www.threatcrowd.org Open in urlscan Pro
2606:4700:3038::6815:e9bd  Public Scan

14 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 65

• https://s.adroll.com/j/exp/PIUCN4PSYRCCHBHOGPVN5Q/index.js HTTP 302
• https://s.adroll.com/j/exp/index.js

Request Chain 66

• https://s.adroll.com/j/pre/PIUCN4PSYRCCHBHOGPVN5Q/KDBRCBINVREGNJUXIQKBDP/fpconsent.js HTTP 302
• https://s.adroll.com/j/pre/index.js

Request Chain 70

• https://d.adroll.com/pixel/PIUCN4PSYRCCHBHOGPVN5Q/KDBRCBINVREGNJUXIQKBDP?adroll_fpc=4498f60f0b4b56ce69a90c18c9a6dbef-1638885832356&arrfrr=https%3A%2F%2Fwww.threatcrowd.org%2Fmalware.php%3Fmd5%3D775a0631fb8229b2aa3d7621427085ad&xid_ch=f&pv=97957316713.18564&cookie=&adroll_s_ref=&keyw= HTTP 302
• https://s.adroll.com/pixel/PIUCN4PSYRCCHBHOGPVN5Q/KDBRCBINVREGNJUXIQKBDP/4OCRKBF4JJENXICP676FJT.js

Request Chain 74

• https://d.adroll.com/cm/onevideo/out?adroll_fpc=4498f60f0b4b56ce69a90c18c9a6dbef-1638885832356&arrfrr=https%3A%2F%2Fwww.threatcrowd.org%2Fmalware.php%3Fmd5%3D775a0631fb8229b2aa3d7621427085ad&xid_ch=f&advertisable=PIUCN4PSYRCCHBHOGPVN5Q HTTP 302
• https://pixel.advertising.com/ups/55980/sync?uid=NmZmY2IxOGY0ZWY2ZjgzMzdhMWIyYTNkZDAwNmQzMmE&_origin=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA HTTP 302
• https://pixel.advertising.com/ups/55980/sync?uid=NmZmY2IxOGY0ZWY2ZjgzMzdhMWIyYTNkZDAwNmQzMmE&_origin=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA&verify=true

Request Chain 75

• https://d.adroll.com/cm/pubmatic/out?adroll_fpc=4498f60f0b4b56ce69a90c18c9a6dbef-1638885832356&arrfrr=https%3A%2F%2Fwww.threatcrowd.org%2Fmalware.php%3Fmd5%3D775a0631fb8229b2aa3d7621427085ad&xid_ch=f&advertisable=PIUCN4PSYRCCHBHOGPVN5Q HTTP 302
• https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMwNiZ0bD01MjU2MDA&piggybackCookie=NmZmY2IxOGY0ZWY2ZjgzMzdhMWIyYTNkZDAwNmQzMmE&gdpr=1&gdpr_consent=BOOoKswOOoKswA2ABBENAkwAAAAXyACACYAIIA

Request Chain 76

• https://d.adroll.com/cm/triplelift/out?adroll_fpc=4498f60f0b4b56ce69a90c18c9a6dbef-1638885832356&arrfrr=https%3A%2F%2Fwww.threatcrowd.org%2Fmalware.php%3Fmd5%3D775a0631fb8229b2aa3d7621427085ad&xid_ch=f&advertisable=PIUCN4PSYRCCHBHOGPVN5Q HTTP 302
• https://eb2.3lift.com/xuid?mid=4714&xuid=NmZmY2IxOGY0ZWY2ZjgzMzdhMWIyYTNkZDAwNmQzMmE&dongle=c85e HTTP 302
• https://eb2.3lift.com/xuid?ld=1&mid=4714&xuid=NmZmY2IxOGY0ZWY2ZjgzMzdhMWIyYTNkZDAwNmQzMmE&dongle=c85e&gdpr=1&cmp_cs=&us_privacy=

Request Chain 77

• https://d.adroll.com/cm/x/out?adroll_fpc=4498f60f0b4b56ce69a90c18c9a6dbef-1638885832356&arrfrr=https%3A%2F%2Fwww.threatcrowd.org%2Fmalware.php%3Fmd5%3D775a0631fb8229b2aa3d7621427085ad&xid_ch=f&advertisable=PIUCN4PSYRCCHBHOGPVN5Q HTTP 302
• https://ib.adnxs.com/setuid?entity=172&code=NmZmY2IxOGY0ZWY2ZjgzMzdhMWIyYTNkZDAwNmQzMmE HTTP 307
• https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D172%26code%3DNmZmY2IxOGY0ZWY2ZjgzMzdhMWIyYTNkZDAwNmQzMmE

Request Chain 78

• https://d.adroll.com/cm/r/out?adroll_fpc=4498f60f0b4b56ce69a90c18c9a6dbef-1638885832356&arrfrr=https%3A%2F%2Fwww.threatcrowd.org%2Fmalware.php%3Fmd5%3D775a0631fb8229b2aa3d7621427085ad&xid_ch=f&advertisable=PIUCN4PSYRCCHBHOGPVN5Q HTTP 302
• https://ads.yahoo.com/cms/v1?esig=1~bf4e7dc4546a90c08591652d78a230d3f2ef5733&nwid=10001032567&sigv=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA

Request Chain 79

• https://d.adroll.com/cm/b/out?adroll_fpc=4498f60f0b4b56ce69a90c18c9a6dbef-1638885832356&arrfrr=https%3A%2F%2Fwww.threatcrowd.org%2Fmalware.php%3Fmd5%3D775a0631fb8229b2aa3d7621427085ad&xid_ch=f&advertisable=PIUCN4PSYRCCHBHOGPVN5Q HTTP 302
• https://x.bidswitch.net/sync?dsp_id=44&user_id=NmZmY2IxOGY0ZWY2ZjgzMzdhMWIyYTNkZDAwNmQzMmE HTTP 302
• https://x.bidswitch.net/ul_cb/sync?dsp_id=44&user_id=NmZmY2IxOGY0ZWY2ZjgzMzdhMWIyYTNkZDAwNmQzMmE

Request Chain 81

• https://d.adroll.com/cm/o/out?adroll_fpc=4498f60f0b4b56ce69a90c18c9a6dbef-1638885832356&arrfrr=https%3A%2F%2Fwww.threatcrowd.org%2Fmalware.php%3Fmd5%3D775a0631fb8229b2aa3d7621427085ad&xid_ch=f&advertisable=PIUCN4PSYRCCHBHOGPVN5Q HTTP 302
• https://us-u.openx.net/w/1.0/sd?id=537103138&val=6ffcb18f4ef6f8337a1b2a3dd006d32a

Request Chain 82

• https://d.adroll.com/cm/g/out?adroll_fpc=4498f60f0b4b56ce69a90c18c9a6dbef-1638885832356&arrfrr=https%3A%2F%2Fwww.threatcrowd.org%2Fmalware.php%3Fmd5%3D775a0631fb8229b2aa3d7621427085ad&xid_ch=f&advertisable=PIUCN4PSYRCCHBHOGPVN5Q&google_nid=adroll2 HTTP 302
• https://cm.g.doubleclick.net/pixel?google_sc&google_nid=artb&google_hm=b_yxj072-DN6Gyo90AbTKg HTTP 302
• https://cm.g.doubleclick.net/pixel?google_sc=&google_nid=artb&google_hm=b_yxj072-DN6Gyo90AbTKg&google_tc= HTTP 302
• https://d.adroll.com/cm/g/in

