URL: https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
Submission Tags: falconsandbox
Submission: On July 22 via api from US

Summary

This website contacted 34 IPs in 4 countries across 30 domains to perform 99 HTTP transactions. The main IP is 2606:4700:300b::a29f:f67d, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.fireeye.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on January 7th 2021. Valid for: a year.
This is the only time www.fireeye.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
22 2606:4700:300... 13335 (CLOUDFLAR...)
1 1 104.111.232.231 16625 (AKAMAI-AS)
2 13.108.249.135 14340 (SALESFORCE)
6 104.17.70.206 13335 (CLOUDFLAR...)
3 104.75.88.126 16625 (AKAMAI-AS)
3 2a00:1450:400... 15169 (GOOGLE)
2 2606:4700::68... 13335 (CLOUDFLAR...)
1 2a02:26f0:6c0... 20940 (AKAMAI-ASN1)
3 2620:1ec:c11:... 8068 (MICROSOFT...)
1 151.101.12.157 54113 (FASTLY)
1 142.250.186.162 15169 (GOOGLE)
2 104.111.234.67 16625 (AKAMAI-AS)
3 13.32.25.92 16509 (AMAZON-02)
2 2a03:2880:f01... 32934 (FACEBOOK)
6 2a00:1450:400... 15169 (GOOGLE)
1 13.226.145.91 16509 (AMAZON-02)
2 2 2620:119:50e1... 14413 (LINKEDIN)
1 1 2620:1ec:21::14 8068 (MICROSOFT...)
1 108.174.10.14 14413 (LINKEDIN)
1 104.244.42.5 13414 (TWITTER)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
2 2a03:2880:f11... 32934 (FACEBOOK)
12 35.173.142.174 14618 (AMAZON-AES)
2 2606:4700::68... 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
1 2.18.235.40 16625 (AKAMAI-AS)
1 104.244.42.195 13414 (TWITTER)
1 2606:4700::68... 13335 (CLOUDFLAR...)
2 130.211.29.114 15169 (GOOGLE)
1 52.213.168.74 16509 (AMAZON-02)
4 35.241.15.240 15169 (GOOGLE)
4 23.20.13.199 14618 (AMAZON-AES)
1 13.110.43.53 14340 (SALESFORCE)
99 34
Apex Domain
Subdomains
Transfer
28 fireeye.com
www.fireeye.com
www2.fireeye.com
817 KB
16 pathfactory.com
jukebox.pathfactory.com
spcollector.pathfactory.com
7 KB
6 perfdrive.com
cdn.perfdrive.com
cas.avalon.perfdrive.com
15 KB
6 google-analytics.com
www.google-analytics.com
20 KB
4 linkedin.com
px.ads.linkedin.com
www.linkedin.com
px4.ads.linkedin.com
3 KB
3 lookbookhq.com
app.cdn.lookbookhq.com
407 KB
3 bing.com
bat.bing.com
9 KB
3 googletagmanager.com
www.googletagmanager.com
139 KB
3 salesforceliveagent.com
c.la2c2.salesforceliveagent.com
d.la2c2.salesforceliveagent.com
d.la1-c1-ia5.salesforceliveagent.com
42 KB
2 google.de
www.google.de
676 B
2 google.com
www.google.com
447 B
2 bootstrapcdn.com
maxcdn.bootstrapcdn.com
77 KB
2 facebook.com
www.facebook.com
388 B
2 doubleclick.net
googleads.g.doubleclick.net
stats.g.doubleclick.net
2 KB
2 facebook.net
connect.facebook.net
99 KB
2 marketo.net
munchkin.marketo.net
6 KB
2 maxmind.com
js.maxmind.com
2 KB
2 addthis.com
s7.addthis.com
190 KB
1 omtrdc.net
fireeye.tt.omtrdc.net
786 B
1 cloudflare.com
cdnjs.cloudflare.com
23 KB
1 addthisedge.com
v1.addthisedge.com
1 KB
1 twitter.com
analytics.twitter.com
657 B
1 moatads.com
z.moatads.com
1 KB
1 googleapis.com
fonts.googleapis.com
1 KB
1 t.co
t.co
455 B
1 leadfeeder.com
lftracker.leadfeeder.com
8 KB
1 googleadservices.com
www.googleadservices.com
14 KB
1 ads-twitter.com
static.ads-twitter.com
2 KB
1 licdn.com
snap.licdn.com
2 KB
1 typography.com
cloud.typography.com
463 B
99 30
Domain Requested by
22 www.fireeye.com www.fireeye.com
12 jukebox.pathfactory.com www.fireeye.com
6 www.google-analytics.com www.googletagmanager.com
www.fireeye.com
6 www2.fireeye.com www.fireeye.com
www2.fireeye.com
4 spcollector.pathfactory.com www.fireeye.com
cdnjs.cloudflare.com
4 cas.avalon.perfdrive.com www.fireeye.com
3 app.cdn.lookbookhq.com www.fireeye.com
3 bat.bing.com www.googletagmanager.com
www.fireeye.com
