www.malwarebytes.com Open in urlscan Pro
192.0.66.233  Public Scan

34 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 72

• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2594100&time=1732189028999&li_adsId=a7f2bbd9-7e66-446e-9594-f0ef652ed705&url=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fnews%2F2024%2F11%2Fhello-again-fakebat-popular-loader-returns-after-months-long-hiatus HTTP 302
• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2594100&time=1732189028999&li_adsId=a7f2bbd9-7e66-446e-9594-f0ef652ed705&url=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fnews%2F2024%2F11%2Fhello-again-fakebat-popular-loader-returns-after-months-long-hiatus&cookiesTest=true HTTP 302
• https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D2594100%26time%3D1732189028999%26li_adsId%3Da7f2bbd9-7e66-446e-9594-f0ef652ed705%26url%3Dhttps%253A%252F%252Fwww.malwarebytes.com%252Fblog%252Fnews%252F2024%252F11%252Fhello-again-fakebat-popular-loader-returns-after-months-long-hiatus%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2594100&time=1732189028999&li_adsId=a7f2bbd9-7e66-446e-9594-f0ef652ed705&url=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fnews%2F2024%2F11%2Fhello-again-fakebat-popular-loader-returns-after-months-long-hiatus&cookiesTest=true&liSync=true HTTP 302
• https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=2594100&time=1732189028999&li_adsId=a7f2bbd9-7e66-446e-9594-f0ef652ed705&url=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fnews%2F2024%2F11%2Fhello-again-fakebat-popular-loader-returns-after-months-long-hiatus&cookiesTest=true&liSync=true&e_ipv6=AQIXygoKYQBaPgAAAZNOgwPs6ZwuP0frAi5eDMlb_C1Q9bDBWycCJIxNQSGy8vkHWYNwCfdpNId3onO5miwvnwUE2kruROo

77 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
4 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request hello-again-fakebat-popular-loader-returns-after-months-long-hiatus Show response www.malwarebytes.com/blog/news/2024/11/	147 KB 34 KB	52ms 9ms	Document text/html	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://www.malwarebytes.com/blog/news/2024/11/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 5c2f818f085db9dfc3a2c0c7016e2fa05a75a7564ae18012308d67ea82646996 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options DENY Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Response headers accept-ranges bytes cache-control max-age=300, must-revalidate content-encoding br content-type text/html; charset=UTF-8 date Thu, 21 Nov 2024 11:37:07 GMT host-header a9130478a60e5f9135f765b23f26593b link <https://www.malwarebytes.com/wp-json/>; rel="https://api.w.org/" <https://www.malwarebytes.com/wp-json/wp/v2/posts/120552>; rel="alternate"; type="application/json" <https://www.malwarebytes.com/?p=120552>; rel=shortlink referrer-policy strict-origin-when-cross-origin server nginx strict-transport-security max-age=31536000 vary Accept-Encoding, Origin x-cache STALE x-content-type-options nosniff x-frame-options DENY x-rq jfk2 96 184 443
GET H2	200	RobotoSerif-Medium.00ec4109.woff www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/	125 KB 126 KB	13ms 10ms	Font application/font-woff	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/RobotoSerif-Medium.00ec4109.woff Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2024/11/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash bbf5ef817d938f8bbb1bada103e55f96170f62fe6cf7b54b4019071e7072ee15 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Origin https://www.malwarebytes.com Referer https://www.malwarebytes.com/blog/news/2024/11/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus Response headers strict-transport-security max-age=31536000 cache-control max-age=300, must-revalidate x-rq jfk2 96 184 443 etag "6687a8cb-1f5e4" access-control-allow-methods GET, HEAD accept-ranges bytes access-control-allow-origin * x-cache HIT content-length 128484 date Thu, 21 Nov 2024 11:37:07 GMT content-type application/font-woff last-modified Fri, 05 Jul 2024 08:03:23 GMT server nginx
GET H2	200	RobotoSerif-Medium.a8a104b1.woff2 www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/	172 KB 172 KB	13ms 10ms	Font application/font-woff2	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/RobotoSerif-Medium.a8a104b1.woff2 Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2024/11/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 71e7d96e0b15924a58f28b82f88627957a5ea25f7a23930c295186f3412cca2c Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Origin https://www.malwarebytes.com Referer https://www.malwarebytes.com/blog/news/2024/11/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus Response headers strict-transport-security max-age=31536000 cache-control max-age=300, must-revalidate x-rq jfk2 96 185 443 etag "6687a8cb-2afa7" access-control-allow-methods GET, HEAD accept-ranges bytes access-control-allow-origin * x-cache HIT content-length 176039 date Thu, 21 Nov 2024 11:37:07 GMT content-type application/font-woff2 last-modified Fri, 05 Jul 2024 08:03:23 GMT server nginx
GET H2	200	Roboto-Regular.b009a76a.woff2 www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/	15 KB 16 KB	13ms 11ms	Font application/font-woff2	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/Roboto-Regular.b009a76a.woff2 Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2024/11/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Origin https://www.malwarebytes.com Referer https://www.malwarebytes.com/blog/news/2024/11/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus Response headers strict-transport-security max-age=31536000 cache-control max-age=300, must-revalidate x-rq jfk2 96 185 443 etag "64e38fa8-3d80" access-control-allow-methods GET, HEAD accept-ranges bytes access-control-allow-origin * x-cache HIT content-length 15744 date Thu, 21 Nov 2024 11:37:08 GMT content-type application/font-woff2 last-modified Mon, 21 Aug 2023 16:24:08 GMT server nginx
GET H2	200	Roboto-Regular.f1e2a767.woff www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/	20 KB 20 KB	20ms 18ms	Font application/font-woff	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/Roboto-Regular.f1e2a767.woff Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2024/11/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash f2abf7fbabe298e5823d257e48f5dc2138c6d5e0c210066f76b0067e8eda194f Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Origin https://www.malwarebytes.com Referer https://www.malwarebytes.com/blog/news/2024/11/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus Response headers strict-transport-security max-age=31536000 cache-control max-age=300, must-revalidate x-rq jfk2 96 185 443 etag "64e38fa8-4f78" access-control-allow-methods GET, HEAD accept-ranges bytes access-control-allow-origin * x-cache HIT content-length 20344 date Thu, 21 Nov 2024 11:37:08 GMT content-type application/font-woff last-modified Mon, 21 Aug 2023 16:24:08 GMT server nginx
GET H2	200	Roboto-Bold.227c9319.woff2 www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/	15 KB 16 KB	22ms 20ms	Font application/font-woff2	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/Roboto-Bold.227c9319.woff2 Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2024/11/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Origin https://www.malwarebytes.com Referer https://www.malwarebytes.com/blog/news/2024/11/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus Response headers strict-transport-security max-age=31536000 cache-control max-age=300, must-revalidate x-rq jfk2 96 184 443 etag "64e38fa8-3df4" access-control-allow-methods GET, HEAD accept-ranges bytes access-control-allow-origin * x-cache HIT content-length 15860 date Thu, 21 Nov 2024 11:37:08 GMT content-type application/font-woff2 last-modified Mon, 21 Aug 2023 16:24:08 GMT server nginx
GET H2	200	Roboto-Bold.77ecb942.woff www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/	20 KB 20 KB	22ms 20ms	Font application/font-woff	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/Roboto-Bold.77ecb942.woff Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2024/11/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash e0fd57c0d9537d9c9884b6a8ad8c1823800d94dcfb6a2cc988780fe65a592fe6 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Origin https://www.malwarebytes.com Referer https://www.malwarebytes.com/blog/news/2024/11/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus Response headers strict-transport-security max-age=31536000 cache-control max-age=300, must-revalidate x-rq jfk2 96 185 443 etag "64e38fa8-4fb8" access-control-allow-methods GET, HEAD accept-ranges bytes access-control-allow-origin * x-cache HIT content-length 20408 date Thu, 21 Nov 2024 11:37:08 GMT content-type application/font-woff last-modified Mon, 21 Aug 2023 16:24:08 GMT server nginx
GET H2	200	Roboto-Black.2e8becfc.woff2 www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/	15 KB 16 KB	23ms 21ms	Font application/font-woff2	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/Roboto-Black.2e8becfc.woff2 Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2024/11/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 7e262106f82cc52663e403f5b73795bbeab9ca0630c33c03579354fbcd4fae1e Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Origin https://www.malwarebytes.com Referer https://www.malwarebytes.com/blog/news/2024/11/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus Response headers strict-transport-security max-age=31536000 cache-control max-age=300, must-revalidate x-rq jfk2 96 184 443 etag "64e38fa8-3d88" access-control-allow-methods GET, HEAD accept-ranges bytes access-control-allow-origin * x-cache HIT content-length 15752 date Thu, 21 Nov 2024 11:37:08 GMT content-type application/font-woff2 last-modified Mon, 21 Aug 2023 16:24:08 GMT server nginx
GET H2	200	Roboto-Black.f5677eb2.woff www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/	20 KB 20 KB	21ms 19ms	Font application/font-woff	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/Roboto-Black.f5677eb2.woff Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2024/11/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash f6537e32263e6c49bf59bd6e4952b6bf06c8f09152c5b016365fef70e35856cf Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Origin https://www.malwarebytes.com Referer https://www.malwarebytes.com/blog/news/2024/11/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus Response headers strict-transport-security max-age=31536000 cache-control max-age=300, must-revalidate x-rq jfk2 96 185 443 etag "64e38fa8-4fc8" access-control-allow-methods GET, HEAD accept-ranges bytes access-control-allow-origin * x-cache HIT content-length 20424 date Thu, 21 Nov 2024 11:37:08 GMT content-type application/font-woff last-modified Mon, 21 Aug 2023 16:24:08 GMT server nginx
GET H2	200	shape-challenger-2.307bef30.png www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/images/	10 KB 10 KB	16ms 11ms	Image image/png	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/images/shape-challenger-2.307bef30.png Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2024/11/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 9493ef8d4ffa2372bc105ae6ff98c9d169c465255578e5ddb4a8a48d56e453aa Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/blog/news/2024/11/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus Response headers strict-transport-security max-age=31536000 cache-control max-age=31536000 x-rq jfk2 96 184 443 etag "64f81e81-27b9" accept-ranges bytes x-cache HIT content-length 10169 date Thu, 21 Nov 2024 11:37:08 GMT content-type image/png last-modified Wed, 06 Sep 2023 06:38:57 GMT server nginx
