urlscan.io logo urlscan.io
SecurityTrails logo

blogs.blackberry.com Open in urlscan Pro
2600:9000:223d:b800:19:cd0a:2e00:93a1  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://campaigns-events.eu-central-1.onpdr.com/track/link/l9ynowj4dn/0cdvxvad1lbad11fhktnxv6tx/m3597e5deq
Effective URL: https://blogs.blackberry.com/en/2022/10/unattributed-romcom-threat-actor-spoofing-popular-apps-now-hits-ukrainian-militaries
Submission: On November 03 via api from PL — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 14 IPs in 3 countries across 14 domains to perform 50 HTTP transactions. The main IP is 2600:9000:223d:b800:19:cd0a:2e00:93a1, located in United States and belongs to AMAZON-02, US. The main domain is blogs.blackberry.com.
TLS certificate: Issued by DigiCert TLS RSA SHA256 2020 CA1 on July 21st 2022. Valid for: a year.
This is the only time blogs.blackberry.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

1    2606:4700:4400::ac40:9b49 (United States)

ASN13335 (CLOUDFLARENET, US)
campaigns-events.eu-central-1.onpdr.com
21    2600:9000:223d:b800:19:cd0a:2e00:93a1 (United States)

ASN16509 (AMAZON-02, US)
blogs.blackberry.com
7    2606:4700::6810:9540 (United States)

ASN13335 (CLOUDFLARENET, US)
cdn.cookielaw.org
3    2a02:26f0:480:284::1e80 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
assets.adobedtm.com
2    2a00:1450:4001:830::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
1    2606:4700::6812:1734 (United States)

ASN13335 (CLOUDFLARENET, US)
kit.fontawesome.com
1    2a00:1450:4001:800::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
1    2606:4700:4400::ac40:929e (United States)

ASN13335 (CLOUDFLARENET, US)
geolocation.onetrust.com
3    2606:4700:e6::ac40:ca1c (United States)

ASN13335 (CLOUDFLARENET, US)
ka-f.fontawesome.com
5    2a00:1450:4001:828::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
2    54.229.34.254 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-229-34-254.eu-west-1.compute.amazonaws.com
dpm.demdex.net
1    2a00:1450:4001:82b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
googleads.g.doubleclick.net
1    2a00:1450:4001:828::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
1    2a00:1450:4001:829::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.de
1    54.229.2.193 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-229-2-193.eu-west-1.compute.amazonaws.com
blackberry.demdex.net
1    34.248.32.199 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-248-32-199.eu-west-1.compute.amazonaws.com
cm.everesttech.net
Apex Domain
Subdomains		 Transfer
21 blackberry.com
blogs.blackberry.com
2 MB
7 cookielaw.org
cdn.cookielaw.org — Cisco Umbrella Rank: 635
128 KB
5 gstatic.com
fonts.gstatic.com
66 KB
4 fontawesome.com
kit.fontawesome.com — Cisco Umbrella Rank: 3084
ka-f.fontawesome.com — Cisco Umbrella Rank: 5936
23 KB
3 demdex.net
dpm.demdex.net — Cisco Umbrella Rank: 285
blackberry.demdex.net
5 KB
3 adobedtm.com
assets.adobedtm.com — Cisco Umbrella Rank: 467
145 KB
2 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 121
158 KB
1 everesttech.net
cm.everesttech.net — Cisco Umbrella Rank: 1487
517 B
1 google.de
www.google.de — Cisco Umbrella Rank: 3590
548 B
1 google.com
www.google.com — Cisco Umbrella Rank: 17
548 B
1 doubleclick.net
googleads.g.doubleclick.net — Cisco Umbrella Rank: 66
2 KB
1 onetrust.com
geolocation.onetrust.com — Cisco Umbrella Rank: 1038
295 B
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 118
1 KB
1 onpdr.com
campaigns-events.eu-central-1.onpdr.com
706 B
50 14
Domain Requested by
21 blogs.blackberry.com blogs.blackberry.com
7 cdn.cookielaw.org blogs.blackberry.com
cdn.cookielaw.org
5 fonts.gstatic.com fonts.googleapis.com
3 ka-f.fontawesome.com kit.fontawesome.com
3 assets.adobedtm.com blogs.blackberry.com
assets.adobedtm.com
2 dpm.demdex.net assets.adobedtm.com
blogs.blackberry.com
2 www.googletagmanager.com blogs.blackberry.com
1 cm.everesttech.net 1 redirects
1 blackberry.demdex.net assets.adobedtm.com
1 www.google.de blogs.blackberry.com
1 www.google.com blogs.blackberry.com
1 googleads.g.doubleclick.net www.googletagmanager.com
1 geolocation.onetrust.com cdn.cookielaw.org
1 fonts.googleapis.com blogs.blackberry.com
1 kit.fontawesome.com blogs.blackberry.com
1 campaigns-events.eu-central-1.onpdr.com 1 redirects
50 16
Subject Issuer Validity Valid
*.blackberry.com
DigiCert TLS RSA SHA256 2020 CA1		 2022-07-21 -
2023-08-21		 a year crt.sh
cookielaw.org
Cloudflare Inc ECC CA-3		 2022-05-01 -
2023-05-01		 a year crt.sh
assets.adobedtm.com
DigiCert TLS RSA SHA256 2020 CA1		 2022-07-19 -
2023-08-19		 a year crt.sh
*.google-analytics.com
GTS CA 1C3		 2022-10-17 -
2023-01-09		 3 months crt.sh
*.fontawesome.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-12-01 -
2023-01-01		 a year crt.sh
upload.video.google.com
GTS CA 1C3		 2022-10-17 -
2023-01-09		 3 months crt.sh
onetrust.com
Cloudflare Inc ECC CA-3		 2022-01-12 -
2023-01-12		 a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2022-08-12 -
2023-08-12		 a year crt.sh
*.gstatic.com
GTS CA 1C3		 2022-09-26 -
2022-12-19		 3 months crt.sh
*.demdex.com
DigiCert TLS RSA SHA256 2020 CA1		 2022-09-26 -
2023-10-27		 a year crt.sh
*.g.doubleclick.net
GTS CA 1C3		 2022-09-26 -
2022-12-19		 3 months crt.sh
www.google.com
GTS CA 1C3		 2022-09-26 -
2022-12-19		 3 months crt.sh
www.google.de
GTS CA 1C3		 2022-09-26 -
2022-12-19		 3 months crt.sh

This page contains 2 frames:

Primary Page: https://blogs.blackberry.com/en/2022/10/unattributed-romcom-threat-actor-spoofing-popular-apps-now-hits-ukrainian-militaries
Frame ID: 6F6F159B0C51552E5ADFEFD7A96E7493
Requests: 49 HTTP requests in this frame

Frame: https://blackberry.demdex.net/dest5.html?d_nsid=0
Frame ID: DE704CF84EC7CBF30B5A793A5F067947
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Unattributed RomCom Threat Actor Spoofing Popular Apps Now Hits Ukrainian MilitariesBlackBerry Logo

Page URL History Show full URLs

  1. https://campaigns-events.eu-central-1.onpdr.com/track/link/l9ynowj4dn/0cdvxvad1lbad11fhktnxv6tx/m3597e5deq HTTP 302
    https://blogs.blackberry.com/en/2022/10/unattributed-romcom-threat-actor-spoofing-popular-apps-now-hits-u... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • /etc\.clientlibs/
Overall confidence: 100%
Detected patterns
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
  • kit\.fontawesome\.com/([0-9a-z]+).js
Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/ns\.html[^>]+></iframe>
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js
Overall confidence: 100%
Detected patterns
  • cdn\.cookielaw\.org
  • otSDKStub\.js
Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

50
Requests

98 %
HTTPS

81 %
IPv6

14
Domains

16
Subdomains

14
IPs

3
Countries

2573 kB
Transfer

4268 kB
Size

9
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://campaigns-events.eu-central-1.onpdr.com/track/link/l9ynowj4dn/0cdvxvad1lbad11fhktnxv6tx/m3597e5deq HTTP 302
    https://blogs.blackberry.com/en/2022/10/unattributed-romcom-threat-actor-spoofing-popular-apps-now-hits-ukrainian-militaries Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 48
  • https://cm.everesttech.net/cm/dd?d_uuid=07968580236520529533158094012952807342 HTTP 302
  • https://dpm.demdex.net/ibs:dpid=411&dpuuid=Y2OGzgAAADpmbgN-

50 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request unattributed-romcom-threat-actor-spoofing-popular-apps-now-hits-ukrainian-militaries
blogs.blackberry.com/en/2022/10/
Redirect Chain
  • https://campaigns-events.eu-central-1.onpdr.com/track/link/l9ynowj4dn/0cdvxvad1lbad11fhktnxv6tx/m3597e5deq
  • https://blogs.blackberry.com/en/2022/10/unattributed-romcom-threat-actor-spoofing-popular-apps-now-hits-ukrainian-militaries
88 KB
20 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://blogs.blackberry.com/en/2022/10/unattributed-romcom-threat-actor-spoofing-popular-apps-now-hits-ukrainian-militaries
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223d:b800:19:cd0a:2e00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
2590f1a7c078e8fc862aa7c1dc5fe94735b26539521061aa3ff3215d35a72575
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
Strict-Transport-Security max-age=63072000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
age
7911
cache-control
no-cache="set-cookie"
content-encoding
gzip
content-length
20312
content-security-policy
frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
content-type
text/html;charset=utf-8
date
Thu, 03 Nov 2022 07:04:07 GMT
etag
"15fd8-5ec82b3260574-gzip"
last-modified
Wed, 02 Nov 2022 20:29:39 GMT
server
Apache
strict-transport-security
max-age=63072000; includeSubdomains;
vary
Accept-Encoding
via
1.1 e94c77a12a65a84cbcef7856ed7e0fb8.cloudfront.net (CloudFront)
x-amz-cf-id
e2-eClkOxbDS6CDGvlWMuwCqiXcvbz8N3lYDkVPdWZGnnjMb74oj-A==
x-amz-cf-pop
FRA56-P3
x-cache
Hit from cloudfront
x-content-type-options
nosniff
x-dispatcher
dispatcher2uswest2
x-frame-options
SAMEORIGIN
x-vhost
publish
x-xss-protection
1; mode=block

