
content-length: 174276

GET
H2 200 Internet_Security_Concept_-_Safe_and_Secure_Network.jpg
blogapp.bitdefender.com/labs/content/images/size/w300/2022/08/ 10 KB
10 KB 73ms
31ms Image
image/jpeg 2606:4700::6812:a8de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blogapp.bitdefender.com/labs/content/images/size/w300/2022/08/Internet_Security_Concept_-_Safe_and_Secure_Network.jpg
Requested by: Host: www.bitdefender.com
URL: https://www.bitdefender.com/blog/labs/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:a8de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 2b71de573fd66d45ad8f771f4b288f8f0c6256efdf106d7d9b0e157cecd65e72

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bitdefender.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 05 Sep 2022 19:11:28 GMT
cf-cache-status: HIT
last-modified: Wed, 10 Aug 2022 11:01:38 GMT
server: cloudflare
age: 301331
x-powered-by: Express
etag: W/"2812-182876ac701"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 74614558cf759125-FRA
content-length: 10258
cf-bgj: h2pri

GET
H2 200 smart-home-gfd3bc417c_1920.jpg
blogapp.bitdefender.com/labs/content/images/size/w300/2022/03/ 18 KB
18 KB 71ms
30ms Image
image/jpeg 2606:4700::6812:a8de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blogapp.bitdefender.com/labs/content/images/size/w300/2022/03/smart-home-gfd3bc417c_1920.jpg
Requested by: Host: www.bitdefender.com
URL: https://www.bitdefender.com/blog/labs/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:a8de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 84f58b182a30f21e0d86036cb5ef1c91614a726024caab8f2258f0a09dad7d7e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bitdefender.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 05 Sep 2022 19:11:28 GMT
cf-cache-status: HIT
last-modified: Tue, 29 Mar 2022 15:41:33 GMT
server: cloudflare
age: 104626
x-powered-by: Express
etag: W/"470e-17fd656e43a"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 74614558cf789125-FRA
content-length: 18190
cf-bgj: h2pri

GET
H2 200 sms-mini.jpg
blogapp.bitdefender.com/labs/content/images/size/w300/2022/01/ 8 KB
8 KB 72ms
32ms Image
image/jpeg 2606:4700::6812:a8de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blogapp.bitdefender.com/labs/content/images/size/w300/2022/01/sms-mini.jpg
Requested by: Host: www.bitdefender.com
URL: https://www.bitdefender.com/blog/labs/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:a8de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 6b1ac3e3003fe173ea49a6e54e47d12396b690043bf6d811e65edb29d0d24df8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bitdefender.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 05 Sep 2022 19:11:28 GMT
cf-cache-status: HIT
last-modified: Tue, 26 Apr 2022 07:35:42 GMT
server: cloudflare
age: 301331
x-powered-by: Express
etag: W/"1f97-18064cc27cb"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 74614558cf7c9125-FRA
content-length: 8087
cf-bgj: h2pri

GET
H2 200 markus-spiske-70Rir5vB96U-unsplash.jpg
blogapp.bitdefender.com/labs/content/images/size/w300/2021/12/ 17 KB
17 KB 63ms
31ms Image
image/jpeg 2606:4700::6812:a8de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blogapp.bitdefender.com/labs/content/images/size/w300/2021/12/markus-spiske-70Rir5vB96U-unsplash.jpg
Requested by: Host: www.bitdefender.com
URL: https://www.bitdefender.com/blog/labs/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:a8de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: bb67e83ddffecbe3b2c2f7ce7022cffa34968732c79dc8324b96c982220ededa

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bitdefender.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 05 Sep 2022 19:11:28 GMT
cf-cache-status: HIT
last-modified: Tue, 26 Apr 2022 07:36:17 GMT
server: cloudflare
age: 1791625
x-powered-by: Express
etag: W/"44c6-18064ccb0ef"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 74614558df9e9125-FRA
content-length: 17606
cf-bgj: h2pri

GET
H2 200 DracoTeam_visuals_01.jpg
blogapp.bitdefender.com/labs/content/images/size/w300/2021/11/ 9 KB
9 KB 57ms
25ms Image
image/jpeg 2606:4700::6812:a8de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blogapp.bitdefender.com/labs/content/images/size/w300/2021/11/DracoTeam_visuals_01.jpg
Requested by: Host: www.bitdefender.com
URL: https://www.bitdefender.com/blog/labs/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:a8de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 30477c3a3724f87a1a0999252ff6bf8417ed79da5a6e0cb462b1cc7b27318d7c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bitdefender.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 05 Sep 2022 19:11:28 GMT
cf-cache-status: HIT
last-modified: Tue, 26 Apr 2022 07:35:43 GMT
server: cloudflare
age: 1763884
x-powered-by: Express
etag: W/"24d0-18064cc29c7"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 74614558dfa49125-FRA
content-length: 9424
cf-bgj: h2pri

GET
H2 200 decryptors.jpg
blogapp.bitdefender.com/labs/content/images/size/w300/2021/10/ 10 KB
10 KB 46ms
26ms Image
image/jpeg 2606:4700::6812:a8de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blogapp.bitdefender.com/labs/content/images/size/w300/2021/10/decryptors.jpg
Requested by: Host: www.bitdefender.com
URL: https://www.bitdefender.com/blog/labs/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:a8de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 27fb8bc75fcbd15af1cb1e1ccf9ef291ff28758a8652f7a5ed7ad698cdcc7aed

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bitdefender.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 05 Sep 2022 19:11:28 GMT
cf-cache-status: HIT
last-modified: Tue, 26 Apr 2022 07:35:43 GMT
server: cloudflare
age: 1763883
x-powered-by: Express
etag: W/"28ae-18064cc2977"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 74614558dfb89125-FRA
content-length: 10414
cf-bgj: h2pri

GET
H/1.1

200
OK

rd Show response
dpm.demdex.net/id/
Redirect Chain

https://dpm.demdex.net/id?d_visid_ver=5.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=0E920C0F53DA9E9B0A490D45%40AdobeOrg&d_nsid=0&ts=1662405095413
https://dpm.demdex.net/id/rd?d_visid_ver=5.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=0E920C0F53DA9E9B0A490D45%40AdobeOrg&d_nsid=0&ts=1662405095413

2 KB
2 KB

36ms
35ms

XHR
application/json

34.249.157.182
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id/rd?d_visid_ver=5.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=0E920C0F53DA9E9B0A490D45%40AdobeOrg&d_nsid=0&ts=1662405095413

Requested by

Host: www.bitdefender.com
URL: https://www.bitdefender.com/blog/labs/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/

Protocol

HTTP/1.1

Server

34.249.157.182 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-249-157-182.eu-west-1.compute.amazonaws.com

Software

Resource Hash

b722985700bda4dcc44ba79f755cd316db98f06edf3dc167d54d02df440205a6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bitdefender.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

DCS: dcs-prod-irl1-2-v038-052908483.edge-irl1.demdex.com 4 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-TID: ukiXH0sNTgE=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://www.bitdefender.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 739
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS: dcs-prod-irl1-1-v038-0c1b2a0e8.edge-irl1.demdex.com 0 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Access-Control-Allow-Origin: https://www.bitdefender.com
X-TID: K0DVCQkdTxk=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://dpm.demdex.net/id/rd?d_visid_ver=5.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=0E920C0F53DA9E9B0A490D45%40AdobeOrg&d_nsid=0&ts=1662405095413
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 AppMeasurement.min.js Show response
assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/ 33 KB
12 KB 23ms
18ms Script
application/x-javascript 2a02:26f0:3500:592::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/8a93f8486ba4/62c1fd5cdcbd/launch-b77a56f2d5f1.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:592::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 9219086b4f2c3bf77854b2e06ccd97ad32b9b7a140e65ff8b974a3bae6c7854c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bitdefender.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

unused62: 8096267
date: Mon, 05 Sep 2022 19:11:28 GMT
content-encoding: gzip
last-modified: Mon, 14 Feb 2022 16:35:31 GMT
server: AkamaiNetStorage
etag: "d860c16ac938f7d839f0ec158d02d0f0:1644856531.418573"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.bitdefender.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 12163
expires: Mon, 05 Sep 2022 20:11:28 GMT

GET
H2 200 AppMeasurement_Module_ActivityMap.min.js Show response
assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/ 3 KB
2 KB 26ms
22ms Script
application/x-javascript 2a02:26f0:3500:592::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement_Module_ActivityMap.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/8a93f8486ba4/62c1fd5cdcbd/launch-b77a56f2d5f1.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:592::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 462a66acbf50e933685e7587e9f1441df8225b2bb4d6b7bc5e757eccf4ff6575

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bitdefender.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

unused62: 8096267
date: Mon, 05 Sep 2022 19:11:28 GMT
content-encoding: gzip
last-modified: Mon, 14 Feb 2022 16:35:31 GMT
server: AkamaiNetStorage
etag: "2d1382c349d480b6b41574ac0c1af066:1644856531.739514"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.bitdefender.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 1597
expires: Mon, 05 Sep 2022 20:11:28 GMT

GET
H2 200 AppMeasurement_Module_AudienceManagement.min.js Show response
assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/ 25 KB
9 KB 69ms
65ms Script
application/x-javascript 2a02:26f0:3500:592::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement_Module_AudienceManagement.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/8a93f8486ba4/62c1fd5cdcbd/launch-b77a56f2d5f1.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:592::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 4858af0bdd1175d3f6c795eb053e7cae348ecb67f0633020d7d925c7672de871

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bitdefender.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

unused62: 8096267
date: Mon, 05 Sep 2022 19:11:28 GMT
content-encoding: gzip
last-modified: Mon, 14 Feb 2022 16:35:31 GMT
server: AkamaiNetStorage
etag: "26a8cd142b539700557eb4710c3d56bd:1644856531.982003"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.bitdefender.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 8753
expires: Mon, 05 Sep 2022 20:11:28 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 168 KB
62 KB 96ms
26ms Script
application/javascript 2a00:1450:4001:801::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-674268845