3 www.googletagmanager.com www.fireeye.com
www.googletagmanager.com
2 cdn.perfdrive.com www.fireeye.com
2 www.google.de www.fireeye.com
2 www.google.com www.fireeye.com
2 maxcdn.bootstrapcdn.com www.fireeye.com
maxcdn.bootstrapcdn.com
2 www.facebook.com www.fireeye.com
2 px.ads.linkedin.com 2 redirects
2 connect.facebook.net www.fireeye.com
connect.facebook.net
2 munchkin.marketo.net www.googletagmanager.com
munchkin.marketo.net
2 js.maxmind.com www.fireeye.com
2 s7.addthis.com www.fireeye.com
1 d.la1-c1-ia5.salesforceliveagent.com www.fireeye.com
1 fireeye.tt.omtrdc.net www.fireeye.com
1 cdnjs.cloudflare.com www.fireeye.com
1 v1.addthisedge.com s7.addthis.com
1 d.la2c2.salesforceliveagent.com www.fireeye.com
1 analytics.twitter.com www.fireeye.com
1 z.moatads.com s7.addthis.com
1 fonts.googleapis.com www.fireeye.com
1 stats.g.doubleclick.net www.fireeye.com
1 googleads.g.doubleclick.net www.fireeye.com
1 t.co www.fireeye.com
1 px4.ads.linkedin.com www.fireeye.com
1 www.linkedin.com 1 redirects
1 lftracker.leadfeeder.com www.fireeye.com
1 www.googleadservices.com www.googletagmanager.com
1 static.ads-twitter.com www.googletagmanager.com
1 snap.licdn.com www.googletagmanager.com
1 c.la2c2.salesforceliveagent.com www.fireeye.com
1 cloud.typography.com 1 redirects
99 38
Subject Issuer Validity Valid
fireeye.com
Cloudflare Inc ECC CA-3
2021-01-07 -
2022-01-06
a year crt.sh
la1-c2-ord.salesforceliveagent.com
DigiCert TLS RSA SHA256 2020 CA1
2021-04-26 -
2022-04-25
a year crt.sh
www2.fireeye.com
Cloudflare Inc ECC CA-3
2021-06-10 -
2022-06-09
a year crt.sh
odc-addthis-prod-01.oracle.com
DigiCert SHA2 Secure Server CA
2021-04-25 -
2022-04-27
a year crt.sh
*.google-analytics.com
GTS CA 1C3
2021-06-22 -
2021-09-14
3 months crt.sh
*.maxmind.com
Sectigo RSA Organization Validation Secure Server CA
2020-10-07 -
2021-11-06
a year crt.sh
*.licdn.com
DigiCert SHA2 Secure Server CA
2021-04-30 -
2022-05-11
a year crt.sh
www.bing.com
Microsoft RSA TLS CA 01
2021-04-12 -
2021-10-12
6 months crt.sh
ads-twitter.com
DigiCert SHA2 High Assurance Server CA
2020-08-14 -
2021-08-19
a year crt.sh
www.googleadservices.com
GTS CA 1C3
2021-06-22 -
2021-09-14
3 months crt.sh
*.marketo.net
DigiCert SHA2 Secure Server CA
2021-03-29 -
2022-04-06
a year crt.sh
cdn.lookbookhq.com
Amazon
2020-11-08 -
2021-12-07
a year crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA
2021-05-26 -
2021-08-24
3 months crt.sh
*.leadfeeder.com
Amazon
2021-02-13 -
2022-03-14
a year crt.sh
px.ads.linkedin.com
DigiCert SHA2 Secure Server CA
2021-04-15 -
2021-10-15
6 months crt.sh
t.co
DigiCert TLS RSA SHA256 2020 CA1
2021-02-05 -
2022-02-04
a year crt.sh
*.g.doubleclick.net
GTS CA 1C3
2021-06-28 -
2021-09-20
3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2021-03-01 -
2022-02-28
a year crt.sh
upload.video.google.com
GTS CA 1O1
2021-06-28 -
2021-09-20
3 months crt.sh
*.pathfactory.com
Amazon
2021-03-22 -
2022-04-20
a year crt.sh
www.google.com
GTS CA 1C3
2021-06-28 -
2021-09-20
3 months crt.sh
www.google.de
GTS CA 1C3
2021-06-28 -
2021-09-20
3 months crt.sh
moatads.com
DigiCert SHA2 Secure Server CA
2021-01-21 -
2022-01-25
a year crt.sh
*.twitter.com
DigiCert TLS RSA SHA256 2020 CA1
2021-02-05 -
2022-02-04
a year crt.sh
*.perfdrive.com
Go Daddy Secure Certificate Authority - G2
2020-09-15 -
2021-09-26
a year crt.sh
*.tt.omtrdc.net
DigiCert SHA2 Secure Server CA
2020-11-02 -
2021-11-09
a year crt.sh
cas.avalon.perfdrive.com
Go Daddy Secure Certificate Authority - G2
2020-07-30 -
2021-08-05
a year crt.sh
la1-c1-ia5.salesforceliveagent.com
DigiCert TLS RSA SHA256 2020 CA1
2021-04-07 -
2022-04-06
a year crt.sh

