malware.news Open in urlscan Pro
2606:4700:20::681a:769 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253
Submission: On November 21 via api (November 21st 2024, 11:36:45 am UTC) from IN — Scanned from DE

Summary HTTP 47 Redirects Links 11 Behaviour Indicators

Summary

This website contacted 7 IPs in 3 countries across 6 domains to perform 47 HTTP transactions. The main IP is 2606:4700:20::681a:769, located in United States and belongs to CLOUDFLARENET, US. The main domain is malware.news. The Cisco Umbrella rank of the primary domain is 935442.
TLS certificate: Issued by WE1 on November 6th 2024. Valid for: 3 months.

This is the only time malware.news was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
39	2606:4700:20:... 2606:4700:20::681a:769	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:81c::2008	15169 (GOOGLE) (GOOGLE)
4	192.0.66.233 192.0.66.233	2635 (AUTOMATTIC) (AUTOMATTIC)
1	2001:4860:480... 2001:4860:4802:34::36	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c00::9c	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:828::2003	15169 (GOOGLE) (GOOGLE)
47	7

39 2606:4700:20::681a:769 (United States)

ASN13335 (CLOUDFLARENET, US)

malware.news	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81c::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 192.0.66.233 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)

www.malwarebytes.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:34::36 (United States)

ASN15169 (GOOGLE, US)

region1.analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c00::9c (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:828::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
39	malware.news malware.news — Cisco Umbrella Rank: 935442	1 MB
4	malwarebytes.com www.malwarebytes.com — Cisco Umbrella Rank: 52743	201 KB
1	google.de www.google.de — Cisco Umbrella Rank: 10745	63 B
1	doubleclick.net stats.g.doubleclick.net — Cisco Umbrella Rank: 135	552 B
1	google.com region1.analytics.google.com — Cisco Umbrella Rank: 4108
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 39	95 KB
47	6

	Domain	Requested by
39	malware.news	malware.news
4	www.malwarebytes.com	malware.news
1	www.google.de	malware.news
1	stats.g.doubleclick.net	www.googletagmanager.com
1	region1.analytics.google.com	www.googletagmanager.com
1	www.googletagmanager.com	malware.news
47	6

This site contains links to these domains. Also see Links.

Domain
www.malwarebytes.com
russianpanda.com
squiblydoo.blog
discourse.org

Subject Issuer	Validity	Valid
malware.news WE1	`2024-11-06` - `2025-02-04`	3 months	crt.sh
*.google-analytics.com WR2	`2024-10-21` - `2025-01-13`	3 months	crt.sh
malwarebytes.com E5	`2024-10-20` - `2025-01-18`	3 months	crt.sh
*.g.doubleclick.net WR2	`2024-10-21` - `2025-01-13`	3 months	crt.sh
*.google.de WR2	`2024-10-21` - `2025-01-13`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253
Frame ID: FBEC4E7D36A4CAE815C03435A3A6CC3A
Requests: 49 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Hello again, FakeBat: popular loader returns after months-long hiatus - Malware Analysis - Malware Analysis, News and Indicators

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

Page Statistics

47
Requests

100 %
HTTPS

83 %
IPv6

6
Domains

6
Subdomains

7
IPs

3
Countries

1813 kB
Transfer

7132 kB
Size

2
Cookies

11 Outgoing links

These are links going to different origins than the main page.

URL: https://www.malwarebytes.com/wp-content/uploads/sites/2/2024/11/image_00e479.png

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/wp-content/uploads/sites/2/2024/11/image_c03d18.png

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/wp-content/uploads/sites/2/2024/11/image_07f473.png

Search URL Search Domain Scan URL

URL: https://russianpanda.com/
Title: RussianPanda

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/wp-content/uploads/sites/2/2024/11/image_f1c809.png

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/wp-content/uploads/sites/2/2024/11/image_e5a808.png

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/wp-content/uploads/sites/2/2024/11/image_e1b48c.png

Search URL Search Domain Scan URL

URL: https://squiblydoo.blog/
Title: Sqiiblydoo

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/for-home
Title: downloading Malwarebytes today

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/blog/cybercrime/2024/11/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus
Title: Hello again, FakeBat: popular loader returns after months-long hiatus | Malwarebytes

Search URL Search Domain Scan URL

URL: https://discourse.org/powered-by
Title: Powered by Discourse

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

47 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request 88253 Show response
malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/ 106 KB
22 KB 290ms
150ms Document
text/html 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4a94efe8536620015174b0b689f77cd8189ceaaac8f646c0c0223dd90d0c5789

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; base-uri 'self'; object-src 'none'; script-src 'nonce-gznnhnKGcLJeGMxuwG4sHY9NG' 'strict-dynamic'; frame-ancestors 'self'; manifest-src 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, no-store
cf-cache-status: DYNAMIC
cf-ray: 8e606219fbefd398-FRA
content-encoding: br
content-security-policy: upgrade-insecure-requests; base-uri 'self'; object-src 'none'; script-src 'nonce-gznnhnKGcLJeGMxuwG4sHY9NG' 'strict-dynamic'; frame-ancestors 'self'; manifest-src 'self'
content-security-policy-report-only: upgrade-insecure-requests; base-uri 'self'; object-src 'none'; script-src 'nonce-gznnhnKGcLJeGMxuwG4sHY9NG' 'strict-dynamic'; frame-ancestors 'self'; manifest-src 'self'
content-type: text/html; charset=utf-8
cross-origin-opener-policy: same-origin-allow-popups
date: Thu, 21 Nov 2024 11:36:38 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HjaBot8CKcU9%2BYa%2FJrv0hVJr1oicuRtTYHDF1mP4PFoaX7GQdjs2rkG7dG6TZRpOCYtliy75sAk56C76dq8ZUo7wRrQzkAoSi0pOMRXXX%2BfXJzvK2lbHJtgxsCGAKPS6Xz0rbi1RO7gzSw%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfL4;desc="?proto=TCP&rtt=21009&sent=7&recv=12&lost=0&retrans=0&sent_bytes=4013&recv_bytes=2431&delivery_rate=192873&cwnd=254&unsent_bytes=0&cid=5b9b7af518fe909b&ts=186&x=0"
vary: Accept-Encoding Accept
x-content-type-options: nosniff
x-discourse-cached: true
x-discourse-route: topics/show
x-discourse-trackview: 1
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-request-id: 622c73c0-fc2a-4bb6-b76d-2cf7a6950913
x-runtime: 0.009247
x-xss-protection: 0

GET
H2 200 start-discourse-9f921142b762fb91207051d0a28e571b9455bab74e7d0e03726024c286cff8d5.js Show response
malware.news/assets/ 567 B
879 B 86ms
61ms Script
application/javascript 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/start-discourse-9f921142b762fb91207051d0a28e571b9455bab74e7d0e03726024c286cff8d5.js
Requested by: Host: malware.news
URL: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9f921142b762fb91207051d0a28e571b9455bab74e7d0e03726024c286cff8d5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253

Response headers

cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 998566
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Z7Nln4iN0YvKSKiS%2BFCPsgPw%2FQMC58a9IvNuZYfQtSEccN8Ep1Oy6Qre5TVrx1HYTj9xAiF3cXhOolkKyAFDchFMMMmIQc%2BvTA39smL6JU0FqaYyyuRJvgreUmJ%2F4TDp%2FrZHSWFFl0lTtw%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8e60621b5f6dd398-FRA
expires: Sun, 09 Nov 2025 19:24:10 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=25964&sent=90&recv=27&lost=0&retrans=0&sent_bytes=91067&recv_bytes=4384&delivery_rate=1290082&cwnd=256&unsent_bytes=31872&cid=5b9b7af518fe909b&ts=283&x=0"
date: Thu, 21 Nov 2024 11:36:38 GMT
content-type: application/javascript
last-modified: Sat, 09 Nov 2024 19:20:22 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 browser-update-6f90b23ab8d8bbdca5b58f8c616b7779f50c1315575c80eacccbc30e8bb3c32e.js Show response
malware.news/assets/ 2 KB
1 KB 89ms
65ms Script
application/javascript 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/browser-update-6f90b23ab8d8bbdca5b58f8c616b7779f50c1315575c80eacccbc30e8bb3c32e.js
Requested by: Host: malware.news
URL: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6f90b23ab8d8bbdca5b58f8c616b7779f50c1315575c80eacccbc30e8bb3c32e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253

Response headers

cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 998566
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lLqJGgqoL7XlaQwjA%2Bw3zSl2FAeAWCwuOxIzI9G41NGECn%2Bp%2BbXBqbJaN6jxvk%2B6V9HRgQdWVz9Sf%2B1Wm0dbw4Ksmb4qHsmXhyPVou5I60HarbN7DLxya0oAtzlaQ%2Fzsg4yi7kQMuh8%2FTg%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8e60621b5f6ed398-FRA
expires: Sun, 09 Nov 2025 19:24:10 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=26429&sent=105&recv=28&lost=0&retrans=0&sent_bytes=110053&recv_bytes=4384&delivery_rate=1297442&cwnd=256&unsent_bytes=12886&cid=5b9b7af518fe909b&ts=284&x=0"
date: Thu, 21 Nov 2024 11:36:38 GMT
content-type: application/javascript
last-modified: Sat, 09 Nov 2024 19:20:22 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 browser-detect-99f42f91bffa8ca1606d62b70bb92f981d83921e78ccdbd3d9538f07007f27ac.js Show response
malware.news/assets/ 497 B
814 B 34ms
34ms Script
application/javascript 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/browser-detect-99f42f91bffa8ca1606d62b70bb92f981d83921e78ccdbd3d9538f07007f27ac.js
Requested by: Host: malware.news
URL: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 99f42f91bffa8ca1606d62b70bb92f981d83921e78ccdbd3d9538f07007f27ac