Redirect headers

access-control-expose-headers
X-RateLimit-Remaining, X-RateLimit-Limit, X-RateLimit-Reset
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
badi
Routing: eu-central-1=>eu-central-1; Version: d434; Host: bari;
cache-control
no-cache
cf-cache-status
DYNAMIC
cf-ray
76440228a8045c0e-FRA
content-length
4
content-type
application/json; charset=utf-8
date
Thu, 03 Nov 2022 09:15:58 GMT
location
https://blogs.blackberry.com/en/2022/10/unattributed-romcom-threat-actor-spoofing-popular-apps-now-hits-ukrainian-militaries
server
cloudflare
strict-transport-security
max-age=31536000; includeSubDomains
vary
Accept-Encoding
x-content-type-options
nosniff
x-correlation-id
a23bcbfa-c824-44c4-a905-501ee23c3759
x-xss-protection
1; mode=block
otSDKStub.js
cdn.cookielaw.org/scripttemplates/ 		21 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2022/10/unattributed-romcom-threat-actor-spoofing-popular-apps-now-hits-ukrainian-militaries
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
bbc4456bca95006683a8f081d0d2ed645eef5b14c62eca12c70f7e1cec26c1a0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 03 Nov 2022 09:15:58 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
e0VkrpV+7zqDAjQ/RMXPsw==
age
8261
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
7151
x-ms-lease-status
unlocked
last-modified
Wed, 02 Nov 2022 06:39:34 GMT
server
cloudflare
etag
0x8DABC9D01A61A76
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
0c76a26d-d01e-0136-188e-ee33e1000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=14400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
7644022a5b6b9249-FRA
clientlib-site.min.212090aa91e144ce76b952f074e6c1ba.css
blogs.blackberry.com/etc.clientlibs/blogs-bbcom/clientlibs/ 		209 KB
32 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://blogs.blackberry.com/etc.clientlibs/blogs-bbcom/clientlibs/clientlib-site.min.212090aa91e144ce76b952f074e6c1ba.css
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2022/10/unattributed-romcom-threat-actor-spoofing-popular-apps-now-hits-ukrainian-militaries
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223d:b800:19:cd0a:2e00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
67aebc966ccdb62424299f5f290a1283b3e66a03c32be8dc73716384c970ebfe
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
Strict-Transport-Security max-age=63072000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/en/2022/10/unattributed-romcom-threat-actor-spoofing-popular-apps-now-hits-ukrainian-militaries
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

x-dispatcher
dispatcher3uswest2
content-security-policy
frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
content-encoding
gzip
x-content-type-options
nosniff
date
Wed, 02 Nov 2022 22:50:36 GMT
via
1.1 e94c77a12a65a84cbcef7856ed7e0fb8.cloudfront.net (CloudFront)
strict-transport-security
max-age=63072000; includeSubdomains;
x-amz-cf-pop
FRA56-P3
age
37522
x-vhost
publish
x-cache
Hit from cloudfront
content-length
32351
x-xss-protection
1; mode=block
last-modified
Wed, 13 Jul 2022 18:05:33 GMT
server
Apache
etag
"34579-5e3b3a1937540-gzip"
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
text/css;charset=utf-8
cache-control
no-cache="set-cookie"
accept-ranges
bytes
x-amz-cf-id
wkzcoYP-UhZVTN-rxzX6NXoiYanVVf6Ge3J6G2_US-ErnsuQbS9zxQ==
launch-17c42c38011b.min.js
assets.adobedtm.com/cb3160b9e813/dd47d4a7a48e/ 		533 KB
131 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/cb3160b9e813/dd47d4a7a48e/launch-17c42c38011b.min.js
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2022/10/unattributed-romcom-threat-actor-spoofing-popular-apps-now-hits-ukrainian-militaries
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:480:284::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
c116899f723b0f59bca95bad86e524c295ab397cc921c022d73984d23cc359da

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Thu, 03 Nov 2022 09:15:58 GMT
content-encoding
gzip
last-modified
Fri, 21 Oct 2022 20:37:59 GMT
server
AkamaiNetStorage
etag
"5d0e67310fc010c27ae9c2f4e97c2710:1666384679.268878"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://blogs.blackberry.com
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
133908
expires
Thu, 03 Nov 2022 10:15:58 GMT
js
www.googletagmanager.com/gtag/ 		134 KB
52 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-944900006
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2022/10/unattributed-romcom-threat-actor-spoofing-popular-apps-now-hits-ukrainian-militaries
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
bb5aad79832651898f6b5be3ad48622421089b5ee5517d8323ddb5933c6a0b72
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Thu, 03 Nov 2022 09:15:58 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
52841
x-xss-protection
0
last-modified
Thu, 03 Nov 2022 09:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Thu, 03 Nov 2022 09:15:58 GMT
3c243f8233.js
kit.fontawesome.com/ 		11 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://kit.fontawesome.com/3c243f8233.js
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2022/10/unattributed-romcom-threat-actor-spoofing-popular-apps-now-hits-ukrainian-militaries
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1734 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
22b22ab6217c7b299e896ac9bd55044fd72c25cf99410b1a724bf4eba90cb8e5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload

Request headers

Referer
https://blogs.blackberry.com/
Origin
https://blogs.blackberry.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Thu, 03 Nov 2022 09:15:58 GMT
strict-transport-security
max-age=31536000; preload
content-encoding
gzip
cf-cache-status
REVALIDATED
server
cloudflare
access-control-max-age
3000
access-control-allow-methods
GET, OPTIONS
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=60, public, must-revalidate
vary
origin, accept-encoding, access-control-request-headers, access-control-request-method
cf-ray
7644022a7d4b9223-FRA
access-control-allow-headers
accept, accept-langauge, content-language, content-type, fa-kit-token
x-request-id
FyKabsi_1w__QlRs87qh
romcom-875x530px-hdr.png
blogs.blackberry.com/content/dam/blogs-blackberry-com/images/blogs/2022/10/ 		228 KB
229 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blogs.blackberry.com/content/dam/blogs-blackberry-com/images/blogs/2022/10/romcom-875x530px-hdr.png
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2022/10/unattributed-romcom-threat-actor-spoofing-popular-apps-now-hits-ukrainian-militaries
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223d:b800:19:cd0a:2e00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
e2c59b82de2701048abd96f86cab62ece113a916ae712f0f8b57a9dc8a961147
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
Strict-Transport-Security max-age=63072000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/en/2022/10/unattributed-romcom-threat-actor-spoofing-popular-apps-now-hits-ukrainian-militaries
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

x-dispatcher
dispatcher4uswest2
content-security-policy
frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
date
Thu, 03 Nov 2022 07:04:08 GMT
x-content-type-options
nosniff
strict-transport-security
max-age=63072000; includeSubdomains;
via
1.1 e94c77a12a65a84cbcef7856ed7e0fb8.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P3
age
7910
x-vhost
publish
x-cache
Hit from cloudfront
content-disposition
attachment
content-length
233190
x-xss-protection
1; mode=block
last-modified
Sun, 23 Oct 2022 15:03:23 GMT
server
Apache
etag
"38ee6-5ebb4f9e924c0"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
no-cache="set-cookie"
accept-ranges
bytes
x-amz-cf-id
HbTJ82OfDnXC8XHPu7NyZUZYFCjYz-VxcuD2_u6_akGKjn5dnnY0uw==
romcom-fig-1.png
blogs.blackberry.com/content/dam/blogs-blackberry-com/images/blogs/2022/10/ 		308 KB
308 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blogs.blackberry.com/content/dam/blogs-blackberry-com/images/blogs/2022/10/romcom-fig-1.png
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2022/10/unattributed-romcom-threat-actor-spoofing-popular-apps-now-hits-ukrainian-militaries
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223d:b800:19:cd0a:2e00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
05805384113ee0e786510aae5c462addd4a056e88932c47c49865753596a4ae3
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
Strict-Transport-Security max-age=63072000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/en/2022/10/unattributed-romcom-threat-actor-spoofing-popular-apps-now-hits-ukrainian-militaries
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

x-dispatcher
dispatcher3uswest2
content-security-policy
frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
date
Thu, 03 Nov 2022 07:04:08 GMT
x-content-type-options
nosniff
strict-transport-security
max-age=63072000; includeSubdomains;
via
1.1 e94c77a12a65a84cbcef7856ed7e0fb8.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P3
age
7910
x-vhost
publish
x-cache
Hit from cloudfront
content-disposition
attachment
content-length
314887
x-xss-protection
1; mode=block
last-modified
Sun, 23 Oct 2022 15:14:32 GMT
server
Apache
etag
"4ce07-5ebb521c94600"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
no-cache="set-cookie"
accept-ranges
bytes
x-amz-cf-id
eim4j2Sdn4kbu5fw5U4tco7psaYWmtyeTa9_2XD-WralizAZdv_zlg==
romcom-fig-2.png
blogs.blackberry.com/content/dam/blogs-blackberry-com/images/blogs/2022/10/ 		375 KB
376 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blogs.blackberry.com/content/dam/blogs-blackberry-com/images/blogs/2022/10/romcom-fig-2.png
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2022/10/unattributed-romcom-threat-actor-spoofing-popular-apps-now-hits-ukrainian-militaries
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223d:b800:19:cd0a:2e00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
11aead2770c9e8c64c1f3b095000cefa5909af279504cd102a58d27de0468b3f
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
Strict-Transport-Security max-age=63072000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/en/2022/10/unattributed-romcom-threat-actor-spoofing-popular-apps-now-hits-ukrainian-militaries
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

