malwarefixit.com Open in urlscan Pro
208.76.245.34 Public Scan

Go To Rescan
Add Verdict Report

URL:
http://malwarefixit.com/remove-malware/w32-hfsautob-066b.htm
Submission Tags: falconsandbox
Submission: On April 19 via api (April 19th 2021, 10:52:10 am UTC) from US

Summary HTTP 83 Redirects Links 26 Behaviour Indicators

Summary

This website contacted 26 IPs in 3 countries across 16 domains to perform 83 HTTP transactions. The main IP is 208.76.245.34, located in United States and belongs to CRUCIAL, US. The main domain is malwarefixit.com.

This is the only time malwarefixit.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
3 19	208.76.245.34 208.76.245.34	20202 (CRUCIAL) (CRUCIAL)
1	2a00:1450:400... 2a00:1450:4001:80f::200a	15169 (GOOGLE) (GOOGLE)
1	2a04:fa87:fff... 2a04:fa87:fffe::c000:4902	2635 (AUTOMATTIC) (AUTOMATTIC)
3	2a00:1450:400... 2a00:1450:4001:80f::2002	15169 (GOOGLE) (GOOGLE)
5	2a00:1450:400... 2a00:1450:4001:828::2003	15169 (GOOGLE) (GOOGLE)
2	104.22.53.65 104.22.53.65	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:801::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80e::2002	15169 (GOOGLE) (GOOGLE)
1	142.250.186.98 142.250.186.98	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:800::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:810::2002	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:802::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:827::2002	15169 (GOOGLE) (GOOGLE)
2 7	151.101.112.134 151.101.112.134	54113 (FASTLY) (FASTLY)
1	2a00:1450:400... 2a00:1450:4001:82a::2002	15169 (GOOGLE) (GOOGLE)
19	2606:4700::68... 2606:4700::6812:a813	13335 (CLOUDFLAR...) (CLOUDFLARENET)
8	151.101.192.134 151.101.192.134	54113 (FASTLY) (FASTLY)
2	151.101.14.49 151.101.14.49	54113 (FASTLY) (FASTLY)
2	2a03:2880:f02... 2a03:2880:f02d:12:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
2	2a00:1450:400... 2a00:1450:4001:810::200e	15169 (GOOGLE) (GOOGLE)
1	2a03:2880:f12... 2a03:2880:f12d:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
2	2a00:1450:400... 2a00:1450:4001:811::200d	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:811::2003	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:811::2001	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80f::2001	15169 (GOOGLE) (GOOGLE)
83	26

19 208.76.245.34 (United States) 3 redirects

ASN20202 (CRUCIAL, US)
PTR: s497.c4.crucialp.com

malwarefixit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
greatis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80f::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:fa87:fffe::c000:4902 (Ireland)

ASN2635 (AUTOMATTIC, US)

0.gravatar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:80f::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:828::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.22.53.65 (United States)

ASN13335 (CLOUDFLARENET, US)

www.statcounter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.statcounter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:801::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80e::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.186.98 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s06-in-f2.1e100.net

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:800::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:810::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:802::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:827::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 151.101.112.134 (Frankfurt am Main, Germany) 2 redirects

ASN54113 (FASTLY, US)

cleanvir.disqus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
referrer.disqus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82a::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

19 2606:4700::6812:a813 (United States)

ASN13335 (CLOUDFLARENET, US)

c.disquscdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 151.101.192.134 (United States)

ASN54113 (FASTLY, US)

disqus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.14.49 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

a.disquscdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f02d:12:face:b00c:0:3 (United States)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:810::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

apis.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f12d:83:face:b00c:0:25de (United States)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:811::200d (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

accounts.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:811::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ssl.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:811::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80f::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
21	disquscdn.com c.disquscdn.com a.disquscdn.com	726 KB
15	disqus.com 2 redirects cleanvir.disqus.com disqus.com referrer.disqus.com	98 KB
13	malwarefixit.com malwarefixit.com	255 KB
7	googlesyndication.com pagead2.googlesyndication.com tpc.googlesyndication.com	155 KB
6	google.com adservice.google.com apis.google.com accounts.google.com	40 KB
6	gstatic.com fonts.gstatic.com ssl.gstatic.com	122 KB
6	greatis.com 3 redirects greatis.com	14 KB
3	doubleclick.net googleads.g.doubleclick.net	5 KB
2	facebook.net connect.facebook.net	66 KB
2	google.de adservice.google.de	287 B
2	statcounter.com www.statcounter.com c.statcounter.com	15 KB
1	facebook.com www.facebook.com
1	googletagservices.com www.googletagservices.com	28 KB
1	googleadservices.com partner.googleadservices.com	644 B
1	gravatar.com 0.gravatar.com	3 KB
1	googleapis.com fonts.googleapis.com	2 KB
83	16

	Domain	Requested by
19	c.disquscdn.com	cleanvir.disqus.com disqus.com c.disquscdn.com
13	malwarefixit.com	malwarefixit.com
8	disqus.com	cleanvir.disqus.com c.disquscdn.com
6	greatis.com	3 redirects malwarefixit.com
5	cleanvir.disqus.com	2 redirects malwarefixit.com cleanvir.disqus.com
5	fonts.gstatic.com	fonts.googleapis.com
5	pagead2.googlesyndication.com	malwarefixit.com pagead2.googlesyndication.com tpc.googlesyndication.com
3	googleads.g.doubleclick.net	pagead2.googlesyndication.com
2	tpc.googlesyndication.com	pagead2.googlesyndication.com tpc.googlesyndication.com
2	referrer.disqus.com	malwarefixit.com
2	accounts.google.com	apis.google.com ssl.gstatic.com
2	apis.google.com	c.disquscdn.com apis.google.com
2	connect.facebook.net	c.disquscdn.com connect.facebook.net
2	a.disquscdn.com	malwarefixit.com c.disquscdn.com
2	adservice.google.com	pagead2.googlesyndication.com
2	adservice.google.de	pagead2.googlesyndication.com
1	ssl.gstatic.com	accounts.google.com
1	www.facebook.com	c.disquscdn.com
1	c.statcounter.com	www.statcounter.com
1	www.googletagservices.com	pagead2.googlesyndication.com
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	www.statcounter.com	malwarefixit.com
1	0.gravatar.com	malwarefixit.com
1	fonts.googleapis.com	malwarefixit.com
83	24

This site contains links to these domains. Also see Links.

Domain
greatis.com
plus.google.com
www.facebook.com
twitter.com
www.pinterest.com
www.linkedin.com
www.tumblr.com
digg.com
www.stumbleupon.com
myspace.com
vk.com
www.reddit.com
www.bebo.com
delicious.com
www.odnoklassniki.ru
sns.qzone.qq.com
service.weibo.com
widget.renren.com
n4g.com
ideaboxthemes.com
www.poradnik-webmastera.com

Subject Issuer	Validity	Valid
greatis.com cPanel, Inc. Certification Authority	`2021-02-09` - `2021-05-10`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2021-03-23` - `2021-06-15`	3 months	crt.sh
*.googleadservices.com GTS CA 1O1	`2021-03-23` - `2021-06-15`	3 months	crt.sh
*.google.de GTS CA 1O1	`2021-03-23` - `2021-06-15`	3 months	crt.sh
*.google.com GTS CA 1O1	`2021-03-23` - `2021-06-15`	3 months	crt.sh
us-dallas.statcounter.com Sectigo RSA Domain Validation Secure Server CA	`2020-10-13` - `2021-11-13`	a year	crt.sh
*.disqus.com DigiCert SHA2 Secure Server CA	`2020-04-20` - `2022-05-09`	2 years	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-08-15` - `2021-08-15`	a year	crt.sh
*.disquscdn.com GlobalSign Atlas R3 DV TLS CA 2020	`2021-03-22` - `2022-04-23`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2021-04-06` - `2021-07-03`	3 months	crt.sh
*.apis.google.com GTS CA 1O1	`2021-03-23` - `2021-06-15`	3 months	crt.sh
accounts.google.com GTS CA 1O1	`2021-03-23` - `2021-06-15`	3 months	crt.sh
*.gstatic.com GTS CA 1O1	`2021-03-23` - `2021-06-15`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1O1	`2021-03-23` - `2021-06-15`	3 months	crt.sh

This page contains 8 frames:

Primary Page: http://malwarefixit.com/remove-malware/w32-hfsautob-066b.htm
Frame ID: AC78F16E60E95743DC79B90DFABEE354
Requests: 47 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20210414/r20190131/zrt_lookup.html
Frame ID: 02C6A01471B87DFA9651CF4E938B55DC
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1909731584357274&output=html&h=90&slotname=1092803764&adk=308481230&adf=4025689514&pi=t.ma~as.1092803764&w=728&lmt=1618829507&psa=0&format=728x90&url=http%3A%2F%2Fmalwarefixit.com%2Fremove-malware%2Fw32-hfsautob-066b.htm&flash=0&wgl=1&dt=1618829507816&bpp=14&bdt=495&idt=58&shv=r20210414&cbv=r20190131&ptt=9&saldr=aa&abxe=1&correlator=1296859467049&frm=20&pv=2&ga_vid=2006481385.1618829508&ga_sid=1618829508&ga_hid=1496848070&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=250&ady=2018&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44740079&oid=3&pvsid=2703670568446435&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&cms=2&fu=0&bc=23&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=3A37gAFdyx&p=http%3A//malwarefixit.com&dtd=75
Frame ID: BB285CFEC17028D35F74535C18E939E7
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1909731584357274&output=html&adk=1812271804&adf=3025194257&lmt=1618829507&plat=1%3A32776%2C2%3A32776%2C8%3A134217728%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=http%3A%2F%2Fmalwarefixit.com%2Fremove-malware%2Fw32-hfsautob-066b.htm&ea=0&flash=0&pra=7&wgl=1&dt=1618829508091&bpp=1&bdt=770&idt=1&shv=r20210414&cbv=r20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3D2128eed03d856a7e-22e0147b9aa70087%3AT%3D1618829507%3ART%3D1618829507%3AS%3DALNI_MbQZKilSMTVMLYtRf-oMa8Cd1lmgw&prev_fmts=728x90&nras=1&correlator=1296859467049&frm=20&pv=1&ga_vid=2006481385.1618829508&ga_sid=1618829508&ga_hid=1496848070&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44740079&oid=3&pvsid=2703670568446435&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=0&bc=23&ifi=2&uci=a!2&fsb=1&dtd=7
Frame ID: 21E3DBA521D42C74BD84F027E1392FDB
Requests: 1 HTTP requests in this frame

Frame: https://disqus.com/embed/comments/?base=default&f=cleanvir&t_i=13617%20http%3A%2F%2Fgreatis.com%2Fcleanvirus%2Fremove-malware%2Fw32-hfsautob-066b.htm&t_u=http%3A%2F%2Fmalwarefixit.com%2Fremove-malware%2Fw32-hfsautob-066b.htm&t_e=W32.HfsAutoB.066b&t_d=W32.HfsAutoB.066b%20%C2%AB%20Malware%20%C2%AB%20Clean%20Virus&t_t=W32.HfsAutoB.066b&s_o=default&l=
Frame ID: A54F75C011936A1EF2FFEC38301B2FF8
Requests: 21 HTTP requests in this frame

Frame: https://disqus.com/recommendations/?base=default&f=cleanvir&t_i=13617%20http%3A%2F%2Fgreatis.com%2Fcleanvirus%2Fremove-malware%2Fw32-hfsautob-066b.htm&t_u=http%3A%2F%2Fmalwarefixit.com%2Fremove-malware%2Fw32-hfsautob-066b.htm&t_e=W32.HfsAutoB.066b&t_d=W32.HfsAutoB.066b%20%C2%AB%20Malware%20%C2%AB%20Clean%20Virus&t_t=W32.HfsAutoB.066b
Frame ID: 50E45D420C492E01F4F787094C67FA9C
Requests: 8 HTTP requests in this frame

Frame: https://accounts.google.com/o/oauth2/iframe
Frame ID: BA1B6B2CEC294DA063318E3F571C5070
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/222/runner.html
Frame ID: C7C63C5D524E7CF000E5A3B55C36F086
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
meta generator /^WordPress ?([\d.]+)?/i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
meta generator /^WordPress ?([\d.]+)?/i

MySQL (Databases) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
meta generator /^WordPress ?([\d.]+)?/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

script /googlesyndication\.com\//i

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

Page Statistics

83
Requests

73 %
HTTPS

76 %
IPv6

16
Domains

24
Subdomains

26
IPs

3
Countries

1527 kB
Transfer

2941 kB
Size

0
Cookies

26 Outgoing links

These are links going to different origins than the main page.

URL: http://greatis.com/unhackme/thankyou.htm?force=1&pk_campaign=cleanvirus&pk_kwd=fixtop
Title: UnHackMe!

Search URL Search Domain Scan URL

URL: http://greatis.com/unhackme/thankyou.htm?force=1&pk_campaign=cleanvirus&pk_kwd=fixt

Search URL Search Domain Scan URL

URL: https://plus.google.com/107260089491053348151?rel=author
Title: Alex NightWatcher

Search URL Search Domain Scan URL

URL: http://greatis.com/iunhackme
Title: UnHackMe

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?m2w&u=malwarefixit.com/remove-malware/w32-hfsautob-066b.htm

Search URL Search Domain Scan URL

URL: https://twitter.com/share?status=malwarefixit.com/remove-malware/w32-hfsautob-066b.htm&text=W32.HfsAutoB.066b

Search URL Search Domain Scan URL

URL: http://www.pinterest.com/pin/create/button/?url=malwarefixit.com/remove-malware/w32-hfsautob-066b.htm&media=http://malwarefixit.com/wp-content/plugins/wp-share-buttons/Front_end/../images/noimage.png&description=W32.HfsAutoB.066b

Search URL Search Domain Scan URL

URL: https://plus.google.com/share?url=malwarefixit.com/remove-malware/w32-hfsautob-066b.htm

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/shareArticle?title=W32.HfsAutoB.066b&mini=true&url=malwarefixit.com/remove-malware/w32-hfsautob-066b.htm

Search URL Search Domain Scan URL

URL: https://www.tumblr.com/share/link?url=malwarefixit.com/remove-malware/w32-hfsautob-066b.htm&name=W32.HfsAutoB.066b

Search URL Search Domain Scan URL

URL: http://digg.com/submit?phase=2&url=malwarefixit.com/remove-malware/w32-hfsautob-066b.htm&title=W32.HfsAutoB.066b

Search URL Search Domain Scan URL

URL: http://www.stumbleupon.com/submit?url=malwarefixit.com/remove-malware/w32-hfsautob-066b.htm&title=W32.HfsAutoB.066b

Search URL Search Domain Scan URL

URL: https://myspace.com/post?l=3&u=malwarefixit.com/remove-malware/w32-hfsautob-066b.htm

Search URL Search Domain Scan URL

URL: http://vk.com/share.php?url=malwarefixit.com/remove-malware/w32-hfsautob-066b.htm&title=W32.HfsAutoB.066b

Search URL Search Domain Scan URL

URL: http://www.reddit.com/submit?url=malwarefixit.com/remove-malware/w32-hfsautob-066b.htm&title=W32.HfsAutoB.066b

Search URL Search Domain Scan URL

URL: http://www.bebo.com/c/share?Url=malwarefixit.com/remove-malware/w32-hfsautob-066b.htm

Search URL Search Domain Scan URL

URL: https://delicious.com/save?v=5&noui&jump=close&url=malwarefixit.com/remove-malware/w32-hfsautob-066b.htm&title=W32.HfsAutoB.066b

Search URL Search Domain Scan URL

URL: http://www.odnoklassniki.ru/dk?st.cmd=addShare&st.s=2&st.noresize=on&st._surl=malwarefixit.com/remove-malware/w32-hfsautob-066b.htm

Search URL Search Domain Scan URL

URL: http://sns.qzone.qq.com/cgi-bin/qzshare/cgi_qzshare_onekey?url=malwarefixit.com/remove-malware/w32-hfsautob-066b.htm&title=W32.HfsAutoB.066b

Search URL Search Domain Scan URL

URL: http://service.weibo.com/share/share.php?url=malwarefixit.com/remove-malware/w32-hfsautob-066b.htm&appkey=&title=W32.HfsAutoB.066b&pic=&ralateUid=&

Search URL Search Domain Scan URL

URL: http://widget.renren.com/dialog/share?resourceUrl=malwarefixit.com/remove-malware/w32-hfsautob-066b.htm&srcUrl=malwarefixit.com/remove-malware/w32-hfsautob-066b.htm&title=W32.HfsAutoB.066b

Search URL Search Domain Scan URL

URL: http://n4g.com/tips?url=malwarefixit.com/remove-malware/w32-hfsautob-066b.htm&title=W32.HfsAutoB.066b

Search URL Search Domain Scan URL

URL: http://greatis.com/unhackme/thankyou.htm?force=1&pk_campaign=cleanvirus&pk_kwd=fixbot

Search URL Search Domain Scan URL

URL: http://ideaboxthemes.com/
Title: Tatva WordPress theme by IdeaBox

Search URL Search Domain Scan URL

URL: http://www.poradnik-webmastera.com/projekty/meta_seo_pack/
Title: Meta SEO Pack

Search URL Search Domain Scan URL

URL: http://www.poradnik-webmastera.com/
Title: Poradnik Webmastera

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 3

http://greatis.com/blog/pics/dima64.jpg HTTP 302
https://greatis.com/blog/pics/dima64.jpg

