news.sophos.com Open in urlscan Pro
2a04:fa87:fffd::c000:42c8  Public Scan

12 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 39

• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1636698631487&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F11%2F11%2Fbazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism%2F HTTP 302
• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1636698631487&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F11%2F11%2Fbazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism%2F&cookiesTest=true HTTP 302
• https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D461060%26time%3D1636698631487%26url%3Dhttps%253A%252F%252Fnews.sophos.com%252Fen-us%252F2021%252F11%252F11%252Fbazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism%252F%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1636698631487&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F11%2F11%2Fbazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism%2F&cookiesTest=true&liSync=true HTTP 302
• https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1636698631487&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F11%2F11%2Fbazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism%2F&cookiesTest=true&liSync=true&e_ipv6=AQIk0yt8iasDjgAAAX0S1zC1zDxUDL1Ha4vAG5X3qZvf876c3hOYLiIti-r3dyZg_aEzYkeZ HTTP 302
• https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=71ff8cee-d8ea-41f7-b2e9-da4bfb13d6cd HTTP 302
• https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=71ff8cee-d8ea-41f7-b2e9-da4bfb13d6cd&_expected_cookie=1058ce76e09ce4a03a816b6f312900b9

Request Chain 45

• https://match.prod.bidr.io/cookie-sync/demandbase HTTP 303
• https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1 HTTP 303
• https://segments.company-target.com/log?vendor=choca&user_id=AAlYmE7DHBQAADevXw5GNg HTTP 303
• https://segments.company-target.com/validateCookie?vendor=choca&user_id=AAlYmE7DHBQAADevXw5GNg&verifyHash=d21ffa894c12694c76c67c81b875a4746a8a1d20

Request Chain 46

• https://id.rlcdn.com/464526.gif HTTP 307
• https://id.rlcdn.com/1000.gif?memo=CI6tHBoNCIeUuIwGEgUI6AcQAEIASgA HTTP 307
• https://segments.company-target.com/log?vendor=liveramp&user_id=Xc1297p-9excfoRP3AXx6lwMe4aaL3m2eh_s8-ySeagolz1jY

Request Chain 47

• https://stats.g.doubleclick.net/r/__utm.gif?utmwv=5.7.2dc&utms=1&utmn=364191406&utmhn=news.sophos.com&utme=8(4!CampaignID)9(4!70130000001xKqzAAE)&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=BazarLoader%20%E2%80%98call%20me%20back%E2%80%99%20attack%20abuses%20Windows%2010%20Apps%20mechanism%20%E2%80%93%20Sophos%20News&utmhid=1503263714&utmr=-&utmp=%2Fcorpblog%2Fen-us%2F2021%2F11%2F11%2Fbazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism%2F&utmht=1636698631608&utmac=UA-737537-1&utmcc=__utma%3D1.94060615.1636698632.1636698632.1636698632.1%3B%2B__utmz%3D1.1636698632.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=454681740&utmredir=3&utmu=q1CAAAAAAAAAAAAAAAAAAAAE~ HTTP 302
• https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=94060615.1636698632&jid=454681740&_v=5.7.2dc&z=364191406 HTTP 302
• https://www.google.co.jp/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=94060615.1636698632&jid=454681740&_v=5.7.2dc&z=364191406&slf_rd=1&random=4046871887

Request Chain 57

• https://insight.adsrvr.org/track/up?adv=j022xlj&ref=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F11%2F11%2Fbazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism%2F&upid=ql4fc2b&upv=1.1.0 HTTP 302
• https://match.adsrvr.org/track/upb/?adv=j022xlj&ref=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F11%2F11%2Fbazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism%2F&upid=ql4fc2b&upv=1.1.0

Request Chain 59

• https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=c2284dcc-e298-4113-8477-711236015e20&gdpr=0&gdpr_consent=&expires=30&next=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Frubicon HTTP 302
• https://match.adsrvr.org/track/cmf/rubicon?gdpr=0

Request Chain 61

• https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm&google_sc&google_hm=YzIyODRkY2MtZTI5OC00MTEzLTg0NzctNzExMjM2MDE1ZTIw&gdpr=0&gdpr_consent=&ttd_tdid=c2284dcc-e298-4113-8477-711236015e20 HTTP 302
• https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=c2284dcc-e298-4113-8477-711236015e20&google_gid=CAESELYGH9dabozSDk-UDecIk4M&google_cver=1