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253

Response headers

cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 3265331
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4LFxej3DkTlQSinmapaK7EfR8BgeQnutowJIsppqeXwc11dlPhNGIPWp%2BImrch1R5ndIXWuLHz4s0e3ZbDdhKLj%2BrSDpNUbR5Xwr%2FmqwbN7MLO0eQdm0AX8kuHBdtq9HTKjyi1ZVxRPRvg%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8e60621c9a4bd398-FRA
expires: Fri, 10 Oct 2025 17:19:16 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=26566&sent=152&recv=63&lost=0&retrans=0&sent_bytes=164959&recv_bytes=4627&delivery_rate=3429151&cwnd=256&unsent_bytes=0&cid=5b9b7af518fe909b&ts=489&x=0"
date: Thu, 21 Nov 2024 11:36:39 GMT
content-type: application/javascript
last-modified: Sun, 19 May 2024 17:35:46 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 vendor.d3163860318024d1a45415fcf58dbe4b-f6a0e31af09bc94252ffd2005ded43e70ee5ea44cbc0d90b36967a66fdf76b72.js Show response
malware.news/assets/ 430 KB
120 KB 51ms
50ms Script
application/javascript 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/vendor.d3163860318024d1a45415fcf58dbe4b-f6a0e31af09bc94252ffd2005ded43e70ee5ea44cbc0d90b36967a66fdf76b72.js
Requested by: Host: malware.news
URL: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f6a0e31af09bc94252ffd2005ded43e70ee5ea44cbc0d90b36967a66fdf76b72

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253

Response headers

cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 998566
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WkZ9D8f1RWs6hrldnjihhjhOWHm6VRCIEARqqC1tJsoQqirYd6w48qP6MsiYqVkHytrHzNNS45h2UkgUHXN9%2BhWLwaHmSgY7iZT5vLMs9kmre99cy4c8fikbRwz3mEZjsyB6YK4hcyiPNQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8e60621c9a4ed398-FRA
expires: Sun, 09 Nov 2025 19:24:10 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=26566&sent=164&recv=78&lost=0&retrans=0&sent_bytes=169401&recv_bytes=6291&delivery_rate=3429151&cwnd=256&unsent_bytes=0&cid=5b9b7af518fe909b&ts=504&x=0"
date: Thu, 21 Nov 2024 11:36:39 GMT
content-type: application/javascript
last-modified: Sat, 09 Nov 2024 19:19:57 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 chunk.dc7a33f0346e6027c1e5.d41d8cd9.js Show response
malware.news/assets/ 5 MB
1018 KB 69ms
63ms Script
application/javascript 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/chunk.dc7a33f0346e6027c1e5.d41d8cd9.js
Requested by: Host: malware.news
URL: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 08e72912ddff29f7da96ec2d3b0e425a8e50efea87d8ec9db0d7abd64047e05f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253

Response headers

cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 1002869
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GFiP7irY2wPNRm5%2BanBca%2FlUgElN4c1%2F6rZJskJVSV5AHNTGffsOrb1xhH4anGlOWKhF9meQsC9P%2BX0KjZprqiiAd9bWFFVQEgl6qzIKNjCw%2FdOzoqP5KIcvBNkPYwiS52y9f%2BRDdjfNyw%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8e60621cba92d398-FRA
expires: Sun, 09 Nov 2025 19:24:10 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=24520&sent=293&recv=81&lost=0&retrans=0&sent_bytes=333918&recv_bytes=6291&delivery_rate=3429151&cwnd=256&unsent_bytes=0&cid=5b9b7af518fe909b&ts=510&x=0"
date: Thu, 21 Nov 2024 11:36:39 GMT
content-type: application/javascript
last-modified: Sat, 09 Nov 2024 19:19:49 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 chunk.92341f685bf1b158be8e.d41d8cd9.js Show response
malware.news/assets/ 66 KB
12 KB 66ms
61ms Script
application/javascript 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/chunk.92341f685bf1b158be8e.d41d8cd9.js
Requested by: Host: malware.news
URL: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 85e2838b0d4d24942d3503bf17700732c5c6dd749dd5a87dcc921f716bfa8e8d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253

Response headers

cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 998567
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=I%2F2FqVJLMelQp9uhNUwIJOSD1vwgI1H6i%2FICTGiUlsshsU8ZQaWqiGRJuxjOKOfxPKX8iGfbTODsxiufTE1ubthL0zTNY6AffH2a7nvUc5tlfUVlkadOI1Xd84U9WG44QeO9Mx%2FHc4LzkA%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8e60621cba95d398-FRA
expires: Sun, 09 Nov 2025 19:24:10 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=26566&sent=260&recv=78&lost=0&retrans=0&sent_bytes=293048&recv_bytes=6291&delivery_rate=3429151&cwnd=256&unsent_bytes=0&cid=5b9b7af518fe909b&ts=505&x=0"
date: Thu, 21 Nov 2024 11:36:39 GMT
content-type: application/javascript
last-modified: Sat, 09 Nov 2024 19:19:49 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 checklist-48229befcefff057fe27509100acef005461f4af616cf844ffd4392e10db6236.js Show response
malware.news/assets/plugins/ 4 KB
2 KB 37ms
31ms Script
application/javascript 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/plugins/checklist-48229befcefff057fe27509100acef005461f4af616cf844ffd4392e10db6236.js
Requested by: Host: malware.news
URL: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 48229befcefff057fe27509100acef005461f4af616cf844ffd4392e10db6236

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253

Response headers

cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 998567
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Wm7solYc1iCVI5UAvmnt0YqB9onkkFuHuIq9GUqpMBZjzmjFXz4FVDbFKWTf8eyXaOJRH7TPwlF%2FHkoDn9YCLsOyTJsbPKOMPf2TFYw112ltDD5EbSt0Bd5BUHDDhu0k9PQZJ1ZWykHn8Q%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8e60621cba97d398-FRA
expires: Sun, 09 Nov 2025 19:24:10 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=26566&sent=157&recv=78&lost=0&retrans=0&sent_bytes=165839&recv_bytes=6291&delivery_rate=3429151&cwnd=256&unsent_bytes=0&cid=5b9b7af518fe909b&ts=504&x=0"
date: Thu, 21 Nov 2024 11:36:39 GMT
content-type: application/javascript
last-modified: Sat, 09 Nov 2024 19:20:46 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 discourse-details-be420de1cdbbc41691234abe548124043e201bc6b576570af28c0d960ad35a0c.js Show response
malware.news/assets/plugins/ 1 KB
1 KB 38ms
32ms Script
application/javascript 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/plugins/discourse-details-be420de1cdbbc41691234abe548124043e201bc6b576570af28c0d960ad35a0c.js
Requested by: Host: malware.news
URL: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: be420de1cdbbc41691234abe548124043e201bc6b576570af28c0d960ad35a0c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253

Response headers

cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 43537
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=A7b9T2JvOGk7j0f%2Frpz53rDSuny8u6aimNgG6JpQ%2Btt3YiskPW8asFuN09rN2Z7z2IZ3nXsxyJKdiarkCIta0BHZTOQuxQ4GReHa%2FWY4YjYOLI6YpdtVAuhMA0kPxnwzFY3d4fG8ei6OKg%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8e60621cba98d398-FRA
expires: Sun, 09 Nov 2025 19:24:10 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=26566&sent=161&recv=78&lost=0&retrans=0&sent_bytes=168162&recv_bytes=6291&delivery_rate=3429151&cwnd=256&unsent_bytes=0&cid=5b9b7af518fe909b&ts=504&x=0"
date: Thu, 21 Nov 2024 11:36:39 GMT
content-type: application/javascript
last-modified: Sat, 09 Nov 2024 19:20:46 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 discourse-lazy-videos-da6a701d09603c2e1bf81930868aa84af4b9fb58607f1dc8b88dfeb8ed6127f2.js Show response
malware.news/assets/plugins/ 6 KB
3 KB 70ms
65ms Script
application/javascript 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/plugins/discourse-lazy-videos-da6a701d09603c2e1bf81930868aa84af4b9fb58607f1dc8b88dfeb8ed6127f2.js
Requested by: Host: malware.news
URL: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: da6a701d09603c2e1bf81930868aa84af4b9fb58607f1dc8b88dfeb8ed6127f2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253

Response headers

cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 998567
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=V8dhCmF%2BXhkXgrlv4DCJTFiSqwfVkVd%2BcKoNx03rJjMTj9o%2FoNEM8yVfFTHSmrLVItw6Zh9w9mJuc6%2FT2p08Ap%2BMa3SE4nVNKVLoqPZb1EKn7UoLsWGVFY2nE6ujOLFvJvgdnZ6nQ3eOtA%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8e60621cba9ad398-FRA
expires: Sun, 09 Nov 2025 19:24:10 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=26566&sent=260&recv=78&lost=0&retrans=0&sent_bytes=293048&recv_bytes=6291&delivery_rate=3429151&cwnd=256&unsent_bytes=24517&cid=5b9b7af518fe909b&ts=505&x=0"
date: Thu, 21 Nov 2024 11:36:39 GMT
content-type: application/javascript
last-modified: Sat, 09 Nov 2024 19:20:46 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 discourse-local-dates-508f34e4c906329b9d84609309e5e1f86c721c36d67f58edf00920eaab24843d.js Show response
malware.news/assets/plugins/ 30 KB
9 KB 68ms
63ms Script
application/javascript 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/plugins/discourse-local-dates-508f34e4c906329b9d84609309e5e1f86c721c36d67f58edf00920eaab24843d.js
Requested by: Host: malware.news
URL: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 508f34e4c906329b9d84609309e5e1f86c721c36d67f58edf00920eaab24843d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253