Request Chain 4

http://greatis.com/blog/pics/download-unhackme.gif HTTP 302
https://greatis.com/blog/pics/download-unhackme.gif

Request Chain 7

http://greatis.com/blog/pics/download-removal-tool.gif HTTP 302
https://greatis.com/blog/pics/download-removal-tool.gif

Request Chain 31

http://cleanvir.disqus.com/embed.js HTTP 301
https://cleanvir.disqus.com/embed.js

Request Chain 32

http://cleanvir.disqus.com/count.js HTTP 301
https://cleanvir.disqus.com/count.js

83 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request Cookie set w32-hfsautob-066b.htm Show response
malwarefixit.com/remove-malware/ 37 KB
10 KB 4955ms
4783ms Document
text/html 208.76.245.34
CRUCIAL

General

Check archive.org

Show headers Download Go to

Full URL: http://malwarefixit.com/remove-malware/w32-hfsautob-066b.htm
Protocol: HTTP/1.1
Server: 208.76.245.34 , United States, ASN20202 (CRUCIAL, US),
Reverse DNS: s497.c4.crucialp.com
Software: Apache / PHP/5.6.40
Resource Hash: 13fc9d7b29ec40196fd7750e38dda03df5c550c631f22681a9225bdabf879d26

Request headers

Host: malwarefixit.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 19 Apr 2021 10:51:42 GMT
Server: Apache
X-Powered-By: PHP/5.6.40
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Link: <http://malwarefixit.com/?p=13617>; rel=shortlink
Content-Encoding: gzip
Vary: Accept-Encoding,User-Agent
X-Pingback: http://malwarefixit.com/xmlrpc.php
Set-Cookie: PHPSESSID=ecc8d1e1f83be4062bd1de6f85e04571; path=/
Last-Modified: Mon, 19 Apr 2021 10:51:47 GMT
Keep-Alive: timeout=2, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK Vc3BDoMwDAPQH6JkfFKAICqVJopTKv5-1bQddvLl2V6oW8LJLmltEVpBiKcIHa41Zqn79KLguDmVHEIMSIA2gI4BEneBXjJfuf7Dz8q0UFffzQVIptYK-0jE76WbDcMtTnU0_9ZA1taStzc.css
malwarefixit.com/wp-content/cache/minify/000000/ 73 KB
15 KB 207ms
190ms Stylesheet
text/css 208.76.245.34
CRUCIAL

General

Check archive.org

Show headers Download Go to

Full URL: http://malwarefixit.com/wp-content/cache/minify/000000/Vc3BDoMwDAPQH6JkfFKAICqVJopTKv5-1bQddvLl2V6oW8LJLmltEVpBiKcIHa41Zqn79KLguDmVHEIMSIA2gI4BEneBXjJfuf7Dz8q0UFffzQVIptYK-0jE76WbDcMtTnU0_9ZA1taStzc.css
Requested by: Host: malwarefixit.com
URL: http://malwarefixit.com/remove-malware/w32-hfsautob-066b.htm
Protocol: HTTP/1.1
Server: 208.76.245.34 , United States, ASN20202 (CRUCIAL, US),
Reverse DNS: s497.c4.crucialp.com
Software: Apache / W3 Total Cache/0.9.1.3
Resource Hash: 105b700ab3ac2e4555c96919dc81744e291de3143ce8b3bbd67a92f05a06e9ad

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: malwarefixit.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: http://malwarefixit.com/remove-malware/w32-hfsautob-066b.htm
Cookie: PHPSESSID=ecc8d1e1f83be4062bd1de6f85e04571
Connection: keep-alive
Cache-Control: no-cache
Referer: http://malwarefixit.com/remove-malware/w32-hfsautob-066b.htm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 19 Apr 2021 10:51:47 GMT
Content-Encoding: gzip
Last-Modified: Sat, 22 Jul 2017 16:07:43 GMT
Server: Apache
X-Powered-By: W3 Total Cache/0.9.1.3
Vary: Accept-Encoding
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=99
Content-Length: 15121

GET
H/1.1 200
OK usr_style.php
malwarefixit.com/wp-content/plugins/universal-star-rating/includes/ 474 B
525 B 371ms
350ms Stylesheet
text/css 208.76.245.34
CRUCIAL

General

Check archive.org

Show headers Download Go to

Full URL: http://malwarefixit.com/wp-content/plugins/universal-star-rating/includes/usr_style.php?px=12&usrver=1.10.0&ver=4.3.11
Requested by: Host: malwarefixit.com
URL: http://malwarefixit.com/remove-malware/w32-hfsautob-066b.htm
Protocol: HTTP/1.1
Server: 208.76.245.34 , United States, ASN20202 (CRUCIAL, US),
Reverse DNS: s497.c4.crucialp.com
Software: Apache / PHP/5.6.40
Resource Hash: 041ba231b72e3e5e3e203a91bb06053ca657dac40510f163d9e4f0cd7169fafa

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: malwarefixit.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: http://malwarefixit.com/remove-malware/w32-hfsautob-066b.htm
Cookie: PHPSESSID=ecc8d1e1f83be4062bd1de6f85e04571
Connection: keep-alive
Cache-Control: no-cache
Referer: http://malwarefixit.com/remove-malware/w32-hfsautob-066b.htm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 19 Apr 2021 10:51:47 GMT
Content-Encoding: gzip
Server: Apache
X-Powered-By: PHP/5.6.40
Vary: Accept-Encoding,User-Agent
Content-Type: text/css;charset=UTF-8
Connection: Keep-Alive
Keep-Alive: timeout=2, max=100
Content-Length: 254

GET
H/1.1 200
OK css
fonts.googleapis.com/ 13 KB
2 KB 15ms
15ms Stylesheet
text/css 2a00:1450:4001:80f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.googleapis.com/css?family=Open+Sans:400,300,400italic,700,700italic|Montserrat:400,700&subset=latin

Requested by

Host: malwarefixit.com
URL: http://malwarefixit.com/remove-malware/w32-hfsautob-066b.htm

Protocol

HTTP/1.1

Server

2a00:1450:4001:80f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

73e6e8b5c28efc91475f6bf3f05898deb429aaf3b597e7c9fad6c8a197acbe7d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: http://malwarefixit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 19 Apr 2021 10:51:47 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Mon, 19 Apr 2021 10:51:47 GMT
Server: ESF
X-Frame-Options: SAMEORIGIN
Content-Type: text/css; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: private, max-age=86400, stale-while-revalidate=604800
Transfer-Encoding: chunked
Cross-Origin-Resource-Policy: cross-origin
Timing-Allow-Origin: *
Link: <http://fonts.gstatic.com>; rel=preconnect; crossorigin
X-XSS-Protection: 0
Expires: Mon, 19 Apr 2021 10:51:47 GMT

GET
H/1.1

200
OK

dima64.jpg
greatis.com/blog/pics/
Redirect Chain

http://greatis.com/blog/pics/dima64.jpg
https://greatis.com/blog/pics/dima64.jpg

1 KB
1 KB

613ms
188ms

Image
image/jpeg

208.76.245.34
CRUCIAL

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://greatis.com/blog/pics/dima64.jpg
Requested by: Host: malwarefixit.com
URL: http://malwarefixit.com/remove-malware/w32-hfsautob-066b.htm
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 208.76.245.34 , United States, ASN20202 (CRUCIAL, US),
Reverse DNS: s497.c4.crucialp.com
Software: Apache / W3 Total Cache/0.9.1.3
Resource Hash: 27ba09ef9560cd1fbdcd23292b97e78541a9b9c8c913e396ad6723275bce3454

Request headers

Referer: http://malwarefixit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 19 Apr 2021 10:51:48 GMT
Last-Modified: Fri, 05 Dec 2014 10:12:10 GMT
Server: Apache
X-Powered-By: W3 Total Cache/0.9.1.3
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=100
Content-Length: 1163

Redirect headers

Location: https://greatis.com/blog/pics/dima64.jpg
Date: Mon, 19 Apr 2021 10:51:48 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=2, max=100
Content-Length: 224
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1

200
OK

download-unhackme.gif
greatis.com/blog/pics/
Redirect Chain

http://greatis.com/blog/pics/download-unhackme.gif
https://greatis.com/blog/pics/download-unhackme.gif

6 KB
6 KB

613ms
188ms

Image
image/gif

208.76.245.34
CRUCIAL

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://greatis.com/blog/pics/download-unhackme.gif
Requested by: Host: malwarefixit.com
URL: http://malwarefixit.com/remove-malware/w32-hfsautob-066b.htm
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 208.76.245.34 , United States, ASN20202 (CRUCIAL, US),
Reverse DNS: s497.c4.crucialp.com
Software: Apache / W3 Total Cache/0.9.1.3
Resource Hash: 5ac97e4b298f836bc53cbf8ca4d7f5fc39eb624fe134b20d2178564384a39b7f

Request headers

Referer: http://malwarefixit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 19 Apr 2021 10:51:48 GMT
Last-Modified: Mon, 13 Apr 2015 09:37:18 GMT
Server: Apache
X-Powered-By: W3 Total Cache/0.9.1.3
Content-Type: image/gif
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=100
Content-Length: 5692

Redirect headers

Location: https://greatis.com/blog/pics/download-unhackme.gif
Date: Mon, 19 Apr 2021 10:51:48 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=2, max=100
Content-Length: 235
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 200
OK stars.php
malwarefixit.com/wp-content/plugins/universal-star-rating/includes/ 1018 B
1 KB 372ms
187ms Image
image/png 208.76.245.34
CRUCIAL

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://malwarefixit.com/wp-content/plugins/universal-star-rating/includes/stars.php?img=06.png&px=12&max=5&rat=5
Requested by: Host: malwarefixit.com
URL: http://malwarefixit.com/remove-malware/w32-hfsautob-066b.htm
Protocol: HTTP/1.1
Server: 208.76.245.34 , United States, ASN20202 (CRUCIAL, US),
Reverse DNS: s497.c4.crucialp.com
Software: Apache / PHP/5.6.40
Resource Hash: edb5483a53e50a99a820c4d5dac9ffd305b6afe0427a0828d3a43bb499941082

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: malwarefixit.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer: http://malwarefixit.com/remove-malware/w32-hfsautob-066b.htm
Cookie: PHPSESSID=ecc8d1e1f83be4062bd1de6f85e04571
Connection: keep-alive
Cache-Control: no-cache
Referer: http://malwarefixit.com/remove-malware/w32-hfsautob-066b.htm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 19 Apr 2021 10:51:47 GMT
Content-Encoding: gzip
Server: Apache
X-Powered-By: PHP/5.6.40
Vary: Accept-Encoding,User-Agent
Content-Type: image/png
Connection: Keep-Alive
Keep-Alive: timeout=2, max=98
Content-Length: 884

GET
H/1.1 200
OK 3bc847cde5d0334abf77f22a10c8bc4f
0.gravatar.com/avatar/ 2 KB
3 KB 12ms
5ms Image
image/jpeg 2a04:fa87:fffe::c000:4902
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://0.gravatar.com/avatar/3bc847cde5d0334abf77f22a10c8bc4f?s=60&d=mm&r=g
Requested by: Host: malwarefixit.com
URL: http://malwarefixit.com/remove-malware/w32-hfsautob-066b.htm
Protocol: HTTP/1.1
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 6fd7644c723ad68af13f563013b451abf66d4801b7fc984f46c66508dad8bdf3

Request headers

Referer: http://malwarefixit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

X-nc: HIT hhn 1
Date: Mon, 19 Apr 2021 10:51:47 GMT
Last-Modified: Thu, 26 Jul 2012 09:27:31 GMT
Server: nginx
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Cache-Control: max-age=300
Content-Disposition: inline; filename="3bc847cde5d0334abf77f22a10c8bc4f.jpeg"
Connection: keep-alive
Accept-Ranges: bytes
Link: <https://www.gravatar.com/avatar/3bc847cde5d0334abf77f22a10c8bc4f?s=60&d=mm&r=g>; rel="canonical"
Content-Length: 2123
Expires: Mon, 19 Apr 2021 10:56:47 GMT

GET
H/1.1

200
OK

download-removal-tool.gif
greatis.com/blog/pics/
Redirect Chain

http://greatis.com/blog/pics/download-removal-tool.gif
https://greatis.com/blog/pics/download-removal-tool.gif

6 KB
6 KB

644ms
191ms

Image
image/gif

208.76.245.34
CRUCIAL

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://greatis.com/blog/pics/download-removal-tool.gif
Requested by: Host: malwarefixit.com
URL: http://malwarefixit.com/remove-malware/w32-hfsautob-066b.htm
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 208.76.245.34 , United States, ASN20202 (CRUCIAL, US),
Reverse DNS: s497.c4.crucialp.com
Software: Apache / W3 Total Cache/0.9.1.3
Resource Hash: 3ca3e32832946feccf9509bfb44fd3dee7a0f60027cdf80fe3cee9cfb417a379

Request headers

Referer: http://malwarefixit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 19 Apr 2021 10:51:48 GMT
Last-Modified: Fri, 05 Dec 2014 10:12:12 GMT
Server: Apache
X-Powered-By: W3 Total Cache/0.9.1.3
Content-Type: image/gif
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=100
Content-Length: 5874

Redirect headers

Location: https://greatis.com/blog/pics/download-removal-tool.gif
Date: Mon, 19 Apr 2021 10:51:48 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=2, max=100
Content-Length: 239
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 200
OK 1.png
malwarefixit.com/wp-content/uploads/2017/04/ 10 KB
11 KB 189ms
189ms Image
image/png 208.76.245.34
CRUCIAL

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://malwarefixit.com/wp-content/uploads/2017/04/1.png
Requested by: Host: malwarefixit.com
URL: http://malwarefixit.com/remove-malware/w32-hfsautob-066b.htm
Protocol: HTTP/1.1
Server: 208.76.245.34 , United States, ASN20202 (CRUCIAL, US),
Reverse DNS: s497.c4.crucialp.com
Software: Apache / W3 Total Cache/0.9.1.3
Resource Hash: 141e1e911b8114adac10b87a31575b4b255937707c59c2daff0bde7002c7266f

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: malwarefixit.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer: http://malwarefixit.com/remove-malware/w32-hfsautob-066b.htm
Cookie: PHPSESSID=ecc8d1e1f83be4062bd1de6f85e04571; sc_is_visitor_unique=rx10728684.1618829508.8A16C33328B04FFFBA1A5BB57D41C9A0.1.1.1.1.1.1.1.1.1; __gads=ID=2128eed03d856a7e-22e0147b9aa70087:T=1618829507:RT=1618829507:S=ALNI_MbQZKilSMTVMLYtRf-oMa8Cd1lmgw
Connection: keep-alive
Cache-Control: no-cache
Referer: http://malwarefixit.com/remove-malware/w32-hfsautob-066b.htm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 19 Apr 2021 10:51:48 GMT
Last-Modified: Wed, 10 May 2017 08:17:02 GMT
Server: Apache
X-Powered-By: W3 Total Cache/0.9.1.3
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=97
Content-Length: 10555

GET
H/1.1 200
OK adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 134 KB
48 KB 30ms
23ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: malwarefixit.com
URL: http://malwarefixit.com/remove-malware/w32-hfsautob-066b.htm

Protocol

HTTP/1.1

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

dad2ac3f093b8cdcca3bfce4fb4d0d7c2e72bd3247ea05ec5e383559d4c3a77f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://malwarefixit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Timing-Allow-Origin: *
Date: Mon, 19 Apr 2021 10:51:47 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: cafe
ETag: 9885252380620520250
Vary: Accept-Encoding, Origin
P3P: policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Cache-Control: private, max-age=3600
Cross-Origin-Resource-Policy: cross-origin
Content-Disposition: attachment; filename="f.txt"
Content-Type: text/javascript; charset=UTF-8
Content-Length: 48646
X-XSS-Protection: 0
Expires: Mon, 19 Apr 2021 10:51:47 GMT

GET
H/1.1 200
OK bcxLCoAwDATQC9mkVcHzBA1SaaumUdDT-8WVu2HmMRaVdCUTvDJSzqwZh4xx7FiS38WU0IAz0aeixnaMkZMa4SlscHUVDvPCsn3hlL2Q8r3a__NHwkrBdy8FB86BnYQP.js Show response
malwarefixit.com/wp-content/cache/minify/000000/ 142 KB
47 KB 189ms
189ms Script
application/x-javascript 208.76.245.34
CRUCIAL

General

Check archive.org

Show headers Download Go to

Full URL: http://malwarefixit.com/wp-content/cache/minify/000000/bcxLCoAwDATQC9mkVcHzBA1SaaumUdDT-8WVu2HmMRaVdCUTvDJSzqwZh4xx7FiS38WU0IAz0aeixnaMkZMa4SlscHUVDvPCsn3hlL2Q8r3a__NHwkrBdy8FB86BnYQP.js
Requested by: Host: malwarefixit.com
URL: http://malwarefixit.com/remove-malware/w32-hfsautob-066b.htm
Protocol: HTTP/1.1
Server: 208.76.245.34 , United States, ASN20202 (CRUCIAL, US),
Reverse DNS: s497.c4.crucialp.com
Software: Apache / W3 Total Cache/0.9.1.3
Resource Hash: c76b678224e0ef5e5b1093631b6d32ef566a788a5c751c710859e0c2fb93d810