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/8a93f8486ba4/62c1fd5cdcbd/launch-b77a56f2d5f1.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

28bc18ea6d845945c22e14516438b29acf7ede246d0e1a6fcee2ade2976b6294

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bitdefender.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 05 Sep 2022 19:11:28 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 62775
x-xss-protection: 0
last-modified: Mon, 05 Sep 2022 18:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 05 Sep 2022 19:11:28 GMT

GET
H2 200 ip.json Show response
api.company-target.com/api/v2/ 1 KB
1 KB 209ms
68ms XHR
application/json 18.66.97.17
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.company-target.com/api/v2/ip.json?key=b7702e4099c19fbb2580e68d489df700&page=https%3A%2F%2Fwww.bitdefender.com%2Fblog%2Flabs%2Fnew-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer%2F&referrer=&page_title=New%20Router%20DNS%20Hijacking%20Attacks%20Abuse%20Bitbucket%20to%20Host%20Infostealer&src=adobelaunch
Requested by: Host: www.bitdefender.com
URL: https://www.bitdefender.com/blog/_nuxt/6a6d0e9.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.97.17 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-97-17.fra56.r.cloudfront.net
Software: nginx /
Resource Hash: 700c0dae509ca97b836fce880edd251968a0d64590a33cc50da6be52815110d6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bitdefender.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 05 Sep 2022 19:11:28 GMT
identification-source: CENTRAL
vary: Accept-Encoding, Origin
x-amz-cf-pop: FRA56-P2
x-cache: Miss from cloudfront
request-id: 2a4f9f77-8618-4d4d-b022-2b3b2b329ea1
content-encoding: gzip
pragma: no-cache
access-control-allow-origin: https://www.bitdefender.com
server: nginx
access-control-max-age: 7200
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json;charset=utf-8
via: 1.1 80a51c83bb9479e2a3aa1ea59b366458.cloudfront.net (CloudFront)
access-control-expose-headers
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
api-version: v2
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: TIDxh8siZGw70zdNVGtHRbarcpYL-CufASwwNj8VYkGUNsagpn7fuw==
expires: Sun, 04 Sep 2022 19:11:28 GMT

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 8 KB
3 KB 69ms
9ms Script
application/x-javascript 2a02:26f0:3500:16::215:149b
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: www.bitdefender.com
URL: https://www.bitdefender.com/blog/labs/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:16::215:149b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: b57839788686bf37d29f47bbe45ad8258085e3aebf54650ab389c0b515b977e1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bitdefender.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 05 Sep 2022 19:11:28 GMT
content-encoding: gzip
last-modified: Fri, 12 Aug 2022 20:23:36 GMT
x-cdn: AKAM
vary: Accept-Encoding
content-type: application/x-javascript;charset=utf-8
cache-control: max-age=61197
accept-ranges: bytes
content-length: 3063

GET
H2 200 fs.js Show response
edge.fullstory.com/s/ 244 KB
62 KB 64ms
8ms Script
application/javascript 35.201.112.186
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://edge.fullstory.com/s/fs.js
Requested by: Host: www.bitdefender.com
URL: https://www.bitdefender.com/blog/labs/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.112.186 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 186.112.201.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 2f787511a2287aac4f97e8dfcc046c59a072d3ac320d031c89c256f62c204095

Request headers

Referer: https://www.bitdefender.com/
Origin: https://www.bitdefender.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 05 Sep 2022 19:10:06 GMT
content-encoding: br
age: 82
x-guploader-uploadid: ADPycdu9blDbGREpL4dl2JR1BqpgnM-O4SL_GpRI1frGdGh8uSfW70CHUr_JLIK8zveTgl6L6AjYtrcNrvwp_vq255X3Ww
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: br
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 62596
last-modified: Wed, 31 Aug 2022 14:00:47 GMT
server: UploadServer
etag: "5236e609e3c53efc1950e159bd75152a"
vary: Accept-Encoding
x-goog-hash: crc32c=uai+sA==, md5=UjbmCePFPvwZUOFZvXUVKg==
x-goog-generation: 1661954446968697
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Content-Type, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control: public, max-age=3600,no-transform
x-goog-stored-content-length: 62596
accept-ranges: bytes
content-type: application/javascript
expires: Mon, 05 Sep 2022 20:10:06 GMT

GET
H2 200 hotjar-37798.js Show response
static.hotjar.com/c/ 19 KB
5 KB 87ms
9ms Script
application/javascript 18.66.97.37
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hotjar.com/c/hotjar-37798.js?sv=6

Requested by

Host: www.bitdefender.com
URL: https://www.bitdefender.com/blog/labs/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.97.37 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-97-37.fra56.r.cloudfront.net

Software

Resource Hash

aec03f6734668391ed99d7a5a8402667ea74b5031061ee9805a9b95a8a98f791

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bitdefender.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 05 Sep 2022 19:10:46 GMT
content-encoding: br
x-content-type-options: nosniff
age: 42
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=604800; includeSubDomains
access-control-allow-origin: *
x-cache-hit: 1
etag: W/325cbde74efd5b6d8cb900977981348a
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
via: 1.1 c2e56cd54e2593df95ccca8a6d98c958.cloudfront.net (CloudFront)
cache-control: max-age=60
x-amz-cf-pop: FRA56-P2
x-amz-cf-id: bizvHaabEHBob8YwMRvsmiyiKhV8s25fSwhaSFcHPuzbnn3COEq8LA==

GET
H/1.1 200
OK scarab-v2.js Show response
cdn.scarabresearch.com/js/198DE47607F5EBDB/ 95 KB
23 KB 89ms
12ms Script
application/javascript 18.66.147.110
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.scarabresearch.com/js/198DE47607F5EBDB/scarab-v2.js
Requested by: Host: www.bitdefender.com
URL: https://www.bitdefender.com/blog/labs/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.147.110 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-147-110.fra60.r.cloudfront.net
Software: /
Resource Hash: d57c03d71db7c219088793c262275665f64bb36e69629115ff0542a54cbd8d32

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bitdefender.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Date: Mon, 05 Sep 2022 18:35:59 GMT
Content-Encoding: gzip
Connection: keep-alive
Age: 2130
ETag: "912618c704a77f580a94d1bc692110df--gzip"
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Content-Type: application/javascript;charset=utf-8
Via: 1.1 0c371064bf157d89e4b3520c0b29474c.cloudfront.net (CloudFront)
Cache-Control: max-age=3600,public
Transfer-Encoding: chunked
X-Amz-Cf-Pop: FRA60-P4
Timing-Allow-Origin: *
X-Amz-Cf-Id: K0FP3e1HXhehHodQzGRqB7yxOP6eKgvB-sVz3sQRJKb6mVacDQdDJA==

GET
H2 200 css
fonts.googleapis.com/ 8 KB
1 KB 73ms
28ms Stylesheet
text/css 2a00:1450:400e:810::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:400,500,600,700,800,900&display=swap

Requested by

Host: www.bitdefender.com
URL: https://www.bitdefender.com/themes/draco/menu_json/mega_menu.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400e:810::200a , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

4904f9e17645f3b0ad5eaee1896f35715c37653b82b1ae20fc4f65404b39d613

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bitdefender.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 05 Sep 2022 19:11:28 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 05 Sep 2022 19:11:28 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 05 Sep 2022 19:11:28 GMT

GET
H2 200 bc-v4.min.html Show response
consentcdn.cookiebot.com/sdk/ Frame CD06 627 B
692 B 96ms
17ms Document
text/html 2a02:26f0:10e:2b1::f09
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://consentcdn.cookiebot.com/sdk/bc-v4.min.html
Requested by: Host: consent.cookiebot.com
URL: https://consent.cookiebot.com/uc.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10e:2b1::f09 Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 738e5435f2d18427d291a0d6289eee0ebbc87b596d6003919f255760ac293104

Request headers

Referer: https://www.bitdefender.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=31535811
content-encoding: gzip
content-length: 392
content-type: text/html
date: Mon, 05 Sep 2022 19:11:28 GMT
etag: "3d08665fa4c7bcf9fa2dcbbc7efe1d0f:1649057029.895163"
expires: Tue, 05 Sep 2023 19:08:19 GMT
last-modified: Mon, 04 Apr 2022 07:23:49 GMT
server: AkamaiNetStorage
server-timing: cdn-cache; desc=HIT edge; dur=1
vary: Accept-Encoding
x-akamai-transformed: 9 - 0 pmb=mRUM,1

GET
H2 200 cc.js Show response
consent.cookiebot.com/4a55b566-7010-4633-9b03-7ba7735be0b6/ 242 KB
59 KB 178ms
178ms Script
application/x-javascript 2a02:26f0:ea::215:ac21
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://consent.cookiebot.com/4a55b566-7010-4633-9b03-7ba7735be0b6/cc.js?renew=false&referer=www.bitdefender.com&dnt=false&init=false&culture=en_US
Requested by: Host: consent.cookiebot.com
URL: https://consent.cookiebot.com/uc.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:ea::215:ac21 Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 3eca59020141cf3157cf996e32defb08752534e96a5f1e77897390999671360c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bitdefender.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 05 Sep 2022 19:11:28 GMT
content-encoding: gzip
last-modified: Mon, 05 Sep 2022 19:11:28 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
access-control-expose-headers: Request-Context
cache-control: private, max-age=1200
content-length: 60258
request-context: appId=cid-v1:89f47f4b-bed0-4db8-956b-d6e6dfac3fef

GET
H2 200 / Show response
www.bitdefender.com/site/Main/TagIT/getparams/ 53 B
909 B 113ms
112ms Script
application/javascript 2606:4700::6812:a8de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bitdefender.com/site/Main/TagIT/getparams/?callback=TagIT_getParams_callback&callback2=&l=en&ch=1662405098