x-dispatcher
dispatcher1uswest2
content-security-policy
frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
date
Thu, 03 Nov 2022 07:04:08 GMT
x-content-type-options
nosniff
strict-transport-security
max-age=63072000; includeSubdomains;
via
1.1 e94c77a12a65a84cbcef7856ed7e0fb8.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P3
age
7910
x-vhost
publish
x-cache
Hit from cloudfront
content-disposition
attachment
content-length
383704
x-xss-protection
1; mode=block
last-modified
Sun, 23 Oct 2022 15:14:43 GMT
server
Apache
etag
"5dad8-5ebb522711ec0"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
no-cache="set-cookie"
accept-ranges
bytes
x-amz-cf-id
CTLZrDZX6xI5nukhzFdaWJ7tBbQcTMp4mk0o8j5zoUHx9t4vymcTTQ==
romcom-fig-3.png
blogs.blackberry.com/content/dam/blogs-blackberry-com/images/blogs/2022/10/ 		156 KB
157 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blogs.blackberry.com/content/dam/blogs-blackberry-com/images/blogs/2022/10/romcom-fig-3.png
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2022/10/unattributed-romcom-threat-actor-spoofing-popular-apps-now-hits-ukrainian-militaries
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223d:b800:19:cd0a:2e00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
c368fc59b92f1873480969e6a7f9b721be998c3733d6d7d44c6f2fe892aeb358
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
Strict-Transport-Security max-age=63072000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/en/2022/10/unattributed-romcom-threat-actor-spoofing-popular-apps-now-hits-ukrainian-militaries
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

x-dispatcher
dispatcher4uswest2
content-security-policy
frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
date
Thu, 03 Nov 2022 07:04:08 GMT
x-content-type-options
nosniff
strict-transport-security
max-age=63072000; includeSubdomains;
via
1.1 e94c77a12a65a84cbcef7856ed7e0fb8.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P3
age
7910
x-vhost
publish
x-cache
Hit from cloudfront
content-disposition
attachment
content-length
159594
x-xss-protection
1; mode=block
last-modified
Sun, 23 Oct 2022 15:14:45 GMT
server
Apache
etag
"26f6a-5ebb5228fa340"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
no-cache="set-cookie"
accept-ranges
bytes
x-amz-cf-id
eOws5Yrmf1LR4Xm6aA2txy8PeWJae08vqNDuhpLjWmFO5lnu-iWBHg==
romcom-fig-4.png
blogs.blackberry.com/content/dam/blogs-blackberry-com/images/blogs/2022/10/ 		42 KB
43 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blogs.blackberry.com/content/dam/blogs-blackberry-com/images/blogs/2022/10/romcom-fig-4.png
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2022/10/unattributed-romcom-threat-actor-spoofing-popular-apps-now-hits-ukrainian-militaries
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223d:b800:19:cd0a:2e00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
a4024dcdcbaad04c447e3e3b8a6ca7f3fd0f6ed78c87cf0a982d7286a49989c2
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
Strict-Transport-Security max-age=63072000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/en/2022/10/unattributed-romcom-threat-actor-spoofing-popular-apps-now-hits-ukrainian-militaries
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

x-dispatcher
dispatcher1uswest2
content-security-policy
frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
date
Thu, 03 Nov 2022 07:04:08 GMT
x-content-type-options
nosniff
strict-transport-security
max-age=63072000; includeSubdomains;
via
1.1 e94c77a12a65a84cbcef7856ed7e0fb8.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P3
age
7910
x-vhost
publish
x-cache
Hit from cloudfront
content-disposition
attachment
content-length
43098
x-xss-protection
1; mode=block
last-modified
Sun, 23 Oct 2022 15:14:46 GMT
server
Apache
etag
"a85a-5ebb5229ee580"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
no-cache="set-cookie"
accept-ranges
bytes
x-amz-cf-id
4_B8Dxlh9tou6EyHALJ1p8UUyQYyQ0dYCjIOxPfWXd4jHP9iAtaEsg==
romcom-fig-5.png
blogs.blackberry.com/content/dam/blogs-blackberry-com/images/blogs/2022/10/ 		88 KB
89 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blogs.blackberry.com/content/dam/blogs-blackberry-com/images/blogs/2022/10/romcom-fig-5.png
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2022/10/unattributed-romcom-threat-actor-spoofing-popular-apps-now-hits-ukrainian-militaries
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223d:b800:19:cd0a:2e00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
f8258923f42ffb2c5ffaa58b0dc3f0d0fb0a146f2718d434d362fcfb2fe8cbc1
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
Strict-Transport-Security max-age=63072000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/en/2022/10/unattributed-romcom-threat-actor-spoofing-popular-apps-now-hits-ukrainian-militaries
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

x-dispatcher
dispatcher2uswest2
content-security-policy
frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
date
Thu, 03 Nov 2022 07:04:08 GMT
x-content-type-options
nosniff
strict-transport-security
max-age=63072000; includeSubdomains;
via
1.1 e94c77a12a65a84cbcef7856ed7e0fb8.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P3
age
7910
x-vhost
publish
x-cache
Hit from cloudfront
content-disposition
attachment
content-length
90403
x-xss-protection
1; mode=block
last-modified
Sun, 23 Oct 2022 15:14:49 GMT
server
Apache
etag
"16123-5ebb522ccac40"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
no-cache="set-cookie"
accept-ranges
bytes
x-amz-cf-id
jV342zuHlEiCiYcetDT9Dx5Bw1V7FJOePG14d6DNiV-NTUX7ShZuKg==
romcom-fig-6.png
blogs.blackberry.com/content/dam/blogs-blackberry-com/images/blogs/2022/10/ 		82 KB
82 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blogs.blackberry.com/content/dam/blogs-blackberry-com/images/blogs/2022/10/romcom-fig-6.png
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2022/10/unattributed-romcom-threat-actor-spoofing-popular-apps-now-hits-ukrainian-militaries
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223d:b800:19:cd0a:2e00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
090bf13e9ded9a3b802a1a8b639d5edc8121e76586d043c36c1294aa95a32caf
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
Strict-Transport-Security max-age=63072000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/en/2022/10/unattributed-romcom-threat-actor-spoofing-popular-apps-now-hits-ukrainian-militaries
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

x-dispatcher
dispatcher4uswest2
content-security-policy
frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
date
Thu, 03 Nov 2022 07:04:08 GMT
x-content-type-options
nosniff
strict-transport-security
max-age=63072000; includeSubdomains;
via
1.1 e94c77a12a65a84cbcef7856ed7e0fb8.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P3
age
7910
x-vhost
publish
x-cache
Hit from cloudfront
content-disposition
attachment
content-length
83575
x-xss-protection
1; mode=block
last-modified
Sun, 23 Oct 2022 15:14:51 GMT
server
Apache
etag
"14677-5ebb522eb30c0"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
no-cache="set-cookie"
accept-ranges
bytes
x-amz-cf-id
iQJg7NYnJYCf8Ck9_MO6o8FIEiFyp_ltvHX6GEVAqgrxsTzC3yE0Fg==
romcom-fig-7.png
blogs.blackberry.com/content/dam/blogs-blackberry-com/images/blogs/2022/10/ 		23 KB
23 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blogs.blackberry.com/content/dam/blogs-blackberry-com/images/blogs/2022/10/romcom-fig-7.png
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2022/10/unattributed-romcom-threat-actor-spoofing-popular-apps-now-hits-ukrainian-militaries
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223d:b800:19:cd0a:2e00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
d7344bc8b16c47fa2bf3d9c213251e77b141e94c9bf93effeebeb30df89070cf
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
Strict-Transport-Security max-age=63072000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/en/2022/10/unattributed-romcom-threat-actor-spoofing-popular-apps-now-hits-ukrainian-militaries
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

x-dispatcher
dispatcher3uswest2
content-security-policy
frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
date
Thu, 03 Nov 2022 07:04:08 GMT
x-content-type-options
nosniff
strict-transport-security
max-age=63072000; includeSubdomains;
via
1.1 e94c77a12a65a84cbcef7856ed7e0fb8.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P3
age
7910
x-vhost
publish
x-cache
Hit from cloudfront
content-disposition
attachment
content-length
23110
x-xss-protection
1; mode=block
last-modified
Sun, 23 Oct 2022 15:14:52 GMT
server
Apache
etag
"5a46-5ebb522fa7300"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
no-cache="set-cookie"
accept-ranges
bytes
x-amz-cf-id
xOZWkdqSkBJ4-WfavoFNxkfhW4DOAr3pVKWceSDzZobNpSH_c1OYbA==
romcom-fig-8.png
blogs.blackberry.com/content/dam/blogs-blackberry-com/images/blogs/2022/10/ 		26 KB
26 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blogs.blackberry.com/content/dam/blogs-blackberry-com/images/blogs/2022/10/romcom-fig-8.png
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2022/10/unattributed-romcom-threat-actor-spoofing-popular-apps-now-hits-ukrainian-militaries
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223d:b800:19:cd0a:2e00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
52521a8e8198d5759eeb9412feae38293f052218d6553f1446de0f307e51ce63
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
Strict-Transport-Security max-age=63072000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/en/2022/10/unattributed-romcom-threat-actor-spoofing-popular-apps-now-hits-ukrainian-militaries
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