GET H2	200	ajax-loader.6f9ac78c.gif www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/images/	19 KB 19 KB	17ms 12ms	Image image/gif	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/images/ajax-loader.6f9ac78c.gif Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2024/11/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 24ed9db3eb0d97ecf1f0832cbd30bd37744e0d2b520ccdad5af60f7a08a45b90 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/blog/news/2024/11/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus Response headers strict-transport-security max-age=31536000 cache-control max-age=31536000 x-rq jfk2 96 184 443 etag "64e38fa8-4aa6" accept-ranges bytes x-cache HIT content-length 19110 date Thu, 21 Nov 2024 11:37:08 GMT content-type image/gif last-modified Mon, 21 Aug 2023 16:24:08 GMT server nginx
GET H2	200	app-play.5ed26b30.png www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/images/	54 KB 54 KB	17ms 12ms	Image image/png	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/images/app-play.5ed26b30.png Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2024/11/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 1fc4302f08484cb4df0a32e6cf6ce58cc057de2eed9c645cfdabebef1d3306d1 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/blog/news/2024/11/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus Response headers strict-transport-security max-age=31536000 cache-control max-age=31536000 x-rq jfk2 96 184 443 etag "6687a8cb-d830" accept-ranges bytes x-cache HIT content-length 55344 date Thu, 21 Nov 2024 11:37:08 GMT content-type image/png last-modified Fri, 05 Jul 2024 08:03:23 GMT server nginx
GET H2	200	app-store.0d6e625d.png www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/images/	53 KB 53 KB	17ms 13ms	Image image/png	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/images/app-store.0d6e625d.png Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2024/11/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 837bb391f879a1edd4521ce965b614bb760c6a2eeacde80329a57631196bea73 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/blog/news/2024/11/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus Response headers strict-transport-security max-age=31536000 cache-control max-age=31536000 x-rq jfk2 96 184 443 etag "6687a8cb-d2eb" accept-ranges bytes x-cache HIT content-length 53995 date Thu, 21 Nov 2024 11:37:08 GMT content-type image/png last-modified Fri, 05 Jul 2024 08:03:23 GMT server nginx
GET H2	200	/ www.malwarebytes.com/_static/	163 KB 13 KB	11ms 9ms	Stylesheet text/css	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://www.malwarebytes.com/_static/??-eJyFjEEKwzAMBD9URzYUmkvoW1xXEQJHFpGC6e9r0ksPhd6WnZ2FrqE0cRQHrQexGBA2zzuhs1BX0ONRuUCxLxI+5bSxTANc4MdNR6rN4cnmp7zuYxBG+mdkVTB/VTQQ7GGtmU7nvi3plq5xjimmN80eRNc= Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2024/11/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 24c613a2bb6db3e4b670cd5ab76d56edd869f3472bc463d8e8431421deb324d3 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/blog/news/2024/11/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus Response headers strict-transport-security max-age=31536000 cache-control max-age=31536000 content-encoding br x-rq jfk2 96 184 443 accept-ranges bytes x-cache HIT date Thu, 21 Nov 2024 11:37:07 GMT content-type text/css;charset=utf-8 vary Accept-Encoding server nginx last-modified Thu, 25 Apr 2024 21:21:41 GMT
GET H2	200	/ www.malwarebytes.com/_static/	254 KB 47 KB	21ms 20ms	Stylesheet text/css	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://www.malwarebytes.com/_static/??-eJydzlEKwjAQBNALmS5tkXyJZ9mtqwayiWRWQm9veoT6OTBvGOqfsNXiWpz8raYg49y5qew+AgPqIPmm/CBhaHiONqYNuNBpK7m+/qNnVE7SuO00CB1vA3dFNZ0slWPnbrc5rsu8xPUaf4yHYHU= Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2024/11/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 9cd20ca16c66ea3c622a6d1d780003ec5473850894d6b43203c541d04128f08c Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/blog/news/2024/11/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus Response headers strict-transport-security max-age=31536000 cache-control max-age=31536000 content-encoding br x-rq jfk2 96 185 443 accept-ranges bytes x-cache HIT date Thu, 21 Nov 2024 11:37:08 GMT content-type text/css;charset=utf-8 vary Accept-Encoding server nginx last-modified Wed, 20 Nov 2024 18:29:17 GMT
GET H2	200	front-js.js Show response www.malwarebytes.com/wp-content/plugins/weglot/dist/	5 KB 2 KB	13ms 12ms	Script application/javascript	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://www.malwarebytes.com/wp-content/plugins/weglot/dist/front-js.js?m=1731353723g Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2024/11/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 0aa10e1d078fcba8a8c9c654650d01b1e9562fb419ca536ad23fcb960bad9b2b Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/blog/news/2024/11/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus Response headers strict-transport-security max-age=31536000 cache-control max-age=31536000 content-encoding br x-rq jfk2 96 185 443 etag W/"67325c7b-1244" accept-ranges bytes x-cache HIT date Thu, 21 Nov 2024 11:37:08 GMT content-type application/javascript last-modified Mon, 11 Nov 2024 19:35:23 GMT server nginx vary Accept-Encoding
GET H2	200	NEW-NavBug.svg www.malwarebytes.com/wp-content/uploads/sites/2/2023/04/	1 KB 850 B	16ms 15ms	Image image/svg+xml	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://www.malwarebytes.com/wp-content/uploads/sites/2/2023/04/NEW-NavBug.svg Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2024/11/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 5f114a7afff8759ea3f28a6af87355ab3fc278d4b93eaaf865b3fc3fd49b7575 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/blog/news/2024/11/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus Response headers strict-transport-security max-age=31536000 cache-control max-age=31536000 content-encoding br x-rq jfk2 98 228 443 etag W/"38f845bd119a0420" accept-ranges bytes x-cache HIT date Thu, 21 Nov 2024 11:37:08 GMT content-type image/svg+xml vary Accept-Encoding server nginx last-modified Tue, 24 Sep 2024 22:18:49 GMT
GET H2	200	product-menu-screen.webp www.malwarebytes.com/wp-content/uploads/sites/2/2023/09/	16 KB 16 KB	16ms 16ms	Image image/webp	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://www.malwarebytes.com/wp-content/uploads/sites/2/2023/09/product-menu-screen.webp?w=356 Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2024/11/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 2fc88556de1ebed9f55afb87d495d90d43f939a515f3afa5d59e953b8fc0ab20 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/blog/news/2024/11/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus Response headers strict-transport-security max-age=31536000 cache-control max-age=31536000 x-rq jfk2 98 226 443 etag "d6b8504167c61790" accept-ranges bytes, bytes x-cache HIT content-length 16616 date Thu, 21 Nov 2024 11:37:08 GMT content-type image/webp last-modified Fri, 08 Nov 2024 15:27:46 GMT server nginx vary Accept
GET H2	200	Malwarebytes_Labs_logo_Color-2.png www.malwarebytes.com/wp-content/uploads/sites/2/2023/07/	962 B 1 KB	17ms 13ms	Image image/webp	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://www.malwarebytes.com/wp-content/uploads/sites/2/2023/07/Malwarebytes_Labs_logo_Color-2.png?resize=150,19 Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2024/11/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash a163f2ca5ba23ca9f8e4a6c3d27665160a63fb7379e4504ca0b05cd676149afb Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/blog/news/2024/11/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus Response headers strict-transport-security max-age=31536000 cache-control max-age=31536000 x-rq jfk2 98 228 443 etag "5f0ecc25ac4fda74" accept-ranges bytes, bytes x-cache HIT content-length 962 date Thu, 21 Nov 2024 11:37:08 GMT content-type image/webp last-modified Fri, 08 Nov 2024 19:28:49 GMT server nginx vary Accept
GET H2	200	banner.jpg www.malwarebytes.com/wp-content/uploads/sites/2/2024/11/	36 KB 37 KB	15ms 14ms	Image image/webp	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://www.malwarebytes.com/wp-content/uploads/sites/2/2024/11/banner.jpg?resize=1536,758 Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2024/11/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 965450309cb45f59c8c8cba3642e0703996afed120119c5f720fb4ca3f1f5c9e Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/blog/news/2024/11/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus Response headers strict-transport-security max-age=31536000 cache-control max-age=31536000 x-rq jfk2 100 143 443 etag "1669efdb795cfef8" accept-ranges bytes, bytes x-cache HIT content-length 37236 date Thu, 21 Nov 2024 11:37:08 GMT content-type image/webp last-modified Fri, 08 Nov 2024 23:35:51 GMT server nginx vary Accept
GET H2	200	image_00e479.png www.malwarebytes.com/wp-content/uploads/sites/2/2024/11/	59 KB 59 KB	12ms 11ms	Image image/webp	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://www.malwarebytes.com/wp-content/uploads/sites/2/2024/11/image_00e479.png Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2024/11/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 56e590c8f6ce5062522dcc00979b82a19df2dc1f72c6ad084da9c1bfbe47c0bc Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/blog/news/2024/11/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus Response headers strict-transport-security max-age=31536000 cache-control max-age=31536000 x-rq jfk2 98 226 443 etag "16f909281cc857ba" accept-ranges bytes, bytes x-cache HIT content-length 60172 date Thu, 21 Nov 2024 11:37:08 GMT content-type image/webp last-modified Fri, 08 Nov 2024 23:35:51 GMT server nginx vary Accept
GET H2	200	image_b7f9c2.png www.malwarebytes.com/wp-content/uploads/sites/2/2024/11/	18 KB 18 KB	20ms 14ms	Image image/webp	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://www.malwarebytes.com/wp-content/uploads/sites/2/2024/11/image_b7f9c2.png Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2024/11/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash b3b9f8ae2c9fb920117f3737206d93ed23ac705a24344c7a355ae69d7bddf3e9 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/blog/news/2024/11/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus Response headers strict-transport-security max-age=31536000 cache-control max-age=31536000 x-rq jfk2 98 226 443 etag "5d314abed8887848" accept-ranges bytes, bytes x-cache HIT content-length 18450 date Thu, 21 Nov 2024 11:37:08 GMT content-type image/webp last-modified Sat, 09 Nov 2024 00:53:05 GMT server nginx vary Accept