87 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request malware.php Show response www.threatcrowd.org/	14 KB 5 KB	2011ms 1982ms	Document text/html	2606:4700:3038::6815:e9bd CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.threatcrowd.org/malware.php?md5=775a0631fb8229b2aa3d7621427085ad Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3038::6815:e9bd , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/7.1.33 Resource Hash 71ff57b6e2df3e77b30eca03da84a2730d72c0f58976ba389cc6b2b69a67ddd4 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers date Tue, 07 Dec 2021 14:03:50 GMT content-type text/html; charset=UTF-8 x-powered-by PHP/7.1.33 vary Accept-Encoding cache-control max-age=86400 cf-cache-status MISS last-modified Tue, 07 Dec 2021 14:03:49 GMT expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FRhFwopDVNF3rNfd4EaiOlIH5IpeydHIYgUpqTiKSPnI94WER7Rw%2BC6yx74o6ZR05DwJP3Sjr5I8Neq%2FppVC5C9CYNQlk3sfyy1ZCB0%2FwRZNEqmt413RBhi70%2FIOt8MLPqWRlBgefWiZE4s39ca%2BHL1z"}],"group":"cf-nel","max_age":604800} nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare cf-ray 6b9e4cacdfd04a55-FRA content-encoding br alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
GET H2	200	bootstrap.min.css maxcdn.bootstrapcdn.com/bootstrap/3.3.6/css/	118 KB 21 KB	49ms 31ms	Stylesheet text/css	2606:4700::6812:acf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://maxcdn.bootstrapcdn.com/bootstrap/3.3.6/css/bootstrap.min.css Requested by Host: www.threatcrowd.org URL: https://www.threatcrowd.org/malware.php?md5=775a0631fb8229b2aa3d7621427085ad Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash eece6e0c65b7007ab0eb1b4998d36dafe381449525824349128efc3f86f4c91c Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.threatcrowd.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Tue, 07 Dec 2021 14:03:50 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT cdn-edgestorageid 601, 617 age 22438916 cdn-cachedat 2021-03-11 11:57:53 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 timing-allow-origin * access-control-allow-origin * last-modified Mon, 25 Jan 2021 22:03:59 GMT server cloudflare cdn-requestpullcode 200 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/css; charset=utf-8 cdn-cache HIT vary Accept-Encoding cache-control public, max-age=31919000 cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cdn-requestid 9c865ab149d3db1d503eb94bbda09a17 cf-ray 6b9e4cb979c42c3a-FRA cdn-requestcountrycode DE cdn-requestpullsuccess True
GET H2	200	custom.css www.threatcrowd.org/css/	3 KB 1 KB	22ms 22ms	Stylesheet text/css	2606:4700:3038::6815:e9bd CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.threatcrowd.org/css/custom.css Requested by Host: www.threatcrowd.org URL: https://www.threatcrowd.org/malware.php?md5=775a0631fb8229b2aa3d7621427085ad Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3038::6815:e9bd , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6fdab4960192fbaa8cf44caccb31a3af5e3d065609cf684fec7a05f647581323 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.threatcrowd.org/malware.php?md5=775a0631fb8229b2aa3d7621427085ad User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Tue, 07 Dec 2021 14:03:50 GMT content-encoding br cf-cache-status HIT last-modified Thu, 03 Jun 2021 14:58:11 GMT server cloudflare age 6639 etag W/"ba5-5c3ddcdc546c0-gzip" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uoyDZT04%2FBNx%2FR62T5erLEE2L8o%2FYZILALjKpq6aoQCfI9NahiKHpOTonQpSmQlO5hWFQUfU%2BYhl7PXIZ%2FPqV1%2Bz8cTReMQWNHVxDLYF4RHcX9Aom4VkzZnrHImzJPn8pvsp7DHgunzwWuhoJajJiMWL"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control max-age=86400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 6b9e4cb95bad4a55-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
GET H2	200	home.png www.threatcrowd.org/img/	1 KB 2 KB	16ms 16ms	Image image/png	2606:4700:3038::6815:e9bd CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.threatcrowd.org/img/home.png Requested by Host: www.threatcrowd.org URL: https://www.threatcrowd.org/malware.php?md5=775a0631fb8229b2aa3d7621427085ad Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3038::6815:e9bd , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 1b8b1d761a96d958fd8dbb46dd03dc4fd472324fc2570d587bc054f722b73611 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.threatcrowd.org/malware.php?md5=775a0631fb8229b2aa3d7621427085ad User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Tue, 07 Dec 2021 14:03:50 GMT cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 84997 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 content-length 1236 last-modified Thu, 03 Jun 2021 14:58:11 GMT server cloudflare etag "4d4-5c3ddcdc546c0" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SX4jAzN51f%2F%2F3B%2BhjVESE5Hhfn6Sjq%2FqWmqiNSMxf7Y39V801oGPSzU3b3mamON4VXg49ST1v4xd%2F%2FQOlPMzK5k9wkG0QtNOdyP1ZIjUW7kDw5pqwvddeaVF0x%2F9PjJ2gSigzEUiZmwPXDJZi5pUeu6Y"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=86400 accept-ranges bytes cf-ray 6b9e4cb95bb94a55-FRA
GET H2	200	more.png www.threatcrowd.org/img/	312 B 656 B	704ms 704ms	Image image/png	2606:4700:3038::6815:e9bd CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.threatcrowd.org/img/more.png Requested by Host: www.threatcrowd.org URL: https://www.threatcrowd.org/malware.php?md5=775a0631fb8229b2aa3d7621427085ad Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3038::6815:e9bd , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dbd0f9cc91a7186a7fb05493f7c8d5bcdac08e73796a9965aa7ab46a447097c4 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.threatcrowd.org/malware.php?md5=775a0631fb8229b2aa3d7621427085ad User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Tue, 07 Dec 2021 14:03:51 GMT cf-cache-status MISS last-modified Thu, 03 Jun 2021 14:58:11 GMT server cloudflare etag "138-5c3ddcdc546c0" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dLr2A%2Bt3n8IRV2qnaI9hSndyizKkJqsmWCWwZQQD8kzjqt%2BDFnOW8%2BtMj42jmTQ0XR43AN9h6p0%2F9S2KwJQtyqfg%2FrWjHIjF47j2EtPfUjx1qrN33Q%2FfrsWT0P0gWYhU52%2Bue9Zbzf4VoEHZ74cafR27"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=86400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} accept-ranges bytes cf-ray 6b9e4cb95bbf4a55-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 content-length 312
GET H2	200	open.png www.threatcrowd.org/img/	369 B 685 B	18ms 17ms	Image image/png	2606:4700:3038::6815:e9bd CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.threatcrowd.org/img/open.png Requested by Host: www.threatcrowd.org URL: https://www.threatcrowd.org/malware.php?md5=775a0631fb8229b2aa3d7621427085ad Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3038::6815:e9bd , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 028a212b9e4b667cc174ec165ed58dc7df2c8eb4ce4411c7f191dcf98e857627 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.threatcrowd.org/malware.php?md5=775a0631fb8229b2aa3d7621427085ad User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Tue, 07 Dec 2021 14:03:50 GMT cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 60830 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 content-length 369 last-modified Thu, 03 Jun 2021 14:58:11 GMT server cloudflare etag "171-5c3ddcdc546c0" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=C9dsNZkS2mhyyP6PKAPQ5BuvuncW4YR9bIvswQsPPFGwvrKj41%2BGVCkayk9SBlSQXgFSCZ21e3vR4ZICQGP%2BeUk0HTBVNZ1g5%2Brv2PElEblMfGSD4OJHaLJFkAdFNbzjM%2BKQWYSCMA3yfNPzZ1qS9NNO"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=86400 accept-ranges bytes cf-ray 6b9e4cb95bc04a55-FRA
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/1.11.1/	94 KB 33 KB	125ms 40ms	Script text/javascript	2a00:1450:4001:812::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/1.11.1/jquery.min.js Requested by Host: www.threatcrowd.org URL: https://www.threatcrowd.org/malware.php?md5=775a0631fb8229b2aa3d7621427085ad Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.threatcrowd.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Fri, 03 Dec 2021 17:39:16 GMT content-encoding gzip x-content-type-options nosniff age 332674 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 33434 x-xss-protection 0 last-modified Tue, 03 Mar 2020 19:15:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Sat, 03 Dec 2022 17:39:16 GMT
GET H2	200	bootstrap.min.js Show response www.threatcrowd.org/js/	35 KB 10 KB	20ms 19ms	Script application/javascript	2606:4700:3038::6815:e9bd CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.threatcrowd.org/js/bootstrap.min.js Requested by Host: www.threatcrowd.org URL: https://www.threatcrowd.org/malware.php?md5=775a0631fb8229b2aa3d7621427085ad Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3038::6815:e9bd , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f971b901aeb9e55b07d472afee09bd5ae05159e1119dbd16d993e473565e7fc0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.threatcrowd.org/malware.php?md5=775a0631fb8229b2aa3d7621427085ad User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Tue, 07 Dec 2021 14:03:50 GMT content-encoding br cf-cache-status HIT last-modified Thu, 03 Jun 2021 14:58:12 GMT server cloudflare age 8309 etag W/"8b11-5c3ddcdd48900-gzip" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XvDznnwx3K97z5XpmDez1XN40hibsWEmR3FYCxySExqEat%2FZa7fVSpnL4cp48VbCOvdrCLW8RniV3s5XAXuPtaJFPrIn92fZxqurnd0ole6a%2F9K3Bb4ViGA6h%2FfWN0uWgNSlvuo3MJF7mvOzPh9zivUI"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control max-age=86400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 6b9e4cb95bb14a55-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
GET H2	200	ie10-viewport-bug-workaround.js Show response www.threatcrowd.org/js/	694 B 742 B	19ms 18ms	Script application/javascript	2606:4700:3038::6815:e9bd CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.threatcrowd.org/js/ie10-viewport-bug-workaround.js Requested by Host: www.threatcrowd.org URL: https://www.threatcrowd.org/malware.php?md5=775a0631fb8229b2aa3d7621427085ad Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3038::6815:e9bd , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ce01c41255d7e61cc44e865184559085737a98cf6911ef67f915692152b88852 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.threatcrowd.org/malware.php?md5=775a0631fb8229b2aa3d7621427085ad User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Tue, 07 Dec 2021 14:03:50 GMT content-encoding br cf-cache-status HIT last-modified Thu, 03 Jun 2021 14:58:12 GMT server cloudflare age 60768 etag W/"2b6-5c3ddcdd48900-gzip" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1RgzA9lg9WM4UyfZKfGiwQ68lBgGxfGFDqM8TgUoSy5kUzNILcnlRZczTCuykbDVk7Dm3O0%2FIj6TmStHxdELUaBvwKpjoNXHaAj4WeNGqcZ%2FQyk2nd2u9AtQjb02%2FOgs9cYeQadb94wF8wKYuAo%2Fdk%2BY"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control max-age=86400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 6b9e4cb95bb74a55-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
GET H2	200	analytics.js Show response www.google-analytics.com/	49 KB 20 KB	125ms 39ms	Script text/javascript	2a00:1450:4001:808::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.threatcrowd.org URL: https://www.threatcrowd.org/malware.php?md5=775a0631fb8229b2aa3d7621427085ad Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.threatcrowd.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff last-modified Tue, 02 Nov 2021 17:39:06 GMT server Golfe2 age 3763 date Tue, 07 Dec 2021 13:01:07 GMT vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 20006 expires Tue, 07 Dec 2021 15:01:07 GMT
GET H3	200	graphHtml.php Show response www.threatcrowd.org/ Frame 3AA0	5 KB 3 KB	842ms 841ms	Document text/html	2606:4700:3038::6815:e9bd CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.threatcrowd.org/graphHtml.php?md5=775a0631fb8229b2aa3d7621427085ad Requested by Host: www.threatcrowd.org URL: https://www.threatcrowd.org/malware.php?md5=775a0631fb8229b2aa3d7621427085ad Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3038::6815:e9bd , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/7.1.33 Resource Hash 6573885b25613895f05c47df1ebbe3499f7781575b6f07ccb188a0123ff97676 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://www.threatcrowd.org/malware.php?md5=775a0631fb8229b2aa3d7621427085ad Response headers date Tue, 07 Dec 2021 14:03:51 GMT content-type text/html; charset=UTF-8 x-powered-by PHP/7.1.33 vary Accept-Encoding cache-control max-age=86400 cf-cache-status MISS last-modified Tue, 07 Dec 2021 14:03:51 GMT expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BojoJA69c6FM3TyOPllaEcrsZnTx%2FlegGhrQDP9ZDcevyQFvMmLwFo%2FUU5AKdxhEAkumGuFyWj%2Baz3vnAuLBpNSs%2FVEliHOJw7qL03%2BfMzXNZlXkIyuCba3hDAlFQcLk0c5f0LzjRjnWnBFDamf%2B0R%2BC"}],"group":"cf-nel","max_age":604800} nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare cf-ray 6b9e4cb9b869c2c7-FRA content-encoding br alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
GET H3	200	glyphicons-halflings-regular.woff2 maxcdn.bootstrapcdn.com/bootstrap/3.3.6/fonts/	18 KB 18 KB	34ms 23ms	Font font/woff2	2606:4700::6812:acf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://maxcdn.bootstrapcdn.com/bootstrap/3.3.6/fonts/glyphicons-halflings-regular.woff2 Requested by Host: maxcdn.bootstrapcdn.com URL: https://maxcdn.bootstrapcdn.com/bootstrap/3.3.6/css/bootstrap.min.css Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash fe185d11a49676890d47bb783312a0cda5a44c4039214094e7957b4c040ef11c Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://maxcdn.bootstrapcdn.com/bootstrap/3.3.6/css/bootstrap.min.css Origin https://www.threatcrowd.org Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Tue, 07 Dec 2021 14:03:50 GMT x-content-type-options nosniff cf-cache-status HIT cdn-edgestorageid 722, 718, 718 age 19728567 cdn-cachedat 2021-04-23 07:47:03 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 content-length 18028 timing-allow-origin * access-control-allow-origin * last-modified Mon, 25 Jan 2021 22:03:59 GMT server cloudflare cdn-requestpullcode 200 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type font/woff2 cdn-cache HIT vary Accept-Encoding cache-control public, max-age=31919000 cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cdn-requestid fc3aa93735fa2f5f1921a45a6b2cf4b8 accept-ranges bytes cf-ray 6b9e4cb9cf0b4de2-FRA cdn-requestcountrycode DE cdn-requestpullsuccess True
GET H/1.1	200 OK	embed.js Show response threatcrowd.disqus.com/	74 KB 24 KB	41ms 8ms	Script application/javascript	199.232.196.134 FASTLY
General Check archive.org Show headers Download Go to Full URL https://threatcrowd.disqus.com/embed.js Requested by Host: www.threatcrowd.org URL: https://www.threatcrowd.org/malware.php?md5=775a0631fb8229b2aa3d7621427085ad Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 199.232.196.134 , United States, ASN54113 (FASTLY, US), Reverse DNS Software openresty / Resource Hash 1f09169dd3f6ccdbe16d8ed36628a07ac6f3f8c4a7c270e2ca549eb85c5031b0 Security Headers Name Value Strict-Transport-Security max-age=300; includeSubdomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.threatcrowd.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Date Tue, 07 Dec 2021 14:03:50 GMT Content-Encoding gzip Server openresty Age 85 Vary Accept-Encoding Connection keep-alive Content-Type application/javascript; charset=utf-8 Cache-Control private, max-age=60 X-Service router_gunicorn Strict-Transport-Security max-age=300; includeSubdomains Link <https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect Content-Length 24577 Cross-Origin-Resource-Policy cross-origin
GET H2	200	lounge.3e33cc45b553fa4f7fd3dfc49dc03ed0.css c.disquscdn.com/next/embed/styles/	0 26 KB	61ms 8ms	Other text/css	2600:9000:21f3:f200:6:8656:f5c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://c.disquscdn.com/next/embed/styles/lounge.3e33cc45b553fa4f7fd3dfc49dc03ed0.css Requested by Host: threatcrowd.disqus.com URL: https://threatcrowd.disqus.com/embed.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:21f3:f200:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.threatcrowd.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 15 Nov 2021 19:07:46 GMT content-encoding gzip x-content-type-options nosniff age 1882564 x-cache Hit from cloudfront cross-origin-resource-policy cross-origin content-length 26056 x-xss-protection 1; mode=block x-served-by static-web-2 access-control-allow-origin * surrogate-key next last-modified Mon, 15 Nov 2021 18:51:03 GMT server nginx etag "6192ac17-65c8" content-type text/css; charset=utf-8 via 1.1 52f0756596448c36265861853c0a44a4.cloudfront.net (CloudFront) expires Tue, 15 Nov 2022 19:07:46 GMT cache-control max-age=31536000, public, immutable, no-transform x-amz-cf-pop FRA2-C2 timing-allow-origin * x-amz-cf-id Rnb7G-lM1m-oqrDwRFFxaP-RHcn_tCd_l7dWrDxS3lsLjtqgX3uXDw== x-cache-hits 0
GET H2	200	common.bundle.2f2f40d40785c9541a90e9086c8770a3.js c.disquscdn.com/next/embed/	0 93 KB	67ms 14ms	Other application/javascript	2600:9000:21f3:f200:6:8656:f5c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://c.disquscdn.com/next/embed/common.bundle.2f2f40d40785c9541a90e9086c8770a3.js Requested by Host: threatcrowd.disqus.com URL: https://threatcrowd.disqus.com/embed.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:21f3:f200:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.threatcrowd.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 25 Oct 2021 14:45:30 GMT content-encoding gzip x-content-type-options nosniff age 3712700 x-cache Hit from cloudfront cross-origin-resource-policy cross-origin content-length 94779 x-xss-protection 1; mode=block x-served-by static-web-2 access-control-allow-origin * surrogate-key next last-modified Fri, 22 Oct 2021 00:26:02 GMT server nginx etag "6172051a-1723b" content-type application/javascript; charset=utf-8 via 1.1 52f0756596448c36265861853c0a44a4.cloudfront.net (CloudFront) expires Tue, 25 Oct 2022 14:45:30 GMT cache-control max-age=31536000, public, immutable, no-transform x-amz-cf-pop FRA2-C2 timing-allow-origin * x-amz-cf-id TgmlHtFyIZ-orq4T5u5MYe017g8W3lt9R5zDDKnDP2GhYE5HCPhdNw== x-cache-hits 0