63 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/	74 KB 21 KB	206ms 3ms	Document text/html	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / WordPress VIP <https://wpvip.com> Resource Hash 01575c4ded7e85e715915b1b841786b302791f554030bf2d0b5647074884e049 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Accept-Language jp-JP,jp;q=0.9 Response headers server nginx date Fri, 12 Nov 2021 06:30:31 GMT content-type text/html; charset=UTF-8 content-length 21263 x-hacker If you're reading this, you should visit wpvip.com/careers and apply to join the fun, mention this header. x-powered-by WordPress VIP <https://wpvip.com> host-header a9130478a60e5f9135f765b23f26593b link <https://news.sophos.com/wp-json/>; rel="https://api.w.org/" <https://news.sophos.com/wp-json/wp/v2/posts/79639>; rel="alternate"; type="application/json" <https://news.sophos.com/?p=79639>; rel=shortlink x-rq nrt2 0 2 9980 cache-control max-age=300, must-revalidate content-encoding gzip age 1573 x-cache hit vary Accept-Encoding accept-ranges bytes strict-transport-security max-age=31536000
GET H2	200	/ news.sophos.com/_static/	234 KB 38 KB	7ms 6ms	Stylesheet text/css	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://news.sophos.com/_static/??-eJyNj0sOgzAMRC/UYAIqiEXVs4RgQVrnI5wI5fYNbRegbrrzeObJHtiCME5TmpBBM8NkOMJIXj8FmXFVawaOmbCyxlUlcIEj8WCwOBmFhBZdPIlAKuMqCGel83948Y76BGnv4p6JS/EY2IfFs8ONRVPL/vNkGRv5Q9gkAqXZuHIQY1Clmqyr9l33u9iZu73Jru2u3TD09QufZGXG Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 1fe274e05941fb6cdca292fa476d7ad42b877a38c1c2c4ebcbcfab5afa0c0c43 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Fri, 12 Nov 2021 06:30:31 GMT x-rq nrt2 0 2 9980 last-modified Wed, 10 Nov 2021 18:46:10 GMT server nginx age 112179 vary Accept-Encoding x-cache hit content-type text/css;charset=utf-8 cache-control max-age=31536000 strict-transport-security max-age=31536000 accept-ranges bytes content-encoding gzip content-length 38919
GET H2	200	/ Show response news.sophos.com/_static/	98 KB 34 KB	3ms 3ms	Script application/javascript	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://news.sophos.com/_static/??-eJzTLy/QzcxLzilNSS3WzwKiwtLUokoopZebmaeXVayjj0+Rbm5melFiSSpUsX2uraGZsZmpmaWluUEWAK+4Iiw= Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 75839e3ea0cd949a33dc21dd8b0931f396829fea8e0e3148b576b1228f40e469 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Fri, 12 Nov 2021 06:30:31 GMT x-rq nrt2 0 2 9980 last-modified Wed, 10 Nov 2021 18:46:10 GMT server nginx age 112179 vary Accept-Encoding x-cache hit content-type application/javascript cache-control max-age=31536000 strict-transport-security max-age=31536000 accept-ranges bytes content-encoding gzip content-length 34312
GET H2	200	Category-Icon-Threat-Research@2x.min_.png news.sophos.com/wp-content/uploads/2021/05/	29 KB 29 KB	3ms 2ms	Image image/png	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://news.sophos.com/wp-content/uploads/2021/05/Category-Icon-Threat-Research@2x.min_.png Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 1bb589dac456a9951fa3e549f5d614b07c880c19d06a5e68b789b25361b733dd Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Fri, 12 Nov 2021 06:30:31 GMT x-rq nrt2 118 85 443 last-modified Tue, 25 May 2021 21:15:26 GMT server nginx etag "af175471cea67ede" strict-transport-security max-age=31536000 x-cache HIT content-type image/png cache-control max-age=2592000 accept-ranges bytes content-length 29491 expires Sat, 17 Sep 2022 23:15:12 GMT
GET H2	200	216532880604c8cf0600f4bc964cf01d secure.gravatar.com/avatar/	87 KB 88 KB	12ms 4ms	Image image/png	2a04:fa87:fffe::c000:4902 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://secure.gravatar.com/avatar/216532880604c8cf0600f4bc964cf01d?s=400&d=blank&r=g Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 5c259c40b1b260479da09444eb81d821e2427d175d4493be612f50a6c7a66677 Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers x-nc HIT nrt 1 date Fri, 12 Nov 2021 06:30:31 GMT last-modified Mon, 04 Jun 2018 15:39:21 GMT server nginx content-type image/png access-control-allow-origin * cache-control max-age=300 content-disposition inline; filename="216532880604c8cf0600f4bc964cf01d.png" accept-ranges bytes link <https://www.gravatar.com/avatar/216532880604c8cf0600f4bc964cf01d?s=400&d=blank&r=g>; rel="canonical" content-length 89335 expires Fri, 12 Nov 2021 06:35:31 GMT
GET H2	200	gtm.js Show response www.googletagmanager.com/	101 KB 39 KB	90ms 49ms	Script application/javascript	2404:6800:4004:824::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-5L6H3LN&gtm_auth=d5XceCG5H_eblswmMfURjQ&gtm_preview=env-2&gtm_cookies_win=x Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2404:6800:4004:824::2008 , Australia, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash a114f712f9733ef9edbef51bf2187740e1f4508f40a7c2d90491b655357ad198 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Fri, 12 Nov 2021 06:30:31 GMT content-encoding br vary * cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 39408 x-xss-protection 0 pragma no-cache server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true access-control-allow-headers Cache-Control expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	wp-emoji-release.min.js Show response news.sophos.com/wp-includes/js/	18 KB 5 KB	5ms 5ms	Script application/javascript	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://news.sophos.com/wp-includes/js/wp-emoji-release.min.js?ver=5.8.2 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash def5de6254be138b8b35d680d1fdd8b07827d03b8626daebfeeb4157ec330ea7 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Fri, 12 Nov 2021 06:30:31 GMT x-rq nrt2 0 2 9980 last-modified Wed, 10 Nov 2021 18:46:10 GMT server nginx age 112179 etag W/"618c1372-4705" vary Accept-Encoding x-cache hit content-type application/javascript cache-control max-age=31536000 strict-transport-security max-age=31536000 accept-ranges bytes content-encoding gzip content-length 4926 expires Sat, 12 Nov 2022 06:30:31 GMT
GET H2	200	/ Show response news.sophos.com/_static/	135 KB 38 KB	3ms 3ms	Script application/javascript	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://news.sophos.com/_static/??-eJyVjFEOgyAQBS9UQLDVr6ZnIWSj0LJL2G3t8cV4AUne12Tmma2oQCiAYmSFDGyYykqMsLFyg51N4rYm0TuC+jnttG1An0AnvplLH4Fqhw1/qZ6v+yfSX4mf/ir4XHxcsDssvgpC7e4W350crEWv/LTTONn78BjntAOgdaA8 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash a36c1b591e0a043aef36da97ac4da5a313386c35ad3c92eb558e13d0291f8eff Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Fri, 12 Nov 2021 06:30:31 GMT x-rq nrt2 0 2 9980 last-modified Fri, 05 Nov 2021 19:28:57 GMT server nginx age 554850 vary Accept-Encoding x-cache hit content-type application/javascript cache-control max-age=31536000 strict-transport-security max-age=31536000 accept-ranges bytes content-encoding gzip content-length 38988
GET H2	200	alpine.min.js Show response cdn.jsdelivr.net/gh/alpinejs/alpine@v2.8.1/dist/	26 KB 9 KB	22ms 14ms	Script application/javascript	2606:4700::6810:5714 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/gh/alpinejs/alpine@v2.8.1/dist/alpine.min.js?ver=2.0.1 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:5714 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash de9485aee0805fc555984a4286697dccb8a9762fa9240c6a47b4dd478d282e74 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Fri, 12 Nov 2021 06:30:31 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT age 1503248 x-jsd-version 2.8.1 x-cache HIT, MISS cross-origin-resource-policy cross-origin strict-transport-security max-age=31536000; includeSubDomains; preload alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 x-served-by cache-fra19182-FRA, cache-tyo11939-TYO timing-allow-origin * x-jsd-version-type version server cloudflare etag W/"6964-M33llwtEtRbUwMPPG0SKpWL3vX8" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * access-control-expose-headers * cache-control public, max-age=31536000, s-maxage=31536000, immutable cf-ray 6acdb64ddf791ec8-NRT
GET H2	200	/ Show response news.sophos.com/_static/	4 KB 2 KB	6ms 5ms	Script application/javascript	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://news.sophos.com/_static/??/wp-includes/js/comment-reply.min.js,/wp-includes/js/wp-embed.min.js?m=1636569970j Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 070a9ce02c3219e9eae17eb12ed3944475f206d05e2c4c3ce14868c425d8df13 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Fri, 12 Nov 2021 06:30:31 GMT x-rq nrt2 0 2 9980 last-modified Wed, 10 Nov 2021 18:46:10 GMT server nginx age 112150 vary Accept-Encoding x-cache hit content-type application/javascript cache-control max-age=31536000 strict-transport-security max-age=31536000 accept-ranges bytes content-encoding gzip content-length 1931
GET H2	200	e-202145.js Show response stats.wp.com/	9 KB 3 KB	11ms 3ms	Script application/javascript	192.0.76.3 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://stats.wp.com/e-202145.js Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.76.3 , United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 0ebbc7fba9a50d36ef5422345f624431710db4528f25749d1d438c2c10bb69f2 Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers x-nc HIT nrt date Fri, 12 Nov 2021 06:30:31 GMT content-encoding br server nginx etag W/"5c6340e3-350a" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type application/javascript access-control-allow-origin * cache-control max-age=31536000 expires Thu, 10 Nov 2022 15:20:42 GMT
GET H2	200	sophos-ransomware-web-banner-1200x628px-option-2.png news.sophos.com/wp-content/uploads/2021/05/	75 KB 75 KB	6ms 5ms	Image image/webp	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://news.sophos.com/wp-content/uploads/2021/05/sophos-ransomware-web-banner-1200x628px-option-2.png?w=640 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 632adbe6ad11ec159079391311ff0ad317ad1c52890365dbfeb497fedabfaebb Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Fri, 12 Nov 2021 06:30:31 GMT x-rq nrt2 118 20 443 last-modified Mon, 24 May 2021 12:34:03 GMT server nginx etag "2a5b74eb6ef6e549" vary Accept x-cache HIT content-type image/webp cache-control max-age=2592000 strict-transport-security max-age=31536000 accept-ranges bytes content-length 76514 expires Tue, 24 May 2022 12:34:03 GMT