x-dispatcher
dispatcher4uswest2
content-security-policy
frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
date
Thu, 03 Nov 2022 07:04:08 GMT
x-content-type-options
nosniff
strict-transport-security
max-age=63072000; includeSubdomains;
via
1.1 e94c77a12a65a84cbcef7856ed7e0fb8.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P3
age
7910
x-vhost
publish
x-cache
Hit from cloudfront
content-disposition
attachment
content-length
26510
x-xss-protection
1; mode=block
last-modified
Sun, 23 Oct 2022 15:14:53 GMT
server
Apache
etag
"678e-5ebb52309b540"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
no-cache="set-cookie"
accept-ranges
bytes
x-amz-cf-id
4wf5nUfo675OKfELtZgFJAzhHOoFX8c0a0pjhxlixmqoPhaUlax7Gw==
romcom-fig-9.png
blogs.blackberry.com/content/dam/blogs-blackberry-com/images/blogs/2022/10/ 		95 KB
95 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blogs.blackberry.com/content/dam/blogs-blackberry-com/images/blogs/2022/10/romcom-fig-9.png
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2022/10/unattributed-romcom-threat-actor-spoofing-popular-apps-now-hits-ukrainian-militaries
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223d:b800:19:cd0a:2e00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
8152499f992d91f05b105ba7da1a4972498bc4c7416e81c7223c4659360413dc
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
Strict-Transport-Security max-age=63072000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/en/2022/10/unattributed-romcom-threat-actor-spoofing-popular-apps-now-hits-ukrainian-militaries
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

x-dispatcher
dispatcher2uswest2
content-security-policy
frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
date
Thu, 03 Nov 2022 07:04:08 GMT
x-content-type-options
nosniff
strict-transport-security
max-age=63072000; includeSubdomains;
via
1.1 e94c77a12a65a84cbcef7856ed7e0fb8.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P3
age
7910
x-vhost
publish
x-cache
Hit from cloudfront
content-disposition
attachment
content-length
96956
x-xss-protection
1; mode=block
last-modified
Sun, 23 Oct 2022 15:14:55 GMT
server
Apache
etag
"17abc-5ebb5232839c0"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
no-cache="set-cookie"
accept-ranges
bytes
x-amz-cf-id
q8uIel2uHj3ZlkAytRYR68nppjVYK9k0WJKwHfBQuq-o63kH3EwtIQ==
romcom-fig-10.png
blogs.blackberry.com/content/dam/blogs-blackberry-com/images/blogs/2022/10/ 		39 KB
40 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blogs.blackberry.com/content/dam/blogs-blackberry-com/images/blogs/2022/10/romcom-fig-10.png
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2022/10/unattributed-romcom-threat-actor-spoofing-popular-apps-now-hits-ukrainian-militaries
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223d:b800:19:cd0a:2e00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
6216ca852224925d356e88c28b21fb2052445c478b8efdde73e3e3616a426f89
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
Strict-Transport-Security max-age=63072000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/en/2022/10/unattributed-romcom-threat-actor-spoofing-popular-apps-now-hits-ukrainian-militaries
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

x-dispatcher
dispatcher2uswest2
content-security-policy
frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
date
Thu, 03 Nov 2022 07:04:08 GMT
x-content-type-options
nosniff
strict-transport-security
max-age=63072000; includeSubdomains;
via
1.1 e94c77a12a65a84cbcef7856ed7e0fb8.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P3
age
7910
x-vhost
publish
x-cache
Hit from cloudfront
content-disposition
attachment
content-length
39960
x-xss-protection
1; mode=block
last-modified
Sun, 23 Oct 2022 15:14:56 GMT
server
Apache
etag
"9c18-5ebb523377c00"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
no-cache="set-cookie"
accept-ranges
bytes
x-amz-cf-id
ZFQLevsXMlmI1NW_yxT0TTMv75nnWsNWEWdS6ZBW_CXudCX7DWdZ3w==
romcom-fig-11.png
blogs.blackberry.com/content/dam/blogs-blackberry-com/images/blogs/2022/10/ 		221 KB
222 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blogs.blackberry.com/content/dam/blogs-blackberry-com/images/blogs/2022/10/romcom-fig-11.png
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2022/10/unattributed-romcom-threat-actor-spoofing-popular-apps-now-hits-ukrainian-militaries
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223d:b800:19:cd0a:2e00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
04e2a5545fca5d8d2782d018a57c5bfa481bdeb973492390b18b6ea587f985a5
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
Strict-Transport-Security max-age=63072000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/en/2022/10/unattributed-romcom-threat-actor-spoofing-popular-apps-now-hits-ukrainian-militaries
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

x-dispatcher
dispatcher1uswest2
content-security-policy
frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
date
Thu, 03 Nov 2022 07:04:08 GMT
x-content-type-options
nosniff
strict-transport-security
max-age=63072000; includeSubdomains;
via
1.1 e94c77a12a65a84cbcef7856ed7e0fb8.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P3
age
7910
x-vhost
publish
x-cache
Hit from cloudfront
content-disposition
attachment
content-length
226589
x-xss-protection
1; mode=block
last-modified
Sun, 23 Oct 2022 15:14:59 GMT
server
Apache
etag
"3751d-5ebb5236542c0"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
no-cache="set-cookie"
accept-ranges
bytes
x-amz-cf-id
rGl3ERDqVCEqcZqwDjo9FOHPFNEU6QIHpJt9k15TslDHiPUUwb7VTA==
cobalt-strike-beacon-1200px-banner.jpg
blogs.blackberry.com/content/dam/blogs-blackberry-com/images/blogs/2021/10/ 		184 KB
185 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blogs.blackberry.com/content/dam/blogs-blackberry-com/images/blogs/2021/10/cobalt-strike-beacon-1200px-banner.jpg
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2022/10/unattributed-romcom-threat-actor-spoofing-popular-apps-now-hits-ukrainian-militaries
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223d:b800:19:cd0a:2e00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
f30733e0e39f5044034df46d3d8c20feaa22cf680bc21398b2359f3555ff5364
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
Strict-Transport-Security max-age=63072000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/en/2022/10/unattributed-romcom-threat-actor-spoofing-popular-apps-now-hits-ukrainian-militaries
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

x-dispatcher
dispatcher2uswest2
content-security-policy
frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
date
Wed, 02 Nov 2022 22:50:37 GMT
x-content-type-options
nosniff
strict-transport-security
max-age=63072000; includeSubdomains;
via
1.1 e94c77a12a65a84cbcef7856ed7e0fb8.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P3
age
37521
x-vhost
publish
x-cache
Hit from cloudfront
content-disposition
attachment
content-length
188464
x-xss-protection
1; mode=block
last-modified
Thu, 14 Oct 2021 03:01:17 GMT
server
Apache
etag
"2e030-5ce474ad49940"
x-frame-options
SAMEORIGIN
content-type
image/jpeg
cache-control
no-cache="set-cookie"
accept-ranges
bytes
x-amz-cf-id
fydQ0oPuIZ3clQHSKpKWgo2IYUB1ACHFD9swsk4hajlkU-RQwYpvZg==
blackberry-logo-square.jpg
blogs.blackberry.com/content/dam/blogs-blackberry-com/images/authors/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blogs.blackberry.com/content/dam/blogs-blackberry-com/images/authors/blackberry-logo-square.jpg
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2022/10/unattributed-romcom-threat-actor-spoofing-popular-apps-now-hits-ukrainian-militaries
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223d:b800:19:cd0a:2e00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
7b5dbd37fcc639258ef21f839e379c044a86f7ca588cda61532446bc021f6e04
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
Strict-Transport-Security max-age=63072000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/en/2022/10/unattributed-romcom-threat-actor-spoofing-popular-apps-now-hits-ukrainian-militaries
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

x-dispatcher
dispatcher1uswest2
content-security-policy
frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
date
Wed, 02 Nov 2022 22:50:37 GMT
x-content-type-options
nosniff
strict-transport-security
max-age=63072000; includeSubdomains;
via
1.1 e94c77a12a65a84cbcef7856ed7e0fb8.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P3
age
37521
x-vhost
publish
x-cache
Hit from cloudfront
content-disposition
attachment
content-length
2701
x-xss-protection
1; mode=block
last-modified
Wed, 08 Jul 2020 17:55:25 GMT
server
Apache
etag
"a8d-5a9f1cff97d40"
x-frame-options
SAMEORIGIN
content-type
image/jpeg
cache-control
no-cache="set-cookie"
accept-ranges
bytes
x-amz-cf-id
zzNg4yh7adsWC6yzuGzSzyMab7j81rrZCh8FaRwZY_S-Ju3sVu1XYA==
jquery.min.4db6e885829bd8fc24f238a73222cb0e.js
blogs.blackberry.com/etc.clientlibs/shared/clientlibs/ 		86 KB
31 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blogs.blackberry.com/etc.clientlibs/shared/clientlibs/jquery.min.4db6e885829bd8fc24f238a73222cb0e.js
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2022/10/unattributed-romcom-threat-actor-spoofing-popular-apps-now-hits-ukrainian-militaries
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223d:b800:19:cd0a:2e00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
0afeb0c59cda1372d24a059afe9de618c353070363a486cb04bdf8d4cad55d80
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
Strict-Transport-Security max-age=63072000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/en/2022/10/unattributed-romcom-threat-actor-spoofing-popular-apps-now-hits-ukrainian-militaries
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

