www.threatdown.com Open in urlscan Pro
192.0.66.84 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/
Submission: On October 02 via api (October 2nd 2024, 2:10:57 am UTC) from TR — Scanned from DE

Summary HTTP 96 Redirects Links 13 Behaviour Indicators

Summary

This website contacted 26 IPs in 4 countries across 19 domains to perform 96 HTTP transactions. The main IP is 192.0.66.84, located in San Francisco, United States and belongs to AUTOMATTIC, US. The main domain is www.threatdown.com.
TLS certificate: Issued by E5 on August 8th 2024. Valid for: 3 months.

This is the only time www.threatdown.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
35	192.0.66.84 192.0.66.84	2635 (AUTOMATTIC) (AUTOMATTIC)
1	2a00:1450:400... 2a00:1450:4001:829::200a	15169 (GOOGLE) (GOOGLE)
4	104.17.74.206 104.17.74.206	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	192.0.76.3 192.0.76.3	2635 (AUTOMATTIC) (AUTOMATTIC)
10	34.96.102.137 34.96.102.137	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2	2a00:1450:400... 2a00:1450:4001:80f::2008	15169 (GOOGLE) (GOOGLE)
4	142.250.186.35 142.250.186.35	15169 (GOOGLE) (GOOGLE)
1	172.64.149.114 172.64.149.114	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	34.197.248.129 34.197.248.129	14618 (AMAZON-AES) (AMAZON-AES)
12	2606:4700::68... 2606:4700::6812:572a	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	18.245.86.14 18.245.86.14	16509 (AMAZON-02) (AMAZON-02)
1	104.18.39.181 104.18.39.181	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	18.245.46.25 18.245.46.25	16509 (AMAZON-02) (AMAZON-02)
1	104.17.72.206 104.17.72.206	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	108.138.26.31 108.138.26.31	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700:440... 2606:4700:4400::6812:2089	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	34.96.71.22 34.96.71.22	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	35.244.174.68 35.244.174.68	15169 (GOOGLE) (GOOGLE)
2	18.66.102.75 18.66.102.75	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:272... 2600:9000:2724:9000:1d:8d6d:3b40:93a1	16509 (AMAZON-02) (AMAZON-02)
1	35.194.81.74 35.194.81.74	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	2001:4860:480... 2001:4860:4802:34::36	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c1f::9c	15169 (GOOGLE) (GOOGLE)
1	142.250.185.163 142.250.185.163	15169 (GOOGLE) (GOOGLE)
2	18.245.86.77 18.245.86.77	16509 (AMAZON-02) (AMAZON-02)
96	26

35 192.0.66.84 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)

www.threatdown.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:829::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 104.17.74.206 (None, )

ASN13335 (CLOUDFLARENET, US)

go.malwarebytes.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 192.0.76.3 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)

stats.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 34.96.102.137 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 137.102.96.34.bc.googleusercontent.com

dev.visualwebsiteoptimizer.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80f::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.250.186.35 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f3.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.64.149.114 (San Francisco, United States)

ASN13335 (CLOUDFLARENET, US)

api.weglot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.197.248.129 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-197-248-129.compute-1.amazonaws.com

api.ipstack.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2606:4700::6812:572a (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.cookielaw.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.245.86.14 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-245-86-14.fra60.r.cloudfront.net

js.driftt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.18.39.181 (None, )

ASN13335 (CLOUDFLARENET, US)

185c650ccfd84b27aad189f19681365b.js.ubembed.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 18.245.46.25 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-245-46-25.fra56.r.cloudfront.net

tag.demandbase.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.17.72.206 (None, )

ASN13335 (CLOUDFLARENET, US)

go.malwarebytes.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.138.26.31 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-138-26-31.fra56.r.cloudfront.net

assets.ubembed.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::6812:2089 (United States)

ASN13335 (CLOUDFLARENET, US)

geolocation.onetrust.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.96.71.22 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 22.71.96.34.bc.googleusercontent.com

s.company-target.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.244.174.68 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 68.174.244.35.bc.googleusercontent.com

id.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.66.102.75 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-102-75.fra56.r.cloudfront.net

api.company-target.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2724:9000:1d:8d6d:3b40:93a1 (United States)

ASN16509 (AMAZON-02, US)

tag-logger.demandbase.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.194.81.74 (Washington, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 74.81.194.35.bc.googleusercontent.com

r3.visualwebsiteoptimizer.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:34::36 (United States)

ASN15169 (GOOGLE, US)

region1.analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c1f::9c (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.163 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s51-in-f3.1e100.net

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.245.86.77 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-245-86-77.fra60.r.cloudfront.net

js.driftt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
35	threatdown.com www.threatdown.com	851 KB
12	cookielaw.org cdn.cookielaw.org — Cisco Umbrella Rank: 351	161 KB
11	visualwebsiteoptimizer.com dev.visualwebsiteoptimizer.com — Cisco Umbrella Rank: 3476 r3.visualwebsiteoptimizer.com — Cisco Umbrella Rank: 64589	138 KB
5	malwarebytes.com go.malwarebytes.com	71 KB
4	demandbase.com tag.demandbase.com — Cisco Umbrella Rank: 6838 tag-logger.demandbase.com — Cisco Umbrella Rank: 6070	78 KB
4	gstatic.com fonts.gstatic.com	73 KB
4	wp.com stats.wp.com — Cisco Umbrella Rank: 3846 pixel.wp.com — Cisco Umbrella Rank: 3792	8 KB
3	company-target.com s.company-target.com — Cisco Umbrella Rank: 1696 api.company-target.com — Cisco Umbrella Rank: 4976	3 KB
3	driftt.com js.driftt.com — Cisco Umbrella Rank: 7595	62 KB
2	ubembed.com 185c650ccfd84b27aad189f19681365b.js.ubembed.com assets.ubembed.com — Cisco Umbrella Rank: 13982	50 KB
2	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 57	216 KB
1	google.de www.google.de — Cisco Umbrella Rank: 9833	63 B
1	doubleclick.net stats.g.doubleclick.net — Cisco Umbrella Rank: 152	556 B
1	google.com region1.analytics.google.com — Cisco Umbrella Rank: 4111
1	rlcdn.com id.rlcdn.com — Cisco Umbrella Rank: 891	98 B
1	onetrust.com geolocation.onetrust.com — Cisco Umbrella Rank: 550	315 B
1	ipstack.com api.ipstack.com — Cisco Umbrella Rank: 27555	2 KB
1	weglot.com api.weglot.com — Cisco Umbrella Rank: 25838	2 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 46	1 KB
96	19

	Domain	Requested by
35	www.threatdown.com	www.threatdown.com
12	cdn.cookielaw.org	www.threatdown.com cdn.cookielaw.org dev.visualwebsiteoptimizer.com
10	dev.visualwebsiteoptimizer.com	www.threatdown.com dev.visualwebsiteoptimizer.com
5	go.malwarebytes.com	www.threatdown.com go.malwarebytes.com
4	fonts.gstatic.com	fonts.googleapis.com
3	tag.demandbase.com	www.threatdown.com tag.demandbase.com
3	js.driftt.com	www.threatdown.com js.driftt.com
2	api.company-target.com	tag.demandbase.com dev.visualwebsiteoptimizer.com
2	pixel.wp.com	www.threatdown.com
2	www.googletagmanager.com	www.threatdown.com www.googletagmanager.com
2	stats.wp.com	www.threatdown.com
1	www.google.de	www.threatdown.com
1	stats.g.doubleclick.net	www.googletagmanager.com
1	region1.analytics.google.com	dev.visualwebsiteoptimizer.com
1	r3.visualwebsiteoptimizer.com	dev.visualwebsiteoptimizer.com
1	tag-logger.demandbase.com	dev.visualwebsiteoptimizer.com
1	id.rlcdn.com	www.threatdown.com
1	s.company-target.com	tag.demandbase.com
1	geolocation.onetrust.com	cdn.cookielaw.org
1	assets.ubembed.com	185c650ccfd84b27aad189f19681365b.js.ubembed.com
1	185c650ccfd84b27aad189f19681365b.js.ubembed.com	www.googletagmanager.com
1	api.ipstack.com	www.threatdown.com
1	api.weglot.com	www.threatdown.com
1	fonts.googleapis.com	www.threatdown.com
96	24

This site contains links to these domains. Also see Links.

Domain
cloud.threatdown.com
oneview.malwarebytes.com
partners.malwarebytes.com
support.threatdown.com
www.malwarebytes.com
www.linkedin.com
twitter.com
jetpack.com
www.onetrust.com

Subject Issuer	Validity	Valid
www.threatdown.com E5	`2024-08-08` - `2024-11-06`	3 months	crt.sh
upload.video.google.com WR2	`2024-09-16` - `2024-12-09`	3 months	crt.sh
go.malwarebytes.com Cloudflare Inc ECC CA-3	`2024-03-10` - `2024-12-31`	10 months	crt.sh
*.wp.com Sectigo ECC Domain Validation Secure Server CA	`2023-11-28` - `2024-12-28`	a year	crt.sh
*.visualwebsiteoptimizer.com Starfield Secure Certificate Authority - G2	`2024-06-29` - `2025-07-31`	a year	crt.sh
*.google-analytics.com WR2	`2024-09-16` - `2024-12-09`	3 months	crt.sh
*.gstatic.com WR2	`2024-09-16` - `2024-12-09`	3 months	crt.sh
api.weglot.com WE1	`2024-08-29` - `2024-11-27`	3 months	crt.sh
apilayer.net Amazon RSA 2048 M02	`2024-07-03` - `2025-08-01`	a year	crt.sh
cookielaw.org WE1	`2024-08-13` - `2024-11-11`	3 months	crt.sh
drift.com Amazon RSA 2048 M03	`2024-07-30` - `2025-08-27`	a year	crt.sh
*.js.ubembed.com E6	`2024-08-09` - `2024-11-07`	3 months	crt.sh
tag.demandbase.com Go Daddy Secure Certificate Authority - G2	`2024-08-27` - `2025-09-28`	a year	crt.sh
assets.ubembed.com Amazon RSA 2048 M03	`2023-12-06` - `2025-01-03`	a year	crt.sh
geolocation.onetrust.com WE1	`2024-08-13` - `2024-11-11`	3 months	crt.sh
*.company-target.com R11	`2024-08-15` - `2024-11-13`	3 months	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2024-02-06` - `2025-03-05`	a year	crt.sh
api.demandbase.com Go Daddy Secure Certificate Authority - G2	`2024-08-13` - `2025-09-14`	a year	crt.sh
*.demandbase.com Amazon RSA 2048 M02	`2024-06-10` - `2025-07-08`	a year	crt.sh
*.g.doubleclick.net WR2	`2024-08-26` - `2024-11-18`	3 months	crt.sh
*.google.de WR2	`2024-09-16` - `2024-12-09`	3 months	crt.sh

This page contains 5 frames:

Primary Page: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/
Frame ID: 8CA6E116AE21E42D0A6089C30856D607
Requests: 91 HTTP requests in this frame

Frame: https://go.malwarebytes.com/index.php/form/XDFrame
Frame ID: B85F3A21D80234C54F83EBA45654FA3D
Requests: 1 HTTP requests in this frame

Frame: https://s.company-target.com/s/sync?exc=lr
Frame ID: EB0DF539D0C802D96F9D51D4D5C22B18
Requests: 1 HTTP requests in this frame

Frame: https://js.driftt.com/core?d=1&embedId=7ghicgw4nish&eId=7ghicgw4nish&region=US&forceShow=false&skipCampaigns=false&sessionId=b358b652-219b-4044-b164-84299010c696&sessionStarted=1727835053.759&campaignRefreshToken=74c00028-9433-4c64-b99a-da2f6bc6d469&hideController=false&pageLoadStartTime=1727835052071&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.threatdown.com%2Fblog%2Fwatch-out-mobidash-android-adware-spread-through-phishing-and-online-links%2F
Frame ID: 76FDB4D856B1F21959B73843207CC033
Requests: 1 HTTP requests in this frame

Frame: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1727835052071
Frame ID: 73C12E453D3DC47549BB09FEFDA8D816
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Watch out! Mobidash Android adware spread through phishing and online links - ThreatDown by Malwarebytes

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

Unbounce (Editors) Expand

Overall confidence: 100%
Detected patterns

ubembed\.com

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js

OneTrust (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

cdn\.cookielaw\.org
otSDKStub\.js

Weglot (Miscellaneous) Expand

Overall confidence: 100%
Detected patterns

wp-content/plugins/weglot

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

96
Requests

97 %
HTTPS

28 %
IPv6

19
Domains

24
Subdomains

26
IPs

4
Countries

1747 kB
Transfer

4616 kB
Size

23
Cookies

13 Outgoing links

These are links going to different origins than the main page.

URL: https://cloud.threatdown.com/auth/login
Title: Nebula sign in

Search URL Search Domain Scan URL

URL: https://oneview.malwarebytes.com/auth/login
Title: OneView sign in

Search URL Search Domain Scan URL

URL: https://partners.malwarebytes.com/English/
Title: Partner Portal sign in

Search URL Search Domain Scan URL

URL: https://support.threatdown.com/hc/en-us
Title: Nebula Support

Search URL Search Domain Scan URL

URL: https://support.threatdown.com/hc/en-us/p/oneview
Title: OneView Support

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/blog/detections/android-adware-mobidash
Title: MobiDash adware for Android

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/threatdown.com/about/

Search URL Search Domain Scan URL

URL: https://twitter.com/threat_down

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/resources/
Title: Resources

Search URL Search Domain Scan URL

URL: https://support.threatdown.com/
Title: Support

Search URL Search Domain Scan URL

URL: https://jetpack.com/upgrade/search/?utm_source=poweredby
Title: Search powered by Jetpack

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/legal/privacy-policy
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://www.onetrust.com/products/cookie-consent/

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

96 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/ 132 KB
25 KB 134ms
40ms Document
text/html 192.0.66.84
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.66.84 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx / WordPress VIP <https://wpvip.com>
Resource Hash: 5fdbbc5a54538597b95c74b6d225177b81e592b918749ce476cc4aeaf0bb6640

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=300, must-revalidate
content-encoding: br
content-type: text/html; charset=UTF-8
date: Wed, 02 Oct 2024 02:10:51 GMT
host-header: a9130478a60e5f9135f765b23f26593b
link: <https://www.threatdown.com/api/>; rel="https://api.w.org/" <https://www.threatdown.com/api/wp/v2/posts/113414>; rel="alternate"; title="JSON"; type="application/json" <https://www.threatdown.com/?p=113414>; rel=shortlink
server: nginx
vary: Accept-Encoding
x-cache: HIT
x-hacker: If you're reading this, you should visit wpvip.com/careers and apply to join the fun, mention this header.
x-powered-by: WordPress VIP <https://wpvip.com>
x-rq: hhn1 111 253 443

GET
H2 200 style.min.css
www.threatdown.com/wp-includes/css/dist/block-library/ 110 KB
15 KB 45ms
43ms Stylesheet
text/css 192.0.66.84
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://www.threatdown.com/wp-includes/css/dist/block-library/style.min.css?m=1725982252g
Requested by: Host: www.threatdown.com
URL: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.66.84 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: fb3a89cc6347e098063bd15f285bc90411846ddce6f17812364feedab67a67f5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/