This page contains 2 frames:

Primary Page: https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
Frame ID: 788BC29C8E390DBE4834435097C5FB78
Requests: 96 HTTP requests in this frame

Frame: https://www2.fireeye.com/index.php/form/XDFrame
Frame ID: 6ABBA65C100E850276ADB896900AB5DB
Requests: 2 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /^cloudflare$/i

Page Statistics

99
Requests

99 %
HTTPS

47 %
IPv6

30
Domains

38
Subdomains

34
IPs

4
Countries

2028 kB
Transfer

4836 kB
Size

27
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 3
  • https://cloud.typography.com/6746836/6977592/css/fonts.css HTTP 302
  • https://www.fireeye.com/content/dam/fireeye-www/fw/f/775489/E164E390493CD4814.css
Request Chain 35
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=6572&time=1626998038523&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2013%2F04%2Fmalware-callbacks.html HTTP 302
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D6572%26time%3D1626998038523%26url%3Dhttps%253A%252F%252Fwww.fireeye.com%252Fblog%252Fthreat-research%252F2013%252F04%252Fmalware-callbacks.html%26liSync%3Dtrue HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=6572&time=1626998038523&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2013%2F04%2Fmalware-callbacks.html&liSync=true HTTP 302
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=6572&time=1626998038523&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2013%2F04%2Fmalware-callbacks.html&liSync=true&e_ipv6=AQI5EBUFyn_HwwAAAXrQo-NFQukAJtIr2GG2mv7jLLGxZPzLoFaLrez2HJs3OAfKhMnfjw-M

99 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request malware-callbacks.html
www.fireeye.com/blog/threat-research/2013/04/
70 KB
19 KB
Document
General
Full URL
https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
33d7568469159814a5802ca59e5792ec1623a9a4fb63e42eef604b4805613806
Security Headers
Name Value
Content-Security-Policy worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://content.fireeye.com
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
www.fireeye.com
:scheme
https
:path
/blog/threat-research/2013/04/malware-callbacks.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 22 Jul 2021 23:53:58 GMT
content-type
text/html; charset=UTF-8
cf-ray
67309764b90b2c0d-FRA
cache-control
public, max-age=691200
expires
Fri, 30 Jul 2021 23:53:58 GMT
strict-transport-security
max-age=31536000; includeSubDomains
vary
Accept-Encoding,User-Agent
cf-cache-status
MISS
content-security-policy
worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-content-type-options
nosniff
x-dispatcher
dispatcher1uswest1
x-frame-options
ALLOW-FROM https://content.fireeye.com
x-vhost
publish
x-xss-protection
1; mode=block
server
cloudflare
content-encoding
gzip
jquery.min.js
www.fireeye.com/etc.clientlibs/clientlibs/granite/
111 KB
38 KB
Script
General
Full URL
https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery.min.js
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b397476bcbcf8c9eae3f82007cc4f9495661b367e02e6d3dea6e15f0610ef20a
Security Headers
Name Value
Content-Security-Policy worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://content.fireeye.com
X-Xss-Protection 1; mode=block

Request headers

:path
/etc.clientlibs/clientlibs/granite/jquery.min.js
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.fireeye.com
referer
https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-dispatcher
dispatcher1uswest1
date
Thu, 22 Jul 2021 23:53:58 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
6703
x-vhost
publish
vary
Accept-Encoding,User-Agent
content-length
38305
x-xss-protection
1; mode=block
last-modified
Thu, 22 Jul 2021 21:29:20 GMT
server
cloudflare
x-frame-options
ALLOW-FROM https://content.fireeye.com
etag
"1baa2-5c7bcfae3b7d2-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript
cache-control
public, max-age=691200
content-security-policy
worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges
bytes
cf-ray
6730976b28052c0d-FRA
expires
Fri, 30 Jul 2021 23:53:58 GMT
csrf.min.js
www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/
4 KB
2 KB
Script
General
Full URL
https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fbcc2c7d4dfbc5d0251c789843b8d7edf25306dfa23188ad267e2786357233c0
Security Headers
Name Value
Content-Security-Policy worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://content.fireeye.com
X-Xss-Protection 1; mode=block

Request headers

:path
/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.fireeye.com
referer
https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-dispatcher
dispatcher2uswest1
date
Thu, 22 Jul 2021 23:53:58 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
6702
x-vhost
publish
vary
Accept-Encoding,User-Agent
content-length
1676
x-xss-protection
1; mode=block
last-modified
Thu, 22 Jul 2021 21:26:33 GMT
server
cloudflare
x-frame-options
ALLOW-FROM https://content.fireeye.com
etag
"f3e-5c7bcf0e7479c-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript
cache-control
public, max-age=691200
content-security-policy
worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges
bytes
cf-ray
6730976b28062c0d-FRA
expires
Fri, 30 Jul 2021 23:53:58 GMT
clientlibs_nav.min.js
www.fireeye.com/etc/designs/fireeye-www/
12 KB
4 KB
Script
General
Full URL
https://www.fireeye.com/etc/designs/fireeye-www/clientlibs_nav.min.js
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
84a91ff2a1a995e3816750f53342b4499bfefc817a8ee1a5d4b401433692d510
Security Headers
Name Value
Content-Security-Policy worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://content.fireeye.com
X-Xss-Protection 1; mode=block