Requested by

Host: www.bitdefender.com
URL: https://www.bitdefender.com/scripts/TagIT.v1.min.js?v=43

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:a8de , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

33f4a3188e5bd3946bc65cba66db7f0400a6c149acc208b4b46640af86858f61

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bitdefender.com/blog/labs/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Sep 2022 19:11:28 GMT
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
strict-transport-security: max-age=63072000; includeSubdomains; preload
p3p: CP="NOI ADM DEV COM NAV OUR STP"
content-type: application/javascript
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray: 7461455b7c3d9125-FRA
expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
16 KB 33ms
9ms Font
font/woff2 2a00:1450:4001:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,500,600,700,800,900&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.bitdefender.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Sun, 04 Sep 2022 05:29:41 GMT
x-content-type-options: nosniff
age: 135707
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15860
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 04 Sep 2023 05:29:41 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
15 KB 30ms
11ms Font
font/woff2 2a00:1450:4001:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,500,600,700,800,900&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.bitdefender.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 01 Sep 2022 08:01:51 GMT
x-content-type-options: nosniff
age: 385777
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 01 Sep 2023 08:01:51 GMT

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ 16 KB
16 KB 31ms
28ms Font
font/woff2 2a00:1450:4001:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,500,600,700,800,900&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.bitdefender.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Wed, 31 Aug 2022 20:10:25 GMT
x-content-type-options: nosniff
age: 428463
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15920
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:45 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 31 Aug 2023 20:10:25 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu7GxKOzY.woff2
fonts.gstatic.com/s/roboto/v30/ 12 KB
12 KB 10ms
9ms Font
font/woff2 2a00:1450:4001:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu7GxKOzY.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,500,600,700,800,900&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3c23eb02de6b34e30f18cfb7167abd81a2cedfd1da60dfcb71989517ab3fb431

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.bitdefender.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 29 Aug 2022 20:41:06 GMT
x-content-type-options: nosniff
age: 599422
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11872
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:25:01 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 29 Aug 2023 20:41:06 GMT

GET
H/1.1 200
OK dest5.html Show response
bitdefender.demdex.net/ Frame A92B 7 KB
3 KB 277ms
30ms Document
text/html 52.19.103.22
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://bitdefender.demdex.net/dest5.html?d_nsid=0

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/8a93f8486ba4/62c1fd5cdcbd/launch-b77a56f2d5f1.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.19.103.22 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-19-103-22.eu-west-1.compute.amazonaws.com

Software

Resource Hash

7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.bitdefender.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 2791
Content-Type: text/html;charset=UTF-8
DCS: dcs-prod-irl1-1-v038-0bef0d017.edge-irl1.demdex.com 0 ms
Expires: Thu, 01 Jan 1970 00:00:00 UTC
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: 6iTIgZOwT/o=
content-encoding: gzip
date: Mon, 5 Sep 2022 19:11:28 GMT
last-modified: Wed, 3 Aug 2022 11:53:46 GMT
vary: accept-encoding

GET
H2 200 id Show response
sstats.bitdefender.com/ 48 B
464 B 161ms
17ms XHR
application/x-javascript 13.36.218.177
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://sstats.bitdefender.com/id?d_visid_ver=5.4.0&d_fieldgroup=A&mcorgid=0E920C0F53DA9E9B0A490D45%40AdobeOrg&mid=33600745589040559792576253352563400461&ts=1662405095811

Requested by

Host: www.bitdefender.com
URL: https://www.bitdefender.com/blog/_nuxt/6a6d0e9.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.36.218.177 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-36-218-177.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

f8036f862488949609441d342479cf8d1caa763af69afb598e3d3510b74bc993

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.bitdefender.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 05 Sep 2022 19:11:28 GMT
x-content-type-options: nosniff
server: jag
vary: Origin
p3p: CP="This is not a P3P policy"
access-control-allow-origin: https://www.bitdefender.com
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/x-javascript;charset=utf-8
content-length: 48
x-xss-protection: 1; mode=block

GET
H/1.1

200
OK

ibs:dpid=411&dpuuid=YxZJ4AAAAMMFTQN-
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=33619390861099198522578824315854892490
https://dpm.demdex.net/ibs:dpid=411&dpuuid=YxZJ4AAAAMMFTQN-

42 B
942 B

33ms
32ms

Image
image/gif

34.249.157.182
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=411&dpuuid=YxZJ4AAAAMMFTQN-

Requested by

Host: www.bitdefender.com
URL: https://www.bitdefender.com/blog/labs/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/

Protocol

HTTP/1.1

Server

34.249.157.182 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-249-157-182.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bitdefender.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v038-0a9c51066.edge-irl1.demdex.com 2 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: +CanGKR7Ts0=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=YxZJ4AAAAMMFTQN-
Date: Mon, 05 Sep 2022 19:11:28 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

POST
H2 200 delivery Show response
starget.bitdefender.com/rest/v1/ 1 KB
1 KB 189ms
39ms XHR
application/json 52.208.60.7
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://starget.bitdefender.com/rest/v1/delivery?client=bitdefender&sessionId=29a31e33f6634f0882dbc26b3cbed7a9&version=2.9.0
Requested by: Host: www.bitdefender.com
URL: https://www.bitdefender.com/blog/_nuxt/6a6d0e9.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.208.60.7 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-208-60-7.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: c02388453d6d0fe769cd91a291f07c00aad29e00713afaedb24488c007d68782

Request headers

Referer: https://www.bitdefender.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 05 Sep 2022 19:11:28 GMT
content-encoding: gzip
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://www.bitdefender.com
access-control-allow-credentials: true
timing-allow-origin: *
x-request-id: cebbb003179a58a02491fa7d7f892cee

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=359890&time=1662405095879&url=https%3A%2F%2Fwww.bitdefender.com%2Fblog%2Flabs%2Fnew-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infosteal...
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D359890%26time%3D1662405095879%26url%3Dhttps%253A%252F%252Fwww.bitdefender.com%252...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=359890&time=1662405095879&url=https%3A%2F%2Fwww.bitdefender.com%2Fblog%2Flabs%2Fnew-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infosteal...
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=359890&time=1662405095879&url=https%3A%2F%2Fwww.bitdefender.com%2Fblog%2Flabs%2Fnew-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostea...

0
265 B

135ms
111ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=359890&time=1662405095879&url=https%3A%2F%2Fwww.bitdefender.com%2Fblog%2Flabs%2Fnew-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer%2F&liSync=true&e_ipv6=AQIzkylaIFw0SwAAAYMPEJeA9lOMvzyV79JkS_fYOoausC6evbQIz9o4lRiJdkeHIA
Requested by: Host: www.bitdefender.com
URL: https://www.bitdefender.com/blog/labs/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bitdefender.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 05 Sep 2022 19:11:28 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 7195D1A482E745639C0F4C853441B1DD Ref B: FRAEDGE1520 Ref C: 2022-09-05T19:11:29Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-type: application/javascript
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXn8tjRsQeBM/vnbSR4PQ==
x-li-fabric: prod-lva1

Redirect headers

date: Mon, 05 Sep 2022 19:11:28 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 57C61A91557D4FACB6436800404A8D8A Ref B: FRAEDGE1517 Ref C: 2022-09-05T19:11:29Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lva1
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=359890&time=1662405095879&url=https%3A%2F%2Fwww.bitdefender.com%2Fblog%2Flabs%2Fnew-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer%2F&liSync=true&e_ipv6=AQIzkylaIFw0SwAAAYMPEJeA9lOMvzyV79JkS_fYOoausC6evbQIz9o4lRiJdkeHIA
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXn8tjPmA7kxYgqs+6ytQ==

GET
H2 200 modules.d5eb3c97b67a0b8958ff.js Show response
script.hotjar.com/ 251 KB
65 KB 111ms
12ms Script
application/javascript 108.138.7.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://script.hotjar.com/modules.d5eb3c97b67a0b8958ff.js

Requested by

Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-37798.js?sv=6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

108.138.7.111 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-108-138-7-111.fra56.r.cloudfront.net

Software

Resource Hash

4ca35ab6756046c8b94ea3bde35009f35f981bbcb8fa3e8937c6dd956a36b3e1

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bitdefender.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 09:50:06 GMT
content-encoding: br
x-content-type-options: nosniff
age: 292882
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=86400; includeSubDomains
content-length: 65509
access-control-allow-origin: *
last-modified: Fri, 02 Sep 2022 09:49:47 GMT
etag: "5a03435fb2b1019b1b00d7bc5c267f72"
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 0e37105a96e87c22ff4981659a6dc176.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA56-P6
accept-ranges: bytes
x-robots-tag: none
x-amz-cf-id: jbg_67Bfmsdcj1kiV2U6ECUZBO8mQqpkx-Ch8fzKoa390ElMmUy4QQ==

GET
H/1.1 200
OK wploader.js Show response
static.scarabresearch.com/wpjs/ 31 KB
11 KB 80ms
9ms Script
application/javascript 13.32.99.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.scarabresearch.com/wpjs/wploader.js?ts=2748
Requested by: Host: cdn.scarabresearch.com
URL: https://cdn.scarabresearch.com/js/198DE47607F5EBDB/scarab-v2.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.38 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-38.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c38bb954c382346bc43d67d9cc917180fe04be2bed4c19fc414e2a6e536bd599

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bitdefender.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-amz-version-id: lyz9oZFfSVj9eJ.9bot3OMs1hmNnUPCm
Content-Encoding: gzip
ETag: W/"a5cb6b309aad20434e1c776fa43d2b06"
Age: 53927
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
Last-Modified: Wed, 31 Aug 2022 07:56:16 GMT
Server: AmazonS3
Date: Mon, 05 Sep 2022 07:24:16 GMT
Vary: Accept-Encoding
Content-Type: application/javascript
Via: 1.1 ab21b6436bc1d51d57b228ad39b1fa54.cloudfront.net (CloudFront)
Cache-Control: max-age=86400
X-Amz-Cf-Pop: FRA60-P3
X-Amz-Cf-Id: 3CwQ1CmwDtGQk9ZK20dR9l8ej3I7i2h16QcrAKHDTFOmkKCfbm2Qcg==