Response headers

cache-control: max-age=31536000
content-encoding: br
x-rq: hhn1 111 253 443
etag: W/"66e0662c-1b72b"
accept-ranges: bytes
x-cache: HIT
date: Wed, 02 Oct 2024 02:10:52 GMT
content-type: text/css
last-modified: Tue, 10 Sep 2024 15:30:52 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 style-index.css
www.threatdown.com/wp-content/plugins/td-blocks-plugin/build/blocks/content-card-block/ 1 KB
577 B 45ms
44ms Stylesheet
text/css 192.0.66.84
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://www.threatdown.com/wp-content/plugins/td-blocks-plugin/build/blocks/content-card-block/style-index.css?m=1719347935g
Requested by: Host: www.threatdown.com
URL: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.66.84 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 8227f3613cc8587b97ee185581b4be37a71e377b381a695bcd5e58439fcbbf03

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/

Response headers

cache-control: max-age=31536000
content-encoding: br
x-rq: hhn1 111 253 443
etag: W/"667b2adf-4b4"
accept-ranges: bytes
x-cache: HIT
date: Wed, 02 Oct 2024 02:10:52 GMT
content-type: text/css
last-modified: Tue, 25 Jun 2024 20:38:55 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 style-index.css
www.threatdown.com/wp-content/plugins/td-blocks-plugin/build/blocks/form-block/ 2 KB
920 B 45ms
44ms Stylesheet
text/css 192.0.66.84
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://www.threatdown.com/wp-content/plugins/td-blocks-plugin/build/blocks/form-block/style-index.css?m=1719347935g
Requested by: Host: www.threatdown.com
URL: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.66.84 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 6bf2514d72c9fa4a4302b61fcf77edc48803d7af8f09575320e117d9889a23ff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/

Response headers

cache-control: max-age=31536000
content-encoding: br
x-rq: hhn1 111 253 443
etag: W/"667b2adf-9ee"
accept-ranges: bytes
x-cache: HIT
date: Wed, 02 Oct 2024 02:10:52 GMT
content-type: text/css
last-modified: Tue, 25 Jun 2024 20:38:55 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 style-index.css
www.threatdown.com/wp-content/plugins/td-blocks-plugin/build/blocks/hero-v2-block/ 3 KB
985 B 46ms
44ms Stylesheet
text/css 192.0.66.84
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://www.threatdown.com/wp-content/plugins/td-blocks-plugin/build/blocks/hero-v2-block/style-index.css?m=1727458795g
Requested by: Host: www.threatdown.com
URL: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.66.84 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 73d68145c096b2edc4c09a6c9e123ed1abc6ab1afc1d7f3d579ba2931e0c60af

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/

Response headers

cache-control: max-age=31536000
content-encoding: br
x-rq: hhn1 111 253 443
etag: W/"66f6edeb-ace"
accept-ranges: bytes
x-cache: HIT
date: Wed, 02 Oct 2024 02:10:52 GMT
content-type: text/css
last-modified: Fri, 27 Sep 2024 17:39:55 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 style-index.css
www.threatdown.com/wp-content/plugins/td-blocks-plugin/build/blocks/tab-area-block/ 2 KB
702 B 46ms
44ms Stylesheet
text/css 192.0.66.84
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://www.threatdown.com/wp-content/plugins/td-blocks-plugin/build/blocks/tab-area-block/style-index.css?m=1719347935g
Requested by: Host: www.threatdown.com
URL: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.66.84 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: c0813b9627886c9fa1d6d57eb7a227747ab6e2629ab19bf1f646af9c7c3d79e0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/

Response headers

cache-control: max-age=31536000
content-encoding: br
x-rq: hhn1 111 254 443
etag: W/"667b2adf-629"
accept-ranges: bytes
x-cache: HIT
date: Wed, 02 Oct 2024 02:10:52 GMT
content-type: text/css
last-modified: Tue, 25 Jun 2024 20:38:55 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 /
www.threatdown.com/_static/ 15 KB
4 KB 46ms
45ms Stylesheet
text/css 192.0.66.84
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://www.threatdown.com/_static/??-eJzTLy/QzcxLzilNSS3WzyrWz01NyUxMzUnNTc0rQeEU5CRWphbp5qSmJyZX6uVm5uklFxfr6OPTDpRD5sM02efaGpobmVpaGBmZGgEARN0u5g==
Requested by: Host: www.threatdown.com
URL: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.66.84 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 3d2c10cf69410c10177fc6e56937d05151b182841fa6aee36f651d587d91fbb8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/

Response headers

cache-control: max-age=31536000
content-encoding: br
x-rq: hhn1 111 254 443
accept-ranges: bytes
x-cache: HIT
date: Wed, 02 Oct 2024 02:10:52 GMT
content-type: text/css;charset=utf-8
vary: Accept-Encoding
server: nginx
last-modified: Tue, 10 Sep 2024 15:30:52 GMT

GET
H2 200 /
www.threatdown.com/_static/ 142 KB
10 KB 47ms
46ms Stylesheet
text/css 192.0.66.84
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://www.threatdown.com/_static/??-eJyVjUEOAiEMAD9kreuacDI+whcgdJGI0NBu0N9LiPFmjLdOM9NiY3AlK2VFTmuIWZDXS4py5UoiIFQjCXAtWGo4D9o6kQ3+Ucbs0urfYL0v3aWHVgtabtThcxrG+uuDRiEVRR9FsTu41C5An34VlhlFn4kEMzVYkg2jOd2Pk5nm2ezN7vAC1sZlkQ==
Requested by: Host: www.threatdown.com
URL: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.66.84 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 79ee837dd384ba3484203f513c56fe5fca731c9012d7d82e6a7f243078a1f71c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/

Response headers

cache-control: max-age=31536000
content-encoding: br
x-rq: hhn1 111 254 443
accept-ranges: bytes
x-cache: HIT
date: Wed, 02 Oct 2024 02:10:52 GMT
content-type: text/css;charset=utf-8
vary: Accept-Encoding
server: nginx
last-modified: Wed, 17 Apr 2024 16:51:44 GMT

GET
H2 200 /
www.threatdown.com/_static/ 171 KB
56 KB 47ms
46ms Stylesheet
text/css 192.0.66.84
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://www.threatdown.com/_static/??/wp-content/themes/mbc/style.css,/wp-includes/css/dashicons.min.css?m=1727458795
Requested by: Host: www.threatdown.com
URL: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.66.84 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 9a81aca6e5e7d838c68f108c3265034b98a56518f08bba74436478f2edc915a5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/

Response headers

cache-control: max-age=31536000
content-encoding: br
x-rq: hhn1 111 253 443
accept-ranges: bytes
x-cache: HIT
date: Wed, 02 Oct 2024 02:10:52 GMT
content-type: text/css;charset=utf-8
vary: Accept-Encoding
server: nginx
last-modified: Fri, 27 Sep 2024 17:39:55 GMT

GET
H2 200 front-js.js Show response
www.threatdown.com/wp-content/plugins/weglot/dist/ 5 KB
2 KB 47ms
47ms Script
application/javascript 192.0.66.84
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://www.threatdown.com/wp-content/plugins/weglot/dist/front-js.js?m=1713372704g
Requested by: Host: www.threatdown.com
URL: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.66.84 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 84f5f5aa795694fd24258c8dee7a6f36f94a505f6f0446e06515f6114864f037

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/

Response headers

cache-control: max-age=31536000
content-encoding: br
x-rq: hhn1 111 254 443
etag: W/"661ffe20-1324"
accept-ranges: bytes
x-cache: HIT
date: Wed, 02 Oct 2024 02:10:52 GMT
content-type: application/javascript
last-modified: Wed, 17 Apr 2024 16:51:44 GMT
server: nginx
vary: Accept-Encoding

GET d89d3ff3-6507-4d57-9cf6-64af9d0c76c3
https://www.threatdown.com/ Frame 0
0

GET
H2 200 css2
fonts.googleapis.com/ 11 KB
1 KB 144ms
50ms Stylesheet
text/css 2a00:1450:4001:829::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@300;400;500;700;900&display=swap

Requested by

Host: www.threatdown.com
URL: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

cb86d971ded6b3f73f6be5ad76afd08c70099363c2aa64f29343e2a447a5404f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Wed, 02 Oct 2024 02:10:52 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 02 Oct 2024 02:10:52 GMT
content-type: text/css; charset=utf-8
last-modified: Wed, 02 Oct 2024 01:41:15 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H2 200 logo-header-threatdown-horizontal.svg
www.threatdown.com/wp-content/themes/mbc/images/ 27 KB
10 KB 74ms
73ms Image
image/svg+xml 192.0.66.84
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.threatdown.com/wp-content/themes/mbc/images/logo-header-threatdown-horizontal.svg
Requested by: Host: www.threatdown.com
URL: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.66.84 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 9e36f834eeef0ed10ef8d2681c179af354758c4d329f3514ac4caae28a7310a9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/

Response headers

cache-control: max-age=300, must-revalidate
content-encoding: br
x-rq: hhn1 111 254 443
etag: W/"65720a33-6cc1"
accept-ranges: bytes
x-cache: HIT
date: Wed, 02 Oct 2024 02:10:52 GMT
content-type: image/svg+xml
last-modified: Thu, 07 Dec 2023 18:08:51 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 px-center.png
www.threatdown.com/wp-content/uploads/2023/11/ 17 KB
18 KB 74ms
74ms Image
image/webp 192.0.66.84
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.threatdown.com/wp-content/uploads/2023/11/px-center.png
Requested by: Host: www.threatdown.com
URL: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.66.84 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: bc48f6d63c43b68b083b43a28928a8c79fa5a940b958f3c82e7cf9dfb20cc713

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/

Response headers

cache-control: max-age=31536000
x-rq: hhn1 109 200 443
etag: "ce0b2d879cd9b946"
accept-ranges: bytes, bytes
x-cache: HIT
content-length: 17818
date: Wed, 02 Oct 2024 02:10:52 GMT
content-type: image/webp
last-modified: Sun, 18 Aug 2024 09:28:59 GMT
server: nginx
vary: Accept

GET
H2 200 sor-2024.png
www.threatdown.com/wp-content/uploads/2024/08/ 287 KB
288 KB 40ms
39ms Image
image/webp 192.0.66.84
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.threatdown.com/wp-content/uploads/2024/08/sor-2024.png
Requested by: Host: www.threatdown.com
URL: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.66.84 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: cf9ca61a00ddb5352412e2b3786688e6c7d94a3ff94f9683d3f2be6c8dfec8f0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/

Response headers

cache-control: max-age=31536000
x-rq: hhn1 109 195 443
etag: "8cf5d4500fac318a"
accept-ranges: bytes, bytes
x-cache: HIT
content-length: 293958
date: Wed, 02 Oct 2024 02:10:52 GMT
content-type: image/webp
last-modified: Tue, 20 Aug 2024 14:13:59 GMT
server: nginx
vary: Accept

GET
H2 200 nav-nebula_sign_in.png
www.threatdown.com/wp-content/uploads/2024/04/ 30 KB
30 KB 51ms
47ms Image
image/webp 192.0.66.84
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.threatdown.com/wp-content/uploads/2024/04/nav-nebula_sign_in.png
Requested by: Host: www.threatdown.com
URL: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.66.84 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 5a9aa0112c5d786557feaa6cf96b3136219005f43dc46cd6c394b8d387006901

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/

Response headers

cache-control: max-age=31536000
x-rq: hhn1 109 140 443
etag: "59fbf67c3d7d93a8"
accept-ranges: bytes, bytes
x-cache: HIT
content-length: 30536
date: Wed, 02 Oct 2024 02:10:52 GMT
content-type: image/webp
last-modified: Fri, 31 May 2024 22:40:33 GMT
server: nginx
vary: Accept

GET
H2 200 x-logo.svg
www.threatdown.com/wp-content/themes/mbc/images/ 449 B
645 B 52ms
48ms Image
image/svg+xml 192.0.66.84
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.threatdown.com/wp-content/themes/mbc/images/x-logo.svg
Requested by: Host: www.threatdown.com
URL: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.66.84 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: bf8b6eabee06732294708b4285c90c685bb297b55151f7efe37afd1ead1d3ab0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/

Response headers

cache-control: max-age=300, must-revalidate
x-rq: hhn1 111 253 443
etag: "65720a33-1c1"
accept-ranges: bytes
x-cache: HIT
content-length: 449
date: Wed, 02 Oct 2024 02:10:52 GMT
content-type: image/svg+xml
last-modified: Thu, 07 Dec 2023 18:08:51 GMT
server: nginx

GET
H2 200 threatdown-logo.svg
www.threatdown.com/wp-content/themes/mbc/images/ 28 KB
10 KB 52ms
50ms Image
image/svg+xml 192.0.66.84
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.threatdown.com/wp-content/themes/mbc/images/threatdown-logo.svg
Requested by: Host: www.threatdown.com
URL: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.66.84 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 9da2bd1aa1b397eea1fa3b751fd50e0f624a33761a4e9e9fd660ed3d26f07f1b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/

Response headers

cache-control: max-age=300, must-revalidate
content-encoding: br
x-rq: hhn1 111 254 443
etag: W/"65720a33-6f8b"
accept-ranges: bytes
x-cache: HIT
date: Wed, 02 Oct 2024 02:10:52 GMT
content-type: image/svg+xml
last-modified: Thu, 07 Dec 2023 18:08:51 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 forms2.min.js Show response
go.malwarebytes.com/js/forms2/js/ 199 KB
67 KB 206ms
82ms Script
application/x-javascript 104.17.74.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://go.malwarebytes.com/js/forms2/js/forms2.min.js

Requested by

Host: www.threatdown.com
URL: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.74.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0423f69dc0e5f863d923e48c8c61298979b1c3fbdacbf6976d2b36f160bdea88

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/

Response headers

cache-control: public, max-age=14400
content-encoding: gzip
cf-cache-status: HIT
etag: "a40056-31b30-61d9f4beb95c0"
x-content-type-options: nosniff
cf-ray: 8cc12894dfb944f8-TXL
expires: Wed, 02 Oct 2024 06:10:52 GMT
date: Wed, 02 Oct 2024 02:10:52 GMT
content-type: application/x-javascript
last-modified: Fri, 19 Jul 2024 20:11:11 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 /
www.threatdown.com/_static/ 67 KB
12 KB 51ms
48ms Stylesheet
text/css 192.0.66.84
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://www.threatdown.com/_static/??-eJyNjcEOgyAQRH+odIumMT00fovABol02bCgvy/Gk/HS28yb5A1srGyiglSAY/WBBCa3TmTRKV8bN5i94pwgBgMrkksZuJoYZOaMIpeiTEx2aQoRLAK2zSd5tviA/89ugoMekvH31cNLf4bu3esdYlJHTA==
Requested by: Host: www.threatdown.com
URL: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.66.84 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3cc69a381981c2717f3a867f2d2449593a3f70dab0cd5db512cff9757f6acb0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/

Response headers

cache-control: max-age=31536000
content-encoding: br
x-rq: hhn1 111 254 443
accept-ranges: bytes
x-cache: HIT
date: Wed, 02 Oct 2024 02:10:52 GMT
content-type: text/css;charset=utf-8
vary: Accept-Encoding
server: nginx
last-modified: Thu, 07 Dec 2023 18:08:51 GMT