GET H2	200	ThreatDown_Horizontal_Reverse-2-2.svg www.malwarebytes.com/wp-content/uploads/sites/2/2023/11/	28 KB 11 KB	18ms 14ms	Image image/svg+xml	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://www.malwarebytes.com/wp-content/uploads/sites/2/2023/11/ThreatDown_Horizontal_Reverse-2-2.svg?w=1024 Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2024/11/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 6eac02b1761c62ace94875848fb6cf12728c936a19384a7758b07be6c3b86446 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/blog/news/2024/11/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus Response headers strict-transport-security max-age=31536000 cache-control max-age=31536000 content-encoding br x-rq jfk2 98 226 443 etag W/"69fc36375b7bd7a5" accept-ranges bytes x-cache HIT date Thu, 21 Nov 2024 11:37:08 GMT content-type image/svg+xml vary Accept-Encoding server nginx last-modified Tue, 21 Nov 2023 01:13:30 GMT
GET H/1.1	200 OK	count.js Show response malwarebytesunpacked.disqus.com/	1 KB 2 KB	121ms 10ms	Script application/javascript	199.232.196.134 FASTLY
General Check archive.org Show headers Download Go to Full URL https://malwarebytesunpacked.disqus.com/count.js Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2024/11/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 199.232.196.134 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 3487ef2baf0c08ba660a8a143cdeb8ebeec961eea04bccd7c49096b4eb26b875 Security Headers Name Value Strict-Transport-Security max-age=300; includeSubdomains X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers Content-Encoding gzip ETag "6733965e-367" Age 294 X-Content-Type-Options nosniff X-Amz-Cf-Id rp7MyxMx4DaGg4vipKhW0a0UYkOazw1cKB9uP7Ccfqrk7diKnzYulA== Date Thu, 21 Nov 2024 11:37:08 GMT Content-Type application/javascript; charset=utf-8 Last-Modified Tue, 12 Nov 2024 17:54:38 GMT Vary Accept-Encoding Strict-Transport-Security max-age=300; includeSubdomains Link <https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect Cache-Control public, max-age=300 Connection keep-alive Cross-Origin-Resource-Policy cross-origin Content-Length 871 X-XSS-Protection 1; mode=block X-Amz-Cf-Pop DFW56-P9 Server nginx
GET H2	200	jquery.min.js Show response www.malwarebytes.com/wp-includes/js/jquery/	86 KB 31 KB	16ms 11ms	Script application/javascript	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://www.malwarebytes.com/wp-includes/js/jquery/jquery.min.js?ver=1.0 Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2024/11/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/blog/news/2024/11/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus Response headers strict-transport-security max-age=31536000 cache-control max-age=31536000 content-encoding br x-rq jfk2 96 184 443 etag W/"6733be6b-15601" accept-ranges bytes x-cache HIT date Thu, 21 Nov 2024 11:37:08 GMT content-type application/javascript last-modified Tue, 12 Nov 2024 20:45:31 GMT server nginx vary Accept-Encoding
GET H2	200	/ Show response www.malwarebytes.com/_static/	80 KB 25 KB	17ms 14ms	Script application/javascript	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://www.malwarebytes.com/_static/??-eJyVjEsOwjAMBS9Ea7WiZYU4SxKs4Mhxo9pRVE5PBBvEjuW8z0ArQ9jEUAwK10iiEHEzt0c0ktgKlOqZAqSvYvhkY9IT/CPIJKDIGIyeOHb6NdgDM/ad4+Z29Id1cKpoCr4S33vzPt3ydbrM6zLNy3pOL1lJSdI= Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2024/11/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 83ec965817cc644f3583df6524a72f6632f3ed0ecb311cf9eca63a2f440e5a77 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/blog/news/2024/11/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus Response headers strict-transport-security max-age=31536000 cache-control max-age=31536000 content-encoding br x-rq jfk2 96 184 443 accept-ranges bytes x-cache HIT date Thu, 21 Nov 2024 11:37:08 GMT content-type application/javascript vary Accept-Encoding server nginx last-modified Mon, 16 Sep 2024 18:49:24 GMT
GET H2	200	main-vwo-personalization-threatdown.js Show response www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/	698 B 662 B	20ms 16ms	Script application/javascript	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/main-vwo-personalization-threatdown.js?ver=1.4 Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2024/11/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 2e7a03672c8aee8a48a7b996bcbb820055e4ebffe37f197849e801dc2660d8c8 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/blog/news/2024/11/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus Response headers strict-transport-security max-age=31536000 cache-control max-age=31536000 content-encoding br x-rq jfk2 96 184 443 etag W/"673c8b3a-2ba" accept-ranges bytes x-cache HIT date Thu, 21 Nov 2024 11:37:08 GMT content-type application/javascript last-modified Tue, 19 Nov 2024 12:57:30 GMT server nginx vary Accept-Encoding
GET H2	200	/ Show response www.malwarebytes.com/_static/	2 KB 1 KB	20ms 17ms	Script application/javascript	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://www.malwarebytes.com/_static/??-eJyVjMENwjAMABcimApVEQ/ELG5qitPErmJXFUxPVujzpLuDYwtJxUkc/EOVDCqWAxtNX++AZuQG1hJkA0paK7VEsDsXdu5GUl2ZrtkucOq1UTMVLPxDZ5WutpWcZQkJ64a8iJ2YTjuXGd6NKMx6SFGce/2qzyHeb3EY42PMfzNSWUY= Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2024/11/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash a52f68095f3d06ee602c5137a535b020173e2c63f76e9d39c7a36c50e022f680 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/blog/news/2024/11/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus Response headers strict-transport-security max-age=31536000 cache-control max-age=31536000 content-encoding br x-rq jfk2 96 184 443 accept-ranges bytes x-cache HIT date Thu, 21 Nov 2024 11:37:08 GMT content-type application/javascript vary Accept-Encoding server nginx last-modified Mon, 04 Nov 2024 10:23:15 GMT
GET H2	200	e-202447.js Show response stats.wp.com/	7 KB 3 KB	51ms 8ms	Script application/javascript	192.0.76.3 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://stats.wp.com/e-202447.js Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2024/11/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 5badd609a51ede5bab5b89534fc3011a4dd1ab487cc7081d7cf38479bcbab855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers cache-control max-age=31536000 content-encoding br x-nc HIT jfk etag W/14421-1717166113344.7605 x-minify t x-minify-cache hit access-control-allow-methods GET, HEAD expires Mon, 17 Nov 2025 17:27:40 GMT access-control-allow-origin * alt-svc h3=":443"; ma=86400 date Thu, 21 Nov 2024 11:37:08 GMT content-type application/javascript vary Accept-Encoding server nginx
GET H2	200	gtm.js Show response www.googletagmanager.com/	494 KB 149 KB	66ms 26ms	Script application/javascript	2607:f8b0:4004:c17::61 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-MKSKW3 Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2024/11/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4004:c17::61 Washington, United States, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash d6a0f172460836361209bb1dde19a7af6be8b4ff43f686916d580474eef44f19 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers content-encoding br report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1080:0"}],} expires Thu, 21 Nov 2024 11:37:08 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Thu, 21 Nov 2024 11:37:08 GMT content-type application/javascript; charset=UTF-8 vary Accept-Encoding last-modified Thu, 21 Nov 2024 09:00:00 GMT access-control-allow-headers Cache-Control strict-transport-security max-age=31536000; includeSubDomains cache-control private, max-age=900 cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1080:0 access-control-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 151742 x-xss-protection 0 server Google Tag Manager
GET H2	200	script.js Show response plausible.io/js/	1 KB 1 KB	148ms 38ms	Script application/javascript	2400:52e0:1a00::1206:2 BunnyCDN BUNNYWAY
General Check archive.org Show headers Download Go to Full URL https://plausible.io/js/script.js Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2024/11/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2400:52e0:1a00::1206:2 Chicago, United States, ASN200325 (BunnyCDN BUNNYWAY, informacijske storitve d.o.o., SI), Reverse DNS Software BunnyCDN-IL1-1206 / Resource Hash e3409ac09af396e35fd67c5e024386d36c52138b7541e6a4644c31a94a2d33a4 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers cdn-status 200 content-encoding br x-content-type-options nosniff date Thu, 21 Nov 2024 11:37:08 GMT content-type application/javascript vary Accept-Encoding cdn-cachedat 11/20/2024 14:46:51 cdn-cache HIT cdn-requestpullcode 200 cache-control public, must-revalidate, max-age=86400 cdn-requestpullsuccess True cdn-requesttime 0 cdn-uid 153cb5b1-399a-48ef-b5bf-098c03770254 cdn-requestid 7bca94a1de0eac4d9b5651d0bb50fa27 cross-origin-resource-policy cross-origin cdn-pullzone 682664 cdn-proxyver 1.06 application 127.0.0.1 permissions-policy interest-cohort=() access-control-allow-origin * cdn-edgestorageid 1029 server BunnyCDN-IL1-1206 cdn-requestcountrycode US
GET H/1.1	200 OK	embed.js Show response malwarebytesunpacked.disqus.com/	80 KB 26 KB	119ms 10ms	Script application/javascript	199.232.196.134 FASTLY
General Check archive.org Show headers Download Go to Full URL https://malwarebytesunpacked.disqus.com/embed.js Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2024/11/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 199.232.196.134 , United States, ASN54113 (FASTLY, US), Reverse DNS Software openresty / Resource Hash 61e8adf2e2b38300a6576a9f3b972140a985e234d2a835d912deb24e8ed2e30e Security Headers Name Value Strict-Transport-Security max-age=300; includeSubdomains Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers Strict-Transport-Security max-age=300; includeSubdomains Link <https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect Cache-Control private, max-age=60 x-service router content-encoding gzip Age 69 Connection keep-alive Cross-Origin-Resource-Policy cross-origin Content-Length 26328 Date Thu, 21 Nov 2024 11:37:08 GMT content-type application/javascript; charset=utf-8 Vary Accept-Encoding server openresty