POST
H2 202 page Show response
rs.fullstory.com/rec/ 52 B
262 B 150ms
124ms XHR
text/plain 35.186.194.58
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://rs.fullstory.com/rec/page

Requested by

Host: www.bitdefender.com
URL: https://www.bitdefender.com/blog/_nuxt/6a6d0e9.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.186.194.58 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

58.194.186.35.bc.googleusercontent.com

Software

Resource Hash

1776651e4a3c9aeb0124d70ef86c2832dc6900251e7771124b482283256d710d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.bitdefender.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 05 Sep 2022 19:11:28 GMT
via: 1.1 google
x-content-type-options: nosniff
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://www.bitdefender.com
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 52

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 41 KB
16 KB 125ms
99ms Script
text/javascript 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-674268845

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f162.1e100.net

Software

cafe /

Resource Hash

f6200e00f9bcf9a324c8c1a046c6bc624ebcaf1379faf13e4d76ae56ea0d1a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bitdefender.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 05 Sep 2022 19:11:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15690
x-xss-protection: 0
server: cafe
etag: 13194339052015637803
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Mon, 05 Sep 2022 19:11:28 GMT

GET
H2 200 box-1ada912494ba7fc7aca15fcef1c2a7ae.html Show response
vars.hotjar.com/ Frame 8CD9 2 KB
1 KB 65ms
8ms Document
text/html 18.66.147.116
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://vars.hotjar.com/box-1ada912494ba7fc7aca15fcef1c2a7ae.html

Requested by

Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-37798.js?sv=6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.147.116 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-147-116.fra60.r.cloudfront.net

Software

Resource Hash

90438997aa817bad94f49d367b04dbaaaa387493ef5a1f5b5d5f7b953b76c1ac

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400; includeSubDomains

Request headers

Referer: https://www.bitdefender.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 4703902
cache-control: max-age=31536000
content-encoding: br
content-length: 1044
content-type: text/html
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Wed, 13 Jul 2022 08:33:06 GMT
etag: "0b3d3f4206ab84d8861a8cc4b2ddbe66"
last-modified: Wed, 13 Jul 2022 08:32:20 GMT
strict-transport-security: max-age=86400; includeSubDomains
vary: Accept-Encoding
via: 1.1 a962efd99fafcdb81ca24e0e8140a67c.cloudfront.net (CloudFront)
x-amz-cf-id: Ob7IgjDl1AYofXOJyjMVQiQKQHm0OPnODiEWPBnnecZYT5aIvY3RNw==
x-amz-cf-pop: FRA60-P4
x-cache: Hit from cloudfront
x-robots-tag: none

GET
H2 200 json Show response
fls.doubleclick.net/ 40 B
719 B 144ms
48ms Script
text/javascript 142.250.184.198
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fls.doubleclick.net/json?spot=5165113&src=&var=s_3_Integrate_DFA_get_0&host=integrate.112.2o7.net%2Fdfa_echo%3Fvar%3Ds_3_Integrate_DFA_get_0%26AQE%3D1%26A2S%3D1&ord=7222582630514

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/8a93f8486ba4/62c1fd5cdcbd/launch-b77a56f2d5f1.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f6.1e100.net

Software

cafe /

Resource Hash

e32a6ae5e43f7f652674e0f03dc23f86839f839b29ee4e63c01c93da180bb0d0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bitdefender.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 05 Sep 2022 19:11:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 60
x-xss-protection: 0
pragma: no-cache
server: cafe
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: no-cache, must-revalidate
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 RCcc4046503e554f9d879079476ec89322-source.min.js Show response
assets.adobedtm.com/8a93f8486ba4/62c1fd5cdcbd/d755a3b3d814/ 494 B
568 B 13ms
13ms Script
application/x-javascript 2a02:26f0:3500:592::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/8a93f8486ba4/62c1fd5cdcbd/d755a3b3d814/RCcc4046503e554f9d879079476ec89322-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/8a93f8486ba4/62c1fd5cdcbd/launch-b77a56f2d5f1.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:592::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 95c6b9041f948cab2b50eec45c5a066f29747dda99e047d6946175d9e5c47728

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bitdefender.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 05 Sep 2022 19:11:28 GMT
content-encoding: gzip
last-modified: Wed, 31 Aug 2022 12:08:42 GMT
server: AkamaiNetStorage
etag: "245d8df51cd7d61f109e736982c4f574:1661947722.00778"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.bitdefender.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 301
expires: Mon, 05 Sep 2022 20:11:28 GMT

GET
H/1.1 200
OK wpes6.js Show response
static.scarabresearch.com/wpjs/ 88 KB
29 KB 9ms
9ms Script
application/javascript 13.32.99.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.scarabresearch.com/wpjs/wpes6.js?ts=2748
Requested by: Host: cdn.scarabresearch.com
URL: https://cdn.scarabresearch.com/js/198DE47607F5EBDB/scarab-v2.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.38 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-38.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 632fa1f1f20105d9f666362923739a79a12300d4ca8ffe08a1db3dd86b884160

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bitdefender.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-amz-version-id: mgTk3Be1iIaMQA6skmW3VWPx_bYJqcDm
Content-Encoding: gzip
ETag: W/"9ab68c364f08e838d6437a1ef441c6cc"
Age: 42432
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
Last-Modified: Wed, 31 Aug 2022 07:56:18 GMT
Server: AmazonS3
Date: Mon, 05 Sep 2022 07:24:17 GMT
Vary: Accept-Encoding
Content-Type: application/javascript
Via: 1.1 ab21b6436bc1d51d57b228ad39b1fa54.cloudfront.net (CloudFront)
Cache-Control: max-age=86400
X-Amz-Cf-Pop: FRA60-P3
X-Amz-Cf-Id: FWGiYXUiK__ZgU82OslsQtzGIEdkuExH8zOcg9uv99Wr1B05RKwkcw==

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4f29b4389a6e08bf3ffcdfb097597d5621b4abac31a74f89c3fa3537dc428e68

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 964 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d47bcf54431b918d4b86953244677a675940b21844a2ac41bee9b690415eb0b1

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 98ccd33e523985efa588344a13932892db38b1335243f989dd366450db8ea68d

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 973 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: feeff1b73fc856bbaa909aecd74cd3918a41d2f0642b773831da45ad969317e9

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 43e8590e9574c075959f307b06c6089707927b5222f8855adbcb28aabc286867

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK / Show response
recommender.scarabresearch.com/merchants/198DE47607F5EBDB/ 89 B
649 B 79ms
8ms XHR
application/json 18.153.3.78
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://recommender.scarabresearch.com/merchants/198DE47607F5EBDB/?pv=1758816025&xp=1&cv=1&ca=&cp=1
Requested by: Host: www.bitdefender.com
URL: https://www.bitdefender.com/blog/_nuxt/6a6d0e9.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.153.3.78 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-153-3-78.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: a211156b6a63a4e16019e1f3d1f5742b57ac3ff01e8c591e7d1407528aee9ec2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bitdefender.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Date: Mon, 05 Sep 2022 19:11:29 GMT
P3P: CP="NOI DSP COR NID PSAo OUR IND"
Vary: Accept-Encoding, User-Agent
Content-Type: application/json;charset=utf-8
Access-Control-Allow-Origin: https://www.bitdefender.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 89
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 RC472316cf351947379963ff5bb35b079a-source.min.js Show response
assets.adobedtm.com/8a93f8486ba4/62c1fd5cdcbd/d755a3b3d814/ 529 B
605 B 9ms
8ms Script
application/x-javascript 2a02:26f0:3500:592::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/8a93f8486ba4/62c1fd5cdcbd/d755a3b3d814/RC472316cf351947379963ff5bb35b079a-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/8a93f8486ba4/62c1fd5cdcbd/launch-b77a56f2d5f1.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:592::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 627c537d7fadb4890a89a79768756a044f7e791cad37e597d051a0070a7e5469

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bitdefender.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 05 Sep 2022 19:11:29 GMT
content-encoding: gzip
last-modified: Wed, 31 Aug 2022 12:08:42 GMT
server: AkamaiNetStorage
etag: "245d8df51cd7d61f109e736982c4f574:1661947722.00778"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.bitdefender.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 337
expires: Mon, 05 Sep 2022 20:11:29 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/674268845/ 2 KB
2 KB 121ms
95ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/674268845/?random=1662405096250&cv=9&fst=1662405096250&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa8v0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.bitdefender.com%2Fblog%2Flabs%2Fnew-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer%2F&tiba=New%20Router%20DNS%20Hijacking%20Attacks%20Abuse%20Bitbucket%20to%20Host%20Infostealer&auid=592754599.1662405096&hn=www.googleadservices.com&us_privacy=1---&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e21ba8342831d4df59a5686161e0954c7d34b33b6c64bd512bc4fb7a26608176