GET
H2 200 hooks.min.js Show response
www.threatdown.com/wp-includes/js/dist/ 4 KB
2 KB 52ms
48ms Script
application/javascript 192.0.66.84
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://www.threatdown.com/wp-includes/js/dist/hooks.min.js?m=1725982252g
Requested by: Host: www.threatdown.com
URL: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.66.84 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 2cb546fbdda7995d374fffa4b2f6530bbcf57d014639ddf76de45df43d593045

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/

Response headers

cache-control: max-age=31536000
content-encoding: br
x-rq: hhn1 111 254 443
etag: W/"66e0662c-10d3"
accept-ranges: bytes
x-cache: HIT
date: Wed, 02 Oct 2024 02:10:52 GMT
content-type: application/javascript
last-modified: Tue, 10 Sep 2024 15:30:52 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 i18n.min.js Show response
www.threatdown.com/wp-includes/js/dist/ 9 KB
4 KB 52ms
49ms Script
application/javascript 192.0.66.84
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://www.threatdown.com/wp-includes/js/dist/i18n.min.js?ver=5e580eb46a90c2b997e6
Requested by: Host: www.threatdown.com
URL: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.66.84 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f313d12ea6124bd28fc4a6b7163d253bb83d5aeab5edce594880c5c3df475cbc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/

Response headers

cache-control: max-age=31536000
content-encoding: br
x-rq: hhn1 111 253 443
etag: W/"66e0662c-23b5"
accept-ranges: bytes
x-cache: HIT
date: Wed, 02 Oct 2024 02:10:52 GMT
content-type: application/javascript
last-modified: Tue, 10 Sep 2024 15:30:52 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 i18n-loader.js Show response
www.threatdown.com/wp-content/mu-plugins/jetpack-13.8/jetpack_vendor/automattic/jetpack-assets/build/ 6 KB
3 KB 52ms
49ms Script
application/javascript 192.0.66.84
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://www.threatdown.com/wp-content/mu-plugins/jetpack-13.8/jetpack_vendor/automattic/jetpack-assets/build/i18n-loader.js?minify=true&ver=becd7d9884bc1b331e45
Requested by: Host: www.threatdown.com
URL: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.66.84 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 5e5c12d7275bca7a6c4cc0422ac102b9c1b7d60a2bf6aa871953e35464143068

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/

Response headers

cache-control: max-age=31536000
content-encoding: br
x-rq: hhn1 111 254 443
etag: W/"66f32a8c-1797"
accept-ranges: bytes
x-cache: HIT
date: Wed, 02 Oct 2024 02:10:52 GMT
content-type: application/javascript
last-modified: Tue, 24 Sep 2024 21:09:32 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 / Show response
www.threatdown.com/_static/ 46 KB
18 KB 52ms
49ms Script
application/javascript 192.0.66.84
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://www.threatdown.com/_static/??/wp-includes/js/dist/vendor/wp-polyfill.min.js,/wp-includes/js/dist/url.min.js?m=1725982252j
Requested by: Host: www.threatdown.com
URL: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.66.84 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 4c9359c1a26148379cdb326639e7ac4da9577c6e94d09af93f6d8900dbd6dd5e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/

Response headers

cache-control: max-age=31536000
content-encoding: br
x-rq: hhn1 111 253 443
accept-ranges: bytes
x-cache: HIT
date: Wed, 02 Oct 2024 02:10:52 GMT
content-type: application/javascript
vary: Accept-Encoding
server: nginx
last-modified: Tue, 10 Sep 2024 15:30:52 GMT

GET
H2 200 jp-search.js Show response
www.threatdown.com/wp-content/mu-plugins/jetpack-13.8/jetpack_vendor/automattic/jetpack-search/build/instant-search/ 7 KB
3 KB 52ms
49ms Script
application/javascript 192.0.66.84
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://www.threatdown.com/wp-content/mu-plugins/jetpack-13.8/jetpack_vendor/automattic/jetpack-search/build/instant-search/jp-search.js?minify=false&ver=bd796460f494d7ca043c
Requested by: Host: www.threatdown.com
URL: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.66.84 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 8c6f8073282a52c566dc04bc0156e182877b9c7b803c277fd1647a8f02e93b2a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/

Response headers

cache-control: max-age=31536000
content-encoding: br
x-rq: hhn1 111 253 443
etag: W/"66f32a8c-1b45"
accept-ranges: bytes
x-cache: HIT
date: Wed, 02 Oct 2024 02:10:52 GMT
content-type: application/javascript
last-modified: Tue, 24 Sep 2024 21:09:32 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 w.js Show response
stats.wp.com/ 13 KB
5 KB 126ms
39ms Script
application/javascript 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.wp.com/w.js?ver=202440
Requested by: Host: www.threatdown.com
URL: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: bbcc769c4704058d89afc024f24dde11deed8ec61b99f1d52ba935fad8614523

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/

Response headers

cache-control: max-age=31536000
content-encoding: br
x-nc: HIT hhn
etag: W/12868-1717166113635.1218
x-minify: t
x-minify-cache: hit
access-control-allow-methods: GET, HEAD
expires: Mon, 29 Sep 2025 15:39:25 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
date: Wed, 02 Oct 2024 02:10:52 GMT
content-type: application/javascript
vary: Accept-Encoding
server: nginx

GET
H2 200 script.min.js Show response
www.threatdown.com/wp-content/themes/mbc/js/ 95 KB
35 KB 52ms
49ms Script
application/javascript 192.0.66.84
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://www.threatdown.com/wp-content/themes/mbc/js/script.min.js?m=1727458795g
Requested by: Host: www.threatdown.com
URL: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.66.84 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 9e7b15e5a63410ed9a1f0391c990255d7c67d20f46aabf5b02f3712b6c61220b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/

Response headers

cache-control: max-age=31536000
content-encoding: br
x-rq: hhn1 111 253 443
etag: W/"66f6edeb-17d47"
accept-ranges: bytes
x-cache: HIT
date: Wed, 02 Oct 2024 02:10:52 GMT
content-type: application/javascript
last-modified: Fri, 27 Sep 2024 17:39:55 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 e-202440.js Show response
stats.wp.com/ 7 KB
3 KB 125ms
38ms Script
application/javascript 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.wp.com/e-202440.js
Requested by: Host: www.threatdown.com
URL: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 5badd609a51ede5bab5b89534fc3011a4dd1ab487cc7081d7cf38479bcbab855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/

Response headers

cache-control: max-age=31536000
content-encoding: br
x-nc: HIT hhn
etag: W/14421-1717166114261.106
x-minify: t
x-minify-cache: hit
access-control-allow-methods: GET, HEAD
expires: Sat, 27 Sep 2025 18:32:50 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
date: Wed, 02 Oct 2024 02:10:52 GMT
content-type: application/javascript
vary: Accept-Encoding
server: nginx

GET
H2 200 / Show response
www.threatdown.com/_static/ 99 KB
35 KB 52ms
50ms Script
application/javascript 192.0.66.84
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://www.threatdown.com/_static/??-eJzTLy/QzcxLzilNSS3WzwKiwtLUokoopZebmaeXVayjj0+Rbm5melFiSSpUsX2uraG5kamlhZGRqVEWAK+YIiM=
Requested by: Host: www.threatdown.com
URL: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.66.84 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ecf7723a32533007ede558c546fc8ba30f508283223b6e7f49c297b7c63c8b50

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/

Response headers

cache-control: max-age=31536000
content-encoding: br
x-rq: hhn1 111 253 443
accept-ranges: bytes
x-cache: HIT
date: Wed, 02 Oct 2024 02:10:52 GMT
content-type: application/javascript
vary: Accept-Encoding
server: nginx
last-modified: Tue, 10 Sep 2024 15:30:52 GMT

GET
H2 200 j.php Show response
dev.visualwebsiteoptimizer.com/ 20 KB
7 KB 137ms
48ms Script
application/javascript 34.96.102.137
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/j.php?a=805334&u=https%3A%2F%2Fwww.threatdown.com%2Fblog%2Fwatch-out-mobidash-android-adware-spread-through-phishing-and-online-links%2F&vn=2
Requested by: Host: www.threatdown.com
URL: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 137.102.96.34.bc.googleusercontent.com
Software: gfra2 /
Resource Hash: 9d994e9f852d02b751310208a3a6bdd04416bd0834b1eee217cc6649f9f88055

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/

Response headers

cache-control: public, max-age=0, no-cache, must-revalidate
timing-allow-origin: *
content-encoding: gzip
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 02 Oct 2024 02:10:51 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: gfra2

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 326 KB
107 KB 149ms
60ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-MQ92VXZT

Requested by

Host: www.threatdown.com
URL: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

02f067845d9b173b7565811c608b3ab14d760b1eb182ac9e10a05ef13a635c6e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1080:0"}],}
expires: Wed, 02 Oct 2024 02:10:52 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 02 Oct 2024 02:10:52 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Wed, 02 Oct 2024 00:28:14 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1080:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 108752
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 masterpage-svg.svg
www.threatdown.com/wp-content/themes/mbc/images/ 70 KB
23 KB 61ms
59ms Other
image/svg+xml 192.0.66.84
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://www.threatdown.com/wp-content/themes/mbc/images/masterpage-svg.svg
Requested by: Host: www.threatdown.com
URL: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.66.84 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 4662962f6a7ba6c6e423763f88ab9af3ec3fb17eeba90a673590984319c3e706

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/

Response headers

cache-control: max-age=300, must-revalidate
content-encoding: br
x-rq: hhn1 111 253 443
etag: W/"65720a33-116c9"
accept-ranges: bytes
x-cache: HIT
date: Wed, 02 Oct 2024 02:10:52 GMT
content-type: image/svg+xml
last-modified: Thu, 07 Dec 2023 18:08:51 GMT
server: nginx
vary: Accept-Encoding

GET
H2 404 indic-chevron-right.svg
www.threatdown.com/wp-content/themes/mbc/images/ 97 KB
97 KB 350ms
350ms Image
text/html 192.0.66.84
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.threatdown.com/wp-content/themes/mbc/images/indic-chevron-right.svg
Requested by: Host: www.threatdown.com
URL: https://www.threatdown.com/_static/??/wp-content/themes/mbc/style.css,/wp-includes/css/dashicons.min.css?m=1727458795
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.66.84 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx / WordPress VIP <https://wpvip.com>
Resource Hash: 98f6682d1cc74b20a3af3878bf57cbeb74539ad18b569ca227af2d1979f64c02

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/_static/??/wp-content/themes/mbc/style.css,/wp-includes/css/dashicons.min.css?m=1727458795

Response headers

link: <https://www.threatdown.com/api/>; rel="https://api.w.org/"
content-encoding: br
x-rq: hhn1 111 254 443
x-cache: EXPIRED
date: Wed, 02 Oct 2024 02:10:52 GMT
host-header: a9130478a60e5f9135f765b23f26593b
content-type: text/html; charset=UTF-8
x-powered-by: WordPress VIP <https://wpvip.com>
vary: Accept-Encoding
server: nginx
x-hacker: If you're reading this, you should visit wpvip.com/careers and apply to join the fun, mention this header.

GET
H3 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v32/ 18 KB
18 KB 109ms
58ms Font
font/woff2 142.250.186.35
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Roboto:wght@300;400;500;700;900&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.35 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f3.1e100.net

Software

sffe /

Resource Hash

ae0e442895406e9922237108496c2cd60f4947649a826463e2da9860b5c25dd6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.threatdown.com
Referer: https://fonts.googleapis.com/

Response headers

age: 64194
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Wed, 01 Oct 2025 08:20:58 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 01 Oct 2024 08:20:58 GMT
last-modified: Thu, 01 Aug 2024 20:41:24 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 18588
x-xss-protection: 0
server: sffe

GET
H3 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v32/ 18 KB
18 KB 93ms
42ms Font
font/woff2 142.250.186.35
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Roboto:wght@300;400;500;700;900&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.35 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f3.1e100.net

Software

sffe /

Resource Hash

89978e658e840b927dddb5cb3a835c7d8526ece79933bd9f3096b301fe1a8571

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.threatdown.com
Referer: https://fonts.googleapis.com/

Response headers

age: 65059
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Wed, 01 Oct 2025 08:06:33 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 01 Oct 2024 08:06:33 GMT
last-modified: Thu, 01 Aug 2024 20:41:24 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 18536
x-xss-protection: 0
server: sffe

GET
H3 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v32/ 18 KB
18 KB 89ms
39ms Font
font/woff2 142.250.186.35
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Roboto:wght@300;400;500;700;900&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.35 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f3.1e100.net

Software

sffe /

Resource Hash

d9bada3a44bb2ffa66dec5cc781cafc9ef17ed876cd9b0c5f7ef18228b63cebb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.threatdown.com
Referer: https://fonts.googleapis.com/

Response headers

age: 69112
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Wed, 01 Oct 2025 06:59:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 01 Oct 2024 06:59:00 GMT
last-modified: Thu, 01 Aug 2024 20:41:21 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 18596
x-xss-protection: 0
server: sffe

GET
DATA 200
OK truncated
/ 31 KB
31 KB Font
application/x-font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6db83b2803fed3f9b574567755102b18c401904a374c8acf4c9a2e9b0159cb4f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.threatdown.com
Referer

Response headers

Content-Type: application/x-font-woff;charset=utf-8

GET
H2 200 android_robot.svg_blog-image-solid-1.png
www.threatdown.com/wp-content/uploads/2024/09/ 6 KB
6 KB 41ms
40ms Image
image/webp 192.0.66.84
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.threatdown.com/wp-content/uploads/2024/09/android_robot.svg_blog-image-solid-1.png
Requested by: Host: www.threatdown.com
URL: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.66.84 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 458a654724a5ca18680cf80cf4b7072b1a71ca9c1077ac9111c694b379dcf0fa

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/

Response headers

cache-control: max-age=31536000
x-rq: hhn1 109 140 443
etag: "23728fbcc08f9d5a"
accept-ranges: bytes, bytes
x-cache: HIT
content-length: 6438
date: Wed, 02 Oct 2024 02:10:52 GMT
content-type: image/webp
last-modified: Mon, 30 Sep 2024 12:20:37 GMT
server: nginx
vary: Accept

GET
H2 200 Facebook_link.png
www.threatdown.com/wp-content/uploads/2024/09/ 35 KB
35 KB 41ms
41ms Image
image/webp 192.0.66.84
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.threatdown.com/wp-content/uploads/2024/09/Facebook_link.png
Requested by: Host: www.threatdown.com
URL: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.66.84 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 5d2b0efc546ca6819349d6682a6c8371afc842557afe8e5b156a26380bf0a263

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/

Response headers

cache-control: max-age=31536000
x-rq: hhn1 109 154 443
etag: "7fe86ebe49b8c2ae"
accept-ranges: bytes, bytes
x-cache: HIT
content-length: 35354
date: Wed, 02 Oct 2024 02:10:52 GMT
content-type: image/webp
last-modified: Mon, 30 Sep 2024 13:47:50 GMT
server: nginx
vary: Accept