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: malwarefixit.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: */*
Referer: http://malwarefixit.com/remove-malware/w32-hfsautob-066b.htm
Cookie: PHPSESSID=ecc8d1e1f83be4062bd1de6f85e04571
Connection: keep-alive
Cache-Control: no-cache
Referer: http://malwarefixit.com/remove-malware/w32-hfsautob-066b.htm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 19 Apr 2021 10:51:47 GMT
Content-Encoding: gzip
Last-Modified: Sat, 22 Jul 2017 16:07:52 GMT
Server: Apache
X-Powered-By: W3 Total Cache/0.9.1.3
Vary: Accept-Encoding
Content-Type: application/x-javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=98
Content-Length: 48231

GET
H/1.1 200
OK bcvBDYBACATAhiRcSxvFBANHIuvVrwX4nxlKcEHCaYpuY-vVulemTcpZd8pC-AF6zW38805EyDeeFw.js Show response
malwarefixit.com/wp-content/cache/minify/000000/ 1 KB
818 B 186ms
185ms Script
application/x-javascript 208.76.245.34
CRUCIAL

General

Check archive.org

Show headers Download Go to

Full URL: http://malwarefixit.com/wp-content/cache/minify/000000/bcvBDYBACATAhiRcSxvFBANHIuvVrwX4nxlKcEHCaYpuY-vVulemTcpZd8pC-AF6zW38805EyDeeFw.js
Requested by: Host: malwarefixit.com
URL: http://malwarefixit.com/remove-malware/w32-hfsautob-066b.htm
Protocol: HTTP/1.1
Server: 208.76.245.34 , United States, ASN20202 (CRUCIAL, US),
Reverse DNS: s497.c4.crucialp.com
Software: Apache / W3 Total Cache/0.9.1.3
Resource Hash: 55aebca688276d2e179896353d39b532cfe38fcab7dd1254af7871766fa4827f

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: malwarefixit.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: */*
Referer: http://malwarefixit.com/remove-malware/w32-hfsautob-066b.htm
Cookie: PHPSESSID=ecc8d1e1f83be4062bd1de6f85e04571
Connection: keep-alive
Cache-Control: no-cache
Referer: http://malwarefixit.com/remove-malware/w32-hfsautob-066b.htm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 19 Apr 2021 10:51:47 GMT
Content-Encoding: gzip
Last-Modified: Sat, 22 Jul 2017 16:07:54 GMT
Server: Apache
X-Powered-By: W3 Total Cache/0.9.1.3
Vary: Accept-Encoding
Content-Type: application/x-javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=99
Content-Length: 477

GET
H/1.1 200
OK M9RPySwuLC3WTc7PzU3NK9EtriwuSc3Vz01NyUzUzyqGSgMA.js Show response
malwarefixit.com/wp-content/cache/minify/000000/ 1 KB
896 B 374ms
351ms Script
application/x-javascript 208.76.245.34
CRUCIAL

General

Check archive.org

Show headers Download Go to

Full URL: http://malwarefixit.com/wp-content/cache/minify/000000/M9RPySwuLC3WTc7PzU3NK9EtriwuSc3Vz01NyUzUzyqGSgMA.js
Requested by: Host: malwarefixit.com
URL: http://malwarefixit.com/remove-malware/w32-hfsautob-066b.htm
Protocol: HTTP/1.1
Server: 208.76.245.34 , United States, ASN20202 (CRUCIAL, US),
Reverse DNS: s497.c4.crucialp.com
Software: Apache / W3 Total Cache/0.9.1.3
Resource Hash: fea0c5ed46d4f7e0bdf1dd44a57624ae09c05847a250ca365ea0511788ef2b59

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: malwarefixit.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: */*
Referer: http://malwarefixit.com/remove-malware/w32-hfsautob-066b.htm
Cookie: PHPSESSID=ecc8d1e1f83be4062bd1de6f85e04571
Connection: keep-alive
Cache-Control: no-cache
Referer: http://malwarefixit.com/remove-malware/w32-hfsautob-066b.htm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 19 Apr 2021 10:51:47 GMT
Content-Encoding: gzip
Last-Modified: Sat, 22 Jul 2017 16:08:01 GMT
Server: Apache
X-Powered-By: W3 Total Cache/0.9.1.3
Vary: Accept-Encoding
Content-Type: application/x-javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=100
Content-Length: 554

GET
H/1.1 200
OK M9RPySwuLC3WTc7PzU3NK9EtriwuSc3Vz01NyUzUzyrWT84vzSsBAA.js Show response
malwarefixit.com/wp-content/cache/minify/000000/ 668 B
724 B 378ms
355ms Script
application/x-javascript 208.76.245.34
CRUCIAL

General

Check archive.org

Show headers Download Go to

Full URL: http://malwarefixit.com/wp-content/cache/minify/000000/M9RPySwuLC3WTc7PzU3NK9EtriwuSc3Vz01NyUzUzyrWT84vzSsBAA.js
Requested by: Host: malwarefixit.com
URL: http://malwarefixit.com/remove-malware/w32-hfsautob-066b.htm
Protocol: HTTP/1.1
Server: 208.76.245.34 , United States, ASN20202 (CRUCIAL, US),
Reverse DNS: s497.c4.crucialp.com
Software: Apache / W3 Total Cache/0.9.1.3
Resource Hash: 0514a158a9513625ab8fa361f2634b79aaa924c4ff5a782619fc9a810b08ef5e

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: malwarefixit.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: */*
Referer: http://malwarefixit.com/remove-malware/w32-hfsautob-066b.htm
Cookie: PHPSESSID=ecc8d1e1f83be4062bd1de6f85e04571
Connection: keep-alive
Cache-Control: no-cache
Referer: http://malwarefixit.com/remove-malware/w32-hfsautob-066b.htm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 19 Apr 2021 10:51:47 GMT
Content-Encoding: gzip
Last-Modified: Sat, 22 Jul 2017 16:07:57 GMT
Server: Apache
X-Powered-By: W3 Total Cache/0.9.1.3
Vary: Accept-Encoding
Content-Type: application/x-javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=100
Content-Length: 382

POST
H/1.1 200
OK admin-ajax.php Show response
malwarefixit.com/wp-admin/ 40 B
622 B 2469ms
2469ms XHR
text/html 208.76.245.34
CRUCIAL

General

Check archive.org

Show headers Download Go to

Full URL

http://malwarefixit.com/wp-admin/admin-ajax.php

Requested by

Host: malwarefixit.com
URL: http://malwarefixit.com/remove-malware/w32-hfsautob-066b.htm

Protocol

HTTP/1.1

Server

208.76.245.34 , United States, ASN20202 (CRUCIAL, US),

Reverse DNS

s497.c4.crucialp.com

Software

Apache / PHP/5.6.40

Resource Hash

1d6e7f534598bf30bf358f130cb27459503055e09c0de0a3f02ebc65b133d239

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Pragma: no-cache
Origin: http://malwarefixit.com
Accept-Encoding: gzip, deflate
Host: malwarefixit.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: application/x-www-form-urlencoded
Accept: */*
Cache-Control: no-cache
Referer: http://malwarefixit.com/remove-malware/w32-hfsautob-066b.htm
Cookie: PHPSESSID=ecc8d1e1f83be4062bd1de6f85e04571
Connection: keep-alive
Content-Length: 54
Referer: http://malwarefixit.com/remove-malware/w32-hfsautob-066b.htm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

Date: Mon, 19 Apr 2021 10:51:47 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Powered-By: PHP/5.6.40
Connection: Keep-Alive
Content-Length: 60
Pragma: no-cache
Server: Apache
X-Frame-Options: SAMEORIGIN
Vary: Accept-Encoding,User-Agent
Content-Type: text/html; charset=UTF-8
Access-Control-Allow-Origin: http://malwarefixit.com
Cache-Control: no-cache, must-revalidate, max-age=0
Access-Control-Allow-Credentials: true
X-Robots-Tag: noindex
Keep-Alive: timeout=2, max=100
Expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H/1.1 200
OK buttons.30.png
malwarefixit.com/wp-content/plugins/wp-share-buttons/images/ 123 KB
123 KB 186ms
185ms Image
image/png 208.76.245.34
CRUCIAL

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://malwarefixit.com/wp-content/plugins/wp-share-buttons/images/buttons.30.png
Requested by: Host: malwarefixit.com
URL: http://malwarefixit.com/remove-malware/w32-hfsautob-066b.htm
Protocol: HTTP/1.1
Server: 208.76.245.34 , United States, ASN20202 (CRUCIAL, US),
Reverse DNS: s497.c4.crucialp.com
Software: Apache / W3 Total Cache/0.9.1.3
Resource Hash: fc73a8e755637ec54915fbe7836a8501c97c625588a7106f05df1f292cd3ea37

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: malwarefixit.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer: http://malwarefixit.com/remove-malware/w32-hfsautob-066b.htm
Cookie: PHPSESSID=ecc8d1e1f83be4062bd1de6f85e04571; sc_is_visitor_unique=rx10728684.1618829508.8A16C33328B04FFFBA1A5BB57D41C9A0.1.1.1.1.1.1.1.1.1; __gads=ID=2128eed03d856a7e-22e0147b9aa70087:T=1618829507:RT=1618829507:S=ALNI_MbQZKilSMTVMLYtRf-oMa8Cd1lmgw
Connection: keep-alive
Cache-Control: no-cache
Referer: http://malwarefixit.com/remove-malware/w32-hfsautob-066b.htm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 19 Apr 2021 10:51:48 GMT
Last-Modified: Thu, 10 Dec 2015 14:03:54 GMT
Server: Apache
X-Powered-By: W3 Total Cache/0.9.1.3
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=97
Content-Length: 125900

GET
H/1.1 200
OK mem8YaGs126MiZpBA-UFVZ0b.woff2
fonts.gstatic.com/s/opensans/v18/ 14 KB
14 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.gstatic.com/s/opensans/v18/mem8YaGs126MiZpBA-UFVZ0b.woff2

Requested by

Host: fonts.googleapis.com
URL: http://fonts.googleapis.com/css?family=Open+Sans:400,300,400italic,700,700italic|Montserrat:400,700&subset=latin

Protocol

HTTP/1.1

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9c50a96c859b9beea47b71740bd14e7f69a4df586d015f47434037f8def53b52

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: http://malwarefixit.com
Referer: http://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 15 Apr 2021 02:03:03 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 15 Sep 2020 18:09:22 GMT
Server: sffe
Age: 377324
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 14380
X-XSS-Protection: 0
Expires: Fri, 15 Apr 2022 02:03:03 GMT

GET
H/1.1 200
OK JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
fonts.gstatic.com/s/montserrat/v15/ 19 KB
19 KB 12ms
6ms Font
font/woff2 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.gstatic.com/s/montserrat/v15/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2

Requested by

Host: fonts.googleapis.com
URL: http://fonts.googleapis.com/css?family=Open+Sans:400,300,400italic,700,700italic|Montserrat:400,700&subset=latin

Protocol

HTTP/1.1

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8767f01caa430c5bd4e3b008a8e9dfe022156a4e91a23c394fdcb05c267f1b94

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: http://malwarefixit.com
Referer: http://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 18 Apr 2021 10:03:43 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 15 Sep 2020 18:11:52 GMT
Server: sffe
Age: 89284
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 19172
X-XSS-Protection: 0
Expires: Mon, 18 Apr 2022 10:03:43 GMT

GET
H/1.1 200
OK fontawesome-webfont.woff
malwarefixit.com/wp-content/themes/tatva-lite/assets/fonts/ 43 KB
44 KB 379ms
360ms Font
font/woff 208.76.245.34
CRUCIAL

General

Check archive.org

Show headers Download Go to

Full URL: http://malwarefixit.com/wp-content/themes/tatva-lite/assets/fonts/fontawesome-webfont.woff?v=4.0.3
Requested by: Host: malwarefixit.com
URL: http://malwarefixit.com/wp-content/cache/minify/000000/Vc3BDoMwDAPQH6JkfFKAICqVJopTKv5-1bQddvLl2V6oW8LJLmltEVpBiKcIHa41Zqn79KLguDmVHEIMSIA2gI4BEneBXjJfuf7Dz8q0UFffzQVIptYK-0jE76WbDcMtTnU0_9ZA1taStzc.css
Protocol: HTTP/1.1
Server: 208.76.245.34 , United States, ASN20202 (CRUCIAL, US),
Reverse DNS: s497.c4.crucialp.com
Software: Apache /
Resource Hash: 0fd28fece9ebd606b8b071460ebd3fc2ed7bc7a66ef91c8834f11dfacab4a849

Request headers

Pragma: no-cache
Origin: http://malwarefixit.com
Accept-Encoding: gzip, deflate
Host: malwarefixit.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: */*
Referer: http://malwarefixit.com/wp-content/cache/minify/000000/Vc3BDoMwDAPQH6JkfFKAICqVJopTKv5-1bQddvLl2V6oW8LJLmltEVpBiKcIHa41Zqn79KLguDmVHEIMSIA2gI4BEneBXjJfuf7Dz8q0UFffzQVIptYK-0jE76WbDcMtTnU0_9ZA1taStzc.css
Cookie: PHPSESSID=ecc8d1e1f83be4062bd1de6f85e04571
Connection: keep-alive
Cache-Control: no-cache
Origin: http://malwarefixit.com
Referer: http://malwarefixit.com/wp-content/cache/minify/000000/Vc3BDoMwDAPQH6JkfFKAICqVJopTKv5-1bQddvLl2V6oW8LJLmltEVpBiKcIHa41Zqn79KLguDmVHEIMSIA2gI4BEneBXjJfuf7Dz8q0UFffzQVIptYK-0jE76WbDcMtTnU0_9ZA1taStzc.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 19 Apr 2021 10:51:47 GMT
Content-Encoding: gzip
Last-Modified: Thu, 10 Dec 2015 13:47:18 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Content-Type: font/woff
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=100
Content-Length: 44427

GET
H/1.1 200
OK mem5YaGs126MiZpBA-UN_r8OUuhp.woff2
fonts.gstatic.com/s/opensans/v18/ 15 KB
15 KB 14ms
8ms Font
font/woff2 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.gstatic.com/s/opensans/v18/mem5YaGs126MiZpBA-UN_r8OUuhp.woff2

Requested by

Host: fonts.googleapis.com
URL: http://fonts.googleapis.com/css?family=Open+Sans:400,300,400italic,700,700italic|Montserrat:400,700&subset=latin

Protocol

HTTP/1.1

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f677ee2d82dfb11f08175f673cf3f065b0d5e491b4485e01259a492715c746e2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: http://malwarefixit.com
Referer: http://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 15 Apr 2021 10:56:12 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 15 Sep 2020 18:09:21 GMT
Server: sffe
Age: 345335
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 14932
X-XSS-Protection: 0
Expires: Fri, 15 Apr 2022 10:56:12 GMT

GET
H/1.1 200
OK mem5YaGs126MiZpBA-UN7rgOUuhp.woff2
fonts.gstatic.com/s/opensans/v18/ 15 KB
15 KB 13ms
7ms Font
font/woff2 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.gstatic.com/s/opensans/v18/mem5YaGs126MiZpBA-UN7rgOUuhp.woff2

Requested by

Host: fonts.googleapis.com
URL: http://fonts.googleapis.com/css?family=Open+Sans:400,300,400italic,700,700italic|Montserrat:400,700&subset=latin

Protocol

HTTP/1.1

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

74201a4b97ec1d5e86252dd0180eafd8c5378a9235864dbcd682f3575b41c85b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: http://malwarefixit.com
Referer: http://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 18 Apr 2021 10:03:39 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 15 Sep 2020 18:11:00 GMT
Server: sffe
Age: 89288
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 15056
X-XSS-Protection: 0
Expires: Mon, 18 Apr 2022 10:03:39 GMT

GET
H/1.1 200
OK JTURjIg1_i6t8kCHKm45_dJE3gnD_g.woff2
fonts.gstatic.com/s/montserrat/v15/ 19 KB
19 KB 12ms
6ms Font
font/woff2 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.gstatic.com/s/montserrat/v15/JTURjIg1_i6t8kCHKm45_dJE3gnD_g.woff2

Requested by

Host: fonts.googleapis.com
URL: http://fonts.googleapis.com/css?family=Open+Sans:400,300,400italic,700,700italic|Montserrat:400,700&subset=latin

Protocol

HTTP/1.1

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4545eb1dec25fe868d19dc292d417d8a9e41c0276d75a4eaf524a9db21aa705a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: http://malwarefixit.com
Referer: http://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 18 Apr 2021 10:03:43 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 15 Sep 2020 18:10:46 GMT
Server: sffe
Age: 89284
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 19480
X-XSS-Protection: 0
Expires: Mon, 18 Apr 2022 10:03:43 GMT

GET
H/1.1 200
OK counter.js Show response
www.statcounter.com/counter/ 38 KB
15 KB 141ms
114ms Script
application/x-javascript 104.22.53.65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://www.statcounter.com/counter/counter.js
Requested by: Host: malwarefixit.com
URL: http://malwarefixit.com/remove-malware/w32-hfsautob-066b.htm
Protocol: HTTP/1.1
Server: 104.22.53.65 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c5086d4f97bc3ee70971c51e89fa6ae25ff054accec7c4e890b1083ee7bcc9ab