GET H2	200	lounge.bundle.a1463487bac02a7bb88bedf02c8655b7.js c.disquscdn.com/next/embed/	0 119 KB	75ms 22ms	Other application/javascript	2600:9000:21f3:f200:6:8656:f5c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://c.disquscdn.com/next/embed/lounge.bundle.a1463487bac02a7bb88bedf02c8655b7.js Requested by Host: threatcrowd.disqus.com URL: https://threatcrowd.disqus.com/embed.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:21f3:f200:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.threatcrowd.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Thu, 02 Dec 2021 21:36:51 GMT content-encoding gzip x-content-type-options nosniff age 404819 x-cache Hit from cloudfront cross-origin-resource-policy cross-origin content-length 120983 x-xss-protection 1; mode=block x-served-by static-web-1 access-control-allow-origin * surrogate-key next last-modified Thu, 02 Dec 2021 21:18:56 GMT server nginx etag "61a93840-1d897" content-type application/javascript; charset=utf-8 via 1.1 52f0756596448c36265861853c0a44a4.cloudfront.net (CloudFront) expires Fri, 02 Dec 2022 21:36:51 GMT cache-control max-age=31536000, public, immutable, no-transform x-amz-cf-pop FRA2-C2 timing-allow-origin * x-amz-cf-id qXcutYSwVUbvI8iwIcV1tPJZSW3NiaDLjX5dxsyPQaMf2kNiqpFZxg== x-cache-hits 0
GET H/1.1	200 OK	config.js disqus.com/next/	0 15 KB	35ms 6ms	Other application/javascript	151.101.0.134 FASTLY
General Check archive.org Show headers Download Go to Full URL https://disqus.com/next/config.js Requested by Host: threatcrowd.disqus.com URL: https://threatcrowd.disqus.com/embed.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.0.134 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=300; includeSubdomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.threatcrowd.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Date Tue, 07 Dec 2021 14:03:50 GMT X-Content-Type-Options nosniff Content-Type application/javascript; charset=UTF-8 Server nginx Age 54 X-Frame-Options SAMEORIGIN Strict-Transport-Security max-age=300; includeSubdomains p3p CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM" Access-Control-Allow-Origin * Cache-Control public, stale-while-revalidate=300, s-stalewhilerevalidate=3600, max-age=60 Cross-Origin-Resource-Policy cross-origin Connection keep-alive Timing-Allow-Origin * Content-Length 14500 X-XSS-Protection 1; mode=block
GET H/1.1	200 OK	recommendations.js Show response threatcrowd.disqus.com/	63 KB 21 KB	124ms 124ms	Script application/javascript	199.232.196.134 FASTLY
General Check archive.org Show headers Download Go to Full URL https://threatcrowd.disqus.com/recommendations.js Requested by Host: threatcrowd.disqus.com URL: https://threatcrowd.disqus.com/embed.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 199.232.196.134 , United States, ASN54113 (FASTLY, US), Reverse DNS Software openresty / Resource Hash 30cae7eb3e74cc4cc595bfa7e86cf31a926e37d12999ea3d03c879b667897df9 Security Headers Name Value Strict-Transport-Security max-age=300; includeSubdomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.threatcrowd.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Date Tue, 07 Dec 2021 14:03:50 GMT Content-Encoding gzip Server openresty Age 0 Vary Accept-Encoding, Accept, Accept-Encoding, X-Forwarded-Proto, X-Disqus-Shortname, X-Disqus-Device, X-Disqus-Experiment, X-Disqus-Is-Private, X-Disqus-Development-Base Connection keep-alive Content-Type application/javascript; charset=utf-8 Cache-Control stale-while-revalidate=60, public, stale-if-error=86400, max-age=60 X-Service router_gunicorn Strict-Transport-Security max-age=300; includeSubdomains Link <https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect Content-Length 20894 Cross-Origin-Resource-Policy cross-origin
POST H3	200	collect Show response www.google-analytics.com/j/	2 B 22 B	93ms 46ms	XHR text/plain	2a00:1450:4001:808::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j96&a=1790694126&t=pageview&_s=1&dl=https%3A%2F%2Fwww.threatcrowd.org%2Fmalware.php%3Fmd5%3D775a0631fb8229b2aa3d7621427085ad&ul=en-us&de=UTF-8&dt=Malware%20%3E%20775a0631fb8229b2aa3d7621427085ad%20%7C%20Threatcrowd.org%20Open%20Source%20Threat%20Intelligence&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAAC~&jid=1552554995&gjid=1319938801&cid=1513015680.1638885831&tid=UA-61293969-1&_gid=1207013657.1638885831&_r=1&_slc=1&z=1310563542 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.threatcrowd.org/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Tue, 07 Dec 2021 14:03:50 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.threatcrowd.org cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	/ Show response disqus.com/embed/comments/ Frame 786F	7 KB 4 KB	148ms 147ms	Document text/html	151.101.0.134 FASTLY
General Check archive.org Show headers Download Go to Full URL https://disqus.com/embed/comments/?base=default&f=threatcrowd&t_u=https%3A%2F%2Fwww.threatcrowd.org%2Fmalware.php%3Fmd5%3D775a0631fb8229b2aa3d7621427085ad&t_d=Malware%20%3E%20775a0631fb8229b2aa3d7621427085ad%20%7C%20Threatcrowd.org%20Open%20Source%20Threat%20Intelligence&t_t=Malware%20%3E%20775a0631fb8229b2aa3d7621427085ad%20%7C%20Threatcrowd.org%20Open%20Source%20Threat%20Intelligence&s_o=default Requested by Host: threatcrowd.disqus.com URL: https://threatcrowd.disqus.com/embed.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.0.134 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash f637562cd630cb159d362a4f05ec1f7ae7e1e97095d23ef57931bc20d7d55d3a Security Headers Name Value Content-Security-Policy script-src https://*.twitter.com:* https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://*.services.disqus.com:* https://cdn.boomtrain.com/p13n/ https://apis.google.com https://cdn.syndication.twimg.com/tweets.json https://connect.facebook.net/en_US/sdk.js https://referrer.disqus.com/juggler/ 'unsafe-inline' https://com-disqus.netmng.com:* https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com Strict-Transport-Security max-age=300; includeSubdomains X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://www.threatcrowd.org/ Response headers Connection keep-alive Content-Length 2802 Server nginx Content-Type text/html; charset=utf-8 Content-Security-Policy script-src https://*.twitter.com:* https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://*.services.disqus.com:* https://cdn.boomtrain.com/p13n/ https://apis.google.com https://cdn.syndication.twimg.com/tweets.json https://connect.facebook.net/en_US/sdk.js https://referrer.disqus.com/juggler/ 'unsafe-inline' https://com-disqus.netmng.com:* https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com Last-Modified Fri, 12 Nov 2021 03:23:29 GMT ETag W/"lounge:view:5842995345.b94f9a0a973da735eab3a4073f60ad62.2" Link <https://c.disquscdn.com>;rel=preconnect,<https://c.disquscdn.com>;rel=dns-prefetch Cache-Control stale-if-error=3600, s-stalewhilerevalidate=3600, stale-while-revalidate=30, no-cache, must-revalidate, public, s-maxage=5 p3p CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM" Referrer-Policy no-referrer-when-downgrade Timing-Allow-Origin * X-Content-Type-Options nosniff X-XSS-Protection 1; mode=block Content-Encoding gzip Date Tue, 07 Dec 2021 14:03:51 GMT Age 0 Vary Accept-Encoding Cross-Origin-Resource-Policy cross-origin Strict-Transport-Security max-age=300; includeSubdomains
GET H/1.1	200 OK	stat.gif referrer.disqus.com/juggler/	43 B 339 B	121ms 101ms	Image image/gif	199.232.196.134 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://referrer.disqus.com/juggler/stat.gif?event=lounge.loading.view Requested by Host: www.threatcrowd.org URL: https://www.threatcrowd.org/malware.php?md5=775a0631fb8229b2aa3d7621427085ad Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 199.232.196.134 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.threatcrowd.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Date Tue, 07 Dec 2021 14:03:50 GMT X-Content-Type-Options nosniff Last-Modified Mon, 28 Sep 1970 06:00:00 GMT Server nginx Content-Type image/gif Cross-Origin-Resource-Policy cross-origin Connection keep-alive Content-Length 43 X-XSS-Protection 1; mode=block
GET H2	200	disqus-social-icon-dark.a621bea3e02c9fa04fd3965a3d6f424d.svg c.disquscdn.com/next/embed/assets/img/	1 KB 2 KB	7ms 6ms	Image image/svg+xml	2600:9000:21f3:f200:6:8656:f5c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://c.disquscdn.com/next/embed/assets/img/disqus-social-icon-dark.a621bea3e02c9fa04fd3965a3d6f424d.svg Requested by Host: www.threatcrowd.org URL: https://www.threatcrowd.org/malware.php?md5=775a0631fb8229b2aa3d7621427085ad Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:21f3:f200:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash ad3d0ca410aa64d933c2853e39ef8b605c4815f9826bc0e721e3d3d93860bf64 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.threatcrowd.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Thu, 29 Apr 2021 07:52:30 GMT via 1.1 52f0756596448c36265861853c0a44a4.cloudfront.net (CloudFront) x-content-type-options nosniff age 19203080 x-cache Hit from cloudfront content-length 1042 x-xss-protection 1; mode=block x-served-by static-web-1 surrogate-key next last-modified Wed, 28 Apr 2021 21:48:08 GMT server nginx etag "6089d818-412" content-type image/svg+xml; charset=utf-8 access-control-allow-origin * expires Fri, 29 Apr 2022 07:52:30 GMT cache-control max-age=31536000, public, immutable, no-transform x-amz-cf-pop FRA2-C2 accept-ranges bytes timing-allow-origin * x-amz-cf-id -W4bWLs6Pk18MyBriKknAyfM4jelyeQViXP15D81fnQVjLw0cg9ezg== x-cache-hits 0
GET H2	200	recommendations.10022a97346f1c6e3798931bbd8e4bb5.css c.disquscdn.com/next/recommendations/styles/	0 3 KB	8ms 7ms	Other text/css	2600:9000:21f3:f200:6:8656:f5c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://c.disquscdn.com/next/recommendations/styles/recommendations.10022a97346f1c6e3798931bbd8e4bb5.css Requested by Host: threatcrowd.disqus.com URL: https://threatcrowd.disqus.com/recommendations.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:21f3:f200:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.threatcrowd.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 18 Oct 2021 21:23:26 GMT content-encoding gzip x-content-type-options nosniff age 4293623 x-cache Hit from cloudfront content-length 2978 x-xss-protection 1; mode=block x-served-by static-web-1 access-control-allow-origin * surrogate-key next last-modified Mon, 18 Oct 2021 21:05:37 GMT server nginx etag "616de1a1-ba2" content-type text/css; charset=utf-8 via 1.1 52f0756596448c36265861853c0a44a4.cloudfront.net (CloudFront) expires Tue, 18 Oct 2022 21:23:26 GMT cache-control max-age=31536000, public, immutable, no-transform x-amz-cf-pop FRA2-C2 timing-allow-origin * x-amz-cf-id K_6ZHE2GLpQJsyqHkwvxdbvoBH5OyexPwaozjCyym-B5Pi74iQce-w== x-cache-hits 0
GET H2	200	common.bundle.6c6defcc206edabe5048d82459ee0a0e.js c.disquscdn.com/next/recommendations/	0 87 KB	9ms 8ms	Other application/javascript	2600:9000:21f3:f200:6:8656:f5c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://c.disquscdn.com/next/recommendations/common.bundle.6c6defcc206edabe5048d82459ee0a0e.js Requested by Host: threatcrowd.disqus.com URL: https://threatcrowd.disqus.com/recommendations.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:21f3:f200:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.threatcrowd.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 18 Oct 2021 21:23:25 GMT content-encoding gzip x-content-type-options nosniff age 4293625 x-cache Hit from cloudfront content-length 88862 x-xss-protection 1; mode=block x-served-by static-web-2 access-control-allow-origin * surrogate-key next last-modified Mon, 18 Oct 2021 21:05:37 GMT server nginx etag "616de1a1-15b1e" content-type application/javascript; charset=utf-8 via 1.1 52f0756596448c36265861853c0a44a4.cloudfront.net (CloudFront) expires Tue, 18 Oct 2022 21:23:25 GMT cache-control max-age=31536000, public, immutable, no-transform x-amz-cf-pop FRA2-C2 timing-allow-origin * x-amz-cf-id oDXEsQlNdweMqMMoZ_DKy9qWgixbI3OyKPwYFfpZdKOIR-8gx7sfHQ== x-cache-hits 0
GET H2	200	recommendations.bundle.926bc472e4859a48daa346b4ba2ab4f4.js c.disquscdn.com/next/recommendations/	0 20 KB	11ms 10ms	Other application/javascript	2600:9000:21f3:f200:6:8656:f5c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://c.disquscdn.com/next/recommendations/recommendations.bundle.926bc472e4859a48daa346b4ba2ab4f4.js Requested by Host: threatcrowd.disqus.com URL: https://threatcrowd.disqus.com/recommendations.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:21f3:f200:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.threatcrowd.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 11 Oct 2021 20:25:43 GMT content-encoding gzip x-content-type-options nosniff age 4901887 x-cache Hit from cloudfront content-length 20244 x-xss-protection 1; mode=block x-served-by static-web-1 access-control-allow-origin * surrogate-key next last-modified Mon, 11 Oct 2021 20:15:56 GMT server nginx etag "61649b7c-4f14" content-type application/javascript; charset=utf-8 via 1.1 52f0756596448c36265861853c0a44a4.cloudfront.net (CloudFront) expires Tue, 11 Oct 2022 20:25:43 GMT cache-control max-age=31536000, public, immutable, no-transform x-amz-cf-pop FRA2-C2 timing-allow-origin * x-amz-cf-id _p49PJOm8wXDdMxQ-QTCt0OgThxzKNdI2ax9i7WvGwjzRbyWZ-Reeg== x-cache-hits 0
GET H/1.1	200 OK	/ Show response disqus.com/recommendations/ Frame 2B4E	5 KB 3 KB	118ms 111ms	Document text/html	151.101.0.134 FASTLY
General Check archive.org Show headers Download Go to Full URL https://disqus.com/recommendations/?base=default&f=threatcrowd&t_u=https%3A%2F%2Fwww.threatcrowd.org%2Fmalware.php%3Fmd5%3D775a0631fb8229b2aa3d7621427085ad&t_d=Malware%20%3E%20775a0631fb8229b2aa3d7621427085ad%20%7C%20Threatcrowd.org%20Open%20Source%20Threat%20Intelligence&t_t=Malware%20%3E%20775a0631fb8229b2aa3d7621427085ad%20%7C%20Threatcrowd.org%20Open%20Source%20Threat%20Intelligence Requested by Host: threatcrowd.disqus.com URL: https://threatcrowd.disqus.com/recommendations.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.0.134 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 45b32ec16faef8716afaf107857ddf9df97812b24f63c55cf531fe4a8ffd61aa Security Headers Name Value Content-Security-Policy script-src https://*.twitter.com:* https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://*.services.disqus.com:* https://cdn.boomtrain.com/p13n/ https://apis.google.com https://cdn.syndication.twimg.com/tweets.json https://connect.facebook.net/en_US/sdk.js https://referrer.disqus.com/juggler/ 'unsafe-inline' https://com-disqus.netmng.com:* https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com Strict-Transport-Security max-age=300; includeSubdomains X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://www.threatcrowd.org/ Response headers Connection keep-alive Content-Length 2312 Server nginx Content-Type text/html; charset=utf-8 Content-Security-Policy script-src https://*.twitter.com:* https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://*.services.disqus.com:* https://cdn.boomtrain.com/p13n/ https://apis.google.com https://cdn.syndication.twimg.com/tweets.json https://connect.facebook.net/en_US/sdk.js https://referrer.disqus.com/juggler/ 'unsafe-inline' https://com-disqus.netmng.com:* https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com Last-Modified Mon, 27 Sep 2021 07:24:14 GMT Link <https://c.disquscdn.com>;rel=preconnect,<https://c.disquscdn.com>;rel=dns-prefetch Cache-Control stale-while-revalidate=30, no-cache, must-revalidate, stale-if-error=3600, public p3p CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM" Timing-Allow-Origin * X-Content-Type-Options nosniff X-XSS-Protection 1; mode=block Content-Encoding gzip Date Tue, 07 Dec 2021 14:03:51 GMT Age 0 Vary Accept-Encoding Cross-Origin-Resource-Policy cross-origin Strict-Transport-Security max-age=300; includeSubdomains