GET
H2 200 APK_download.png
www.threatdown.com/wp-content/uploads/2024/09/ 8 KB
8 KB 41ms
40ms Image
image/webp 192.0.66.84
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.threatdown.com/wp-content/uploads/2024/09/APK_download.png
Requested by: Host: www.threatdown.com
URL: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.66.84 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 3b115e38069ecd710cec6bf59bf5f74a2a81845a0362ad4dddb7d45d89d02816

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/

Response headers

cache-control: max-age=31536000
x-rq: hhn1 109 195 443
etag: "125b236168a61558"
accept-ranges: bytes, bytes
x-cache: HIT
content-length: 8294
date: Wed, 02 Oct 2024 02:10:52 GMT
content-type: image/webp
last-modified: Mon, 30 Sep 2024 13:47:50 GMT
server: nginx
vary: Accept

GET
H2 200 lookebonyhillcomblock.png
www.threatdown.com/wp-content/uploads/2024/09/ 14 KB
14 KB 41ms
41ms Image
image/webp 192.0.66.84
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.threatdown.com/wp-content/uploads/2024/09/lookebonyhillcomblock.png
Requested by: Host: www.threatdown.com
URL: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.66.84 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 7ae5e1d574f0a6914abd79584dfa9c15799739fdb878f97dc956e1a478ae190d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/

Response headers

cache-control: max-age=31536000
x-rq: hhn1 109 30 443
etag: "eb6f653c555a8b36"
accept-ranges: bytes, bytes
x-cache: HIT
content-length: 14200
date: Wed, 02 Oct 2024 02:10:52 GMT
content-type: image/webp
last-modified: Mon, 30 Sep 2024 13:47:50 GMT
server: nginx
vary: Accept

GET 03a7e1d9-9196-438f-9a20-5237b506dd0f
https://www.threatdown.com/ Frame 0
0

GET
H3 200 vanj-e5825ce47540b67e848854c08b35d33cbr.js Show response
dev.visualwebsiteoptimizer.com/cdn/edrv/ 260 KB
67 KB 86ms
42ms Script
text/javascript 34.96.102.137
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/cdn/edrv/vanj-e5825ce47540b67e848854c08b35d33cbr.js
Requested by: Host: dev.visualwebsiteoptimizer.com
URL: https://dev.visualwebsiteoptimizer.com/j.php?a=805334&u=https%3A%2F%2Fwww.threatdown.com%2Fblog%2Fwatch-out-mobidash-android-adware-spread-through-phishing-and-online-links%2F&vn=2
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 137.102.96.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 8a8737fa6233104a7cfd1a96d055f1df6cf39243d78a0acd4b2594581705d17e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.threatdown.com
Referer: https://www.threatdown.com/

Response headers

x-goog-metageneration: 1
content-encoding: br
x-goog-hash: crc32c=bjqfSA==, md5=eMBP/fKjZaO3TTzjx0CgMg==
etag: "78c04ffdf2a365a3b74d3ce3c740a032"
age: 387033
x-goog-stored-content-encoding: br
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 68961
date: Fri, 27 Sep 2024 14:40:19 GMT
last-modified: Fri, 27 Sep 2024 14:20:54 GMT
content-type: text/javascript; charset=UTF-8
x-guploader-uploadid: AD-8ljuc0CTHeA0PB-ZN6DpzxhtwXgBHYi7NlhPxD00w3OMay7fxnOalxJ1FY7dcgsTd6-nwH5-gjuPHxA
cdn_cache_status: hit
cache-control: public, max-age=31536000
x-goog-storage-class: STANDARD
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1727446854353627
content-length: 68961
content-language: en
server: UploadServer

GET
H3 200 nc-bced65cf3ce53b1cb96e33d3391e8ef4br.js Show response
dev.visualwebsiteoptimizer.com/cdn/edrv/ 11 KB
4 KB 83ms
41ms Script
text/javascript 34.96.102.137
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/cdn/edrv/nc-bced65cf3ce53b1cb96e33d3391e8ef4br.js
Requested by: Host: dev.visualwebsiteoptimizer.com
URL: https://dev.visualwebsiteoptimizer.com/j.php?a=805334&u=https%3A%2F%2Fwww.threatdown.com%2Fblog%2Fwatch-out-mobidash-android-adware-spread-through-phishing-and-online-links%2F&vn=2
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 137.102.96.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: dc731d27b605c8bfda83754695f4de65206b95681806892e01db3cd374838d18

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.threatdown.com
Referer: https://www.threatdown.com/

Response headers

x-goog-metageneration: 1
content-encoding: br
x-goog-hash: crc32c=7MztHA==, md5=lfGY9pn/XBOvmDUWZrKOfQ==
etag: "95f198f699ff5c13af98351666b28e7d"
age: 375408
x-goog-stored-content-encoding: br
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 3700
date: Fri, 27 Sep 2024 17:54:04 GMT
last-modified: Fri, 27 Sep 2024 14:21:30 GMT
content-type: text/javascript; charset=UTF-8
x-guploader-uploadid: AD-8ljvpYjSnCH9x0AwBC2A-W-l2txeYcK29kPAGIpds4eurJtqh4ML3m0cuCewnIFzTYwmxE6U
cdn_cache_status: hit
cache-control: public, max-age=31536000
x-goog-storage-class: STANDARD
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1727446890260286
content-length: 3700
content-language: en
server: UploadServer

GET
H2 200 v.gif
dev.visualwebsiteoptimizer.com/ 35 B
144 B 129ms
129ms Image
image/gif 34.96.102.137
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dev.visualwebsiteoptimizer.com/v.gif?cd=0&a=805334&d=threatdown.com&u=DD554191E324B4B306DE3E7D0EFDC2E85&h=e2e1d6c669f26288d99f13c5ba2063da&t=false

Requested by

Host: www.threatdown.com
URL: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

137.102.96.34.bc.googleusercontent.com

Software

gnv03c /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/

Response headers

cache-control: public, max-age=43200
x-content-type-options: nosniff
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
date: Wed, 02 Oct 2024 02:10:51 GMT
content-type: image/gif
server: gnv03c

GET
DATA 200
OK truncated
/ 211 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 28b48920a64e295085db5f353539dbff2b7f6d76c4ba71e959ffac345a36c5c1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml;charset=utf-8

POST
H3 200 pageviews Show response
api.weglot.com/ 2 B
2 KB 157ms
102ms XHR
application/json 172.64.149.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://api.weglot.com/pageviews?api_key=wg_b310b3cb37917975ba31f8a293be66062

Requested by

Host: www.threatdown.com
URL: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.149.114 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' .weglot.com; base-uri 'self'; connect-src 'self' ; font-src 'self' cdn.jsdelivr.net https://fonts.gstatic.com data:; form-action 'self' .weglot.com api.workos.com error.workos.com announcekit.app https://accounts.google.com https://login.microsoftonline.com https://pi.zebra.com https://.okta.com https://.jumpcloud.com; frame-src 'self' .weglot.io announcekit.app https://www.google.com https://js.stripe.com https://app.goentri.com https://www.youtube.com https://www.youtube-nocookie.com https://td.doubleclick.net https://js.refiner.io blob:; img-src 'self' * data: blob:; object-src 'none'; media-src 'self' blob:; script-src 'nonce-510c6290a521cf2d663c37e49f4b1b73' 'strict-dynamic'; style-src 'self' 'unsafe-inline' *.weglot.com https://app.productfruits.com; worker-src 'self' blob:; block-all-mixed-content;report-uri https://csp-report.browser-intake-datadoghq.com/api/v2/logs?dd-api-key=pub3bd6aeebbc69014092e8cc554aa628f3&dd-evp-origin=content-security-policy&ddsource=csp-report&ddtags=env:prod;frame-ancestors 'none';
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://www.threatdown.com/

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
access-control-allow-methods: GET,POST,PUT,PATCH,DELETE
x-content-type-options: nosniff
expires: Wed, 02 Oct 2024 02:10:52 GMT
date: Wed, 02 Oct 2024 02:10:52 GMT
content-type: application/json
x-frame-options: SAMEORIGIN
access-control-allow-headers: Content-Type, Weglot-Source, Authorization
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: default-src 'self' *.weglot.com; base-uri 'self'; connect-src 'self' *; font-src 'self' cdn.jsdelivr.net https://fonts.gstatic.com data:; form-action 'self' *.weglot.com api.workos.com error.workos.com announcekit.app https://accounts.google.com https://login.microsoftonline.com https://pi.zebra.com https://*.okta.com https://*.jumpcloud.com; frame-src 'self' *.weglot.io announcekit.app https://www.google.com https://js.stripe.com https://app.goentri.com https://www.youtube.com https://www.youtube-nocookie.com https://td.doubleclick.net https://js.refiner.io blob:; img-src 'self' * data: blob:; object-src 'none'; media-src 'self' blob:; script-src 'nonce-510c6290a521cf2d663c37e49f4b1b73' 'strict-dynamic'; style-src 'self' 'unsafe-inline' *.weglot.com https://app.productfruits.com; worker-src 'self' blob:; block-all-mixed-content;report-uri https://csp-report.browser-intake-datadoghq.com/api/v2/logs?dd-api-key=pub3bd6aeebbc69014092e8cc554aa628f3&dd-evp-origin=content-security-policy&ddsource=csp-report&ddtags=env:prod;frame-ancestors 'none';
cache-control: max-age=0, must-revalidate, no-store, private
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8cc128960c5e6a75-TXL
permissions-policy: accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), fullscreen=(self), geolocation=(), gyroscope=(self), magnetometer=(), microphone=(), midi=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), usb=(), xr-spatial-tracking=(), clipboard-read=(self), clipboard-write=(self), hid=(), idle-detection=(), serial=()
access-control-allow-origin: *
x-xss-protection: 1; mode=block
server: cloudflare

GET
H2 200 g.gif
pixel.wp.com/ 50 B
177 B 46ms
39ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?x_stats-initial-visibility=visible&v=wpcom-no-pv&rand=0.10495622972298047
Requested by: Host: www.threatdown.com
URL: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/

Response headers

cache-control: no-cache
access-control-allow-origin: *
content-length: 50
alt-svc: h3=":443"; ma=86400
date: Wed, 02 Oct 2024 02:10:52 GMT
content-type: image/gif
server: nginx

GET
H/1.1 200
OK check Show response
api.ipstack.com/ 1 KB
2 KB 412ms
154ms Fetch
application/json 34.197.248.129
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://api.ipstack.com/check?access_key=0dcc7759180b385aa39a4c471f0e2cc6
Requested by: Host: www.threatdown.com
URL: https://www.threatdown.com/wp-content/themes/mbc/js/script.min.js?m=1727458795g
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.197.248.129 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-197-248-129.compute-1.amazonaws.com
Software: /
Resource Hash: 7a5310911f167d7e0237f082c9950b89a6ef02d63b349d2c00fcb8c398e4e46b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/

Response headers

transfer-encoding: chunked
x-request-time: 0.031
x-quota-remaining: 495196
access-control-allow-methods: GET, POST, HEAD, OPTIONS
x-apilayer-transaction-id: aae5dec7-09f8-4695-8994-a33f3f8c74c8
access-control-allow-origin: *
x-quota-limit: 500000
date: Wed, 02 Oct 2024 02:10:52 GMT
x-increment-usage: 1
content-type: application/json
access-control-allow-headers: *

GET
H2 200 getForm Show response
go.malwarebytes.com/index.php/form/ 5 KB
2 KB 89ms
88ms Script
application/javascript 104.17.74.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://go.malwarebytes.com/index.php/form/getForm?munchkinId=805-USG-300&form=6056&url=https%3A%2F%2Fwww.threatdown.com%2Fblog%2Fwatch-out-mobidash-android-adware-spread-through-phishing-and-online-links%2F&callback=jQuery371039762337887716126_1727835052398&_=1727835052399
Requested by: Host: go.malwarebytes.com
URL: https://go.malwarebytes.com/js/forms2/js/forms2.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.17.74.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b2d0a7f68bd1207582f9e4861705b74627867c88582cbac6b70baf4b462e592b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/

Response headers

cf-ray: 8cc12895f9b244f8-TXL
cached: true
content-encoding: gzip
date: Wed, 02 Oct 2024 02:10:52 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 otSDKStub.js Show response
cdn.cookielaw.org/scripttemplates/ 22 KB
8 KB 143ms
48ms Script
application/javascript 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Requested by

Host: www.threatdown.com
URL: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

872d4e2ae170a25a803a61b0dde9fe4ce7ae5b80bd59e333eb139161ec22e495

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/

Response headers

content-md5: jDFunkBoRQZ82jkCSA3wow==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DCE0F4E3319C89
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 66434
x-content-type-options: nosniff
date: Wed, 02 Oct 2024 02:10:52 GMT
content-type: application/javascript
last-modified: Mon, 30 Sep 2024 02:09:16 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 61d33504-d01e-0041-2269-13bb99000000
cf-ray: 8cc12896aae4d2a2-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 7220
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 7ghicgw4nish.js Show response
js.driftt.com/include/1727835300000/ 221 KB
62 KB 371ms
289ms Script
application/javascript 18.245.86.14
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/include/1727835300000/7ghicgw4nish.js

Requested by

Host: www.threatdown.com
URL: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.14 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-14.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

635c69243b34e95bb6c714cb6c43815c7b4c50d0e2ef76354df4cb2b4a1325af

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/

Response headers

content-encoding: gzip
x-amz-version-id: niaeQgibZo8hMzsw.EaO8mU9srmtoti3
etag: W/"f832ffabf78fe78b7d496fd5029e9a5a"
access-control-allow-methods: GET, POST, OPTIONS
x-cache: Miss from cloudfront
x-amz-cf-id: rpFz2kNzHASn_Wq_LXxy7gAenpco7txeQ8DfirutVfNI3Pnth-GNeg==
date: Wed, 02 Oct 2024 02:10:52 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
last-modified: Tue, 24 Sep 2024 17:33:41 GMT
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache
x-envoy-upstream-service-time: 58
access-control-allow-credentials: true
via: 1.1 cae5c5323232533718f592c973f01432.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: FRA60-P6
server: istio-envoy
x-amz-server-side-encryption: AES256

GET
H2 200 / Show response
185c650ccfd84b27aad189f19681365b.js.ubembed.com/ 415 B
675 B 185ms
96ms Script
application/javascript 104.18.39.181
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://185c650ccfd84b27aad189f19681365b.js.ubembed.com/
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MQ92VXZT
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.39.181 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b829c597d30d2a416fc4a94a829c51b045569e37abaca72b227d642cb077df7f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/

Response headers

cache-control: max-age=0, must-revalidate
content-encoding: br
cf-cache-status: HIT
etag: W/"54dfc1e0007e9ced271ca9fd30348c5d05d3261a"
cf-ray: 8cc128969d236a75-TXL
access-control-allow-origin: *
date: Wed, 02 Oct 2024 02:10:52 GMT
content-type: application/javascript
vary: Accept-Encoding, Referer
server: cloudflare

GET
H2 200 g.gif
pixel.wp.com/ 50 B
177 B 39ms
39ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?v=ext&blog=220729883&post=113414&tz=0&srv=www.threatdown.com&hp=vip&j=1%3A13.8.1&host=www.threatdown.com&ref=&rand=0.44798863414852264
Requested by: Host: www.threatdown.com
URL: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/