Request headers

Referer: http://malwarefixit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

Date: Mon, 19 Apr 2021 10:51:47 GMT
Content-Encoding: gzip
CF-Cache-Status: HIT
Last-Modified: Tue, 19 Jan 2021 10:15:35 GMT
Server: cloudflare
Age: 143
ETag: W/"6006b147-98f7"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=43200
Transfer-Encoding: chunked
Connection: keep-alive
CF-RAY: 642594684d3f0c05-AMS
cf-request-id: 098b5b152f00000c05f4b03000000001
Expires: Mon, 19 Apr 2021 22:49:24 GMT

GET
H2 200 show_ads_impl_with_ama_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20210414/r20190131/ 222 KB
83 KB 34ms
33ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210414/r20190131/show_ads_impl_with_ama_fy2019.js?client=ca-pub-1909731584357274&plah=malwarefixit.com&amaexp=1

Requested by

Host: pagead2.googlesyndication.com
URL: http://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

11d5cc5bb3db6c56fb91f9068e7f4741f6212c8e2e5546b17039c1c58720fb83

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://malwarefixit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 19 Apr 2021 10:51:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 84747
x-xss-protection: 0
server: cafe
etag: 7950800710615234990
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Mon, 19 Apr 2021 10:51:47 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20210414/r20190131/ Frame 02C6 10 KB
5 KB 5ms
5ms Document
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20210414/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: http://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a5cb642ef22434a24612329870579fbb272cb9fa7475360035596ea56fb0431a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/html/r20210414/r20190131/zrt_lookup.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://malwarefixit.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: http://malwarefixit.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Sun, 18 Apr 2021 14:17:37 GMT
expires: Sun, 02 May 2021 14:17:37 GMT
content-type: text/html; charset=UTF-8
etag: 10446291943670460780
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4644
x-xss-protection: 0
age: 74050
cache-control: public, max-age=1209600
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 206 B
644 B 139ms
49ms Script
text/javascript 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=malwarefixit.com&callback=_gfp_s_&client=ca-pub-1909731584357274

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20210414/r20190131/show_ads_impl_with_ama_fy2019.js?client=ca-pub-1909731584357274&plah=malwarefixit.com&amaexp=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

96e5cd135623aca80642dc180955f41e06dbaac8668ef7924d9c7f5d6b9b7fba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://malwarefixit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 19 Apr 2021 10:51:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 195
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
165 B 14ms
14ms Script
application/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=malwarefixit.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://malwarefixit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 19 Apr 2021 10:51:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
165 B 15ms
14ms Script
application/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=malwarefixit.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://malwarefixit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 19 Apr 2021 10:51:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame BB28 399 B
221 B 167ms
166ms Document
text/html 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1909731584357274&output=html&h=90&slotname=1092803764&adk=308481230&adf=4025689514&pi=t.ma~as.1092803764&w=728&lmt=1618829507&psa=0&format=728x90&url=http%3A%2F%2Fmalwarefixit.com%2Fremove-malware%2Fw32-hfsautob-066b.htm&flash=0&wgl=1&dt=1618829507816&bpp=14&bdt=495&idt=58&shv=r20210414&cbv=r20190131&ptt=9&saldr=aa&abxe=1&correlator=1296859467049&frm=20&pv=2&ga_vid=2006481385.1618829508&ga_sid=1618829508&ga_hid=1496848070&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=250&ady=2018&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44740079&oid=3&pvsid=2703670568446435&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&cms=2&fu=0&bc=23&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=3A37gAFdyx&p=http%3A//malwarefixit.com&dtd=75

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2b18650f7ca8215eb14d31f6310b50450d5f2321cee798fd4ac41c512ca889f3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-1909731584357274&output=html&h=90&slotname=1092803764&adk=308481230&adf=4025689514&pi=t.ma~as.1092803764&w=728&lmt=1618829507&psa=0&format=728x90&url=http%3A%2F%2Fmalwarefixit.com%2Fremove-malware%2Fw32-hfsautob-066b.htm&flash=0&wgl=1&dt=1618829507816&bpp=14&bdt=495&idt=58&shv=r20210414&cbv=r20190131&ptt=9&saldr=aa&abxe=1&correlator=1296859467049&frm=20&pv=2&ga_vid=2006481385.1618829508&ga_sid=1618829508&ga_hid=1496848070&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=250&ady=2018&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44740079&oid=3&pvsid=2703670568446435&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&cms=2&fu=0&bc=23&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=3A37gAFdyx&p=http%3A//malwarefixit.com&dtd=75
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://malwarefixit.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: http://malwarefixit.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Mon, 19 Apr 2021 10:51:48 GMT
server: cafe
content-length: 198
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Mon, 19-Apr-2021 11:06:47 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 19 Apr 2021 10:51:48 GMT
cache-control: private

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 73 KB
28 KB 13ms
13ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

74e1cf077493c33fe895c7ce5732cda76b195e2d357d928f094bc3367cc7a75f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://malwarefixit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 19 Apr 2021 10:51:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1618423639646658"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28266
x-xss-protection: 0
expires: Mon, 19 Apr 2021 10:51:47 GMT

GET
H2 200 t.php Show response
c.statcounter.com/ 162 B
819 B 335ms
197ms XHR
application/json 104.22.53.65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.statcounter.com/t.php?u1=8A16C33328B04FFFBA1A5BB57D41C9A0&sc_project=10728684&java=1&security=34c37994&sc_snum=1&sess=830817&p=0&jg=new&rr=1.1.1.1.1.1.1.1.1&sc_ev_author=NightWatcher&resolution=1600&h=1200&camefrom=&u=http%3A//malwarefixit.com/remove-malware/w32-hfsautob-066b.htm&t=W32.HfsAutoB.066b%20%C2%AB%20Malware%20%C2%AB%20Clean%20Virus&invisible=1&sc_rum_e_s=5592&sc_rum_e_e=5598&sc_rum_f_s=0&sc_rum_f_e=5590&get_config=true
Requested by: Host: www.statcounter.com
URL: http://www.statcounter.com/counter/counter.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.22.53.65 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0564d20c6662fa83c89b22ef3e1185cede3d6e4dfbc1525e936930e8ea58fb13

Request headers

Referer: http://malwarefixit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 19 Apr 2021 10:51:48 GMT
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray: 64259469c9ddc779-AMS
p3p: policyref="http://www.statcounter.com/w3c/p3p.xml", CP="ADMa OUR COM NAV NID DSP NOI COR"
access-control-allow-origin: http://malwarefixit.com
access-control-allow-credentials: true
content-type: application/json
cf-request-id: 098b5b161b0000c779d48e2000000001
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1

200
OK

embed.js Show response
cleanvir.disqus.com/
Redirect Chain

http://cleanvir.disqus.com/embed.js
https://cleanvir.disqus.com/embed.js

73 KB
24 KB

138ms
46ms

Script
application/javascript

151.101.112.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cleanvir.disqus.com/embed.js

Requested by

Host: malwarefixit.com
URL: http://malwarefixit.com/remove-malware/w32-hfsautob-066b.htm

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.112.134 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

openresty /

Resource Hash

731ee6fc8f4b9567d02bfcad0bf69db1d8d0b155007b5ab7bee88eb0c5cc6872

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains

Request headers

Referer: http://malwarefixit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 19 Apr 2021 10:51:48 GMT
Content-Encoding: gzip
Server: openresty
Age: 27
Vary: Accept-Encoding
Connection: keep-alive
Content-Type: application/javascript; charset=utf-8
Cache-Control: private, max-age=60
X-Service: router
Strict-Transport-Security: max-age=300; includeSubdomains
Link: <https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
Content-Length: 24312

Redirect headers

Date: Mon, 19 Apr 2021 10:51:48 GMT
Server: Varnish
Strict-Transport-Security: max-age=300; includeSubdomains
Content-Type: text/html
Location: https://cleanvir.disqus.com/embed.js
Cache-Control: public, max-age=31536000
Connection: close
Link: <https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
Content-Length: 219

GET
H/1.1

200
OK

count.js Show response
cleanvir.disqus.com/
Redirect Chain

http://cleanvir.disqus.com/count.js
https://cleanvir.disqus.com/count.js

1 KB
2 KB

141ms
47ms

Script
application/javascript

151.101.112.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cleanvir.disqus.com/count.js

Requested by

Host: malwarefixit.com
URL: http://malwarefixit.com/remove-malware/w32-hfsautob-066b.htm

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.112.134 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

3487ef2baf0c08ba660a8a143cdeb8ebeec961eea04bccd7c49096b4eb26b875

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: http://malwarefixit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 19 Apr 2021 10:51:48 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Age: 1742118
P3P: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Connection: keep-alive
Content-Length: 871
X-XSS-Protection: 1; mode=block
Last-Modified: Wed, 24 Mar 2021 19:08:53 GMT
Server: nginx
ETag: "605b8e45-367"
Vary: Accept-Encoding
Strict-Transport-Security: max-age=300; includeSubdomains
Content-Type: application/javascript; charset=utf-8
Cache-Control: public, max-age=300
X-Amz-Cf-Pop: DFW55-C3
Link: <https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
X-Amz-Cf-Id: KErR2xNPj8cwdsjlBOPdJH7mEFMI-oZj1EFS-2QuoYYHmA6Y4BxqxQ==

Redirect headers

Date: Mon, 19 Apr 2021 10:51:48 GMT
Server: Varnish
Strict-Transport-Security: max-age=300; includeSubdomains
Content-Type: text/html
Location: https://cleanvir.disqus.com/count.js
Cache-Control: public, max-age=31536000
Connection: close
Link: <https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
Content-Length: 219

GET
H3-29 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 23ms
22ms Script
application/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=malwarefixit.com

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://malwarefixit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 19 Apr 2021 10:51:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 24ms
21ms Script
application/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=malwarefixit.com

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://malwarefixit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 19 Apr 2021 10:51:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 21E3 0
20 B 23ms
22ms Document
text/html 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1909731584357274&output=html&adk=1812271804&adf=3025194257&lmt=1618829507&plat=1%3A32776%2C2%3A32776%2C8%3A134217728%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=http%3A%2F%2Fmalwarefixit.com%2Fremove-malware%2Fw32-hfsautob-066b.htm&ea=0&flash=0&pra=7&wgl=1&dt=1618829508091&bpp=1&bdt=770&idt=1&shv=r20210414&cbv=r20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3D2128eed03d856a7e-22e0147b9aa70087%3AT%3D1618829507%3ART%3D1618829507%3AS%3DALNI_MbQZKilSMTVMLYtRf-oMa8Cd1lmgw&prev_fmts=728x90&nras=1&correlator=1296859467049&frm=20&pv=1&ga_vid=2006481385.1618829508&ga_sid=1618829508&ga_hid=1496848070&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44740079&oid=3&pvsid=2703670568446435&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=0&bc=23&ifi=2&uci=a!2&fsb=1&dtd=7

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-1909731584357274&output=html&adk=1812271804&adf=3025194257&lmt=1618829507&plat=1%3A32776%2C2%3A32776%2C8%3A134217728%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=http%3A%2F%2Fmalwarefixit.com%2Fremove-malware%2Fw32-hfsautob-066b.htm&ea=0&flash=0&pra=7&wgl=1&dt=1618829508091&bpp=1&bdt=770&idt=1&shv=r20210414&cbv=r20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3D2128eed03d856a7e-22e0147b9aa70087%3AT%3D1618829507%3ART%3D1618829507%3AS%3DALNI_MbQZKilSMTVMLYtRf-oMa8Cd1lmgw&prev_fmts=728x90&nras=1&correlator=1296859467049&frm=20&pv=1&ga_vid=2006481385.1618829508&ga_sid=1618829508&ga_hid=1496848070&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44740079&oid=3&pvsid=2703670568446435&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=0&bc=23&ifi=2&uci=a!2&fsb=1&dtd=7
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://malwarefixit.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: http://malwarefixit.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Mon, 19 Apr 2021 10:51:48 GMT
server: cafe
content-length: 0
x-xss-protection: 0
set-cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Mon, 21 Jul 2008 23:59:00 GMT; SameSite=none; Secure IDE=AHWqTUlzh9q2RVzKYO7XmryJ7akdExFwisXFOqwPfmurllM5ayH40FBEHx8yY1B4; expires=Sat, 14-May-2022 10:51:48 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 19 Apr 2021 10:51:48 GMT
cache-control: private

GET
H2 200 lounge.c82b267b396dfbc10ae5113342115da8.css
c.disquscdn.com/next/embed/styles/ 0
23 KB 31ms
15ms Other
text/css 2606:4700::6812:a813
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/styles/lounge.c82b267b396dfbc10ae5113342115da8.css

Requested by

Host: cleanvir.disqus.com
URL: http://cleanvir.disqus.com/embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:a813 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: http://malwarefixit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 19 Apr 2021 10:51:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 4033456
strict-transport-security: max-age=300; includeSubdomains
content-length: 22713
cf-request-id: 098b5b171600002ba1c5be7000000001
timing-allow-origin: *
last-modified: Wed, 03 Mar 2021 01:20:39 GMT
server: cloudflare
etag: "603ee467-58b9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
x-xss-protection: 1; mode=block
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: FRA56-C2
accept-ranges: bytes
cf-ray: 6425946b5c672ba1-FRA
x-amz-cf-id: 8iHhdnaJ5uIRYSyeUnp9kgCqelvQxggEWvWNZtCLHCvwamS-AeRHKw==
expires: Thu, 03 Mar 2022 18:27:32 GMT

GET
H2 200 common.bundle.f485ba8b89bf2153fdb9f493ec342aed.js
c.disquscdn.com/next/embed/ 0
93 KB 33ms
16ms Other
application/javascript 2606:4700::6812:a813
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/common.bundle.f485ba8b89bf2153fdb9f493ec342aed.js

Requested by

Host: cleanvir.disqus.com
URL: http://cleanvir.disqus.com/embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:a813 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: http://malwarefixit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 19 Apr 2021 10:51:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 3516097
strict-transport-security: max-age=300; includeSubdomains
content-length: 94786
cf-request-id: 098b5b171600002ba1adbb5000000001
timing-allow-origin: *
last-modified: Tue, 09 Mar 2021 17:57:38 GMT
server: cloudflare
etag: "6047b712-17242"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-xss-protection: 1; mode=block
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: FRA56-C2
accept-ranges: bytes
cf-ray: 6425946b5c6c2ba1-FRA
x-amz-cf-id: iGbO1sC_L2SXajbXh3fns4o9OWy9yuPPlUqsvZKLIHAqbdlN6Dbhow==
expires: Wed, 09 Mar 2022 18:10:09 GMT

GET
H2 200 lounge.bundle.5c8cd56736a07a84352a4d37a862a762.js
c.disquscdn.com/next/embed/ 0
115 KB 43ms
27ms Other
application/javascript 2606:4700::6812:a813
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/lounge.bundle.5c8cd56736a07a84352a4d37a862a762.js

Requested by

Host: cleanvir.disqus.com
URL: http://cleanvir.disqus.com/embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:a813 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: http://malwarefixit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 19 Apr 2021 10:51:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 2208748
strict-transport-security: max-age=300; includeSubdomains
content-length: 117042
cf-request-id: 098b5b171600002ba1af36c000000001
timing-allow-origin: *
last-modified: Wed, 24 Mar 2021 20:33:38 GMT
server: cloudflare
etag: "605ba222-1c932"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-xss-protection: 1; mode=block
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
cf-ray: 6425946b5c6d2ba1-FRA
x-amz-cf-id: wHMVdFIOKMWmxOB1tyUv-pM5OppW3IdhZaJR7RDK4a0KJo8VIfLMZg==
expires: Thu, 24 Mar 2022 21:19:19 GMT

GET
H/1.1 200
OK config.js
disqus.com/next/ 0
12 KB 130ms
43ms Other
application/javascript 151.101.192.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://disqus.com/next/config.js

Requested by

Host: cleanvir.disqus.com
URL: http://cleanvir.disqus.com/embed.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.192.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://malwarefixit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 19 Apr 2021 10:51:48 GMT
X-Content-Type-Options: nosniff
Content-Type: application/javascript; charset=UTF-8
Server: nginx
Age: 11
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=300; includeSubdomains
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Access-Control-Allow-Origin: *
Cache-Control: public, stale-while-revalidate=300, s-stalewhilerevalidate=3600, max-age=60
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 11688
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK recommendations.js Show response
cleanvir.disqus.com/ 61 KB
20 KB 167ms
167ms Script
application/javascript 151.101.112.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cleanvir.disqus.com/recommendations.js

Requested by

Host: cleanvir.disqus.com
URL: http://cleanvir.disqus.com/embed.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.112.134 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

openresty /

Resource Hash

12d181115f9383d64235cfc106c9d02d379e8a0c9a7ab73961f9c3b550d3d8d2

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains

Request headers

Referer: http://malwarefixit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 19 Apr 2021 10:51:48 GMT
Content-Encoding: gzip
Server: openresty
Age: 0
Vary: Accept-Encoding, Accept, Accept-Encoding, X-Forwarded-Proto, X-Disqus-Shortname, X-Disqus-Device, X-Disqus-Experiment, X-Disqus-Is-Private, X-Disqus-Development-Base
Connection: keep-alive
Content-Type: application/javascript; charset=utf-8
Cache-Control: stale-while-revalidate=60, public, stale-if-error=86400, max-age=60
X-Service: router
Strict-Transport-Security: max-age=300; includeSubdomains
Link: <https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
Content-Length: 20361