x-dispatcher
dispatcher1uswest2
content-security-policy
frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
content-encoding
gzip
x-content-type-options
nosniff
date
Wed, 02 Nov 2022 22:50:36 GMT
via
1.1 e94c77a12a65a84cbcef7856ed7e0fb8.cloudfront.net (CloudFront)
strict-transport-security
max-age=63072000; includeSubdomains;
x-amz-cf-pop
FRA56-P3
age
37522
x-vhost
publish
x-cache
Hit from cloudfront
content-length
31577
x-xss-protection
1; mode=block
last-modified
Wed, 19 Aug 2020 17:23:14 GMT
server
Apache
etag
"15950-5ad3e42368480-gzip"
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
application/javascript;charset=utf-8
cache-control
no-cache="set-cookie"
accept-ranges
bytes
x-amz-cf-id
1p7OXNxE5Yk39RhbnnjLP1h4HX7ucM6UXWSxSjykU2bwxpLvRnd49A==
clientlib-dependencies.min.d41d8cd98f00b204e9800998ecf8427e.js
blogs.blackberry.com/etc.clientlibs/blogs-bbcom/clientlibs/ 		0
566 B 		Script
General
Check archive.org
Download Go to
Full URL
https://blogs.blackberry.com/etc.clientlibs/blogs-bbcom/clientlibs/clientlib-dependencies.min.d41d8cd98f00b204e9800998ecf8427e.js
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2022/10/unattributed-romcom-threat-actor-spoofing-popular-apps-now-hits-ukrainian-militaries
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223d:b800:19:cd0a:2e00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
Strict-Transport-Security max-age=63072000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/en/2022/10/unattributed-romcom-threat-actor-spoofing-popular-apps-now-hits-ukrainian-militaries
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

x-dispatcher
dispatcher2uswest2
content-security-policy
frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
date
Thu, 03 Nov 2022 05:12:32 GMT
x-content-type-options
nosniff
strict-transport-security
max-age=63072000; includeSubdomains;
via
1.1 e94c77a12a65a84cbcef7856ed7e0fb8.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P3
age
14605
x-vhost
publish
x-cache
Hit from cloudfront
content-length
0
x-xss-protection
1; mode=block
last-modified
Wed, 19 Aug 2020 17:28:58 GMT
server
Apache
etag
"0-5ad3e56b78a80"
x-frame-options
SAMEORIGIN
content-type
application/javascript;charset=utf-8
cache-control
no-cache="set-cookie"
accept-ranges
bytes
x-amz-cf-id
5sI6Cgj-C300J5dLH7STsnIxojBoUkwKiHxZk1tgFtPiBbSXsCFqLw==
clientlib-site.min.8a0a0c3499467e79592169e008f2e562.js
blogs.blackberry.com/etc.clientlibs/blogs-bbcom/clientlibs/ 		83 KB
25 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blogs.blackberry.com/etc.clientlibs/blogs-bbcom/clientlibs/clientlib-site.min.8a0a0c3499467e79592169e008f2e562.js
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2022/10/unattributed-romcom-threat-actor-spoofing-popular-apps-now-hits-ukrainian-militaries
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223d:b800:19:cd0a:2e00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
d0071bfc234cbb6c8c3dba83388129e09223ab6e1a9f17431a0f345c9cd94af1
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
Strict-Transport-Security max-age=63072000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/en/2022/10/unattributed-romcom-threat-actor-spoofing-popular-apps-now-hits-ukrainian-militaries
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

x-dispatcher
dispatcher1uswest2
content-security-policy
frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
content-encoding
gzip
x-content-type-options
nosniff
date
Wed, 02 Nov 2022 22:50:37 GMT
via
1.1 e94c77a12a65a84cbcef7856ed7e0fb8.cloudfront.net (CloudFront)
strict-transport-security
max-age=63072000; includeSubdomains;
x-amz-cf-pop
FRA56-P3
age
37521
x-vhost
publish
x-cache
Hit from cloudfront
content-length
24986
x-xss-protection
1; mode=block
last-modified
Wed, 02 Nov 2022 13:12:45 GMT
server
Apache
etag
"14ae2-5ec7c98ab0d40-gzip"
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
application/javascript;charset=utf-8
cache-control
no-cache="set-cookie"
accept-ranges
bytes
x-amz-cf-id
ZQYbzUCdW6b8NbfQkjnoWPW5n4a3TKUPk2WHaY9Ld9vjurgZ-zrcrQ==
6373c986-7725-4c54-9731-2a91bdd43107.json
cdn.cookielaw.org/consent/6373c986-7725-4c54-9731-2a91bdd43107/ 		4 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://cdn.cookielaw.org/consent/6373c986-7725-4c54-9731-2a91bdd43107/6373c986-7725-4c54-9731-2a91bdd43107.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
02cb2c279d3a2c1bb8d9557283ececa5c76b8ff6950aa7a922885cb99e048445
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 03 Nov 2022 09:15:58 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
rn3TFRY9CYERe2zdicfi5A==
age
4950
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
1592
x-ms-lease-status
unlocked
last-modified
Tue, 04 Oct 2022 14:29:06 GMT
server
cloudflare
etag
0x8DAA614CAED251A
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
a9627a6a-701e-009e-73fd-d7a1a1000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=14400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
7644022aa83f9079-FRA
expires
Thu, 03 Nov 2022 13:15:58 GMT
css
fonts.googleapis.com/ 		6 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Roboto:300,400,900&display=swap
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/etc.clientlibs/blogs-bbcom/clientlibs/clientlib-site.min.212090aa91e144ce76b952f074e6c1ba.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
4c8417349722c7f6afdd6ff0124b20d345c952d91f46aa0192dae089bd007eef
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Thu, 03 Nov 2022 09:15:58 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Thu, 03 Nov 2022 09:15:58 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Thu, 03 Nov 2022 09:15:58 GMT
location
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 		59 B
295 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::ac40:929e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2157361193375a79ade3559e960f982daa8d599cf7f4a92d36e3eef257738f16
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept
application/json
Referer
https://blogs.blackberry.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Thu, 03 Nov 2022 09:15:58 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
server
cloudflare
vary
Accept-Encoding
access-control-allow-methods
GET, OPTIONS
content-type
application/json
access-control-allow-origin
*
cf-ray
7644022aeadf9945-FRA
access-control-allow-headers
Content-Type
gtm.js
www.googletagmanager.com/ 		444 KB
106 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-TXGFP23
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2022/10/unattributed-romcom-threat-actor-spoofing-popular-apps-now-hits-ukrainian-militaries
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
19b5d8bf1a558142adde9118a5c69367ce2655bce0952c6d9aa5ac24d338fdde
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Thu, 03 Nov 2022 09:15:58 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
108417
x-xss-protection
0
last-modified
Thu, 03 Nov 2022 09:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Thu, 03 Nov 2022 09:15:58 GMT
free.min.css
ka-f.fontawesome.com/releases/v5.15.4/css/ 		59 KB
13 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ka-f.fontawesome.com/releases/v5.15.4/css/free.min.css?token=3c243f8233
Requested by
Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/3c243f8233.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:e6::ac40:ca1c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fc5128dfdcdfa0c3a9967a6d2f19399d7bf1aaae6ad7571b96b03915a1f30dda

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Thu, 03 Nov 2022 09:15:58 GMT
via
1.1 f7e6fd9466c5c2a3b15f0fb077de1afa.cloudfront.net (CloudFront)
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
FRA60-P2
age
4757128
x-cache
Hit from cloudfront
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Wed, 04 Aug 2021 18:53:09 GMT
server
cloudflare
etag
W/"a12ec7ebe75a4d59a5dd6b79e2ba2e16"
access-control-max-age
3000
access-control-allow-methods
GET
content-type
text/css
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sHbXdQRMeNrU5Do3i4OEJXrm6AzsHXZ%2FKoqNZHphyksv8J%2BLVfEDl%2F8sFc7ef3UcPptLEuaj7A7UKNJp3HyvJezc7uPVq7QVooxKIcCPi1nxPK5Vp%2FYNHs%2FWxJcdBcFaTosx0G9Bv27ZJNVDY%2FXRUi0FBg%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=31556926
vary
Accept-Encoding
cf-ray
7644022b1f1d907c-FRA
access-control-allow-headers
fa-kit-token
x-amz-cf-id
UPw3JF1K6Rh2w7dpvJHvmbax-ptZ1-2S2rFCZ0_x2hDSiUfWu2glPg==
free-v4-shims.min.css
ka-f.fontawesome.com/releases/v5.15.4/css/ 		26 KB
4 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ka-f.fontawesome.com/releases/v5.15.4/css/free-v4-shims.min.css?token=3c243f8233
Requested by
Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/3c243f8233.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:e6::ac40:ca1c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6dea47458a4cd7cd7312cc780a53c62e0c8b3ccc8d0b13c1ac0ea6e3dfcecea8