Response headers

cache-control: no-cache
access-control-allow-origin: *
content-length: 50
alt-svc: h3=":443"; ma=86400
date: Wed, 02 Oct 2024 02:10:52 GMT
content-type: image/gif
server: nginx

GET
H3 200 s.gif
dev.visualwebsiteoptimizer.com/ 35 B
53 B 129ms
129ms Image
image/gif 34.96.102.137
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dev.visualwebsiteoptimizer.com/s.gif?account_id=805334&u=DD554191E324B4B306DE3E7D0EFDC2E85&s=1727835051&ed=%7B%22sr%22%3A%221600x1200%22%2C%22sc%22%3A24%2C%22de%22%3A%22UTF-8%22%2C%22ul%22%3A%22de-de%22%2C%22r%22%3A%22%22%2C%22lt%22%3A1727835052496%2C%22tO%22%3A-2%2C%22tz%22%3A%22Europe%2FBerlin%22%7D&cu=https%3A%2F%2Fwww.threatdown.com%2Fblog%2Fwatch-out-mobidash-android-adware-spread-through-phishing-and-online-links%2F&r=0&p=1&cq=0&vn=undefined&vns=undefined&vno=undefined&eTime=1727835051515&v=257b305e9

Requested by

Host: www.threatdown.com
URL: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/

Protocol

Security

QUIC, , AES_128_GCM

Server

34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

137.102.96.34.bc.googleusercontent.com

Software

gnv03c /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/

Response headers

cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
pragma: no-cache
x-content-type-options: nosniff
via: 1.1 google
expires: Mon, 10 Jan 2005 00:00:01 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
date: Wed, 02 Oct 2024 02:10:51 GMT
content-type: image/gif
server: gnv03c

GET
H2 200 wp-emoji-release.min.js Show response
www.threatdown.com/wp-includes/js/ 18 KB
5 KB 40ms
40ms Script
application/javascript 192.0.66.84
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://www.threatdown.com/wp-includes/js/wp-emoji-release.min.js?ver=6.6.2
Requested by: Host: www.threatdown.com
URL: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.66.84 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 4e6ce5444c7f396cef0eb1fa3611034151e485dd06fbe5573a5583e1eebc98c3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/

Response headers

cache-control: max-age=31536000
content-encoding: br
x-rq: hhn1 111 253 443
etag: W/"66e0662d-4926"
accept-ranges: bytes
x-cache: HIT
date: Wed, 02 Oct 2024 02:10:52 GMT
content-type: application/javascript
last-modified: Tue, 10 Sep 2024 15:30:53 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 jp-search.defaultVendors.js Show response
www.threatdown.com/wp-content/mu-plugins/jetpack-13.8/jetpack_vendor/automattic/jetpack-search/build/instant-search/ 76 KB
25 KB 40ms
39ms Script
application/javascript 192.0.66.84
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://www.threatdown.com/wp-content/mu-plugins/jetpack-13.8/jetpack_vendor/automattic/jetpack-search/build/instant-search/jp-search.defaultVendors.js?minify=false&ver=e5ebee41a5cad7de8b1f
Requested by: Host: www.threatdown.com
URL: https://www.threatdown.com/wp-content/mu-plugins/jetpack-13.8/jetpack_vendor/automattic/jetpack-search/build/instant-search/jp-search.js?minify=false&ver=bd796460f494d7ca043c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.66.84 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 95cc88624c5917156db88bac6b01540bc6ad7852ed113873ceaf6d93168655ac

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/

Response headers

cache-control: max-age=31536000
content-encoding: br
x-rq: hhn1 111 253 443
etag: W/"66f32a8c-12fb4"
accept-ranges: bytes
x-cache: HIT
date: Wed, 02 Oct 2024 02:10:52 GMT
content-type: application/javascript
last-modified: Tue, 24 Sep 2024 21:09:32 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 jp-search.chunk-main-payload.css
www.threatdown.com/wp-content/mu-plugins/jetpack-13.8/jetpack_vendor/automattic/jetpack-search/build/instant-search/ 36 KB
5 KB 41ms
40ms Stylesheet
text/css 192.0.66.84
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://www.threatdown.com/wp-content/mu-plugins/jetpack-13.8/jetpack_vendor/automattic/jetpack-search/build/instant-search/jp-search.chunk-main-payload.css?minify=false&ver=9d1725f327b1ce30525f
Requested by: Host: www.threatdown.com
URL: https://www.threatdown.com/wp-content/mu-plugins/jetpack-13.8/jetpack_vendor/automattic/jetpack-search/build/instant-search/jp-search.js?minify=false&ver=bd796460f494d7ca043c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.66.84 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 4dd117d2c92e7c493a6741ab1460b8248c512c3fbb15ea9a2bc5a7b0bfe16411

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/

Response headers

cache-control: max-age=31536000
content-encoding: br
x-rq: hhn1 111 253 443
etag: W/"66f32a8c-8e9d"
accept-ranges: bytes
x-cache: HIT
date: Wed, 02 Oct 2024 02:10:52 GMT
content-type: text/css
last-modified: Tue, 24 Sep 2024 21:09:32 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 jp-search.chunk-main-payload.js Show response
www.threatdown.com/wp-content/mu-plugins/jetpack-13.8/jetpack_vendor/automattic/jetpack-search/build/instant-search/ 75 KB
20 KB 40ms
40ms Script
application/javascript 192.0.66.84
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://www.threatdown.com/wp-content/mu-plugins/jetpack-13.8/jetpack_vendor/automattic/jetpack-search/build/instant-search/jp-search.chunk-main-payload.js?minify=false&ver=c2ac62c616b4cf8ea2da
Requested by: Host: www.threatdown.com
URL: https://www.threatdown.com/wp-content/mu-plugins/jetpack-13.8/jetpack_vendor/automattic/jetpack-search/build/instant-search/jp-search.js?minify=false&ver=bd796460f494d7ca043c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.66.84 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1dc8465c5deadea9b38d7307bcefe48bfa6c96b4b92686e8e635e0cf9c27734d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/

Response headers

cache-control: max-age=31536000
content-encoding: br
x-rq: hhn1 111 253 443
etag: W/"66f32a8c-12a19"
accept-ranges: bytes
x-cache: HIT
date: Wed, 02 Oct 2024 02:10:52 GMT
content-type: application/javascript
last-modified: Tue, 24 Sep 2024 21:09:32 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 HWyTnY16.min.js Show response
tag.demandbase.com/ 64 KB
19 KB 538ms
447ms Script
application/javascript 18.245.46.25
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tag.demandbase.com/HWyTnY16.min.js

Requested by

Host: www.threatdown.com
URL: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.46.25 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-46-25.fra56.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

aa879a89d5f522391f099f229403255317c4f91ed8027d898fae42cfd64eeb51

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/

Response headers

content-encoding: gzip
x-amz-version-id: lyCwm7RobaJ2I6UbOw8BM9oxamole7U.
etag: W/"08a24028055c3da809f2d5191058ba7d"
x-cache: RefreshHit from cloudfront
x-amz-cf-id: -kqlRIqyGGPodfjuk9YLQH7YhroeLSVeT1_msPekpe9DqjOB1rdf0w==
date: Wed, 02 Oct 2024 02:10:53 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
last-modified: Tue, 27 Aug 2024 19:17:16 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: public, max-age=3600
via: 1.1 3aedbf31650352660fd3a878f7b791c8.cloudfront.net (CloudFront)
permissions-policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()
x-amz-cf-pop: FRA56-P9
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H3 200 track-7d0e7bf49bee06d6fc8f51f5d8631c9bbr.js Show response
dev.visualwebsiteoptimizer.com/cdn/7.0/ 16 KB
5 KB 40ms
40ms Script
text/javascript 34.96.102.137
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/cdn/7.0/track-7d0e7bf49bee06d6fc8f51f5d8631c9bbr.js
Requested by: Host: dev.visualwebsiteoptimizer.com
URL: https://dev.visualwebsiteoptimizer.com/cdn/edrv/vanj-e5825ce47540b67e848854c08b35d33cbr.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 137.102.96.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: d0dd6c8fec30b51f1a834b32180421f8ecb978e131a7ec73608618987baf3016

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/

Response headers

x-goog-metageneration: 1
content-encoding: br
x-goog-hash: crc32c=vVlDsQ==, md5=SC/cjzcXQQFmrlIjEdlAug==
etag: "482fdc8f3717410166ae522311d940ba"
age: 315507
x-goog-stored-content-encoding: br
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 4687
date: Sat, 28 Sep 2024 10:32:25 GMT
last-modified: Sat, 28 Sep 2024 09:34:54 GMT
content-type: text/javascript; charset=UTF-8
x-guploader-uploadid: AD-8ljvSfgv0GghIYeJ1V3dmmOcl3W1_UEpnqz2FyOYX-DvDm9iDSZ9ljsjJG5jzj0f5CqPZFQ
cdn_cache_status: hit
cache-control: public, max-age=31536000
x-goog-storage-class: STANDARD
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1727516094171770
content-length: 4687
content-language: en
server: UploadServer

GET
H3 200 opa-05c896517ef6440acaf6a4c7e5fccdaebr.js Show response
dev.visualwebsiteoptimizer.com/cdn/analysis/4.0/ 153 KB
39 KB 41ms
41ms Script
text/javascript 34.96.102.137
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/cdn/analysis/4.0/opa-05c896517ef6440acaf6a4c7e5fccdaebr.js
Requested by: Host: dev.visualwebsiteoptimizer.com
URL: https://dev.visualwebsiteoptimizer.com/cdn/edrv/vanj-e5825ce47540b67e848854c08b35d33cbr.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 137.102.96.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 830569b6b9eda3e3e8575c44353e6257a755857675c7dfbf43fd5410667628c6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/

Response headers

x-goog-metageneration: 1
content-encoding: br
x-goog-hash: crc32c=hfwXBQ==, md5=+NxkQvN5DUDTAhUtElft7w==
etag: "f8dc6442f3790d40d302152d1257edef"
age: 60907
x-goog-stored-content-encoding: br
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 39495
date: Tue, 01 Oct 2024 09:15:45 GMT
last-modified: Tue, 01 Oct 2024 06:50:03 GMT
content-type: text/javascript; charset=UTF-8
x-guploader-uploadid: AD-8ljtLyNmbGvHN-ekVk2Hqg-DmannchDnNOkZOB7ap3tG-fjEJTaWciO4OVpYXvYhXPoI2Lg
cdn_cache_status: hit
cache-control: public, max-age=31536000
x-goog-storage-class: STANDARD
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1727765403202384
content-length: 39495
content-language: en
server: UploadServer

GET
H3 200 settings.js Show response
dev.visualwebsiteoptimizer.com/ 9 KB
3 KB 49ms
47ms Script
application/javascript 34.96.102.137
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/settings.js?a=805334&settings_type=1&vn=&eventArch=1&uuid=&rc=1&exc=4|37
Requested by: Host: dev.visualwebsiteoptimizer.com
URL: https://dev.visualwebsiteoptimizer.com/cdn/edrv/vanj-e5825ce47540b67e848854c08b35d33cbr.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 137.102.96.34.bc.googleusercontent.com
Software: gfra2 /
Resource Hash: a8001aed837f420114f70b577c372c83aa288a8138fa71802ba35aa39218bf81

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/

Response headers

cache-control: public, max-age=0, no-cache, must-revalidate
content-encoding: gzip
etag: W/"1727781308_EA"
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 02 Oct 2024 02:10:52 GMT
content-type: application/javascript; charset=UTF-8
server: gfra2

GET
H2 200 forms2.css
go.malwarebytes.com/js/forms2/css/ 13 KB
3 KB 69ms
67ms Stylesheet
text/css 104.17.74.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://go.malwarebytes.com/js/forms2/css/forms2.css

Requested by

Host: go.malwarebytes.com
URL: https://go.malwarebytes.com/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.74.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/

Response headers

cache-control: public, max-age=14400
content-encoding: gzip
cf-cache-status: HIT
etag: "a40006-3437-61d9f4beb95c0"
x-content-type-options: nosniff
cf-ray: 8cc128969ac344f8-TXL
expires: Wed, 02 Oct 2024 06:10:52 GMT
accept-ranges: bytes
content-length: 2623
date: Wed, 02 Oct 2024 02:10:52 GMT
content-type: text/css
last-modified: Fri, 19 Jul 2024 20:11:11 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 forms2-theme-simple.css
go.malwarebytes.com/js/forms2/css/ 826 B
325 B 81ms
79ms Stylesheet
text/css 104.17.74.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://go.malwarebytes.com/js/forms2/css/forms2-theme-simple.css

Requested by

Host: go.malwarebytes.com
URL: https://go.malwarebytes.com/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.74.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

14c8c62dc692fd8faa04434e3fed25e7c23d596b732f9db88f6e9f9ff5dfa61c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/

Response headers

cache-control: public, max-age=14400
content-encoding: gzip
cf-cache-status: HIT
etag: "a40008-33a-61d9f4beb95c0"
x-content-type-options: nosniff
cf-ray: 8cc128969ac544f8-TXL
expires: Wed, 02 Oct 2024 06:10:52 GMT
accept-ranges: bytes
content-length: 242
date: Wed, 02 Oct 2024 02:10:52 GMT
content-type: text/css
last-modified: Fri, 19 Jul 2024 20:11:11 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3 200 KFOlCnqEu92Fr1MmSU5fBBc4.woff2
fonts.gstatic.com/s/roboto/v32/ 18 KB
18 KB 41ms
41ms Font
font/woff2 142.250.186.35
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmSU5fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Roboto:wght@300;400;500;700;900&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.35 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f3.1e100.net

Software

sffe /

Resource Hash

4dbd328e347e890a801d51f9a5f8d38a3efd51ec34c0aa22cc83d0a95d6d9d71

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.threatdown.com
Referer: https://fonts.googleapis.com/

Response headers

age: 62352
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Wed, 01 Oct 2025 08:51:40 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 01 Oct 2024 08:51:40 GMT
last-modified: Thu, 01 Aug 2024 20:41:19 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 18492
x-xss-protection: 0
server: sffe

GET
H3 200 s.gif
dev.visualwebsiteoptimizer.com/ 35 B
53 B 129ms
128ms Image
image/gif 34.96.102.137
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dev.visualwebsiteoptimizer.com/s.gif?account_id=805334&u=DD554191E324B4B306DE3E7D0EFDC2E85&s=1727835051&p=1&update=1&cq=1&ttl=90&vn=undefined&vns=undefined&vno=undefined&eTime=1727835051634&v=257b305e9&_cu=https%3A%2F%2Fwww.threatdown.com%2Fblog%2Fwatch-out-mobidash-android-adware-spread-through-phishing-and-online&random=0.6081992367833169

Requested by

Host: www.threatdown.com
URL: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/

Protocol

Security

QUIC, , AES_128_GCM

Server

34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

137.102.96.34.bc.googleusercontent.com

Software

gnv03c /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/

Response headers

cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
pragma: no-cache
x-content-type-options: nosniff
via: 1.1 google
expires: Mon, 10 Jan 2005 00:00:01 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
date: Wed, 02 Oct 2024 02:10:52 GMT
content-type: image/gif
server: gnv03c