Response headers

cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 998567
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qe1QjGLs%2Bdeqrs45fWIhG%2FysWjQ3T7LY5nJ2AwCtD4XbnKVfNgIkWWqNwryQGhjRf1k8PHKag89G6pEb1cbBZJSiH%2BklQeh%2BxrBGuKox8BeICEBSFU5Vr4KgPy%2FWkadhSY41VFFzpQvzPw%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8e60621cba9bd398-FRA
expires: Sun, 09 Nov 2025 19:24:10 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=26566&sent=282&recv=78&lost=0&retrans=0&sent_bytes=321998&recv_bytes=6291&delivery_rate=3429151&cwnd=256&unsent_bytes=31&cid=5b9b7af518fe909b&ts=506&x=0"
date: Thu, 21 Nov 2024 11:36:39 GMT
content-type: application/javascript
last-modified: Sat, 09 Nov 2024 19:20:47 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 discourse-presence-072656be372e90afa4bdc01d17154e4296da5a750d0a0122deb432524b55905a.js Show response
malware.news/assets/plugins/ 10 KB
2 KB 69ms
64ms Script
application/javascript 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/plugins/discourse-presence-072656be372e90afa4bdc01d17154e4296da5a750d0a0122deb432524b55905a.js
Requested by: Host: malware.news
URL: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 072656be372e90afa4bdc01d17154e4296da5a750d0a0122deb432524b55905a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253

Response headers

cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 998567
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=09AY0LQSrQxOjJbiL0AHl9gAoichpQ4K%2FlDGEn3d7s%2FLwgVfop0FHE7rxgtxl5F%2BA8z4HHBZYxThcyr4UziKoBldZCWk%2BRxeICNxfvnA6ZNPJ0oxVvDGHqNAJLHOrvSZeqoIdvS%2BjuUoUQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8e60621cba9fd398-FRA
expires: Sun, 09 Nov 2025 19:24:10 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=26566&sent=260&recv=78&lost=0&retrans=0&sent_bytes=293048&recv_bytes=6291&delivery_rate=3429151&cwnd=256&unsent_bytes=14664&cid=5b9b7af518fe909b&ts=505&x=0"
date: Thu, 21 Nov 2024 11:36:39 GMT
content-type: application/javascript
last-modified: Sat, 09 Nov 2024 19:20:47 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 docker_manager_admin-b6a39549af39cfd4edc125b6b3309e052f9360651652b65de6ae95adddddc8c3.js Show response
malware.news/assets/plugins/ 32 KB
7 KB 69ms
64ms Script
application/javascript 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/plugins/docker_manager_admin-b6a39549af39cfd4edc125b6b3309e052f9360651652b65de6ae95adddddc8c3.js
Requested by: Host: malware.news
URL: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b6a39549af39cfd4edc125b6b3309e052f9360651652b65de6ae95adddddc8c3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253

Response headers

cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 998566
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gJswaDU%2F0D9FVFSgofdn1WtYfu2wMY73WeTP1yd0lq%2F7Jr7nC1d%2Fz6PN%2BNEKJZhGkFzJQ2py2RPeSZ47teqjDH8uA25y6%2B8QsbKLvgRGloB5k9LXr5I4avDsBy0DRCr9FQ327ue%2FDd1bLA%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8e60621cbaa0d398-FRA
expires: Sun, 09 Nov 2025 19:24:10 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=26566&sent=260&recv=78&lost=0&retrans=0&sent_bytes=293048&recv_bytes=6291&delivery_rate=3429151&cwnd=256&unsent_bytes=17281&cid=5b9b7af518fe909b&ts=505&x=0"
date: Thu, 21 Nov 2024 11:36:39 GMT
content-type: application/javascript
last-modified: Sat, 09 Nov 2024 19:20:47 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 footnote-b30502d9bd28251a1683c8d09ed164bc6650c5c67c4375e6a42adf95b3ee8110.js Show response
malware.news/assets/plugins/ 3 KB
2 KB 67ms
62ms Script
application/javascript 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/plugins/footnote-b30502d9bd28251a1683c8d09ed164bc6650c5c67c4375e6a42adf95b3ee8110.js
Requested by: Host: malware.news
URL: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b30502d9bd28251a1683c8d09ed164bc6650c5c67c4375e6a42adf95b3ee8110

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253

Response headers

cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 998567
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jfSzIQg3ZUB3VaA9K3J%2Ff8D2t21Yc%2FAC%2Fi5f4iI1CrA2cuIXsrz59kZxZDxBVmuV7xEDr%2FYEqp8W0hf2zcEHmXuvji3XEhs3OKBLVml6oR1m1qM7Ndabp%2Bej9HX4hIy0tE3l5o6mLFimMw%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8e60621cbaa1d398-FRA
expires: Sun, 09 Nov 2025 19:24:10 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=26566&sent=260&recv=78&lost=0&retrans=0&sent_bytes=293048&recv_bytes=6291&delivery_rate=3429151&cwnd=256&unsent_bytes=27243&cid=5b9b7af518fe909b&ts=506&x=0"
date: Thu, 21 Nov 2024 11:36:39 GMT
content-type: application/javascript
last-modified: Sat, 09 Nov 2024 19:20:47 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 footnote_extra-295b457b90cb18fedfdb544868c494c71842a27c0781d3042fa4fd26589204fa.js Show response
malware.news/assets/plugins/ 6 KB
3 KB 67ms
63ms Script
application/javascript 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/plugins/footnote_extra-295b457b90cb18fedfdb544868c494c71842a27c0781d3042fa4fd26589204fa.js
Requested by: Host: malware.news
URL: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5d42ebdcddd972fdff22dca8398998a80ce50b0ec08915e8e8b9682a941b8651

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253

Response headers

cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 43537
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=I4vCIYDzZ%2B4ofSGS%2Bq2FvEa%2FKS5aUAjiSlwalu7OOEvx%2FPW0zehK46HIU0CaXrTgAs%2FlfttZbHAAMmvn3PSzGvjUzJMCF5rwWeF1rHk9S2n7w%2Bs66DHhazXJrvU7jN%2Bacnw5YKuPR4o%2FOQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8e60621cbaa2d398-FRA
expires: Mon, 12 May 2025 01:37:00 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=26566&sent=289&recv=78&lost=0&retrans=0&sent_bytes=331088&recv_bytes=6291&delivery_rate=3429151&cwnd=256&unsent_bytes=0&cid=5b9b7af518fe909b&ts=509&x=0"
date: Thu, 21 Nov 2024 11:36:39 GMT
content-type: application/javascript
last-modified: Sat, 09 Mar 2024 04:05:57 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 poll-c5731add591c9f35fc4899817ccf6b7ef5015b50c20cd3bb07801625cfedbe7e.js Show response
malware.news/assets/plugins/ 89 KB
21 KB 86ms
82ms Script
application/javascript 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/plugins/poll-c5731add591c9f35fc4899817ccf6b7ef5015b50c20cd3bb07801625cfedbe7e.js
Requested by: Host: malware.news
URL: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c5731add591c9f35fc4899817ccf6b7ef5015b50c20cd3bb07801625cfedbe7e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253

Response headers

cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 998567
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kYcQiXNvExbFvGGN3P4UDggL7Cf8%2FVdFTGLr4ycsqNYj%2BtXEpX3vy8c8acWGVBat68fp4VDubtlE5HJwjcBmYZ696%2FqHJBazvvVkmczym8KIHCJhMl%2BJcKi51EEwt91NHeZdlds6ClCzjg%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8e60621cbaa5d398-FRA
expires: Sun, 09 Nov 2025 19:24:10 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=24520&sent=349&recv=81&lost=0&retrans=0&sent_bytes=405071&recv_bytes=6291&delivery_rate=3429151&cwnd=256&unsent_bytes=17156&cid=5b9b7af518fe909b&ts=511&x=0"
date: Thu, 21 Nov 2024 11:36:39 GMT
content-type: application/javascript
last-modified: Sat, 09 Nov 2024 19:20:47 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 spoiler-alert-18509682c8a5b9385e58b9d3ed88d6b42a4ac83a0efec3b028fda569d81fcaa2.js Show response
malware.news/assets/plugins/ 3 KB
2 KB 65ms
61ms Script
application/javascript 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/plugins/spoiler-alert-18509682c8a5b9385e58b9d3ed88d6b42a4ac83a0efec3b028fda569d81fcaa2.js
Requested by: Host: malware.news
URL: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 18509682c8a5b9385e58b9d3ed88d6b42a4ac83a0efec3b028fda569d81fcaa2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253

Response headers

cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 998567
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8ztQvLJT%2Fu%2BJfiejKwTp90KEiqmOon8njCJLMZkWCXF9S%2BsZj7WxvSlVmmQw65Qe1hTrCmzYAun7XQMsiNeP5G5678fOWeZfy0pKPYH92iT0mZjxFqIsfywKA0L84pi2be8mPSeSjD2nqQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8e60621cbaa7d398-FRA
expires: Sun, 09 Nov 2025 19:24:10 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=26566&sent=260&recv=78&lost=0&retrans=0&sent_bytes=293048&recv_bytes=6291&delivery_rate=3429151&cwnd=256&unsent_bytes=12663&cid=5b9b7af518fe909b&ts=505&x=0"
date: Thu, 21 Nov 2024 11:36:39 GMT
content-type: application/javascript
last-modified: Sat, 09 Nov 2024 19:20:47 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 en-4da8a5259a9777f1cd3433a17475c015331c74f52693962a1031c13ae8416c59.js Show response
malware.news/assets/locales/ 322 KB
95 KB 86ms
83ms Script
application/javascript 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/locales/en-4da8a5259a9777f1cd3433a17475c015331c74f52693962a1031c13ae8416c59.js
Requested by: Host: malware.news
URL: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0525596819094f44d7abb830e075097897b46e67ed3314ee3676b54fc222263c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253

Response headers

cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 1002860
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3Mm70%2FldZciND5yi%2FkFFYJNgmrAIvHw71Q7FKl4XDso0d38%2FTf11nruhZSM65SKCwbx2ytSw9AQF5HEbjD16vryBZzVYoRYiTZr4GTN23XUuNv4Ym2rnmhYvDqXqunB0saI6cXx9%2FZtIQQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8e60621cbaa8d398-FRA
expires: Sun, 09 Nov 2025 19:24:10 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=24520&sent=349&recv=81&lost=0&retrans=0&sent_bytes=405071&recv_bytes=6291&delivery_rate=3429151&cwnd=256&unsent_bytes=39705&cid=5b9b7af518fe909b&ts=514&x=0"
date: Thu, 21 Nov 2024 11:36:39 GMT
content-type: application/javascript
last-modified: Sat, 09 Nov 2024 19:21:33 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 mf Show response
malware.news/extra-locales/ 18 KB
3 KB 630ms
626ms Script
application/javascript 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/extra-locales/mf?v=50fc7aac4b913b2fb6284a3ad8efa92b