Request headers

:path
/etc/designs/fireeye-www/clientlibs_nav.min.js
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.fireeye.com
referer
https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-dispatcher
dispatcher1uswest1
date
Thu, 22 Jul 2021 23:53:58 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
6701
x-vhost
publish
vary
Accept-Encoding,User-Agent
content-length
3882
x-xss-protection
1; mode=block
last-modified
Thu, 22 Jul 2021 21:26:33 GMT
server
cloudflare
x-frame-options
ALLOW-FROM https://content.fireeye.com
etag
"2f77-5c7bcf0e73786-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript
cache-control
public, max-age=691200
content-security-policy
worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges
bytes
cf-ray
6730976b28082c0d-FRA
expires
Fri, 30 Jul 2021 23:53:58 GMT
E164E390493CD4814.css
www.fireeye.com/content/dam/fireeye-www/fw/f/775489/
Redirect Chain
  • https://cloud.typography.com/6746836/6977592/css/fonts.css
  • https://www.fireeye.com/content/dam/fireeye-www/fw/f/775489/E164E390493CD4814.css
473 KB
356 KB
Stylesheet
General
Full URL
https://www.fireeye.com/content/dam/fireeye-www/fw/f/775489/E164E390493CD4814.css
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a4c67fe8115b40f60d96ecd24873ba492cfdc4d876d1368c1c1142237f56292a
Security Headers
Name Value
Content-Security-Policy worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://content.fireeye.com
X-Xss-Protection 1; mode=block

Request headers

:path
/content/dam/fireeye-www/fw/f/775489/E164E390493CD4814.css
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
www.fireeye.com
referer
https://www.fireeye.com/
:scheme
https
sec-fetch-site
cross-site
:method
GET
Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-dispatcher
dispatcher2uswest1
date
Thu, 22 Jul 2021 23:53:58 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
2675
cf-polished
origSize=485384
x-vhost
publish
cf-bgj
minify
vary
Accept-Encoding,User-Agent
x-xss-protection
1; mode=block
last-modified
Thu, 22 Jul 2021 22:43:44 GMT
server
cloudflare
x-frame-options
ALLOW-FROM https://content.fireeye.com
etag
W/"76808-5c7be04f9c086-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains
content-type
text/css
cache-control
public, max-age=691200
content-security-policy
worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
cf-ray
6730976bc8a92c0d-FRA
expires
Fri, 30 Jul 2021 23:53:58 GMT

Redirect headers

Date
Thu, 22 Jul 2021 23:53:58 GMT
Last-Modified
Wed, 01 Apr 2020 20:12:09 GMT
Server
AkamaiNetStorage
ETag
"d0795af83d79e23ccaffb60b4a75e364:1626820712.711267"
Content-Type
text/html
Location
https://www.fireeye.com/content/dam/fireeye-www/fw/f/775489/E164E390493CD4814.css
Cache-Control
must-revalidate, private
Connection
keep-alive
X-HCo-pid
16
Content-Length
154
Expires
Thu, 22 July 2021 23:53:58 GMT
patch.css
www.fireeye.com/content/dam/fireeye-www/fw/css/
6 KB
2 KB
Stylesheet
General
Full URL
https://www.fireeye.com/content/dam/fireeye-www/fw/css/patch.css?v=1
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d78bfcf1f62b6a4a6c403372ad3a4f46fcf2bda72822ae206129d38de72f4d84
Security Headers
Name Value
Content-Security-Policy worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://content.fireeye.com
X-Xss-Protection 1; mode=block

Request headers

:path
/content/dam/fireeye-www/fw/css/patch.css?v=1
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
www.fireeye.com
referer
https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-dispatcher
dispatcher1uswest1
date
Thu, 22 Jul 2021 23:53:58 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
13171
cf-polished
origSize=6112
x-vhost
publish
cf-bgj
minify
vary
Accept-Encoding,User-Agent
x-xss-protection
1; mode=block
last-modified
Fri, 18 Dec 2020 19:29:31 GMT
server
cloudflare
x-frame-options
ALLOW-FROM https://content.fireeye.com
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains
content-type
text/css
cache-control
public, max-age=691200
content-security-policy
worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
cf-ray
6730976b28092c0d-FRA
expires
Fri, 30 Jul 2021 23:53:58 GMT
clientlibs_fw-2019.min.css
www.fireeye.com/etc/designs/fireeye-www/
211 KB
41 KB
Stylesheet
General
Full URL
https://www.fireeye.com/etc/designs/fireeye-www/clientlibs_fw-2019.min.css
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
985a53bcdeef61498d5d62a66f67a440ae441de38cced2a9cfbc8bd6b029da58
Security Headers
Name Value
Content-Security-Policy worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://content.fireeye.com
X-Xss-Protection 1; mode=block