GET H2	200	sophos-edr-news-blog-image-838x440px@2x.png news.sophos.com/wp-content/uploads/2021/05/	11 KB 11 KB	14ms 13ms	Image image/webp	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://news.sophos.com/wp-content/uploads/2021/05/sophos-edr-news-blog-image-838x440px@2x.png?w=640 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash bd83358a15f76cc031ddf566a6cc1e16f8a86570aeea439bfb3a51bea4786970 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Fri, 12 Nov 2021 06:30:31 GMT x-rq nrt2 112 53 443 last-modified Wed, 19 May 2021 13:02:33 GMT server nginx etag "7d5a9cf2a50743d4" vary Accept x-cache HIT content-type image/webp cache-control max-age=2592000 strict-transport-security max-age=31536000 accept-ranges bytes content-length 11188 expires Thu, 19 May 2022 13:02:33 GMT
GET H2	200	sophos-xdr.png news.sophos.com/wp-content/uploads/2021/05/	39 KB 39 KB	14ms 13ms	Image image/webp	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://news.sophos.com/wp-content/uploads/2021/05/sophos-xdr.png?w=640 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash d60b73d55aed17b7121e54d535602c04a3dce36a90ce83ce95c60a3995838334 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Fri, 12 Nov 2021 06:30:31 GMT x-rq nrt2 113 149 443 last-modified Sat, 15 May 2021 02:08:26 GMT server nginx etag "ad4dd145696e19f0" vary Accept x-cache HIT content-type image/webp cache-control max-age=2592000 strict-transport-security max-age=31536000 accept-ranges bytes content-length 39726 expires Sun, 15 May 2022 02:08:26 GMT
GET H2	200	SophosSans-Light.woff2 news.sophos.com/wp-content/themes/sophosnews-2017/fonts/	25 KB 25 KB	165ms 164ms	Font font/woff2	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://news.sophos.com/wp-content/themes/sophosnews-2017/fonts/SophosSans-Light.woff2 Requested by Host: news.sophos.com URL: https://news.sophos.com/_static/??-eJyNj0sOgzAMRC/UYAIqiEXVs4RgQVrnI5wI5fYNbRegbrrzeObJHtiCME5TmpBBM8NkOMJIXj8FmXFVawaOmbCyxlUlcIEj8WCwOBmFhBZdPIlAKuMqCGel83948Y76BGnv4p6JS/EY2IfFs8ONRVPL/vNkGRv5Q9gkAqXZuHIQY1Clmqyr9l33u9iZu73Jru2u3TD09QufZGXG Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash f4a2fb1bd486b246823cfb9750f25a4323a8f74c23968d4a6fcdd96a65511631 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://news.sophos.com/_static/??-eJyNj0sOgzAMRC/UYAIqiEXVs4RgQVrnI5wI5fYNbRegbrrzeObJHtiCME5TmpBBM8NkOMJIXj8FmXFVawaOmbCyxlUlcIEj8WCwOBmFhBZdPIlAKuMqCGel83948Y76BGnv4p6JS/EY2IfFs8ONRVPL/vNkGRv5Q9gkAqXZuHIQY1Clmqyr9l33u9iZu73Jru2u3TD09QufZGXG Origin https://news.sophos.com Accept-Language jp-JP,jp;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Fri, 12 Nov 2021 06:30:31 GMT content-encoding gzip vary X-Mobile-Class age 0 x-cache miss x-rq nrt2 0 2 9980 last-modified Fri, 05 Nov 2021 19:28:57 GMT server nginx etag W/"618585f9-62e4" strict-transport-security max-age=31536000 access-control-allow-methods GET, HEAD content-type font/woff2 access-control-allow-origin * cache-control max-age=31536000 accept-ranges bytes expires Sat, 12 Nov 2022 06:30:31 GMT
GET H2	200	SophosSans-Medium.woff2 news.sophos.com/wp-content/themes/sophosnews-2017/fonts/	26 KB 26 KB	172ms 172ms	Font font/woff2	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://news.sophos.com/wp-content/themes/sophosnews-2017/fonts/SophosSans-Medium.woff2 Requested by Host: news.sophos.com URL: https://news.sophos.com/_static/??-eJyNj0sOgzAMRC/UYAIqiEXVs4RgQVrnI5wI5fYNbRegbrrzeObJHtiCME5TmpBBM8NkOMJIXj8FmXFVawaOmbCyxlUlcIEj8WCwOBmFhBZdPIlAKuMqCGel83948Y76BGnv4p6JS/EY2IfFs8ONRVPL/vNkGRv5Q9gkAqXZuHIQY1Clmqyr9l33u9iZu73Jru2u3TD09QufZGXG Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash d1fabd20a67738775bb84fda3b230d2f007a2c3a6629d327bc8ab4312cb5c0fe Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://news.sophos.com/_static/??-eJyNj0sOgzAMRC/UYAIqiEXVs4RgQVrnI5wI5fYNbRegbrrzeObJHtiCME5TmpBBM8NkOMJIXj8FmXFVawaOmbCyxlUlcIEj8WCwOBmFhBZdPIlAKuMqCGel83948Y76BGnv4p6JS/EY2IfFs8ONRVPL/vNkGRv5Q9gkAqXZuHIQY1Clmqyr9l33u9iZu73Jru2u3TD09QufZGXG Origin https://news.sophos.com Accept-Language jp-JP,jp;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Fri, 12 Nov 2021 06:30:31 GMT content-encoding gzip vary X-Mobile-Class age 0 x-cache miss content-length 26560 x-rq nrt2 0 2 9980 last-modified Fri, 05 Nov 2021 19:28:57 GMT server nginx etag W/"618585f9-67a4" strict-transport-security max-age=31536000 access-control-allow-methods GET, HEAD content-type font/woff2 access-control-allow-origin * cache-control max-age=31536000 accept-ranges bytes expires Sat, 12 Nov 2022 06:30:31 GMT
GET H2	200	SophosSans-Semibold.woff2 news.sophos.com/wp-content/themes/sophosnews-2017/fonts/	26 KB 26 KB	169ms 168ms	Font font/woff2	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://news.sophos.com/wp-content/themes/sophosnews-2017/fonts/SophosSans-Semibold.woff2 Requested by Host: news.sophos.com URL: https://news.sophos.com/_static/??-eJyNj0sOgzAMRC/UYAIqiEXVs4RgQVrnI5wI5fYNbRegbrrzeObJHtiCME5TmpBBM8NkOMJIXj8FmXFVawaOmbCyxlUlcIEj8WCwOBmFhBZdPIlAKuMqCGel83948Y76BGnv4p6JS/EY2IfFs8ONRVPL/vNkGRv5Q9gkAqXZuHIQY1Clmqyr9l33u9iZu73Jru2u3TD09QufZGXG Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash f927844e8c953560f5a67112c5dfaab926df93df57f3d8cd062028f1ca80b530 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://news.sophos.com/_static/??-eJyNj0sOgzAMRC/UYAIqiEXVs4RgQVrnI5wI5fYNbRegbrrzeObJHtiCME5TmpBBM8NkOMJIXj8FmXFVawaOmbCyxlUlcIEj8WCwOBmFhBZdPIlAKuMqCGel83948Y76BGnv4p6JS/EY2IfFs8ONRVPL/vNkGRv5Q9gkAqXZuHIQY1Clmqyr9l33u9iZu73Jru2u3TD09QufZGXG Origin https://news.sophos.com Accept-Language jp-JP,jp;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Fri, 12 Nov 2021 06:30:31 GMT content-encoding gzip vary X-Mobile-Class age 0 x-cache miss x-rq nrt2 0 2 9980 last-modified Fri, 05 Nov 2021 19:28:57 GMT server nginx etag W/"618585f9-6828" strict-transport-security max-age=31536000 access-control-allow-methods GET, HEAD content-type font/woff2 access-control-allow-origin * cache-control max-age=31536000 accept-ranges bytes expires Sat, 12 Nov 2022 06:30:31 GMT
GET H2	200	angrykitten2.png news.sophos.com/wp-content/uploads/2021/11/	252 KB 253 KB	4ms 4ms	Image image/webp	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://news.sophos.com/wp-content/uploads/2021/11/angrykitten2.png Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash f9b2d030ba3765101fdf3b4127678bc96542bed80f3380ee140873132b4afd1d Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Fri, 12 Nov 2021 06:30:31 GMT x-rq nrt2 113 87 443 last-modified Thu, 11 Nov 2021 13:43:36 GMT server nginx etag "0117b3f1fb99e671" vary Accept x-cache HIT content-type image/webp cache-control max-age=2592000 strict-transport-security max-age=31536000 accept-ranges bytes content-length 258548 expires Fri, 11 Nov 2022 13:43:36 GMT
GET H2	200	bazar-email-1-1.png news.sophos.com/wp-content/uploads/2021/11/	11 KB 11 KB	4ms 4ms	Image image/webp	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://news.sophos.com/wp-content/uploads/2021/11/bazar-email-1-1.png Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 5ce712198953030d714dd40fbc6615cc592401071580c48cc1356f1bdaf09977 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Fri, 12 Nov 2021 06:30:31 GMT x-rq nrt2 113 214 443 last-modified Thu, 11 Nov 2021 12:48:03 GMT server nginx etag "b85e1fd7cfc736de" vary Accept x-cache HIT content-type image/webp cache-control max-age=2592000 strict-transport-security max-age=31536000 accept-ranges bytes content-length 11538 expires Fri, 11 Nov 2022 12:48:03 GMT
GET H2	200	ms-appinstaller-object-link.png news.sophos.com/wp-content/uploads/2021/11/	36 KB 36 KB	5ms 4ms	Image image/webp	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://news.sophos.com/wp-content/uploads/2021/11/ms-appinstaller-object-link.png?resize=768,383 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 7da58d0485e3de20f101fa56e60b614408905bf9997a1b375744e85fb816a215 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Fri, 12 Nov 2021 06:30:31 GMT x-rq nrt2 115 215 443 last-modified Thu, 11 Nov 2021 13:43:35 GMT server nginx etag "866b8ec49088811b" vary Accept x-cache HIT content-type image/webp cache-control max-age=2592000 strict-transport-security max-age=31536000 accept-ranges bytes content-length 37052 expires Fri, 11 Nov 2022 13:43:35 GMT
GET H2	200	bazar-downloads.png news.sophos.com/wp-content/uploads/2021/11/	82 KB 82 KB	5ms 4ms	Image image/webp	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://news.sophos.com/wp-content/uploads/2021/11/bazar-downloads.png?resize=768,236 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 8f3f35ce104cc9ca047643f939a3d4812f51bc98db82473eb48f2b482148c096 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Fri, 12 Nov 2021 06:30:31 GMT x-rq nrt2 119 79 443 last-modified Thu, 11 Nov 2021 13:43:35 GMT server nginx etag "c1feb8e5dda21743" vary Accept x-cache HIT content-type image/webp cache-control max-age=2592000 strict-transport-security max-age=31536000 accept-ranges bytes content-length 84054 expires Fri, 11 Nov 2022 13:43:35 GMT
GET H2	200	app-installer-warning.png news.sophos.com/wp-content/uploads/2021/11/	13 KB 13 KB	5ms 4ms	Image image/webp	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://news.sophos.com/wp-content/uploads/2021/11/app-installer-warning.png Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 74218aa32c3f0c6461f46f569f94193799611aeb9f94736f4f92a588a1c28f8b Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Fri, 12 Nov 2021 06:30:31 GMT x-rq nrt2 112 53 443 last-modified Thu, 11 Nov 2021 12:48:05 GMT server nginx etag "5818a72dd77c1ce5" vary Accept x-cache HIT content-type image/webp cache-control max-age=2592000 strict-transport-security max-age=31536000 accept-ranges bytes content-length 13316 expires Fri, 11 Nov 2022 12:48:05 GMT