POST H3	200	pageviews Show response api.weglot.com/	2 B 2 KB	236ms 176ms	XHR application/json	2606:4700:4400::ac40:9572 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://api.weglot.com/pageviews?api_key=wg_ab7feeaf115f3476db3eec82a65b414c4 Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2024/11/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:4400::ac40:9572 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945 Security Headers Name Value Content-Security-Policy default-src 'self' *.weglot.com; base-uri 'self'; connect-src 'self' *; font-src 'self' cdn.jsdelivr.net https://fonts.gstatic.com data:; form-action 'self' *.weglot.com api.workos.com error.workos.com announcekit.app https://accounts.google.com https://login.microsoftonline.com https://pi.zebra.com https://*.okta.com https://*.jumpcloud.com; frame-src 'self' *.weglot.io announcekit.app code.gist.build renderer.gist.build https://www.google.com https://js.stripe.com https://app.goentri.com https://www.youtube.com https://www.youtube-nocookie.com https://td.doubleclick.net https://js.refiner.io blob: https://weglot.nolt.io; img-src 'self' * data: blob:; object-src 'none'; media-src 'self' blob:; script-src 'nonce-f6527466becfa7e3f757c7fd1c2d4fb8' 'strict-dynamic'; style-src 'self' 'unsafe-inline' *.weglot.com https://app.productfruits.com; worker-src 'self' blob:; block-all-mixed-content;report-uri https://csp-report.browser-intake-datadoghq.com/api/v2/logs?dd-api-key=pub3bd6aeebbc69014092e8cc554aa628f3&dd-evp-origin=content-security-policy&ddsource=csp-report&ddtags=env:prod;frame-ancestors 'none'; Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Content-Type text/plain;charset=UTF-8 Referer https://www.malwarebytes.com/ Response headers content-encoding gzip cf-cache-status DYNAMIC access-control-allow-methods GET,POST,PUT,PATCH,DELETE x-content-type-options nosniff expires Thu, 21 Nov 2024 11:37:08 GMT alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Thu, 21 Nov 2024 11:37:08 GMT content-type application/json priority u=1,i x-frame-options SAMEORIGIN access-control-allow-headers Content-Type, Weglot-Source, Authorization strict-transport-security max-age=31536000; includeSubDomains; preload content-security-policy default-src 'self' *.weglot.com; base-uri 'self'; connect-src 'self' *; font-src 'self' cdn.jsdelivr.net https://fonts.gstatic.com data:; form-action 'self' *.weglot.com api.workos.com error.workos.com announcekit.app https://accounts.google.com https://login.microsoftonline.com https://pi.zebra.com https://*.okta.com https://*.jumpcloud.com; frame-src 'self' *.weglot.io announcekit.app code.gist.build renderer.gist.build https://www.google.com https://js.stripe.com https://app.goentri.com https://www.youtube.com https://www.youtube-nocookie.com https://td.doubleclick.net https://js.refiner.io blob: https://weglot.nolt.io; img-src 'self' * data: blob:; object-src 'none'; media-src 'self' blob:; script-src 'nonce-f6527466becfa7e3f757c7fd1c2d4fb8' 'strict-dynamic'; style-src 'self' 'unsafe-inline' *.weglot.com https://app.productfruits.com; worker-src 'self' blob:; block-all-mixed-content;report-uri https://csp-report.browser-intake-datadoghq.com/api/v2/logs?dd-api-key=pub3bd6aeebbc69014092e8cc554aa628f3&dd-evp-origin=content-security-policy&ddsource=csp-report&ddtags=env:prod;frame-ancestors 'none'; cache-control max-age=0, must-revalidate, no-store, private referrer-policy strict-origin-when-cross-origin cf-ray 8e6062d1bd4c5e7f-EWR permissions-policy accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), fullscreen=(self), geolocation=(), gyroscope=(self), magnetometer=(), microphone=(), midi=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), usb=(), xr-spatial-tracking=(), clipboard-read=(self), clipboard-write=(self), hid=(), idle-detection=(), serial=() access-control-allow-origin * x-xss-protection 1; mode=block server cloudflare
GET DATA	200 OK	truncated /	577 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash b556aa0c99a333220bef9718a277f81139f356534c0c707430252f445f769b8b Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	436 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 242aa88120783594cb0c56ff247407db601e2a09c4f598f7c7d40b9b2ba6369e Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	1 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 63ccbd40f783b34fe6bc9ef9e971de08e32012b91ee81dd54b325ecf527c1dac Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	1 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash c2bf4235c36480dd023ae5a3161be4b1d3c5f4728c753788d43530cece558812 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer Response headers Content-Type image/svg+xml
GET H2	200	8ff7688dd7aaf66effb89c65203ee7c3 secure.gravatar.com/avatar/	10 KB 10 KB	50ms 9ms	Image image/jpeg	2a04:fa87:fffe::c000:4902 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://secure.gravatar.com/avatar/8ff7688dd7aaf66effb89c65203ee7c3?size=300 Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2024/11/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 4ca7509272fd378d23ad6d1c7f7bfce000ae1569832b6347b8bce568816ed159 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers link <https://gravatar.com/avatar/8ff7688dd7aaf66effb89c65203ee7c3?size=300>; rel="canonical" cache-control max-age=300 x-nc HIT jfk 1 expires Thu, 21 Nov 2024 11:42:08 GMT accept-ranges bytes access-control-allow-origin * alt-svc h3=":443"; ma=86400 content-length 10272 date Thu, 21 Nov 2024 11:37:08 GMT content-type image/jpeg last-modified Thu, 19 Nov 2020 20:30:53 GMT server nginx content-disposition inline; filename="8ff7688dd7aaf66effb89c65203ee7c3.jpg"
GET H2	200	locate Show response genesis.malwarebytes.com/api/v1/	402 B 584 B	110ms 21ms	XHR application/json	34.194.223.35 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://genesis.malwarebytes.com/api/v1/locate Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/_static/??-eJyVjEsOwjAMBS9Ea7WiZYU4SxKs4Mhxo9pRVE5PBBvEjuW8z0ArQ9jEUAwK10iiEHEzt0c0ktgKlOqZAqSvYvhkY9IT/CPIJKDIGIyeOHb6NdgDM/ad4+Z29Id1cKpoCr4S33vzPt3ydbrM6zLNy3pOL1lJSdI= Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.194.223.35 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-194-223-35.compute-1.amazonaws.com Software / Resource Hash 17c2e860749d4bac5468f819d0038d568de1bab55c8e400d750f5a027ae20c04 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers access-control-allow-origin https://www.malwarebytes.com content-length 402 date Thu, 21 Nov 2024 11:37:08 GMT content-type application/json vary Origin, Access-Control-Request-Method, Access-Control-Request-Headers
GET H2	200	g.gif pixel.wp.com/	50 B 177 B	28ms 8ms	Image image/gif	192.0.76.3 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://pixel.wp.com/g.gif?v=ext&blog=227197325&post=120552&tz=-8&srv=www.malwarebytes.com&hp=vip&j=1%3A13.9.1&host=www.malwarebytes.com&ref=&fcp=0&rand=0.2236810206644 Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2024/11/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers cache-control no-cache access-control-allow-origin * content-length 50 alt-svc h3=":443"; ma=86400 date Thu, 21 Nov 2024 11:37:08 GMT content-type image/gif server nginx
GET H/1.1	200 OK	count-data.js Show response malwarebytesunpacked.disqus.com/	355 B 938 B	11ms 11ms	Script application/javascript	199.232.196.134 FASTLY
General Check archive.org Show headers Download Go to Full URL https://malwarebytesunpacked.disqus.com/count-data.js?1=121722&1=122044&1=122253&1=122457&1=122561 Requested by Host: malwarebytesunpacked.disqus.com URL: https://malwarebytesunpacked.disqus.com/count.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 199.232.196.134 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 96b17194f0e1eb0580795d1096a397247ec290082d2e0d3b0c19f1e540b4c9fa Security Headers Name Value Strict-Transport-Security max-age=300; includeSubdomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers Strict-Transport-Security max-age=300; includeSubdomains Link <https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect Cache-Control public, max-age=600 Age 437 Connection keep-alive Cross-Origin-Resource-Policy cross-origin X-Content-Type-Options nosniff Content-Length 355 p3p CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM" X-XSS-Protection 1; mode=block Date Thu, 21 Nov 2024 11:37:08 GMT Content-Type application/javascript; charset=UTF-8 Vary Accept-Encoding Server nginx X-Frame-Options SAMEORIGIN
GET H2	200	otSDKStub.js Show response cdn.cookielaw.org/scripttemplates/	22 KB 8 KB	48ms 23ms	Script application/javascript	2606:4700::6812:562a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/otSDKStub.js Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2024/11/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ade920fd5b00cd298aae7978673a9a64d0bb3fa593d23e91994ec6b6723ebace Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers content-md5 Vo/d0f3ZefkwyML/PnJnjg== access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding content-encoding gzip x-ms-version 2009-09-19 etag 0x8DD091F6A7F5A59 x-ms-lease-status unlocked cf-cache-status HIT age 867 x-content-type-options nosniff date Thu, 21 Nov 2024 11:37:08 GMT content-type application/javascript last-modified Wed, 20 Nov 2024 04:54:29 GMT vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control max-age=86400 cross-origin-resource-policy cross-origin x-ms-request-id 2c1c45b3-c01e-00dd-5a1f-3bc024000000 cf-ray 8e6062d388ab7ce2-EWR accept-ranges bytes access-control-allow-origin * content-length 7212 x-ms-blob-type BlockBlob server cloudflare
POST H2	202	event Show response plausible.io/api/	2 B 492 B	188ms 136ms	XHR text/plain	2400:52e0:1a00::1206:2 BunnyCDN BUNNYWAY
General Check archive.org Show headers Download Go to Full URL https://plausible.io/api/event Requested by Host: plausible.io URL: https://plausible.io/js/script.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2400:52e0:1a00::1206:2 Chicago, United States, ASN200325 (BunnyCDN BUNNYWAY, informacijske storitve d.o.o., SI), Reverse DNS Software BunnyCDN-IL1-1206 / Resource Hash 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Content-Type text/plain Referer https://www.malwarebytes.com/ Response headers x-request-id GAn4vnB_lFJsxzQAQuic date Thu, 21 Nov 2024 11:37:08 GMT content-type text/plain; charset=utf-8 cdn-cachedat 11/21/2024 11:37:08 cdn-requestpullcode 202 cache-control must-revalidate, max-age=0, private cdn-requestpullsuccess True cdn-requesttime 0 cdn-uid 153cb5b1-399a-48ef-b5bf-098c03770254 cdn-requestid 49e0296ca5a062b7875568ae927b9b80 access-control-allow-credentials true cdn-pullzone 682664 cdn-proxyver 1.06 application 127.0.0.1 permissions-policy interest-cohort=() access-control-allow-origin * content-length 2 cdn-edgestorageid 1206 server BunnyCDN-IL1-1206 cdn-requestcountrycode US
GET H2	200	82971089-2677-4e1e-8fab-44444f76330b.json Show response cdn.cookielaw.org/consent/82971089-2677-4e1e-8fab-44444f76330b/	7 KB 3 KB	52ms 32ms	XHR application/json	2606:4700::6812:562a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/consent/82971089-2677-4e1e-8fab-44444f76330b/82971089-2677-4e1e-8fab-44444f76330b.json Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e1076e28bf1095b534cec675b71f48f79e71571b0d1e0b6299bfc1598a16b8b3 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers content-md5 LOjydsZgVdt5i4x1RnXibg== access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding content-encoding gzip cf-cache-status HIT etag 0x8DC420742BB00AF age 56987 x-ms-lease-status unlocked x-content-type-options nosniff x-ms-version 2009-09-19 expires Fri, 22 Nov 2024 11:37:08 GMT date Thu, 21 Nov 2024 11:37:08 GMT content-type application/json last-modified Mon, 11 Mar 2024 20:10:13 GMT vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=86400 cross-origin-resource-policy cross-origin, cross-origin x-ms-request-id a522fa5c-101e-0018-144c-26be1f000000 cf-ray 8e6062d3dfc44277-EWR accept-ranges bytes access-control-allow-origin * content-length 1953 x-ms-blob-type BlockBlob server cloudflare
GET H2	200	cropped-favicon-512x512-1-1.png www.malwarebytes.com/wp-content/uploads/sites/2/2023/08/	562 B 809 B	10ms 9ms	Other image/webp	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://www.malwarebytes.com/wp-content/uploads/sites/2/2023/08/cropped-favicon-512x512-1-1.png?w=32 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 6d1f878259463317e1c90fea81b4f5d842248e14d3b23fb19dc54cf62f5e7eac Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/blog/news/2024/11/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus Response headers strict-transport-security max-age=31536000 cache-control max-age=31536000 x-rq jfk2 98 228 443 etag "d568c198ab421e1d" accept-ranges bytes, bytes x-cache HIT content-length 562 date Thu, 21 Nov 2024 11:37:08 GMT content-type image/webp last-modified Fri, 08 Nov 2024 16:28:33 GMT server nginx vary Accept