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bitdefender.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Sep 2022 19:11:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1115
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 s63086546254716 Show response
sstats.bitdefender.com/b/ss/bitdefenderproduction/10/JS-2.22.4-LCUM/ 1 KB
2 KB 44ms
43ms Script
application/x-javascript 13.36.218.177
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://sstats.bitdefender.com/b/ss/bitdefenderproduction/10/JS-2.22.4-LCUM/s63086546254716?AQB=1&ndh=1&pf=1&callback=s_c_il[1].doPostbacks&et=1&t=5%2F8%2F2022%2019%3A11%3A36%201%200&d.&nsid=0&jsonv=1&coop_safe=1&.d&sdid=59450AB120D4EE8D-641F34B2246B9AE4&mid=33600745589040559792576253352563400461&aamlh=6&ce=UTF-8&cdp=2&fpCookieDomainPeriods=2&pageName=blog%3Alabs%3Aantimalware-research%3Anew-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer&g=https%3A%2F%2Fwww.bitdefender.com%2Fblog%2Flabs%2Fnew-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer%2F&c.&inList=3.0&apl=4.0&getPercentPageViewed=5.0.2&handlePPVevents=n%2Fa&p_fo=3.0&.c&cc=USD&ch=blog&server=www.bitdefender.com&events=event1&aamb=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&c1=labs&v1=blog%3Alabs%3Aantimalware-research%3Anew-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer&c2=antimalware-research&c3=new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer&v3=D%3Dc8&c4=production&v4=D%3Dc9&c5=https%3A%2F%2Fwww.bitdefender.com%2Fblog%2Flabs%2Fnew-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer%2F&v5=Bot%20detected&v6=D%3Dc6&c7=en&v7=D%3Dc7&c8=5%2F9%2F2022&c9=19%3A11%7C19%3A00-19%3A59%7Cmonday%7Cgmt&c10=%7C&c12=undefined&c13=highestPercentViewed%3D%20%7C%20initialPercentViewed%3D%20%2B%20%7C%20foldsSeen%3D%20%7C%20foldsAvailable%3D&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=0E920C0F53DA9E9B0A490D45%40AdobeOrg&AQE=1

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.36.218.177 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-36-218-177.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

8dd32d43b590723c9c07d8e08774453ebcb16d13539a34426adae7016af4c783

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bitdefender.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-aam-tid: brnWvkKzSss=
date: Mon, 05 Sep 2022 19:11:29 GMT
x-content-type-options: nosniff
p3p: CP="This is not a P3P policy"
vary: *
content-length: 1407
x-xss-protection: 1; mode=block
dcs: dcs-prod-irl1-2-v038-06d3c4e35.edge-irl1.demdex.com 5 ms
pragma: no-cache
last-modified: Tue, 06 Sep 2022 19:11:29 GMT
server: jag
etag: 3569987746011742208-4619387895946999440
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/x-javascript;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, no-transform, private
expires: Sun, 04 Sep 2022 19:11:29 GMT

GET
H2 451 365868.gif
idsync.rlcdn.com/ Frame A92B 0
98 B 51ms
16ms Image
text/plain 35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/365868.gif?partner_uid=33619390861099198522578824315854892490
Requested by: Host: www.bitdefender.com
URL: https://www.bitdefender.com/blog/labs/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bitdefender.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 05 Sep 2022 19:11:29 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 campaigns Show response
webchannel-content-service.scarabresearch.com/customer/786874886/ 10 B
335 B 98ms
21ms XHR
application/json 34.117.30.199
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://webchannel-content-service.scarabresearch.com/customer/786874886/campaigns?url=https:%2F%2Fwww.bitdefender.com%2Fblog%2Flabs%2Fnew-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer%2F&prev_url=&lang=en&ca=&uli=false

Requested by

Host: www.bitdefender.com
URL: https://www.bitdefender.com/blog/_nuxt/6a6d0e9.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.117.30.199 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

199.30.117.34.bc.googleusercontent.com

Software

Resource Hash

f3c689523d23693d898b0fff66ef380027572e1896e28552f0e029a5626dd46b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/plain, */*
Referer: https://www.bitdefender.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Sep 2022 19:11:29 GMT
via: 1.1 google
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-frame-options: DENY
content-type: application/json
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, must-revalidate
strict-transport-security: max-age=31536000 ; includeSubDomains
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
x-xss-protection: 1; mode=block
expires: 0

GET
H2 200 heatmap-dynamic-view.3812bf29e0e22c682d98.js Show response
script.hotjar.com/ 9 KB
3 KB 9ms
8ms Script
application/javascript 108.138.7.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://script.hotjar.com/heatmap-dynamic-view.3812bf29e0e22c682d98.js

Requested by

Host: script.hotjar.com
URL: https://script.hotjar.com/modules.d5eb3c97b67a0b8958ff.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

108.138.7.111 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-108-138-7-111.fra56.r.cloudfront.net

Software

Resource Hash

1b29e095d88dda5c7f9640cdd33a81f7c1769f95fcd4bfb437761f9647edab85

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bitdefender.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 09:50:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 292881
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=86400; includeSubDomains
content-length: 2826
access-control-allow-origin: *
last-modified: Fri, 02 Sep 2022 09:49:47 GMT
etag: "ec3359b3cadfa2f20e59761ee69f2105"
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 0e37105a96e87c22ff4981659a6dc176.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA56-P6
accept-ranges: bytes
x-robots-tag: none
x-amz-cf-id: zsuhOR1qc9bOBJmbpkk6ry38ZliVhOcKKfuuDXbWntFaYB7WW9yBow==

POST
H2 200 visit-data Show response
in.hotjar.com/api/v2/client/sites/37798/ 148 B
322 B 119ms
40ms XHR
application/json 63.34.154.154
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://in.hotjar.com/api/v2/client/sites/37798/visit-data?sv=6
Requested by: Host: www.bitdefender.com
URL: https://www.bitdefender.com/blog/_nuxt/6a6d0e9.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 63.34.154.154 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-63-34-154-154.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: a7a706ea35bec3b8e407aa0d6c26219d8be48a646e4a2e6098193b83e2cbd347

Request headers

Referer: https://www.bitdefender.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type: text/plain; charset=UTF-8

Response headers

date: Mon, 05 Sep 2022 19:11:29 GMT
content-encoding: br
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store
access-control-allow-credentials: true

GET 37798
vc.hotjar.io/sessions/ 0
0

GET
H2 200 ee38c350.min.js Show response
tag.demandbase.com/ 58 KB
16 KB 61ms
9ms Script
application/javascript 108.138.17.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tag.demandbase.com/ee38c350.min.js

Requested by

Host: www.bitdefender.com
URL: https://www.bitdefender.com/blog/labs/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

108.138.17.47 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-108-138-17-47.fra56.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

a274dd3d80e88c7b7ec742422f85305c89f63195842f6cb955b8da91335bd368

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bitdefender.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-amz-version-id: 8pk_rQfLkgrMhc1cNNDijb5bToidT25O
content-encoding: gzip
etag: W/"1d276aec4bfe79f4e9516e872ebcfdf5"
age: 869
x-cache: Hit from cloudfront
vary: Accept-Encoding
last-modified: Fri, 18 Dec 2020 19:38:34 GMT
server: AmazonS3
date: Mon, 05 Sep 2022 18:57:01 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
via: 1.1 a811170f30183becd909b501e545e756.cloudfront.net (CloudFront)
cache-control: public, max-age=3600
permissions-policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()
x-amz-cf-pop: FRA56-P7
x-amz-cf-id: ogkuoFX_TiFWzdQD0tHGFaDoqObAkYDMNzKOWNU6HfZUhwcpvezOzQ==

GET
H2 200 b67dec8.css
www.bitdefender.com/blog/_nuxt/css/ 317 B
259 B 41ms
41ms Stylesheet
text/css 2606:4700::6812:a8de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bitdefender.com/blog/_nuxt/css/b67dec8.css

Requested by

Host: www.bitdefender.com
URL: https://www.bitdefender.com/blog/_nuxt/5dc6f2a.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:a8de , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

35ca7dfd85eab7b4921cc95481ce31d0f845b54e69e59b1c147e18013fd89fc2

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bitdefender.com/blog/labs/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 05 Sep 2022 19:11:29 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 16 Feb 2022 13:26:00 GMT
server: cloudflare
age: 17385427
etag: W/"140-17f02b60e40"
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
cache-control: public, max-age=31536000
cf-polished: origSize=320
strict-transport-security: max-age=15724800; includeSubDomains
cf-ray: 7461455f69f49125-FRA
cf-bgj: minify

GET
H2 200 4c052e0.js Show response
www.bitdefender.com/blog/_nuxt/ 19 KB
5 KB 42ms
41ms Script
application/javascript 2606:4700::6812:a8de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bitdefender.com/blog/_nuxt/4c052e0.js

Requested by

Host: www.bitdefender.com
URL: https://www.bitdefender.com/blog/_nuxt/5dc6f2a.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:a8de , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c971fa7151c790b164705b95fca02fc3112602a7e993b135e3176def7449b84c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bitdefender.com/blog/labs/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 05 Sep 2022 19:11:29 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 04 Jul 2022 13:31:35 GMT
server: cloudflare
age: 5463063
etag: W/"4ae3-181c968c2d8"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000
strict-transport-security: max-age=15724800; includeSubDomains
cf-ray: 7461455f69f59125-FRA

GET
H2 200 4f5e4ba.js Show response
www.bitdefender.com/blog/_nuxt/ 9 KB
3 KB 30ms
30ms Script
application/javascript 2606:4700::6812:a8de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bitdefender.com/blog/_nuxt/4f5e4ba.js

Requested by

Host: www.bitdefender.com
URL: https://www.bitdefender.com/blog/_nuxt/5dc6f2a.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:a8de , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

af760eef3e69c8edefe111eaec6df825c3dee6dad0dffb97459a56c3ab0391fa

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bitdefender.com/blog/labs/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 05 Sep 2022 19:11:29 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 04 Jul 2022 13:31:35 GMT
server: cloudflare
age: 5463061
etag: W/"2542-181c968c2d8"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000
strict-transport-security: max-age=15724800; includeSubDomains
cf-ray: 7461455f69f79125-FRA