Requested by

Host: malware.news
URL: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2e8184a4bb598f1bd378dad0b24dc19aaa26071c75e055ebf173f91e62658c6a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253

Response headers

x-request-id: f36bb4da-37ba-4d9d-9a2d-417574b3a2bb
content-encoding: gzip
cf-cache-status: DYNAMIC
x-permitted-cross-domain-policies: none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mwQu1DgrrmsRYbAfy04MVXeZkd1QrGOtmt2OnC7hRZ%2F98bGXPrpRL0wXedn0Htke%2FuL7pNFIXhYw83K44mU9axyutVVli5gMymyINQgx82f9mxgOQ6VF98EFchjA%2FT1ey9kq4t%2FpzpE6dQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
server-timing: cfL4;desc="?proto=TCP&rtt=21301&sent=1508&recv=808&lost=0&retrans=327&sent_bytes=1929684&recv_bytes=6291&delivery_rate=11763193&cwnd=656&unsent_bytes=0&cid=5b9b7af518fe909b&ts=1100&x=0"
date: Thu, 21 Nov 2024 11:36:39 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding, Accept
x-runtime: 0.298617
x-frame-options: SAMEORIGIN
cache-control: max-age=31556952, public, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: same-origin-allow-popups
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8e60621cbaaad398-FRA
x-discourse-route: extra_locales/show
x-xss-protection: 0
server: cloudflare

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 269 KB
95 KB 285ms
44ms Script
application/javascript 2a00:1450:4001:81c::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-SVDG4GL741

Requested by

Host: malware.news
URL: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

06ad5a74b33a607a983cb3cbdfc613bcd8737d506d88af2fa4f839cc250c2be4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 21 Nov 2024 11:36:39 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 21 Nov 2024 11:36:39 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 96653
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 google-universal-analytics-v4-e154af4adb3c483a3aba7f9a7229b8881cdc5cf369290923d965a2ad30163ae8.js Show response
malware.news/assets/ 533 B
839 B 87ms
84ms Script
application/javascript 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/google-universal-analytics-v4-e154af4adb3c483a3aba7f9a7229b8881cdc5cf369290923d965a2ad30163ae8.js
Requested by: Host: malware.news
URL: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e154af4adb3c483a3aba7f9a7229b8881cdc5cf369290923d965a2ad30163ae8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253

Response headers

cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 3136510
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2qNuh%2FkJLub5j3zcLhcIoHymWBnfDFitqkFSmsTkLiCLoAMSY0lIDE6DvZuVQ7SxOeKYp4jrGVfdgm3%2BZHvrzxhAwxHQZ1KJNpweuzv%2FCYrBGwiYAPgHwwN4R%2Fz9WlOgNshAD7a6no54sw%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8e60621cbaabd398-FRA
expires: Tue, 29 Apr 2025 14:41:33 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=24520&sent=349&recv=81&lost=0&retrans=0&sent_bytes=405071&recv_bytes=6291&delivery_rate=3429151&cwnd=256&unsent_bytes=38800&cid=5b9b7af518fe909b&ts=514&x=0"
date: Thu, 21 Nov 2024 11:36:39 GMT
content-type: application/javascript
last-modified: Sat, 09 Mar 2024 04:04:58 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 color_definitions_base__2_5875a49f7a1a2f6dfdacc9c6ee7ac82548345c00.css
malware.news/stylesheets/ 4 KB
2 KB 80ms
56ms Stylesheet
text/css 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/stylesheets/color_definitions_base__2_5875a49f7a1a2f6dfdacc9c6ee7ac82548345c00.css?__ws=malware.news

Requested by

Host: malware.news
URL: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5db83bcef43ac8fdafad6b53d7b080a2f4a00ccb306e5fa85793138e82d65244

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253

Response headers

x-request-id: 288873b3-4d6f-46dd-977f-62dfacc5886d
content-encoding: gzip
cf-cache-status: HIT
age: 43537
x-permitted-cross-domain-policies: none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pmzCmqv%2BrAK6HljFW8Omj53QQk4qOzBce7I3walo6%2F7l9CRTiBPOLe5uan%2FN%2BXL3x7%2FhlpmP01ZR8BiD3oh09QGjS4mtgdVLSXqNXVW66qfSHorpfOh4CwizczTvCLfM3IP27sCJ%2FFJNxA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
server-timing: cfL4;desc="?proto=TCP&rtt=25964&sent=90&recv=26&lost=0&retrans=0&sent_bytes=91067&recv_bytes=3694&delivery_rate=1290082&cwnd=256&unsent_bytes=31872&cid=5b9b7af518fe909b&ts=256&x=0"
date: Thu, 21 Nov 2024 11:36:38 GMT
content-disposition: inline; filename="color_definitions_base__2_5875a49f7a1a2f6dfdacc9c6ee7ac82548345c00.css"; filename*=UTF-8''color_definitions_base__2_5875a49f7a1a2f6dfdacc9c6ee7ac82548345c00.css
content-type: text/css
vary: Accept-Encoding
last-modified: Sat, 09 Nov 2024 19:21:48 GMT
x-frame-options: SAMEORIGIN
cache-control: public, max-age=31556952, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: same-origin-allow-popups
content-transfer-encoding: binary
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8e60621b2eeed398-FRA
x-discourse-route: stylesheets/show
x-xss-protection: 0
server: cloudflare

GET
H2 200 desktop_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css
malware.news/stylesheets/ 721 KB
111 KB 53ms
29ms Stylesheet
text/css 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/stylesheets/desktop_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css?__ws=malware.news

Requested by

Host: malware.news
URL: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6ac36c965849ccf6567568611d6c7eb178a1b2b0325c90f570ca07e9fc9329b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253

Response headers

x-request-id: b1e0eff9-375e-43b8-b843-428a22d6f4fe
content-encoding: gzip
cf-cache-status: HIT
age: 998566
x-permitted-cross-domain-policies: none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eUisnOig3t4Rrs%2BB2wayJjCZjwZlKzS0Qjt68BrGUMmJ7OZAYPSJfRg3tB5wppA0qYFUEbVzTnITTJP2VppjVkBoj44j3p1xtk%2FjvDjGtwHF4eF9xSXviSSNgUqMnAjXPWr06fze7UmA2A%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
server-timing: cfL4;desc="?proto=TCP&rtt=25964&sent=36&recv=26&lost=0&retrans=0&sent_bytes=28766&recv_bytes=3694&delivery_rate=1290082&cwnd=256&unsent_bytes=0&cid=5b9b7af518fe909b&ts=255&x=0"
date: Thu, 21 Nov 2024 11:36:38 GMT
content-disposition: inline; filename="desktop_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css"; filename*=UTF-8''desktop_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css
content-type: text/css
vary: Accept-Encoding
last-modified: Sat, 09 Nov 2024 19:21:42 GMT
x-frame-options: SAMEORIGIN
cache-control: public, max-age=31556952, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: same-origin-allow-popups
content-transfer-encoding: binary
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8e60621b2eefd398-FRA
x-discourse-route: stylesheets/show
x-xss-protection: 0
server: cloudflare

GET
H2 200 checklist_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css
malware.news/stylesheets/ 5 KB
2 KB 52ms
29ms Stylesheet
text/css 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/stylesheets/checklist_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css?__ws=malware.news

Requested by

Host: malware.news
URL: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3210e81db34d0cf4dbf5ad179f4c0cbbe1a53f4d2b2f8d265087efa34e386210

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253

Response headers

x-request-id: 3099f5d1-17d7-4ac8-b0a1-2c8174bf917f
content-encoding: gzip
cf-cache-status: HIT
age: 998566
x-permitted-cross-domain-policies: none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=o9jUIhFmrtzOTNn99feGPyBEwNI8iWuoFJ%2FFPgydYeNDzTxofloQAvDBVUueTvuW9FFcRE4b17ZAG8zPd2b%2BJyIIi0m49XZi3WCmtuJ%2BErMsB5%2F24UyaD%2FwbPSc7vkaYaUBOhGuILNHPOA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
server-timing: cfL4;desc="?proto=TCP&rtt=25964&sent=33&recv=26&lost=0&retrans=0&sent_bytes=26939&recv_bytes=3694&delivery_rate=1290082&cwnd=256&unsent_bytes=0&cid=5b9b7af518fe909b&ts=254&x=0"
date: Thu, 21 Nov 2024 11:36:38 GMT
content-disposition: inline; filename="checklist_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css"; filename*=UTF-8''checklist_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css
content-type: text/css
vary: Accept-Encoding
last-modified: Sat, 09 Nov 2024 19:21:46 GMT
x-frame-options: SAMEORIGIN
cache-control: public, max-age=31556952, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: same-origin-allow-popups
content-transfer-encoding: binary
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8e60621b2ef0d398-FRA
x-discourse-route: stylesheets/show
x-xss-protection: 0
server: cloudflare

GET
H2 200 discourse-details_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css
malware.news/stylesheets/ 3 KB
1 KB 78ms
55ms Stylesheet
text/css 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/stylesheets/discourse-details_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css?__ws=malware.news

Requested by

Host: malware.news
URL: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

05cd38562b6bd50256ac866bfb550135934771b1afb1eb0127dcd8ed2fbdacf6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253