GET H/1.1	200 OK	/ disqus.com/embed/comments/ Frame 1622	0 0	66ms 28ms	Document text/html	151.101.0.134 FASTLY
General Check archive.org Show headers Download Go to Full URL https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=120552&t_u=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fcybercrime%2F2024%2F11%2Fhello-again-fakebat-popular-loader-returns-after-months-long-hiatus&t_d=Hello%20again%2C%20FakeBat%3A%20popular%20loader%20returns%20after%20months-long%20hiatus&t_t=Hello%20again%2C%20FakeBat%3A%20popular%20loader%20returns%20after%20months-long%20hiatus&s_o=default Requested by Host: malwarebytesunpacked.disqus.com URL: https://malwarebytesunpacked.disqus.com/embed.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 151.101.0.134 San Francisco, United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash Security Headers Name Value Content-Security-Policy script-src https://*.twitter.com:* https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://*.services.disqus.com:* https://cdn.boomtrain.com/p13n/ https://com-disqus.netmng.com:* 'unsafe-inline' https://referrer.disqus.com/juggler/ https://connect.facebook.net/en_US/sdk.js https://cdn.syndication.twimg.com/tweets.json https://apis.google.com https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com Strict-Transport-Security max-age=300; includeSubdomains X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://www.malwarebytes.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Response headers Age 0 Cache-Control stale-if-error=3600, s-stalewhilerevalidate=3600, stale-while-revalidate=30, no-cache, must-revalidate, public, s-maxage=5 Connection keep-alive Content-Encoding gzip Content-Length 4296 Content-Security-Policy script-src https://*.twitter.com:* https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://*.services.disqus.com:* https://cdn.boomtrain.com/p13n/ https://com-disqus.netmng.com:* 'unsafe-inline' https://referrer.disqus.com/juggler/ https://connect.facebook.net/en_US/sdk.js https://cdn.syndication.twimg.com/tweets.json https://apis.google.com https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com Content-Type text/html; charset=utf-8 Cross-Origin-Resource-Policy cross-origin Date Thu, 21 Nov 2024 11:37:08 GMT ETag W/"lounge:view:10372351174.3559995c7dfc20c33b92551cd5655727.2" Last-Modified Tue, 19 Nov 2024 07:21:31 GMT Link <https://c.disquscdn.com>;rel=preconnect,<https://c.disquscdn.com>;rel=dns-prefetch Referrer-Policy no-referrer-when-downgrade Server nginx Strict-Transport-Security max-age=300; includeSubdomains Timing-Allow-Origin * Vary Accept-Encoding X-Content-Type-Options nosniff X-XSS-Protection 1; mode=block p3p CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
GET H2	200	location Show response geolocation.onetrust.com/cookieconsentpub/v1/geo/	69 B 314 B	56ms 30ms	XHR application/json	2606:4700:4400::ac40:9b77 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::ac40:9b77 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 59e58524340cd7ad353be010374b124c242fdde10a0ed41047fe2fd4bb9e5a2e Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 accept application/json Referer https://www.malwarebytes.com/ Response headers strict-transport-security max-age=31536000; includeSubDomains; preload content-encoding gzip access-control-allow-methods GET, OPTIONS cf-ray 8e6062d438205e71-EWR access-control-allow-origin * date Thu, 21 Nov 2024 11:37:08 GMT content-type application/json vary Accept-Encoding server cloudflare access-control-allow-headers Content-Type
GET H2	200	otBannerSdk.js Show response cdn.cookielaw.org/scripttemplates/202402.1.0/	430 KB 105 KB	23ms 23ms	Script application/javascript	2606:4700::6812:562a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/202402.1.0/otBannerSdk.js Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 89cf762e0c3023dff4e6d43e6a79cd5ec928ce592d022d6f3d97a8972800b475 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers content-md5 XwXx/WxMZ+UJJ5CmkZRGfQ== access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding x-ms-lease-status unlocked cf-bgj minify cf-cache-status HIT x-ms-version 2009-09-19 age 18077 content-encoding gzip x-content-type-options nosniff cf-polished origSize=440693 date Thu, 21 Nov 2024 11:37:08 GMT content-type application/javascript last-modified Tue, 16 Jul 2024 21:32:03 GMT vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control max-age=86400 cross-origin-resource-policy cross-origin x-ms-request-id 0dcfd11e-c01e-00b0-107e-256a0a000000 cf-ray 8e6062d469997ce2-EWR access-control-allow-origin * x-ms-blob-type BlockBlob server cloudflare
GET H2	200	en.json Show response cdn.cookielaw.org/consent/82971089-2677-4e1e-8fab-44444f76330b/018e2f1e-12b2-7a41-ab63-6c6e010fa4d9/	108 KB 26 KB	34ms 34ms	Fetch application/json	2606:4700::6812:562a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/consent/82971089-2677-4e1e-8fab-44444f76330b/018e2f1e-12b2-7a41-ab63-6c6e010fa4d9/en.json Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/202402.1.0/otBannerSdk.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c8bd9aa9a411bd3248cea9f41fa191e5b57a31528dbb92663fb5191375938bcd Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers content-md5 BhZPJjb/noHRZ0epWvH2Fw== access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding content-encoding gzip cf-cache-status HIT etag 0x8DC420751763AC1 age 56925 x-ms-lease-status unlocked x-content-type-options nosniff x-ms-version 2009-09-19 expires Fri, 22 Nov 2024 11:37:08 GMT date Thu, 21 Nov 2024 11:37:08 GMT content-type application/json last-modified Mon, 11 Mar 2024 20:10:37 GMT vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=86400 cross-origin-resource-policy cross-origin, cross-origin x-ms-request-id 559d7544-d01e-00a4-694c-26a96e000000 cf-ray 8e6062d4b8884277-EWR accept-ranges bytes access-control-allow-origin * content-length 26286 x-ms-blob-type BlockBlob server cloudflare
POST H3	200	collect www.google.com/ccm/	0 0	88ms 30ms	Ping text/plain	2607:f8b0:4004:c1d::68 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google.com/ccm/collect?en=page_view&dl=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fnews%2F2024%2F11%2Fhello-again-fakebat-popular-loader-returns-after-months-long-hiatus&scrsrc=www.googletagmanager.com&frm=0&rnd=335461708.1732189029&auid=680732602.1732189029&npa=0&gtm=45He4bk0v6688972za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101925629~102067555~102067808~102077855~102081485&tft=1732189028654&tfd=722&apve=1 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKSKW3 Protocol H3 Security QUIC, , AES_128_GCM Server 2607:f8b0:4004:c1d::68 Washington, United States, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers
GET H2	200	js Show response www.googletagmanager.com/gtag/	447 KB 134 KB	27ms 26ms	Script application/javascript	2607:f8b0:4004:c17::61 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=G-K8KCHE3KSC&l=dataLayer&cx=c&gtm=45He4bk0v6688972za200 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKSKW3 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4004:c17::61 Washington, United States, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash e82d730ddceabdc6b548da2904f990d7e12f169336d3ab2d6f192866b1331513 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers content-encoding br report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],} expires Thu, 21 Nov 2024 11:37:08 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Thu, 21 Nov 2024 11:37:08 GMT content-type application/javascript; charset=UTF-8 vary Accept-Encoding access-control-allow-headers Cache-Control strict-transport-security max-age=31536000; includeSubDomains cache-control private, max-age=900 cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0 access-control-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 136987 x-xss-protection 0 server Google Tag Manager
GET H2	200	malwarebytes.min.js Show response d2jjzw81hqbuqv.cloudfront.net/integration/clients/	48 KB 12 KB	105ms 13ms	Script text/javascript	18.173.132.110 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://d2jjzw81hqbuqv.cloudfront.net/integration/clients/malwarebytes.min.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKSKW3 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.173.132.110 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-173-132-110.jfk52.r.cloudfront.net Software AmazonS3 / Resource Hash e44e740635442c99d55516956fc64d2542492662f5d7e42abb55bc2ec9ae63ef Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers vary accept-encoding, Origin cache-control max-age=600, public content-encoding gzip etag W/"aa50a2049147a8799abe326b8113b55f" age 350 via 1.1 91ac4dab8fb53750ccb2571903bd2844.cloudfront.net (CloudFront) expires Wed, 13 Nov 2024 15:21:39 GMT x-cache Hit from cloudfront x-amz-cf-id vFy7OG8KSD9Knh4mmuVIGjtw6rU6WgOwHPwaQQI0j3r2I8pueVJktA== date Thu, 21 Nov 2024 11:31:19 GMT content-type text/javascript last-modified Wed, 13 Nov 2024 15:11:40 GMT server AmazonS3 x-amz-cf-pop JFK52-P2 x-amz-server-side-encryption AES256
GET H2	200	insight.min.js Show response snap.licdn.com/li.lms-analytics/	40 KB 14 KB	104ms 17ms	Script application/javascript	2600:1408:c400:5::17c7:3716 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Full URL https://snap.licdn.com/li.lms-analytics/insight.min.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKSKW3 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2600:1408:c400:5::17c7:3716 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS Software / Resource Hash 4e8276aea0a3c7fe3600e6718c7f484d49c347c8d5763d89be95900d526a14da Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers cache-control max-age=75422 content-encoding gzip x-cdn AKAM x-content-type-options nosniff accept-ranges bytes content-length 14628 date Thu, 21 Nov 2024 11:37:08 GMT last-modified Thu, 22 Aug 2024 11:06:54 GMT content-type application/javascript;charset=utf-8 vary Accept-Encoding x-amz-server-side-encryption AES256
GET H2	200	bat.js Show response bat.bing.com/	50 KB 15 KB	125ms 23ms	Script application/javascript	2620:1ec:33::10 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://bat.bing.com/bat.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKSKW3 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:33::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash aabc88a6db8b22022f96ca88e4f0a7be426abef2b35169a71515a2d55246402a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers strict-transport-security max-age=31536000; includeSubDomains; preload cache-control private,max-age=1800 content-encoding gzip etag "028e0691d20db1:0" accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: 6DA904819F4648B1BC11134C1223FE77 Ref B: EWR30EDGE0817 Ref C: 2024-11-21T11:37:08Z accept-ranges bytes x-cache CONFIG_NOCACHE content-length 14570 date Thu, 21 Nov 2024 11:37:07 GMT content-type application/javascript last-modified Wed, 16 Oct 2024 22:47:44 GMT vary Accept-Encoding