GET H2	200	dc.js Show response stats.g.doubleclick.net/	45 KB 17 KB	147ms 35ms	Script text/javascript	2404:6800:4008:c04::9d GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/dc.js Requested by Host: news.sophos.com URL: https://news.sophos.com/_static/??-eJyVjFEOgyAQBS9UQLDVr6ZnIWSj0LJL2G3t8cV4AUne12Tmma2oQCiAYmSFDGyYykqMsLFyg51N4rYm0TuC+jnttG1An0AnvplLH4Fqhw1/qZ6v+yfSX4mf/ir4XHxcsDssvgpC7e4W350crEWv/LTTONn78BjntAOgdaA8 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2404:6800:4008:c04::9d Taipei, Taiwan, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 6181cd98fe270c2826d416574446841f86778bc45a0ab0bdd0c667b4e70fd6e8 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff last-modified Tue, 02 Nov 2021 17:39:06 GMT server Golfe2 age 1372 date Fri, 12 Nov 2021 06:07:39 GMT vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 17093 expires Fri, 12 Nov 2021 08:07:39 GMT
GET H/1.1	200 OK	elqCfg.min.js Show response img03.en25.com/i/	6 KB 3 KB	25ms 6ms	Script application/x-javascript	104.71.159.198 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://img03.en25.com/i/elqCfg.min.js Requested by Host: news.sophos.com URL: https://news.sophos.com/_static/??-eJyVjFEOgyAQBS9UQLDVr6ZnIWSj0LJL2G3t8cV4AUne12Tmma2oQCiAYmSFDGyYykqMsLFyg51N4rYm0TuC+jnttG1An0AnvplLH4Fqhw1/qZ6v+yfSX4mf/ir4XHxcsDssvgpC7e4W350crEWv/LTTONn78BjntAOgdaA8 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.71.159.198 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a104-71-159-198.deploy.static.akamaitechnologies.com Software / Resource Hash 3346de8e2ae1bfde250c7ac5c06f79a0a60c7faef8e5e08a2c9e8fbf5ec2c9e8 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers Strict-Transport-Security max-age=31536000; includeSubDomains; preload Content-Encoding gzip X-Content-Type-Options nosniff P3P CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA", Connection keep-alive Content-Length 2183 X-XSS-Protection 1; mode=block Pragma no-cache Last-Modified Tue, 17 Aug 2021 17:49:31 GMT Date Fri, 12 Nov 2021 06:30:31 GMT Vary Accept-Encoding Content-Type application/x-javascript Cache-Control no-store ETag "fac3963b9093d71:0" Accept-Ranges bytes X-Robots-Tag noindex, nofollow Expires Fri, 12 Nov 2021 06:30:31 GMT
GET H2	200	g.gif pixel.wp.com/	50 B 93 B	8ms 8ms	Image image/gif	192.0.76.3 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://pixel.wp.com/g.gif?v=ext&j=1%3A10.3&blog=166161023&post=79639&tz=-5&srv=news.sophos.com&host=news.sophos.com&ref=&fcp=360&rand=0.4644552113976066 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.76.3 , United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1 Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers access-control-allow-origin * date Fri, 12 Nov 2021 06:30:31 GMT cache-control no-cache server nginx content-length 50 content-type image/gif
GET H2	200	js Show response www.googletagmanager.com/gtag/	97 KB 39 KB	46ms 45ms	Script application/javascript	2404:6800:4004:824::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=AW-743773256 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-5L6H3LN&gtm_auth=d5XceCG5H_eblswmMfURjQ&gtm_preview=env-2&gtm_cookies_win=x Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2404:6800:4004:824::2008 , Australia, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 4bbdbeb802bb7ed9052cc3e07a210f26a4e58025931ca2488705c6a10ad4f90d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Fri, 12 Nov 2021 06:30:31 GMT content-encoding br vary Accept-Encoding cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 39547 x-xss-protection 0 last-modified Fri, 12 Nov 2021 06:00:00 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Fri, 12 Nov 2021 06:30:31 GMT
GET H2	200	bat.js Show response bat.bing.com/	35 KB 11 KB	49ms 38ms	Script application/javascript	2620:1ec:c11::200 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://bat.bing.com/bat.js Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash d068af5c09c1417e301e13b2c90fa877e0a24e0baae8160b6b77f1650486eb13 Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Fri, 12 Nov 2021 06:30:30 GMT content-encoding gzip last-modified Wed, 03 Nov 2021 17:40:42 GMT accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: 3A5B109764C043358945322F57695CFD Ref B: TYAEDGE1114 Ref C: 2021-11-12T06:30:31Z etag "08933ecd9d0d71:0" vary Accept-Encoding x-cache CONFIG_NOCACHE content-type application/javascript access-control-allow-origin * cache-control private,max-age=1800 accept-ranges bytes content-length 10202
GET H2	200	fbevents.js Show response connect.facebook.net/en_US/	98 KB 26 KB	11ms 2ms	Script application/x-javascript	2a03:2880:f00f:8:face:b00c:0:1 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/en_US/fbevents.js Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f00f:8:face:b00c:0:1 Tokyo, Japan, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash b23807a4c5d90afca0dc47d688c0a05302779429dab75f5e6182562dcc2970f6 Security Headers Name Value Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers content-security-policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests; content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=3600,h3-29=":443"; ma=3600 content-length 25965 x-xss-protection 0 pragma public x-fb-debug 5VbaokzCLsR0rOuLaMOyp5qWiig/0emwAM+SRJblHBAQFdTrkOYb4Pjf2Gm7fLAWQOh5ALu4xmpojnXYeHcJWg== x-fb-trip-id 382461245 x-frame-options DENY date Fri, 12 Nov 2021 06:30:31 GMT strict-transport-security max-age=31536000; preload; includeSubDomains content-type application/x-javascript; charset=utf-8 vary Accept-Encoding cache-control public, max-age=1200 x-fb-rlafr 0 expires Sat, 01 Jan 2000 00:00:00 GMT
GET H/1.1	200 OK	insight.min.js Show response snap.licdn.com/li.lms-analytics/	5 KB 2 KB	19ms 2ms	Script application/x-javascript	2600:140b:2::174d:cc9b AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://snap.licdn.com/li.lms-analytics/insight.min.js Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2600:140b:2::174d:cc9b Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash fed785a6a8ca96fb67230fec5d85f9c508db49f4075aa0ef284af56cd89813e3 Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers Date Fri, 12 Nov 2021 06:30:31 GMT Content-Encoding gzip Last-Modified Wed, 29 Sep 2021 19:17:49 GMT X-CDN AKAM Vary Accept-Encoding Content-Type application/x-javascript;charset=utf-8 Cache-Control max-age=33388 Connection keep-alive Accept-Ranges bytes Content-Length 2036
GET H2	200	WuEFNglz.min.js Show response scripts.demandbase.com/	61 KB 16 KB	123ms 6ms	Script application/javascript	13.35.49.34 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://scripts.demandbase.com/WuEFNglz.min.js Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.35.49.34 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-35-49-34.nrt20.r.cloudfront.net Software AmazonS3 / Resource Hash 821c1dba392245eac9a9d8709348b2e3dc9245eaeb40233a2f0d608060df20e0 Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers x-amz-version-id LCueR8U3D7lJgwCfemj1Slg2LluSXKrc content-encoding gzip last-modified Thu, 17 Jun 2021 19:46:43 GMT server AmazonS3 age 1477 etag W/"b068f44152e87ccb66f40491a735aad0" vary Accept-Encoding x-cache Hit from cloudfront content-type application/javascript; charset=utf-8 via 1.1 57d6a381accc684bf9c07fe8ac96e9f1.cloudfront.net (CloudFront) cache-control public, max-age=3600 date Fri, 12 Nov 2021 06:06:44 GMT x-amz-cf-pop NRT20-C1 x-amz-cf-id mS57JStQDZZZ4GhwkSFzNtWAEAdGx9-LuTSW6nc6hMHZWI3Hg5nNvQ==
GET H2	200	uwt.js Show response static.ads-twitter.com/	14 KB 6 KB	11ms 2ms	Script application/javascript	151.101.108.157 FASTLY
General Check archive.org Show headers Download Go to Full URL https://static.ads-twitter.com/uwt.js Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.108.157 Tokyo, Japan, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 4da3e3aa30b5b06390d7e7e3fcfb16d648909eb429d161c2748bd6d79a7ec5fb Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Fri, 12 Nov 2021 06:30:31 GMT content-encoding gzip last-modified Tue, 21 Sep 2021 23:38:59 GMT etag "8dc11b7ca1d5ed9ec3b1ab1beb621c75+gzip+gzip" vary Accept-Encoding,Host x-tw-cdn FT p3p CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" cache-control no-cache x-cache HIT, HIT accept-ranges bytes content-type application/javascript; charset=utf-8 content-length 5410 x-served-by cache-iad-kcgs7200044-IAD, cache-tyo11974-TYO
GET H2	200	qevents.js Show response a.quora.com/	39 KB 14 KB	15ms 1ms	Script text/plain	151.101.193.2 FASTLY
General Check archive.org Show headers Download Go to Full URL https://a.quora.com/qevents.js Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.193.2 , United States, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash ef6de6beb1cf5bf809eccfe10f99aea0e0969c71d4eab5446410fef72695679f Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers x-amz-version-id s3LlaOWABX1LUjiLldBNr49lVAylKDRo content-encoding gzip etag "f32ebb1e93a72c0a57add6d07f688510" age 2008 x-cache HIT, HIT content-length 13681 x-amz-id-2 e8HRjjz8HcFB8zDoiQFu4e01sE1AeVEOhH24UIrP9sL9o7l1RhOrij1J4VOjOC59Sl+73vIv1qw= x-served-by cache-bwi5180-BWI, cache-hnd18746-HND last-modified Fri, 25 Oct 2019 19:28:38 GMT server AmazonS3 x-amz-meta-s3cmd-attrs atime:1572031715/ctime:1572031714/gid:1000000/gname:employee/md5:f32ebb1e93a72c0a57add6d07f688510/mode:33188/mtime:1149709104/uid:1000332/uname:tzhou x-timer S1636698631.466723,VS0,VE0 date Fri, 12 Nov 2021 06:30:31 GMT vary Accept-Encoding x-amz-request-id MVCNT4HJT8ZRN5VS via 1.1 varnish, 1.1 varnish cache-control max-age=7200 accept-ranges bytes content-type text/plain x-cache-hits 1, 153