Response headers

x-request-id: 43f77564-11eb-4009-9546-4bfc645980da
content-encoding: gzip
cf-cache-status: HIT
age: 943050
x-permitted-cross-domain-policies: none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KVmjMMug8TEvrVgBVa8Nn%2BdKTg9gIG%2BDcljTot39XjuVfSQqCqtBfHY4VQXEo822xGqvWjo0oNEg7t%2FYqgjo%2Fq36KpSXbqlAnv5J7uSScCe4iLraYGIQHdWlz6h1b8qUIlv6p5zpoZYnmQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
server-timing: cfL4;desc="?proto=TCP&rtt=25964&sent=90&recv=26&lost=0&retrans=0&sent_bytes=91067&recv_bytes=3694&delivery_rate=1290082&cwnd=256&unsent_bytes=31872&cid=5b9b7af518fe909b&ts=256&x=0"
date: Thu, 21 Nov 2024 11:36:38 GMT
content-disposition: inline; filename="discourse-details_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css"; filename*=UTF-8''discourse-details_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css
content-type: text/css
vary: Accept-Encoding
last-modified: Sat, 09 Nov 2024 19:21:46 GMT
x-frame-options: SAMEORIGIN
cache-control: public, max-age=31556952, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: same-origin-allow-popups
content-transfer-encoding: binary
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8e60621b2ef3d398-FRA
x-discourse-route: stylesheets/show
x-xss-protection: 0
server: cloudflare

GET
H2 200 discourse-lazy-videos_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css
malware.news/stylesheets/ 7 KB
4 KB 82ms
58ms Stylesheet
text/css 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/stylesheets/discourse-lazy-videos_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css?__ws=malware.news

Requested by

Host: malware.news
URL: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

254c1df8945252e32e84cb5e6a27f1a4be608015da6523a2f546c8a3b411d6a8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253

Response headers

x-request-id: 16ee2fa5-eb07-4cec-ba9a-87c807a4cd33
content-encoding: gzip
cf-cache-status: HIT
age: 998566
x-permitted-cross-domain-policies: none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KI1TH5omkEb1r32q8jHDQK7FUUWqb6ZE5%2FTEToKBZf%2FLFAH%2FeCNZXLwY%2FqYJjG1Djexy%2FOPd2xTx6Q%2FPTtdAUhYHYCpJJn4NiHyvQ%2B19EoK9RkyS1rw2Je8FennsWtau6JGS2FkiHioDTA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
server-timing: cfL4;desc="?proto=TCP&rtt=25964&sent=90&recv=26&lost=0&retrans=0&sent_bytes=91067&recv_bytes=3694&delivery_rate=1290082&cwnd=256&unsent_bytes=31872&cid=5b9b7af518fe909b&ts=256&x=0"
date: Thu, 21 Nov 2024 11:36:38 GMT
content-disposition: inline; filename="discourse-lazy-videos_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css"; filename*=UTF-8''discourse-lazy-videos_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css
content-type: text/css
vary: Accept-Encoding
last-modified: Sat, 09 Nov 2024 19:21:46 GMT
x-frame-options: SAMEORIGIN
cache-control: public, max-age=31556952, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: same-origin-allow-popups
content-transfer-encoding: binary
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8e60621b2ef4d398-FRA
x-discourse-route: stylesheets/show
x-xss-protection: 0
server: cloudflare

GET
H2 200 discourse-local-dates_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css
malware.news/stylesheets/ 856 B
1 KB 79ms
56ms Stylesheet
text/css 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/stylesheets/discourse-local-dates_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css?__ws=malware.news

Requested by

Host: malware.news
URL: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

eea9a523d4db379cf8df984a1e29425971a0a887e69ebd5fffcf87b207dea982

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253

Response headers

x-request-id: 7e8d191d-618d-49df-a5c1-f6888a3809a7
content-encoding: gzip
cf-cache-status: HIT
age: 43536
x-permitted-cross-domain-policies: none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DEGHHyrlZsxbyBxYFSoGMvVRwVGTdue2FuBAq2ePRuP3Wt%2FfmtggUnQQSLnXuUmeSILp8nWmSF7IQjCXh4y%2F6bSKkZX%2FXuN6zx%2BykC3CJ3d40SThoGlA61pES8apAKTCOnfPqAY7AwQs8w%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
server-timing: cfL4;desc="?proto=TCP&rtt=25964&sent=90&recv=26&lost=0&retrans=0&sent_bytes=91067&recv_bytes=3694&delivery_rate=1290082&cwnd=256&unsent_bytes=31872&cid=5b9b7af518fe909b&ts=256&x=0"
date: Thu, 21 Nov 2024 11:36:38 GMT
content-disposition: inline; filename="discourse-local-dates_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css"; filename*=UTF-8''discourse-local-dates_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css
content-type: text/css
vary: Accept-Encoding
last-modified: Sat, 09 Nov 2024 19:21:46 GMT
x-frame-options: SAMEORIGIN
cache-control: public, max-age=31556952, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: same-origin-allow-popups
content-transfer-encoding: binary
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8e60621b2ef5d398-FRA
x-discourse-route: stylesheets/show
x-xss-protection: 0
server: cloudflare

GET
H2 200 discourse-narrative-bot_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css
malware.news/stylesheets/ 171 B
686 B 80ms
57ms Stylesheet
text/css 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/stylesheets/discourse-narrative-bot_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css?__ws=malware.news

Requested by

Host: malware.news
URL: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f894e10b15e5045352c8ded91c7e3194eca94cefb94260d8a222cb6943831965

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253

Response headers

x-request-id: 8424eea4-83f4-434f-989b-40a2a0eb6713
content-encoding: gzip
cf-cache-status: HIT
age: 998565
x-permitted-cross-domain-policies: none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YIWXTEbYc9aztbFfvx6OFGXyV%2BBhZy4CQDCTRFdqVjSD%2BJeRtEx7%2BjnadgPhDE39QdZj2W59ONsvfXmdW5oV%2BRooSpEBgUdap9Uwmxn77gltOBkzfLrHFHMNZKQyU73i2xBO9H0aX4fs6Q%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
server-timing: cfL4;desc="?proto=TCP&rtt=25964&sent=90&recv=26&lost=0&retrans=0&sent_bytes=91067&recv_bytes=3694&delivery_rate=1290082&cwnd=256&unsent_bytes=31872&cid=5b9b7af518fe909b&ts=256&x=0"
date: Thu, 21 Nov 2024 11:36:38 GMT
content-disposition: inline; filename="discourse-narrative-bot_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css"; filename*=UTF-8''discourse-narrative-bot_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css
content-type: text/css
vary: Accept-Encoding
last-modified: Sat, 09 Nov 2024 19:21:46 GMT
x-frame-options: SAMEORIGIN
cache-control: public, max-age=31556952, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: same-origin-allow-popups
content-transfer-encoding: binary
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8e60621b2ef6d398-FRA
x-discourse-route: stylesheets/show
x-xss-protection: 0
server: cloudflare

GET
H2 200 discourse-presence_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css
malware.news/stylesheets/ 1 KB
1 KB 80ms
58ms Stylesheet
text/css 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/stylesheets/discourse-presence_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css?__ws=malware.news

Requested by

Host: malware.news
URL: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f3dfbf92751007bf7123860118ef29e50e4ed0b0c7bd6059f44c912e161640f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253

Response headers

x-request-id: 65590104-4930-4499-82cd-b21aa440e53c
content-encoding: gzip
cf-cache-status: HIT
age: 998566
x-permitted-cross-domain-policies: none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lCCbi35fHRzecFp2Qtp%2Fa%2FaAry2%2BqFkrC%2BSOl2rD6suZtyR4SW3XqBc3%2Fyo3IhUA%2FsqTsW5wyznd5e%2FP%2BZ8OjRzxjyLjZBZos%2B82f6Yl7MN%2FqeI2vvGXCkjNsHplmIZk9a4w3Huqm6aylQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
server-timing: cfL4;desc="?proto=TCP&rtt=25964&sent=90&recv=26&lost=0&retrans=0&sent_bytes=91067&recv_bytes=3694&delivery_rate=1290082&cwnd=256&unsent_bytes=31872&cid=5b9b7af518fe909b&ts=257&x=0"
date: Thu, 21 Nov 2024 11:36:38 GMT
content-disposition: inline; filename="discourse-presence_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css"; filename*=UTF-8''discourse-presence_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css
content-type: text/css
vary: Accept-Encoding
last-modified: Sat, 09 Nov 2024 19:21:46 GMT
x-frame-options: SAMEORIGIN
cache-control: public, max-age=31556952, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: same-origin-allow-popups
content-transfer-encoding: binary
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8e60621b2ef8d398-FRA
x-discourse-route: stylesheets/show
x-xss-protection: 0
server: cloudflare

GET
H2 200 docker_manager_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css
malware.news/stylesheets/ 3 KB
2 KB 78ms
57ms Stylesheet
text/css 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/stylesheets/docker_manager_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css?__ws=malware.news

Requested by

Host: malware.news
URL: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fb73247ea0b8cd13f9cc740f6c5d319ed7b77df2d73fb96f142a540e83fde0f9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253

Response headers

x-request-id: c159bd82-47dd-43d9-b3b6-60c500ed68ad
content-encoding: gzip
cf-cache-status: HIT
age: 998565
x-permitted-cross-domain-policies: none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2%2BPwgscEzOuWeyxZPWpJlWTrKLV2MmJtqzJtdtt90GdK7T4aEVd0wUKzB3xpOVxT2VyOj08SwR7zXR0TjMuXBzRppcXwk5eS7LDINgWe0NgGdy0nEBIKPt5p2qcNDPQXngYqhQjpHGZQ7Q%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
server-timing: cfL4;desc="?proto=TCP&rtt=25964&sent=90&recv=26&lost=0&retrans=0&sent_bytes=91067&recv_bytes=3694&delivery_rate=1290082&cwnd=256&unsent_bytes=31872&cid=5b9b7af518fe909b&ts=256&x=0"
date: Thu, 21 Nov 2024 11:36:38 GMT
content-disposition: inline; filename="docker_manager_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css"; filename*=UTF-8''docker_manager_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css
content-type: text/css
vary: Accept-Encoding
last-modified: Sat, 09 Nov 2024 19:21:46 GMT
x-frame-options: SAMEORIGIN
cache-control: public, max-age=31556952, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: same-origin-allow-popups
content-transfer-encoding: binary
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8e60621b2efcd398-FRA
x-discourse-route: stylesheets/show
x-xss-protection: 0
server: cloudflare