Request headers

:path
/etc/designs/fireeye-www/clientlibs_fw-2019.min.css
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
www.fireeye.com
referer
https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-dispatcher
dispatcher2uswest1
date
Thu, 22 Jul 2021 23:53:58 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
12240
x-vhost
publish
vary
Accept-Encoding,User-Agent
content-length
41599
x-xss-protection
1; mode=block
last-modified
Wed, 21 Jul 2021 21:58:22 GMT
server
cloudflare
x-frame-options
ALLOW-FROM https://content.fireeye.com
etag
"34cc2-5c7a944d9eca7-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains
content-type
text/css
cache-control
public, max-age=691200
content-security-policy
worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges
bytes
cf-ray
6730976b280b2c0d-FRA
expires
Fri, 30 Jul 2021 23:53:58 GMT
clientlibs_base.min.css
www.fireeye.com/etc/clientlibs/fireeye-blog/
5 KB
2 KB
Stylesheet
General
Full URL
https://www.fireeye.com/etc/clientlibs/fireeye-blog/clientlibs_base.min.css
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
757eb886edd9a887fc95b701c88b08191eb743657027636c0c9d4973547ebb4a
Security Headers
Name Value
Content-Security-Policy worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://content.fireeye.com
X-Xss-Protection 1; mode=block

Request headers

:path
/etc/clientlibs/fireeye-blog/clientlibs_base.min.css
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
www.fireeye.com
referer
https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-dispatcher
dispatcher1uswest1
date
Thu, 22 Jul 2021 23:53:58 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
10307
x-vhost
publish
vary
Accept-Encoding,User-Agent
content-length
1501
x-xss-protection
1; mode=block
last-modified
Wed, 21 Jul 2021 22:16:37 GMT
server
cloudflare
x-frame-options
ALLOW-FROM https://content.fireeye.com
etag
"1507-5c7a98625022d-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains
content-type
text/css
cache-control
public, max-age=691200
content-security-policy
worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges
bytes
cf-ray
6730976b280c2c0d-FRA
expires
Fri, 30 Jul 2021 23:53:58 GMT
utils.min.js
www.fireeye.com/etc.clientlibs/clientlibs/granite/
10 KB
4 KB
Script
General
Full URL
https://www.fireeye.com/etc.clientlibs/clientlibs/granite/utils.min.js
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
799cb15a25ed2fa78bdba496d1afbc68f033a3a5dd9ead12f4eaac4e0a93236d
Security Headers
Name Value
Content-Security-Policy worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://content.fireeye.com
X-Xss-Protection 1; mode=block

Request headers

:path
/etc.clientlibs/clientlibs/granite/utils.min.js
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.fireeye.com
referer
https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-dispatcher
dispatcher1uswest1
date
Thu, 22 Jul 2021 23:53:58 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
6657
x-vhost
publish
vary
Accept-Encoding,User-Agent
content-length
3706
x-xss-protection
1; mode=block
last-modified
Thu, 22 Jul 2021 21:27:05 GMT
server
cloudflare
x-frame-options
ALLOW-FROM https://content.fireeye.com
etag
"26ad-5c7bcf2d1e968-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript
cache-control
public, max-age=691200
content-security-policy
worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges
bytes
cf-ray
6730976b280d2c0d-FRA
expires
Fri, 30 Jul 2021 23:53:58 GMT
granite.min.js
www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/
4 KB
2 KB
Script
General
Full URL
https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c986afd07a4082d65befeef18869a4cd5e00f3ac6e8228d49658802c7453a1b8
Security Headers
Name Value
Content-Security-Policy worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://content.fireeye.com
X-Xss-Protection 1; mode=block

Request headers

:path
/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.fireeye.com
referer
https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-dispatcher
dispatcher2uswest1
date
Thu, 22 Jul 2021 23:53:58 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
6657
x-vhost
publish
vary
Accept-Encoding,User-Agent
content-length
1702
x-xss-protection
1; mode=block
last-modified
Thu, 22 Jul 2021 21:27:05 GMT
server
cloudflare
x-frame-options
ALLOW-FROM https://content.fireeye.com
etag
"f90-5c7bcf2d19b53-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript
cache-control
public, max-age=691200
content-security-policy
worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges
bytes
cf-ray
6730976b280e2c0d-FRA
expires
Fri, 30 Jul 2021 23:53:58 GMT
jquery.min.js
www.fireeye.com/etc.clientlibs/foundation/clientlibs/
16 B
200 B
Script
General
Full URL
https://www.fireeye.com/etc.clientlibs/foundation/clientlibs/jquery.min.js
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c084b47104c493fb377b6d35d8c08df67d773f6dcf8294c0a7360710cd8cacbd
Security Headers
Name Value
Content-Security-Policy worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://content.fireeye.com
X-Xss-Protection 1; mode=block

Request headers

:path
/etc.clientlibs/foundation/clientlibs/jquery.min.js
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.fireeye.com
referer
https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-dispatcher
dispatcher2uswest1
date
Thu, 22 Jul 2021 23:53:58 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
age
6656
x-vhost
publish
vary
User-Agent, Accept-Encoding
content-length
16
x-xss-protection
1; mode=block
last-modified
Thu, 22 Jul 2021 21:37:09 GMT
server
cloudflare
x-frame-options
ALLOW-FROM https://content.fireeye.com
etag
"10-5c7bd16d3762d"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript
cache-control
public, max-age=691200
content-security-policy
worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges
bytes
cf-ray
6730976b280f2c0d-FRA
expires
Fri, 30 Jul 2021 23:53:58 GMT
shared.min.js
www.fireeye.com/etc.clientlibs/foundation/clientlibs/
24 KB
7 KB
Script
General
Full URL
https://www.fireeye.com/etc.clientlibs/foundation/clientlibs/shared.min.js
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4086c8cd4c3361452c1c1da9af3034fc90f4a375c4f6195f31d6dcf1c7b56f00
Security Headers
Name Value
Content-Security-Policy worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://content.fireeye.com
X-Xss-Protection 1; mode=block