GET
H2 200 /
www.google.com/pagead/1p-user-list/674268845/ 42 B
548 B 53ms
25ms Image
image/gif 2a00:1450:4001:802::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/674268845/?random=1662405096250&cv=9&fst=1662404400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa8v0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.bitdefender.com%2Fblog%2Flabs%2Fnew-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer%2F&tiba=New%20Router%20DNS%20Hijacking%20Attacks%20Abuse%20Bitbucket%20to%20Host%20Infostealer&async=1&fmt=3&is_vtc=1&random=3928597380&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: www.bitdefender.com
URL: https://www.bitdefender.com/blog/labs/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bitdefender.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Sep 2022 19:11:29 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/674268845/ 42 B
548 B 51ms
23ms Image
image/gif 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/674268845/?random=1662405096250&cv=9&fst=1662404400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa8v0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.bitdefender.com%2Fblog%2Flabs%2Fnew-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer%2F&tiba=New%20Router%20DNS%20Hijacking%20Attacks%20Abuse%20Bitbucket%20to%20Host%20Infostealer&async=1&fmt=3&is_vtc=1&random=3928597380&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: www.bitdefender.com
URL: https://www.bitdefender.com/blog/labs/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bitdefender.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Sep 2022 19:11:29 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

ibs:dpid=771&dpuuid=CAESEJqKPgvNiQDTrDe_rXiM1ko&google_cver=1
dpm.demdex.net/ Frame A92B
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm&gdpr=0&gdpr_consent=&google_hm=MzM2MTkzOTA4NjEwOTkxOTg1MjI1Nzg4MjQzMTU4NTQ4OTI0OTA=
https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEJqKPgvNiQDTrDe_rXiM1ko&google_cver=1?gdpr=0&gdpr_consent=

42 B
942 B

36ms
35ms

Image
image/gif

34.249.157.182
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEJqKPgvNiQDTrDe_rXiM1ko&google_cver=1?gdpr=0&gdpr_consent=

Requested by

Host: www.bitdefender.com
URL: https://www.bitdefender.com/blog/labs/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/

Protocol

HTTP/1.1

Server

34.249.157.182 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-249-157-182.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bitdefender.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

DCS: dcs-prod-irl1-2-v038-09a34e9ee.edge-irl1.demdex.com 4 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: 19Kc/VZzR6s=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

pragma: no-cache
date: Mon, 05 Sep 2022 19:11:29 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEJqKPgvNiQDTrDe_rXiM1ko&google_cver=1?gdpr=0&gdpr_consent=
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 314
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ip.json Show response
api.company-target.com/api/v2/ 1 KB
1 KB 174ms
174ms XHR
application/json 18.66.97.17
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.company-target.com/api/v2/ip.json?referrer=&page=https%3A%2F%2Fwww.bitdefender.com%2Fblog%2Flabs%2Fnew-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer%2F&page_title=New%20Router%20DNS%20Hijacking%20Attacks%20Abuse%20Bitbucket%20to%20Host%20Infostealer&src=tag&key=4df37d5c7636f0687f8288c1a889681f
Requested by: Host: www.bitdefender.com
URL: https://www.bitdefender.com/blog/_nuxt/6a6d0e9.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.97.17 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-97-17.fra56.r.cloudfront.net
Software: nginx /
Resource Hash: 700c0dae509ca97b836fce880edd251968a0d64590a33cc50da6be52815110d6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bitdefender.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 05 Sep 2022 19:11:29 GMT
identification-source: CENTRAL
vary: Accept-Encoding, Origin
x-amz-cf-pop: FRA56-P2
x-cache: Miss from cloudfront
request-id: f7bfa26f-7dd5-45b4-8af4-a92971b56799
content-encoding: gzip
pragma: no-cache
access-control-allow-origin: https://www.bitdefender.com
server: nginx
access-control-max-age: 7200
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json;charset=utf-8
via: 1.1 80a51c83bb9479e2a3aa1ea59b366458.cloudfront.net (CloudFront)
access-control-expose-headers
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
api-version: v2
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: uDB3psOsUILNes4yvZiZuJT7mktdFnhEcKf3hIXA8uy_iOBdmm_kng==
expires: Sun, 04 Sep 2022 19:11:29 GMT

GET
H2 200 adsct
analytics.twitter.com/i/ Frame A92B 43 B
354 B 134ms
113ms Image
image/gif 104.244.42.131
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?p_user_id=33619390861099198522578824315854892490&p_id=38594

Requested by

Host: www.bitdefender.com
URL: https://www.bitdefender.com/blog/labs/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.131 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bitdefender.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-response-time: 104
date: Mon, 05 Sep 2022 19:11:28 GMT
server: tsa_o
strict-transport-security: max-age=631138519
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, max-age=0
x-connection-hash: 06d392efde70e08b086686a05ea6ed2edb3bb3466de006191ee9c50005a0aa13
content-length: 43

GET
H2 200 logo-white.svg
www.bitdefender.com/themes/draco/menu_json/img/ 5 KB
2 KB 24ms
23ms Image
image/svg+xml 2606:4700::6812:a8de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bitdefender.com/themes/draco/menu_json/img/logo-white.svg
Requested by: Host: www.bitdefender.com
URL: https://www.bitdefender.com/themes/draco/menu_json/mega_menu.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:a8de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 50da0a45caa286f3feaca26be0d29e6984161f2d16364d34fab40a3245ddc604

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bitdefender.com/themes/draco/menu_json/mega_menu.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 05 Sep 2022 19:11:29 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 05 Dec 2019 12:26:34 GMT
server: cloudflare
age: 4942
etag: W/"5de8f77a-1592"
vary: Accept-Encoding
content-type: image/svg+xml
cf-ray: 746145606c009125-FRA

GET
H2 200 fa-light-300.woff2
www.bitdefender.com/themes/draco/menu_json/font-awesome/webfonts/ 167 KB
168 KB 40ms
39ms Font
application/octet-stream 2606:4700::6812:a8de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bitdefender.com/themes/draco/menu_json/font-awesome/webfonts/fa-light-300.woff2

Requested by

Host: www.bitdefender.com
URL: https://www.bitdefender.com/themes/draco/menu_json/font-awesome/css/light.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:a8de , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

83a4f7d376db994e499b627611104adbe197dc7a8e5d4d1069abad0840d5d368

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload

Request headers

Referer: https://www.bitdefender.com/themes/draco/menu_json/font-awesome/css/light.css
Origin: https://www.bitdefender.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 05 Sep 2022 19:11:29 GMT
cf-cache-status: HIT
last-modified: Wed, 10 Jun 2020 15:46:57 GMT
server: cloudflare
age: 424
etag: W/"5ee10071-29cd4"
vary: Accept-Encoding
content-type: application/octet-stream
strict-transport-security: max-age=63072000; includeSubdomains; preload
cf-ray: 746145606c049125-FRA

GET
H/1.1

200
OK

ibs:dpid=22052&dpuuid=3629848308637761626
dpm.demdex.net/ Frame A92B
Redirect Chain

https://ml314.com/utsync.ashx?eid=50112&et=0&gdpr=0&gdpr_consent=&return=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D22052%26dpuuid%3D[PersonID]
https://dpm.demdex.net/ibs:dpid=22052&dpuuid=3629848308637761626

42 B
942 B

34ms
34ms

Image
image/gif

34.249.157.182
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=22052&dpuuid=3629848308637761626

Protocol

HTTP/1.1

Server

34.249.157.182 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-249-157-182.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bitdefender.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

DCS: dcs-prod-irl1-2-v038-00508e2e6.edge-irl1.demdex.com 4 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: VQ6BiZCGSHA=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

pragma: no-cache
date: Mon, 05 Sep 2022 19:11:29 GMT
via: 1.1 google
server: Microsoft-IIS/10.0
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
p3p: CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
location: https://dpm.demdex.net/ibs:dpid=22052&dpuuid=3629848308637761626
cache-control: no-cache, no-store, must-revalidate
content-type: text/html; charset=utf-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 185
expires: 0,Tue, 06 Sep 2022 15:11:29 GMT

GET
H/1.1

200
OK

ibs:dpid=121998&dpuuid=
dpm.demdex.net/ Frame A92B
Redirect Chain

https://sync.crwdcntrl.net/map/c=9828/tp=ADBE/gdpr=0/gdpr_consent=/tpid=33619390861099198522578824315854892490?https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D121998%26dpuuid%3D${profile_id}
https://sync.crwdcntrl.net/map/ct=y/c=9828/tp=ADBE/gdpr=0/gdpr_consent=/tpid=33619390861099198522578824315854892490?https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D121998%26dpuuid%3D${profile_id}
https://dpm.demdex.net/ibs:dpid=121998&dpuuid=

42 B
960 B

30ms
30ms

Image
image/gif

34.249.157.182
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=121998&dpuuid=

Protocol

HTTP/1.1

Server

34.249.157.182 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-249-157-182.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bitdefender.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

DCS: dcs-prod-irl1-2-v038-0a54615c3.edge-irl1.demdex.com 0 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-Error: 300,104
X-TID: mVI/grDgQQI=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

pragma: no-cache
date: Mon, 05 Sep 2022 19:11:29 GMT
server: Jetty(9.4.38.v20210224)
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
location: https://dpm.demdex.net/ibs:dpid=121998&dpuuid=
expires: 0
cache-control: no-cache
x-server: 10.45.16.164
content-length: 0
x-consent: absent

GET
H2

200

restricted
mid.rkdms.com/ Frame A92B
Redirect Chain

https://mid.rkdms.com/bct?pid=8bc436aa-e0fc-4baa-9c9a-06fbeca87826&puid=33619390861099198522578824315854892490&_ct=img
https://mid.rkdms.com/restricted

0
0

107ms
107ms

Image
text/html

52.54.217.46
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mid.rkdms.com/restricted
Protocol: H2
Server: 52.54.217.46 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-54-217-46.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bitdefender.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Redirect headers

location: /restricted
date: Mon, 05 Sep 2022 19:11:29 GMT
server: nginx
content-length: 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: vc.hotjar.io
URL: https://vc.hotjar.io/sessions/37798?s=0.25&r=0.12078680751840021