GET
H2 200 footnote_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css
malware.news/stylesheets/ 2 KB
1 KB 79ms
58ms Stylesheet
text/css 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/stylesheets/footnote_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css?__ws=malware.news

Requested by

Host: malware.news
URL: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d4e1d8a7be66468bdd7dca8c2dfcda327e8d5af5a390482bc2942b8f45666142

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253

Response headers

x-request-id: ca152658-164e-4335-8a8a-c15132b755ef
content-encoding: gzip
cf-cache-status: HIT
age: 1002872
x-permitted-cross-domain-policies: none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5GPN28CaMcEh41GZFEARVuqhWMs8Ia%2FeJtPa%2BOxMFjgfx7naMckvzp75aThRwXYvAgvH0OPG%2Fu5jjV%2BAjN6nHDR3DWiCJrWX47fBlM0d1bJM3c6Otl5PnMqmbeqQh8c4UdSrWxNUZZFoqA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
server-timing: cfL4;desc="?proto=TCP&rtt=25964&sent=90&recv=26&lost=0&retrans=0&sent_bytes=91067&recv_bytes=3694&delivery_rate=1290082&cwnd=256&unsent_bytes=31872&cid=5b9b7af518fe909b&ts=256&x=0"
date: Thu, 21 Nov 2024 11:36:38 GMT
content-disposition: inline; filename="footnote_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css"; filename*=UTF-8''footnote_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css
content-type: text/css
vary: Accept-Encoding
last-modified: Sat, 09 Nov 2024 19:21:46 GMT
x-frame-options: SAMEORIGIN
cache-control: public, max-age=31556952, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: same-origin-allow-popups
content-transfer-encoding: binary
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8e60621b2efdd398-FRA
x-discourse-route: stylesheets/show
x-xss-protection: 0
server: cloudflare

GET
H2 200 poll_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css
malware.news/stylesheets/ 13 KB
4 KB 100ms
82ms Stylesheet
text/css 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/stylesheets/poll_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css?__ws=malware.news

Requested by

Host: malware.news
URL: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b31913414ff7bbbf49f273a06ec4cd11e42d55cf0145a998e508b6cf59d93750

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253

Response headers

x-request-id: 2dd0623d-96c9-48cb-ac12-2f2f4eef79df
content-encoding: gzip
cf-cache-status: HIT
age: 1002846
x-permitted-cross-domain-policies: none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yJWU1d5oHPmOXOv2L4P5T8FpVR%2FgCLcjtCnpkS0WqWeIyV1aPMgjTZI%2FNKsa%2BPcgZo18IFDoSolMeo8ZL59kyUv%2B1eaJriW4%2FA47jXIrV2lBuS96hnbs2hGoHpdjRh02snbuOF2orFuF9A%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
server-timing: cfL4;desc="?proto=TCP&rtt=27074&sent=142&recv=30&lost=0&retrans=0&sent_bytes=155195&recv_bytes=4384&delivery_rate=2422504&cwnd=256&unsent_bytes=5909&cid=5b9b7af518fe909b&ts=286&x=0"
date: Thu, 21 Nov 2024 11:36:38 GMT
content-disposition: inline; filename="poll_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css"; filename*=UTF-8''poll_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css
content-type: text/css
vary: Accept-Encoding
last-modified: Sat, 09 Nov 2024 19:21:46 GMT
x-frame-options: SAMEORIGIN
cache-control: public, max-age=31556952, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: same-origin-allow-popups
content-transfer-encoding: binary
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8e60621b5f63d398-FRA
x-discourse-route: stylesheets/show
x-xss-protection: 0
server: cloudflare

GET
H2 200 spoiler-alert_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css
malware.news/stylesheets/ 1 KB
1 KB 83ms
66ms Stylesheet
text/css 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/stylesheets/spoiler-alert_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css?__ws=malware.news

Requested by

Host: malware.news
URL: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

da53e3c659e805a26124ef2113f088ef6dd66d36814c62a3ad3b6ad177ef8b75

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253

Response headers

x-request-id: 7154f3c5-fa67-4fc7-8dbd-f6338e26f07f
content-encoding: gzip
cf-cache-status: HIT
age: 1002870
x-permitted-cross-domain-policies: none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UYd6%2FSdSsIwTvEyUjkUeu5waI6Qxu8xvE1TTkPdYw3jGagnaKMBBWgYgPvIOYEIBJ0TppVD29B2aFAKHXX5xEwzIfw%2BjvaT77BdOSazSqTrGEVnwsdGdRFYsMzhgdv3v%2FFEuMGeCyClDhg%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
server-timing: cfL4;desc="?proto=TCP&rtt=25964&sent=90&recv=27&lost=0&retrans=0&sent_bytes=91067&recv_bytes=4384&delivery_rate=1290082&cwnd=256&unsent_bytes=31872&cid=5b9b7af518fe909b&ts=281&x=0"
date: Thu, 21 Nov 2024 11:36:38 GMT
content-disposition: inline; filename="spoiler-alert_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css"; filename*=UTF-8''spoiler-alert_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css
content-type: text/css
vary: Accept-Encoding
last-modified: Sat, 09 Nov 2024 19:21:47 GMT
x-frame-options: SAMEORIGIN
cache-control: public, max-age=31556952, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: same-origin-allow-popups
content-transfer-encoding: binary
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8e60621b5f67d398-FRA
x-discourse-route: stylesheets/show
x-xss-protection: 0
server: cloudflare

GET
H2 200 poll_desktop_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css
malware.news/stylesheets/ 486 B
926 B 88ms
71ms Stylesheet
text/css 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/stylesheets/poll_desktop_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css?__ws=malware.news

Requested by

Host: malware.news
URL: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

61cebcc6c197dc2ab70050e4e318e731564461ffea6f676c101592e3b77e22a3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253

Response headers

x-request-id: 9ae70abe-ad13-45a7-843a-c2eee246ed51
content-encoding: gzip
cf-cache-status: HIT
age: 998566
x-permitted-cross-domain-policies: none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DJarm9C4JT7mPr63K02JFb9oZfbbi7cw89RdDzPxnn5zA4avo6yi0o%2BL8XmCwl2duW40S6ECtKB6skTC8I4BqegIdqqe4NHDCQZST8a5fbv4QJDBUXWp0g5e54zAXEaoK4ACdRsFMTJLOQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
server-timing: cfL4;desc="?proto=TCP&rtt=25964&sent=90&recv=27&lost=0&retrans=0&sent_bytes=91067&recv_bytes=4384&delivery_rate=1290082&cwnd=256&unsent_bytes=31872&cid=5b9b7af518fe909b&ts=282&x=0"
date: Thu, 21 Nov 2024 11:36:38 GMT
content-disposition: inline; filename="poll_desktop_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css"; filename*=UTF-8''poll_desktop_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css
content-type: text/css
vary: Accept-Encoding
last-modified: Sat, 09 Nov 2024 19:21:47 GMT
x-frame-options: SAMEORIGIN
cache-control: public, max-age=31556952, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: same-origin-allow-popups
content-transfer-encoding: binary
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8e60621b5f68d398-FRA
x-discourse-route: stylesheets/show
x-xss-protection: 0
server: cloudflare

GET
H2 200 desktop_theme_2_be2225fcdc7dc6bdbe3821fc0d054dd51ef27988.css
malware.news/stylesheets/ 108 B
687 B 90ms
73ms Stylesheet
text/css 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/stylesheets/desktop_theme_2_be2225fcdc7dc6bdbe3821fc0d054dd51ef27988.css?__ws=malware.news

Requested by

Host: malware.news
URL: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0d6159259c7edbfddc1b4de1d432c34dea8cfb429af0f583ad2c3048ece27dcf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253

Response headers

x-request-id: d551d24f-82db-42fb-996b-1ea9dfb2552f
content-encoding: gzip
cf-cache-status: HIT
age: 1002858
x-permitted-cross-domain-policies: none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FOF4Q3xYnYj5K%2FcfMES9PmxNLalkC3v3evnqf6Ant67vZ8XXGhJ8elsB2wNnVDC9de5P3ba4SdiOlYDv%2BaCwPXcct2AceUbRFtnvcdlNV8NOAffhuu88JHRUR2E1ETlq6B8Lo2TfaNBL0Q%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
server-timing: cfL4;desc="?proto=TCP&rtt=25964&sent=90&recv=27&lost=0&retrans=0&sent_bytes=91067&recv_bytes=4384&delivery_rate=1290082&cwnd=256&unsent_bytes=31872&cid=5b9b7af518fe909b&ts=282&x=0"
date: Thu, 21 Nov 2024 11:36:38 GMT
content-disposition: inline; filename="desktop_theme_2_be2225fcdc7dc6bdbe3821fc0d054dd51ef27988.css"; filename*=UTF-8''desktop_theme_2_be2225fcdc7dc6bdbe3821fc0d054dd51ef27988.css
content-type: text/css
vary: Accept-Encoding
last-modified: Sat, 09 Nov 2024 19:21:48 GMT
x-frame-options: SAMEORIGIN
cache-control: public, max-age=31556952, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: same-origin-allow-popups
content-transfer-encoding: binary
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8e60621b5f69d398-FRA
x-discourse-route: stylesheets/show
x-xss-protection: 0
server: cloudflare

GET
DATA 200
OK truncated
/ 42 B
42 B Image
image/svg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c138c32d8539bcf7541029bddec47bc83534b02a92893b90ecee469a1fccfbcc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml

GET
H2 200 svg-2-ebd30ca654fdbd40604e7a7f5127b1bce16eb12b.js Show response
malware.news/svg-sprite/malware.news/ 138 KB
44 KB 34ms
33ms Script
application/javascript 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/svg-sprite/malware.news/svg-2-ebd30ca654fdbd40604e7a7f5127b1bce16eb12b.js

Requested by

Host: malware.news
URL: https://malware.news/assets/chunk.dc7a33f0346e6027c1e5.d41d8cd9.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e16bb6b35c3614177667b6323a7258bebe6a29b7526ca990c257fa906b7e4911