GET H2	200	lounge.load.f9aa8968fec2e67d862a125a099cd4d4.js Show response c.disquscdn.com/next/embed/ Frame 786F	958 B 1 KB	25ms 7ms	Script application/javascript	2600:9000:21f3:f200:6:8656:f5c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://c.disquscdn.com/next/embed/lounge.load.f9aa8968fec2e67d862a125a099cd4d4.js Requested by Host: disqus.com URL: https://disqus.com/embed/comments/?base=default&f=threatcrowd&t_u=https%3A%2F%2Fwww.threatcrowd.org%2Fmalware.php%3Fmd5%3D775a0631fb8229b2aa3d7621427085ad&t_d=Malware%20%3E%20775a0631fb8229b2aa3d7621427085ad%20%7C%20Threatcrowd.org%20Open%20Source%20Threat%20Intelligence&t_t=Malware%20%3E%20775a0631fb8229b2aa3d7621427085ad%20%7C%20Threatcrowd.org%20Open%20Source%20Threat%20Intelligence&s_o=default Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:21f3:f200:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash bbd322e618c695d3e0b6ad39ce9f619178208ff4dcd3f49fb974fba64f268d5e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://disqus.com/embed/comments/?base=default&f=threatcrowd&t_u=https%3A%2F%2Fwww.threatcrowd.org%2Fmalware.php%3Fmd5%3D775a0631fb8229b2aa3d7621427085ad&t_d=Malware%20%3E%20775a0631fb8229b2aa3d7621427085ad%20%7C%20Threatcrowd.org%20Open%20Source%20Threat%20Intelligence&t_t=Malware%20%3E%20775a0631fb8229b2aa3d7621427085ad%20%7C%20Threatcrowd.org%20Open%20Source%20Threat%20Intelligence&s_o=default Origin https://disqus.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Thu, 02 Dec 2021 21:36:51 GMT content-encoding gzip x-content-type-options nosniff age 404820 x-cache Hit from cloudfront cross-origin-resource-policy cross-origin content-length 494 x-xss-protection 1; mode=block x-served-by static-web-1 access-control-allow-origin * surrogate-key next last-modified Thu, 02 Dec 2021 21:18:56 GMT server nginx etag "61a93840-1ee" content-type application/javascript; charset=utf-8 via 1.1 1e498d046330e15095a1a2a958463bf5.cloudfront.net (CloudFront) expires Fri, 02 Dec 2022 21:36:51 GMT cache-control max-age=31536000, public, immutable, no-transform x-amz-cf-pop FRA2-C2 timing-allow-origin * x-amz-cf-id XKDnna7DKxsfRJUxrU_gkXvSfXOXLfiaj8LJEuFEEUpOdsFjkYtm6Q== x-cache-hits 0
GET H2	200	common.bundle.2f2f40d40785c9541a90e9086c8770a3.js Show response c.disquscdn.com/next/embed/ Frame 786F	282 KB 93 KB	8ms 7ms	Script application/javascript	2600:9000:21f3:f200:6:8656:f5c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://c.disquscdn.com/next/embed/common.bundle.2f2f40d40785c9541a90e9086c8770a3.js Requested by Host: c.disquscdn.com URL: https://c.disquscdn.com/next/embed/lounge.load.f9aa8968fec2e67d862a125a099cd4d4.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:21f3:f200:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 4d958aa0fe56b2c9ef407522721c72a3f0ac4f0ae063a2e2d05c134b7a79fa85 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://disqus.com/embed/comments/?base=default&f=threatcrowd&t_u=https%3A%2F%2Fwww.threatcrowd.org%2Fmalware.php%3Fmd5%3D775a0631fb8229b2aa3d7621427085ad&t_d=Malware%20%3E%20775a0631fb8229b2aa3d7621427085ad%20%7C%20Threatcrowd.org%20Open%20Source%20Threat%20Intelligence&t_t=Malware%20%3E%20775a0631fb8229b2aa3d7621427085ad%20%7C%20Threatcrowd.org%20Open%20Source%20Threat%20Intelligence&s_o=default User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 25 Oct 2021 14:45:30 GMT content-encoding gzip x-content-type-options nosniff age 3712701 x-cache Hit from cloudfront cross-origin-resource-policy cross-origin content-length 94779 x-xss-protection 1; mode=block x-served-by static-web-2 access-control-allow-origin * surrogate-key next last-modified Fri, 22 Oct 2021 00:26:02 GMT server nginx etag "6172051a-1723b" content-type application/javascript; charset=utf-8 via 1.1 52f0756596448c36265861853c0a44a4.cloudfront.net (CloudFront) expires Tue, 25 Oct 2022 14:45:30 GMT cache-control max-age=31536000, public, immutable, no-transform x-amz-cf-pop FRA2-C2 timing-allow-origin * x-amz-cf-id EUZK9GYTrSMeGJ8Rl0hjV8TDNrIo-0LQCQCYf3HmuyMJdTMdCqkxLQ== x-cache-hits 0
GET H2	200	lounge.3e33cc45b553fa4f7fd3dfc49dc03ed0.css c.disquscdn.com/next/embed/styles/ Frame 786F	165 KB 26 KB	7ms 7ms	Stylesheet text/css	2600:9000:21f3:f200:6:8656:f5c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://c.disquscdn.com/next/embed/styles/lounge.3e33cc45b553fa4f7fd3dfc49dc03ed0.css Requested by Host: c.disquscdn.com URL: https://c.disquscdn.com/next/embed/common.bundle.2f2f40d40785c9541a90e9086c8770a3.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:21f3:f200:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash c75c66b89e1d714edc8d57056b6ac260d52b273b801482e5795870bc295c89d3 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://disqus.com/embed/comments/?base=default&f=threatcrowd&t_u=https%3A%2F%2Fwww.threatcrowd.org%2Fmalware.php%3Fmd5%3D775a0631fb8229b2aa3d7621427085ad&t_d=Malware%20%3E%20775a0631fb8229b2aa3d7621427085ad%20%7C%20Threatcrowd.org%20Open%20Source%20Threat%20Intelligence&t_t=Malware%20%3E%20775a0631fb8229b2aa3d7621427085ad%20%7C%20Threatcrowd.org%20Open%20Source%20Threat%20Intelligence&s_o=default User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 15 Nov 2021 19:07:46 GMT content-encoding gzip x-content-type-options nosniff age 1882565 x-cache Hit from cloudfront cross-origin-resource-policy cross-origin content-length 26056 x-xss-protection 1; mode=block x-served-by static-web-2 access-control-allow-origin * surrogate-key next last-modified Mon, 15 Nov 2021 18:51:03 GMT server nginx etag "6192ac17-65c8" content-type text/css; charset=utf-8 via 1.1 52f0756596448c36265861853c0a44a4.cloudfront.net (CloudFront) expires Tue, 15 Nov 2022 19:07:46 GMT cache-control max-age=31536000, public, immutable, no-transform x-amz-cf-pop FRA2-C2 timing-allow-origin * x-amz-cf-id ZtVw29NBT8X0d9CudTEt6ECCoap7-aFHDa0MbT9A9Ov7RY-KTC3k9g== x-cache-hits 0
GET H2	200	lounge.bundle.a1463487bac02a7bb88bedf02c8655b7.js Show response c.disquscdn.com/next/embed/ Frame 786F	469 KB 119 KB	8ms 8ms	Script application/javascript	2600:9000:21f3:f200:6:8656:f5c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://c.disquscdn.com/next/embed/lounge.bundle.a1463487bac02a7bb88bedf02c8655b7.js Requested by Host: c.disquscdn.com URL: https://c.disquscdn.com/next/embed/common.bundle.2f2f40d40785c9541a90e9086c8770a3.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:21f3:f200:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 10a1ecbce93715b632bb5e17ccef7c09ea31d67f8c963d8cccb7d460b5b9e170 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://disqus.com/embed/comments/?base=default&f=threatcrowd&t_u=https%3A%2F%2Fwww.threatcrowd.org%2Fmalware.php%3Fmd5%3D775a0631fb8229b2aa3d7621427085ad&t_d=Malware%20%3E%20775a0631fb8229b2aa3d7621427085ad%20%7C%20Threatcrowd.org%20Open%20Source%20Threat%20Intelligence&t_t=Malware%20%3E%20775a0631fb8229b2aa3d7621427085ad%20%7C%20Threatcrowd.org%20Open%20Source%20Threat%20Intelligence&s_o=default User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Thu, 02 Dec 2021 21:36:51 GMT content-encoding gzip x-content-type-options nosniff age 404820 x-cache Hit from cloudfront cross-origin-resource-policy cross-origin content-length 120983 x-xss-protection 1; mode=block x-served-by static-web-1 access-control-allow-origin * surrogate-key next last-modified Thu, 02 Dec 2021 21:18:56 GMT server nginx etag "61a93840-1d897" content-type application/javascript; charset=utf-8 via 1.1 52f0756596448c36265861853c0a44a4.cloudfront.net (CloudFront) expires Fri, 02 Dec 2022 21:36:51 GMT cache-control max-age=31536000, public, immutable, no-transform x-amz-cf-pop FRA2-C2 timing-allow-origin * x-amz-cf-id URDoPFTsbhhNAYfnmlo6VuKHXy-JEBXqPxQJDmPn86UCi0cuOIxj9Q== x-cache-hits 0
GET H/1.1	200 OK	config.js Show response disqus.com/next/ Frame 786F	14 KB 15 KB	7ms 7ms	Script application/javascript	151.101.0.134 FASTLY
General Check archive.org Show headers Download Go to Full URL https://disqus.com/next/config.js Requested by Host: c.disquscdn.com URL: https://c.disquscdn.com/next/embed/common.bundle.2f2f40d40785c9541a90e9086c8770a3.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.0.134 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash f8b30a2aaa19326c2f546b8e22134512c9e5486fa6fec2f0d1c8ca2bbc8acb04 Security Headers Name Value Strict-Transport-Security max-age=300; includeSubdomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://disqus.com/embed/comments/?base=default&f=threatcrowd&t_u=https%3A%2F%2Fwww.threatcrowd.org%2Fmalware.php%3Fmd5%3D775a0631fb8229b2aa3d7621427085ad&t_d=Malware%20%3E%20775a0631fb8229b2aa3d7621427085ad%20%7C%20Threatcrowd.org%20Open%20Source%20Threat%20Intelligence&t_t=Malware%20%3E%20775a0631fb8229b2aa3d7621427085ad%20%7C%20Threatcrowd.org%20Open%20Source%20Threat%20Intelligence&s_o=default User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Date Tue, 07 Dec 2021 14:03:51 GMT X-Content-Type-Options nosniff Content-Type application/javascript; charset=UTF-8 Server nginx Age 54 X-Frame-Options SAMEORIGIN Strict-Transport-Security max-age=300; includeSubdomains p3p CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM" Access-Control-Allow-Origin * Cache-Control public, stale-while-revalidate=300, s-stalewhilerevalidate=3600, max-age=60 Cross-Origin-Resource-Policy cross-origin Connection keep-alive Timing-Allow-Origin * Content-Length 14500 X-XSS-Protection 1; mode=block
GET H/1.1	200 OK	details Show response disqus.com/api/3.0/forums/ Frame 786F	3 KB 3 KB	108ms 108ms	XHR application/json	151.101.0.134 FASTLY
General Check archive.org Show headers Download Go to Full URL https://disqus.com/api/3.0/forums/details?forum=threatcrowd&attach=forumFeatures&api_key=E8Uh5l5fHZ6gD8U3KycjAIAk46f68Zw7C6eW8WSjZvCLXebZ7p0r1yrYDrLilk2F Requested by Host: c.disquscdn.com URL: https://c.disquscdn.com/next/embed/common.bundle.2f2f40d40785c9541a90e9086c8770a3.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.0.134 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash da047bd41ed3a6a24b5dd5b0575e6f9a8ea8a16b73a56b448b78cd53e74c29b7 Security Headers Name Value Strict-Transport-Security max-age=300; includeSubdomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept */* Referer https://disqus.com/embed/comments/?base=default&f=threatcrowd&t_u=https%3A%2F%2Fwww.threatcrowd.org%2Fmalware.php%3Fmd5%3D775a0631fb8229b2aa3d7621427085ad&t_d=Malware%20%3E%20775a0631fb8229b2aa3d7621427085ad%20%7C%20Threatcrowd.org%20Open%20Source%20Threat%20Intelligence&t_t=Malware%20%3E%20775a0631fb8229b2aa3d7621427085ad%20%7C%20Threatcrowd.org%20Open%20Source%20Threat%20Intelligence&s_o=default X-Requested-With XMLHttpRequest Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Date Tue, 07 Dec 2021 14:03:51 GMT X-Content-Type-Options nosniff Server nginx Age 0 X-Frame-Options SAMEORIGIN Strict-Transport-Security max-age=300; includeSubdomains p3p CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM" Cross-Origin-Resource-Policy cross-origin Connection keep-alive Content-Type application/json Vary Origin, Cookie Content-Length 3081 X-XSS-Protection 1; mode=block
GET H2	200	recommendations.load.42dfcc5041eed24b84f85a10a88fa215.js Show response c.disquscdn.com/next/recommendations/ Frame 2B4E	923 B 1017 B	8ms 7ms	Script application/javascript	2600:9000:21f3:f200:6:8656:f5c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://c.disquscdn.com/next/recommendations/recommendations.load.42dfcc5041eed24b84f85a10a88fa215.js Requested by Host: disqus.com URL: https://disqus.com/recommendations/?base=default&f=threatcrowd&t_u=https%3A%2F%2Fwww.threatcrowd.org%2Fmalware.php%3Fmd5%3D775a0631fb8229b2aa3d7621427085ad&t_d=Malware%20%3E%20775a0631fb8229b2aa3d7621427085ad%20%7C%20Threatcrowd.org%20Open%20Source%20Threat%20Intelligence&t_t=Malware%20%3E%20775a0631fb8229b2aa3d7621427085ad%20%7C%20Threatcrowd.org%20Open%20Source%20Threat%20Intelligence Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:21f3:f200:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash f2bfdbf7d2df8d37016a17d53674d2799bb77996a763bf2bee8b1f604dd31a9f Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://disqus.com/ Origin https://disqus.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 18 Oct 2021 21:23:25 GMT content-encoding gzip x-content-type-options nosniff age 4293625 x-cache Hit from cloudfront content-length 446 x-xss-protection 1; mode=block x-served-by static-web-1 access-control-allow-origin * surrogate-key next last-modified Mon, 18 Oct 2021 21:05:37 GMT server nginx etag "616de1a1-1be" content-type application/javascript; charset=utf-8 via 1.1 1e498d046330e15095a1a2a958463bf5.cloudfront.net (CloudFront) expires Tue, 18 Oct 2022 21:23:25 GMT cache-control max-age=31536000, public, immutable, no-transform x-amz-cf-pop FRA2-C2 timing-allow-origin * x-amz-cf-id l7Yipys0M6RhH8vLGXEgz6xCt2nWdJKHhPCUBdI0-m9Lhf7kohayhg== x-cache-hits 0
GET H2	200	noavatar92.png a.disquscdn.com/1638362134/images/ Frame 786F	2 KB 2 KB	35ms 7ms	Image image/png	199.232.194.49 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://a.disquscdn.com/1638362134/images/noavatar92.png Requested by Host: www.threatcrowd.org URL: https://www.threatcrowd.org/malware.php?md5=775a0631fb8229b2aa3d7621427085ad Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 199.232.194.49 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 36ef66124133ca33c8b44c487293c3180e5ab681ff3cad3c728ea4f894ec3444 Security Headers Name Value Strict-Transport-Security max-age=300; includeSubdomains X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://disqus.com/embed/comments/?base=default&f=threatcrowd&t_u=https%3A%2F%2Fwww.threatcrowd.org%2Fmalware.php%3Fmd5%3D775a0631fb8229b2aa3d7621427085ad&t_d=Malware%20%3E%20775a0631fb8229b2aa3d7621427085ad%20%7C%20Threatcrowd.org%20Open%20Source%20Threat%20Intelligence&t_t=Malware%20%3E%20775a0631fb8229b2aa3d7621427085ad%20%7C%20Threatcrowd.org%20Open%20Source%20Threat%20Intelligence&s_o=default User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Tue, 07 Dec 2021 14:03:51 GMT x-content-type-options nosniff last-modified Fri, 26 Feb 2021 20:50:09 GMT server nginx age 512001 etag "60395f01-66c" strict-transport-security max-age=300; includeSubdomains content-type image/png x-xss-protection 1; mode=block cache-control max-age=2592000 cross-origin-resource-policy cross-origin x-amz-cf-pop FRA50-C1 content-length 1644 x-amz-cf-id APmDevLyHkJfIfV69eCenISof8FU3al6t5kA5RLiVg1JUA2JqC3dBw== expires Fri, 31 Dec 2021 15:50:30 GMT
GET DATA	200 OK	truncated / Frame 786F	37 B 0		Image image/gif
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Content-Type image/gif
GET H2	200	svg-sprite.4da5413f5086c5755b46094b813dbfcd.svg c.disquscdn.com/next/embed/assets/img/ Frame 786F	13 KB 13 KB	10ms 10ms	Image image/svg+xml	2600:9000:21f3:f200:6:8656:f5c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://c.disquscdn.com/next/embed/assets/img/svg-sprite.4da5413f5086c5755b46094b813dbfcd.svg Requested by Host: c.disquscdn.com URL: https://c.disquscdn.com/next/embed/styles/lounge.3e33cc45b553fa4f7fd3dfc49dc03ed0.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:21f3:f200:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 3270642c89180c12db93775e2a774b6dadd9bd98cffc963075c85afd2c17b6e4 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://c.disquscdn.com/next/embed/styles/lounge.3e33cc45b553fa4f7fd3dfc49dc03ed0.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 28 Apr 2021 14:37:41 GMT via 1.1 52f0756596448c36265861853c0a44a4.cloudfront.net (CloudFront) x-content-type-options nosniff age 19265170 x-cache Hit from cloudfront content-length 13079 x-xss-protection 1; mode=block x-served-by static-web-1 surrogate-key next last-modified Tue, 27 Apr 2021 21:01:56 GMT server nginx etag "60887bc4-3317" content-type image/svg+xml; charset=utf-8 access-control-allow-origin * expires Thu, 28 Apr 2022 14:37:41 GMT cache-control max-age=31536000, public, immutable, no-transform x-amz-cf-pop FRA2-C2 accept-ranges bytes timing-allow-origin * x-amz-cf-id O_Y6pySX6Gv0mp5Semqj_-a3S-4fljwqM7ixa7NjuEVbwN59PaY0lQ== x-cache-hits 0
GET H2	200	loader.ba7c86e8b4b6135bb668d05223f8f127.gif c.disquscdn.com/next/embed/assets/img/ Frame 786F	3 KB 3 KB	10ms 10ms	Image image/gif	2600:9000:21f3:f200:6:8656:f5c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://c.disquscdn.com/next/embed/assets/img/loader.ba7c86e8b4b6135bb668d05223f8f127.gif Requested by Host: c.disquscdn.com URL: https://c.disquscdn.com/next/embed/styles/lounge.3e33cc45b553fa4f7fd3dfc49dc03ed0.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:21f3:f200:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 4c4491dcfa94cb46fb73742fc2caf49a1cd59027304af1830c7dc6ce1889857c Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://c.disquscdn.com/next/embed/styles/lounge.3e33cc45b553fa4f7fd3dfc49dc03ed0.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 03 Feb 2021 04:58:07 GMT via 1.1 52f0756596448c36265861853c0a44a4.cloudfront.net (CloudFront) x-content-type-options nosniff age 26557544 x-cache Hit from cloudfront content-length 2971 x-xss-protection 1; mode=block x-served-by static-web-2 surrogate-key next last-modified Wed, 27 Jan 2021 17:23:07 GMT server nginx etag "6011a17b-b9b" content-type image/gif access-control-allow-origin * expires Thu, 03 Feb 2022 04:58:07 GMT cache-control max-age=31536000, public, immutable, no-transform x-amz-cf-pop FRA2-C2 accept-ranges bytes timing-allow-origin * x-amz-cf-id 2AFyt08J3H0gqsnBA7at0-H43Kqirqzu_mx1GcNjJooZfzTVVv8Rlw== x-cache-hits 0
GET H2	200	sprite.ad630a07080a45451f139a7487853ff8.png c.disquscdn.com/next/embed/assets/img/ Frame 786F	2 KB 2 KB	10ms 10ms	Image image/png	2600:9000:21f3:f200:6:8656:f5c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://c.disquscdn.com/next/embed/assets/img/sprite.ad630a07080a45451f139a7487853ff8.png Requested by Host: c.disquscdn.com URL: https://c.disquscdn.com/next/embed/styles/lounge.3e33cc45b553fa4f7fd3dfc49dc03ed0.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:21f3:f200:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 9714221c828961b20f45a782c3281c0596f6652cfe1299bee18097f98e8fb7b3 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://c.disquscdn.com/next/embed/styles/lounge.3e33cc45b553fa4f7fd3dfc49dc03ed0.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 22 Sep 2021 19:47:48 GMT via 1.1 52f0756596448c36265861853c0a44a4.cloudfront.net (CloudFront) x-content-type-options nosniff age 6545763 x-cache Hit from cloudfront content-length 1763 x-xss-protection 1; mode=block x-served-by static-web-1 surrogate-key next last-modified Wed, 22 Sep 2021 19:30:27 GMT server nginx etag "614b8453-6e3" content-type image/png access-control-allow-origin * expires Thu, 22 Sep 2022 19:47:48 GMT cache-control max-age=31536000, public, immutable, no-transform x-amz-cf-pop FRA2-C2 accept-ranges bytes timing-allow-origin * x-amz-cf-id vPXNe6ZHJ9bKfeUaRY4i2GXlo3Z9FrzKzO7EF8GbTxnxy9NSTY2DDw== x-cache-hits 0