GET H/1.1	200 OK	events.js Show response tags.srv.stackadapt.com/	13 KB 5 KB	682ms 177ms	Script text/javascript	3.223.38.51 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://tags.srv.stackadapt.com/events.js Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.223.38.51 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-223-38-51.compute-1.amazonaws.com Software / Resource Hash 06d69cb152abd844ee1c860d4f8dc8646131711b9ae5645597afa39ae15ea1e3 Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers Access-Control-Allow-Origin * Date Fri, 12 Nov 2021 06:30:32 GMT Content-Encoding gzip Cache-Control max-age=30 Content-Length 4438 Connection keep-alive Content-Type text/javascript
GET H/1.1	200 OK	up_loader.1.1.0.js Show response js.adsrvr.org/	4 KB 5 KB	21ms 3ms	Script application/x-javascript	13.35.45.57 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.adsrvr.org/up_loader.1.1.0.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-5L6H3LN&gtm_auth=d5XceCG5H_eblswmMfURjQ&gtm_preview=env-2&gtm_cookies_win=x Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 13.35.45.57 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-35-45-57.nrt20.r.cloudfront.net Software AmazonS3 / Resource Hash ee3a7301fe1e0c0f6bf6acff0d7a8d107f5cb3f62a2566740c0416d8e61f00b9 Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers Date Fri, 12 Nov 2021 06:20:16 GMT Via 1.1 9bf92639763e2dc7c1ea8eb4814a239e.cloudfront.net (CloudFront) Last-Modified Thu, 24 Sep 2020 15:15:34 GMT Server AmazonS3 Age 35993 ETag W/"98d98b3499058b76d58073cf8ede2f10" Vary Accept-Encoding X-Cache Hit from cloudfront Content-Type application/x-javascript Connection keep-alive X-Amz-Cf-Pop NRT20-C1 Accept-Ranges bytes Content-Length 4593 X-Amz-Cf-Id SxPQ23yKWW-kVAgkr-GxlJ_Xf1jX_UoxHSA0hwH4yf3UvzBzPuu95A==
GET H2	200	ytc.js Show response s.yimg.com/wi/	15 KB 6 KB	11ms 2ms	Script application/javascript	2406:2000:a4:9fe:: YAHOO-SG internet...
General Check archive.org Show headers Download Go to Full URL https://s.yimg.com/wi/ytc.js Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2406:2000:a4:9fe:: Tokyo, Japan, ASN10230 (YAHOO-SG internet content provider, SG), Reverse DNS Software ATS / Resource Hash 759d6f0c1292d86d24d7abe7ad9a2cd1d86df0041260f98186ccfa26c7daab62 Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers ats-carp-promotion 1 date Fri, 12 Nov 2021 06:06:52 GMT content-encoding gzip x-content-type-options nosniff age 1420 x-amz-server-side-encryption AES256 vary Origin, Accept-Encoding content-length 5652 x-amz-id-2 R77c8Uki6VNywA7ftp+PmNw7LXqPfM97LrermZEkpzKqqNTRrBuY/uSMStSx3Oq8b/Q7sjBMv2U= referrer-policy no-referrer-when-downgrade x-amz-expiration expiry-date="Sat, 10 Dec 2022 00:00:00 GMT", rule-id="oath-standard-lifecycle" last-modified Thu, 04 Nov 2021 15:26:13 GMT server ATS etag "146f99405588b7446958a732612c901d-df" expect-ct max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" strict-transport-security max-age=15552000 x-amz-request-id T5CDYC7QT28S64T1 x-xss-protection 1; mode=block cache-control public,max-age=3600 x-amz-version-id pCmRUUjnQE9zqMEfVdrNnyYpaPAyW8Do accept-ranges bytes content-type application/javascript
GET H2	200	334990480506518 Show response connect.facebook.net/signals/config/	305 KB 87 KB	3ms 3ms	Script application/x-javascript	2a03:2880:f00f:8:face:b00c:0:1 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/334990480506518?v=2.9.48&r=stable Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f00f:8:face:b00c:0:1 Tokyo, Japan, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash f3d1fc2626c6ea0973dee40f4ea950ab4b64b405302f3d96fe92088f219376a9 Security Headers Name Value Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers content-security-policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests; content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=3600,h3-29=":443"; ma=3600 content-length 88931 x-xss-protection 0 pragma public x-fb-debug SI6dIHwNSObFKKo7nAKEUxseFTWhnm8Ckd2/OAqTvfFH1NkydhCD6ABl4nbz2mSN2WkgSMfhguHapiUzAVKnXw== x-fb-trip-id 382461245 x-frame-options DENY cross-origin-opener-policy same-origin-allow-popups cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" date Fri, 12 Nov 2021 06:30:31 GMT strict-transport-security max-age=31536000; preload; includeSubDomains report-to {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"} content-type application/x-javascript; charset=utf-8 vary Accept-Encoding cache-control public, max-age=1200 x-fb-rlafr 0 priority u=3,i expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	adsct Show response analytics.twitter.com/i/	31 B 676 B	384ms 199ms	Script application/javascript	104.244.42.3 TWITTER
General Check archive.org Show headers Download Go to Full URL https://analytics.twitter.com/i/adsct?type=javascript&version=2.0.4&p_id=Twitter&p_user_id=0&txn_id=o4apa&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&event_id=108b9e01-9e3f-4d0b-9a0d-be7c309e7590&tw_document_href=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F11%2F11%2Fbazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism%2F&tpx_cb=twttr.conversion.loadPixels Requested by Host: static.ads-twitter.com URL: https://static.ads-twitter.com/uwt.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.244.42.3 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_m / Resource Hash df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf Security Headers Name Value Strict-Transport-Security max-age=631138519 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Fri, 12 Nov 2021 06:30:31 GMT content-encoding gzip x-content-type-options nosniff p3p CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" status 200 OK x-twitter-response-tags BouncerCompliant content-length 57 x-xss-protection 0 x-response-time 110 pragma no-cache last-modified Fri, 12 Nov 2021 06:30:31 GMT server tsa_m x-frame-options SAMEORIGIN strict-transport-security max-age=631138519 content-type application/javascript;charset=utf-8 cache-control no-cache, no-store, must-revalidate, pre-check=0, post-check=0 x-connection-hash 6933ea6b119c614d3786d404e9e11dd684cbea763e7fe159b8f987b47adf2e83 x-transaction ff7d8d0e1fe8274b expires Tue, 31 Mar 1981 05:00:00 GMT
GET H2	200	adsct t.co/i/	43 B 470 B	385ms 200ms	Image image/gif	104.244.42.197 TWITTER
General Check archive.org Show headers Download Go to Show image Full URL https://t.co/i/adsct?type=javascript&version=2.0.4&p_id=Twitter&p_user_id=0&txn_id=o4apa&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&event_id=108b9e01-9e3f-4d0b-9a0d-be7c309e7590&tw_document_href=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F11%2F11%2Fbazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism%2F Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.244.42.197 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_m / Resource Hash ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957 Security Headers Name Value Strict-Transport-Security max-age=0 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Fri, 12 Nov 2021 06:30:31 GMT content-encoding gzip x-content-type-options nosniff status 200 OK x-twitter-response-tags BouncerCompliant content-length 65 x-xss-protection 0 x-response-time 110 pragma no-cache last-modified Fri, 12 Nov 2021 06:30:31 GMT server tsa_m x-frame-options SAMEORIGIN strict-transport-security max-age=0 content-type image/gif;charset=utf-8 cache-control no-cache, no-store, must-revalidate, pre-check=0, post-check=0 x-connection-hash dcd0e4dea889e7f9d99dcc0d3fc8e89b75b1f1e9d725a9e6788dc9f4c90954de x-transaction d87134e20aace785 expires Tue, 31 Mar 1981 05:00:00 GMT
GET H2	200	10150886.json Show response s.yimg.com/wi/config/	2 B 484 B	174ms 171ms	XHR application/json	2406:2000:a4:9fe:: YAHOO-SG internet...
General Check archive.org Show headers Download Go to Full URL https://s.yimg.com/wi/config/10150886.json Requested by Host: s.yimg.com URL: https://s.yimg.com/wi/ytc.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2406:2000:a4:9fe:: Tokyo, Japan, ASN10230 (YAHOO-SG internet content provider, SG), Reverse DNS Software ATS / Resource Hash 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Fri, 12 Nov 2021 06:30:31 GMT content-encoding gzip x-content-type-options nosniff age 0 vary Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding x-amz-request-id 11MX2PDX3H5R3A42 x-amz-id-2 pEVgzQ6aOidkBeyOTe1Ev9skoDgrYB5zkwFZsSJ+2vmdoornH5rMQtnVOSRdcEZixlRBetl5YF8= referrer-policy no-referrer-when-downgrade server ATS expect-ct max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" strict-transport-security max-age=15552000 access-control-allow-methods GET content-type application/json access-control-allow-origin * x-xss-protection 1; mode=block cache-control public,max-age=3600 content-length 22
GET H/1.1	200 OK	pixel q.quora.com/_/ad/6bed874137d04358a290eecc797a0cd6/	43 B 421 B	740ms 185ms	Image image/gif	3.224.194.150 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://q.quora.com/_/ad/6bed874137d04358a290eecc797a0cd6/pixel?j=1&u=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F11%2F11%2Fbazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism%2F&tag=ViewContent&ts=1636698631487 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.224.194.150 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-224-194-150.compute-1.amazonaws.com Software nginx / Resource Hash 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers Date Fri, 12 Nov 2021 06:30:32 GMT Server nginx Connection keep-alive Content-Length 43 Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Q-Stat ,6c486420e7885868e0bce78e6155cc53,10.0.0.64,49388,45.87.213.61,,127392653167,1,1636698632.137,0.002,,.,0,0,0.004,0.004,-,0,0,197,236,118,10,26847,,,,,,-, Content-Type image/gif