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253

Response headers

x-request-id: 76fd9abf-f37e-4c3d-a724-b2eadc11ed3b
content-encoding: gzip
cf-cache-status: HIT
age: 551465
x-permitted-cross-domain-policies: none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VIly4ZEPWFbXi%2F0CxW4v8mu9IKlXsl%2FXP7mu60OJJOCaiuJDbsW7UrdtX5j9N1BEvUcT%2BF4bL4lR23doan18LXZQHcNK65LyM9TpjEBiyW7lCi4Kc%2FjwhxpcfRMM03B%2BXA2EnfYXVs8z5A%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
server-timing: cfL4;desc="?proto=TCP&rtt=21330&sent=1512&recv=813&lost=0&retrans=327&sent_bytes=1932772&recv_bytes=6393&delivery_rate=11763193&cwnd=660&unsent_bytes=0&cid=5b9b7af518fe909b&ts=1491&x=0"
date: Thu, 21 Nov 2024 11:36:40 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding, Accept
last-modified: Sun, 09 Nov 2014 19:24:11 GMT
x-frame-options: SAMEORIGIN
cache-control: public, max-age=31556952, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: same-origin-allow-popups
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8e606222e99ad398-FRA
x-discourse-route: svg_sprite/show
x-xss-protection: 0
server: cloudflare

GET
H2 200 ba8ee0a927a69022c651441ac23d01bcdbc09785.png
malware.news/uploads/default/original/3X/b/a/ 9 KB
9 KB 63ms
55ms Image
image/png 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://malware.news/uploads/default/original/3X/b/a/ba8ee0a927a69022c651441ac23d01bcdbc09785.png
Requested by: Host: malware.news
URL: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 041dc75fa9294876d29e6d78e76c9f7f3202f1763480da93d6ce2414d0a095c3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253

Response headers

cf-cache-status: HIT
age: 3136510
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NaXQiHzJ70SLCcDIbRwe8KEhzbA9fbsAmL%2BDzIL1FkFf4JSruGLaLWFJq%2F4M4Kb6QRAqeV1t0fK%2BQfwYSdy3%2FcEnRFgXaQXDqJ4F3XaPASt0dBREXz3qOeGRl4taAjkDvfcW4ZXIWP15%2Fg%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: Wed, 03 Sep 2025 05:48:43 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=27321&sent=1552&recv=854&lost=0&retrans=327&sent_bytes=1979315&recv_bytes=6758&delivery_rate=11763193&cwnd=700&unsent_bytes=0&cid=5b9b7af518fe909b&ts=1756&x=0"
date: Thu, 21 Nov 2024 11:36:40 GMT
content-type: image/png
last-modified: Sat, 22 Dec 2018 04:38:37 GMT
vary: Accept-Encoding
cache-control: max-age=31536000
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8e6062248dd0d398-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 8758
server: cloudflare

GET
H2 200 24_2.png
malware.news/user_avatar/malware.news/malbot/48/ 3 KB
3 KB 57ms
23ms Image
image/jpeg 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://malware.news/user_avatar/malware.news/malbot/48/24_2.png

Requested by

Host: malware.news
URL: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

acb53c4533765bc5dc1225c4850964ddb2ed637a7a1cf420c446a08104085da8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253

Response headers

cf-bgj: h2pri
cf-cache-status: HIT
age: 3256072
x-permitted-cross-domain-policies: none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yCIoZJ%2F%2Fx%2FwJmWnI8kmbQyPpBfjekrcAT1syYy%2BpvP7iAC5BmblSLoPgGTwU%2B8gq9OmFtIbRAM7Ce3ytbbtsQmuZ39wGh2vwfGNdYynQsDtdqdu4eA%2FWXk%2Bnq6X%2BzMSxR6aWTzKC7o7pvQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
server-timing: cfL4;desc="?proto=TCP&rtt=22613&sent=1561&recv=864&lost=0&retrans=327&sent_bytes=1988670&recv_bytes=6840&delivery_rate=11763193&cwnd=709&unsent_bytes=0&cid=5b9b7af518fe909b&ts=1823&x=0"
date: Thu, 21 Nov 2024 11:36:40 GMT
content-type: image/jpeg
last-modified: Sat, 09 Mar 2024 04:15:49 GMT
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
cache-control: public, max-age=31556952, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-transfer-encoding: binary
referrer-policy: strict-origin-when-cross-origin
x-download-options: noopen
cf-ray: 8e606224fec5d398-FRA
accept-ranges: bytes
content-length: 2626
x-discourse-route: user_avatars/show
x-xss-protection: 0
server: cloudflare

GET
H2 200 image_00e479.png
www.malwarebytes.com/wp-content/uploads/sites/2/2024/11/ 132 KB
132 KB 209ms
20ms Image
image/webp 192.0.66.233
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.malwarebytes.com/wp-content/uploads/sites/2/2024/11/image_00e479.png?w=859

Requested by

Host: malware.news
URL: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

c0ee9ad6230cb234431bf201d1138eb7fc125e72822b2ccd0f2e9aacfb8f709e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/

Response headers

strict-transport-security: max-age=31536000
cache-control: max-age=31536000
x-rq: hhn2 109 154 443
etag: "6a9b473319b81a40"
accept-ranges: bytes, bytes
x-cache: HIT
content-length: 134786
date: Thu, 21 Nov 2024 11:36:40 GMT
content-type: image/webp
last-modified: Fri, 08 Nov 2024 23:40:07 GMT
server: nginx
vary: Accept

GET
H2 200 image_c03d18.png
www.malwarebytes.com/wp-content/uploads/sites/2/2024/11/ 16 KB
16 KB 211ms
22ms Image
image/webp 192.0.66.233
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.malwarebytes.com/wp-content/uploads/sites/2/2024/11/image_c03d18.png

Requested by

Host: malware.news
URL: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

8b0c5d2ee64cd5c2e2217803da9fe35ccbe85220e33fb35a2675d9aaca3d9103

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/

Response headers

strict-transport-security: max-age=31536000
cache-control: max-age=31536000
x-rq: hhn2 109 200 443
etag: "a8c2412f92003c26"
accept-ranges: bytes, bytes
x-cache: HIT
content-length: 16576
date: Thu, 21 Nov 2024 11:36:40 GMT
content-type: image/webp
last-modified: Fri, 08 Nov 2024 23:36:25 GMT
server: nginx
vary: Accept

GET
H2 200 image_07f473.png
www.malwarebytes.com/wp-content/uploads/sites/2/2024/11/ 21 KB
21 KB 211ms
23ms Image
image/webp 192.0.66.233
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.malwarebytes.com/wp-content/uploads/sites/2/2024/11/image_07f473.png

Requested by

Host: malware.news
URL: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

257486394047ff3f40d8edea10ef11841c382a6052c31c97cd2a4f21a316c7d8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/

Response headers

strict-transport-security: max-age=31536000
cache-control: max-age=31536000
x-rq: hhn2 109 38 443
etag: "7a6c65c3d4ddadee"
accept-ranges: bytes, bytes
x-cache: HIT
content-length: 21568
date: Thu, 21 Nov 2024 11:36:40 GMT
content-type: image/webp
last-modified: Fri, 08 Nov 2024 23:36:25 GMT
server: nginx
vary: Accept

GET
H2 200 image_f1c809.png
www.malwarebytes.com/wp-content/uploads/sites/2/2024/11/ 31 KB
32 KB 211ms
23ms Image
image/webp 192.0.66.233
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.malwarebytes.com/wp-content/uploads/sites/2/2024/11/image_f1c809.png

Requested by

Host: malware.news
URL: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

85990a895de63771b176a8e0cab6f0de69191da07a1739c0d7e3dd48b9990adf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/

Response headers

strict-transport-security: max-age=31536000
cache-control: max-age=31536000
x-rq: hhn2 109 32 443
etag: "aa77074a999f1daf"
accept-ranges: bytes, bytes
x-cache: HIT
content-length: 32114
date: Thu, 21 Nov 2024 11:36:40 GMT
content-type: image/webp
last-modified: Fri, 08 Nov 2024 23:36:25 GMT
server: nginx
vary: Accept

POST
H2 204 collect
region1.analytics.google.com/g/ 0
0 211ms
45ms Fetch
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-SVDG4GL741&gtm=45je4bk0v9121104881za200&_p=1732188999821&_gaz=1&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102077855~102081485&cid=675397442.1732189000&ecid=1434389123&ul=de-de&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&dl=%2Ft%2Fhello-again-fakebat-popular-loader-returns-after-months-long-hiatus%2F88253&dt=Hello%20again%2C%20FakeBat%3A%20popular%20loader%20returns%20after%20months-long%20hiatus%20-%20Malware%20Analysis%20-%20Malware%20Analysis%2C%20News%20and%20Indicators&sid=1732189000&sct=1&seg=0&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&ep.autoLinkConfig=%5Bobject%20Object%5D&tfd=1892
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-SVDG4GL741
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://malware.news
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 21 Nov 2024 11:36:40 GMT
content-type: text/plain
server: Golfe2

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
552 B 210ms
44ms Ping
text/plain 2a00:1450:400c:c00::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-SVDG4GL741&cid=675397442.1732189000&gtm=45je4bk0v9121104881za200&aip=1&dma=1&dma_cps=syphamo&gcd=13l3l3l2l1l1&npa=1&frm=0&tag_exp=101925629~102067555~102067808~102077855~102081485
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-SVDG4GL741
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c00::9c Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:111:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:111:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://malware.news
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 21 Nov 2024 11:36:40 GMT
content-type: text/plain
server: Golfe2

GET
H3 200 ga-audiences
www.google.de/ads/ 42 B
63 B 168ms
59ms Image
image/gif 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-SVDG4GL741&cid=675397442.1732189000&gtm=45je4bk0v9121104881za200&aip=1&dma=1&dma_cps=syphamo&gcd=13l3l3l2l1l1&npa=1&frm=0&tag_exp=101925629~102067555~102067808~102077855~102081485&tag_exp=101925629~102067555~102067808~102077855~102081485&z=1191613812