GET H2	200	icons.4cc7a703d2fdfe684151ff8ac24d45f1.woff2 c.disquscdn.com/next/embed/assets/font/ Frame 786F	8 KB 8 KB	10ms 10ms	Font application/octet-stream	2600:9000:21f3:f200:6:8656:f5c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://c.disquscdn.com/next/embed/assets/font/icons.4cc7a703d2fdfe684151ff8ac24d45f1.woff2 Requested by Host: c.disquscdn.com URL: https://c.disquscdn.com/next/embed/styles/lounge.3e33cc45b553fa4f7fd3dfc49dc03ed0.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:21f3:f200:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash f2a341fc815d45c21da726d4c843c2c5d3e1f333465347c3c75d040d556df4e5 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://c.disquscdn.com/next/embed/styles/lounge.3e33cc45b553fa4f7fd3dfc49dc03ed0.css Origin https://disqus.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Sep 2021 09:58:18 GMT via 1.1 1e498d046330e15095a1a2a958463bf5.cloudfront.net (CloudFront) x-content-type-options nosniff age 8395533 x-cache Hit from cloudfront content-length 7900 x-xss-protection 1; mode=block x-served-by static-web-2 surrogate-key next last-modified Tue, 24 Aug 2021 21:06:44 GMT server nginx etag "61255f64-1edc" content-type application/octet-stream access-control-allow-origin * expires Thu, 01 Sep 2022 09:58:18 GMT cache-control max-age=31536000, public, immutable, no-transform x-amz-cf-pop FRA2-C2 accept-ranges bytes timing-allow-origin * x-amz-cf-id hM9VASQBOdTWoJfDXwfu9qF0Df6cMlKhAWWoOozBedFJMv7tP-GU2Q== x-cache-hits 0
GET H2	200	alfie_v4.63f1ab6d6b9d5807dc0c94ef3fe0b851.js Show response c.disquscdn.com/next/embed/	78 KB 27 KB	8ms 7ms	Script application/javascript	2600:9000:21f3:f200:6:8656:f5c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://c.disquscdn.com/next/embed/alfie_v4.63f1ab6d6b9d5807dc0c94ef3fe0b851.js Requested by Host: threatcrowd.disqus.com URL: https://threatcrowd.disqus.com/embed.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:21f3:f200:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 9efb3d5e1b082a66bd94908b42afb4cf6fe0e8eb8f50b8d2a18f6a5da03e6a18 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.threatcrowd.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 05 May 2021 15:25:30 GMT content-encoding gzip x-content-type-options nosniff age 18657501 x-cache Hit from cloudfront content-length 26578 x-xss-protection 1; mode=block x-served-by static-web-2 access-control-allow-origin * surrogate-key next last-modified Wed, 28 Apr 2021 21:48:08 GMT server nginx etag "6089d818-67d2" content-type application/javascript; charset=utf-8 via 1.1 52f0756596448c36265861853c0a44a4.cloudfront.net (CloudFront) expires Thu, 05 May 2022 15:25:30 GMT cache-control max-age=31536000, public, immutable, no-transform x-amz-cf-pop FRA2-C2 timing-allow-origin * x-amz-cf-id -WDFnwfBu4wqPPwqB-k4i18IgmrYGNyniRdYT26omFJc8xXYdd1itw== x-cache-hits 0
GET H/1.1	200 OK	event.js Show response referrer.disqus.com/juggler/ Frame 786F	40 B 322 B	99ms 99ms	Script application/javascript	199.232.196.134 FASTLY
General Check archive.org Show headers Download Go to Full URL https://referrer.disqus.com/juggler/event.js?experiment=network_default_hidden&variant=fallthrough&page_referrer=direct&product=embed&thread=5842995345&thread_id=5842995345&forum=threatcrowd&forum_id=3570221&zone=thread&page_url=https%3A%2F%2Fwww.threatcrowd.org%2Fmalware.php%3Fmd5%3D775a0631fb8229b2aa3d7621427085ad&service=dynamic&verb=view&object_type=product&object_id=embed&extra_data=%7B%22color_scheme%22%3A%22light%22%2C%22anchor_color%22%3A%22rgb(0%2C179%2C217)%22%2C%22typeface%22%3A%22sans-serif%22%2C%22width%22%3A560%7D&event=activity&imp=87cd8bc1c4md6m&section=default&area=n%2Fa Requested by Host: c.disquscdn.com URL: https://c.disquscdn.com/next/embed/common.bundle.2f2f40d40785c9541a90e9086c8770a3.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 199.232.196.134 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash f5627ea74eac809576ae16667ed7522b8dff46df48c38d9452dbe2eb208d2eef Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://disqus.com/embed/comments/?base=default&f=threatcrowd&t_u=https%3A%2F%2Fwww.threatcrowd.org%2Fmalware.php%3Fmd5%3D775a0631fb8229b2aa3d7621427085ad&t_d=Malware%20%3E%20775a0631fb8229b2aa3d7621427085ad%20%7C%20Threatcrowd.org%20Open%20Source%20Threat%20Intelligence&t_t=Malware%20%3E%20775a0631fb8229b2aa3d7621427085ad%20%7C%20Threatcrowd.org%20Open%20Source%20Threat%20Intelligence&s_o=default User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Date Tue, 07 Dec 2021 14:03:51 GMT X-Content-Type-Options nosniff Server nginx transfer-encoding chunked Content-Type application/javascript Cross-Origin-Resource-Policy cross-origin Connection keep-alive X-XSS-Protection 1; mode=block
GET H2	200	common.bundle.6c6defcc206edabe5048d82459ee0a0e.js Show response c.disquscdn.com/next/recommendations/ Frame 2B4E	262 KB 87 KB	9ms 8ms	Script application/javascript	2600:9000:21f3:f200:6:8656:f5c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://c.disquscdn.com/next/recommendations/common.bundle.6c6defcc206edabe5048d82459ee0a0e.js Requested by Host: c.disquscdn.com URL: https://c.disquscdn.com/next/recommendations/recommendations.load.42dfcc5041eed24b84f85a10a88fa215.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:21f3:f200:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 5fae79754e7af92e6afadc3060797e3d35188221e60d63d0625f66cf921e7ebb Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://disqus.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 18 Oct 2021 21:23:25 GMT content-encoding gzip x-content-type-options nosniff age 4293626 x-cache Hit from cloudfront content-length 88862 x-xss-protection 1; mode=block x-served-by static-web-2 access-control-allow-origin * surrogate-key next last-modified Mon, 18 Oct 2021 21:05:37 GMT server nginx etag "616de1a1-15b1e" content-type application/javascript; charset=utf-8 via 1.1 52f0756596448c36265861853c0a44a4.cloudfront.net (CloudFront) expires Tue, 18 Oct 2022 21:23:25 GMT cache-control max-age=31536000, public, immutable, no-transform x-amz-cf-pop FRA2-C2 timing-allow-origin * x-amz-cf-id r-HHSV3kXdcRt-_iqt4sOyBz1DZuFnIF_w_R7SaopL11-mV8mFfWng== x-cache-hits 0
GET H2	200	svg-sprite.4da5413f5086c5755b46094b813dbfcd.svg c.disquscdn.com/next/embed/assets/img/ Frame 786F	13 KB 13 KB	10ms 9ms	Image image/svg+xml	2600:9000:21f3:f200:6:8656:f5c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://c.disquscdn.com/next/embed/assets/img/svg-sprite.4da5413f5086c5755b46094b813dbfcd.svg Requested by Host: c.disquscdn.com URL: https://c.disquscdn.com/next/embed/styles/lounge.3e33cc45b553fa4f7fd3dfc49dc03ed0.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:21f3:f200:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 3270642c89180c12db93775e2a774b6dadd9bd98cffc963075c85afd2c17b6e4 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://c.disquscdn.com/next/embed/styles/lounge.3e33cc45b553fa4f7fd3dfc49dc03ed0.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 28 Apr 2021 14:37:41 GMT via 1.1 52f0756596448c36265861853c0a44a4.cloudfront.net (CloudFront) x-content-type-options nosniff age 19265170 x-cache Hit from cloudfront content-length 13079 x-xss-protection 1; mode=block x-served-by static-web-1 surrogate-key next last-modified Tue, 27 Apr 2021 21:01:56 GMT server nginx etag "60887bc4-3317" content-type image/svg+xml; charset=utf-8 access-control-allow-origin * expires Thu, 28 Apr 2022 14:37:41 GMT cache-control max-age=31536000, public, immutable, no-transform x-amz-cf-pop FRA2-C2 accept-ranges bytes timing-allow-origin * x-amz-cf-id 7urSjkCVywr_DG7TOoQyK7xHOFwEilfl40RnOF6fQ1bXINtYRx-Lhw== x-cache-hits 0
GET H/1.1	200 OK	event.gif referrer.disqus.com/juggler/ Frame 786F	43 B 339 B	136ms 121ms	Image image/gif	199.232.196.134 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://referrer.disqus.com/juggler/event.gif?abe=0&embed_hidden=0&load_time=116&event=init_embed&thread=5842995345&forum=threatcrowd&forum_id=3570221&imp=87cd8bc1c4md6m&thread_slug=775a0631fb8229b2aa3d7621427085ad_threatcrowdorg&user_type=anon&referrer=https%3A%2F%2Fwww.threatcrowd.org%2F&theme=next&dnt=0&tracking_enabled=0&experiment=network_default_hidden&variant=fallthrough&service=dynamic&promoted_enabled=false&max_enabled=false Requested by Host: www.threatcrowd.org URL: https://www.threatcrowd.org/malware.php?md5=775a0631fb8229b2aa3d7621427085ad Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 199.232.196.134 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://disqus.com/embed/comments/?base=default&f=threatcrowd&t_u=https%3A%2F%2Fwww.threatcrowd.org%2Fmalware.php%3Fmd5%3D775a0631fb8229b2aa3d7621427085ad&t_d=Malware%20%3E%20775a0631fb8229b2aa3d7621427085ad%20%7C%20Threatcrowd.org%20Open%20Source%20Threat%20Intelligence&t_t=Malware%20%3E%20775a0631fb8229b2aa3d7621427085ad%20%7C%20Threatcrowd.org%20Open%20Source%20Threat%20Intelligence&s_o=default User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Date Tue, 07 Dec 2021 14:03:51 GMT X-Content-Type-Options nosniff Last-Modified Mon, 28 Sep 1970 06:00:00 GMT Server nginx Content-Type image/gif Cross-Origin-Resource-Policy cross-origin Connection keep-alive Content-Length 43 X-XSS-Protection 1; mode=block
GET H2	200	pixel.gif cdn.viglink.com/images/	43 B 428 B	63ms 33ms	Image image/gif	2606:4700::6810:a40d CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.viglink.com/images/pixel.gif?ch=1&rn=5.758717452484949 Requested by Host: www.threatcrowd.org URL: https://www.threatcrowd.org/malware.php?md5=775a0631fb8229b2aa3d7621427085ad Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 2606:4700::6810:a40d , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.threatcrowd.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Tue, 07 Dec 2021 14:03:51 GMT cf-cache-status HIT last-modified Tue, 10 Feb 2015 03:29:39 GMT server cloudflare age 0 etag "221d8352905f2c38b3cb2bd191d630b0" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/gif cache-control max-age=15, must-revalidate content-length 43 accept-ranges bytes cf-ray 6b9e4cbddc9b5b86-FRA x-amz-request-id PRWRG3QYDH9YWHTE x-amz-id-2 gfRATvbujnOBmnaE036SleuMrB1J3wYii8FL2ug/NqP3Y1VaN+G8mIF/uoZEbuIpjItbtXD/Qe8=
GET H2	200	pixel.gif cdn.viglink.com/images/	43 B 102 B	70ms 40ms	Image image/gif	2606:4700::6810:a40d CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.viglink.com/images/pixel.gif?ch=2&rn=5.758717452484949 Requested by Host: www.threatcrowd.org URL: https://www.threatcrowd.org/malware.php?md5=775a0631fb8229b2aa3d7621427085ad Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 2606:4700::6810:a40d , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.threatcrowd.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Tue, 07 Dec 2021 14:03:51 GMT cf-cache-status HIT last-modified Tue, 10 Feb 2015 03:29:39 GMT server cloudflare age 0 etag "221d8352905f2c38b3cb2bd191d630b0" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/gif cache-control max-age=15, must-revalidate content-length 43 accept-ranges bytes cf-ray 6b9e4cbddca15b86-FRA x-amz-request-id PRWRG3QYDH9YWHTE x-amz-id-2 gfRATvbujnOBmnaE036SleuMrB1J3wYii8FL2ug/NqP3Y1VaN+G8mIF/uoZEbuIpjItbtXD/Qe8=
GET H2	200	recommendations.10022a97346f1c6e3798931bbd8e4bb5.css c.disquscdn.com/next/recommendations/styles/ Frame 2B4E	14 KB 3 KB	7ms 7ms	Stylesheet text/css	2600:9000:21f3:f200:6:8656:f5c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://c.disquscdn.com/next/recommendations/styles/recommendations.10022a97346f1c6e3798931bbd8e4bb5.css Requested by Host: c.disquscdn.com URL: https://c.disquscdn.com/next/recommendations/common.bundle.6c6defcc206edabe5048d82459ee0a0e.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:21f3:f200:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 3eee15d11eb29b6f2258cabfeeca39b3b900a7cae96fc7919b27789f3470b9f9 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://disqus.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 18 Oct 2021 21:23:26 GMT content-encoding gzip x-content-type-options nosniff age 4293624 x-cache Hit from cloudfront content-length 2978 x-xss-protection 1; mode=block x-served-by static-web-1 access-control-allow-origin * surrogate-key next last-modified Mon, 18 Oct 2021 21:05:37 GMT server nginx etag "616de1a1-ba2" content-type text/css; charset=utf-8 via 1.1 52f0756596448c36265861853c0a44a4.cloudfront.net (CloudFront) expires Tue, 18 Oct 2022 21:23:26 GMT cache-control max-age=31536000, public, immutable, no-transform x-amz-cf-pop FRA2-C2 timing-allow-origin * x-amz-cf-id 2q8wVBmWCT3WnmI5yczg0W_gkuB9F3T_WiuE10QuiOZuzRwkQpTHKA== x-cache-hits 0
GET H2	200	recommendations.bundle.926bc472e4859a48daa346b4ba2ab4f4.js Show response c.disquscdn.com/next/recommendations/ Frame 2B4E	65 KB 20 KB	7ms 7ms	Script application/javascript	2600:9000:21f3:f200:6:8656:f5c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://c.disquscdn.com/next/recommendations/recommendations.bundle.926bc472e4859a48daa346b4ba2ab4f4.js Requested by Host: c.disquscdn.com URL: https://c.disquscdn.com/next/recommendations/common.bundle.6c6defcc206edabe5048d82459ee0a0e.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:21f3:f200:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash dbffe4825c6ba1f19ff48607381ad4384b0609b64998830502c130f00abe887d Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://disqus.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 11 Oct 2021 20:25:43 GMT content-encoding gzip x-content-type-options nosniff age 4901888 x-cache Hit from cloudfront content-length 20244 x-xss-protection 1; mode=block x-served-by static-web-1 access-control-allow-origin * surrogate-key next last-modified Mon, 11 Oct 2021 20:15:56 GMT server nginx etag "61649b7c-4f14" content-type application/javascript; charset=utf-8 via 1.1 52f0756596448c36265861853c0a44a4.cloudfront.net (CloudFront) expires Tue, 11 Oct 2022 20:25:43 GMT cache-control max-age=31536000, public, immutable, no-transform x-amz-cf-pop FRA2-C2 timing-allow-origin * x-amz-cf-id VvWm0AstFz76eOqgaIAPKRufMYeNGthFWSNbyHOvp61n7zr80cdanQ== x-cache-hits 0
GET H/1.1	200 OK	config.js Show response disqus.com/next/ Frame 2B4E	14 KB 15 KB	7ms 6ms	Script application/javascript	151.101.0.134 FASTLY
General Check archive.org Show headers Download Go to Full URL https://disqus.com/next/config.js Requested by Host: c.disquscdn.com URL: https://c.disquscdn.com/next/recommendations/common.bundle.6c6defcc206edabe5048d82459ee0a0e.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.0.134 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash f8b30a2aaa19326c2f546b8e22134512c9e5486fa6fec2f0d1c8ca2bbc8acb04 Security Headers Name Value Strict-Transport-Security max-age=300; includeSubdomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://disqus.com/recommendations/?base=default&f=threatcrowd&t_u=https%3A%2F%2Fwww.threatcrowd.org%2Fmalware.php%3Fmd5%3D775a0631fb8229b2aa3d7621427085ad&t_d=Malware%20%3E%20775a0631fb8229b2aa3d7621427085ad%20%7C%20Threatcrowd.org%20Open%20Source%20Threat%20Intelligence&t_t=Malware%20%3E%20775a0631fb8229b2aa3d7621427085ad%20%7C%20Threatcrowd.org%20Open%20Source%20Threat%20Intelligence User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Date Tue, 07 Dec 2021 14:03:51 GMT X-Content-Type-Options nosniff Content-Type application/javascript; charset=UTF-8 Server nginx Age 54 X-Frame-Options SAMEORIGIN Strict-Transport-Security max-age=300; includeSubdomains p3p CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM" Access-Control-Allow-Origin * Cache-Control public, stale-while-revalidate=300, s-stalewhilerevalidate=3600, max-age=60 Cross-Origin-Resource-Policy cross-origin Connection keep-alive Timing-Allow-Origin * Content-Length 14500 X-XSS-Protection 1; mode=block
GET H/1.1	200 OK	details Show response disqus.com/api/3.0/forums/ Frame 2B4E	3 KB 3 KB	7ms 7ms	XHR application/json	151.101.0.134 FASTLY
General Check archive.org Show headers Download Go to Full URL https://disqus.com/api/3.0/forums/details?forum=threatcrowd&attach=forumFeatures&api_key=E8Uh5l5fHZ6gD8U3KycjAIAk46f68Zw7C6eW8WSjZvCLXebZ7p0r1yrYDrLilk2F Requested by Host: c.disquscdn.com URL: https://c.disquscdn.com/next/recommendations/common.bundle.6c6defcc206edabe5048d82459ee0a0e.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.0.134 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash da047bd41ed3a6a24b5dd5b0575e6f9a8ea8a16b73a56b448b78cd53e74c29b7 Security Headers Name Value Strict-Transport-Security max-age=300; includeSubdomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept */* Referer https://disqus.com/recommendations/?base=default&f=threatcrowd&t_u=https%3A%2F%2Fwww.threatcrowd.org%2Fmalware.php%3Fmd5%3D775a0631fb8229b2aa3d7621427085ad&t_d=Malware%20%3E%20775a0631fb8229b2aa3d7621427085ad%20%7C%20Threatcrowd.org%20Open%20Source%20Threat%20Intelligence&t_t=Malware%20%3E%20775a0631fb8229b2aa3d7621427085ad%20%7C%20Threatcrowd.org%20Open%20Source%20Threat%20Intelligence X-Requested-With XMLHttpRequest Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Date Tue, 07 Dec 2021 14:03:51 GMT X-Content-Type-Options nosniff Server nginx Age 0 X-Frame-Options SAMEORIGIN Strict-Transport-Security max-age=300; includeSubdomains p3p CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM" Cross-Origin-Resource-Policy cross-origin Connection keep-alive Content-Type application/json Vary Origin, Cookie Content-Length 3081 X-XSS-Protection 1; mode=block