GET H2	200	/ p.adsymptotic.com/d/px/ Redirect Chain https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1636698631487&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F11%2F11%2Fbazarloader-call-me-back-attack-abuses-windows-10-apps-mech... https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1636698631487&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F11%2F11%2Fbazarloader-call-me-back-attack-abuses-windows-10-apps-mech... https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D461060%26time%3D1636698631487%26url%3Dhttps%253A%252F%252Fnews.sophos.com%252Fen-... https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1636698631487&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F11%2F11%2Fbazarloader-call-me-back-attack-abuses-windows-10-apps-mech... https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1636698631487&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F11%2F11%2Fbazarloader-call-me-back-attack-abuses-windows-10-apps-mec... https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=71ff8cee-d8ea-41f7-b2e9-da4bfb13d6cd https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=71ff8cee-d8ea-41f7-b2e9-da4bfb13d6cd&_expected_cookie=1058ce76e09ce4a03a816b6f...	43 B 165 B	100ms 99ms	Image image/gif	104.18.99.194 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=71ff8cee-d8ea-41f7-b2e9-da4bfb13d6cd&_expected_cookie=1058ce76e09ce4a03a816b6f312900b9 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/ Protocol H2 Server 104.18.99.194 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Fri, 12 Nov 2021 06:30:33 GMT cf-cache-status DYNAMIC server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" cf-ray 6acdb6581cf534f3-NRT p3p CP='NON DSP COR CONi OUR BUS CNT' content-type image/gif content-length 43 Redirect headers location https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=71ff8cee-d8ea-41f7-b2e9-da4bfb13d6cd&_expected_cookie=1058ce76e09ce4a03a816b6f312900b9 date Fri, 12 Nov 2021 06:30:32 GMT cf-cache-status DYNAMIC server cloudflare cf-ray 6acdb6577bd634f3-NRT content-length 0 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
GET H2	200	/ www.facebook.com/tr/	44 B 408 B	14ms 3ms	Image image/gif	2a03:2880:f10f:83:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=334990480506518&ev=PageView&dl=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F11%2F11%2Fbazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism%2F&rl=&if=false&ts=1636698631502&sw=1600&sh=1200&v=2.9.48&r=stable&ec=0&o=30&fbp=fb.1.1636698631501.1725387802&it=1636698631474&coo=false&rqm=GET Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f10f:83:face:b00c:0:25de Tokyo, Japan, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash 10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Fri, 12 Nov 2021 06:30:31 GMT last-modified Fri, 21 Dec 2012 00:00:01 GMT server proxygen-bolt strict-transport-security max-age=31536000; includeSubDomains content-type image/gif cache-control no-cache, must-revalidate, max-age=0 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=3600, h3-29=":443"; ma=3600 content-length 44 expires Fri, 12 Nov 2021 06:30:31 GMT
GET H2	204	4015302.js Show response bat.bing.com/p/action/	0 93 B	38ms 38ms	Script text/plain	2620:1ec:c11::200 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://bat.bing.com/p/action/4015302.js Requested by Host: bat.bing.com URL: https://bat.bing.com/bat.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers access-control-allow-origin * date Fri, 12 Nov 2021 06:30:30 GMT cache-control private,max-age=1800 accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: 30E6717D5FCB4D068A3D84FC0F0A9801 Ref B: TYAEDGE1114 Ref C: 2021-11-12T06:30:31Z x-cache CONFIG_NOCACHE
GET H2	204	0 bat.bing.com/action/	0 150 B	37ms 37ms	Image text/plain	2620:1ec:c11::200 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://bat.bing.com/action/0?ti=4015302&Ver=2&mid=aab502f0-af50-4f26-9f6a-cda9561247db&sid=08dc3c70438211ec89a43bbbbcb607f3&vid=08dc6570438211ec88a5c3ec5932877b&vids=1&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=BazarLoader%20%E2%80%98call%20me%20back%E2%80%99%20attack%20abuses%20Windows%2010%20Apps%20mechanism%20%E2%80%93%20Sophos%20News&p=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F11%2F11%2Fbazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism%2F&r=&lt=388&evt=pageLoad&msclkid=N&sv=1&rn=844746 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers pragma no-cache date Fri, 12 Nov 2021 06:30:30 GMT accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: FC6368CCA9C048CDA90429EC3C789538 Ref B: TYAEDGE1114 Ref C: 2021-11-12T06:30:31Z x-cache CONFIG_NOCACHE access-control-allow-origin * cache-control no-cache, must-revalidate expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	conversion_async.js Show response www.googleadservices.com/pagead/	37 KB 15 KB	111ms 67ms	Script text/javascript	142.250.199.98 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googleadservices.com/pagead/conversion_async.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=AW-743773256 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.199.98 , United States, ASN15169 (GOOGLE, US), Reverse DNS nrt13s52-in-f2.1e100.net Software cafe / Resource Hash 4f84baa916f797921af359b333dc340ab665b913c483e1f252617eaf3b85de51 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Fri, 12 Nov 2021 06:30:31 GMT content-encoding gzip x-content-type-options nosniff p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 14382 x-xss-protection 0 server cafe etag 17333814607652124526 vary Accept-Encoding content-type text/javascript; charset=UTF-8 cache-control private, max-age=3600 timing-allow-origin * expires Fri, 12 Nov 2021 06:30:31 GMT
GET H2	200	ip.json Show response api.company-target.com/api/v2/	424 B 932 B	134ms 118ms	XHR application/json	13.35.49.104 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://api.company-target.com/api/v2/ip.json?referrer=&page=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F11%2F11%2Fbazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism%2F&page_title=BazarLoader%20%E2%80%98call%20me%20back%E2%80%99%20attack%20abuses%20Windows%2010%20Apps%20mechanism%20%E2%80%93%20Sophos%20News&src=tag&key=f2514e2223f271de300b1908c2c90c911bed78d7 Requested by Host: scripts.demandbase.com URL: https://scripts.demandbase.com/WuEFNglz.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.35.49.104 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-35-49-104.nrt20.r.cloudfront.net Software nginx / Resource Hash b920913b904a2f83c92c1824bb0ce2a3f7ec4e84d9f675ad9fb515c7af20fdb4 Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Fri, 12 Nov 2021 06:30:31 GMT identification-source CENTRAL vary Accept-Encoding, Origin x-amz-cf-pop NRT20-C1 x-cache Miss from cloudfront request-id ee6b54a7-59d3-41a4-b457-232785ee8631 content-encoding gzip pragma no-cache access-control-allow-origin https://news.sophos.com server nginx access-control-max-age 7200 access-control-allow-methods GET, POST, OPTIONS content-type application/json;charset=utf-8 via 1.1 175f6538265283354cce43337b053873.cloudfront.net (CloudFront) access-control-expose-headers cache-control no-cache, no-store, max-age=0, must-revalidate access-control-allow-credentials true api-version v2 access-control-allow-headers DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id hwc_0DZTvSl1oGcYauVTKmrsnM6eyYR_jZfcM6JmMKhjg7tHAxymGA== expires Thu, 11 Nov 2021 06:30:31 GMT
GET H/1.1	200 OK	validateCookie segments.company-target.com/ Redirect Chain https://match.prod.bidr.io/cookie-sync/demandbase https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1 https://segments.company-target.com/log?vendor=choca&user_id=AAlYmE7DHBQAADevXw5GNg https://segments.company-target.com/validateCookie?vendor=choca&user_id=AAlYmE7DHBQAADevXw5GNg&verifyHash=d21ffa894c12694c76c67c81b875a4746a8a1d20	26 B 409 B	149ms 148ms	Image image/gif	99.84.59.108 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://segments.company-target.com/validateCookie?vendor=choca&user_id=AAlYmE7DHBQAADevXw5GNg&verifyHash=d21ffa894c12694c76c67c81b875a4746a8a1d20 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/ Protocol HTTP/1.1 Server 99.84.59.108 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-99-84-59-108.nrt20.r.cloudfront.net Software / Resource Hash 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1 Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers Date Fri, 12 Nov 2021 06:30:31 GMT Via 1.1 f5ea107910388dd712f11441721cd0ae.cloudfront.net (CloudFront) X-Amz-Cf-Pop NRT20-C3 Vary Origin X-Cache Miss from cloudfront Content-Type image/gif Transfer-Encoding chunked Connection keep-alive trace-id f4fb49fead59ae95 X-Amz-Cf-Id mMY4ux7dYUjgURXSykK9MxcmfQvmKbPw4gwyItVbWKdLG08cDwHpIA== Redirect headers Date Fri, 12 Nov 2021 06:30:31 GMT Via 1.1 f5ea107910388dd712f11441721cd0ae.cloudfront.net (CloudFront) X-Amz-Cf-Pop NRT20-C3 Vary Origin X-Cache Miss from cloudfront Location /validateCookie?vendor=choca&user_id=AAlYmE7DHBQAADevXw5GNg&verifyHash=d21ffa894c12694c76c67c81b875a4746a8a1d20 Connection keep-alive trace-id ffd59a416ee22ad0 Content-Length 0 X-Amz-Cf-Id CLOriMm0FCYxe0rPcS-353TaMRGg9c-HwSqTpLfsxvxw_sKW_dR6Uw==
GET H/1.1	200 OK	log segments.company-target.com/ Redirect Chain https://id.rlcdn.com/464526.gif https://id.rlcdn.com/1000.gif?memo=CI6tHBoNCIeUuIwGEgUI6AcQAEIASgA https://segments.company-target.com/log?vendor=liveramp&user_id=Xc1297p-9excfoRP3AXx6lwMe4aaL3m2eh_s8-ySeagolz1jY	26 B 409 B	155ms 146ms	Image image/gif	99.84.59.108 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://segments.company-target.com/log?vendor=liveramp&user_id=Xc1297p-9excfoRP3AXx6lwMe4aaL3m2eh_s8-ySeagolz1jY Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/ Protocol HTTP/1.1 Server 99.84.59.108 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-99-84-59-108.nrt20.r.cloudfront.net Software / Resource Hash 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1 Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers Date Fri, 12 Nov 2021 06:30:31 GMT Via 1.1 079b91267decd177d506dbf353188710.cloudfront.net (CloudFront) X-Amz-Cf-Pop NRT20-C3 Vary Origin X-Cache Miss from cloudfront Content-Type image/gif Transfer-Encoding chunked Connection keep-alive trace-id 778e6d8f4084d846 X-Amz-Cf-Id wIJYgUXTJ-Ji46i2XmYuewlD_xq-rHufjTqQ2A2JQCe73Ufx2kYDsw== Redirect headers date Fri, 12 Nov 2021 06:30:31 GMT via 1.1 google p3p CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" location https://segments.company-target.com/log?vendor=liveramp&user_id=Xc1297p-9excfoRP3AXx6lwMe4aaL3m2eh_s8-ySeagolz1jY cache-control no-cache, no-store timing-allow-origin * alt-svc clear content-length 0