GET H2	200	destination Show response www.googletagmanager.com/gtag/	296 KB 101 KB	26ms 25ms	Script application/javascript	2607:f8b0:4004:c17::61 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/destination?id=AW-407675570&l=dataLayer&cx=c&gtm=45He4bk0v6688972za200 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKSKW3 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4004:c17::61 Washington, United States, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 4bc110aefcf3df02fb0bbac0081e4c9f5cc40d92caff76f801bf8693b3dd24e0 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers content-encoding br report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcysghrgc:42:0"}],} expires Thu, 21 Nov 2024 11:37:08 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Thu, 21 Nov 2024 11:37:08 GMT content-type application/javascript; charset=UTF-8 vary Accept-Encoding last-modified Thu, 21 Nov 2024 09:00:00 GMT access-control-allow-headers Cache-Control strict-transport-security max-age=31536000; includeSubDomains cache-control private, max-age=900 cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcysghrgc:42:0 access-control-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 102586 x-xss-protection 0 server Google Tag Manager
GET H/1.1	200 OK	munchkin.js Show response munchkin.marketo.net/	1 KB 2 KB	135ms 21ms	Script application/x-javascript	23.13.172.203 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://munchkin.marketo.net/munchkin.js Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/news/2024/11/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 23.13.172.203 Ashburn, United States, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-13-172-203.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash a2091f1ff92cc073e178dca31707853e0cc6cd913a5344a8978f040fa373efa6 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers Content-Encoding gzip ETag "e75e5ba140b1c7e6ea79786633c1ba0d:1731465879.778595" Connection keep-alive Accept-Ranges bytes P3P policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR" Content-Length 741 Date Thu, 21 Nov 2024 11:37:08 GMT Content-Type application/x-javascript Last-Modified Wed, 13 Nov 2024 02:44:39 GMT Server AkamaiNetStorage Vary Accept-Encoding
GET H2	200	js Show response www.googletagmanager.com/gtag/	296 KB 100 KB	27ms 26ms	Script application/javascript	2607:f8b0:4004:c17::61 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=AW-930356311 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKSKW3 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4004:c17::61 Washington, United States, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 4c7c492ae946bec16562cd302e935a31b9dd3f7d8c9bb1cc8080e144b7c67192 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers content-encoding br report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],} expires Thu, 21 Nov 2024 11:37:08 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Thu, 21 Nov 2024 11:37:08 GMT content-type application/javascript; charset=UTF-8 vary Accept-Encoding last-modified Thu, 21 Nov 2024 09:00:00 GMT access-control-allow-headers Cache-Control strict-transport-security max-age=31536000; includeSubDomains cache-control private, max-age=900 cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0 access-control-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 102588 x-xss-protection 0 server Google Tag Manager
GET H2	200	otPcPanel.json Show response cdn.cookielaw.org/scripttemplates/202402.1.0/assets/v2/	64 KB 13 KB	24ms 24ms	Fetch application/json	2606:4700::6812:562a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/202402.1.0/assets/v2/otPcPanel.json Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/202402.1.0/otBannerSdk.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0ed759f9b0f407aa73df997bddf186c37a1927d2b0f8d2f7031067ecacf7581d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers content-md5 Hx2FPnZ0+GDc+xiJF4si9A== access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding content-encoding gzip x-ms-version 2009-09-19 etag 0x8DCA5DEB854B960 x-ms-lease-status unlocked cf-cache-status HIT age 5301 x-content-type-options nosniff date Thu, 21 Nov 2024 11:37:08 GMT content-type application/json last-modified Tue, 16 Jul 2024 21:31:57 GMT vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control max-age=86400 cross-origin-resource-policy cross-origin x-ms-request-id cee9b637-d01e-0005-0e02-2467f5000000 cf-ray 8e6062d549204277-EWR accept-ranges bytes access-control-allow-origin * content-length 12960 x-ms-blob-type BlockBlob server cloudflare
GET H2	200	otCommonStyles.css Show response cdn.cookielaw.org/scripttemplates/202402.1.0/assets/	21 KB 4 KB	30ms 29ms	Fetch text/css	2606:4700::6812:562a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/202402.1.0/assets/otCommonStyles.css Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/202402.1.0/otBannerSdk.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d3f7b0ec4de079928a999641e781e80f33597a392a561bc460276dfb4efb6eec Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers content-md5 c7xAZ9MSGAobGaTYg/Qtag== access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding x-ms-version 2009-09-19 x-ms-lease-status unlocked cf-cache-status HIT age 8749 content-encoding gzip x-content-type-options nosniff date Thu, 21 Nov 2024 11:37:08 GMT content-type text/css last-modified Tue, 16 Jul 2024 21:32:07 GMT vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control max-age=86400 cross-origin-resource-policy cross-origin x-ms-request-id ea71daef-f01e-00de-6d20-30c323000000 cf-ray 8e6062d549234277-EWR access-control-allow-origin * x-ms-blob-type BlockBlob server cloudflare
GET H2	200	sw_iframe.html www.googletagmanager.com/static/service_worker/4bj0/ Frame 7D45	0 0	50ms 16ms	Document text/html	2607:f8b0:4004:c17::61 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/static/service_worker/4bj0/sw_iframe.html?origin=https%3A%2F%2Fwww.malwarebytes.com Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKSKW3 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4004:c17::61 Washington, United States, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Response headers accept-ranges bytes age 140683 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 cache-control public, max-age=31536000 content-encoding br content-length 1476 content-type text/html cross-origin-opener-policy same-origin; report-to="analytics-container-tag-serving" cross-origin-resource-policy cross-origin date Tue, 19 Nov 2024 20:32:25 GMT expires Wed, 19 Nov 2025 20:32:25 GMT last-modified Tue, 19 Nov 2024 10:38:00 GMT report-to {"group":"analytics-container-tag-serving","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/analytics-container-tag-serving"}]} server sffe service-worker-allowed /static/service_worker vary Accept-Encoding x-content-type-options nosniff x-xss-protection 0
GET H2	200	ot_guard_logo.svg Show response cdn.cookielaw.org/logos/static/	497 B 495 B	20ms 19ms	Fetch image/svg+xml	2606:4700::6812:562a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/logos/static/ot_guard_logo.svg Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/202402.1.0/otBannerSdk.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 691dcdb24853a0f5ce4e6597e5713dea66799b57ffe2c2a10f28f98e0b569b19 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers content-md5 tXyZydHjxQshFMbbBT1/8A== access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding x-ms-version 2009-09-19 x-ms-lease-status unlocked cf-cache-status HIT age 49971 content-encoding gzip x-content-type-options nosniff date Thu, 21 Nov 2024 11:37:08 GMT content-type image/svg+xml last-modified Tue, 19 Nov 2024 17:08:34 GMT vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control max-age=86400 cross-origin-resource-policy cross-origin x-ms-request-id b4c32b94-401e-00c7-1cfe-3aef4b000000 cf-ray 8e6062d5995e4277-EWR access-control-allow-origin * x-ms-blob-type BlockBlob server cloudflare
GET H2	200	MWB_logo_horizontal_RGB.png cdn.cookielaw.org/logos/4e1c8bc8-2743-413b-8699-aad2216e8616/3be7f101-47f0-48ab-ae22-e34efabb8a62/9b43fe5c-b22b-40eb-9d38-57e36d038e98/	46 KB 46 KB	27ms 26ms	Image image/png	2606:4700::6812:562a CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.cookielaw.org/logos/4e1c8bc8-2743-413b-8699-aad2216e8616/3be7f101-47f0-48ab-ae22-e34efabb8a62/9b43fe5c-b22b-40eb-9d38-57e36d038e98/MWB_logo_horizontal_RGB.png Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash fdf7a139210ad25e0576a0721d45086e047dee38f88ba2995ce745643212c532 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers content-md5 g65E4kh32bbdSPqSevAl8Q== access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding x-ms-version 2009-09-19 x-ms-lease-status unlocked etag 0x8DA459D0252D23C age 17402 cf-cache-status HIT x-content-type-options nosniff date Thu, 21 Nov 2024 11:37:08 GMT content-type image/png last-modified Fri, 03 Jun 2022 20:09:47 GMT vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control max-age=86400 cross-origin-resource-policy cross-origin x-ms-request-id 04442ed1-701e-0008-4453-cd88f9000000 cf-ray 8e6062d5abb67ce2-EWR accept-ranges bytes access-control-allow-origin * content-length 47111 x-ms-blob-type BlockBlob server cloudflare
GET H2	200	powered_by_logo.svg cdn.cookielaw.org/logos/static/	5 KB 2 KB	24ms 23ms	Image image/svg+xml	2606:4700::6812:562a CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.cookielaw.org/logos/static/powered_by_logo.svg Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:562a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers content-md5 Y+c301RBZNK39PvKQWrIBw== access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding x-ms-version 2009-09-19 x-ms-lease-status unlocked cf-cache-status HIT age 11481 content-encoding gzip x-content-type-options nosniff date Thu, 21 Nov 2024 11:37:08 GMT content-type image/svg+xml last-modified Wed, 20 Nov 2024 04:54:31 GMT vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control max-age=86400 cross-origin-resource-policy cross-origin x-ms-request-id 772f7382-301e-0100-09a1-3bd5df000000 cf-ray 8e6062d5abb87ce2-EWR access-control-allow-origin * x-ms-blob-type BlockBlob server cloudflare
POST H2	204	collect analytics.google.com/g/	0 0	70ms 37ms	Fetch text/plain	2001:4860:4802:34::181 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://analytics.google.com/g/collect?v=2&tid=G-K8KCHE3KSC&gtm=45je4bk0v872204243z86688972za200zb6688972&_p=1732189028041&_gaz=1&gcs=G1--&gcd=13l3l3R3l5l1&npa=0&dma=0&tag_exp=101925629~102067555~102067808~102077855~102081485&gdid=dYWJhMj&cid=586334898.1732189029&ul=en-us&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&pae=1&frm=0&pscdl=noapi&_eu=EA&_s=1&dl=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fnews%2F2024%2F11%2Fhello-again-fakebat-popular-loader-returns-after-months-long-hiatus&sid=1732189028&sct=1&seg=0&dt=Hello%20again%2C%20FakeBat%3A%20popular%20loader%20returns%20after%20months-long%20hiatus%20%7C%20Malwarebytes&en=page_view&_fv=1&_nsi=1&_ss=1&ep.content_group=Blog&tfd=918 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-K8KCHE3KSC&l=dataLayer&cx=c&gtm=45He4bk0v6688972za200 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4860:4802:34::181 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers cache-control no-cache, no-store, must-revalidate pragma no-cache cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0 report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0"}],} expires Fri, 01 Jan 1990 00:00:00 GMT access-control-allow-origin https://www.malwarebytes.com cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Thu, 21 Nov 2024 11:37:08 GMT content-type text/plain server Golfe2