Request headers

:path
/etc.clientlibs/foundation/clientlibs/shared.min.js
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.fireeye.com
referer
https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-dispatcher
dispatcher2uswest1
date
Thu, 22 Jul 2021 23:53:58 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
6655
x-vhost
publish
vary
Accept-Encoding,User-Agent
content-length
6920
x-xss-protection
1; mode=block
last-modified
Thu, 22 Jul 2021 21:27:05 GMT
server
cloudflare
x-frame-options
ALLOW-FROM https://content.fireeye.com
etag
"5e7e-5c7bcf2d1fcfb-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript
cache-control
public, max-age=691200
content-security-policy
worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges
bytes
cf-ray
6730976b28102c0d-FRA
expires
Fri, 30 Jul 2021 23:53:58 GMT
modern.min.js
www.fireeye.com/etc.clientlibs/clientlibs/granite/lodash/
34 KB
12 KB
Script
General
Full URL
https://www.fireeye.com/etc.clientlibs/clientlibs/granite/lodash/modern.min.js
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
355604a949ef95ceffcd21a7e9b5ed27c95d847f95127e0ddad5aa1793f1bb74
Security Headers
Name Value
Content-Security-Policy worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://content.fireeye.com
X-Xss-Protection 1; mode=block

Request headers

:path
/etc.clientlibs/clientlibs/granite/lodash/modern.min.js
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.fireeye.com
referer
https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-dispatcher
dispatcher1uswest1
date
Thu, 22 Jul 2021 23:53:58 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
6654
x-vhost
publish
vary
Accept-Encoding,User-Agent
content-length
11784
x-xss-protection
1; mode=block
last-modified
Thu, 22 Jul 2021 21:32:13 GMT
server
cloudflare
x-frame-options
ALLOW-FROM https://content.fireeye.com
etag
"87c8-5c7bd052fcf1b-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript
cache-control
public, max-age=691200
content-security-policy
worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges
bytes
cf-ray
6730976b28112c0d-FRA
expires
Fri, 30 Jul 2021 23:53:58 GMT
kernel.min.js
www.fireeye.com/etc.clientlibs/cq/personalization/clientlib/personalization/
119 KB
26 KB
Script
General
Full URL
https://www.fireeye.com/etc.clientlibs/cq/personalization/clientlib/personalization/kernel.min.js
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
79b2448738716f0daf11d4a206e105e3b79e9d082f9c9bf4ad2bd55e591a1a3c
Security Headers
Name Value
Content-Security-Policy worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://content.fireeye.com
X-Xss-Protection 1; mode=block

Request headers

:path
/etc.clientlibs/cq/personalization/clientlib/personalization/kernel.min.js
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.fireeye.com
referer
https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-dispatcher
dispatcher1uswest1
date
Thu, 22 Jul 2021 23:53:58 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
6653
x-vhost
publish
vary
Accept-Encoding,User-Agent
content-length
26194
x-xss-protection
1; mode=block
last-modified
Thu, 22 Jul 2021 21:27:05 GMT
server
cloudflare
x-frame-options
ALLOW-FROM https://content.fireeye.com
etag
"1dd96-5c7bcf2d32da0-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript
cache-control
public, max-age=691200
content-security-policy
worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges
bytes
cf-ray
6730976b28122c0d-FRA
expires
Fri, 30 Jul 2021 23:53:58 GMT
deployment.js
c.la2c2.salesforceliveagent.com/content/g/js/34.0/
41 KB
41 KB
Script
General
Full URL
https://c.la2c2.salesforceliveagent.com/content/g/js/34.0/deployment.js
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
13.108.249.135 , United States, ASN14340 (SALESFORCE, US),
Reverse DNS
dcl4-ord.la1-c2-ord.salesforceliveagent.com
Software
Jetty /
Resource Hash
abd6fc0a5afb5d28db8874f1d70042c5c43031835ece5f9c439bfb8be0986537

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Thu, 22 Jul 2021 23:53:58 GMT
Cache-Control
max-age=60, must-revalidate
Last-Modified
Fri, 09 Jul 2021 22:41:42 GMT
Server
Jetty
Accept-Ranges
bytes
Content-Length
41548
Content-Type
application/javascript
fe-logo-color.svg
www.fireeye.com/content/dam/fireeye-www/fw/images/
3 KB
1 KB
Image
General
Full URL
https://www.fireeye.com/content/dam/fireeye-www/fw/images/fe-logo-color.svg
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f684d50dc9b24df0a4845f688a45b856d945f79d79549240187e171e1655f236
Security Headers
Name Value
Content-Security-Policy worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://content.fireeye.com
X-Xss-Protection 1; mode=block