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Thu, 03 Nov 2022 09:15:58 GMT
via
1.1 5ddb18e15e6b0ed6114111e515bddc66.cloudfront.net (CloudFront)
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
FRA60-P2
age
4757128
x-cache
Hit from cloudfront
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Wed, 04 Aug 2021 18:53:09 GMT
server
cloudflare
etag
W/"76f34b71fc9fb641507ff6a822cc07f5"
access-control-max-age
3000
access-control-allow-methods
GET
content-type
text/css
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=z2bv4NVxbb%2FFYw9V%2FcSZ2cXFPfKmNfvqOwwpwDAFYbtwPuPCHhtvOe7oZXLOFCirPQhynK41eNI2IqZeMNNiuXlHBsGOZ91%2BrtrAyGk6XMala0Csq1fRFnnt7gvqwHYMak3j8qKC1Q5yP1Bj6p6bc09VGg%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=31556926
vary
Accept-Encoding
cf-ray
7644022b1f1f907c-FRA
access-control-allow-headers
fa-kit-token
x-amz-cf-id
sZ8Q2pjsEF7X0hEPJrZj6NlEa3W23Mw7_fjOFGhBm2glEVoVPNtfKg==
free-v4-font-face.min.css
ka-f.fontawesome.com/releases/v5.15.4/css/ 		3 KB
2 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ka-f.fontawesome.com/releases/v5.15.4/css/free-v4-font-face.min.css?token=3c243f8233
Requested by
Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/3c243f8233.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:e6::ac40:ca1c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7f8b63bff49fba3c5bae30f4eb39f2fd6d088fbe9d7292bdf37b0ef4a1ec68d6

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Thu, 03 Nov 2022 09:15:58 GMT
via
1.1 0ee6aea018b9489b266252370f1e002e.cloudfront.net (CloudFront)
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
DUS51-C1
age
3571890
x-cache
Hit from cloudfront
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Wed, 04 Aug 2021 18:53:09 GMT
server
cloudflare
etag
W/"f2e0b2680d9b0bcb6e0039c4424e5a59"
access-control-max-age
3000
access-control-allow-methods
GET
content-type
text/css
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5DR8Xor2e2yeylDVVLej%2BcgiqP%2FSbYtB8ZV9Tq8DCTRGlczEHMlAliv80dtTbVExiHOAQ71uhgW5ZfXPkx2Lp7Tx7p0%2Br%2F1J1TRYJjkPWapDiNmBRiGmuzzFH%2FNUBH3Js8%2FkdFYsS6NBVEFK5jchIzPT6w%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=31556926
vary
Accept-Encoding
cf-ray
7644022b1f21907c-FRA
access-control-allow-headers
fa-kit-token
x-amz-cf-id
JK0wfwb_fWqdDgxjKlnbrIHcqhdyXm5qs_K3At5LozvVNMMuKU2-iA==
bnr-blue-gradient-crop.jpg
blogs.blackberry.com/content/dam/blackberry-com/Images/support/bgs/ 		48 KB
49 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blogs.blackberry.com/content/dam/blackberry-com/Images/support/bgs/bnr-blue-gradient-crop.jpg
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2022/10/unattributed-romcom-threat-actor-spoofing-popular-apps-now-hits-ukrainian-militaries
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223d:b800:19:cd0a:2e00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
d104b74bae6e524bb21bfede62a270ff318122d005772d94e6d7cebbc53017fc
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
Strict-Transport-Security max-age=63072000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/en/2022/10/unattributed-romcom-threat-actor-spoofing-popular-apps-now-hits-ukrainian-militaries
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

x-dispatcher
dispatcher3uswest2
content-security-policy
frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
date
Thu, 03 Nov 2022 05:12:34 GMT
x-content-type-options
nosniff
strict-transport-security
max-age=63072000; includeSubdomains;
via
1.1 e94c77a12a65a84cbcef7856ed7e0fb8.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P3
age
14604
x-vhost
publish
x-cache
Hit from cloudfront
content-disposition
attachment
content-length
49272
x-xss-protection
1; mode=block
last-modified
Fri, 02 Nov 2018 16:55:27 GMT
server
Apache
etag
"c078-579b166f41dc0"
x-frame-options
SAMEORIGIN
content-type
image/jpeg
cache-control
no-cache="set-cookie"
accept-ranges
bytes
x-amz-cf-id
rTXnb85d-lW7Kbs9Qa0iRmMV4Vf4QLDRQmAg3Xn_cXi9tXj1yoOkgA==
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ 		15 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:300,400,900&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://blogs.blackberry.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Wed, 02 Nov 2022 16:40:56 GMT
x-content-type-options
nosniff
age
59702
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15744
x-xss-protection
0
last-modified
Wed, 11 May 2022 19:24:48 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 02 Nov 2023 16:40:56 GMT
KFOlCnqEu92Fr1MmYUtfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmYUtfBBc4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:300,400,900&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
7e262106f82cc52663e403f5b73795bbeab9ca0630c33c03579354fbcd4fae1e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://blogs.blackberry.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Thu, 03 Nov 2022 03:39:12 GMT
x-content-type-options
nosniff
age
20206
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15752
x-xss-protection
0
last-modified
Wed, 11 May 2022 19:24:56 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 03 Nov 2023 03:39:12 GMT
KFOlCnqEu92Fr1MmSU5fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBBc4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:300,400,900&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f75911313e1c7802c23345ab57e754d87801581706780c993fb23ff4e0fe62ef
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://blogs.blackberry.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Fri, 28 Oct 2022 20:40:44 GMT
x-content-type-options
nosniff
age
477314
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15740
x-xss-protection
0
last-modified
Wed, 11 May 2022 19:24:56 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 28 Oct 2023 20:40:44 GMT
KFOlCnqEu92Fr1MmSU5fABc4EsA.woff2
fonts.gstatic.com/s/roboto/v30/ 		9 KB
9 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fABc4EsA.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:300,400,900&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
47aa3bfad6cb9e2d63abdd58f4e6ce4f7b9fd2704b2b15193c71874035fe025d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://blogs.blackberry.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Tue, 01 Nov 2022 08:45:44 GMT
x-content-type-options
nosniff
age
174614
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
9576
x-xss-protection
0
last-modified
Wed, 11 May 2022 19:24:58 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 01 Nov 2023 08:45:44 GMT
KFOmCnqEu92Fr1Mu5mxKOzY.woff2
fonts.gstatic.com/s/roboto/v30/ 		9 KB
10 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu5mxKOzY.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:300,400,900&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
495d38d4b9741e8aa4204002414069e2d8db9f3c60b60e195e4d74381462dee9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://blogs.blackberry.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Mon, 31 Oct 2022 18:17:14 GMT
x-content-type-options
nosniff
age
226724
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
9628
x-xss-protection
0
last-modified
Wed, 11 May 2022 19:24:42 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 31 Oct 2023 18:17:14 GMT
otBannerSdk.js
cdn.cookielaw.org/scripttemplates/202209.1.0/ 		376 KB
90 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.cookielaw.org/scripttemplates/202209.1.0/otBannerSdk.js
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5bcbd83d020ff272645c59dff179841df9374a6295f324eee00b9de4e67bc1cd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 03 Nov 2022 09:15:58 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
229oLfugqvtMNLM3e0uPaA==
age
9135
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
91423
x-ms-lease-status
unlocked
last-modified
Tue, 11 Oct 2022 04:36:30 GMT
server
cloudflare
etag
0x8DAAB422B1E6529
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
65ffbfc2-d01e-0039-6a3d-dd9842000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=14400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
7644022b5d2e9249-FRA
jquery.touchSwipe.min.js
blogs.blackberry.com/etc.clientlibs/bbcom/clientlibs/clientlib-etc-legacy/resources/bbcom-aem-project/scripts/plugins/touchswipe/ 		20 KB
6 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://blogs.blackberry.com/etc.clientlibs/bbcom/clientlibs/clientlib-etc-legacy/resources/bbcom-aem-project/scripts/plugins/touchswipe/jquery.touchSwipe.min.js?_=1667466958576
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/etc.clientlibs/shared/clientlibs/jquery.min.4db6e885829bd8fc24f238a73222cb0e.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223d:b800:19:cd0a:2e00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
9167cb37ed21405ef9556646b83789a2099c15398f5cea867470df1e81752e17
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
Strict-Transport-Security max-age=63072000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Referer
https://blogs.blackberry.com/en/2022/10/unattributed-romcom-threat-actor-spoofing-popular-apps-now-hits-ukrainian-militaries
X-Requested-With
XMLHttpRequest
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

x-dispatcher
dispatcher4uswest2
content-security-policy
frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
content-encoding
gzip
x-content-type-options
nosniff
date
Wed, 02 Nov 2022 22:50:37 GMT
via
1.1 e94c77a12a65a84cbcef7856ed7e0fb8.cloudfront.net (CloudFront)
strict-transport-security
max-age=63072000; includeSubdomains;
x-amz-cf-pop
FRA56-P3
age
37521
x-vhost
publish
x-cache
Hit from cloudfront
content-length
5051
x-xss-protection
1; mode=block
last-modified
Wed, 19 Aug 2020 17:40:41 GMT
server
Apache
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=86400, public, no-cache="set-cookie"
x-amz-cf-id
eNCnnRtLeO8gO-JTx_6jJOJLUsusEsFrcyRRS6goBMNPmFiGfN_4mA==
id
dpm.demdex.net/ 		369 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://dpm.demdex.net/id?d_visid_ver=5.2.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=85522AC5562681557F000101%40AdobeOrg&d_nsid=0&ts=1667466958716
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/cb3160b9e813/dd47d4a7a48e/launch-17c42c38011b.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.229.34.254 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-229-34-254.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
c643b017f2f29729a5cfc6b91a0e760c0dc7a36fa74ce0614b09679771332f79
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://blogs.blackberry.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

DCS
dcs-prod-irl1-2-v045-0284b356a.edge-irl1.demdex.com 2 ms
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
content-encoding
gzip
X-TID
IITdid/LQfc=
Vary
Origin
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin
https://blogs.blackberry.com
Content-Type
application/json;charset=utf-8
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
311
Expires
Thu, 01 Jan 1970 00:00:00 UTC
AppMeasurement.min.js
assets.adobedtm.com/extensions/EPbde2f7ca14e540399dcc1f8208860b7b/ 		33 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/extensions/EPbde2f7ca14e540399dcc1f8208860b7b/AppMeasurement.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/cb3160b9e813/dd47d4a7a48e/launch-17c42c38011b.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:480:284::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
d6b423c91328eec9c218dd8b21ae1e676987d574e5432411a32806e5dd2bde32