POST H2	204	collect stats.g.doubleclick.net/g/	0 558 B	69ms 35ms	Ping text/plain	2607:f8b0:4004:c17::9d GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/g/collect?v=2&tid=G-K8KCHE3KSC&cid=586334898.1732189029&gtm=45je4bk0v872204243z86688972za200zb6688972&aip=1&dma=0&gcs=G1--&gcd=13l3l3R3l5l1&npa=0&frm=0&tag_exp=101925629~102067555~102067808~102077855~102081485 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-K8KCHE3KSC&l=dataLayer&cx=c&gtm=45He4bk0v6688972za200 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4004:c17::9d Washington, United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers cache-control no-cache, no-store, must-revalidate pragma no-cache cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:111:0 report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:111:0"}],} expires Fri, 01 Jan 1990 00:00:00 GMT access-control-allow-origin https://www.malwarebytes.com cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Thu, 21 Nov 2024 11:37:08 GMT content-type text/plain server Golfe2
GET H2	200	rul td.doubleclick.net/td/ga/ Frame 9CD0	0 0	66ms 28ms	Document text/html	2607:f8b0:4004:c21::9a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://td.doubleclick.net/td/ga/rul?tid=G-K8KCHE3KSC&gacid=586334898.1732189029&gtm=45je4bk0v872204243z86688972za200zb6688972&dma=0&gcs=G1--&gcd=13l3l3R3l5l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=101925629~102067555~102067808~102077855~102081485&z=2083866040 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-K8KCHE3KSC&l=dataLayer&cx=c&gtm=45He4bk0v6688972za200 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4004:c21::9a Washington, United States, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.malwarebytes.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Response headers alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 cache-control no-cache, must-revalidate content-encoding br content-length 16 content-type text/html; charset=UTF-8 cross-origin-resource-policy cross-origin date Thu, 21 Nov 2024 11:37:08 GMT expires Fri, 01 Jan 1990 00:00:00 GMT p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" pragma no-cache server cafe timing-allow-origin * x-content-type-options nosniff x-xss-protection 0
POST H3	200	407675570 google.com/pagead/form-data/	0 0	62ms 30ms	Ping text/html	2607:f8b0:4004:c08::66 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://google.com/pagead/form-data/407675570?gtm=45be4bk0pfv9137103858z86688972za201zb6688972&gcs=G1--&gcd=13l3l3R3l5l1&dma=0&tag_exp=101925629~102067555~102067808~102077855~102081485&did=dYWJhMj&gdid=dYWJhMj&npa=0&frm=0&pscdl=noapi&auid=680732602.1732189029&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&ec_mode=a&em=tv.1 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/destination?id=AW-407675570&l=dataLayer&cx=c&gtm=45He4bk0v6688972za200 Protocol H3 Security QUIC, , AES_128_GCM Server 2607:f8b0:4004:c08::66 Washington, United States, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers
POST H3	204	407675570 google.com/ccm/form-data/	0 20 B	56ms 25ms	Ping text/plain	2607:f8b0:4004:c08::66 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://google.com/ccm/form-data/407675570?gtm=45be4bk0pfv9137103858z86688972za201zb6688972&gcs=G1--&gcd=13l3l3R3l5l1&dma=0&tag_exp=101925629~102067555~102067808~102077855~102081485&did=dYWJhMj&gdid=dYWJhMj&npa=0&frm=0&pscdl=noapi&auid=680732602.1732189029&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&ec_mode=a&em=tv.1 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/destination?id=AW-407675570&l=dataLayer&cx=c&gtm=45He4bk0v6688972za200 Protocol H3 Security QUIC, , AES_128_GCM Server 2607:f8b0:4004:c08::66 Washington, United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers cache-control no-cache, no-store, must-revalidate pragma no-cache cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:57:0 report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:57:0"}],} expires Fri, 01 Jan 1990 00:00:00 GMT access-control-allow-origin https://www.malwarebytes.com cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Thu, 21 Nov 2024 11:37:08 GMT content-type text/plain server Golfe2
GET H3	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/930356311/	5 KB 2 KB	188ms 46ms	Script text/javascript	2607:f8b0:4004:c1d::9b GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/930356311/?random=1732189028970&cv=11&fst=1732189028970&bg=ffffff&guid=ON&async=1&gtm=45be4bk0v9137103858za200&gcd=13l3l3R3l5l1&dma=0&tag_exp=101925629~102067555~102067808~102077855~102081485&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fnews%2F2024%2F11%2Fhello-again-fakebat-popular-loader-returns-after-months-long-hiatus&hn=www.googleadservices.com&frm=0&tiba=Hello%20again%2C%20FakeBat%3A%20popular%20loader%20returns%20after%20months-long%20hiatus%20%7C%20Malwarebytes&did=dYWJhMj&gdid=dYWJhMj&npa=0&pscdl=noapi&auid=680732602.1732189029&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=4 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=AW-930356311 Protocol H3 Security QUIC, , AES_128_GCM Server 2607:f8b0:4004:c1d::9b Washington, United States, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash f01639e6c78934d29918b5d68bd2411e15f58969d84b531fc8c549f657539532 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers cache-control no-cache, must-revalidate timing-allow-origin * content-encoding br pragma no-cache cross-origin-resource-policy cross-origin x-content-type-options nosniff expires Fri, 01 Jan 1990 00:00:00 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" content-length 2455 date Thu, 21 Nov 2024 11:37:09 GMT x-xss-protection 0 content-type text/javascript; charset=UTF-8 content-disposition attachment; filename="f.txt" server cafe
GET H2	200	930356311 td.doubleclick.net/td/rul/ Frame 20F6	0 0	43ms 38ms	Document text/html	2607:f8b0:4004:c21::9a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://td.doubleclick.net/td/rul/930356311?random=1732189028970&cv=11&fst=1732189028970&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4bk0v9137103858za200&gcd=13l3l3R3l5l1&dma=0&tag_exp=101925629~102067555~102067808~102077855~102081485&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fnews%2F2024%2F11%2Fhello-again-fakebat-popular-loader-returns-after-months-long-hiatus&hn=www.googleadservices.com&frm=0&tiba=Hello%20again%2C%20FakeBat%3A%20popular%20loader%20returns%20after%20months-long%20hiatus%20%7C%20Malwarebytes&did=dYWJhMj&gdid=dYWJhMj&npa=0&pscdl=noapi&auid=680732602.1732189029&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=AW-930356311 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4004:c21::9a Washington, United States, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.malwarebytes.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Response headers alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 cache-control no-cache, must-revalidate content-encoding br content-length 1308 content-type text/html; charset=UTF-8 cross-origin-resource-policy cross-origin date Thu, 21 Nov 2024 11:37:09 GMT expires Fri, 01 Jan 1990 00:00:00 GMT p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" pragma no-cache server cafe timing-allow-origin * x-content-type-options nosniff x-xss-protection 0
GET H3	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/407675570/	5 KB 2 KB	174ms 43ms	Script text/javascript	2607:f8b0:4004:c1d::9b GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/407675570/?random=1732189028990&cv=11&fst=1732189028990&bg=ffffff&guid=ON&async=1&gtm=45be4bk0v9137103858za200&gcd=13l3l3R3l5l1&dma=0&tag_exp=101925629~102067555~102067808~102077855~102081485&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fnews%2F2024%2F11%2Fhello-again-fakebat-popular-loader-returns-after-months-long-hiatus&hn=www.googleadservices.com&frm=0&tiba=Hello%20again%2C%20FakeBat%3A%20popular%20loader%20returns%20after%20months-long%20hiatus%20%7C%20Malwarebytes&did=dYWJhMj&gdid=dYWJhMj&npa=0&pscdl=noapi&auid=680732602.1732189029&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=4 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=AW-930356311 Protocol H3 Security QUIC, , AES_128_GCM Server 2607:f8b0:4004:c1d::9b Washington, United States, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 4c90fbab927c45ce022f2e9bf44c593f3a4bff8c3f0c335f68d4f63666046572 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers cache-control no-cache, must-revalidate timing-allow-origin * content-encoding br pragma no-cache cross-origin-resource-policy cross-origin x-content-type-options nosniff expires Fri, 01 Jan 1990 00:00:00 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" content-length 2454 date Thu, 21 Nov 2024 11:37:09 GMT x-xss-protection 0 content-type text/javascript; charset=UTF-8 content-disposition attachment; filename="f.txt" server cafe
GET H2	200	407675570 td.doubleclick.net/td/rul/ Frame 1E80	0 0	50ms 37ms	Document text/html	2607:f8b0:4004:c21::9a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://td.doubleclick.net/td/rul/407675570?random=1732189028990&cv=11&fst=1732189028990&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4bk0v9137103858za200&gcd=13l3l3R3l5l1&dma=0&tag_exp=101925629~102067555~102067808~102077855~102081485&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fnews%2F2024%2F11%2Fhello-again-fakebat-popular-loader-returns-after-months-long-hiatus&hn=www.googleadservices.com&frm=0&tiba=Hello%20again%2C%20FakeBat%3A%20popular%20loader%20returns%20after%20months-long%20hiatus%20%7C%20Malwarebytes&did=dYWJhMj&gdid=dYWJhMj&npa=0&pscdl=noapi&auid=680732602.1732189029&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=AW-930356311 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4004:c21::9a Washington, United States, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.malwarebytes.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Response headers alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 cache-control no-cache, must-revalidate content-encoding br content-length 1503 content-type text/html; charset=UTF-8 cross-origin-resource-policy cross-origin date Thu, 21 Nov 2024 11:37:09 GMT expires Fri, 01 Jan 1990 00:00:00 GMT p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" pragma no-cache server cafe timing-allow-origin * x-content-type-options nosniff x-xss-protection 0