GET
H2 200 381d1392-b15b-49e3-9cf9-8a5e644c68da.json Show response
cdn.cookielaw.org/consent/381d1392-b15b-49e3-9cf9-8a5e644c68da/ 7 KB
2 KB 139ms
59ms XHR
application/json 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/381d1392-b15b-49e3-9cf9-8a5e644c68da/381d1392-b15b-49e3-9cf9-8a5e644c68da.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

010abc1425a170a391af2a90f06ff1b98b92c43dc33523ed2c6dac45ac81e1ab

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/

Response headers

content-md5: nUbRTozUxLYIMnhgUCHCQw==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
cf-cache-status: HIT
etag: 0x8DC4E8C3C5954DF
age: 43773
x-ms-lease-status: unlocked
x-content-type-options: nosniff
x-ms-version: 2009-09-19
expires: Thu, 03 Oct 2024 02:10:52 GMT
date: Wed, 02 Oct 2024 02:10:52 GMT
content-type: application/json
last-modified: Wed, 27 Mar 2024 18:32:19 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin, cross-origin
x-ms-request-id: 82569494-c01e-00a6-7475-808e9d000000
cf-ray: 8cc128979d3f360a-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1925
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H3 200 worker-70faafffa0475802f5ee03ca5ff74179br.js Show response
dev.visualwebsiteoptimizer.com/cdn/analysis/4.0/ 46 KB
13 KB 42ms
42ms XHR
text/javascript 34.96.102.137
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/cdn/analysis/4.0/worker-70faafffa0475802f5ee03ca5ff74179br.js
Requested by: Host: dev.visualwebsiteoptimizer.com
URL: https://dev.visualwebsiteoptimizer.com/cdn/analysis/4.0/opa-05c896517ef6440acaf6a4c7e5fccdaebr.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 137.102.96.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 09b67475f266dbf552159ca9f6b44d9dc3ea04842b2bd6e8b09d74f6b21897d0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/

Response headers

x-goog-metageneration: 1
content-encoding: br
x-goog-hash: crc32c=t9nekA==, md5=OTBW++nqbotSERjfhuer5A==
etag: "393056fbe9ea6e8b521118df86e7abe4"
age: 383651
x-goog-stored-content-encoding: br
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 13401
date: Fri, 27 Sep 2024 15:36:41 GMT
last-modified: Fri, 27 Sep 2024 11:09:37 GMT
content-type: text/javascript; charset=UTF-8
x-guploader-uploadid: AD-8lju22iFH6aL0vnvopaLNAPoA1_JMN581mzWShv1ITpVz6zaY3AYnP6gfrdk2r4ESeFS-VXlbOEEfnw
cdn_cache_status: hit
cache-control: public, max-age=31536000
x-goog-storage-class: STANDARD
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1727435376936205
content-length: 13401
content-language: en
server: UploadServer

GET
H2 200 XDFrame
go.malwarebytes.com/index.php/form/ Frame B85F 0
0 209ms
144ms Document
text/html 104.17.72.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://go.malwarebytes.com/index.php/form/XDFrame

Requested by

Host: go.malwarebytes.com
URL: https://go.malwarebytes.com/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.72.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.threatdown.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

cache-control: max-age=3600
cf-cache-status: DYNAMIC
cf-ray: 8cc12897eb8158e4-TXL
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Wed, 02 Oct 2024 02:10:52 GMT
server: cloudflare
vary: Accept-Encoding
x-content-type-options: nosniff

GET
H2 200 bundle.js Show response
assets.ubembed.com/universalscript/releases/v0.183.0/ 183 KB
49 KB 136ms
45ms Script
application/javascript 108.138.26.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.ubembed.com/universalscript/releases/v0.183.0/bundle.js
Requested by: Host: 185c650ccfd84b27aad189f19681365b.js.ubembed.com
URL: https://185c650ccfd84b27aad189f19681365b.js.ubembed.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.26.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-26-31.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c39fa609f4a9b43e493115c723b102147f9025008bd24841e7732c5f253edd51

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/

Response headers

vary: Accept-Encoding
cache-control: max-age=31536000
content-encoding: gzip
etag: W/"ce1f9daa5bfa548f0417f378eb40974e"
age: 11261895
via: 1.1 6be461c5a9399007c1540eee90371674.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: eKS4kkpgIZFbSLF5rOiRHcDRRvQxzQfQJTTmZi0YNyq6F8DCoFglww==
date: Fri, 24 May 2024 17:52:38 GMT
content-type: application/javascript
last-modified: Fri, 24 May 2024 17:48:37 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P7
x-amz-server-side-encryption: AES256

GET
H2 200 location Show response
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 68 B
315 B 155ms
60ms XHR
application/json 2606:4700:4400::6812:2089
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2089 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e9433f83f20500145850d5aabddced402dcfc94e310072e9a3f545df0bdb9f96

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
accept: application/json
Referer: https://www.threatdown.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
access-control-allow-methods: GET, OPTIONS
cf-ray: 8cc128989ed83626-FRA
access-control-allow-origin: *
date: Wed, 02 Oct 2024 02:10:52 GMT
content-type: application/json
vary: Accept-Encoding
server: cloudflare
access-control-allow-headers: Content-Type

GET
H2 200 otBannerSdk.js Show response
cdn.cookielaw.org/scripttemplates/202403.1.0/ 442 KB
107 KB 48ms
47ms Script
application/javascript 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202403.1.0/otBannerSdk.js

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6d1137d21f3ba78b8a882dbf77f7c88712ad02a3f5efdce5ff996a67c15a6bf6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/

Response headers

content-md5: kUodklFyKXDEOUEPkRF3YA==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DCA5DFBFFA9F82
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 75789
x-content-type-options: nosniff
date: Wed, 02 Oct 2024 02:10:52 GMT
content-type: application/javascript
last-modified: Tue, 16 Jul 2024 21:39:19 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 0edf8d45-001e-008f-6dc9-d7ddd6000000
cf-ray: 8cc12898fe1ad2a2-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 109667
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 en.json Show response
cdn.cookielaw.org/consent/381d1392-b15b-49e3-9cf9-8a5e644c68da/018e8128-6f85-7df4-b207-ed48394e497c/ 39 KB
11 KB 62ms
62ms Fetch
application/json 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/381d1392-b15b-49e3-9cf9-8a5e644c68da/018e8128-6f85-7df4-b207-ed48394e497c/en.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202403.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

162344dd9df7bdcea168f2227c115f6d785db536ad48b3153872faa6282098fd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/

Response headers

content-md5: tLa6mdDW7PQbW87LxI3//A==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
cf-cache-status: HIT
etag: 0x8DC4E8C470B030D
age: 4564
x-ms-lease-status: unlocked
x-content-type-options: nosniff
x-ms-version: 2009-09-19
expires: Thu, 03 Oct 2024 02:10:53 GMT
date: Wed, 02 Oct 2024 02:10:53 GMT
content-type: application/json
last-modified: Wed, 27 Mar 2024 18:32:37 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin, cross-origin
x-ms-request-id: 19ac66c0-301e-0056-7c76-80c86c000000
cf-ray: 8cc12899ae21360a-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 11512
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 sync
s.company-target.com/s/ Frame EB0D 0
0 221ms
127ms Document
text/html 34.96.71.22
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://s.company-target.com/s/sync?exc=lr

Requested by

Host: tag.demandbase.com
URL: https://tag.demandbase.com/HWyTnY16.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.71.22 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

22.71.96.34.bc.googleusercontent.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.threatdown.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-methods: GET,OPTIONS
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 634
content-type: text/html; charset=UTF-8
date: Wed, 02 Oct 2024 02:10:53 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 google

GET
H2 451 464526.gif
id.rlcdn.com/ 0
98 B 145ms
50ms Image
text/plain 35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://id.rlcdn.com/464526.gif
Requested by: Host: www.threatdown.com
URL: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/

Response headers

via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Wed, 02 Oct 2024 02:10:53 GMT

POST
H2 200 ip.json Show response
api.company-target.com/api/v3/ 2 KB
2 KB 199ms
104ms XHR
application/json 18.66.102.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.company-target.com/api/v3/ip.json?referrer=&page=https%3A%2F%2Fwww.threatdown.com%2Fblog%2Fwatch-out-mobidash-android-adware-spread-through-phishing-and-online-links%2F&page_title=Watch%20out!%20Mobidash%20Android%20adware%20spread%20through%20phishing%20and%20online%20links%20-%20ThreatDown%20by%20Malwarebytes

Requested by

Host: tag.demandbase.com
URL: https://tag.demandbase.com/HWyTnY16.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.102.75 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-102-75.fra56.r.cloudfront.net

Software

nginx /

Resource Hash

62abda4145106e7fdc2da0f66791347453380f63809b981468c6897d79a30003

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://www.threatdown.com/

Response headers

access-control-max-age: 7200
access-control-expose-headers: x-amz-cf-id
content-encoding: gzip
identification-source: CENTRAL
access-control-allow-methods: GET, POST, OPTIONS
request-id: 64e709c1-79e0-4056-9ddc-25d330a607df
expires: Tue, 01 Oct 2024 02:10:53 GMT
x-cache: Miss from cloudfront
x-amz-cf-id: _T69oMpbM6JcfiuE8qulXdTF2LWrxmzEjGofAjarE8Pe5oLP6iM8ng==
date: Wed, 02 Oct 2024 02:10:53 GMT
content-type: application/json;charset=utf-8
vary: Accept-Encoding, Origin
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
api-version: v3
access-control-allow-credentials: true
via: 1.1 3f52d342c56014599dee37446f6c9f2e.cloudfront.net (CloudFront)
access-control-allow-origin: https://www.threatdown.com
x-amz-cf-pop: FRA56-P2
server: nginx

GET
H2 200 otFlat.json Show response
cdn.cookielaw.org/scripttemplates/202403.1.0/assets/ 13 KB
3 KB 74ms
73ms Fetch
application/json 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202403.1.0/assets/otFlat.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202403.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f4aaa18c55c90588c5e828e56dcc6b2cb0acf9a4280494c7d1a53fc5e3669112

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/

Response headers

content-md5: gWbZdVb/GsEUTnv/p/InTg==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DCA5DFBBC2C661
x-ms-lease-status: unlocked
cf-cache-status: HIT
x-content-type-options: nosniff
date: Wed, 02 Oct 2024 02:10:53 GMT
content-type: application/json
last-modified: Tue, 16 Jul 2024 21:39:12 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 97176422-601e-00bd-54db-d78506000000
cf-ray: 8cc1289a1e4c360a-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 3041
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 otPcPanel.json Show response
cdn.cookielaw.org/scripttemplates/202403.1.0/assets/v2/ 64 KB
13 KB 51ms
50ms Fetch
application/json 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202403.1.0/assets/v2/otPcPanel.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202403.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0ed759f9b0f407aa73df997bddf186c37a1927d2b0f8d2f7031067ecacf7581d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/

Response headers

content-md5: uFS5wT+0+fvZJFPYO6D9oQ==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DCA5DFBD299C3B
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 3646
x-content-type-options: nosniff
date: Wed, 02 Oct 2024 02:10:53 GMT
content-type: application/json
last-modified: Tue, 16 Jul 2024 21:39:14 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 815017d0-701e-004c-6863-d85495000000
cf-ray: 8cc1289a1e4d360a-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 12960
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 otCookieSettingsButton.json Show response
cdn.cookielaw.org/scripttemplates/202403.1.0/assets/ 5 KB
2 KB 52ms
52ms Fetch
application/json 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202403.1.0/assets/otCookieSettingsButton.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202403.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5fb7c176325267082e94a7131fed5e157516e6805cee3ac6f6a93340a947d640

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/

Response headers

content-md5: yb3U5LP1G8IlMRT4O3b4PA==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DCA5DFBCCCC97D
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 6915
x-content-type-options: nosniff
date: Wed, 02 Oct 2024 02:10:53 GMT
content-type: application/json
last-modified: Tue, 16 Jul 2024 21:39:14 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: f2a81859-801e-0095-1ed8-d7f2b9000000
cf-ray: 8cc1289a2e4e360a-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1738
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 otCommonStyles.css Show response
cdn.cookielaw.org/scripttemplates/202403.1.0/assets/ 24 KB
4 KB 51ms
51ms Fetch
text/css 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202403.1.0/assets/otCommonStyles.css

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202403.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

06c0edbfc1b871fb45195265f5faad3e23191305f6ff2125557a9fbc287c8992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/

Response headers

content-md5: 4ErYmXXFNbMLrnc9DrDTsg==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 85183
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 02 Oct 2024 02:10:53 GMT
content-type: text/css
last-modified: Tue, 16 Jul 2024 21:39:25 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 47fa3393-901e-0009-7f27-d88904000000
cf-ray: 8cc1289a2e50360a-FRA
access-control-allow-origin: *
x-ms-blob-type: BlockBlob
server: cloudflare

GET 918b4a16-0731-4265-aa46-d7d9584ff4a4
https://www.threatdown.com/ Frame 0
0

GET
H2 200 ot_close.svg
cdn.cookielaw.org/logos/static/ 651 B
623 B 49ms
48ms Image
image/svg+xml 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/static/ot_close.svg

Requested by

Host: www.threatdown.com
URL: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

901bb0e03b8c3c0a1cf4c487a177417328bb7d8c94106ecefceedd7d7f6c4ddc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/

Response headers

content-md5: pcXWFGpuVeSg/jVnYCseRg==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 38061
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 02 Oct 2024 02:10:53 GMT
content-type: image/svg+xml
last-modified: Tue, 01 Oct 2024 03:19:43 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 4e25be0b-801e-001d-5a17-144a60000000
cf-ray: 8cc1289ad8e1d2a2-FRA
access-control-allow-origin: *
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 ot_guard_logo.svg Show response
cdn.cookielaw.org/logos/static/ 497 B
515 B 50ms
50ms Fetch
image/svg+xml 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/logos/static/ot_guard_logo.svg

Requested by

Host: dev.visualwebsiteoptimizer.com
URL: https://dev.visualwebsiteoptimizer.com/cdn/analysis/4.0/opa-05c896517ef6440acaf6a4c7e5fccdaebr.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

691dcdb24853a0f5ce4e6597e5713dea66799b57ffe2c2a10f28f98e0b569b19

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/

Response headers

content-md5: tXyZydHjxQshFMbbBT1/8A==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 70970
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 02 Oct 2024 02:10:53 GMT
content-type: image/svg+xml
last-modified: Mon, 30 Sep 2024 02:09:18 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 2bf2a725-c01e-00f4-6604-13b666000000
cf-ray: 8cc1289aeeaf360a-FRA
access-control-allow-origin: *
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 ThreatDown_Horizontal_Reverse_1.png
cdn.cookielaw.org/logos/4e1c8bc8-2743-413b-8699-aad2216e8616/6e92ecb0-4e42-4d30-8f04-407f278db3b5/b82dfa15-25d8-4665-ba3c-6a24ec909e54/ 6 KB
7 KB 50ms
50ms Image
mage/png 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/4e1c8bc8-2743-413b-8699-aad2216e8616/6e92ecb0-4e42-4d30-8f04-407f278db3b5/b82dfa15-25d8-4665-ba3c-6a24ec909e54/ThreatDown_Horizontal_Reverse_1.png