GET
H/1.1 200
OK / Show response
disqus.com/embed/comments/ Frame A54F 6 KB
4 KB 225ms
185ms Document
text/html 151.101.192.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://disqus.com/embed/comments/?base=default&f=cleanvir&t_i=13617%20http%3A%2F%2Fgreatis.com%2Fcleanvirus%2Fremove-malware%2Fw32-hfsautob-066b.htm&t_u=http%3A%2F%2Fmalwarefixit.com%2Fremove-malware%2Fw32-hfsautob-066b.htm&t_e=W32.HfsAutoB.066b&t_d=W32.HfsAutoB.066b%20%C2%AB%20Malware%20%C2%AB%20Clean%20Virus&t_t=W32.HfsAutoB.066b&s_o=default&l=

Requested by

Host: cleanvir.disqus.com
URL: http://cleanvir.disqus.com/embed.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.192.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

ba93891a4bf53e67da19a0f17017989f5056696c2a3ff513c9a4738cd92c7133

Security Headers

Name	Value
Content-Security-Policy	script-src https://.twitter.com: https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://.services.disqus.com: https://cdn.boomtrain.com/p13n/ https://apis.google.com https://cdn.syndication.twimg.com/tweets.json https://connect.facebook.net/en_US/sdk.js https://referrer.disqus.com/juggler/ 'unsafe-inline' https://com-disqus.netmng.com:* https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Host: disqus.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: http://malwarefixit.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: http://malwarefixit.com/

Response headers

Connection: keep-alive
Content-Length: 2631
Server: nginx
Content-Type: text/html; charset=utf-8
Content-Security-Policy: script-src https://*.twitter.com:* https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://*.services.disqus.com:* https://cdn.boomtrain.com/p13n/ https://apis.google.com https://cdn.syndication.twimg.com/tweets.json https://connect.facebook.net/en_US/sdk.js https://referrer.disqus.com/juggler/ 'unsafe-inline' https://com-disqus.netmng.com:* https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com
Last-Modified: Thu, 15 Aug 2019 17:57:02 GMT
ETag: W/"lounge:view:4417168388.5c0463e46676453f2b40b125d1cb6827.2"
Link: <https://c.disquscdn.com>;rel=preconnect,<https://c.disquscdn.com>;rel=dns-prefetch
Cache-Control: stale-if-error=3600, s-stalewhilerevalidate=3600, stale-while-revalidate=30, no-cache, must-revalidate, public, s-maxage=5
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Referrer-Policy: no-referrer-when-downgrade
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Content-Encoding: gzip
Date: Mon, 19 Apr 2021 10:51:48 GMT
Age: 0
Vary: Accept-Encoding
Strict-Transport-Security: max-age=300; includeSubdomains

GET
H2 200 recommendations.eff219b98b7c4167b4b289065f36f391.css
c.disquscdn.com/next/recommendations/styles/ 0
4 KB 21ms
20ms Other
text/css 2606:4700::6812:a813
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/recommendations/styles/recommendations.eff219b98b7c4167b4b289065f36f391.css

Requested by

Host: cleanvir.disqus.com
URL: https://cleanvir.disqus.com/recommendations.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:a813 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: http://malwarefixit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 19 Apr 2021 10:51:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 2985321
strict-transport-security: max-age=300; includeSubdomains
content-length: 3748
cf-request-id: 098b5b17c000002ba18e319000000001
timing-allow-origin: *
last-modified: Mon, 15 Mar 2021 21:21:21 GMT
server: cloudflare
etag: "604fcfd1-ea4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
x-xss-protection: 1; mode=block
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: FRA53-C1
accept-ranges: bytes
cf-ray: 6425946c6e442ba1-FRA
x-amz-cf-id: -C814T_EH1fXFNS-8rI9GX0iQ-SivA-k_ff45ra5UfJytc1kYo1b3g==
expires: Tue, 15 Mar 2022 21:34:33 GMT

GET
H2 200 common.bundle.9aad4e5af3027dd4fbeac9669fb17819.js
c.disquscdn.com/next/recommendations/ 0
87 KB 16ms
16ms Other
application/javascript 2606:4700::6812:a813
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/recommendations/common.bundle.9aad4e5af3027dd4fbeac9669fb17819.js

Requested by

Host: cleanvir.disqus.com
URL: https://cleanvir.disqus.com/recommendations.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:a813 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: http://malwarefixit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 19 Apr 2021 10:51:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 1176083
strict-transport-security: max-age=300; includeSubdomains
content-length: 88873
cf-request-id: 098b5b17c000002ba18c81e000000001
timing-allow-origin: *
last-modified: Mon, 05 Apr 2021 19:53:46 GMT
server: cloudflare
etag: "606b6aca-15b29"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-xss-protection: 1; mode=block
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
cf-ray: 6425946c6e462ba1-FRA
x-amz-cf-id: q4IRbEUdZj-_nXmrhnFb27cdJFpuI5rkblMrQGbH31PPqgt6-Itc9g==
expires: Tue, 05 Apr 2022 20:10:25 GMT

GET
H2 200 recommendations.bundle.4214219f8f12995fa46e1e83745b2a0e.js
c.disquscdn.com/next/recommendations/ 0
20 KB 14ms
13ms Other
application/javascript 2606:4700::6812:a813
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/recommendations/recommendations.bundle.4214219f8f12995fa46e1e83745b2a0e.js

Requested by

Host: cleanvir.disqus.com
URL: https://cleanvir.disqus.com/recommendations.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:a813 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: http://malwarefixit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 19 Apr 2021 10:51:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 6046800
strict-transport-security: max-age=300; includeSubdomains
content-length: 19898
cf-request-id: 098b5b17c100002ba173a22000000001
timing-allow-origin: *
last-modified: Wed, 03 Feb 2021 18:02:57 GMT
server: cloudflare
etag: "601ae551-4dba"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-xss-protection: 1; mode=block
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
cf-ray: 6425946c6e472ba1-FRA
x-amz-cf-id: jlTRG_X2NNsZlvqhdFsMtZ1cq8VXo_M_8l7Vvsli87lAsZEB5TIhfw==
expires: Tue, 08 Feb 2022 11:11:48 GMT

GET
H/1.1 200
OK / Show response
disqus.com/recommendations/ Frame 50E4 5 KB
3 KB 148ms
148ms Document
text/html 151.101.192.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://disqus.com/recommendations/?base=default&f=cleanvir&t_i=13617%20http%3A%2F%2Fgreatis.com%2Fcleanvirus%2Fremove-malware%2Fw32-hfsautob-066b.htm&t_u=http%3A%2F%2Fmalwarefixit.com%2Fremove-malware%2Fw32-hfsautob-066b.htm&t_e=W32.HfsAutoB.066b&t_d=W32.HfsAutoB.066b%20%C2%AB%20Malware%20%C2%AB%20Clean%20Virus&t_t=W32.HfsAutoB.066b

Requested by

Host: cleanvir.disqus.com
URL: https://cleanvir.disqus.com/recommendations.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.192.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

63a1da0146081d3e36fd4a56c6d899238a6cfe76f38b50ab31d0ac3d4a6ae1b6

Security Headers

Name	Value
Content-Security-Policy	script-src https://.twitter.com: https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://.services.disqus.com: https://cdn.boomtrain.com/p13n/ https://apis.google.com https://cdn.syndication.twimg.com/tweets.json https://connect.facebook.net/en_US/sdk.js https://referrer.disqus.com/juggler/ 'unsafe-inline' https://com-disqus.netmng.com:* https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Host: disqus.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: http://malwarefixit.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: http://malwarefixit.com/

Response headers

Connection: keep-alive
Content-Length: 2229
Server: nginx
Content-Type: text/html; charset=utf-8
Content-Security-Policy: script-src https://*.twitter.com:* https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://*.services.disqus.com:* https://cdn.boomtrain.com/p13n/ https://apis.google.com https://cdn.syndication.twimg.com/tweets.json https://connect.facebook.net/en_US/sdk.js https://referrer.disqus.com/juggler/ 'unsafe-inline' https://com-disqus.netmng.com:* https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com
Last-Modified: Mon, 12 Aug 2019 23:33:18 GMT
Link: <https://c.disquscdn.com>;rel=preconnect,<https://c.disquscdn.com>;rel=dns-prefetch
Cache-Control: stale-while-revalidate=30, no-cache, must-revalidate, stale-if-error=3600, public
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Content-Encoding: gzip
Date: Mon, 19 Apr 2021 10:51:48 GMT
Age: 0
Vary: Accept-Encoding
Strict-Transport-Security: max-age=300; includeSubdomains

GET
H2 200 lounge.load.a658a7c16140d8728cc859daf581cbbc.js Show response
c.disquscdn.com/next/embed/ Frame A54F 1 KB
1 KB 31ms
18ms Script
application/javascript 2606:4700::6812:a813
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/lounge.load.a658a7c16140d8728cc859daf581cbbc.js

Requested by

Host: disqus.com
URL: https://disqus.com/embed/comments/?base=default&f=cleanvir&t_i=13617%20http%3A%2F%2Fgreatis.com%2Fcleanvirus%2Fremove-malware%2Fw32-hfsautob-066b.htm&t_u=http%3A%2F%2Fmalwarefixit.com%2Fremove-malware%2Fw32-hfsautob-066b.htm&t_e=W32.HfsAutoB.066b&t_d=W32.HfsAutoB.066b%20%C2%AB%20Malware%20%C2%AB%20Clean%20Virus&t_t=W32.HfsAutoB.066b&s_o=default&l=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:a813 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ce33b36f16a953ed16394b859ee8f1a6e7fd9785869fe62e3af78aa019c07f7b

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Origin: https://disqus.com
Referer: https://disqus.com/embed/comments/?base=default&f=cleanvir&t_i=13617%20http%3A%2F%2Fgreatis.com%2Fcleanvirus%2Fremove-malware%2Fw32-hfsautob-066b.htm&t_u=http%3A%2F%2Fmalwarefixit.com%2Fremove-malware%2Fw32-hfsautob-066b.htm&t_e=W32.HfsAutoB.066b&t_d=W32.HfsAutoB.066b%20%C2%AB%20Malware%20%C2%AB%20Clean%20Virus&t_t=W32.HfsAutoB.066b&s_o=default&l=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 19 Apr 2021 10:51:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 2208748
strict-transport-security: max-age=300; includeSubdomains
content-length: 535
cf-request-id: 098b5b186900004e26adac2000000001
timing-allow-origin: *
last-modified: Wed, 24 Mar 2021 20:33:38 GMT
server: cloudflare
etag: "605ba222-217"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-xss-protection: 1; mode=block
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
cf-ray: 6425946d78844e26-FRA
x-amz-cf-id: UvupA6cr16mXG4PtlTB7U9JZSc9DPN4CceokOKQXSpBYeLhaNgD-yw==
expires: Thu, 24 Mar 2022 21:19:18 GMT

GET
H2 200 common.bundle.f485ba8b89bf2153fdb9f493ec342aed.js Show response
c.disquscdn.com/next/embed/ Frame A54F 282 KB
93 KB 14ms
13ms Script
application/javascript 2606:4700::6812:a813
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/common.bundle.f485ba8b89bf2153fdb9f493ec342aed.js

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/lounge.load.a658a7c16140d8728cc859daf581cbbc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:a813 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

33d9c56f2b1408711b9b963963790177ac4e7c38a5ecf0e3c12f558c676e294b

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://disqus.com/embed/comments/?base=default&f=cleanvir&t_i=13617%20http%3A%2F%2Fgreatis.com%2Fcleanvirus%2Fremove-malware%2Fw32-hfsautob-066b.htm&t_u=http%3A%2F%2Fmalwarefixit.com%2Fremove-malware%2Fw32-hfsautob-066b.htm&t_e=W32.HfsAutoB.066b&t_d=W32.HfsAutoB.066b%20%C2%AB%20Malware%20%C2%AB%20Clean%20Virus&t_t=W32.HfsAutoB.066b&s_o=default&l=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 19 Apr 2021 10:51:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 3516097
strict-transport-security: max-age=300; includeSubdomains
content-length: 94786
cf-request-id: 098b5b187d00002ba1c5800000000001
timing-allow-origin: *
last-modified: Tue, 09 Mar 2021 17:57:38 GMT
server: cloudflare
etag: "6047b712-17242"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-xss-protection: 1; mode=block
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: FRA56-C2
accept-ranges: bytes
cf-ray: 6425946d98192ba1-FRA
x-amz-cf-id: iGbO1sC_L2SXajbXh3fns4o9OWy9yuPPlUqsvZKLIHAqbdlN6Dbhow==
expires: Wed, 09 Mar 2022 18:10:09 GMT

GET
H2 200 lounge.c82b267b396dfbc10ae5113342115da8.css
c.disquscdn.com/next/embed/styles/ Frame A54F 126 KB
23 KB 25ms
25ms Stylesheet
text/css 2606:4700::6812:a813
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/styles/lounge.c82b267b396dfbc10ae5113342115da8.css

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.f485ba8b89bf2153fdb9f493ec342aed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:a813 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

20b6097504aed42f81fd7492b0e20ee87c7e7d8f9e0a367081741ec0c405f740

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://disqus.com/embed/comments/?base=default&f=cleanvir&t_i=13617%20http%3A%2F%2Fgreatis.com%2Fcleanvirus%2Fremove-malware%2Fw32-hfsautob-066b.htm&t_u=http%3A%2F%2Fmalwarefixit.com%2Fremove-malware%2Fw32-hfsautob-066b.htm&t_e=W32.HfsAutoB.066b&t_d=W32.HfsAutoB.066b%20%C2%AB%20Malware%20%C2%AB%20Clean%20Virus&t_t=W32.HfsAutoB.066b&s_o=default&l=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 19 Apr 2021 10:51:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 4033456
strict-transport-security: max-age=300; includeSubdomains
content-length: 22713
cf-request-id: 098b5b18ae00002ba1ce093000000001
timing-allow-origin: *
last-modified: Wed, 03 Mar 2021 01:20:39 GMT
server: cloudflare
etag: "603ee467-58b9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
x-xss-protection: 1; mode=block
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: FRA56-C2
accept-ranges: bytes
cf-ray: 6425946de89f2ba1-FRA
x-amz-cf-id: 8iHhdnaJ5uIRYSyeUnp9kgCqelvQxggEWvWNZtCLHCvwamS-AeRHKw==
expires: Thu, 03 Mar 2022 18:27:32 GMT

GET
H2 200 lounge.bundle.5c8cd56736a07a84352a4d37a862a762.js Show response
c.disquscdn.com/next/embed/ Frame A54F 453 KB
115 KB 18ms
17ms Script
application/javascript 2606:4700::6812:a813
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/lounge.bundle.5c8cd56736a07a84352a4d37a862a762.js

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.f485ba8b89bf2153fdb9f493ec342aed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:a813 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ce8fc5b6de8c12b2eac649cc45206787aa6d5c9ab0987020574349688c3df288

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://disqus.com/embed/comments/?base=default&f=cleanvir&t_i=13617%20http%3A%2F%2Fgreatis.com%2Fcleanvirus%2Fremove-malware%2Fw32-hfsautob-066b.htm&t_u=http%3A%2F%2Fmalwarefixit.com%2Fremove-malware%2Fw32-hfsautob-066b.htm&t_e=W32.HfsAutoB.066b&t_d=W32.HfsAutoB.066b%20%C2%AB%20Malware%20%C2%AB%20Clean%20Virus&t_t=W32.HfsAutoB.066b&s_o=default&l=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 19 Apr 2021 10:51:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 2208748
strict-transport-security: max-age=300; includeSubdomains
content-length: 117042
cf-request-id: 098b5b18ae00002ba1cc376000000001
timing-allow-origin: *
last-modified: Wed, 24 Mar 2021 20:33:38 GMT
server: cloudflare
etag: "605ba222-1c932"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-xss-protection: 1; mode=block
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
cf-ray: 6425946de8a12ba1-FRA
x-amz-cf-id: wHMVdFIOKMWmxOB1tyUv-pM5OppW3IdhZaJR7RDK4a0KJo8VIfLMZg==
expires: Thu, 24 Mar 2022 21:19:19 GMT

GET
H/1.1 200
OK config.js Show response
disqus.com/next/ Frame A54F 11 KB
12 KB 42ms
42ms Script
application/javascript 151.101.192.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://disqus.com/next/config.js

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.f485ba8b89bf2153fdb9f493ec342aed.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.192.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

d0627e883f59b06ada61af684c0636818d0e01f4c3fed677f83f974196b8316f

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://disqus.com/embed/comments/?base=default&f=cleanvir&t_i=13617%20http%3A%2F%2Fgreatis.com%2Fcleanvirus%2Fremove-malware%2Fw32-hfsautob-066b.htm&t_u=http%3A%2F%2Fmalwarefixit.com%2Fremove-malware%2Fw32-hfsautob-066b.htm&t_e=W32.HfsAutoB.066b&t_d=W32.HfsAutoB.066b%20%C2%AB%20Malware%20%C2%AB%20Clean%20Virus&t_t=W32.HfsAutoB.066b&s_o=default&l=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 19 Apr 2021 10:51:48 GMT
X-Content-Type-Options: nosniff
Content-Type: application/javascript; charset=UTF-8
Server: nginx
Age: 11
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=300; includeSubdomains
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Access-Control-Allow-Origin: *
Cache-Control: public, stale-while-revalidate=300, s-stalewhilerevalidate=3600, max-age=60
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 11688
X-XSS-Protection: 1; mode=block