GET H2	200	ga-audiences www.google.co.jp/ads/ Redirect Chain https://stats.g.doubleclick.net/r/__utm.gif?utmwv=5.7.2dc&utms=1&utmn=364191406&utmhn=news.sophos.com&utme=8(4!CampaignID)9(4!70130000001xKqzAAE)&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=2... https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=94060615.1636698632&jid=454681740&_v=5.7.2dc&z=364191406 https://www.google.co.jp/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=94060615.1636698632&jid=454681740&_v=5.7.2dc&z=364191406&slf_rd=1&random=4046871887	42 B 501 B	86ms 42ms	Image image/gif	2404:6800:4004:81f::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.co.jp/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=94060615.1636698632&jid=454681740&_v=5.7.2dc&z=364191406&slf_rd=1&random=4046871887 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/ Protocol H2 Server 2404:6800:4004:81f::2003 , Australia, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers pragma no-cache date Fri, 12 Nov 2021 06:30:31 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT Redirect headers pragma no-cache date Fri, 12 Nov 2021 06:30:31 GMT x-content-type-options nosniff server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" content-type text/html; charset=UTF-8 location https://www.google.co.jp/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=94060615.1636698632&jid=454681740&_v=5.7.2dc&z=364191406&slf_rd=1&random=4046871887 cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	__utm.gif stats.g.doubleclick.net/r/	35 B 111 B	49ms 49ms	Image image/gif	2404:6800:4008:c04::9d GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://stats.g.doubleclick.net/r/__utm.gif?utmwv=5.7.2dc&utms=1&utmn=661176472&utmhn=news.sophos.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=BazarLoader%20%E2%80%98call%20me%20back%E2%80%99%20attack%20abuses%20Windows%2010%20Apps%20mechanism%20%E2%80%93%20Sophos%20News&utmhid=1503263714&utmr=-&utmp=%2Fen-us%2F2021%2F11%2F11%2Fbazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism%2F&utmht=1636698631612&utmac=UA-737537-53&utmcc=__utma%3D204943247.784053081.1636698632.1636698632.1636698632.1%3B%2B__utmz%3D204943247.1636698632.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=1256515314&utmredir=3&utmmt=1&utmu=q1CgAAAAAAAAAAAAAAAAAAgE~ Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2404:6800:4008:c04::9d Taipei, Taiwan, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers pragma no-cache strict-transport-security max-age=10886400; includeSubDomains; preload x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 date Fri, 12 Nov 2021 06:30:31 GMT content-type image/gif access-control-allow-origin * cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 35 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/743773256/	3 KB 2 KB	95ms 42ms	Script text/javascript	2404:6800:4004:81c::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/743773256/?random=1636698631645&cv=9&fst=1636698631645&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oaba1&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F11%2F11%2Fbazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism%2F&tiba=BazarLoader%20%E2%80%98call%20me%20back%E2%80%99%20attack%20abuses%20Windows%2010%20Apps%20mechanism%20%E2%80%93%20Sophos%20News&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4 Requested by Host: www.googleadservices.com URL: https://www.googleadservices.com/pagead/conversion_async.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2404:6800:4004:81c::2002 , Australia, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash aecf15235be67ebf1446bb65d95fddf466dda687f65f29b45e5515a83afaa8d9 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers pragma no-cache date Fri, 12 Nov 2021 06:30:31 GMT content-encoding gzip x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type text/javascript; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1123 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	sp.pl sp.analytics.yahoo.com/	43 B 964 B	224ms 73ms	Image image/gif	106.10.236.146 YAHOO-SG3 interne...
General Check archive.org Show headers Download Go to Show image Full URL https://sp.analytics.yahoo.com/sp.pl?a=10000&d=Fri%2C%2012%20Nov%202021%2006%3A30%3A31%20GMT&n=0&b=BazarLoader%20%E2%80%98call%20me%20back%E2%80%99%20attack%20abuses%20Windows%2010%20Apps%20mechanism%20%E2%80%93%20Sophos%20News&.yp=10150886&f=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F11%2F11%2Fbazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism%2F&enc=UTF-8&yv=1.10.2&tagmgr=gtm Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 106.10.236.146 Singapore, Singapore, ASN56173 (YAHOO-SG3 internet content provider, SG), Reverse DNS spdc.pbp.vip.sg3.yahoo.com Software ATS / Resource Hash 0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 1; mode=block Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers Date Fri, 12 Nov 2021 06:30:31 GMT X-Content-Type-Options nosniff Age 0 Connection keep-alive Content-Length 43 X-XSS-Protection 1; mode=block Pragma no-cache Referrer-Policy strict-origin-when-cross-origin Server ATS X-Frame-Options DENY Expect-CT max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" Strict-Transport-Security max-age=31536000 Content-Type image/gif Cache-Control no-cache, private, must-revalidate Accept-Ranges bytes Expires Fri, 12 Nov 2021 06:30:31 GMT
GET H2	200	/ www.google.com/pagead/1p-user-list/743773256/	42 B 165 B	46ms 45ms	Image image/gif	2404:6800:4004:80e::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/743773256/?random=1636698631645&cv=9&fst=1636696800000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oaba1&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F11%2F11%2Fbazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism%2F&tiba=BazarLoader%20%E2%80%98call%20me%20back%E2%80%99%20attack%20abuses%20Windows%2010%20Apps%20mechanism%20%E2%80%93%20Sophos%20News&async=1&fmt=3&is_vtc=1&random=250957219&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2404:6800:4004:80e::2004 , Australia, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers pragma no-cache date Fri, 12 Nov 2021 06:30:31 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-security-policy script-src 'none'; object-src 'none' content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.co.jp/pagead/1p-user-list/743773256/	42 B 154 B	95ms 44ms	Image image/gif	2404:6800:4004:81f::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.co.jp/pagead/1p-user-list/743773256/?random=1636698631645&cv=9&fst=1636696800000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oaba1&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F11%2F11%2Fbazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism%2F&tiba=BazarLoader%20%E2%80%98call%20me%20back%E2%80%99%20attack%20abuses%20Windows%2010%20Apps%20mechanism%20%E2%80%93%20Sophos%20News&async=1&fmt=3&is_vtc=1&random=250957219&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2404:6800:4004:81f::2003 , Australia, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers pragma no-cache date Fri, 12 Nov 2021 06:30:31 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-security-policy script-src 'none'; object-src 'none' content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.facebook.com/tr/	44 B 147 B	5ms 3ms	Image image/gif	2a03:2880:f10f:83:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=334990480506518&ev=Microdata&dl=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F11%2F11%2Fbazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism%2F&rl=&if=false&ts=1636698632010&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22BazarLoader%20%E2%80%98call%20me%20back%E2%80%99%20attack%20abuses%20Windows%2010%20Apps%20mechanism%20%E2%80%93%20Sophos%20News%22%7D&cd[OpenGraph]=%7B%22og%3Atype%22%3A%22article%22%2C%22og%3Atitle%22%3A%22BazarLoader%20%E2%80%98call%20me%20back%E2%80%99%20attack%20abuses%20Windows%2010%20Apps%20mechanism%22%2C%22og%3Aurl%22%3A%22https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F11%2F11%2Fbazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism%2F%22%2C%22og%3Adescription%22%3A%22The%20unusual%20technique%20invokes%20the%20Windows%20App%20Installer%20to%20deliver%20malware%22%2C%22article%3Apublished_time%22%3A%222021-11-11T12%3A30%3A49%2B00%3A00%22%2C%22article%3Amodified_time%22%3A%222021-11-11T03%3A59%3A57%2B00%3A00%22%2C%22og%3Asite_name%22%3A%22Sophos%20News%22%2C%22og%3Aimage%22%3A%22https%3A%2F%2Fnews.sophos.com%2Fwp-content%2Fuploads%2F2021%2F11%2Fangrykitten2.png%3Fw%3D640%22%2C%22og%3Aimage%3Asecure_url%22%3A%22https%3A%2F%2Fnews.sophos.com%2Fwp-content%2Fuploads%2F2021%2F11%2Fangrykitten2.png%3Fw%3D640%22%2C%22og%3Aimage%3Awidth%22%3A%22640%22%2C%22og%3Aimage%3Aheight%22%3A%22359%22%2C%22og%3Alocale%22%3A%22en_US%22%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.48&r=stable&ec=1&o=30&fbp=fb.1.1636698631501.1725387802&it=1636698631474&coo=false&es=automatic&tm=3&rqm=GET Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f10f:83:face:b00c:0:25de Tokyo, Japan, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash 10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Fri, 12 Nov 2021 06:30:32 GMT last-modified Fri, 21 Dec 2012 00:00:01 GMT server proxygen-bolt strict-transport-security max-age=31536000; includeSubDomains content-type image/gif cache-control no-cache, must-revalidate, max-age=0 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=3600, h3-29=":443"; ma=3600 content-length 44 expires Fri, 12 Nov 2021 06:30:32 GMT