Requested by

Host: www.threatdown.com
URL: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c8c32294948f5448c2ac0bcdf5b98909dab4ee73ac854be06bfd4a13bce89363

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/

Response headers

content-md5: nH40X2VjWJZythBS11v9uw==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
etag: 0x8DBE4905AE5595C
age: 84402
cf-cache-status: HIT
x-content-type-options: nosniff
date: Wed, 02 Oct 2024 02:10:53 GMT
content-type: mage/png
last-modified: Mon, 13 Nov 2023 21:34:45 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: f7dbda2b-001e-00a9-1edb-71f8f1000000
cf-ray: 8cc1289b3984d2a2-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 6630
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 powered_by_logo.svg
cdn.cookielaw.org/logos/static/ 5 KB
2 KB 54ms
54ms Image
image/svg+xml 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/static/powered_by_logo.svg

Requested by

Host: www.threatdown.com
URL: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/

Response headers

content-md5: Y+c301RBZNK39PvKQWrIBw==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 6638
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 02 Oct 2024 02:10:53 GMT
content-type: image/svg+xml
last-modified: Tue, 01 Oct 2024 16:22:43 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 2432963c-901e-00a3-663d-145feb000000
cf-ray: 8cc1289b3987d2a2-FRA
access-control-allow-origin: *
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 destination Show response
www.googletagmanager.com/gtag/ 356 KB
109 KB 69ms
68ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/destination?id=G-K8KCHE3KSC&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MQ92VXZT

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

f5d6c45b0fbb8928cbbd23b7bd0197ba5e764f41a6c9e4dcf6b3d2cb2b756373

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcysghrgc:42:0"}],}
expires: Wed, 02 Oct 2024 02:10:53 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 02 Oct 2024 02:10:53 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcysghrgc:42:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 111173
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 forms_0ac018bf7c.min.js Show response
tag.demandbase.com/shared/ 172 KB
55 KB 40ms
40ms Script
application/javascript 18.245.46.25
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tag.demandbase.com/shared/forms_0ac018bf7c.min.js

Requested by

Host: tag.demandbase.com
URL: https://tag.demandbase.com/HWyTnY16.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.46.25 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-46-25.fra56.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

0a7f44c1354ebe8134dc5fae913b06aabf953b16fa52e327e25b59083da1e2ea

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/

Response headers

content-encoding: gzip
etag: W/"f6e3a94380ce796fb79fae8a893f767b"
x-amz-version-id: 4i9X5vSp_zVDGkmj37uJwYrZoIZHw2Kp
age: 83707
x-cache: Hit from cloudfront
x-amz-cf-id: ApkD3SYCW7R4k2xrhxtOTSYLerOKfOEkV5YjFG1zGjQRJWWLphCYtw==
date: Tue, 01 Oct 2024 02:57:23 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Tue, 27 Aug 2024 17:46:25 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
via: 1.1 3aedbf31650352660fd3a878f7b791c8.cloudfront.net (CloudFront)
permissions-policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()
x-amz-cf-pop: FRA56-P9
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 bg9s Show response
tag-logger.demandbase.com/ 0
419 B 240ms
140ms XHR
text/html 2600:9000:2724:9000:1d:8d6d:3b40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tag-logger.demandbase.com/bg9s?x-amz-cf-id=_T69oMpbM6JcfiuE8qulXdTF2LWrxmzEjGofAjarE8Pe5oLP6iM8ng==&api-version=v3
Requested by: Host: dev.visualwebsiteoptimizer.com
URL: https://dev.visualwebsiteoptimizer.com/cdn/analysis/4.0/opa-05c896517ef6440acaf6a4c7e5fccdaebr.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2724:9000:1d:8d6d:3b40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/

Response headers

x-amz-version-id: 8SdDCdpJvGjkSiMFPv08XcVSgwOMVVmH
etag: "d41d8cd98f00b204e9800998ecf8427e"
age: 79937
x-cache: Error from cloudfront
x-amz-cf-id: bQWRfEw3Oivg7IW5lsQzBYMNrmGRvmXoy2yhBYk-JxApM938Sx21ew==
date: Tue, 01 Oct 2024 03:58:39 GMT
content-type: text/html
vary: Accept-Encoding
last-modified: Tue, 07 Mar 2023 20:47:02 GMT
via: 1.1 8576ee57c8a84a61190d4c1b31b69a90.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 0
x-amz-cf-pop: FRA56-P12
server: AmazonS3
x-amz-server-side-encryption: AES256

POST
H2 200 analyze Show response
r3.visualwebsiteoptimizer.com/ 0
143 B 642ms
363ms XHR
application/javascript 35.194.81.74
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://r3.visualwebsiteoptimizer.com/analyze?_a=805334&_u=https%3A%2F%2Fwww.threatdown.com%2Fblog%2Fwatch-out-mobidash-android-adware-spread-through-phishing-and-online-links%2F
Requested by: Host: dev.visualwebsiteoptimizer.com
URL: https://dev.visualwebsiteoptimizer.com/cdn/analysis/4.0/opa-05c896517ef6440acaf6a4c7e5fccdaebr.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.194.81.74 Washington, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 74.81.194.35.bc.googleusercontent.com
Software: r3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryUmIqbtAN8XxuKLcL
Referer: https://www.threatdown.com/

Response headers

access-control-allow-origin: *
content-encoding: gzip
date: Wed, 02 Oct 2024 02:10:53 GMT
content-type: application/javascript; charset=UTF-8
server: r3

GET
H2 200 stylesheet_0ac018bf7c.v2.css
tag.demandbase.com/shared/ 21 KB
3 KB 41ms
41ms Stylesheet
text/css 18.245.46.25
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tag.demandbase.com/shared/stylesheet_0ac018bf7c.v2.css

Requested by

Host: tag.demandbase.com
URL: https://tag.demandbase.com/shared/forms_0ac018bf7c.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.46.25 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-46-25.fra56.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

b62e2b5a98092e6d82cd6c650253589a3ae63e2ec8591c156cfb413e405e17c3

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/

Response headers

content-encoding: gzip
etag: W/"1466c24462e7a0ef7487f6578e5a2595"
x-amz-version-id: SKjpgbXQwktyoHtH9QoU0oxHYw0gU2G1
age: 78931
x-cache: Hit from cloudfront
x-amz-cf-id: 0njUwmTPs6WTbpeRvgJkr0U0ZGGjn5Ys4aJC5k5I0_anE0MJHmAdJA==
date: Tue, 01 Oct 2024 04:15:40 GMT
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
last-modified: Tue, 27 Aug 2024 17:46:25 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
via: 1.1 3aedbf31650352660fd3a878f7b791c8.cloudfront.net (CloudFront)
permissions-policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()
x-amz-cf-pop: FRA56-P9
server: AmazonS3
x-amz-server-side-encryption: AES256

POST
H2 204 collect
region1.analytics.google.com/g/ 0
0 145ms
48ms Fetch
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-K8KCHE3KSC&gtm=45je4a10v872204243za200zb9167491076&_p=1727835052155&_gaz=1&gcd=13l3lPl2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101671035~101747727&gdid=dYWJhMj&cid=220033538.1727835053&ul=de-de&sr=1600x1200&are=1&frm=0&pscdl=noapi&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=BA&_s=1&sid=1727835053&sct=1&seg=0&dl=https%3A%2F%2Fwww.threatdown.com%2Fblog%2Fwatch-out-mobidash-android-adware-spread-through-phishing-and-online-links%2F&dt=Watch%20out!%20Mobidash%20Android%20adware%20spread%20through%20phishing%20and%20online%20links%20-%20ThreatDown%20by%20Malwarebytes&en=demandbase_event&_fv=1&_ss=1&_ee=1&ep.2=(Non-Company%20Visitor)&ep.3=Enterprise%20Business&ep.4=Healthcare%20%26%20Medical&ep.5=Ballad%20Health&ep.6=Ballad%20Health&ep.7=Hospitals%20and%20Healthcare&ep.8=Integrated%20Healthcare%20Networks&ep.9=%241B%20-%20%242.5B&ep.10=Enterprise&ep.11=Johnson%20City&ep.12=TN&ep.13=(Non-Company%20Visitor)&ep.14=(Non-Company%20Visitor)&ep.15=(Non-Company%20Visitor)&ep.16=Todd%20Dunfee&ep.17=US&ep.18=balladhealth.org&epn.24=14000&tfd=1612
Requested by: Host: dev.visualwebsiteoptimizer.com
URL: https://dev.visualwebsiteoptimizer.com/cdn/analysis/4.0/opa-05c896517ef6440acaf6a4c7e5fccdaebr.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.threatdown.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 02 Oct 2024 02:10:53 GMT
content-type: text/plain
server: Golfe2

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
556 B 179ms
51ms Ping
text/plain 2a00:1450:400c:c1f::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-K8KCHE3KSC&cid=220033538.1727835053&gtm=45je4a10v872204243za200zb9167491076&aip=1&dma=1&dma_cps=syphamo&gcd=13l3lPl2l1l1&npa=1&frm=0&tag_exp=101671035~101747727
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=G-K8KCHE3KSC&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c1f::9c Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:111:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:111:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.threatdown.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 02 Oct 2024 02:10:53 GMT
content-type: text/plain
server: Golfe2

GET
H3 200 ga-audiences
www.google.de/ads/ 42 B
63 B 109ms
51ms Image
image/gif 142.250.185.163
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-K8KCHE3KSC&cid=220033538.1727835053&gtm=45je4a10v872204243za200zb9167491076&aip=1&dma=1&dma_cps=syphamo&gcd=13l3lPl2l1l1&npa=1&frm=0&tag_exp=101671035~101747727&tag_exp=101671035~101747727&z=133659026

Requested by

Host: www.threatdown.com
URL: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Wed, 02 Oct 2024 02:10:53 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 core
js.driftt.com/ Frame 76FD 0
0 242ms
165ms Document
text/html 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core?d=1&embedId=7ghicgw4nish&eId=7ghicgw4nish&region=US&forceShow=false&skipCampaigns=false&sessionId=b358b652-219b-4044-b164-84299010c696&sessionStarted=1727835053.759&campaignRefreshToken=74c00028-9433-4c64-b99a-da2f6bc6d469&hideController=false&pageLoadStartTime=1727835052071&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.threatdown.com%2Fblog%2Fwatch-out-mobidash-android-adware-spread-through-phishing-and-online-links%2F

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/include/1727835300000/7ghicgw4nish.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.threatdown.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
cache-control: no-cache
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Wed, 02 Oct 2024 02:10:53 GMT
etag: W/"e02707ecde812f324896e0f17b53fd15"
last-modified: Tue, 24 Sep 2024 17:33:10 GMT
server: istio-envoy
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding
via: 1.1 57bc54093a2e2c99ca194f2955ba3d1c.cloudfront.net (CloudFront)
x-amz-cf-id: pc4LZsrc0XcJZaQ_Q1oyMpCkfq1dkOE9cmthwsK3lu2tawLPjbVnQg==
x-amz-cf-pop: FRA60-P6
x-amz-server-side-encryption: AES256
x-amz-version-id: YN8CatGloOim4_XmQKZzVgY7V1fWMNRE
x-cache: RefreshHit from cloudfront
x-envoy-upstream-service-time: 21

GET
H2 200 chat
js.driftt.com/core/ Frame 73C1 0
0 218ms
144ms Document
text/html 18.245.86.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1727835052071

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/include/1727835300000/7ghicgw4nish.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-77.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.threatdown.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
cache-control: no-cache
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Wed, 02 Oct 2024 02:10:53 GMT
etag: W/"e02707ecde812f324896e0f17b53fd15"
last-modified: Tue, 24 Sep 2024 17:33:10 GMT
server: istio-envoy
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding
via: 1.1 57bc54093a2e2c99ca194f2955ba3d1c.cloudfront.net (CloudFront)
x-amz-cf-id: 39Ztw1iL3I_bICobw3in2LyDVDhuqDGYALCr2wG_wjVn8_wOxZhiNg==
x-amz-cf-pop: FRA60-P6
x-amz-server-side-encryption: AES256
x-amz-version-id: YN8CatGloOim4_XmQKZzVgY7V1fWMNRE
x-cache: RefreshHit from cloudfront
x-envoy-upstream-service-time: 62

GET
H2 200 favicon.svg
www.threatdown.com/wp-content/uploads/2023/11/ 31 KB
31 KB 40ms
39ms Other
image/svg+xml 192.0.66.84
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://www.threatdown.com/wp-content/uploads/2023/11/favicon.svg?w=16
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.66.84 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: c9e433acb7082694e1a6a861ad1bd4f218ea3cdd57fcbfff823a0967a2aa925e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/

Response headers

cache-control: max-age=31536000
x-rq: hhn1 109 32 443
etag: "cec9cedda1f1bde1"
accept-ranges: bytes, bytes
x-cache: HIT
content-length: 31766
date: Wed, 02 Oct 2024 02:10:54 GMT
content-type: image/svg+xml
vary: Accept-Encoding
server: nginx
last-modified: Tue, 07 Nov 2023 06:54:38 GMT

GET
H2 200 ip.json Show response
api.company-target.com/api/v3/ 2 KB
2 KB 172ms
92ms Fetch
application/json 18.66.102.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.company-target.com/api/v3/ip.json?auth=f7HmeeHicOTWYyYV3aYt8PryRbQ6taulYUHfqU1D&page=https%3A%2F%2Fwww.threatdown.com%2Fblog%2Fwatch-out-mobidash-android-adware-spread-through-phishing-and-online-links%2F&page_title=Watch%20out!%20Mobidash%20Android%20adware%20spread%20through%20phishing%20and%20online%20links%20-%20ThreatDown%20by%20Malwarebytes&referrer=

Requested by

Host: dev.visualwebsiteoptimizer.com
URL: https://dev.visualwebsiteoptimizer.com/cdn/analysis/4.0/opa-05c896517ef6440acaf6a4c7e5fccdaebr.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.102.75 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-102-75.fra56.r.cloudfront.net

Software

nginx /

Resource Hash

f5f7f84a6660ca9cf09f9b24030045f4657aef64dc3405076f926f1bfd7da63f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.threatdown.com/

Response headers

access-control-max-age: 7200
access-control-expose-headers: x-amz-cf-id
content-encoding: gzip
identification-source: CENTRAL
access-control-allow-methods: GET, POST, OPTIONS
request-id: b927a664-e896-461d-b6d7-4c8f5ff74d75
expires: Tue, 01 Oct 2024 02:10:54 GMT
x-cache: Miss from cloudfront
x-amz-cf-id: IyqHqDn9k_l_Bc9HBkSgBkL75PUnG903Q4y7TV7TJHiUnvSegajFKg==
date: Wed, 02 Oct 2024 02:10:54 GMT
content-type: application/json;charset=utf-8
vary: Accept-Encoding, Origin
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
api-version: v3
access-control-allow-credentials: true
via: 1.1 3aad72975c9da06e6d0903ad874f0b54.cloudfront.net (CloudFront)
access-control-allow-origin: https://www.threatdown.com
x-amz-cf-pop: FRA56-P2
server: nginx

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.threatdown.com
URL: blob:https://www.threatdown.com/d89d3ff3-6507-4d57-9cf6-64af9d0c76c3