GET H/1.1	200 OK	listRecommendations.json Show response disqus.com/api/3.0/discovery/ Frame 2B4E	8 KB 8 KB	223ms 223ms	XHR application/json	151.101.0.134 FASTLY
General Check archive.org Show headers Download Go to Full URL https://disqus.com/api/3.0/discovery/listRecommendations.json?forum=threatcrowd&thread=url%3Ahttps%3A%2F%2Fwww.threatcrowd.org%2Fmalware.php%3Fmd5%3D775a0631fb8229b2aa3d7621427085ad&limit=8&api_key=E8Uh5l5fHZ6gD8U3KycjAIAk46f68Zw7C6eW8WSjZvCLXebZ7p0r1yrYDrLilk2F Requested by Host: c.disquscdn.com URL: https://c.disquscdn.com/next/recommendations/common.bundle.6c6defcc206edabe5048d82459ee0a0e.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.0.134 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 93bf3621ee25a13ba199c1ecb7e3c6c7696a45eb3f6e0cd2b5c5f55719f4b20c Security Headers Name Value Strict-Transport-Security max-age=300; includeSubdomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept application/json, text/javascript, */*; q=0.01 Referer https://disqus.com/recommendations/?base=default&f=threatcrowd&t_u=https%3A%2F%2Fwww.threatcrowd.org%2Fmalware.php%3Fmd5%3D775a0631fb8229b2aa3d7621427085ad&t_d=Malware%20%3E%20775a0631fb8229b2aa3d7621427085ad%20%7C%20Threatcrowd.org%20Open%20Source%20Threat%20Intelligence&t_t=Malware%20%3E%20775a0631fb8229b2aa3d7621427085ad%20%7C%20Threatcrowd.org%20Open%20Source%20Threat%20Intelligence X-Requested-With XMLHttpRequest Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Date Tue, 07 Dec 2021 14:03:51 GMT X-Content-Type-Options nosniff Server nginx Age 0 X-Frame-Options SAMEORIGIN Strict-Transport-Security max-age=300; includeSubdomains p3p CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM" Cache-Control stale-while-revalidate=450, public, max-age=1800 Cross-Origin-Resource-Policy cross-origin Connection keep-alive Content-Type application/json Vary Origin Content-Length 8005 X-XSS-Protection 1; mode=block
GET H2	200	get c.disquscdn.com/ Frame 2B4E	1 KB 2 KB	9ms 8ms	Image image/png	2600:9000:21f3:f200:6:8656:f5c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://c.disquscdn.com/get?url=https%3A%2F%2Fwww.threatcrowd.org%2Fimg%2Fhome.png&key=d7WViDkk440GovZDmk6PtQ&h=200 Requested by Host: www.threatcrowd.org URL: https://www.threatcrowd.org/malware.php?md5=775a0631fb8229b2aa3d7621427085ad Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:21f3:f200:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 1b8b1d761a96d958fd8dbb46dd03dc4fd472324fc2570d587bc054f722b73611 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://disqus.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Tue, 23 Nov 2021 21:57:16 GMT via 1.1 52f0756596448c36265861853c0a44a4.cloudfront.net (CloudFront) x-content-type-options nosniff nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 1255508 x-cache Hit from cloudfront p3p CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM" cross-origin-resource-policy cross-origin, cross-origin, cross-origin content-length 1236 x-xss-protection 1; mode=block x-served-by static-web-1 server nginx expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-cache-hits 0 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=a93HrpryONtY5HOwcqwW8xCNpnhvNS3R8QjlJqCs2GXlei98zfX3KRgfgtlHBtf%2F8IbkbWl4XGBaYtC6ZO4AuZ6MUUOj2E5r47qR4aexjUtk%2Fp5iX3IERwYJr9ZTPr9xPGjYgbvV"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=2592000 x-amz-cf-pop FRA2-C2 accept-ranges bytes x-amz-cf-id JJT1PdNKbBrYt_2mGOZCUUQ6pxX0o4aUDpy2Ek-cFMSMS6zyEEbPEw== expires Thu, 23 Dec 2021 21:57:16 GMT
GET H2	200	get c.disquscdn.com/ Frame 2B4E	1 KB 2 KB	10ms 10ms	Image image/png	2600:9000:21f3:f200:6:8656:f5c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://c.disquscdn.com/get?url=https%3A%2F%2Fthreatcrowd.org%2Fimg%2Fhome.png&key=t9tchXH9vhDFPKLmgx3MFA&h=200 Requested by Host: www.threatcrowd.org URL: https://www.threatcrowd.org/malware.php?md5=775a0631fb8229b2aa3d7621427085ad Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:21f3:f200:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 1b8b1d761a96d958fd8dbb46dd03dc4fd472324fc2570d587bc054f722b73611 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://disqus.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 24 Nov 2021 08:19:51 GMT via 1.1 52f0756596448c36265861853c0a44a4.cloudfront.net (CloudFront) x-content-type-options nosniff nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 1208064 x-cache Hit from cloudfront p3p CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM" cross-origin-resource-policy cross-origin, cross-origin, cross-origin content-length 1236 x-xss-protection 1; mode=block x-served-by static-web-1 server nginx expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-cache-hits 0 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Jdt%2Fwl6sN11lrUm6uUH%2FSDq%2B3nPQaR%2F04f0SqxADsejWPeAFgd4Yyn%2Fj%2FsqUsIEJn1gMG0QdVGHkZEe9KzO4cFlYutkVgon7oWclwkCMp7tmFDGuTXx%2BU9J4AIG8fABVYOk%3D"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=2592000 x-amz-cf-pop FRA2-C2 accept-ranges bytes x-amz-cf-id mH818g_Kjr4f4-kOaVe7d9KUjWGkxcNIVmcvJM5RqzBvsEednW7KIA== expires Fri, 24 Dec 2021 08:19:51 GMT
GET H2	200	jquery-2.0.3.min.js Show response code.jquery.com/ Frame 3AA0	82 KB 29 KB	322ms 34ms	Script application/javascript	2001:4de0:ac18::1:a:2b HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-2.0.3.min.js Requested by Host: www.threatcrowd.org URL: https://www.threatcrowd.org/graphHtml.php?md5=775a0631fb8229b2aa3d7621427085ad Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac18::1:a:2b , Netherlands, ASN20446 (HIGHWINDS3, US), Reverse DNS Software nginx / Resource Hash b13cb5989e08fcb02314209d101e1102f3d299109bdc253b62aa1da21c9e38ba Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.threatcrowd.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Tue, 07 Dec 2021 14:03:51 GMT content-encoding gzip last-modified Fri, 24 Oct 2014 00:16:07 GMT server nginx etag W/"54499a47-1469c" vary Accept-Encoding x-hw 1638885831.dop156.am5.t,1638885831.cds224.am5.hn,1638885831.cds135.am5.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 29305
GET H3	200	cytoscape.min.js Show response www.threatcrowd.org/js/ Frame 3AA0	208 KB 59 KB	23ms 23ms	Script application/javascript	2606:4700:3038::6815:e9bd CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.threatcrowd.org/js/cytoscape.min.js Requested by Host: www.threatcrowd.org URL: https://www.threatcrowd.org/graphHtml.php?md5=775a0631fb8229b2aa3d7621427085ad Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3038::6815:e9bd , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash fd81620c131af05d3f49bbdc0358763e20916385bef2941a8f6577430131d643 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.threatcrowd.org/graphHtml.php?md5=775a0631fb8229b2aa3d7621427085ad User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Tue, 07 Dec 2021 14:03:51 GMT content-encoding br cf-cache-status HIT last-modified Thu, 03 Jun 2021 14:58:12 GMT server cloudflare age 78667 etag W/"33ecc-5c3ddcdd48900-gzip" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=G%2Fwycn5siaLfhNUXo67xh0lHT%2F3CJl0cW7ydDgNuJ%2F%2BSDTUr3pi6YSTSrEKo3mL9GJf0kNGj8iVYXGSmvphpQCkRMjyTnzLmkJEG7lJmOC9KnCg%2BnRrjabymQifnOKIebglG0q6y9HaqC8sib%2BMhNdam"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control max-age=86400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 6b9e4cbfeadac2c7-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
GET H3	200	cytoscape-cxtmenu.js Show response www.threatcrowd.org/js/c/menu/ Frame 3AA0	5 KB 3 KB	18ms 17ms	Script application/javascript	2606:4700:3038::6815:e9bd CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.threatcrowd.org/js/c/menu/cytoscape-cxtmenu.js Requested by Host: www.threatcrowd.org URL: https://www.threatcrowd.org/graphHtml.php?md5=775a0631fb8229b2aa3d7621427085ad Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3038::6815:e9bd , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash bce4d1d83d42ffde5b205b6d8ca777717c324bf76c11d8161d8514e07504a9c6 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.threatcrowd.org/graphHtml.php?md5=775a0631fb8229b2aa3d7621427085ad User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Tue, 07 Dec 2021 14:03:51 GMT content-encoding br cf-cache-status HIT last-modified Thu, 03 Jun 2021 14:58:12 GMT server cloudflare age 78666 etag W/"142c-5c3ddcdd48900-gzip" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dDIF6GTtdJnEpD3wrIopddwaR1%2BtC6E7T5v2EMQl8TzZpCwaaw9n%2FjnyFLDbIh30HXSeRvFYRh6Z4DIOI2AUqpcu26M5L82n9nnC1b%2FIvkkRqPhZKsLut3dZNbhuyaXxgAUBsm1IwUdqeUmEL3e23yAs"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control max-age=86400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 6b9e4cbfeadcc2c7-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
GET H3	200	cytoscape.js-navigator.css www.threatcrowd.org/js/c/nav/ Frame 3AA0	600 B 866 B	16ms 16ms	Stylesheet text/css	2606:4700:3038::6815:e9bd CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.threatcrowd.org/js/c/nav/cytoscape.js-navigator.css Requested by Host: www.threatcrowd.org URL: https://www.threatcrowd.org/graphHtml.php?md5=775a0631fb8229b2aa3d7621427085ad Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3038::6815:e9bd , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 3e1d0697bfac1230dcaa39d33cfa6fe7af3e922d2cdd55937633d8f224c73f50 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.threatcrowd.org/graphHtml.php?md5=775a0631fb8229b2aa3d7621427085ad User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Tue, 07 Dec 2021 14:03:51 GMT content-encoding br cf-cache-status HIT last-modified Thu, 03 Jun 2021 14:58:12 GMT server cloudflare age 75612 etag W/"258-5c3ddcdd48900-gzip" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ygulWqh5yf6EoiMtM9FZc5n4ytlr4DuZz34MMmDb2QSd%2FoskztnskpVBIQWsUhZ4RJ25pVIRJlPc%2B%2B%2BJwj1LQZAica1133Nw7c5jZDQq3RZlAiKd58qAM1hqfsuvueV4Wb6Kf8ErSCSOfrSqvUAVwlqW"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control max-age=86400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 6b9e4cbfeadfc2c7-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
GET H3	200	cytoscape.js-navigator.js Show response www.threatcrowd.org/js/c/nav/ Frame 3AA0	9 KB 3 KB	18ms 18ms	Script application/javascript	2606:4700:3038::6815:e9bd CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.threatcrowd.org/js/c/nav/cytoscape.js-navigator.js Requested by Host: www.threatcrowd.org URL: https://www.threatcrowd.org/graphHtml.php?md5=775a0631fb8229b2aa3d7621427085ad Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3038::6815:e9bd , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a985d1c01e66718e9fcb4150f7dc7c73038af3f2447d435e90030b28d9727e70 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.threatcrowd.org/graphHtml.php?md5=775a0631fb8229b2aa3d7621427085ad User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Tue, 07 Dec 2021 14:03:51 GMT content-encoding br cf-cache-status HIT last-modified Thu, 03 Jun 2021 14:58:12 GMT server cloudflare age 67421 etag W/"2210-5c3ddcdd48900-gzip" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=N7165MUpBsv4%2FxYMYOiVLdtKmleij44dFSRc2xaPE%2F3NuNYStNV8E2qNupUl%2FfC0qCMzfx8pjV6zrrgBpZOWZTLEEbqkdnRPiYUe5q%2FMflPPCDuWltrUS3DuhBcKio%2F3S72dWjVaKIQJmW0CJkz9VUeT"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control max-age=86400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 6b9e4cbfeae0c2c7-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
GET H3	200	network.png www.threatcrowd.org/img/ Frame 3AA0	2 KB 2 KB	18ms 18ms	Image image/png	2606:4700:3038::6815:e9bd CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.threatcrowd.org/img/network.png Requested by Host: www.threatcrowd.org URL: https://www.threatcrowd.org/graphHtml.php?md5=775a0631fb8229b2aa3d7621427085ad Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3038::6815:e9bd , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e6615745d99ac9ea184b3efddb2f0a3933b82419170beedf1e65c5372e1dabe3 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.threatcrowd.org/graphHtml.php?md5=775a0631fb8229b2aa3d7621427085ad User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Tue, 07 Dec 2021 14:03:51 GMT cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 14094 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 content-length 1677 last-modified Thu, 03 Jun 2021 14:58:11 GMT server cloudflare etag "68d-5c3ddcdc546c0" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jOt40RJiNr9CwaPEQVhyoTRa6GJrCj27bnpG7GAaNhNg9HWgqA0BdbeBmrqMpQhS227hVw77EnrP%2F3OvrnbYd13TX0dTgl4XmE6xDomPTmjYh03YzbXPqrvmqnbnU17R4cfgUQNqUQWO%2BrvfN0nEvjYn"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=86400 accept-ranges bytes cf-ray 6b9e4cc02b3dc2c7-FRA
GET H3	200	table.png www.threatcrowd.org/img/ Frame 3AA0	144 B 736 B	16ms 15ms	Image image/png	2606:4700:3038::6815:e9bd CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.threatcrowd.org/img/table.png Requested by Host: www.threatcrowd.org URL: https://www.threatcrowd.org/graphHtml.php?md5=775a0631fb8229b2aa3d7621427085ad Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3038::6815:e9bd , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 4b0fe0a5f37dd9d6c0a8b31cd5ad0cb944347cabc2a4a3b244b49c50ee047def Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.threatcrowd.org/graphHtml.php?md5=775a0631fb8229b2aa3d7621427085ad User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Tue, 07 Dec 2021 14:03:51 GMT cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 80542 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 content-length 144 last-modified Thu, 03 Jun 2021 14:58:11 GMT server cloudflare etag "90-5c3ddcdc546c0" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=clB8xQo4mO4qOr2eU2mtlpk7y6Cswf%2BPxOo0Quacr63Ek2ax30q4hpVAQdkGzcpRDYFmsJeW18Wf9zD%2FLHvG%2FIf5BImjAVsdAMGyUyIDDdYyCoMcP6vK9wc3Wu1h2%2FfNXYabM7l21DvVWuwb1LYS0UAD"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=86400 accept-ranges bytes cf-ray 6b9e4cc04b71c2c7-FRA
GET H3	200	globe.png www.threatcrowd.org/img/ Frame 3AA0	4 KB 4 KB	16ms 15ms	Image image/png	2606:4700:3038::6815:e9bd CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.threatcrowd.org/img/globe.png Requested by Host: www.threatcrowd.org URL: https://www.threatcrowd.org/graphHtml.php?md5=775a0631fb8229b2aa3d7621427085ad Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3038::6815:e9bd , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8a56a567773a9260f561dbc11d04dc26dee34dc9c0fd07d79d6997def2dad1f1 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.threatcrowd.org/graphHtml.php?md5=775a0631fb8229b2aa3d7621427085ad User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Tue, 07 Dec 2021 14:03:51 GMT cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 5429 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 content-length 3753 last-modified Thu, 03 Jun 2021 14:58:11 GMT server cloudflare etag "ea9-5c3ddcdc546c0" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hLwufrXKvOO9zFE9vKcdvUl%2B5DL%2F%2F7cvQLdgciXD2cVpAXOKX%2FtGevkjWPYAGlxh5azUulPpVsMnGWi5STGPXWMvoNenRsxcSympDVTdciqLXmWpP3Ze3zjqAsd7CU3QAFgq9JH76bk%2BIcNyAUx8pof3"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=86400 accept-ranges bytes cf-ray 6b9e4cc06ba4c2c7-FRA
GET H3	200	twitter.png www.threatcrowd.org/img/ Frame 3AA0	1 KB 2 KB	32ms 32ms	Image image/png	2606:4700:3038::6815:e9bd CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.threatcrowd.org/img/twitter.png Requested by Host: www.threatcrowd.org URL: https://www.threatcrowd.org/graphHtml.php?md5=775a0631fb8229b2aa3d7621427085ad Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3038::6815:e9bd , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7c63a1302e11c3843637bfb335ef3da437c2e84e78ff33a4527ac7bbf2c3d7e3 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.threatcrowd.org/graphHtml.php?md5=775a0631fb8229b2aa3d7621427085ad User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Tue, 07 Dec 2021 14:03:51 GMT cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 65017 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 content-length 1200 last-modified Thu, 03 Jun 2021 14:58:11 GMT server cloudflare etag "4b0-5c3ddcdc546c0" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5AFzAwnIxE4Gi8Alh0xPe9cRd9V4O4Vb9krooDS0FIAVzpwDTZ82Jfn4dv62UNJHXDYfaHlMdUGPwyCwIDW3re8L1TzUWGaLy3uI4a1H0sma0EaHXqmwj8u9Zn8fVUtryZtJE9OBz58IUZxwJr%2FcS8Yk"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=86400 accept-ranges bytes cf-ray 6b9e4cc08bd1c2c7-FRA
POST H/1.1	200 OK	ping Show response links.services.disqus.com/api/	358 B 795 B	91ms 40ms	XHR text/javascript	199.232.196.64 FASTLY