GET H/1.1	200 OK	sa.css tags.srv.stackadapt.com/	65 B 292 B	167ms 166ms	Stylesheet text/css	3.223.38.51 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://tags.srv.stackadapt.com/sa.css Requested by Host: tags.srv.stackadapt.com URL: https://tags.srv.stackadapt.com/events.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.223.38.51 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-223-38-51.compute-1.amazonaws.com Software / Resource Hash eefd56366a7333dcc96e11523adbf5dde37406fdae035af6642428ea4c67c0a6 Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers Access-Control-Allow-Origin * Date Fri, 12 Nov 2021 06:30:32 GMT Cache-Control only-if-cached, no-transform, private, max-age=7776000 Connection keep-alive Content-Length 65 Content-Type text/css
GET H/1.1	200 OK	sa.jpeg Show response tags.srv.stackadapt.com/	0 881 B	672ms 168ms	Fetch image/jpeg	3.223.38.51 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://tags.srv.stackadapt.com/sa.jpeg Requested by Host: tags.srv.stackadapt.com URL: https://tags.srv.stackadapt.com/events.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.223.38.51 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-223-38-51.compute-1.amazonaws.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers Access-Control-Allow-Origin * Date Fri, 12 Nov 2021 06:30:32 GMT Cache-Control only-if-cached, no-transform, private, max-age=7776000 Connection keep-alive Content-Length 651 Content-Type image/jpeg
GET H/1.1	200 OK	saq_pxl Show response tags.srv.stackadapt.com/	94 B 397 B	167ms 167ms	XHR text/plain	3.223.38.51 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://tags.srv.stackadapt.com/saq_pxl?uid=uxMvfKEouJZfJzsjwRVn_Q&is_js=true&landing_url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F11%2F11%2Fbazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism%2F&t=BazarLoader%20%E2%80%98call%20me%20back%E2%80%99%20attack%20abuses%20Windows%2010%20Apps%20mechanism%20%E2%80%93%20Sophos%20News&host=https://news.sophos.com Requested by Host: tags.srv.stackadapt.com URL: https://tags.srv.stackadapt.com/events.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.223.38.51 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-223-38-51.compute-1.amazonaws.com Software / Resource Hash 078f3dd88e751c3c421b2007e1cb27bcb65a95daf278bd25de81ba7b2bf3c4e4 Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://news.sophos.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers Date Fri, 12 Nov 2021 06:30:32 GMT Access-Control-Allow-Methods GET Content-Type text/plain; charset=utf-8 Access-Control-Allow-Origin https://news.sophos.com Access-Control-Allow-Credentials true Connection keep-alive Access-Control-Allow-Headers * Content-Length 94
GET H2	200	/ Show response match.adsrvr.org/track/upb/ Frame FE9B Redirect Chain https://insight.adsrvr.org/track/up?adv=j022xlj&ref=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F11%2F11%2Fbazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism%2F&upid=ql4fc2b&upv=1.1.0 https://match.adsrvr.org/track/upb/?adv=j022xlj&ref=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F11%2F11%2Fbazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism%2F&upid=ql4fc2b&upv=1.1.0	916 B 1 KB	26ms 24ms	Document text/html	52.223.40.198 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://match.adsrvr.org/track/upb/?adv=j022xlj&ref=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F11%2F11%2Fbazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism%2F&upid=ql4fc2b&upv=1.1.0 Requested by Host: js.adsrvr.org URL: https://js.adsrvr.org/up_loader.1.1.0.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.223.40.198 , United States, ASN16509 (AMAZON-02, US), Reverse DNS a6370ebea231e0c9a.awsglobalaccelerator.com Software / Resource Hash 67b8d91d68eca31df27f5a7c9464c8d4f1637d3948bcc4a1868b18598b574319 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Accept-Language jp-JP,jp;q=0.9 Referer https://news.sophos.com/ Response headers date Fri, 12 Nov 2021 06:30:33 GMT content-type text/html; charset=utf-8 cache-control private,no-cache, must-revalidate pragma no-cache x-aspnet-version 4.0.30319 p3p CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV" Redirect headers date Fri, 12 Nov 2021 06:30:33 GMT content-type text/html; charset=utf-8 location https://match.adsrvr.org/track/upb/?adv=j022xlj&ref=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F11%2F11%2Fbazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism%2F&upid=ql4fc2b&upv=1.1.0 cache-control private,no-cache, must-revalidate pragma no-cache x-aspnet-version 4.0.30319 p3p CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
GET H/1.1	200 OK	universal_pixel.1.1.0.js Show response js.adsrvr.org/ Frame FE9B	487 B 964 B	27ms 27ms	Script application/x-javascript	13.35.45.57 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.adsrvr.org/universal_pixel.1.1.0.js Requested by Host: match.adsrvr.org URL: https://match.adsrvr.org/track/upb/?adv=j022xlj&ref=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F11%2F11%2Fbazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism%2F&upid=ql4fc2b&upv=1.1.0 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 13.35.45.57 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-35-45-57.nrt20.r.cloudfront.net Software AmazonS3 / Resource Hash f6d7e9dafd1ec463ecd0c6b20f170400dd15afe81c71dea50771550df2f83ffc Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://match.adsrvr.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers Date Thu, 11 Nov 2021 19:00:02 GMT Via 1.1 9bf92639763e2dc7c1ea8eb4814a239e.cloudfront.net (CloudFront) Last-Modified Thu, 24 Sep 2020 15:15:32 GMT Server AmazonS3 Age 41432 ETag "f0a7a3296da7382ce6bc1a3b6769e927" X-Cache Hit from cloudfront Content-Type application/x-javascript Connection keep-alive X-Amz-Cf-Pop NRT20-C1 Accept-Ranges bytes Content-Length 487 X-Amz-Cf-Id 9HwziBI4u2f8KaSIR8y9P448N91iC5eYhju6KXnmCUNYswEb7PGesg==
GET H2	200	rubicon Show response match.adsrvr.org/track/cmf/ Frame 969B Redirect Chain https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=c2284dcc-e298-4113-8477-711236015e20&gdpr=0&gdpr_consent=&expires=30&next=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Frubicon https://match.adsrvr.org/track/cmf/rubicon?gdpr=0	70 B 586 B	8ms 7ms	Document image/gif	52.223.40.198 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://match.adsrvr.org/track/cmf/rubicon?gdpr=0 Requested by Host: js.adsrvr.org URL: https://js.adsrvr.org/universal_pixel.1.1.0.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.223.40.198 , United States, ASN16509 (AMAZON-02, US), Reverse DNS a6370ebea231e0c9a.awsglobalaccelerator.com Software / Resource Hash 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Accept-Language jp-JP,jp;q=0.9 Referer https://match.adsrvr.org/ Response headers date Fri, 12 Nov 2021 06:30:33 GMT content-type image/gif content-length 70 cache-control private,no-cache, must-revalidate pragma no-cache x-aspnet-version 4.0.30319 p3p CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV" Redirect headers P3P CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT" Pragma no-cache Cache-Control no-cache,no-store,must-revalidate Expires 0 X-RPHost 0963d041a95f271fbba7f411adc03573 Location https://match.adsrvr.org/track/cmf/rubicon?gdpr=0 Content-Type text/html content-length 0
GET H2	204	sync ups.analytics.yahoo.com/ups/55953/ Frame 67F3	0 0	99ms 31ms	Document text/plain	18.178.22.21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://ups.analytics.yahoo.com/ups/55953/sync?uid=c2284dcc-e298-4113-8477-711236015e20&_origin=1&gdpr=0&gdpr_consent= Requested by Host: js.adsrvr.org URL: https://js.adsrvr.org/universal_pixel.1.1.0.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 18.178.22.21 Tokyo, Japan, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-178-22-21.ap-northeast-1.compute.amazonaws.com Software ATS/9.1.0.33 / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Accept-Language jp-JP,jp;q=0.9 Referer https://match.adsrvr.org/ Response headers date Fri, 12 Nov 2021 06:30:33 GMT strict-transport-security max-age=31536000 p3p CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV age 0 server ATS/9.1.0.33
GET H2	200	google Show response match.adsrvr.org/track/cmf/ Frame 0603 Redirect Chain https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm&google_sc&google_hm=YzIyODRkY2MtZTI5OC00MTEzLTg0NzctNzExMjM2MDE1ZTIw&gdpr=0&gdpr_consent=&ttd_tdid=c2284dcc-e298-4113-8477-71123... https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=c2284dcc-e298-4113-8477-711236015e20&google_gid=CAESELYGH9dabozSDk-UDecIk4M&google_cver=1	70 B 586 B	11ms 11ms	Document image/gif	52.223.40.198 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=c2284dcc-e298-4113-8477-711236015e20&google_gid=CAESELYGH9dabozSDk-UDecIk4M&google_cver=1 Requested by Host: js.adsrvr.org URL: https://js.adsrvr.org/universal_pixel.1.1.0.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.223.40.198 , United States, ASN16509 (AMAZON-02, US), Reverse DNS a6370ebea231e0c9a.awsglobalaccelerator.com Software / Resource Hash 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Accept-Language jp-JP,jp;q=0.9 Referer https://match.adsrvr.org/ Response headers date Fri, 12 Nov 2021 06:30:33 GMT content-type image/gif content-length 70 cache-control private,no-cache, must-revalidate pragma no-cache x-aspnet-version 4.0.30319 p3p CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV" Redirect headers p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" location https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=c2284dcc-e298-4113-8477-711236015e20&google_gid=CAESELYGH9dabozSDk-UDecIk4M&google_cver=1 date Fri, 12 Nov 2021 06:30:33 GMT pragma no-cache expires Fri, 01 Jan 1990 00:00:00 GMT cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type text/html; charset=UTF-8 server HTTP server (unknown) content-length 386 x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"