GET
H2 200 recommendations.load.07054adb31d4f6133c2fb097add414fd.js Show response
c.disquscdn.com/next/recommendations/ Frame 50E4 923 B
654 B 19ms
18ms Script
application/javascript 2606:4700::6812:a813
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/recommendations/recommendations.load.07054adb31d4f6133c2fb097add414fd.js

Requested by

Host: disqus.com
URL: https://disqus.com/recommendations/?base=default&f=cleanvir&t_i=13617%20http%3A%2F%2Fgreatis.com%2Fcleanvirus%2Fremove-malware%2Fw32-hfsautob-066b.htm&t_u=http%3A%2F%2Fmalwarefixit.com%2Fremove-malware%2Fw32-hfsautob-066b.htm&t_e=W32.HfsAutoB.066b&t_d=W32.HfsAutoB.066b%20%C2%AB%20Malware%20%C2%AB%20Clean%20Virus&t_t=W32.HfsAutoB.066b

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:a813 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

eef38d6cfe80ac20855dcd98162da1541701141843f5ca41834448b259c6c1ed

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Origin: https://disqus.com
Referer: https://disqus.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 19 Apr 2021 10:51:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 1176083
strict-transport-security: max-age=300; includeSubdomains
content-length: 447
cf-request-id: 098b5b18d200004e26ae96b000000001
timing-allow-origin: *
last-modified: Mon, 05 Apr 2021 19:53:45 GMT
server: cloudflare
etag: "606b6ac9-1bf"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-xss-protection: 1; mode=block
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
cf-ray: 6425946e19d34e26-FRA
x-amz-cf-id: A2sY2466bBXFyapI4W_1jPx3FFQwx_3GBnrn52APYnZdQxMSOLTcgA==
expires: Tue, 05 Apr 2022 20:10:25 GMT

GET
H/1.1 200
OK details Show response
disqus.com/api/3.0/forums/ Frame A54F 3 KB
3 KB 147ms
146ms XHR
application/json 151.101.192.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://disqus.com/api/3.0/forums/details?forum=cleanvir&attach=forumFeatures&api_key=E8Uh5l5fHZ6gD8U3KycjAIAk46f68Zw7C6eW8WSjZvCLXebZ7p0r1yrYDrLilk2F

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.f485ba8b89bf2153fdb9f493ec342aed.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.192.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

1f84864570c631b6ab885274d203bfb4138bdd5362e8282f7e0e13c585f497d9

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: */*
Referer: https://disqus.com/embed/comments/?base=default&f=cleanvir&t_i=13617%20http%3A%2F%2Fgreatis.com%2Fcleanvirus%2Fremove-malware%2Fw32-hfsautob-066b.htm&t_u=http%3A%2F%2Fmalwarefixit.com%2Fremove-malware%2Fw32-hfsautob-066b.htm&t_e=W32.HfsAutoB.066b&t_d=W32.HfsAutoB.066b%20%C2%AB%20Malware%20%C2%AB%20Clean%20Virus&t_t=W32.HfsAutoB.066b&s_o=default&l=
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 19 Apr 2021 10:51:49 GMT
X-Content-Type-Options: nosniff
Server: nginx
Age: 0
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=300; includeSubdomains
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Connection: keep-alive
Content-Type: application/json
Vary: Origin, Cookie
Content-Length: 2880
X-XSS-Protection: 1; mode=block

GET
H2 200 common.bundle.9aad4e5af3027dd4fbeac9669fb17819.js Show response
c.disquscdn.com/next/recommendations/ Frame 50E4 262 KB
87 KB 16ms
16ms Script
application/javascript 2606:4700::6812:a813
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/recommendations/common.bundle.9aad4e5af3027dd4fbeac9669fb17819.js

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/recommendations/recommendations.load.07054adb31d4f6133c2fb097add414fd.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:a813 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ffa907d826f82968612e5a325704a5cc38330a791049b23da9725a6609e22538

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://disqus.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 19 Apr 2021 10:51:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 1176083
strict-transport-security: max-age=300; includeSubdomains
content-length: 88873
cf-request-id: 098b5b196100002ba1d58f7000000001
timing-allow-origin: *
last-modified: Mon, 05 Apr 2021 19:53:46 GMT
server: cloudflare
etag: "606b6aca-15b29"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-xss-protection: 1; mode=block
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
cf-ray: 6425946f0a7a2ba1-FRA
x-amz-cf-id: q4IRbEUdZj-_nXmrhnFb27cdJFpuI5rkblMrQGbH31PPqgt6-Itc9g==
expires: Tue, 05 Apr 2022 20:10:25 GMT

GET
H2 200 noavatar92.png
a.disquscdn.com/1617742046/images/ Frame A54F 2 KB
2 KB 131ms
42ms Image
image/png 151.101.14.49
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://a.disquscdn.com/1617742046/images/noavatar92.png

Requested by

Host: malwarefixit.com
URL: http://malwarefixit.com/remove-malware/w32-hfsautob-066b.htm

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.14.49 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

36ef66124133ca33c8b44c487293c3180e5ab681ff3cad3c728ea4f894ec3444

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://disqus.com/embed/comments/?base=default&f=cleanvir&t_i=13617%20http%3A%2F%2Fgreatis.com%2Fcleanvirus%2Fremove-malware%2Fw32-hfsautob-066b.htm&t_u=http%3A%2F%2Fmalwarefixit.com%2Fremove-malware%2Fw32-hfsautob-066b.htm&t_e=W32.HfsAutoB.066b&t_d=W32.HfsAutoB.066b%20%C2%AB%20Malware%20%C2%AB%20Clean%20Virus&t_t=W32.HfsAutoB.066b&s_o=default&l=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 19 Apr 2021 10:51:49 GMT
x-content-type-options: nosniff
last-modified: Fri, 26 Feb 2021 20:50:09 GMT
server: nginx
age: 1073792
etag: "60395f01-66c"
strict-transport-security: max-age=300; includeSubdomains
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
x-xss-protection: 1; mode=block
cache-control: max-age=2592000
x-amz-cf-pop: FRA53-C1
content-type: image/png
content-length: 1644
x-amz-cf-id: vlJLc_TTbx_WsgMOVm5OQhEGOXJOn0aJzq3Z1t9UunmOoaRRTSaXqA==
expires: Fri, 07 May 2021 00:35:16 GMT

GET
DATA 200
OK truncated
/ Frame A54F 37 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif

GET
H2 200 svg-sprite.4da5413f5086c5755b46094b813dbfcd.svg
c.disquscdn.com/next/embed/assets/img/ Frame A54F 13 KB
13 KB 17ms
17ms Image
image/svg+xml 2606:4700::6812:a813
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/next/embed/assets/img/svg-sprite.4da5413f5086c5755b46094b813dbfcd.svg

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.c82b267b396dfbc10ae5113342115da8.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:a813 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3270642c89180c12db93775e2a774b6dadd9bd98cffc963075c85afd2c17b6e4

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://c.disquscdn.com/next/embed/styles/lounge.c82b267b396dfbc10ae5113342115da8.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 19 Apr 2021 10:51:49 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 14369222
strict-transport-security: max-age=300; includeSubdomains
content-length: 13079
cf-request-id: 098b5b198600002ba17f9b6000000001
timing-allow-origin: *
last-modified: Mon, 19 Oct 2020 18:27:03 GMT
server: cloudflare
etag: "5f8dda77-3317"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml; charset=utf-8
access-control-allow-origin: *
x-xss-protection: 1; mode=block
cache-control: max-age=31536000, public, immutable, no-transform
accept-ranges: bytes
cf-ray: 6425946f3ad22ba1-FRA
expires: Tue, 19 Oct 2021 19:08:20 GMT

GET
H2 200 loader.ba7c86e8b4b6135bb668d05223f8f127.gif
c.disquscdn.com/next/embed/assets/img/ Frame A54F 3 KB
3 KB 13ms
13ms Image
image/gif 2606:4700::6812:a813
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/next/embed/assets/img/loader.ba7c86e8b4b6135bb668d05223f8f127.gif

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.c82b267b396dfbc10ae5113342115da8.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:a813 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4c4491dcfa94cb46fb73742fc2caf49a1cd59027304af1830c7dc6ce1889857c

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://c.disquscdn.com/next/embed/styles/lounge.c82b267b396dfbc10ae5113342115da8.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 19 Apr 2021 10:51:49 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 5366616
strict-transport-security: max-age=300; includeSubdomains
content-length: 2971
cf-request-id: 098b5b198d00002ba1b422d000000001
timing-allow-origin: *
last-modified: Mon, 14 Dec 2020 22:46:46 GMT
server: cloudflare
etag: "5fd7eb56-b9b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/gif
access-control-allow-origin: *
x-xss-protection: 1; mode=block
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: DFW55-C3
accept-ranges: bytes
cf-ray: 6425946f4adf2ba1-FRA
x-amz-cf-id: EvCMTWKCjvve0qmqQvWzwZWa75ce5tSol6Ycs2_dayHQ8JpFyq0ZUw==
expires: Fri, 17 Dec 2021 09:57:52 GMT

GET
H2 200 sprite.654110a9206fd22f08cca0798e34a65e.png
c.disquscdn.com/next/embed/assets/img/ Frame A54F 2 KB
2 KB 14ms
13ms Image
image/png 2606:4700::6812:a813
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/next/embed/assets/img/sprite.654110a9206fd22f08cca0798e34a65e.png

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.c82b267b396dfbc10ae5113342115da8.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:a813 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cdba739c28b41f39ce438f2bf204fe739dc81a26cf559a9394ceed56a0666bee

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://c.disquscdn.com/next/embed/styles/lounge.c82b267b396dfbc10ae5113342115da8.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 19 Apr 2021 10:51:49 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 5366616
strict-transport-security: max-age=300; includeSubdomains
content-length: 1862
cf-request-id: 098b5b198d00002ba1780db000000001
timing-allow-origin: *
last-modified: Mon, 18 Jan 2021 17:33:12 GMT
server: cloudflare
etag: "6005c658-746"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
x-xss-protection: 1; mode=block
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: DFW53-C1
accept-ranges: bytes
cf-ray: 6425946f4ae02ba1-FRA
x-amz-cf-id: EgON8tp8Et0Hc79zmS9Vbrl1C9iZJkMbKnffWBuVEXPBZ0W_DSkg6Q==
expires: Fri, 21 Jan 2022 12:21:07 GMT

GET
H2 200 icons.4cc7a703d2fdfe684151ff8ac24d45f1.woff2
c.disquscdn.com/next/embed/assets/font/ Frame A54F 8 KB
8 KB 15ms
14ms Font
application/octet-stream 2606:4700::6812:a813
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/assets/font/icons.4cc7a703d2fdfe684151ff8ac24d45f1.woff2

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.c82b267b396dfbc10ae5113342115da8.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:a813 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f2a341fc815d45c21da726d4c843c2c5d3e1f333465347c3c75d040d556df4e5

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Origin: https://disqus.com
Referer: https://c.disquscdn.com/next/embed/styles/lounge.c82b267b396dfbc10ae5113342115da8.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 19 Apr 2021 10:51:49 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 5366615
strict-transport-security: max-age=300; includeSubdomains
content-length: 7900
cf-request-id: 098b5b198d00004e26598f9000000001
timing-allow-origin: *
last-modified: Wed, 03 Feb 2021 18:02:57 GMT
server: cloudflare
etag: "601ae551-1edc"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/octet-stream
access-control-allow-origin: *
x-xss-protection: 1; mode=block
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: FRA56-C1
accept-ranges: bytes
cf-ray: 6425946f4c584e26-FRA
x-amz-cf-id: Rgooauymwnrvp5ORnFt12m3Cagi0Qgi2D6GgELQK7gROkGCk4txtzw==
expires: Sun, 06 Feb 2022 07:54:37 GMT

GET
H/1.1 500
Internal Server Error w32-hfsautob-066b.htm
malwarefixit.com/remove-malware/ 0
0 4374ms
4374ms Script
text/html 208.76.245.34
CRUCIAL

General

Check archive.org

Show headers Download Go to

Full URL: http://malwarefixit.com/remove-malware/w32-hfsautob-066b.htm?cf_action=sync_comments&post_id=13617
Requested by: Host: malwarefixit.com
URL: http://malwarefixit.com/wp-content/cache/minify/000000/M9RPySwuLC3WTc7PzU3NK9EtriwuSc3Vz01NyUzUzyqGSgMA.js
Protocol: HTTP/1.1
Server: 208.76.245.34 , United States, ASN20202 (CRUCIAL, US),
Reverse DNS: s497.c4.crucialp.com
Software: Apache / PHP/5.6.40
Resource Hash

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: malwarefixit.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: */*
Referer: http://malwarefixit.com/remove-malware/w32-hfsautob-066b.htm
Cookie: PHPSESSID=ecc8d1e1f83be4062bd1de6f85e04571; sc_is_visitor_unique=rx10728684.1618829508.8A16C33328B04FFFBA1A5BB57D41C9A0.1.1.1.1.1.1.1.1.1; __gads=ID=2128eed03d856a7e-22e0147b9aa70087:T=1618829507:RT=1618829507:S=ALNI_MbQZKilSMTVMLYtRf-oMa8Cd1lmgw
Connection: keep-alive
Cache-Control: no-cache
Referer: http://malwarefixit.com/remove-malware/w32-hfsautob-066b.htm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 19 Apr 2021 10:51:49 GMT
Server: Apache
X-Powered-By: PHP/5.6.40
Vary: User-Agent
Content-Type: text/html; charset=UTF-8
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: close
Content-Length: 0
Expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H2 200 svg-sprite.4da5413f5086c5755b46094b813dbfcd.svg
c.disquscdn.com/next/embed/assets/img/ Frame A54F 13 KB
13 KB 14ms
14ms Image
image/svg+xml 2606:4700::6812:a813
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/next/embed/assets/img/svg-sprite.4da5413f5086c5755b46094b813dbfcd.svg

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.c82b267b396dfbc10ae5113342115da8.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:a813 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3270642c89180c12db93775e2a774b6dadd9bd98cffc963075c85afd2c17b6e4

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://c.disquscdn.com/next/embed/styles/lounge.c82b267b396dfbc10ae5113342115da8.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 19 Apr 2021 10:51:49 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 14369222
strict-transport-security: max-age=300; includeSubdomains
content-length: 13079
cf-request-id: 098b5b19ec00002ba1a9807000000001
timing-allow-origin: *
last-modified: Mon, 19 Oct 2020 18:27:03 GMT
server: cloudflare
etag: "5f8dda77-3317"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml; charset=utf-8
access-control-allow-origin: *
x-xss-protection: 1; mode=block
cache-control: max-age=31536000, public, immutable, no-transform
accept-ranges: bytes
cf-ray: 6425946fdbd72ba1-FRA
expires: Tue, 19 Oct 2021 19:08:20 GMT

GET
H2 200 sdk.js Show response
connect.facebook.net/en_US/ Frame A54F 3 KB
2 KB 18ms
6ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.f485ba8b89bf2153fdb9f493ec342aed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

5611563c3bcc59abb787d32f4abbdce8e08ce707829f111eadb485c1a0dc174f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://disqus.com/embed/comments/?base=default&f=cleanvir&t_i=13617%20http%3A%2F%2Fgreatis.com%2Fcleanvirus%2Fremove-malware%2Fw32-hfsautob-066b.htm&t_u=http%3A%2F%2Fmalwarefixit.com%2Fremove-malware%2Fw32-hfsautob-066b.htm&t_e=W32.HfsAutoB.066b&t_d=W32.HfsAutoB.066b%20%C2%AB%20Malware%20%C2%AB%20Clean%20Virus&t_t=W32.HfsAutoB.066b&s_o=default&l=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: v28Ate4QpO8CylpMx6Du4A==
cross-origin-resource-policy: cross-origin
expires: Mon, 19 Apr 2021 10:53:17 GMT
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 1782
x-fb-rlafr: 0
x-fb-debug: jg4zCAzAwLB0DijgHBRcSj3YfpEHvloeOA1x5S37VPGax2V7ywWes/BkJpfKLFPYatFLA/uKjL67mK9wuq2gaQ==
x-fb-trip-id: 917726464
x-fb-content-md5: 206f535fe7184d8dcd6e500b6eccd5c8
date: Mon, 19 Apr 2021 10:51:49 GMT
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public,max-age=1200,stale-while-revalidate=3600
etag: "7ae103a3039766599ca10dff9282e9b3"
timing-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5

GET
H2 200 api.js Show response
apis.google.com/js/ Frame A54F 12 KB
6 KB 48ms
28ms Script
application/javascript 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/js/api.js

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.f485ba8b89bf2153fdb9f493ec342aed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