Domain: www.threatdown.com
URL: blob:https://www.threatdown.com/03a7e1d9-9196-438f-9a20-5237b506dd0f

Domain: www.threatdown.com
URL: blob:https://www.threatdown.com/918b4a16-0731-4265-aa46-d7d9584ff4a4

Verdicts & Comments Add Verdict or Comment

117 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

23 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.threatdown.com/	1970-01-21 08:44:17	Name: _vwo_uuid_v2 Value: DD554191E324B4B306DE3E7D0EFDC2E85\|e2e1d6c669f26288d99f13c5ba2063da
.threatdown.com/	1970-01-21 08:43:12	Name: _vwo_uuid Value: DD554191E324B4B306DE3E7D0EFDC2E85
.www.threatdown.com/	1970-01-20 23:57:18	Name: ppc_last_visited_page Value: https://www.threatdown.com/blog/watch-out-mobidash-android-adware-spread-through-phishing-and-online-links/
.threatdown.com/	1970-01-21 02:21:15	Name: _vis_opt_s Value: 1%7C
.threatdown.com/	1969-12-31 23:59:59	Name: _vis_opt_test_cookie Value: 1
.threatdown.com/	1970-01-21 09:33:15	Name: tk_ai Value: %2BIPYfDQzlZmUWw6PeX3J7Fsm
.js.ubembed.com/	1970-01-20 23:57:16	Name: __cf_bm Value: HqpqUb3KiX6nSFwxTs7alx6VBQISBXRUm5or78Fs6M0-1727835052-1.0.1.1-Y7aeJJRJl.G_YzKFDoexGtHJPipqt0HUA9pO9cQpw7i2ckwxLzILvQjPBRFSx66e5BWc75GnFKFnbfLj5h4WQw
.threatdown.com/	1970-01-21 02:06:51	Name: _vwo_ds Value: 3%3Aa_1%2Ct_1%3A0%241727835051%3A8.13559344%3A%3A%3A37_1%2C4_1%3A0
.go.malwarebytes.com/	1970-01-20 23:57:16	Name: __cf_bm Value: dhXLPLImKQ62nNV_Sb_MG69pLWUz0Nz.O.wSqF64tpA-1727835052-1.0.1.1-7lOcJYeqQA8zEhhHRD8nq1P_4GHNkvtzK3MAfGlfupwGC6KBgB0.W_wYPFwTGL7Ek9xjsq29mFy_mAvbQ_KA5Q
.threatdown.com/	1970-01-20 23:57:16	Name: _vwo_sn Value: 0%3A1%3Ar3.visualwebsiteoptimizer.com%3A1%3A1%3Areferrer%3D
.threatdown.com/	1970-01-21 04:16:27	Name: OptanonConsent Value: isGpcEnabled=0&datestamp=Wed+Oct+02+2024+04%3A10%3A53+GMT%2B0200+(Mitteleurop%C3%A4ische+Sommerzeit)&version=202403.1.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=1cd2dcfa-db66-44b8-8de6-4008a76157fb&interactionCount=0&isAnonUser=1&landingPath=https%3A%2F%2Fwww.threatdown.com%2Fblog%2Fwatch-out-mobidash-android-adware-spread-through-phishing-and-online-links%2F&groups=C0001%3A1%2CC0003%3A0%2CC0002%3A0%2CC0004%3A0
.company-target.com/	1970-01-21 09:33:15	Name: tuuid Value: 41e20599-5c18-46f0-ba24-8c118910d859
.company-target.com/	1970-01-21 09:33:15	Name: tuuid_lu Value: 1727835053\|ix:0\|mctv:0\|rp:0
.threatdown.com/	1970-01-21 09:33:15	Name: _ga_K8KCHE3KSC Value: GS1.1.1727835053.1.0.1727835053.60.0.0
.threatdown.com/	1970-01-21 09:33:15	Name: _ga Value: GA1.1.220033538.1727835053
.casalemedia.com/	1970-01-21 08:42:51	Name: CMID Value: ZvyrrVVbLVMAAA8NARVpfgAA
.casalemedia.com/	1970-01-21 02:06:51	Name: CMPS Value: 5169
.casalemedia.com/	1970-01-21 02:06:51	Name: CMPRO Value: 5169
.tremorhub.com/	1970-01-21 08:43:11	Name: tvid Value: 688e17b0ebcc47bbbbeef283066b1afb
.tremorhub.com/	1970-01-21 09:33:15	Name: tv_UIDM Value: 41e20599-5c18-46f0-ba24-8c118910d859
www.threatdown.com/	1970-01-20 23:57:16	Name: drift_campaign_refresh Value: 74c00028-9433-4c64-b99a-da2f6bc6d469
www.threatdown.com/	1970-01-21 09:33:15	Name: drift_aid Value: 43e7f6b3-edda-4d2e-90d0-2f40202a5a10
www.threatdown.com/	1970-01-21 09:33:15	Name: driftt_aid Value: 43e7f6b3-edda-4d2e-90d0-2f40202a5a10

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://www.threatdown.com/wp-content/themes/mbc/images/indic-chevron-right.svg Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://id.rlcdn.com/464526.gif Message: Failed to load resource: the server responded with a status of 451 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

185c650ccfd84b27aad189f19681365b.js.ubembed.com
api.company-target.com
api.ipstack.com
api.weglot.com
assets.ubembed.com
cdn.cookielaw.org
dev.visualwebsiteoptimizer.com
fonts.googleapis.com
fonts.gstatic.com
geolocation.onetrust.com
go.malwarebytes.com
id.rlcdn.com
js.driftt.com
pixel.wp.com
r3.visualwebsiteoptimizer.com
region1.analytics.google.com
s.company-target.com
stats.g.doubleclick.net
stats.wp.com
tag-logger.demandbase.com
tag.demandbase.com
www.google.de
www.googletagmanager.com
www.threatdown.com
www.threatdown.com
104.17.72.206
104.17.74.206
104.18.39.181
108.138.26.31
142.250.185.163
142.250.186.35
172.64.149.114
18.245.46.25
18.245.86.14
18.245.86.77
18.66.102.75
192.0.66.84
192.0.76.3
2001:4860:4802:34::36
2600:9000:2724:9000:1d:8d6d:3b40:93a1
2606:4700:4400::6812:2089
2606:4700::6812:572a
2a00:1450:4001:80f::2008
2a00:1450:4001:829::200a
2a00:1450:400c:c1f::9c
34.197.248.129
34.96.102.137
34.96.71.22
35.194.81.74
35.244.174.68
010abc1425a170a391af2a90f06ff1b98b92c43dc33523ed2c6dac45ac81e1ab
02f067845d9b173b7565811c608b3ab14d760b1eb182ac9e10a05ef13a635c6e
0423f69dc0e5f863d923e48c8c61298979b1c3fbdacbf6976d2b36f160bdea88
06c0edbfc1b871fb45195265f5faad3e23191305f6ff2125557a9fbc287c8992
09b67475f266dbf552159ca9f6b44d9dc3ea04842b2bd6e8b09d74f6b21897d0
0a7f44c1354ebe8134dc5fae913b06aabf953b16fa52e327e25b59083da1e2ea
0ed759f9b0f407aa73df997bddf186c37a1927d2b0f8d2f7031067ecacf7581d
14c8c62dc692fd8faa04434e3fed25e7c23d596b732f9db88f6e9f9ff5dfa61c
162344dd9df7bdcea168f2227c115f6d785db536ad48b3153872faa6282098fd
1dc8465c5deadea9b38d7307bcefe48bfa6c96b4b92686e8e635e0cf9c27734d
256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a
28b48920a64e295085db5f353539dbff2b7f6d76c4ba71e959ffac345a36c5c1
2cb546fbdda7995d374fffa4b2f6530bbcf57d014639ddf76de45df43d593045
3b115e38069ecd710cec6bf59bf5f74a2a81845a0362ad4dddb7d45d89d02816
3d2c10cf69410c10177fc6e56937d05151b182841fa6aee36f651d587d91fbb8
458a654724a5ca18680cf80cf4b7072b1a71ca9c1077ac9111c694b379dcf0fa
4662962f6a7ba6c6e423763f88ab9af3ec3fb17eeba90a673590984319c3e706
4c9359c1a26148379cdb326639e7ac4da9577c6e94d09af93f6d8900dbd6dd5e
4dbd328e347e890a801d51f9a5f8d38a3efd51ec34c0aa22cc83d0a95d6d9d71
4dd117d2c92e7c493a6741ab1460b8248c512c3fbb15ea9a2bc5a7b0bfe16411
4e6ce5444c7f396cef0eb1fa3611034151e485dd06fbe5573a5583e1eebc98c3
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
5a9aa0112c5d786557feaa6cf96b3136219005f43dc46cd6c394b8d387006901
5badd609a51ede5bab5b89534fc3011a4dd1ab487cc7081d7cf38479bcbab855
5d2b0efc546ca6819349d6682a6c8371afc842557afe8e5b156a26380bf0a263
5e5c12d7275bca7a6c4cc0422ac102b9c1b7d60a2bf6aa871953e35464143068
5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d
5fb7c176325267082e94a7131fed5e157516e6805cee3ac6f6a93340a947d640
5fdbbc5a54538597b95c74b6d225177b81e592b918749ce476cc4aeaf0bb6640
62abda4145106e7fdc2da0f66791347453380f63809b981468c6897d79a30003
635c69243b34e95bb6c714cb6c43815c7b4c50d0e2ef76354df4cb2b4a1325af
691dcdb24853a0f5ce4e6597e5713dea66799b57ffe2c2a10f28f98e0b569b19
6bf2514d72c9fa4a4302b61fcf77edc48803d7af8f09575320e117d9889a23ff
6d1137d21f3ba78b8a882dbf77f7c88712ad02a3f5efdce5ff996a67c15a6bf6
6db83b2803fed3f9b574567755102b18c401904a374c8acf4c9a2e9b0159cb4f
73d68145c096b2edc4c09a6c9e123ed1abc6ab1afc1d7f3d579ba2931e0c60af
79ee837dd384ba3484203f513c56fe5fca731c9012d7d82e6a7f243078a1f71c
7a5310911f167d7e0237f082c9950b89a6ef02d63b349d2c00fcb8c398e4e46b
7ae5e1d574f0a6914abd79584dfa9c15799739fdb878f97dc956e1a478ae190d
8227f3613cc8587b97ee185581b4be37a71e377b381a695bcd5e58439fcbbf03
830569b6b9eda3e3e8575c44353e6257a755857675c7dfbf43fd5410667628c6
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84f5f5aa795694fd24258c8dee7a6f36f94a505f6f0446e06515f6114864f037
872d4e2ae170a25a803a61b0dde9fe4ce7ae5b80bd59e333eb139161ec22e495
89978e658e840b927dddb5cb3a835c7d8526ece79933bd9f3096b301fe1a8571
8a8737fa6233104a7cfd1a96d055f1df6cf39243d78a0acd4b2594581705d17e
8c6f8073282a52c566dc04bc0156e182877b9c7b803c277fd1647a8f02e93b2a
901bb0e03b8c3c0a1cf4c487a177417328bb7d8c94106ecefceedd7d7f6c4ddc
95cc88624c5917156db88bac6b01540bc6ad7852ed113873ceaf6d93168655ac
98f6682d1cc74b20a3af3878bf57cbeb74539ad18b569ca227af2d1979f64c02
9a81aca6e5e7d838c68f108c3265034b98a56518f08bba74436478f2edc915a5
9d994e9f852d02b751310208a3a6bdd04416bd0834b1eee217cc6649f9f88055
9da2bd1aa1b397eea1fa3b751fd50e0f624a33761a4e9e9fd660ed3d26f07f1b
9e36f834eeef0ed10ef8d2681c179af354758c4d329f3514ac4caae28a7310a9
9e7b15e5a63410ed9a1f0391c990255d7c67d20f46aabf5b02f3712b6c61220b
a8001aed837f420114f70b577c372c83aa288a8138fa71802ba35aa39218bf81
aa879a89d5f522391f099f229403255317c4f91ed8027d898fae42cfd64eeb51
ae0e442895406e9922237108496c2cd60f4947649a826463e2da9860b5c25dd6
b2d0a7f68bd1207582f9e4861705b74627867c88582cbac6b70baf4b462e592b
b62e2b5a98092e6d82cd6c650253589a3ae63e2ec8591c156cfb413e405e17c3
b829c597d30d2a416fc4a94a829c51b045569e37abaca72b227d642cb077df7f
bbcc769c4704058d89afc024f24dde11deed8ec61b99f1d52ba935fad8614523
bc48f6d63c43b68b083b43a28928a8c79fa5a940b958f3c82e7cf9dfb20cc713
bf8b6eabee06732294708b4285c90c685bb297b55151f7efe37afd1ead1d3ab0
c0813b9627886c9fa1d6d57eb7a227747ab6e2629ab19bf1f646af9c7c3d79e0
c39fa609f4a9b43e493115c723b102147f9025008bd24841e7732c5f253edd51
c8c32294948f5448c2ac0bcdf5b98909dab4ee73ac854be06bfd4a13bce89363
c9e433acb7082694e1a6a861ad1bd4f218ea3cdd57fcbfff823a0967a2aa925e
cb86d971ded6b3f73f6be5ad76afd08c70099363c2aa64f29343e2a447a5404f
cf9ca61a00ddb5352412e2b3786688e6c7d94a3ff94f9683d3f2be6c8dfec8f0
d0dd6c8fec30b51f1a834b32180421f8ecb978e131a7ec73608618987baf3016
d9bada3a44bb2ffa66dec5cc781cafc9ef17ed876cd9b0c5f7ef18228b63cebb
dc731d27b605c8bfda83754695f4de65206b95681806892e01db3cd374838d18
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3cc69a381981c2717f3a867f2d2449593a3f70dab0cd5db512cff9757f6acb0
e9433f83f20500145850d5aabddced402dcfc94e310072e9a3f545df0bdb9f96
ecf7723a32533007ede558c546fc8ba30f508283223b6e7f49c297b7c63c8b50
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f313d12ea6124bd28fc4a6b7163d253bb83d5aeab5edce594880c5c3df475cbc
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
f4aaa18c55c90588c5e828e56dcc6b2cb0acf9a4280494c7d1a53fc5e3669112
f5d6c45b0fbb8928cbbd23b7bd0197ba5e764f41a6c9e4dcf6b3d2cb2b756373
f5f7f84a6660ca9cf09f9b24030045f4657aef64dc3405076f926f1bfd7da63f
fb3a89cc6347e098063bd15f285bc90411846ddce6f17812364feedab67a67f5

www.threatdown.com Open in urlscan Pro 192.0.66.84 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

96 Requests

97 %HTTPS

28 %IPv6

19 Domains

24 Subdomains

26 IPs

4 Countries

1747 kBTransfer

4616 kBSize

23 Cookies

13 Outgoing links

Redirected requests

96 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.threatdown.com Open in urlscan Pro
192.0.66.84 Public Scan

Screenshot
Live screenshot

Full Image

96
Requests

97 %
HTTPS

28 %
IPv6

19
Domains

24
Subdomains

26
IPs

4
Countries

1747 kB
Transfer

4616 kB
Size

23
Cookies

96 HTTP transactions
2 data transactions