Request headers

:path
/content/dam/fireeye-www/fw/images/fe-logo-color.svg
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.fireeye.com
referer
https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-dispatcher
dispatcher2uswest1
date
Thu, 22 Jul 2021 23:53:58 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
8754
x-vhost
publish
vary
Accept-Encoding,User-Agent
content-length
1239
x-xss-protection
1; mode=block
last-modified
Thu, 22 Jul 2021 21:28:04 GMT
server
cloudflare
x-frame-options
ALLOW-FROM https://content.fireeye.com
etag
W/"cec-5c7bcf661562e-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/svg+xml
cache-control
public, max-age=691200
content-security-policy
worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges
bytes
cf-ray
6730976b98752c0d-FRA
expires
Fri, 30 Jul 2021 23:53:58 GMT
bnr-mandiant-advantage-v3-315x315.png
www.fireeye.com/content/dam/fireeye-www/services/images/
55 KB
55 KB
Image
General
Full URL
https://www.fireeye.com/content/dam/fireeye-www/services/images/bnr-mandiant-advantage-v3-315x315.png
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a83836ec8efa8e402e410455200c7a01b33e8e390c7b9ddfa5ab3224a0d44286
Security Headers
Name Value
Content-Security-Policy worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://content.fireeye.com
X-Xss-Protection 1; mode=block

Request headers

:path
/content/dam/fireeye-www/services/images/bnr-mandiant-advantage-v3-315x315.png
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.fireeye.com
referer
https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-dispatcher
dispatcher1uswest1
date
Thu, 22 Jul 2021 23:53:58 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
age
4495
cf-polished
origSize=57113
x-vhost
publish
cf-bgj
imgq:85,h2pri
vary
Accept-Encoding
content-length
56255
x-xss-protection
1; mode=block
last-modified
Thu, 22 Jul 2021 21:54:02 GMT
server
cloudflare
x-frame-options
ALLOW-FROM https://content.fireeye.com
etag
"df19-5c7bd533bfaca"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/png
cache-control
public, max-age=691200
content-security-policy
worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges
bytes
cf-ray
6730976b98762c0d-FRA
expires
Fri, 30 Jul 2021 23:53:58 GMT
forms2.min.js
www2.fireeye.com/js/forms2/js/
204 KB
68 KB
Script
General
Full URL
https://www2.fireeye.com/js/forms2/js/forms2.min.js
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.70.206 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
014de295141a456ceda8e3c4762085e53dca50f91ddf65906d227f70cf0b1a55
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 22 Jul 2021 23:53:58 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
last-modified
Fri, 18 Jun 2021 20:07:07 GMT
server
cloudflare
age
4993
etag
"400c0-33187-5c50fde38d0c0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
public, max-age=14400
cf-ray
6730976c9ebf331e-CDG
expires
Fri, 23 Jul 2021 03:53:58 GMT
clientlibs_fw.min.js
www.fireeye.com/etc/designs/fireeye-www/
165 KB
50 KB
Script
General
Full URL
https://www.fireeye.com/etc/designs/fireeye-www/clientlibs_fw.min.js
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b82c98e8c4f4a5c771ef6f061634b0fe49da9f53f915cdf0f576b1cf655db0c1
Security Headers
Name Value
Content-Security-Policy worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://content.fireeye.com
X-Xss-Protection 1; mode=block

Request headers

:path
/etc/designs/fireeye-www/clientlibs_fw.min.js
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.fireeye.com
referer
https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-dispatcher
dispatcher1uswest1
date
Thu, 22 Jul 2021 23:53:58 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
6686
x-vhost
publish
vary
Accept-Encoding,User-Agent
content-length
50685
x-xss-protection
1; mode=block
last-modified
Thu, 22 Jul 2021 21:29:39 GMT
server
cloudflare
x-frame-options
ALLOW-FROM https://content.fireeye.com
etag
"29217-5c7bcfc05e559-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript
cache-control
public, max-age=691200
content-security-policy
worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges
bytes
cf-ray
6730976b98722c0d-FRA
expires
Fri, 30 Jul 2021 23:53:58 GMT
addthis_widget.js
s7.addthis.com/js/300/
353 KB
114 KB
Script
General
Full URL
https://s7.addthis.com/js/300/addthis_widget.js
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.75.88.126 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-75-88-126.deploy.static.akamaitechnologies.com
Software
nginx/1.15.8 /
Resource Hash
acd2f7ad78edeebad4b6b0fdd17ff57d81c3726c60fd5435ee8c5a0115d29403
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=15724800; includeSubDomains
content-encoding
gzip
last-modified
Mon, 26 Oct 2020 18:11:48 GMT
server
nginx/1.15.8
etag
W/"5f971164-5834c"
vary
Accept-Encoding
x-distribution
99
content-type
application/javascript
date
Thu, 22 Jul 2021 23:53:58 GMT
x-host
s7.addthis.com
content-length
116325
gtm.js
www.googletagmanager.com/
314 KB
101 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-MVGC8KK
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
95687e1f33ad9db49292344fc79e6de6a4d35f4e796386f099323a98dc20694d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 22 Jul 2021 23:53:58 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
103356
x-xss-protection
0
last-modified
Thu, 22 Jul 2021 22:30:48 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Thu, 22 Jul 2021 23:53:58 GMT
token.json
www.fireeye.com/libs/granite/csrf/
2 B
111 B
XHR
General
Full URL
https://www.fireeye.com/libs/granite/csrf/token.json
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
Security Headers
Name Value
Content-Security-Policy worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff nosniff
X-Frame-Options ALLOW-FROM https://content.fireeye.com
X-Xss-Protection 1; mode=block