0b93183bcc5bda42dc9db65084d052ca8fdb7eb3e3b08a75e5f3884a888cf035

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-PGN8x5XMIiAybpNAX+b8bg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://disqus.com/embed/comments/?base=default&f=cleanvir&t_i=13617%20http%3A%2F%2Fgreatis.com%2Fcleanvirus%2Fremove-malware%2Fw32-hfsautob-066b.htm&t_u=http%3A%2F%2Fmalwarefixit.com%2Fremove-malware%2Fw32-hfsautob-066b.htm&t_e=W32.HfsAutoB.066b&t_d=W32.HfsAutoB.066b%20%C2%AB%20Malware%20%C2%AB%20Clean%20Virus&t_t=W32.HfsAutoB.066b&s_o=default&l=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 19 Apr 2021 10:51:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
x-ua-compatible: IE=edge, chrome=1
server: ESF
x-frame-options: SAMEORIGIN
etag: "6873478039673be44cc70fd23da24c6e"
strict-transport-security: max-age=31536000
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=1800, stale-while-revalidate=1800
content-security-policy: script-src 'report-sample' 'nonce-PGN8x5XMIiAybpNAX+b8bg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
timing-allow-origin: *
expires: Mon, 19 Apr 2021 10:51:49 GMT

GET
H2 200 recommendations.eff219b98b7c4167b4b289065f36f391.css
c.disquscdn.com/next/recommendations/styles/ Frame 50E4 17 KB
4 KB 16ms
15ms Stylesheet
text/css 2606:4700::6812:a813
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/recommendations/styles/recommendations.eff219b98b7c4167b4b289065f36f391.css

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/recommendations/common.bundle.9aad4e5af3027dd4fbeac9669fb17819.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:a813 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7964d033f829ae2809f61810c4efa9adf6aff915ded111a9c346bca2b1302b62

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://disqus.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 19 Apr 2021 10:51:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 2985322
strict-transport-security: max-age=300; includeSubdomains
content-length: 3748
cf-request-id: 098b5b1a0d00002ba1b017d000000001
timing-allow-origin: *
last-modified: Mon, 15 Mar 2021 21:21:21 GMT
server: cloudflare
etag: "604fcfd1-ea4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
x-xss-protection: 1; mode=block
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: FRA53-C1
accept-ranges: bytes
cf-ray: 642594701c212ba1-FRA
x-amz-cf-id: -C814T_EH1fXFNS-8rI9GX0iQ-SivA-k_ff45ra5UfJytc1kYo1b3g==
expires: Tue, 15 Mar 2022 21:34:33 GMT

GET
H3-29 200 sdk.js Show response
connect.facebook.net/en_US/ Frame A54F 216 KB
64 KB 8ms
8ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js?hash=7b8096304dde36809026638dc2154d37&ua=modern_es6

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

0df9ef212bb597cd4fdca9fcf8afa33d796d05fbcd8199017c67547d0fddb8bb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Origin: https://disqus.com
Referer: https://disqus.com/embed/comments/?base=default&f=cleanvir&t_i=13617%20http%3A%2F%2Fgreatis.com%2Fcleanvirus%2Fremove-malware%2Fw32-hfsautob-066b.htm&t_u=http%3A%2F%2Fmalwarefixit.com%2Fremove-malware%2Fw32-hfsautob-066b.htm&t_e=W32.HfsAutoB.066b&t_d=W32.HfsAutoB.066b%20%C2%AB%20Malware%20%C2%AB%20Clean%20Virus&t_t=W32.HfsAutoB.066b&s_o=default&l=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: GX6D7Dyyb7vOFPfSfxm8Lw==
cross-origin-resource-policy: cross-origin
expires: Tue, 19 Apr 2022 10:08:19 GMT
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 65489
x-fb-rlafr: 0
x-fb-debug: 1OSm0YfaPGDXbGftEHtMVrVrSQHh1eRY6UUeUywXxrORBlS4SizApGeyZVl5teZn7aBLVH3s+dhtoxp2CR+vKA==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
x-fb-content-md5: d3219e34b4b08ee57c80caf079634abb
date: Mon, 19 Apr 2021 10:51:49 GMT
x-frame-options: DENY
report-to: {"group":"coep_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]}
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
etag: "e4f274e7bfb027262963545531e639ea"
timing-allow-origin: *
priority: u=3,i
access-control-expose-headers: X-FB-Content-MD5

GET
H2 200 recommendations.bundle.4214219f8f12995fa46e1e83745b2a0e.js Show response
c.disquscdn.com/next/recommendations/ Frame 50E4 64 KB
20 KB 17ms
17ms Script
application/javascript 2606:4700::6812:a813
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/recommendations/recommendations.bundle.4214219f8f12995fa46e1e83745b2a0e.js

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/recommendations/common.bundle.9aad4e5af3027dd4fbeac9669fb17819.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:a813 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

812c197974a5fe7adbf3dff287286efc9918e3ce9545d57fbc6a34c298fb260e

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://disqus.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 19 Apr 2021 10:51:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 6046801
strict-transport-security: max-age=300; includeSubdomains
content-length: 19898
cf-request-id: 098b5b1a1400002ba1ce0ac000000001
timing-allow-origin: *
last-modified: Wed, 03 Feb 2021 18:02:57 GMT
server: cloudflare
etag: "601ae551-4dba"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-xss-protection: 1; mode=block
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
cf-ray: 642594702c372ba1-FRA
x-amz-cf-id: jlTRG_X2NNsZlvqhdFsMtZ1cq8VXo_M_8l7Vvsli87lAsZEB5TIhfw==
expires: Tue, 08 Feb 2022 11:11:48 GMT

GET
H/1.1 200
OK config.js Show response
disqus.com/next/ Frame 50E4 11 KB
12 KB 42ms
41ms Script
application/javascript 151.101.192.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://disqus.com/next/config.js

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/recommendations/common.bundle.9aad4e5af3027dd4fbeac9669fb17819.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.192.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

d0627e883f59b06ada61af684c0636818d0e01f4c3fed677f83f974196b8316f

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://disqus.com/recommendations/?base=default&f=cleanvir&t_i=13617%20http%3A%2F%2Fgreatis.com%2Fcleanvirus%2Fremove-malware%2Fw32-hfsautob-066b.htm&t_u=http%3A%2F%2Fmalwarefixit.com%2Fremove-malware%2Fw32-hfsautob-066b.htm&t_e=W32.HfsAutoB.066b&t_d=W32.HfsAutoB.066b%20%C2%AB%20Malware%20%C2%AB%20Clean%20Virus&t_t=W32.HfsAutoB.066b
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 19 Apr 2021 10:51:49 GMT
X-Content-Type-Options: nosniff
Content-Type: application/javascript; charset=UTF-8
Server: nginx
Age: 11
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=300; includeSubdomains
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Access-Control-Allow-Origin: *
Cache-Control: public, stale-while-revalidate=300, s-stalewhilerevalidate=3600, max-age=60
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 11688
X-XSS-Protection: 1; mode=block

GET
H3-29 200 cb=gapi.loaded_0 Show response
apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.MWM3Xj_RD9s.O/m=auth2/rt=j/sv=1/d=1/ed=1/am=AQ/rs=AGLTcCOUmnuCcTtedasW7L1tq37fs4eoIg/ Frame A54F 102 KB
34 KB 21ms
7ms Script
text/javascript 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.MWM3Xj_RD9s.O/m=auth2/rt=j/sv=1/d=1/ed=1/am=AQ/rs=AGLTcCOUmnuCcTtedasW7L1tq37fs4eoIg/cb=gapi.loaded_0

Requested by

Host: apis.google.com
URL: https://apis.google.com/js/api.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6289a67bc4acdbdafbc49c8db8bee69deaca8a0a5a9321011b96e2cc9c242eba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://disqus.com/embed/comments/?base=default&f=cleanvir&t_i=13617%20http%3A%2F%2Fgreatis.com%2Fcleanvirus%2Fremove-malware%2Fw32-hfsautob-066b.htm&t_u=http%3A%2F%2Fmalwarefixit.com%2Fremove-malware%2Fw32-hfsautob-066b.htm&t_e=W32.HfsAutoB.066b&t_d=W32.HfsAutoB.066b%20%C2%AB%20Malware%20%C2%AB%20Clean%20Virus&t_t=W32.HfsAutoB.066b&s_o=default&l=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Apr 2021 06:19:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 07 Apr 2021 17:21:52 GMT
server: sffe
age: 361944
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34454
x-xss-protection: 0
expires: Fri, 15 Apr 2022 06:19:25 GMT

GET
H2 200 status
www.facebook.com/x/oauth/ Frame A54F 0
0 58ms
46ms Fetch
text/plain 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/x/oauth/status?ancestor_origins=http%3A%2F%2Fmalwarefixit.com&client_id=52254943976&input_token&origin=1&redirect_uri=https%3A%2F%2Fdisqus.com%2Fembed%2Fcomments%2F%3Fbase%3Ddefault%26f%3Dcleanvir%26t_i%3D13617%2520http%253A%252F%252Fgreatis.com%252Fcleanvirus%252Fremove-malware%252Fw32-hfsautob-066b.htm%26t_u%3Dhttp%253A%252F%252Fmalwarefixit.com%252Fremove-malware%252Fw32-hfsautob-066b.htm%26t_e%3DW32.HfsAutoB.066b%26t_d%3DW32.HfsAutoB.066b%2520%25C2%25AB%2520Malware%2520%25C2%25AB%2520Clean%2520Virus%26t_t%3DW32.HfsAutoB.066b%26s_o%3Ddefault%26l%3D%23version%3Da658a7c16140d8728cc859daf581cbbc&sdk=joey&wants_cookie_data=false

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.f485ba8b89bf2153fdb9f493ec342aed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://disqus.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
x-content-type-options: nosniff
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 0
x-fb-rlafr: 0
pragma: no-cache
x-fb-debug: KajrTQGvXS0xnRQ/9MaYseqACTlpZZbbFoW4vuNJiGRVUox+vSHcixZt/12d1LMIhfHH5EgHHhnOcttOMcmBWA==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
fb-s: unknown
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 19 Apr 2021 10:51:49 GMT
report-to: {"group":"coep_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]}
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://disqus.com
access-control-expose-headers: fb-s
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1 200
OK details Show response
disqus.com/api/3.0/forums/ Frame 50E4 3 KB
3 KB 146ms
145ms XHR
application/json 151.101.192.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://disqus.com/api/3.0/forums/details?forum=cleanvir&attach=forumFeatures&api_key=E8Uh5l5fHZ6gD8U3KycjAIAk46f68Zw7C6eW8WSjZvCLXebZ7p0r1yrYDrLilk2F

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/recommendations/common.bundle.9aad4e5af3027dd4fbeac9669fb17819.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.192.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

1f84864570c631b6ab885274d203bfb4138bdd5362e8282f7e0e13c585f497d9

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: */*
Referer: https://disqus.com/recommendations/?base=default&f=cleanvir&t_i=13617%20http%3A%2F%2Fgreatis.com%2Fcleanvirus%2Fremove-malware%2Fw32-hfsautob-066b.htm&t_u=http%3A%2F%2Fmalwarefixit.com%2Fremove-malware%2Fw32-hfsautob-066b.htm&t_e=W32.HfsAutoB.066b&t_d=W32.HfsAutoB.066b%20%C2%AB%20Malware%20%C2%AB%20Clean%20Virus&t_t=W32.HfsAutoB.066b
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 19 Apr 2021 10:51:49 GMT
X-Content-Type-Options: nosniff
Server: nginx
Age: 0
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=300; includeSubdomains
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Connection: keep-alive
Content-Type: application/json
Vary: Origin, Cookie
Content-Length: 2880
X-XSS-Protection: 1; mode=block

GET
H2 200 iframe Show response
accounts.google.com/o/oauth2/ Frame BA1B 513 B
843 B 43ms
23ms Document
text/html 2a00:1450:4001:811::200d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.google.com/o/oauth2/iframe

Requested by

Host: apis.google.com
URL: https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.MWM3Xj_RD9s.O/m=auth2/rt=j/sv=1/d=1/ed=1/am=AQ/rs=AGLTcCOUmnuCcTtedasW7L1tq37fs4eoIg/cb=gapi.loaded_0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::200d Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

441218e63bad6f1487f6f4459a3bb878904ea9fefbb29642896cfb3b966a883e

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-Re51HAb9Gr9IWKPTlr8RQw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /o/cspreport
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: accounts.google.com
:scheme: https
:path: /o/oauth2/iframe
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://disqus.com/embed/comments/?base=default&f=cleanvir&t_i=13617%20http%3A%2F%2Fgreatis.com%2Fcleanvirus%2Fremove-malware%2Fw32-hfsautob-066b.htm&t_u=http%3A%2F%2Fmalwarefixit.com%2Fremove-malware%2Fw32-hfsautob-066b.htm&t_e=W32.HfsAutoB.066b&t_d=W32.HfsAutoB.066b%20%C2%AB%20Malware%20%C2%AB%20Clean%20Virus&t_t=W32.HfsAutoB.066b&s_o=default&l=
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: NID=213=Vqv_NsYNQTzoN2XOjbMeoNNeztET5OngylZKnUzf6P0DU2WhhD9Ijz_tnnrn7Oo-FueJCaubaNrxnQ6xbH2dkEHKbnx-5i5S0ppMAT7KtTvPUQOavmKmqGHGJ7Fm-StehAY7qZILrznRAeQVzGH6-bPGoGOGLGH_mLYibuGIUsc
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://disqus.com/embed/comments/?base=default&f=cleanvir&t_i=13617%20http%3A%2F%2Fgreatis.com%2Fcleanvirus%2Fremove-malware%2Fw32-hfsautob-066b.htm&t_u=http%3A%2F%2Fmalwarefixit.com%2Fremove-malware%2Fw32-hfsautob-066b.htm&t_e=W32.HfsAutoB.066b&t_d=W32.HfsAutoB.066b%20%C2%AB%20Malware%20%C2%AB%20Clean%20Virus&t_t=W32.HfsAutoB.066b&s_o=default&l=

Response headers

content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Mon, 19 Apr 2021 10:51:49 GMT
content-language: en-US
content-security-policy: script-src 'report-sample' 'nonce-Re51HAb9Gr9IWKPTlr8RQw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /o/cspreport
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-content-type-options: nosniff
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK listRecommendations.json Show response
disqus.com/api/3.0/discovery/ Frame 50E4 822 B
1 KB 129ms
129ms XHR
application/json 151.101.192.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://disqus.com/api/3.0/discovery/listRecommendations.json?forum=cleanvir&limit=8&api_key=E8Uh5l5fHZ6gD8U3KycjAIAk46f68Zw7C6eW8WSjZvCLXebZ7p0r1yrYDrLilk2F

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/recommendations/common.bundle.9aad4e5af3027dd4fbeac9669fb17819.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.192.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

116fe6e72ecb6c290e93a2284a28f4c7556a4ab54d198e7c01677dc510b8b195

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://disqus.com/recommendations/?base=default&f=cleanvir&t_i=13617%20http%3A%2F%2Fgreatis.com%2Fcleanvirus%2Fremove-malware%2Fw32-hfsautob-066b.htm&t_u=http%3A%2F%2Fmalwarefixit.com%2Fremove-malware%2Fw32-hfsautob-066b.htm&t_e=W32.HfsAutoB.066b&t_d=W32.HfsAutoB.066b%20%C2%AB%20Malware%20%C2%AB%20Clean%20Virus&t_t=W32.HfsAutoB.066b
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 19 Apr 2021 10:51:49 GMT
X-Content-Type-Options: nosniff
Server: nginx
Age: 1541
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=300; includeSubdomains
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Cache-Control: stale-while-revalidate=450, public, max-age=1800
Connection: keep-alive
Content-Type: application/json
Vary: Origin
Content-Length: 822
X-XSS-Protection: 1; mode=block

GET
H2 200 1152779234-idpiframe.js Show response
ssl.gstatic.com/accounts/o/ Frame BA1B 112 KB
39 KB 28ms
7ms Script
text/javascript 2a00:1450:4001:811::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ssl.gstatic.com/accounts/o/1152779234-idpiframe.js

Requested by

Host: accounts.google.com
URL: https://accounts.google.com/o/oauth2/iframe

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ce39ecda470ad1ba3ac9fddad55abe54822a6f208578c1555b0805435694d07c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://accounts.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 19 Apr 2021 07:48:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 13 Apr 2021 00:25:08 GMT
server: sffe
age: 10991
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39190
x-xss-protection: 0
expires: Tue, 19 Apr 2022 07:48:38 GMT

GET
H3-29 200 iframerpc Show response
accounts.google.com/o/oauth2/ Frame BA1B 14 B
58 B 39ms
24ms XHR
application/json 2a00:1450:4001:811::200d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.google.com/o/oauth2/iframerpc?action=checkOrigin&origin=https%3A%2F%2Fdisqus.com&client_id=508198334196-bgmagrg0a2rub674g0shidj8fnd50dji.apps.googleusercontent.com

Requested by

Host: ssl.gstatic.com
URL: https://ssl.gstatic.com/accounts/o/1152779234-idpiframe.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::200d Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

8daf09a6fc31937457dd77e9c25ce4b21349d605b561a8c5d557841bf964c9a0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://accounts.google.com/o/oauth2/iframe
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
X-Requested-With: XmlHttpRequest

Response headers

date: Mon, 19 Apr 2021 10:51:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
content-type: application/json; charset=utf-8
cache-control: public, max-age=3600
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
expires: Mon, 19 Apr 2021 11:51:49 GMT

GET
H/1.1 200
OK stat.gif
referrer.disqus.com/juggler/ 43 B
295 B 251ms
156ms Image
image/gif 151.101.112.134
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://referrer.disqus.com/juggler/stat.gif?event=failed_recommendations.server.undefined