General Check archive.org Show headers Download Go to Full URL https://links.services.disqus.com/api/ping Requested by Host: c.disquscdn.com URL: https://c.disquscdn.com/next/embed/alfie_v4.63f1ab6d6b9d5807dc0c94ef3fe0b851.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 199.232.196.64 , United States, ASN54113 (FASTLY, US), Reverse DNS Software Apache-Coyote/1.1 / Resource Hash 139ea5b350e6b00b3d1e34f3688a0946bda54767e2c97ee59af6e02b79ca4acc Request headers Referer https://www.threatcrowd.org/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Content-Type application/x-www-form-urlencoded Response headers Pragma no-cache Date Tue, 07 Dec 2021 14:03:51 GMT Server Apache-Coyote/1.1 P3P CP="ALL IND DSP COR CUR ADM TAIo PSDo OUR COM INT NAV PUR STA UNI" Access-Control-Allow-Origin https://www.threatcrowd.org Cache-Control no-cache, no-store Access-Control-Allow-Credentials true Connection keep-alive Content-Type text/javascript;charset=UTF-8 Content-Length 358 Expires Thu, 01 Jan 1970 00:00:00 GMT
GET H/1.1	200 OK	sync.gif links.services.disqus.com/api/	43 B 375 B	35ms 35ms	Image image/gif	199.232.196.64 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://links.services.disqus.com/api/sync.gif?key=cfdfcf52dffd0a702a61bad27507376d Requested by Host: www.threatcrowd.org URL: https://www.threatcrowd.org/malware.php?md5=775a0631fb8229b2aa3d7621427085ad Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 199.232.196.64 , United States, ASN54113 (FASTLY, US), Reverse DNS Software Apache-Coyote/1.1 / Resource Hash 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.threatcrowd.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Pragma no-cache Date Tue, 07 Dec 2021 14:03:51 GMT Server Apache-Coyote/1.1 P3P CP="ALL IND DSP COR CUR ADM TAIo PSDo OUR COM INT NAV PUR STA UNI" Cache-Control no-cache, no-store Connection keep-alive Content-Type image/gif;charset=UTF-8 Content-Length 43 Expires Thu, 01 Jan 1970 00:00:00 GMT
POST H/1.1	200 OK	domains Show response links.services.disqus.com/api/	41 B 477 B	47ms 32ms	XHR text/javascript	199.232.196.64 FASTLY
General Check archive.org Show headers Download Go to Full URL https://links.services.disqus.com/api/domains Requested by Host: c.disquscdn.com URL: https://c.disquscdn.com/next/embed/alfie_v4.63f1ab6d6b9d5807dc0c94ef3fe0b851.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 199.232.196.64 , United States, ASN54113 (FASTLY, US), Reverse DNS Software Apache-Coyote/1.1 / Resource Hash 51fea562926d9922abb19144043498a248d10fb0cd0ecd46ccbed0f62d5dbb2a Request headers Referer https://www.threatcrowd.org/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Content-Type application/x-www-form-urlencoded Response headers Pragma no-cache Date Tue, 07 Dec 2021 14:03:51 GMT Server Apache-Coyote/1.1 P3P CP="ALL IND DSP COR CUR ADM TAIo PSDo OUR COM INT NAV PUR STA UNI" Access-Control-Allow-Origin https://www.threatcrowd.org Cache-Control no-cache, no-store Access-Control-Allow-Credentials true Connection keep-alive Content-Type text/javascript;charset=UTF-8 Content-Length 41 Expires Thu, 01 Jan 1970 00:00:00 GMT
GET H/1.1	200 OK	roundtrip.js Show response s.adroll.com/j/	47 KB 16 KB	30ms 10ms	Script text/javascript	2600:9000:20eb:e400:6:9280:1080:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://s.adroll.com/j/roundtrip.js Requested by Host: www.threatcrowd.org URL: https://www.threatcrowd.org/malware.php?md5=775a0631fb8229b2aa3d7621427085ad Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2600:9000:20eb:e400:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash eef431caaf038231bd760cfb02bc99f7a6cf8b496703bc38ed9f3337ea19802a Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.threatcrowd.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers X-Amz-Version-Id buqx9Ixn5Jcappa8vAvpi1PhQEs716Xq Content-Encoding gzip Etag W/"21456fcecffb49f383892fc6fcfebbfc" Age 1728 X-Amz-Server-Side-Encryption AES256 Transfer-Encoding chunked X-Cache Hit from cloudfront Connection keep-alive Vary Accept-Encoding Via 1.1 1d67a4c00b06651cb6daa95ec3f21f9b.cloudfront.net (CloudFront) Last-Modified Mon, 06 Dec 2021 21:01:54 GMT Server AmazonS3 Date Tue, 07 Dec 2021 13:35:10 GMT Access-Control-Max-Age 600 Access-Control-Allow-Methods GET Content-Type text/javascript Access-Control-Allow-Origin * Cache-Control max-age=3600, must-revalidate Access-Control-Allow-Credentials false X-Amz-Cf-Pop FRA2-C1 Access-Control-Allow-Headers * X-Amz-Cf-Id 7zyyb-oELPIJKI1nyCyP6v4yZvBXzQsfi3YiNcnLy37cZeI56O6G2g==
GET H/1.1	200 OK	index.js Show response s.adroll.com/j/exp/ Redirect Chain https://s.adroll.com/j/exp/PIUCN4PSYRCCHBHOGPVN5Q/index.js https://s.adroll.com/j/exp/index.js	28 B 761 B	8ms 8ms	Script application/javascript	2600:9000:20eb:e400:6:9280:1080:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://s.adroll.com/j/exp/index.js Protocol HTTP/1.1 Server 2600:9000:20eb:e400:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.threatcrowd.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers X-Amz-Version-Id VxC0v7SN4NsT_sJxZYoy27yA4ALlRfhC Via 1.1 1d67a4c00b06651cb6daa95ec3f21f9b.cloudfront.net (CloudFront) Etag "5816cced8568d223aa09d889f300692b" Age 74825 X-Amz-Server-Side-Encryption AES256 X-Cache Hit from cloudfront Connection keep-alive Content-Length 28 Last-Modified Mon, 18 Oct 2021 21:07:54 GMT Server AmazonS3 Date Mon, 06 Dec 2021 23:38:57 GMT Access-Control-Max-Age 600 Access-Control-Allow-Methods GET Content-Type application/javascript Access-Control-Allow-Origin * Access-Control-Allow-Credentials false X-Amz-Cf-Pop FRA2-C1 Accept-Ranges bytes Access-Control-Allow-Headers * X-Amz-Cf-Id Qx3-zGrwNbQOdo4wlIJy79c6k0npjEUjO3B58t6l-sS-c16CzrC17w== Redirect headers Date Mon, 06 Dec 2021 23:34:13 GMT Via 1.1 1d67a4c00b06651cb6daa95ec3f21f9b.cloudfront.net (CloudFront) Age 52178 X-Cache Hit from cloudfront Connection keep-alive Content-Length 0 Server AmazonS3 Location https://s.adroll.com/j/exp/index.js Access-Control-Max-Age 600 Access-Control-Allow-Methods GET Content-Type application/xml Access-Control-Allow-Origin * Access-Control-Allow-Credentials false X-Amz-Cf-Pop FRA2-C1 Access-Control-Allow-Headers * X-Amz-Cf-Id _cfxaDgIMArLPdY_-POIouFW1PzV3bNt2Ker598Q5UWlB4Y9sdzeKA==
GET H/1.1	200 OK	index.js Show response s.adroll.com/j/pre/ Redirect Chain https://s.adroll.com/j/pre/PIUCN4PSYRCCHBHOGPVN5Q/KDBRCBINVREGNJUXIQKBDP/fpconsent.js https://s.adroll.com/j/pre/index.js	0 732 B	9ms 9ms	Script application/javascript	2600:9000:20eb:e400:6:9280:1080:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://s.adroll.com/j/pre/index.js Protocol HTTP/1.1 Server 2600:9000:20eb:e400:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.threatcrowd.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers X-Amz-Version-Id nQEe8wQ7h0ROt7P4GJfDfstto6x684Hy Via 1.1 c379418fd6100691807f32f274ebe9ce.cloudfront.net (CloudFront) Etag "d41d8cd98f00b204e9800998ecf8427e" Age 62245 X-Amz-Server-Side-Encryption AES256 X-Cache Hit from cloudfront Connection keep-alive Content-Length 0 Last-Modified Wed, 15 Jan 2020 23:54:18 GMT Server AmazonS3 Date Mon, 06 Dec 2021 20:46:57 GMT Access-Control-Max-Age 600 Access-Control-Allow-Methods GET Content-Type application/javascript Access-Control-Allow-Origin * Access-Control-Allow-Credentials false X-Amz-Cf-Pop FRA2-C1 Accept-Ranges bytes Access-Control-Allow-Headers * X-Amz-Cf-Id FPc9QiVTxHqQTmAzEy8oq-CuWSdFy27wNjE1AGAVjpp4rnIO2lknqA== Redirect headers Date Mon, 06 Dec 2021 23:34:13 GMT Via 1.1 1d67a4c00b06651cb6daa95ec3f21f9b.cloudfront.net (CloudFront) Age 52178 X-Cache Hit from cloudfront Connection keep-alive Content-Length 0 Server AmazonS3 Location https://s.adroll.com/j/pre/index.js Access-Control-Max-Age 600 Access-Control-Allow-Methods GET Content-Type application/xml Access-Control-Allow-Origin * Access-Control-Allow-Credentials false X-Amz-Cf-Pop FRA2-C1 Access-Control-Allow-Headers * X-Amz-Cf-Id dqsH-QzoAk0aQeagky4Ox3ckOSkCB0Un0W3TNepB2oDsCn-z8gQwgQ==
GET H/1.1	200 OK	index.js Show response s.adroll.com/j/pre/PIUCN4PSYRCCHBHOGPVN5Q/KDBRCBINVREGNJUXIQKBDP/	0 774 B	31ms 14ms	Script text/javascript	2600:9000:20eb:e400:6:9280:1080:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://s.adroll.com/j/pre/PIUCN4PSYRCCHBHOGPVN5Q/KDBRCBINVREGNJUXIQKBDP/index.js Requested by Host: s.adroll.com URL: https://s.adroll.com/j/roundtrip.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2600:9000:20eb:e400:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.threatcrowd.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers X-Amz-Version-Id coEhG9bcRjqlNI8kY1yBkyqkm75ltVO1 Via 1.1 69f13f852a135432abb1b7bfc5a8b421.cloudfront.net (CloudFront) Etag "d41d8cd98f00b204e9800998ecf8427e" X-Amz-Cf-Pop FRA2-C1 X-Amz-Server-Side-Encryption AES256 X-Cache Hit from cloudfront Connection keep-alive Content-Length 0 Last-Modified Sat, 20 Nov 2021 23:23:35 GMT Server AmazonS3 Date Tue, 07 Dec 2021 14:03:52 GMT Access-Control-Max-Age 600 Access-Control-Allow-Methods GET Content-Type text/javascript; charset=utf-8 Access-Control-Allow-Origin * Cache-Control max-age=3600, must-revalidate Access-Control-Allow-Credentials false Accept-Ranges bytes Access-Control-Allow-Headers * X-Amz-Cf-Id H1PApdHp5WwQtF9XZBA1lMagOYMC74NJ21V5Pjsbzo6rWDpuRd6B9w==
GET H2	200	PIUCN4PSYRCCHBHOGPVN5Q Show response d.adroll.com/consent/check/	395 B 864 B	87ms 29ms	Script application/javascript	34.251.57.8 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://d.adroll.com/consent/check/PIUCN4PSYRCCHBHOGPVN5Q?arrfrr=https%3A%2F%2Fwww.threatcrowd.org%2Fmalware.php%3Fmd5%3D775a0631fb8229b2aa3d7621427085ad&_s=105d157bb60cede946fc9bb1127aa608&_b=2 Requested by Host: s.adroll.com URL: https://s.adroll.com/j/roundtrip.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.251.57.8 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-34-251-57-8.eu-west-1.compute.amazonaws.com Software nginx/1.20.0 / Resource Hash 4ec9cbc22c92034e51384e5226f2c65508360905a5e0c7ebbdee543aa32ab041 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.threatcrowd.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Tue, 07 Dec 2021 14:03:52 GMT cache-control no-store, no-cache, must-revalidate server nginx/1.20.0 content-type application/javascript content-length 395 p3p CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
GET H2	200	ctx.v1.1.min.js Show response s.dca0.com/	6 KB 2 KB	59ms 8ms	Script application/javascript	13.224.189.98 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://s.dca0.com/ctx.v1.1.min.js?1635953272 Requested by Host: s.adroll.com URL: https://s.adroll.com/j/roundtrip.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.224.189.98 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-224-189-98.fra2.r.cloudfront.net Software AmazonS3 / Resource Hash 14a3a7e077c77e3180a74584291e139dd0301b610fe5ec6888fdba19e7e8781c Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.threatcrowd.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Tue, 07 Dec 2021 14:03:15 GMT content-encoding gzip last-modified Wed, 20 Oct 2021 16:48:23 GMT server AmazonS3 age 38 etag W/"1ef4dd0ba87baa7e952ed9b8e839b84e" vary Accept-Encoding x-cache Hit from cloudfront content-type application/javascript via 1.1 e0efba8a72628bfc3dc6d4d637b28302.cloudfront.net (CloudFront) x-amz-cf-pop FRA2-C1 x-amz-cf-id HDWn85omeg0gDrLcSrLBJut-9RQldLnJd2uVHB8y1HLSoh6XqNIPrA==
GET H/1.1	200 OK	4OCRKBF4JJENXICP676FJT.js Show response s.adroll.com/pixel/PIUCN4PSYRCCHBHOGPVN5Q/KDBRCBINVREGNJUXIQKBDP/ Redirect Chain https://d.adroll.com/pixel/PIUCN4PSYRCCHBHOGPVN5Q/KDBRCBINVREGNJUXIQKBDP?adroll_fpc=4498f60f0b4b56ce69a90c18c9a6dbef-1638885832356&arrfrr=https%3A%2F%2Fwww.threatcrowd.org%2Fmalware.php%3Fmd5%3D775... https://s.adroll.com/pixel/PIUCN4PSYRCCHBHOGPVN5Q/KDBRCBINVREGNJUXIQKBDP/4OCRKBF4JJENXICP676FJT.js	15 KB 5 KB	12ms 12ms	Script text/javascript	2600:9000:20eb:e400:6:9280:1080:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://s.adroll.com/pixel/PIUCN4PSYRCCHBHOGPVN5Q/KDBRCBINVREGNJUXIQKBDP/4OCRKBF4JJENXICP676FJT.js Protocol HTTP/1.1 Server 2600:9000:20eb:e400:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 1dd3b19e5ac5da8a02e147d0f9e71a571bd0c226fb70158742ee7004a3997189 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.threatcrowd.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers X-Amz-Version-Id PWJganzxvIDYoQS1BOzH4J04ZIiON_e0 Content-Encoding gzip Etag W/"67c3f6ffeecbe4142deedbe2635b13a4" X-Amz-Cf-Pop FRA2-C1 X-Amz-Server-Side-Encryption AES256 Transfer-Encoding chunked X-Cache Hit from cloudfront Access-Control-Max-Age 600 Connection keep-alive Access-Control-Allow-Origin * Last-Modified Wed, 09 Dec 2020 00:06:46 GMT Server AmazonS3 Date Tue, 07 Dec 2021 14:03:52 GMT Vary Accept-Encoding Access-Control-Allow-Methods GET Content-Type text/javascript; charset=utf-8 Via 1.1 c379418fd6100691807f32f274ebe9ce.cloudfront.net (CloudFront) Cache-Control max-age=3600, must-revalidate Access-Control-Allow-Credentials false Access-Control-Allow-Headers * X-Amz-Cf-Id PpNSALafQPzmVgQgrljnxHqS3hXT8_yEEm0CfyyDJmuQ6ybB3Fn9dA== Redirect headers pragma no-cache x-conversion-value 0.00 server nginx/1.20.0 x-rule * date Tue, 07 Dec 2021 14:03:52 GMT x-segment-eid 4OCRKBF4JJENXICP676FJT p3p CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA" location https://s.adroll.com/pixel/PIUCN4PSYRCCHBHOGPVN5Q/KDBRCBINVREGNJUXIQKBDP/4OCRKBF4JJENXICP676FJT.js cache-control no-store, no-cache, must-revalidate x-segment-display-name Visitors to Unsegmented Pages x-pixel-eid KDBRCBINVREGNJUXIQKBDP x-segment-name * x-advertisable-eid PIUCN4PSYRCCHBHOGPVN5Q content-length 0 x-conversion-currency
GET H2	200	fbevents.js Show response connect.facebook.net/en_US/	98 KB 26 KB	24ms 7ms	Script application/x-javascript	2a03:2880:f02d:12:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/en_US/fbevents.js Requested by Host: d.adroll.com URL: https://d.adroll.com/pixel/PIUCN4PSYRCCHBHOGPVN5Q/KDBRCBINVREGNJUXIQKBDP?adroll_fpc=4498f60f0b4b56ce69a90c18c9a6dbef-1638885832356&arrfrr=https%3A%2F%2Fwww.threatcrowd.org%2Fmalware.php%3Fmd5%3D775a0631fb8229b2aa3d7621427085ad&xid_ch=f&pv=97957316713.18564&cookie=&adroll_s_ref=&keyw= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash b23807a4c5d90afca0dc47d688c0a05302779429dab75f5e6182562dcc2970f6 Security Headers Name Value Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.threatcrowd.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers content-security-policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; content-encoding gzip x-content-type-options nosniff document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=3600,h3-29=":443"; ma=3600 content-length 25965 x-xss-protection 0 pragma public x-fb-debug bEWBZmm1wGWXZUyrjgX6KhMXkTkQjMgtNNYbrVq/TUawq2gCWOcwmgNjVn5fI3GKeCk1gsn7wodYnfAiMYEd1g== x-fb-trip-id 917726464 x-frame-options DENY date Tue, 07 Dec 2021 14:03:52 GMT strict-transport-security max-age=31536000; preload; includeSubDomains content-type application/x-javascript; charset=utf-8 vary Accept-Encoding cache-control public, max-age=1200 x-fb-rlafr 0 expires Sat, 01 Jan 2000 00:00:00 GMT
GET H/1.1	200 OK	sendrolling.js Show response s.adroll.com/j/	11 KB 3 KB	8ms 8ms	Script text/javascript	2600:9000:20eb:e400:6:9280:1080:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://s.adroll.com/j/sendrolling.js Requested by Host: d.adroll.com URL: https://d.adroll.com/pixel/PIUCN4PSYRCCHBHOGPVN5Q/KDBRCBINVREGNJUXIQKBDP?adroll_fpc=4498f60f0b4b56ce69a90c18c9a6dbef-1638885832356&arrfrr=https%3A%2F%2Fwww.threatcrowd.org%2Fmalware.php%3Fmd5%3D775a0631fb8229b2aa3d7621427085ad&xid_ch=f&pv=97957316713.18564&cookie=&adroll_s_ref=&keyw= Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2600:9000:20eb:e400:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 134568be83d33ab28a55e78e8e8ac638ac6a57ff1bfc62bb5bc4e93fee39e20f Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.threatcrowd.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers X-Amz-Version-Id nBEDfcrLpdZvNXYEtZnkvf0lC4F1AgZw Content-Encoding gzip Etag W/"c317a5be7d65fa0c4d68d9735af020e4" Age 154 X-Amz-Server-Side-Encryption AES256 Transfer-Encoding chunked X-Cache Hit from cloudfront Connection keep-alive Vary Accept-Encoding Via 1.1 c379418fd6100691807f32f274ebe9ce.cloudfront.net (CloudFront) Last-Modified Tue, 30 Nov 2021 21:53:03 GMT Server AmazonS3 Date Tue, 07 Dec 2021 14:01:23 GMT Access-Control-Max-Age 600 Access-Control-Allow-Methods GET Content-Type text/javascript Access-Control-Allow-Origin * Cache-Control max-age=3600 Access-Control-Allow-Credentials false X-Amz-Cf-Pop FRA2-C1 Access-Control-Allow-Headers * X-Amz-Cf-Id GlGamCL8-_Z7d3avIW-IoLBqKR7PTCzqXlLGHEjdjed8GKVSSEFXoA==
GET H2	200	KDBRCBINVREGNJUXIQKBDP d.adroll.com/onp/PIUCN4PSYRCCHBHOGPVN5Q/	42 B 535 B	29ms 28ms	Image image/gif	34.251.57.8 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://d.adroll.com/onp/PIUCN4PSYRCCHBHOGPVN5Q/KDBRCBINVREGNJUXIQKBDP?adroll_fpc=4498f60f0b4b56ce69a90c18c9a6dbef-1638885832356&arrfrr=https%3A%2F%2Fwww.threatcrowd.org%2Fmalware.php%3Fmd5%3D775a0631fb8229b2aa3d7621427085ad&xid_ch=f&pv=97957316713.18564&ev=t%3Dtop%26f%3D0 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.251.57.8 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-34-251-57-8.eu-west-1.compute.amazonaws.com Software nginx/1.20.0 / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.threatcrowd.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Tue, 07 Dec 2021 14:03:52 GMT server nginx/1.20.0 p3p CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA" cache-control no-store, no-cache, must-revalidate content-type image/gif x-advertisable-eid PIUCN4PSYRCCHBHOGPVN5Q content-length 42