Requested by

Host: malware.news
URL: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/

Response headers

cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Thu, 21 Nov 2024 11:36:40 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 a0086c91da850eb004fb4af82117ab347b9e272a_2_32x32.png
malware.news/uploads/default/optimized/3X/a/0/ 2 KB
2 KB 35ms
30ms Other
image/png 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/uploads/default/optimized/3X/a/0/a0086c91da850eb004fb4af82117ab347b9e272a_2_32x32.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c7afa12ce5701916349284e884f7fddcf56832f30d041982b6f9a484b64084f5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253

Response headers

cf-cache-status: HIT
age: 3259913
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cecqF4mF9aeJhmmpNfIQ3Hr8grrL6xiLtw34IE4bM0PZbJ3yCQ1iEh4nDyMP7H5cHGZytVYR0iSzhFE59byoGRjHTDJzVcGxgmNQrlrRb6p1HjvhaNnF%2FpbEwGX3wAbimtVNOKqFT3Bvpw%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: Sun, 09 Mar 2025 04:07:40 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=21523&sent=1566&recv=870&lost=0&retrans=327&sent_bytes=1992107&recv_bytes=7029&delivery_rate=11763193&cwnd=714&unsent_bytes=0&cid=5b9b7af518fe909b&ts=2031&x=0"
date: Thu, 21 Nov 2024 11:36:40 GMT
content-type: image/png
last-modified: Sat, 01 Jun 2019 22:43:41 GMT
vary: Accept-Encoding
cache-control: max-age=31536000
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8e60622649d8d398-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1851
server: cloudflare

POST
H2 200 poll
malware.news/message-bus/1eb9be55257d4e2eaad5153ef104a067/ 240 B
0 146ms
136ms XHR
text/plain 2606:4700:20::681a:769
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/message-bus/1eb9be55257d4e2eaad5153ef104a067/poll

Requested by

Host: malware.news
URL: https://malware.news/assets/chunk.dc7a33f0346e6027c1e5.d41d8cd9.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:769 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Discourse-Deferred-Track-View: true
X-CSRF-Token: undefined
Discourse-Deferred-Track-View-Topic-Id: 88253
Referer: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253
X-SILENCE-LOGGER: true
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Accept: text/plain, */*; q=0.01
Discourse-Present: true
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

access-control-max-age: 7200
content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Oa1lWiU3MMM2lRqzQVnTdHAGnAbJOmFnGChvgt5BoPReYzL8h0Wy5UHJC68XRLRLdybz%2BUAYfqLXgNLTQ0e7TnZxO80Vlb9q%2F3sbW8rDsfRchvY8sZ91sj%2BnCey7Vs0hclzTFAJ53Ns4uQ%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET, POST
x-content-type-options: nosniff
expires: 0
server-timing: cfL4;desc="?proto=TCP&rtt=21180&sent=1571&recv=875&lost=0&retrans=327&sent_bytes=1994537&recv_bytes=7594&delivery_rate=11763193&cwnd=718&unsent_bytes=0&cid=5b9b7af518fe909b&ts=2587&x=0"
date: Thu, 21 Nov 2024 11:36:41 GMT
content-type: text/plain; charset=utf-8
access-control-allow-headers: X-SILENCE-LOGGER, X-Shared-Session-Key, Dont-Chunk, Discourse-Present, Discourse-Deferred-Track-View
cache-control: must-revalidate, private, max-age=0
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 8e60622918ebd398-FRA
access-control-allow-origin: https://malware.news
server: cloudflare

Verdicts & Comments Add Verdict or Comment

29 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.malware.news/	1970-01-21 10:45:49	Name: _ga_SVDG4GL741 Value: GS1.1.1732189000.1.0.1732189000.60.0.1434389123
			.malware.news/	1970-01-21 10:45:49	Name: _ga Value: GA1.1.675397442.1732189000

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	URL: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253 Message: The Content Security Policy directive 'upgrade-insecure-requests' is ignored when delivered in a report-only policy.
recommendation	verbose	URL: https://malware.news/t/hello-again-fakebat-popular-loader-returns-after-months-long-hiatus/88253 Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests; base-uri 'self'; object-src 'none'; script-src 'nonce-gznnhnKGcLJeGMxuwG4sHY9NG' 'strict-dynamic'; frame-ancestors 'self'; manifest-src 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

malware.news
region1.analytics.google.com
stats.g.doubleclick.net
www.google.de
www.googletagmanager.com
www.malwarebytes.com
192.0.66.233
2001:4860:4802:34::36
2606:4700:20::681a:769
2a00:1450:4001:81c::2008
2a00:1450:4001:828::2003
2a00:1450:400c:c00::9c
041dc75fa9294876d29e6d78e76c9f7f3202f1763480da93d6ce2414d0a095c3
0525596819094f44d7abb830e075097897b46e67ed3314ee3676b54fc222263c
05cd38562b6bd50256ac866bfb550135934771b1afb1eb0127dcd8ed2fbdacf6
06ad5a74b33a607a983cb3cbdfc613bcd8737d506d88af2fa4f839cc250c2be4
072656be372e90afa4bdc01d17154e4296da5a750d0a0122deb432524b55905a
08e72912ddff29f7da96ec2d3b0e425a8e50efea87d8ec9db0d7abd64047e05f
0d6159259c7edbfddc1b4de1d432c34dea8cfb429af0f583ad2c3048ece27dcf
18509682c8a5b9385e58b9d3ed88d6b42a4ac83a0efec3b028fda569d81fcaa2
254c1df8945252e32e84cb5e6a27f1a4be608015da6523a2f546c8a3b411d6a8
257486394047ff3f40d8edea10ef11841c382a6052c31c97cd2a4f21a316c7d8
2e8184a4bb598f1bd378dad0b24dc19aaa26071c75e055ebf173f91e62658c6a
3210e81db34d0cf4dbf5ad179f4c0cbbe1a53f4d2b2f8d265087efa34e386210
48229befcefff057fe27509100acef005461f4af616cf844ffd4392e10db6236
4a94efe8536620015174b0b689f77cd8189ceaaac8f646c0c0223dd90d0c5789
508f34e4c906329b9d84609309e5e1f86c721c36d67f58edf00920eaab24843d
5d42ebdcddd972fdff22dca8398998a80ce50b0ec08915e8e8b9682a941b8651
5db83bcef43ac8fdafad6b53d7b080a2f4a00ccb306e5fa85793138e82d65244
61cebcc6c197dc2ab70050e4e318e731564461ffea6f676c101592e3b77e22a3
6ac36c965849ccf6567568611d6c7eb178a1b2b0325c90f570ca07e9fc9329b3
6f90b23ab8d8bbdca5b58f8c616b7779f50c1315575c80eacccbc30e8bb3c32e
85990a895de63771b176a8e0cab6f0de69191da07a1739c0d7e3dd48b9990adf
85e2838b0d4d24942d3503bf17700732c5c6dd749dd5a87dcc921f716bfa8e8d
8b0c5d2ee64cd5c2e2217803da9fe35ccbe85220e33fb35a2675d9aaca3d9103
99f42f91bffa8ca1606d62b70bb92f981d83921e78ccdbd3d9538f07007f27ac
9f921142b762fb91207051d0a28e571b9455bab74e7d0e03726024c286cff8d5
acb53c4533765bc5dc1225c4850964ddb2ed637a7a1cf420c446a08104085da8
b30502d9bd28251a1683c8d09ed164bc6650c5c67c4375e6a42adf95b3ee8110
b31913414ff7bbbf49f273a06ec4cd11e42d55cf0145a998e508b6cf59d93750
b6a39549af39cfd4edc125b6b3309e052f9360651652b65de6ae95adddddc8c3
be420de1cdbbc41691234abe548124043e201bc6b576570af28c0d960ad35a0c
c0ee9ad6230cb234431bf201d1138eb7fc125e72822b2ccd0f2e9aacfb8f709e
c138c32d8539bcf7541029bddec47bc83534b02a92893b90ecee469a1fccfbcc
c5731add591c9f35fc4899817ccf6b7ef5015b50c20cd3bb07801625cfedbe7e
c7afa12ce5701916349284e884f7fddcf56832f30d041982b6f9a484b64084f5
d4e1d8a7be66468bdd7dca8c2dfcda327e8d5af5a390482bc2942b8f45666142
da53e3c659e805a26124ef2113f088ef6dd66d36814c62a3ad3b6ad177ef8b75
da6a701d09603c2e1bf81930868aa84af4b9fb58607f1dc8b88dfeb8ed6127f2
e154af4adb3c483a3aba7f9a7229b8881cdc5cf369290923d965a2ad30163ae8
e16bb6b35c3614177667b6323a7258bebe6a29b7526ca990c257fa906b7e4911
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eea9a523d4db379cf8df984a1e29425971a0a887e69ebd5fffcf87b207dea982
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f3dfbf92751007bf7123860118ef29e50e4ed0b0c7bd6059f44c912e161640f2
f6a0e31af09bc94252ffd2005ded43e70ee5ea44cbc0d90b36967a66fdf76b72
f894e10b15e5045352c8ded91c7e3194eca94cefb94260d8a222cb6943831965
fb73247ea0b8cd13f9cc740f6c5d319ed7b77df2d73fb96f142a540e83fde0f9

malware.news Open in urlscan Pro 2606:4700:20::681a:769 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

47 Requests

100 %HTTPS

83 %IPv6

6 Domains

6 Subdomains

7 IPs

3 Countries

1813 kBTransfer

7132 kBSize

2 Cookies

11 Outgoing links

Redirected requests

47 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

malware.news Open in urlscan Pro
2606:4700:20::681a:769 Public Scan

Screenshot
Live screenshot

Full Image

47
Requests

100 %
HTTPS

83 %
IPv6

6
Domains

6
Subdomains

7
IPs

3
Countries

1813 kB
Transfer

7132 kB
Size

2
Cookies

47 HTTP transactions
2 data transactions