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Thu, 03 Nov 2022 09:15:58 GMT
content-encoding
gzip
last-modified
Wed, 12 Aug 2020 22:09:52 GMT
server
AkamaiNetStorage
etag
"f259ee6445c19c2ce3c64a1b117a4f35:1597270192.577101"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://blogs.blackberry.com
cache-control
no-cache
accept-ranges
bytes
timing-allow-origin
*
content-length
12184
expires
Thu, 03 Nov 2022 10:15:58 GMT
AppMeasurement_Module_ActivityMap.min.js
assets.adobedtm.com/extensions/EPbde2f7ca14e540399dcc1f8208860b7b/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/extensions/EPbde2f7ca14e540399dcc1f8208860b7b/AppMeasurement_Module_ActivityMap.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/cb3160b9e813/dd47d4a7a48e/launch-17c42c38011b.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:480:284::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
0486530f1e98818865754a08e1b5442ac5a6a36a6bf6042e3b3338a532e998d2

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Thu, 03 Nov 2022 09:15:58 GMT
content-encoding
gzip
last-modified
Wed, 12 Aug 2020 22:09:52 GMT
server
AkamaiNetStorage
etag
"5dedcda2c8a6c3a51fd419d306427010:1597270192.857753"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://blogs.blackberry.com
cache-control
no-cache
accept-ranges
bytes
timing-allow-origin
*
content-length
1594
expires
Thu, 03 Nov 2022 10:15:58 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/944900006/ 		2 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/944900006/?random=1667466958747&cv=11&fst=1667466958747&bg=ffffff&guid=ON&async=1&gtm=2oaav0&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2022%2F10%2Funattributed-romcom-threat-actor-spoofing-popular-apps-now-hits-ukrainian-militaries&tiba=Unattributed%20RomCom%20Threat%20Actor%20Spoofing%20Popular%20Apps%20Now%20Hits%20Ukrainian%20Militaries&auid=971170911.1667466959&data=event%3Dgtag.config&rfmt=3&fmt=4
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-944900006
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
228a0cb1d3acb5792f3f7aa1f2e1a471899e35c709edc183e68de336cfd36614
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 03 Nov 2022 09:15:58 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1060
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
en.json
cdn.cookielaw.org/consent/6373c986-7725-4c54-9731-2a91bdd43107/32e4d3ca-ec8a-4d86-bce8-c6114fb6765d/ 		100 KB
19 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://cdn.cookielaw.org/consent/6373c986-7725-4c54-9731-2a91bdd43107/32e4d3ca-ec8a-4d86-bce8-c6114fb6765d/en.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202209.1.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
86b097cf6509634bb69b4fec6a6e1cb2f555bef2505f03cae1741f2a3b7d082b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 03 Nov 2022 09:15:58 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
j4nLAQ2yxJV7QiJvfaLIVA==
age
4947
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
19637
x-ms-lease-status
unlocked
last-modified
Tue, 04 Oct 2022 14:29:11 GMT
server
cloudflare
etag
0x8DAA614CE5A530F
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
ee565671-901e-0035-71fd-d776b3000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=14400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
7644022c4b459079-FRA
expires
Thu, 03 Nov 2022 13:15:58 GMT
otFlat.json
cdn.cookielaw.org/scripttemplates/202209.1.0/assets/ 		13 KB
3 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://cdn.cookielaw.org/scripttemplates/202209.1.0/assets/otFlat.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202209.1.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
14e4d1596c6b58896dfce1fc1ec45372bab4d2259ba82828fa3f96cc4f859fc4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 03 Nov 2022 09:15:58 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
wG3T8rT9wA5w2UbDdvkxcQ==
age
6686
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
3007
x-ms-lease-status
unlocked
last-modified
Tue, 11 Oct 2022 04:36:21 GMT
server
cloudflare
etag
0x8DAAB42258FDE79
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
x-ms-request-id
5d9432b5-b01e-006d-5d44-dd72c8000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=14400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
7644022cdc2a9079-FRA
otCookieSettingsButton.json
cdn.cookielaw.org/scripttemplates/202209.1.0/assets/ 		5 KB
2 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://cdn.cookielaw.org/scripttemplates/202209.1.0/assets/otCookieSettingsButton.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202209.1.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a09d0f89e99cf5a081315ff701187632005dabd23f3ca116a75790003faa7e8f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 03 Nov 2022 09:15:58 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
chhUbr1lo8VfhnCyj4C/QQ==
age
5439
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
1767
x-ms-lease-status
unlocked
last-modified
Tue, 11 Oct 2022 04:36:23 GMT
server
cloudflare
etag
0x8DAAB4226B08D84
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
x-ms-request-id
cf9ff16b-801e-004c-4643-dd1ff9000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=14400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
7644022cdc2b9079-FRA
otCommonStyles.css
cdn.cookielaw.org/scripttemplates/202209.1.0/assets/ 		22 KB
5 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://cdn.cookielaw.org/scripttemplates/202209.1.0/assets/otCommonStyles.css
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202209.1.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fb6bcf7d9261064812fe1b4d2b59b8c8ca52b7d0c522746ba9cec2dc01b3a7d4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 03 Nov 2022 09:15:58 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
gzip
content-md5
B55i3ZY9miZIaUrwjufy0w==
age
6686
x-ms-lease-status
unlocked
last-modified
Tue, 11 Oct 2022 04:36:34 GMT
server
cloudflare
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
x-ms-request-id
50050c31-f01e-0103-6d45-dd9db4000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=14400
x-ms-version
2009-09-19
cf-ray
7644022cdc2c9079-FRA
/
www.google.com/pagead/1p-user-list/944900006/ 		42 B
548 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/944900006/?random=1667466958747&cv=11&fst=1667466000000&bg=ffffff&guid=ON&async=1&gtm=2oaav0&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2022%2F10%2Funattributed-romcom-threat-actor-spoofing-popular-apps-now-hits-ukrainian-militaries&tiba=Unattributed%20RomCom%20Threat%20Actor%20Spoofing%20Popular%20Apps%20Now%20Hits%20Ukrainian%20Militaries&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=3777556765&rmt_tld=0&ipr=y
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2022/10/unattributed-romcom-threat-actor-spoofing-popular-apps-now-hits-ukrainian-militaries
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 03 Nov 2022 09:15:58 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/944900006/ 		42 B
548 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/pagead/1p-user-list/944900006/?random=1667466958747&cv=11&fst=1667466000000&bg=ffffff&guid=ON&async=1&gtm=2oaav0&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2022%2F10%2Funattributed-romcom-threat-actor-spoofing-popular-apps-now-hits-ukrainian-militaries&tiba=Unattributed%20RomCom%20Threat%20Actor%20Spoofing%20Popular%20Apps%20Now%20Hits%20Ukrainian%20Militaries&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=3777556765&rmt_tld=1&ipr=y
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2022/10/unattributed-romcom-threat-actor-spoofing-popular-apps-now-hits-ukrainian-militaries
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 03 Nov 2022 09:15:58 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
dest5.html
blackberry.demdex.net/ Frame DE70 		7 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://blackberry.demdex.net/dest5.html?d_nsid=0
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/cb3160b9e813/dd47d4a7a48e/launch-17c42c38011b.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.229.2.193 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-229-2-193.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://blogs.blackberry.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Accept-Ranges
bytes
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Type
text/html;charset=UTF-8
DCS
dcs-prod-irl1-1-v045-0826e4ce6.edge-irl1.demdex.com 0 ms
Expires
Thu, 01 Jan 1970 00:00:00 UTC
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-TID
e+s+a+1uSZA=
content-encoding
gzip
date
Thu, 3 Nov 2022 09:15:58 GMT
last-modified
Fri, 28 Oct 2022 11:02:57 GMT
transfer-encoding
chunked
vary
accept-encoding
ibs:dpid=411&dpuuid=Y2OGzgAAADpmbgN-
dpm.demdex.net/
Redirect Chain
  • https://cm.everesttech.net/cm/dd?d_uuid=07968580236520529533158094012952807342
  • https://dpm.demdex.net/ibs:dpid=411&dpuuid=Y2OGzgAAADpmbgN-
42 B
942 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dpm.demdex.net/ibs:dpid=411&dpuuid=Y2OGzgAAADpmbgN-
Requested by
Host: blogs.blackberry.com
URL: https://blogs.blackberry.com/en/2022/10/unattributed-romcom-threat-actor-spoofing-popular-apps-now-hits-ukrainian-militaries
Protocol
HTTP/1.1
Server
54.229.34.254 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-229-34-254.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blogs.blackberry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

DCS
dcs-prod-irl1-1-v045-0078884aa.edge-irl1.demdex.com 2 ms
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
content-encoding
gzip
X-Content-Type-Options
nosniff
X-TID
tJ5kk6yERCY=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type
image/gif
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Length
59
Expires
Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Location
https://dpm.demdex.net/ibs:dpid=411&dpuuid=Y2OGzgAAADpmbgN-
Date
Thu, 03 Nov 2022 09:15:58 GMT
Cache-Control
no-cache
Server
AMO-cookiemap/1.1
Connection
keep-alive
Content-Length
0
P3P
CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