Verdicts & Comments Add Verdict or Comment

122 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

43 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
recommender.scarabresearch.com/merchants/198DE47607F5EBDB	1969-12-31 23:59:59	Name: s Value: 4CD871178BC926A6
www.bitdefender.com/	1969-12-31 23:59:59	Name: tagit_session Value: 1
www.bitdefender.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 1o7itm7rt6p059iq4o8knvj6a5
.bitdefender.com/	1970-01-20 14:32:21	Name: bd112 Value: U1ICAA%3D%3D
.bitdefender.com/	1969-12-31 23:59:59	Name: at_check Value: true
.demdex.net/	1970-01-20 10:05:57	Name: demdex Value: 33619390861099198522578824315854892490
.bitdefender.com/	1969-12-31 23:59:59	Name: AMCVS_0E920C0F53DA9E9B0A490D45%40AdobeOrg Value: 1
www.bitdefender.com/	1970-01-20 05:56:49	Name: AWSALB Value: yKSJt47W82pLEnFdw9ZvJR/4goFZRTyh54I8DvfYKDls/mkJtLWhbCTSw0OraU0vRmhzyRUqsVeAyQf7JVGv7aGkO+RYjVvMm+m2j2YsNm8BKb4xL5O7RYAuh8rZ
www.bitdefender.com/	1970-01-20 05:56:49	Name: AWSALBCORS Value: yKSJt47W82pLEnFdw9ZvJR/4goFZRTyh54I8DvfYKDls/mkJtLWhbCTSw0OraU0vRmhzyRUqsVeAyQf7JVGv7aGkO+RYjVvMm+m2j2YsNm8BKb4xL5O7RYAuh8rZ
.everesttech.net/	1970-01-20 14:32:21	Name: everest_g_v2 Value: g_surferid~YxZJ4AAAAMMFTQN-
.bitdefender.com/	1970-01-20 15:22:45	Name: s_ecid Value: MCMID%7C33600745589040559792576253352563400461
.bitdefender.com/	1970-01-20 07:56:21	Name: _gcl_au Value: 1.1.592754599.1662405096
www.bitdefender.com/	1969-12-31 23:59:59	Name: tagit_params Value: %7B%22obj%22%3A%5B%5D%7D
.bitdefender.com/	1970-01-20 15:22:45	Name: mbox Value: session#29a31e33f6634f0882dbc26b3cbed7a9#1662406957\|PC#29a31e33f6634f0882dbc26b3cbed7a9.37_0#1725649897
.bitdefender.com/	1970-01-20 05:46:46	Name: s_dfa Value: bitdefenderproduction
www.bitdefender.com/	1969-12-31 23:59:59	Name: CartOrderStyle Value: nLWw45SpnHI=
.linkedin.com/	1970-01-20 06:29:57	Name: UserMatchHistory Value: AQLT_iAr39qgTgAAAYMPEJZWLysV2CKzVy3wf1yfXcBTGeXg8fM_vvFxep4IZf94OPbOtOltwdeUNg
.linkedin.com/	1970-01-20 06:29:57	Name: AnalyticsSyncHistory Value: AQJtvARHv7iwKwAAAYMPEJZWkQgqIVCpDhX9X7hs9rkABGeApKhYsDVOzKP4e9P3B7npB2UQk5iMDr55thfYAg
.ads.linkedin.com/	1969-12-31 23:59:59	Name: lang Value: v=2&lang=en-us
.linkedin.com/	1970-01-20 14:32:21	Name: bcookie Value: "v=2&90b3ced7-68d4-447c-83db-85fce44a34bb"
.linkedin.com/	1970-01-20 05:48:11	Name: lidc Value: "b=VGST06:s=V:r=V:a=V:p=V:g=2466:u=1:x=1:i=1662405088:t=1662491488:v=2:sig=AQGYp_77qiuy1fVQtG3NFDMcRPR4DhNj"
.dpm.demdex.net/	1970-01-20 10:05:57	Name: dpm Value: 33619390861099198522578824315854892490
.bitdefender.com/	1970-01-20 15:22:45	Name: AMCV_0E920C0F53DA9E9B0A490D45%40AdobeOrg Value: 1176715910%7CMCIDTS%7C19241%7CMCMID%7C33600745589040559792576253352563400461%7CMCAAMLH-1663009895%7C6%7CMCAAMB-1663009895%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1662412296s%7CNONE%7CMCAID%7CNONE%7CMCSYNCSOP%7C411-19248%7CvVersion%7C5.4.0
.linkedin.com/	1969-12-31 23:59:59	Name: lang Value: v=2&lang=de-de
.www.linkedin.com/	1970-01-20 14:32:21	Name: bscookie Value: "v=1&202209051911289ffa3fba-a09c-41c1-8c05-adcfe67b7637AQFzVRa02uusVha196tjZ68PC4BLAyfB"
.linkedin.com/	1970-01-20 10:05:57	Name: li_gc Value: MTswOzE2NjI0MDUwODg7MjswMjEyiyBQU1NNYsmU0c1eytntXOs7dsp9ZEM24teXa3zQaQ==
.bitdefender.com/	1969-12-31 23:59:59	Name: s_ips Value: 1200
.bitdefender.com/	1969-12-31 23:59:59	Name: s_ppv Value: blog%253Alabs%253Aantimalware-research%253Anew-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer%2C13%2C13%2C1200%2C1%2C7
.bitdefender.com/	1969-12-31 23:59:59	Name: s_cc Value: true
.bitdefender.com/	1970-01-20 14:32:21	Name: _hjSessionUser_37798 Value: eyJpZCI6IjBhNjVkODNiLTU5ZmYtNTgwNi1hMDYyLWFjMGJmOWZhZWQ1YSIsImNyZWF0ZWQiOjE2NjI0MDUwOTYxNDIsImV4aXN0aW5nIjpmYWxzZX0=
.bitdefender.com/	1970-01-20 05:46:46	Name: _hjFirstSeen Value: 1
www.bitdefender.com/	1970-01-20 05:46:45	Name: _hjIncludedInSessionSample Value: 1
.bitdefender.com/	1970-01-20 05:46:46	Name: _hjSession_37798 Value: eyJpZCI6IjY5MTliYTU2LTE3ZTgtNDg1Mi1iOGUzLWU0MjdkZDJiMTgxMiIsImNyZWF0ZWQiOjE2NjI0MDUwOTYzMDcsImluU2FtcGxlIjp0cnVlfQ==
www.bitdefender.com/	1970-01-20 05:46:45	Name: _hjIncludedInPageviewSample Value: 1
.bitdefender.com/	1970-01-20 05:46:46	Name: _hjAbsoluteSessionInProgress Value: 1
.bitdefender.com/	1970-01-20 08:10:45	Name: aam_uid Value: 33619390861099198522578824315854892490
recommender.scarabresearch.com/	1970-01-20 14:32:42	Name: cdv Value: 1408B7D1913397F3
.bitdefender.com/	1970-01-20 14:32:21	Name: scarab.visitor Value: %221408B7D1913397F3%22
.doubleclick.net/	1970-01-20 15:08:21	Name: IDE Value: AHWqTUkwHWdC3K-lnkCtpz6cmf0IxsVHyVgAjEwN6U-md2B7pz-ZPWT-Bj08xW9_
.bitdefender.com/	1969-12-31 23:59:59	Name: s_tp Value: 9361
.twitter.com/	1970-01-20 15:22:45	Name: personalization_id Value: "v1_CN//F25OAypo1tt+u1qZXw=="
.demdex.net/	1970-01-20 10:05:57	Name: dextp Value: 60-1-1662405096274\|771-1-1662405096380\|1123-1-1662405096481\|22052-1-1662405096605\|121998-1-1662405096707\|129099-1-1662405096807
.crwdcntrl.net/	1969-12-31 23:59:59	Name: _cc_cc Value: ctst

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	warning	URL: https://www.bitdefender.com/blog/labs/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/ Message: Mixed Content: The page at 'https://www.bitdefender.com/blog/labs/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/' was loaded over HTTPS, but requested an insecure element 'http://2.gravatar.com/avatar/5a88bf5f4370b9e81beffe2eec2fdfeb?s=512&d=mm&r=g'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	error	URL: https://www.bitdefender.com/blog/_nuxt/6a6d0e9.js(Line 1) Message: Refused to connect to 'https://vc.hotjar.io/sessions/37798?s=0.25&r=0.12078680751840021' because it violates the following Content Security Policy directive: "connect-src api.company-target.com .bitdefender.com geolocation-db.com dpm.demdex.net consent.cookiebot.com www.google.com .scarabresearch.com rs.fullstory.com googleads.g.doubleclick.net region1.google-analytics.com consentcdn.cookiebot.com region1.analytics.google.com .clarity.ms .doubleclick.net .hotjar.com .taboola.com 'self'".
network	error	URL: https://idsync.rlcdn.com/365868.gif?partner_uid=33619390861099198522578824315854892490 Message: Failed to load resource: the server responded with a status of 451 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header