Requested by

Host: malwarefixit.com
URL: http://malwarefixit.com/remove-malware/w32-hfsautob-066b.htm

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.112.134 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: http://malwarefixit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 19 Apr 2021 10:51:49 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT
Server: nginx
Content-Type: image/gif
Connection: keep-alive
Content-Length: 43
X-XSS-Protection: 1; mode=block

GET
H2 200 noavatar92.png
a.disquscdn.com/1617742046/images/ Frame A54F 2 KB
2 KB 41ms
41ms Image
image/png 151.101.14.49
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://a.disquscdn.com/1617742046/images/noavatar92.png

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/lounge.bundle.5c8cd56736a07a84352a4d37a862a762.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.14.49 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

36ef66124133ca33c8b44c487293c3180e5ab681ff3cad3c728ea4f894ec3444

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://disqus.com/embed/comments/?base=default&f=cleanvir&t_i=13617%20http%3A%2F%2Fgreatis.com%2Fcleanvirus%2Fremove-malware%2Fw32-hfsautob-066b.htm&t_u=http%3A%2F%2Fmalwarefixit.com%2Fremove-malware%2Fw32-hfsautob-066b.htm&t_e=W32.HfsAutoB.066b&t_d=W32.HfsAutoB.066b%20%C2%AB%20Malware%20%C2%AB%20Clean%20Virus&t_t=W32.HfsAutoB.066b&s_o=default&l=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 19 Apr 2021 10:51:49 GMT
x-content-type-options: nosniff
last-modified: Fri, 26 Feb 2021 20:50:09 GMT
server: nginx
age: 1073793
etag: "60395f01-66c"
strict-transport-security: max-age=300; includeSubdomains
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
x-xss-protection: 1; mode=block
cache-control: max-age=2592000
x-amz-cf-pop: FRA53-C1
content-type: image/png
content-length: 1644
x-amz-cf-id: vlJLc_TTbx_WsgMOVm5OQhEGOXJOn0aJzq3Z1t9UunmOoaRRTSaXqA==
expires: Fri, 07 May 2021 00:35:16 GMT

GET
H/1.1 200
OK event.gif
referrer.disqus.com/juggler/ Frame A54F 43 B
295 B 222ms
138ms Image
image/gif 151.101.112.134
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://referrer.disqus.com/juggler/event.gif?abe=0&embed_hidden=0&load_time=599&event=init_embed&thread=4417168388&forum=cleanvir&forum_id=3915484&imp=85sdvuj3q90e72&prev_imp&thread_slug=w32hfsautob066b&user_type=anon&referrer=http%3A%2F%2Fmalwarefixit.com%2F&theme=next&dnt=0&tracking_enabled=0&experiment=network_default_hidden&variant=fallthrough&service=dynamic&promoted_enabled=false&max_enabled=false

Requested by

Host: malwarefixit.com
URL: http://malwarefixit.com/remove-malware/w32-hfsautob-066b.htm

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.112.134 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://disqus.com/embed/comments/?base=default&f=cleanvir&t_i=13617%20http%3A%2F%2Fgreatis.com%2Fcleanvirus%2Fremove-malware%2Fw32-hfsautob-066b.htm&t_u=http%3A%2F%2Fmalwarefixit.com%2Fremove-malware%2Fw32-hfsautob-066b.htm&t_e=W32.HfsAutoB.066b&t_d=W32.HfsAutoB.066b%20%C2%AB%20Malware%20%C2%AB%20Clean%20Virus&t_t=W32.HfsAutoB.066b&s_o=default&l=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 19 Apr 2021 10:51:49 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT
Server: nginx
Content-Type: image/gif
Connection: keep-alive
Content-Length: 43
X-XSS-Protection: 1; mode=block

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 9 KB
7 KB 18ms
17ms XHR
application/json 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20210414&st=env

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b17cc991a632bacfd31fe7d2326c33aac9d23f73bf8a653a2adf91d244b423cd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://malwarefixit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 19 Apr 2021 10:51:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6987
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c61a719b48533a1fa932729f4927ba1377a96c441b0d6a427096b867742b4645

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://malwarefixit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 19 Apr 2021 10:51:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1616005470650935"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6437
x-xss-protection: 0
expires: Mon, 19 Apr 2021 10:51:53 GMT

GET
H3-29 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/222/ Frame C7C6 12 KB
5 KB 16ms
14ms Document
text/html 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/222/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6836719899bda27cd22c1551cb7fbfc33fb0bbbedaa89e4baa8715fef8202cbc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/222/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://malwarefixit.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: http://malwarefixit.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
content-length: 5022
date: Mon, 19 Apr 2021 10:37:26 GMT
expires: Tue, 19 Apr 2022 10:37:26 GMT
last-modified: Wed, 20 Jan 2021 19:23:06 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 867
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 Ru4asw80RDg-wKj4k1IJyVIDrNjFP7NKP7NQDOdNnzM.js Show response
pagead2.googlesyndication.com/bg/ Frame C7C6 14 KB
6 KB 16ms
14ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Ru4asw80RDg-wKj4k1IJyVIDrNjFP7NKP7NQDOdNnzM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/222/runner.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

46ee1ab30f3444383ec0a8f8935209c95203acd8c53fb34a3fb3500ce74d9f33

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 19 Apr 2021 10:13:11 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Thu, 08 Apr 2021 09:18:00 GMT
server: sffe
age: 2322
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5687
x-xss-protection: 0
expires: Tue, 19 Apr 2022 10:13:11 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 41ms
41ms Image
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=222&t=2&li=gda_r20210414&jk=2703670568446435&bg=!j4yljMjNAAZUuIlwVLg7ACkAdvg8Wnshi_YCRej7UIdkTVVbxkNTG1EJ7jw0JDTeGBq2geMCy9I_DwIAAABPUgAAAAloAQcKAWV0sVbbPAbF08lH4Tj8ro6ArXridm461E0kBOp0r6bZDHBBMdgbQegDj94E3tR10v5PIbGAokite1KGhqyHv9TCJr3ERi8IYkHMSmCH0odZAFhi6U4s7mLDbFBNbl0-1htTzYHtF27R8ar68_bCLHL46CM0H_C8RdDUr8kuTPZJsh3xBzSvyiKQ-i09zH-RBRlfRVUNIvOrbaJeYXYmbtkv300Tg53oLfaD6jo62pCNsRC38RHpdI_iHw-j_DIe18DPGcXgznq8bBz6wA26GjYz7D7309eLJIHz2zfUwWrfzYYwSzegYuK2xC16ADTfH7CBppDQ2abxYggjCuvZ4r4z4cRx0k-M5iQUAyEZHNvxUqe1SLfP0cEeYamU-Sdz2PDwYsfSAeZF8MRrUTWz522nwtjZSxofBFzm2bSjYUGPkFO69IzyRNS6Mkld3OTwnQjOYrlrqjf-8gzZVxglgjffgb44NuyZAiTdaS24QsfFhpUd-t6Qi6D3xNLGJXlNo93EI2-85fLG0fLwSZBgpvsgw-UMMI1VLUBjdim2GTLV5sQ0Mf4_MnLzH6Z2OKGkvWYRU_szAGakNJN3evnic_Z6fU4ZXr5TBctkYKf4V4XuSB6cRN5lVaUoZE6OgWAd9ezs6-wy-WbM8jMgqBxwy0jHihTNGfBG_lDEm3acLfvFAO6pC45rDgy9y3_SF-Fy5vd2jAtwjperhNecR_o4tfM5FENUsTgv75UAObFB8gQwrYE064cVSBU-Fw6cynViV1WcuKrX_kanncNG5IYPfKVNM_hvdEP9HM-oF4HWJrcaNSwBlYJ0RQW_1B-LTihmwrubMY1ev11AGH7T9a73ffMDka4wUCREXK68wywQO_8r38NRTKwd27003aEDGoq5ZlzfVUsOxacXwGH4LiEblBNK-nBymVHSXhVRbUx-PBoXiWqNa0Nvd_GFaNxZsFn8sGkMKQip0Nn6FzoydI-EhOTViZ-64KSx4JRjlQ1k-wdqEhdy4sbjMoPPn9-J5bv7TL2shiHzBkSDTnF5aZZ4yPzVGnukO-bq8iBiBNTV_efO6UiOtJUFlyYM7bu6293-hZIpuhvqQO8kZ9NT04FWgm0ICvTNgj8igbtQYsHlw_UtfoP8y_vwIK0gUfUKC2GYo-mWjzjx3cZty-Sn2vBYMiLM08XUrDxmSfYJPnqR2c4pHM2Y0qzmhZHR5IO_sw

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://malwarefixit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 19 Apr 2021 10:51:53 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

89 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: http://malwarefixit.com/remove-malware/w32-hfsautob-066b.htm(Line 149) Message: WPP: OK. Execution time: 0.02414 seconds

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

0.gravatar.com
a.disquscdn.com
accounts.google.com
adservice.google.com
adservice.google.de
apis.google.com
c.disquscdn.com
c.statcounter.com
cleanvir.disqus.com
connect.facebook.net
disqus.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
greatis.com
malwarefixit.com
pagead2.googlesyndication.com
partner.googleadservices.com
referrer.disqus.com
ssl.gstatic.com
tpc.googlesyndication.com
www.facebook.com
www.googletagservices.com
www.statcounter.com
104.22.53.65
142.250.186.98
151.101.112.134
151.101.14.49
151.101.192.134
208.76.245.34
2606:4700::6812:a813
2a00:1450:4001:800::2002
2a00:1450:4001:801::2002
2a00:1450:4001:802::2002
2a00:1450:4001:80e::2002
2a00:1450:4001:80f::2001
2a00:1450:4001:80f::2002
2a00:1450:4001:80f::200a
2a00:1450:4001:810::2002
2a00:1450:4001:810::200e
2a00:1450:4001:811::2001
2a00:1450:4001:811::2003
2a00:1450:4001:811::200d
2a00:1450:4001:827::2002
2a00:1450:4001:828::2003
2a00:1450:4001:82a::2002
2a03:2880:f02d:12:face:b00c:0:3
2a03:2880:f12d:83:face:b00c:0:25de
2a04:fa87:fffe::c000:4902
041ba231b72e3e5e3e203a91bb06053ca657dac40510f163d9e4f0cd7169fafa
0514a158a9513625ab8fa361f2634b79aaa924c4ff5a782619fc9a810b08ef5e
0564d20c6662fa83c89b22ef3e1185cede3d6e4dfbc1525e936930e8ea58fb13
0b93183bcc5bda42dc9db65084d052ca8fdb7eb3e3b08a75e5f3884a888cf035
0df9ef212bb597cd4fdca9fcf8afa33d796d05fbcd8199017c67547d0fddb8bb
0fd28fece9ebd606b8b071460ebd3fc2ed7bc7a66ef91c8834f11dfacab4a849
105b700ab3ac2e4555c96919dc81744e291de3143ce8b3bbd67a92f05a06e9ad
116fe6e72ecb6c290e93a2284a28f4c7556a4ab54d198e7c01677dc510b8b195
11d5cc5bb3db6c56fb91f9068e7f4741f6212c8e2e5546b17039c1c58720fb83
12d181115f9383d64235cfc106c9d02d379e8a0c9a7ab73961f9c3b550d3d8d2
13fc9d7b29ec40196fd7750e38dda03df5c550c631f22681a9225bdabf879d26
141e1e911b8114adac10b87a31575b4b255937707c59c2daff0bde7002c7266f
1d6e7f534598bf30bf358f130cb27459503055e09c0de0a3f02ebc65b133d239
1f84864570c631b6ab885274d203bfb4138bdd5362e8282f7e0e13c585f497d9
20b6097504aed42f81fd7492b0e20ee87c7e7d8f9e0a367081741ec0c405f740
27ba09ef9560cd1fbdcd23292b97e78541a9b9c8c913e396ad6723275bce3454
2b18650f7ca8215eb14d31f6310b50450d5f2321cee798fd4ac41c512ca889f3
3270642c89180c12db93775e2a774b6dadd9bd98cffc963075c85afd2c17b6e4
33d9c56f2b1408711b9b963963790177ac4e7c38a5ecf0e3c12f558c676e294b
3487ef2baf0c08ba660a8a143cdeb8ebeec961eea04bccd7c49096b4eb26b875
36ef66124133ca33c8b44c487293c3180e5ab681ff3cad3c728ea4f894ec3444
3ca3e32832946feccf9509bfb44fd3dee7a0f60027cdf80fe3cee9cfb417a379
441218e63bad6f1487f6f4459a3bb878904ea9fefbb29642896cfb3b966a883e
4545eb1dec25fe868d19dc292d417d8a9e41c0276d75a4eaf524a9db21aa705a
46ee1ab30f3444383ec0a8f8935209c95203acd8c53fb34a3fb3500ce74d9f33
4c4491dcfa94cb46fb73742fc2caf49a1cd59027304af1830c7dc6ce1889857c
55aebca688276d2e179896353d39b532cfe38fcab7dd1254af7871766fa4827f
5611563c3bcc59abb787d32f4abbdce8e08ce707829f111eadb485c1a0dc174f
5ac97e4b298f836bc53cbf8ca4d7f5fc39eb624fe134b20d2178564384a39b7f
6289a67bc4acdbdafbc49c8db8bee69deaca8a0a5a9321011b96e2cc9c242eba
63a1da0146081d3e36fd4a56c6d899238a6cfe76f38b50ab31d0ac3d4a6ae1b6
6836719899bda27cd22c1551cb7fbfc33fb0bbbedaa89e4baa8715fef8202cbc
6fd7644c723ad68af13f563013b451abf66d4801b7fc984f46c66508dad8bdf3
731ee6fc8f4b9567d02bfcad0bf69db1d8d0b155007b5ab7bee88eb0c5cc6872
73e6e8b5c28efc91475f6bf3f05898deb429aaf3b597e7c9fad6c8a197acbe7d
74201a4b97ec1d5e86252dd0180eafd8c5378a9235864dbcd682f3575b41c85b
74e1cf077493c33fe895c7ce5732cda76b195e2d357d928f094bc3367cc7a75f
7964d033f829ae2809f61810c4efa9adf6aff915ded111a9c346bca2b1302b62
812c197974a5fe7adbf3dff287286efc9918e3ce9545d57fbc6a34c298fb260e
8767f01caa430c5bd4e3b008a8e9dfe022156a4e91a23c394fdcb05c267f1b94
8daf09a6fc31937457dd77e9c25ce4b21349d605b561a8c5d557841bf964c9a0
96e5cd135623aca80642dc180955f41e06dbaac8668ef7924d9c7f5d6b9b7fba
9c50a96c859b9beea47b71740bd14e7f69a4df586d015f47434037f8def53b52
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a5cb642ef22434a24612329870579fbb272cb9fa7475360035596ea56fb0431a
b17cc991a632bacfd31fe7d2326c33aac9d23f73bf8a653a2adf91d244b423cd
ba93891a4bf53e67da19a0f17017989f5056696c2a3ff513c9a4738cd92c7133
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
c5086d4f97bc3ee70971c51e89fa6ae25ff054accec7c4e890b1083ee7bcc9ab
c61a719b48533a1fa932729f4927ba1377a96c441b0d6a427096b867742b4645
c76b678224e0ef5e5b1093631b6d32ef566a788a5c751c710859e0c2fb93d810
cdba739c28b41f39ce438f2bf204fe739dc81a26cf559a9394ceed56a0666bee
ce33b36f16a953ed16394b859ee8f1a6e7fd9785869fe62e3af78aa019c07f7b
ce39ecda470ad1ba3ac9fddad55abe54822a6f208578c1555b0805435694d07c
ce8fc5b6de8c12b2eac649cc45206787aa6d5c9ab0987020574349688c3df288
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d0627e883f59b06ada61af684c0636818d0e01f4c3fed677f83f974196b8316f
dad2ac3f093b8cdcca3bfce4fb4d0d7c2e72bd3247ea05ec5e383559d4c3a77f
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
edb5483a53e50a99a820c4d5dac9ffd305b6afe0427a0828d3a43bb499941082
eef38d6cfe80ac20855dcd98162da1541701141843f5ca41834448b259c6c1ed
f2a341fc815d45c21da726d4c843c2c5d3e1f333465347c3c75d040d556df4e5
f677ee2d82dfb11f08175f673cf3f065b0d5e491b4485e01259a492715c746e2
fc73a8e755637ec54915fbe7836a8501c97c625588a7106f05df1f292cd3ea37
fea0c5ed46d4f7e0bdf1dd44a57624ae09c05847a250ca365ea0511788ef2b59
ffa907d826f82968612e5a325704a5cc38330a791049b23da9725a6609e22538

malwarefixit.com Open in urlscan Pro 208.76.245.34 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

83 Requests

73 %HTTPS

76 %IPv6

16 Domains

24 Subdomains

26 IPs

3 Countries

1527 kBTransfer

2941 kBSize

0 Cookies

26 Outgoing links

Redirected requests

83 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

malwarefixit.com Open in urlscan Pro
208.76.245.34 Public Scan

Screenshot
Live screenshot

Full Image

83
Requests

73 %
HTTPS

76 %
IPv6

16
Domains

24
Subdomains

26
IPs

3
Countries

1527 kB
Transfer

2941 kB
Size

0
Cookies

83 HTTP transactions
1 data transactions