Verdicts & Comments Add Verdict or Comment

57 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation object| OneTrustStub function| OptanonWrapper object| digitalData object| dataLayer function| gtag object| FontAwesomeKitConfig function| $ function| jQuery function| appendData function| scrollLoadFull function| scrollLoadAuthor function| scrollLoadCategory function| onDemandScript object| bootstrap object| lazySizesConfig object| lazySizes function| getGclidQueryParameter function| getExpiryRecord function| addGclid string| OnetrustActiveGroups string| OptanonActiveGroups object| otStubData object| google_tag_manager object| google_tag_data object| _satellite boolean| __satelliteLoaded object| adobe function| Visitor object| s_c_il number| s_c_in object| GooglebQhCsO function| postscribe object| google_tag_manager_external object| Optanon object| OneTrust function| AppMeasurement function| s_gi function| s_pgicq number| s_objectID number| s_giq function| AppMeasurement_Module_ActivityMap object| s function| getNewRepeat function| getVisitNum function| endOfDatePeriod function| getTimeParting object| cp_utils

9 Cookies

Domain/Path Name / Value
.onpdr.com/ Name: __cf_bm
Value: LtTtRMt2ATH5GSdRDl6PqecyD7WPDgjrIMoxuoTaHyA-1667466958-0-Ab6q+7Is94lpWgdmXu6G46REpR8mqPCxkfbOPvWNkH9p6vvo5WOyJ9YUM3l2v13lYDFIz2OA9K5kOu4n2Zsb6rQ=
.blackberry.com/ Name: _gcl_au
Value: 1.1.971170911.1667466959
.doubleclick.net/ Name: test_cookie
Value: CheckForPermission
.demdex.net/ Name: demdex
Value: 07968580236520529533158094012952807342
.blackberry.com/ Name: AMCVS_85522AC5562681557F000101%40AdobeOrg
Value: 1
.blogs.blackberry.com/ Name: OptanonConsent
Value: isIABGlobal=false&datestamp=Thu+Nov+03+2022+09%3A15%3A58+GMT%2B0000+(GMT)&version=202209.1.0&consentId=14069ebf-00c2-4a4e-8462-a6511bfefbbf&interactionCount=0&landingPath=https%3A%2F%2Fblogs.blackberry.com%2Fen%2F2022%2F10%2Funattributed-romcom-threat-actor-spoofing-popular-apps-now-hits-ukrainian-militaries&groups=C0001%3A1%2CC0002%3A0%2CC0003%3A0%2CC0004%3A0&hosts=H197%3A0%2CH171%3A0%2CH218%3A0%2CH219%3A0%2CH5%3A0%2CH220%3A0%2CH6%3A0%2CH221%3A0%2CH80%3A0%2CH110%3A0%2CH133%3A0%2CH15%3A0%2CH233%3A0%2CH21%3A0%2CH24%3A0%2CH111%3A0%2CH112%3A0%2CH30%3A0%2CH31%3A0%2CH94%3A0%2CH113%3A0%2CH37%3A0%2CH138%3A0%2CH42%3A0%2CH235%3A0%2CH114%3A0%2CH162%3A0%2CH47%3A0%2CH48%3A0%2CH52%3A0%2CH56%3A0%2CH118%3A0%2CH58%3A0%2CH192%3A0%2CH119%3A0%2CH65%3A0%2CH224%3A0%2CH70%3A0%2CH225%3A0%2CH73%3A0%2CH200%3A0%2CH75%3A0&genVendors=
.everesttech.net/ Name: everest_g_v2
Value: g_surferid~Y2OGzgAAADpmbgN-
.dpm.demdex.net/ Name: dpm
Value: 07968580236520529533158094012952807342
.blackberry.com/ Name: AMCV_85522AC5562681557F000101%40AdobeOrg
Value: -1124106680%7CMCIDTS%7C19300%7CMCMID%7C07929016478145700423160467259632875597%7CMCAAMLH-1668071758%7C6%7CMCAAMB-1668071758%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1667474158s%7CNONE%7CMCSYNCSOP%7C411-19307%7CvVersion%7C5.2.0

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy frame-ancestors 'self'; base-uri 'self';upgrade-insecure-requests;
Strict-Transport-Security max-age=63072000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

assets.adobedtm.com
blackberry.demdex.net
blogs.blackberry.com
campaigns-events.eu-central-1.onpdr.com
cdn.cookielaw.org
cm.everesttech.net
dpm.demdex.net
fonts.googleapis.com
fonts.gstatic.com
geolocation.onetrust.com
googleads.g.doubleclick.net
ka-f.fontawesome.com
kit.fontawesome.com
www.google.com
www.google.de
www.googletagmanager.com
2600:9000:223d:b800:19:cd0a:2e00:93a1
2606:4700:4400::ac40:929e
2606:4700:4400::ac40:9b49
2606:4700::6810:9540
2606:4700::6812:1734
2606:4700:e6::ac40:ca1c
2a00:1450:4001:800::200a
2a00:1450:4001:828::2003
2a00:1450:4001:828::2004
2a00:1450:4001:829::2003
2a00:1450:4001:82b::2002
2a00:1450:4001:830::2008
2a02:26f0:480:284::1e80
34.248.32.199
54.229.2.193
54.229.34.254
02cb2c279d3a2c1bb8d9557283ececa5c76b8ff6950aa7a922885cb99e048445
0486530f1e98818865754a08e1b5442ac5a6a36a6bf6042e3b3338a532e998d2
04e2a5545fca5d8d2782d018a57c5bfa481bdeb973492390b18b6ea587f985a5
05805384113ee0e786510aae5c462addd4a056e88932c47c49865753596a4ae3
090bf13e9ded9a3b802a1a8b639d5edc8121e76586d043c36c1294aa95a32caf
0afeb0c59cda1372d24a059afe9de618c353070363a486cb04bdf8d4cad55d80
11aead2770c9e8c64c1f3b095000cefa5909af279504cd102a58d27de0468b3f
14e4d1596c6b58896dfce1fc1ec45372bab4d2259ba82828fa3f96cc4f859fc4
19b5d8bf1a558142adde9118a5c69367ce2655bce0952c6d9aa5ac24d338fdde
2157361193375a79ade3559e960f982daa8d599cf7f4a92d36e3eef257738f16
228a0cb1d3acb5792f3f7aa1f2e1a471899e35c709edc183e68de336cfd36614
22b22ab6217c7b299e896ac9bd55044fd72c25cf99410b1a724bf4eba90cb8e5
2590f1a7c078e8fc862aa7c1dc5fe94735b26539521061aa3ff3215d35a72575
47aa3bfad6cb9e2d63abdd58f4e6ce4f7b9fd2704b2b15193c71874035fe025d
495d38d4b9741e8aa4204002414069e2d8db9f3c60b60e195e4d74381462dee9
4c8417349722c7f6afdd6ff0124b20d345c952d91f46aa0192dae089bd007eef
52521a8e8198d5759eeb9412feae38293f052218d6553f1446de0f307e51ce63
5bcbd83d020ff272645c59dff179841df9374a6295f324eee00b9de4e67bc1cd
6216ca852224925d356e88c28b21fb2052445c478b8efdde73e3e3616a426f89
67aebc966ccdb62424299f5f290a1283b3e66a03c32be8dc73716384c970ebfe
6dea47458a4cd7cd7312cc780a53c62e0c8b3ccc8d0b13c1ac0ea6e3dfcecea8
7b5dbd37fcc639258ef21f839e379c044a86f7ca588cda61532446bc021f6e04
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
7e262106f82cc52663e403f5b73795bbeab9ca0630c33c03579354fbcd4fae1e
7f8b63bff49fba3c5bae30f4eb39f2fd6d088fbe9d7292bdf37b0ef4a1ec68d6
8152499f992d91f05b105ba7da1a4972498bc4c7416e81c7223c4659360413dc
86b097cf6509634bb69b4fec6a6e1cb2f555bef2505f03cae1741f2a3b7d082b
9167cb37ed21405ef9556646b83789a2099c15398f5cea867470df1e81752e17
a09d0f89e99cf5a081315ff701187632005dabd23f3ca116a75790003faa7e8f
a4024dcdcbaad04c447e3e3b8a6ca7f3fd0f6ed78c87cf0a982d7286a49989c2
bb5aad79832651898f6b5be3ad48622421089b5ee5517d8323ddb5933c6a0b72
bbc4456bca95006683a8f081d0d2ed645eef5b14c62eca12c70f7e1cec26c1a0
c116899f723b0f59bca95bad86e524c295ab397cc921c022d73984d23cc359da
c368fc59b92f1873480969e6a7f9b721be998c3733d6d7d44c6f2fe892aeb358
c643b017f2f29729a5cfc6b91a0e760c0dc7a36fa74ce0614b09679771332f79
d0071bfc234cbb6c8c3dba83388129e09223ab6e1a9f17431a0f345c9cd94af1
d104b74bae6e524bb21bfede62a270ff318122d005772d94e6d7cebbc53017fc
d6b423c91328eec9c218dd8b21ae1e676987d574e5432411a32806e5dd2bde32
d7344bc8b16c47fa2bf3d9c213251e77b141e94c9bf93effeebeb30df89070cf
e2c59b82de2701048abd96f86cab62ece113a916ae712f0f8b57a9dc8a961147
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f30733e0e39f5044034df46d3d8c20feaa22cf680bc21398b2359f3555ff5364
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
f75911313e1c7802c23345ab57e754d87801581706780c993fb23ff4e0fe62ef
f8258923f42ffb2c5ffaa58b0dc3f0d0fb0a146f2718d434d362fcfb2fe8cbc1
fb6bcf7d9261064812fe1b4d2b59b8c8ca52b7d0c522746ba9cec2dc01b3a7d4
fc5128dfdcdfa0c3a9967a6d2f19399d7bf1aaae6ad7571b96b03915a1f30dda