GET H2	204	sync pixel.advertising.com/ups/55980/ Redirect Chain https://d.adroll.com/cm/onevideo/out?adroll_fpc=4498f60f0b4b56ce69a90c18c9a6dbef-1638885832356&arrfrr=https%3A%2F%2Fwww.threatcrowd.org%2Fmalware.php%3Fmd5%3D775a0631fb8229b2aa3d7621427085ad&xid_ch... https://pixel.advertising.com/ups/55980/sync?uid=NmZmY2IxOGY0ZWY2ZjgzMzdhMWIyYTNkZDAwNmQzMmE&_origin=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA https://pixel.advertising.com/ups/55980/sync?uid=NmZmY2IxOGY0ZWY2ZjgzMzdhMWIyYTNkZDAwNmQzMmE&_origin=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA&verify=true	0 124 B	10ms 9ms	Image text/plain	52.57.86.173 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://pixel.advertising.com/ups/55980/sync?uid=NmZmY2IxOGY0ZWY2ZjgzMzdhMWIyYTNkZDAwNmQzMmE&_origin=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA&verify=true Protocol H2 Server 52.57.86.173 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-57-86-173.eu-central-1.compute.amazonaws.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.threatcrowd.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Tue, 07 Dec 2021 14:03:52 GMT strict-transport-security max-age=31536000 p3p CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV Redirect headers location https://pixel.advertising.com/ups/55980/sync?uid=NmZmY2IxOGY0ZWY2ZjgzMzdhMWIyYTNkZDAwNmQzMmE&_origin=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA&verify=true date Tue, 07 Dec 2021 14:03:52 GMT content-length 0 strict-transport-security max-age=31536000 p3p CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
GET H2	200	Pug simage2.pubmatic.com/AdServer/ Redirect Chain https://d.adroll.com/cm/pubmatic/out?adroll_fpc=4498f60f0b4b56ce69a90c18c9a6dbef-1638885832356&arrfrr=https%3A%2F%2Fwww.threatcrowd.org%2Fmalware.php%3Fmd5%3D775a0631fb8229b2aa3d7621427085ad&xid_ch... https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMwNiZ0bD01MjU2MDA&piggybackCookie=NmZmY2IxOGY0ZWY2ZjgzMzdhMWIyYTNkZDAwNmQzMmE&gdpr=1&gdpr_consent=BOOoKswOOoKswA2ABBENA...	1 B 548 B	50ms 15ms	Image text/html	185.64.189.110 AS-PUBMATIC
General Check archive.org Show headers Download Go to Show image Full URL https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMwNiZ0bD01MjU2MDA&piggybackCookie=NmZmY2IxOGY0ZWY2ZjgzMzdhMWIyYTNkZDAwNmQzMmE&gdpr=1&gdpr_consent=BOOoKswOOoKswA2ABBENAkwAAAAXyACACYAIIA Protocol H2 Server 185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.threatcrowd.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Tue, 07 Dec 2021 14:03:51 GMT cache-control no-store, no-cache, private x-lat amspug005:0:579 server nginx content-type text/html; charset=utf-8 content-length 1 p3p CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Redirect headers location https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMwNiZ0bD01MjU2MDA&piggybackCookie=NmZmY2IxOGY0ZWY2ZjgzMzdhMWIyYTNkZDAwNmQzMmE&gdpr=1&gdpr_consent=BOOoKswOOoKswA2ABBENAkwAAAAXyACACYAIIA pragma no-cache date Tue, 07 Dec 2021 14:03:52 GMT cache-control no-store, no-cache, must-revalidate server nginx/1.20.0 content-length 220 p3p CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
GET H2	200	xuid eb2.3lift.com/ Redirect Chain https://d.adroll.com/cm/triplelift/out?adroll_fpc=4498f60f0b4b56ce69a90c18c9a6dbef-1638885832356&arrfrr=https%3A%2F%2Fwww.threatcrowd.org%2Fmalware.php%3Fmd5%3D775a0631fb8229b2aa3d7621427085ad&xid_... https://eb2.3lift.com/xuid?mid=4714&xuid=NmZmY2IxOGY0ZWY2ZjgzMzdhMWIyYTNkZDAwNmQzMmE&dongle=c85e https://eb2.3lift.com/xuid?ld=1&mid=4714&xuid=NmZmY2IxOGY0ZWY2ZjgzMzdhMWIyYTNkZDAwNmQzMmE&dongle=c85e&gdpr=1&cmp_cs=&us_privacy=	37 B 353 B	10ms 10ms	Image image/gif	13.248.245.213 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://eb2.3lift.com/xuid?ld=1&mid=4714&xuid=NmZmY2IxOGY0ZWY2ZjgzMzdhMWIyYTNkZDAwNmQzMmE&dongle=c85e&gdpr=1&cmp_cs=&us_privacy= Protocol H2 Server 13.248.245.213 , United States, ASN16509 (AMAZON-02, US), Reverse DNS a0f671730127a0812.awsglobalaccelerator.com Software / Resource Hash bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.threatcrowd.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Tue, 07 Dec 2021 14:03:52 GMT cache-control no-cache, no-store, must-revalidate content-type image/gif content-length 37 p3p policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC" Redirect headers location /xuid?ld=1&mid=4714&xuid=NmZmY2IxOGY0ZWY2ZjgzMzdhMWIyYTNkZDAwNmQzMmE&dongle=c85e&gdpr=1&cmp_cs=&us_privacy= date Tue, 07 Dec 2021 14:03:52 GMT cache-control no-cache, no-store, must-revalidate content-length 0 p3p policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
GET H/1.1	200 OK	bounce ib.adnxs.com/ Redirect Chain https://d.adroll.com/cm/x/out?adroll_fpc=4498f60f0b4b56ce69a90c18c9a6dbef-1638885832356&arrfrr=https%3A%2F%2Fwww.threatcrowd.org%2Fmalware.php%3Fmd5%3D775a0631fb8229b2aa3d7621427085ad&xid_ch=f&adve... https://ib.adnxs.com/setuid?entity=172&code=NmZmY2IxOGY0ZWY2ZjgzMzdhMWIyYTNkZDAwNmQzMmE https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D172%26code%3DNmZmY2IxOGY0ZWY2ZjgzMzdhMWIyYTNkZDAwNmQzMmE	43 B 1 KB	6ms 6ms	Image image/gif	37.252.172.249 ASN-APPNEX
General Check archive.org Show headers Download Go to Show image Full URL https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D172%26code%3DNmZmY2IxOGY0ZWY2ZjgzMzdhMWIyYTNkZDAwNmQzMmE Protocol HTTP/1.1 Server 37.252.172.249 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US), Reverse DNS 534.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net Software nginx/1.17.9 / Resource Hash 4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef Security Headers Name Value X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.threatcrowd.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Pragma no-cache Date Tue, 07 Dec 2021 14:03:52 GMT X-Proxy-Origin 185.213.155.164; 185.213.155.164; 534.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com AN-X-Request-Uuid 7efafbdd-4aa5-4d03-9b2b-aaa479ac0b1c Server nginx/1.17.9 P3P policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin * Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type image/gif Content-Length 43 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT Redirect headers Pragma no-cache Date Tue, 07 Dec 2021 14:03:52 GMT X-Proxy-Origin 185.213.155.164; 185.213.155.164; 534.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com AN-X-Request-Uuid 85de19a2-291b-4473-ad7f-e3d90c2bb499 Server nginx/1.17.9 P3P policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Location https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D172%26code%3DNmZmY2IxOGY0ZWY2ZjgzMzdhMWIyYTNkZDAwNmQzMmE Cache-Control no-store, no-cache, private Connection keep-alive Content-Type text/html; charset=utf-8 Content-Length 0 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
GET H2	204	v1 ads.yahoo.com/cms/ Redirect Chain https://d.adroll.com/cm/r/out?adroll_fpc=4498f60f0b4b56ce69a90c18c9a6dbef-1638885832356&arrfrr=https%3A%2F%2Fwww.threatcrowd.org%2Fmalware.php%3Fmd5%3D775a0631fb8229b2aa3d7621427085ad&xid_ch=f&adve... https://ads.yahoo.com/cms/v1?esig=1~bf4e7dc4546a90c08591652d78a230d3f2ef5733&nwid=10001032567&sigv=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA	0 443 B	78ms 21ms	Image text/plain	2a00:1288:80:800::7001 YAHOO-DEB
General Check archive.org Show headers Download Go to Show image Full URL https://ads.yahoo.com/cms/v1?esig=1~bf4e7dc4546a90c08591652d78a230d3f2ef5733&nwid=10001032567&sigv=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA Protocol H2 Server 2a00:1288:80:800::7001 , United Kingdom, ASN203220 (YAHOO-DEB, GB), Reverse DNS Software ATS / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.threatcrowd.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Tue, 07 Dec 2021 14:03:52 GMT cache-control no-store x-content-type-options nosniff server ATS strict-transport-security max-age=15552000 expect-ct max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" x-xss-protection 1; mode=block Redirect headers location https://ads.yahoo.com/cms/v1?esig=1~bf4e7dc4546a90c08591652d78a230d3f2ef5733&nwid=10001032567&sigv=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA pragma no-cache date Tue, 07 Dec 2021 14:03:52 GMT cache-control no-store, no-cache, must-revalidate server nginx/1.20.0 content-length 165 p3p CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
GET H/1.1	200 OK	sync x.bidswitch.net/ul_cb/ Redirect Chain https://d.adroll.com/cm/b/out?adroll_fpc=4498f60f0b4b56ce69a90c18c9a6dbef-1638885832356&arrfrr=https%3A%2F%2Fwww.threatcrowd.org%2Fmalware.php%3Fmd5%3D775a0631fb8229b2aa3d7621427085ad&xid_ch=f&adve... https://x.bidswitch.net/sync?dsp_id=44&user_id=NmZmY2IxOGY0ZWY2ZjgzMzdhMWIyYTNkZDAwNmQzMmE https://x.bidswitch.net/ul_cb/sync?dsp_id=44&user_id=NmZmY2IxOGY0ZWY2ZjgzMzdhMWIyYTNkZDAwNmQzMmE	43 B 495 B	10ms 9ms	Image image/gif	18.185.164.146 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://x.bidswitch.net/ul_cb/sync?dsp_id=44&user_id=NmZmY2IxOGY0ZWY2ZjgzMzdhMWIyYTNkZDAwNmQzMmE Protocol HTTP/1.1 Server 18.185.164.146 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-185-164-146.eu-central-1.compute.amazonaws.com Software / Resource Hash 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.threatcrowd.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Date Tue, 07 Dec 2021 14:03:52 GMT Cache-Control no-cache, no-store, must-revalidate Connection keep-alive Content-Length 43 Content-Type image/gif Redirect headers Location https://x.bidswitch.net/ul_cb/sync?dsp_id=44&user_id=NmZmY2IxOGY0ZWY2ZjgzMzdhMWIyYTNkZDAwNmQzMmE Date Tue, 07 Dec 2021 14:03:52 GMT Cache-Control no-cache, no-store, must-revalidate Connection keep-alive Content-Length 0
GET H2	200	out d.adroll.com/cm/l/	42 B 180 B	55ms 54ms	Image image/gif	34.251.57.8 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://d.adroll.com/cm/l/out?adroll_fpc=4498f60f0b4b56ce69a90c18c9a6dbef-1638885832356&arrfrr=https%3A%2F%2Fwww.threatcrowd.org%2Fmalware.php%3Fmd5%3D775a0631fb8229b2aa3d7621427085ad&xid_ch=f&advertisable=PIUCN4PSYRCCHBHOGPVN5Q Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.251.57.8 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-34-251-57-8.eu-west-1.compute.amazonaws.com Software nginx/1.20.0 / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.threatcrowd.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Tue, 07 Dec 2021 14:03:52 GMT cache-control no-transform,public,max-age=300,s-maxage=900 server nginx/1.20.0 content-length 42 vary Cookie content-type image/gif
GET H2	200	sd us-u.openx.net/w/1.0/ Redirect Chain https://d.adroll.com/cm/o/out?adroll_fpc=4498f60f0b4b56ce69a90c18c9a6dbef-1638885832356&arrfrr=https%3A%2F%2Fwww.threatcrowd.org%2Fmalware.php%3Fmd5%3D775a0631fb8229b2aa3d7621427085ad&xid_ch=f&adve... https://us-u.openx.net/w/1.0/sd?id=537103138&val=6ffcb18f4ef6f8337a1b2a3dd006d32a	43 B 275 B	54ms 22ms	Image image/gif	35.244.159.8 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://us-u.openx.net/w/1.0/sd?id=537103138&val=6ffcb18f4ef6f8337a1b2a3dd006d32a Protocol H2 Server 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US), Reverse DNS 8.159.244.35.bc.googleusercontent.com Software OXGW/16.221.0 / Resource Hash 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.threatcrowd.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Tue, 07 Dec 2021 14:03:52 GMT via 1.1 google server OXGW/16.221.0 vary Accept p3p CP="CUR ADM OUR NOR STA NID" cache-control private, max-age=0, no-cache content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 43 expires Mon, 26 Jul 1997 05:00:00 GMT Redirect headers location https://us-u.openx.net/w/1.0/sd?id=537103138&val=6ffcb18f4ef6f8337a1b2a3dd006d32a pragma no-cache date Tue, 07 Dec 2021 14:03:52 GMT cache-control no-store, no-cache, must-revalidate server nginx/1.20.0 content-length 87 p3p CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
GET H2	200	in d.adroll.com/cm/g/ Redirect Chain https://d.adroll.com/cm/g/out?adroll_fpc=4498f60f0b4b56ce69a90c18c9a6dbef-1638885832356&arrfrr=https%3A%2F%2Fwww.threatcrowd.org%2Fmalware.php%3Fmd5%3D775a0631fb8229b2aa3d7621427085ad&xid_ch=f&adve... https://cm.g.doubleclick.net/pixel?google_sc&google_nid=artb&google_hm=b_yxj072-DN6Gyo90AbTKg https://cm.g.doubleclick.net/pixel?google_sc=&google_nid=artb&google_hm=b_yxj072-DN6Gyo90AbTKg&google_tc= https://d.adroll.com/cm/g/in	42 B 538 B	29ms 29ms	Image image/gif	34.251.57.8 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://d.adroll.com/cm/g/in Protocol H2 Server 34.251.57.8 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-34-251-57-8.eu-west-1.compute.amazonaws.com Software nginx/1.20.0 / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.threatcrowd.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Tue, 07 Dec 2021 14:03:52 GMT server nginx/1.20.0 p3p CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA" cache-control no-store, no-cache, must-revalidate content-type image/gif content-length 42 x-result g.-1.-1.-1 Redirect headers pragma no-cache date Tue, 07 Dec 2021 14:03:52 GMT server HTTP server (unknown) p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" location https://d.adroll.com/cm/g/in cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type text/html; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 225 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	cluster-id Show response 58450528-a2b9-6a9d-4aea-8268e3a0be8f.z1.dca0.com/api/	16 B 116 B	1007ms 170ms	XHR text/plain	35.162.169.208 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://58450528-a2b9-6a9d-4aea-8268e3a0be8f.z1.dca0.com/api/cluster-id?uid=2dc65ee6-5d1a-cd9d-b4ac-dd724b895543 Requested by Host: s.dca0.com URL: https://s.dca0.com/ctx.v1.1.min.js?1635953272 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.162.169.208 Boardman, United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-35-162-169-208.us-west-2.compute.amazonaws.com Software / Resource Hash 3a085ef6e86e6454cf74275f375f8f2ae6bdde67027decb72aa108ca39ce68f3 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.threatcrowd.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers access-control-allow-origin * date Tue, 07 Dec 2021 14:03:53 GMT content-length 16 content-type text/plain; charset=utf-8
GET H3	200	845756422156575 Show response connect.facebook.net/signals/config/	305 KB 87 KB	18ms 9ms	Script application/x-javascript	2a03:2880:f02d:12:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/845756422156575?v=2.9.48&r=stable Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash e9c32332d5fb223e861849d8071867a07f46477974f410f0a196b2a5050b7c2f Security Headers Name Value Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.threatcrowd.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers content-security-policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; content-encoding gzip x-content-type-options nosniff document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=3600,h3-29=":443"; ma=3600 content-length 88852 x-xss-protection 0 pragma public x-fb-debug qIzRwYIdviZko8FqhHKr9OqK/vWe6YSKQipCa3fW7Wd6QNAQHEvBmJW8Wgx/guGA1LSe+Tto+wzt6kymvQR1lA== cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" cross-origin-opener-policy same-origin-allow-popups x-frame-options DENY date Tue, 07 Dec 2021 14:03:52 GMT strict-transport-security max-age=31536000; preload; includeSubDomains report-to {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"} content-type application/x-javascript; charset=utf-8 vary Accept-Encoding cache-control public, max-age=1200 x-fb-rlafr 0 priority u=3,i expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	/ www.facebook.com/tr/	44 B 295 B	24ms 7ms	Image image/gif	2a03:2880:f12d:83:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=845756422156575&ev=PageView&dl=https%3A%2F%2Fwww.threatcrowd.org%2Fmalware.php%3Fmd5%3D775a0631fb8229b2aa3d7621427085ad&rl=&if=false&ts=1638885832500&cd[segment_eid]=4OCRKBF4JJENXICP676FJT%2CKRUTSKUGEFEQTJVTXBH3RA%2CNJHKX3JAL5HMJFD4XI6P4T%2CVSVNSN2L2JGI5AYCWFL47B%2CWSHLBTOPTNENBHIR3IKXBN&sw=1600&sh=1200&v=2.9.48&r=stable&ec=0&o=29&fbp=fb.1.1638885832498.1018062475&it=1638885832449&coo=false&dpo=LDU&dpoco=0&dpost=0&rqm=GET Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash 10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.threatcrowd.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Tue, 07 Dec 2021 14:03:52 GMT last-modified Fri, 21 Dec 2012 00:00:01 GMT server proxygen-bolt strict-transport-security max-age=31536000; includeSubDomains content-type image/gif cache-control no-cache, must-revalidate, max-age=0 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=3600, h3-29=":443"; ma=3600 content-length 44 expires Tue, 07 Dec 2021 14:03:52 GMT
POST H2	200	PIUCN4PSYRCCHBHOGPVN5Q d.adroll.com/pex/	42 B 124 B	29ms 28ms	Ping image/gif	34.251.57.8 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://d.adroll.com/pex/PIUCN4PSYRCCHBHOGPVN5Q?adroll_fpc=4498f60f0b4b56ce69a90c18c9a6dbef-1638885832356&arrfrr=https%3A%2F%2Fwww.threatcrowd.org%2Fmalware.php%3Fmd5%3D775a0631fb8229b2aa3d7621427085ad&xid_ch=f&ev=xidctx&es=%7BSrk-kSr-mL-Skp%7D&esv=&pv=97957316713.18564 Requested by Host: s.adroll.com URL: https://s.adroll.com/j/roundtrip.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.251.57.8 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-34-251-57-8.eu-west-1.compute.amazonaws.com Software nginx/1.20.0 / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Request headers Referer https://www.threatcrowd.org/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers date Tue, 07 Dec 2021 14:03:53 GMT server nginx/1.20.0 content-length 42 content-type image/gif