Value

Content-Security-Policy

Strict-Transport-Security

max-age=15724800; includeSubDomains

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

2.gravatar.com
analytics.twitter.com
api.company-target.com
assets.adobedtm.com
bitdefender.demdex.net
blogapp.bitdefender.com
cdn.scarabresearch.com
cm.everesttech.net
cm.g.doubleclick.net
consent.cookiebot.com
consentcdn.cookiebot.com
dpm.demdex.net
edge.fullstory.com
fls.doubleclick.net
fonts.googleapis.com
fonts.gstatic.com
geolocation-db.com
googleads.g.doubleclick.net
idsync.rlcdn.com
in.hotjar.com
labs.bitdefender.com
mid.rkdms.com
ml314.com
px.ads.linkedin.com
px4.ads.linkedin.com
recommender.scarabresearch.com
rs.fullstory.com
script.hotjar.com
snap.licdn.com
sstats.bitdefender.com
starget.bitdefender.com
static.hotjar.com
static.scarabresearch.com
sync.crwdcntrl.net
tag.demandbase.com
vars.hotjar.com
vc.hotjar.io
webchannel-content-service.scarabresearch.com
www.bitdefender.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.linkedin.com
vc.hotjar.io
104.244.42.131
108.138.17.47
108.138.7.111
13.107.42.14
13.32.99.38
13.36.218.177
142.250.184.198
159.89.102.253
172.217.16.194
18.153.3.78
18.66.147.110
18.66.147.116
18.66.97.17
18.66.97.37
216.58.212.162
2606:4700::6812:a8de
2620:1ec:21::14
2a00:1450:4001:801::2003
2a00:1450:4001:801::2008
2a00:1450:4001:802::2004
2a00:1450:4001:80f::2003
2a00:1450:4001:810::2002
2a00:1450:400e:810::200a
2a02:26f0:10e:2b1::f09
2a02:26f0:3500:16::215:149b
2a02:26f0:3500:592::1e80
2a02:26f0:ea::215:ac21
2a04:fa87:fffe::c000:4902
34.111.234.236
34.117.30.199
34.248.32.199
34.249.157.182
34.251.71.171
35.186.194.58
35.201.112.186
35.244.174.68
52.19.103.22
52.208.60.7
52.54.217.46
63.34.154.154
04078c70085fe0cfa0fe98a25e33029189b753bacfa629aedee45c8b35b84b89
14efaaef6d7a177ecbe6afc0e91a4bb4ba2244c6d08b0370c5a16e3c9c09f462
15c7f04701cb2e957680e851e86c0d539aa67ac60e7bf19e2191553fabdcdf5c
1776651e4a3c9aeb0124d70ef86c2832dc6900251e7771124b482283256d710d
1789e6bf0f139fc89e73756237ae433989a6d27e7effe2d1771c06d2566f889b
1b29e095d88dda5c7f9640cdd33a81f7c1769f95fcd4bfb437761f9647edab85
1cd4fbab743c32df47d7a7dda0199e27862f8de538e8ec28d4b5dee15ff5cba0
2202c4d20285e4859ee85d4e0cb1ef2816bedfb127e6505cf97f790ebf388db0
26a71c9ecb4291f514ff1eb15363cf97bf01e62d2e518ec0c0a5cf2805fb6872
27fb8bc75fcbd15af1cb1e1ccf9ef291ff28758a8652f7a5ed7ad698cdcc7aed
28bc18ea6d845945c22e14516438b29acf7ede246d0e1a6fcee2ade2976b6294
2b71de573fd66d45ad8f771f4b288f8f0c6256efdf106d7d9b0e157cecd65e72
2f787511a2287aac4f97e8dfcc046c59a072d3ac320d031c89c256f62c204095
30477c3a3724f87a1a0999252ff6bf8417ed79da5a6e0cb462b1cc7b27318d7c
30c87d4f6df218f3afec83c03c08c8986c3c8400a2b14a10e81868b6af37b693
327819dae527134e53bbaa25f0c53b80017da2b541c22c0b3dcae0583e12d7f0
33f4a3188e5bd3946bc65cba66db7f0400a6c149acc208b4b46640af86858f61
35ca7dfd85eab7b4921cc95481ce31d0f845b54e69e59b1c147e18013fd89fc2
386f886c139b9773b5c3ae95fce3c5651066ea68050bbf8babea761f15d894d3
3c23eb02de6b34e30f18cfb7167abd81a2cedfd1da60dfcb71989517ab3fb431
3eca59020141cf3157cf996e32defb08752534e96a5f1e77897390999671360c
43e8590e9574c075959f307b06c6089707927b5222f8855adbcb28aabc286867
462a66acbf50e933685e7587e9f1441df8225b2bb4d6b7bc5e757eccf4ff6575
4858af0bdd1175d3f6c795eb053e7cae348ecb67f0633020d7d925c7672de871
4904f9e17645f3b0ad5eaee1896f35715c37653b82b1ae20fc4f65404b39d613
4ca35ab6756046c8b94ea3bde35009f35f981bbcb8fa3e8937c6dd956a36b3e1
4f29b4389a6e08bf3ffcdfb097597d5621b4abac31a74f89c3fa3537dc428e68
50da0a45caa286f3feaca26be0d29e6984161f2d16364d34fab40a3245ddc604
605049831ba52638b7350f4da9d915fd398308a243c027dfd13eb55f0b1b1556
627c537d7fadb4890a89a79768756a044f7e791cad37e597d051a0070a7e5469
632fa1f1f20105d9f666362923739a79a12300d4ca8ffe08a1db3dd86b884160
6b1ac3e3003fe173ea49a6e54e47d12396b690043bf6d811e65edb29d0d24df8
700c0dae509ca97b836fce880edd251968a0d64590a33cc50da6be52815110d6
7071e48557899623807c0311b9feeaf4ed1de74f96cdf54485ad5a9f31dac25c
738e5435f2d18427d291a0d6289eee0ebbc87b596d6003919f255760ac293104
75bbd9b3073784bd3c9f2ded5c0748c94a388a40ac96ebc8083b4c396caf3c91
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
83a4f7d376db994e499b627611104adbe197dc7a8e5d4d1069abad0840d5d368
84f58b182a30f21e0d86036cb5ef1c91614a726024caab8f2258f0a09dad7d7e
8dd32d43b590723c9c07d8e08774453ebcb16d13539a34426adae7016af4c783
90438997aa817bad94f49d367b04dbaaaa387493ef5a1f5b5d5f7b953b76c1ac
9219086b4f2c3bf77854b2e06ccd97ad32b9b7a140e65ff8b974a3bae6c7854c
95c6b9041f948cab2b50eec45c5a066f29747dda99e047d6946175d9e5c47728
98ccd33e523985efa588344a13932892db38b1335243f989dd366450db8ea68d
a211156b6a63a4e16019e1f3d1f5742b57ac3ff01e8c591e7d1407528aee9ec2
a274dd3d80e88c7b7ec742422f85305c89f63195842f6cb955b8da91335bd368
a7a706ea35bec3b8e407aa0d6c26219d8be48a646e4a2e6098193b83e2cbd347
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ad182c97d0c274d70865102ba8ede3e9312666f30471b43f3c7236b93b100f0c
aec03f6734668391ed99d7a5a8402667ea74b5031061ee9805a9b95a8a98f791
af760eef3e69c8edefe111eaec6df825c3dee6dad0dffb97459a56c3ab0391fa
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
b242dc131487657bc296b73be0c5326463d3eab45d089fb3d948f9ab1d45ff10
b57839788686bf37d29f47bbe45ad8258085e3aebf54650ab389c0b515b977e1
b722985700bda4dcc44ba79f755cd316db98f06edf3dc167d54d02df440205a6
bb67e83ddffecbe3b2c2f7ce7022cffa34968732c79dc8324b96c982220ededa
be06c55f906df7a2bd324a5b5e55c78e602128750fca18e095522ea6fd6fea3f
c02388453d6d0fe769cd91a291f07c00aad29e00713afaedb24488c007d68782
c20a6a38a4b63bbb198941b15d3f52bfdacfbad376eb01838947a852e8f498fe
c38bb954c382346bc43d67d9cc917180fe04be2bed4c19fc414e2a6e536bd599
c660fbb2eafabfce77b9c08b7203202a6f81dba21555196c56d1cbd433e75c4d
c72d06f598a03fc5ea94f19031891b97f4b4abb3a42fc94974cbe7ccd26dd6fd
c971fa7151c790b164705b95fca02fc3112602a7e993b135e3176def7449b84c
cfa51627f00b7afde3a3cf4f88166512a85c14027b0ac05c8904787c374493af
d47bcf54431b918d4b86953244677a675940b21844a2ac41bee9b690415eb0b1
d57c03d71db7c219088793c262275665f64bb36e69629115ff0542a54cbd8d32
d71abdf4ebc13e8d2ebefd8e7f206f80798d2adef5339898d5a511b555da978b
e21ba8342831d4df59a5686161e0954c7d34b33b6c64bd512bc4fb7a26608176
e32a6ae5e43f7f652674e0f03dc23f86839f839b29ee4e63c01c93da180bb0d0
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ec0e78ba3786d620f16943844c3da6aac1f029dc4ec6fb35456d019508679ff1
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f30008d74bc7aca6a5b6d527eec92f69db95ec852784a7ba3b430f9198769a35
f3c689523d23693d898b0fff66ef380027572e1896e28552f0e029a5626dd46b
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f6200e00f9bcf9a324c8c1a046c6bc624ebcaf1379faf13e4d76ae56ea0d1a11
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
f8036f862488949609441d342479cf8d1caa763af69afb598e3d3510b74bc993
fceba08a6bbdf2598e8f6d43e71b51854337da5f880c3fff252a25b9cd10b6ae
feeff1b73fc856bbaa909aecd74cd3918a41d2f0642b773831da45ad969317e9

www.bitdefender.com Open in urlscan Pro 2606:4700::6812:a8de Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

84 Requests

90 %HTTPS

33 %IPv6

27 Domains

44 Subdomains

36 IPs

5 Countries

1785 kBTransfer

4147 kBSize

43 Cookies

41 Outgoing links

Page URL History

Redirected requests

84 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 5 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.bitdefender.com Open in urlscan Pro
2606:4700::6812:a8de Public Scan

Screenshot
Live screenshot

Full Image

84
Requests

90 %
HTTPS

33 %
IPv6

27
Domains

44
Subdomains

36
IPs

5
Countries

1785 kB
Transfer

4147 kB
Size

43
Cookies

84 HTTP transactions
5 data transactions