GET H2	200	attribution_trigger Show response px.ads.linkedin.com/	2 B 763 B	185ms 111ms	XHR application/json	2620:1ec:21::14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://px.ads.linkedin.com/attribution_trigger?pid=2594100&time=1732189028999&url=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fnews%2F2024%2F11%2Fhello-again-fakebat-popular-loader-returns-after-months-long-hiatus Requested by Host: snap.licdn.com URL: https://snap.licdn.com/li.lms-analytics/insight.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Accept * Referer https://www.malwarebytes.com/ Response headers x-li-pop afd-prod-lor1-x content-encoding gzip x-fs-uuid 0006276aafc3bf86e85ab84b4b2818d9 x-msedge-ref Ref A: DFA39BBE60C04BBAA3F5C62A8918358D Ref B: EWR311000107049 Ref C: 2024-11-21T11:37:09Z x-li-fabric prod-lor1 x-restli-protocol-version 1.0.0 access-control-allow-methods GET, OPTIONS x-li-uuid AAYnaq/Dv4boWrhLSygY2Q== x-li-proto http/2 access-control-allow-origin * x-cache CONFIG_NOCACHE date Thu, 21 Nov 2024 11:37:08 GMT content-type application/json access-control-allow-headers *
GET H2	200	collect px4.ads.linkedin.com/ Redirect Chain https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2594100&time=1732189028999&li_adsId=a7f2bbd9-7e66-446e-9594-f0ef652ed705&url=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fnews%2F2024%2F11%2Fhello-... https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2594100&time=1732189028999&li_adsId=a7f2bbd9-7e66-446e-9594-f0ef652ed705&url=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fnews%2F2024%2F11%2Fhello-... https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D2594100%26time%3D1732189028999%26li_adsId%3Da7f2bbd9-7e66-446e-9594-f0ef652ed705%... https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2594100&time=1732189028999&li_adsId=a7f2bbd9-7e66-446e-9594-f0ef652ed705&url=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fnews%2F2024%2F11%2Fhello-... https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=2594100&time=1732189028999&li_adsId=a7f2bbd9-7e66-446e-9594-f0ef652ed705&url=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fnews%2F2024%2F11%2Fhello...	0 489 B	170ms 71ms	Image application/javascript	13.107.42.14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=2594100&time=1732189028999&li_adsId=a7f2bbd9-7e66-446e-9594-f0ef652ed705&url=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fnews%2F2024%2F11%2Fhello-again-fakebat-popular-loader-returns-after-months-long-hiatus&cookiesTest=true&liSync=true&e_ipv6=AQIXygoKYQBaPgAAAZNOgwPs6ZwuP0frAi5eDMlb_C1Q9bDBWycCJIxNQSGy8vkHWYNwCfdpNId3onO5miwvnwUE2kruROo Protocol H2 Server 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers linkedin-action 1 x-li-pop afd-prod-lva1-x x-msedge-ref Ref A: 85567191BA784084AA3936C78DE951BF Ref B: EWR30EDGE1413 Ref C: 2024-11-21T11:37:09Z x-li-fabric prod-lva1 x-li-uuid AAYnaq/JNcSqXNV7yZD6ww== x-li-proto http/2 x-cache CONFIG_NOCACHE content-length 0 date Thu, 21 Nov 2024 11:37:09 GMT content-type application/javascript Redirect headers linkedin-action 1 x-li-pop afd-prod-lva1-x location https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=2594100&time=1732189028999&li_adsId=a7f2bbd9-7e66-446e-9594-f0ef652ed705&url=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fnews%2F2024%2F11%2Fhello-again-fakebat-popular-loader-returns-after-months-long-hiatus&cookiesTest=true&liSync=true&e_ipv6=AQIXygoKYQBaPgAAAZNOgwPs6ZwuP0frAi5eDMlb_C1Q9bDBWycCJIxNQSGy8vkHWYNwCfdpNId3onO5miwvnwUE2kruROo x-msedge-ref Ref A: FFDE68F203AC4B52AAB1722F886CE14F Ref B: EWR30EDGE0708 Ref C: 2024-11-21T11:37:09Z x-li-fabric prod-lva1 x-li-uuid AAYnaq/G/aYsY35XCagCDw== x-li-proto http/2 x-cache CONFIG_NOCACHE content-length 0 date Thu, 21 Nov 2024 11:37:09 GMT
GET H/1.1	200 OK	munchkin.js Show response munchkin.marketo.net/163/	11 KB 5 KB	23ms 17ms	Script application/x-javascript	23.13.172.203 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://munchkin.marketo.net/163/munchkin.js Requested by Host: munchkin.marketo.net URL: https://munchkin.marketo.net/munchkin.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 23.13.172.203 Ashburn, United States, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-13-172-203.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash 68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers Cache-Control max-age=8640000 Content-Encoding gzip ETag "ea7826f34518d7c2295738f39c7640fa:1672972000.238769" Connection keep-alive Expires Sat, 01 Mar 2025 11:37:09 GMT Accept-Ranges bytes P3P policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR" Content-Length 4741 Date Thu, 21 Nov 2024 11:37:09 GMT Content-Type application/x-javascript Last-Modified Fri, 06 Jan 2023 02:26:40 GMT Server AkamaiNetStorage Vary Accept-Encoding
GET H2	200	4072696.js Show response bat.bing.com/p/action/	363 B 422 B	35ms 20ms	Script application/javascript	2620:1ec:33::10 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://bat.bing.com/p/action/4072696.js Requested by Host: bat.bing.com URL: https://bat.bing.com/bat.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:33::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 4922a8859b315c354c23ad278e35483c6cf29aebf1c509c2c928c1f41634fe43 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers strict-transport-security max-age=31536000; includeSubDomains; preload cache-control private,max-age=1800 content-encoding br accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: 84480CE7794747D0B391649ED1BABF50 Ref B: EWR30EDGE0817 Ref C: 2024-11-21T11:37:09Z x-cache CONFIG_NOCACHE date Thu, 21 Nov 2024 11:37:08 GMT content-type application/javascript; charset=utf-8 vary Accept-Encoding
POST H/1.1	200 OK	visitWebPage 805-usg-300.mktoresp.com/webevents/	2 B 318 B	142ms 19ms	Ping text/plain	192.28.144.124 OMNITURE
General Check archive.org Show headers Download Go to Full URL https://805-usg-300.mktoresp.com/webevents/visitWebPage?_mchNc=1732189029039&_mchCn=&_mchId=805-USG-300&_mchTk=_mch-malwarebytes.com-1732189029036-52364&_mchHo=www.malwarebytes.com&_mchPo=&_mchRu=%2Fblog%2Fnews%2F2024%2F11%2Fhello-again-fakebat-popular-loader-returns-after-months-long-hiatus&_mchPc=https%3A&_mchVr=163&_mchEcid=&_mchHa=&_mchRe=&_mchQp= Requested by Host: munchkin.marketo.net URL: https://munchkin.marketo.net/163/munchkin.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 192.28.144.124 , United States, ASN15224 (OMNITURE, US), Reverse DNS Software nginx/1.20.1 / Resource Hash 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers Transfer-Encoding chunked X-Request-Id 64090b7a-83fb-4b5d-ae16-a3e398a1fb4b Content-Encoding gzip Connection keep-alive Access-Control-Allow-Origin * Date Thu, 21 Nov 2024 11:37:09 GMT Content-Type text/plain; charset=UTF-8 Server nginx/1.20.1
GET H2	204	0 bat.bing.com/action/	0 361 B	26ms 23ms	Image text/plain	2620:1ec:33::10 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://bat.bing.com/action/0?ti=4072696&tm=gtm002&Ver=2&mid=f9fae810-5534-4219-ae5f-d34ac59e50ac&bo=1&sid=f11b82e0a7fc11ef8292c7a6798d4050&vid=f11bced0a7fc11ef80a8ddf1f65ada04&vids=1&msclkid=N&pi=918639831&lg=en-US&sw=1600&sh=1200&sc=24&tl=Hello%20again,%20FakeBat%3A%20popular%20loader%20returns%20after%20months-long%20hiatus%20%7C%20Malwarebytes&p=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fnews%2F2024%2F11%2Fhello-again-fakebat-popular-loader-returns-after-months-long-hiatus&r=&lt=499&evt=pageLoad&sv=1&cdb=AQET&rn=194040 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:33::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers strict-transport-security max-age=31536000; includeSubDomains; preload cache-control no-cache, must-revalidate pragma no-cache accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: 4E5DC4BA2A044E4B955363C48FBD45C1 Ref B: EWR30EDGE0817 Ref C: 2024-11-21T11:37:09Z expires Fri, 01 Jan 1990 00:00:00 GMT access-control-allow-origin * x-cache CONFIG_NOCACHE date Thu, 21 Nov 2024 11:37:08 GMT
GET H3	200	/ www.google.com/pagead/1p-user-list/407675570/	42 B 64 B	31ms 30ms	Image image/gif	2607:f8b0:4004:c1d::68 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/407675570/?random=1732189028990&cv=11&fst=1732186800000&bg=ffffff&guid=ON&async=1&gtm=45be4bk0v9137103858za200&gcd=13l3l3R3l5l1&dma=0&tag_exp=101925629~102067555~102067808~102077855~102081485&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fnews%2F2024%2F11%2Fhello-again-fakebat-popular-loader-returns-after-months-long-hiatus&hn=www.googleadservices.com&frm=0&tiba=Hello%20again%2C%20FakeBat%3A%20popular%20loader%20returns%20after%20months-long%20hiatus%20%7C%20Malwarebytes&did=dYWJhMj&gdid=dYWJhMj&npa=0&pscdl=noapi&auid=680732602.1732189029&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSKQCa7L7dbQY7lrBRvLtga1gN6xtIvTbW2p81nGq45iG_VgCZgJ6N5bTO&random=3058121248&rmt_tld=0&ipr=y Protocol H3 Security QUIC, , AES_128_GCM Server 2607:f8b0:4004:c1d::68 Washington, United States, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers content-security-policy script-src 'none'; object-src 'none' cache-control no-cache, no-store, must-revalidate timing-allow-origin * pragma no-cache cross-origin-resource-policy cross-origin x-content-type-options nosniff expires Fri, 01 Jan 1990 00:00:00 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" content-length 42 date Thu, 21 Nov 2024 11:37:09 GMT x-xss-protection 0 content-type image/gif server cafe
GET H3	200	/ www.google.com/pagead/1p-user-list/930356311/	42 B 64 B	28ms 28ms	Image image/gif	2607:f8b0:4004:c1d::68 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/930356311/?random=1732189028970&cv=11&fst=1732186800000&bg=ffffff&guid=ON&async=1&gtm=45be4bk0v9137103858za200&gcd=13l3l3R3l5l1&dma=0&tag_exp=101925629~102067555~102067808~102077855~102081485&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fnews%2F2024%2F11%2Fhello-again-fakebat-popular-loader-returns-after-months-long-hiatus&hn=www.googleadservices.com&frm=0&tiba=Hello%20again%2C%20FakeBat%3A%20popular%20loader%20returns%20after%20months-long%20hiatus%20%7C%20Malwarebytes&did=dYWJhMj&gdid=dYWJhMj&npa=0&pscdl=noapi&auid=680732602.1732189029&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSKQCa7L7dO2-iOJflTSwhgL8F5rA8jM5kSFMxFy2igRMM71uHn4bIa2iJ&random=668276239&rmt_tld=0&ipr=y Protocol H3 Security QUIC, , AES_128_GCM Server 2607:f8b0:4004:c1d::68 Washington, United States, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://www.malwarebytes.com/ Response headers content-security-policy script-src 'none'; object-src 'none' cache-control no-cache, no-store, must-revalidate timing-allow-origin * pragma no-cache cross-origin-resource-policy cross-origin x-content-type-options nosniff expires Fri, 01 Jan 1990 00:00:00 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" content-length 42 date Thu, 21 Nov 2024 11:37:09 GMT x-xss-protection 0 content-type image/gif server cafe
POST H2	204	/ Show response px.ads.linkedin.com/wa/	0 200 B	34ms 33ms	XHR text/plain	2620:1ec:21::14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://px.ads.linkedin.com/wa/ Requested by Host: snap.licdn.com URL: https://snap.licdn.com/li.lms-analytics/insight.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.malwarebytes.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Accept * Content-Type text/plain;charset=UTF-8 Response headers linkedin-action 1 x-li-pop afd-prod-lva1-x x-msedge-ref Ref A: B0F159AB545D4709970391D7F2FC284D Ref B: EWR30EDGE0708 Ref C: 2024-11-21T11:37:09Z x-li-fabric prod-lva1 access-control-allow-credentials true x-li-uuid AAYnaq/KZKB0a2Sz+c0X5A== x-li-proto http/2 access-control-allow-origin https://www.malwarebytes.com x-cache CONFIG_NOCACHE date Thu, 21 Nov 2024 11:37:09 GMT vary Origin