Request headers

:path
/libs/granite/csrf/token.json
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
empty
:authority
www.fireeye.com
referer
https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-dispatcher
dispatcher1uswest1
date
Thu, 22 Jul 2021 23:53:58 GMT
x-content-type-options
nosniff nosniff
cf-cache-status
DYNAMIC
x-vhost
publish
vary
User-Agent, Accept-Encoding
content-length
2
x-xss-protection
1; mode=block
server
cloudflare
x-frame-options
ALLOW-FROM https://content.fireeye.com
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/json;charset=iso-8859-1
cache-control
no-cache
content-security-policy
worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
cf-ray
6730976b88652c0d-FRA
expires
-1
me
js.maxmind.com/geoip/v2.1/country/
771 B
1010 B
XHR
General
Full URL
https://js.maxmind.com/geoip/v2.1/country/me?referrer=https%3A%2F%2Fwww.fireeye.com
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:262f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1f5615dc982df93ec052cf09795ccd312f7c1c7c6be25440b17de0d75a4cb107

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 22 Jul 2021 23:53:58 GMT
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type
application/vnd.maxmind.com-country+json; charset=UTF-8; version=2.1
access-control-allow-origin
*
cf-ray
6730976bc888bebf-FRA
content-length
771
truncated
/
28 KB
28 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
bb854d12c9f15b7e02f12ed4f774638aba6640d5f6f13a3bfa425dbbf0b745f3

Request headers

Origin
https://www.fireeye.com
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
application/x-font-woff2
fireicons.woff
www.fireeye.com/content/dam/fireeye-www/fw/f/
72 KB
36 KB
Font
General
Full URL
https://www.fireeye.com/content/dam/fireeye-www/fw/f/fireicons.woff?mva1rk
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc/designs/fireeye-www/clientlibs_fw-2019.min.css
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
85b6f75f021535da621a7a7f0974ef384720048e32aba9b217d1252329a287a3
Security Headers
Name Value
Content-Security-Policy worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://content.fireeye.com
X-Xss-Protection 1; mode=block

Request headers

:path
/content/dam/fireeye-www/fw/f/fireicons.woff?mva1rk
pragma
no-cache
origin
https://www.fireeye.com
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
font
:authority
www.fireeye.com
referer
https://www.fireeye.com/etc/designs/fireeye-www/clientlibs_fw-2019.min.css
:scheme
https
sec-fetch-site
same-origin
:method
GET
Origin
https://www.fireeye.com
Referer
https://www.fireeye.com/etc/designs/fireeye-www/clientlibs_fw-2019.min.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-dispatcher
dispatcher1uswest1
date
Thu, 22 Jul 2021 23:53:58 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
412
x-vhost
publish
vary
Accept-Encoding,User-Agent
content-length
36869
x-xss-protection
1; mode=block
last-modified
Thu, 27 May 2021 20:35:09 GMT
server
cloudflare
x-frame-options
ALLOW-FROM https://content.fireeye.com
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/x-font-woff
cache-control
public, max-age=691200
content-security-policy
worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges
bytes
cf-ray
6730976c491b2c0d-FRA
expires
Fri, 30 Jul 2021 23:53:58 GMT
insight.min.js
snap.licdn.com/li.lms-analytics/
5 KB
2 KB
Script
General
Full URL
https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVGC8KK
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:6c00:2b0::25ea Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
6e6e6a03e72a528c28884b50bf296425667f38dd0aaf1dd17ce89199ffc85271

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Thu, 22 Jul 2021 23:53:58 GMT
Content-Encoding
gzip
Last-Modified
Tue, 15 Jun 2021 01:25:13 GMT
X-CDN
AKAM
Vary
Accept-Encoding
Content-Type
application/x-javascript;charset=utf-8
Cache-Control
max-age=22210
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
2079
bat.js
bat.bing.com/
30 KB
9 KB
Script
General
Full URL
https://bat.bing.com/bat.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVGC8KK
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
6e9e8d16e703a71a0020912bb5435e8af2e5b41bbd4661905471f84dfb52e1d3

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 22 Jul 2021 23:53:58 GMT
content-encoding
gzip
last-modified
Tue, 20 Jul 2021 18:24:21 GMT
x-msedge-ref
Ref A: 7411F38765C44D81BB3B5D367A251180 Ref B: FRAEDGE1321 Ref C: 2021-07-22T23:53:58Z
etag
"80b87575947dd71:0"
vary
Accept-Encoding
x-cache
CONFIG_NOCACHE
content-type
application/javascript
access-control-allow-origin
*
cache-control
private,max-age=1800
accept-ranges
bytes
content-length
9014
uwt.js
static.ads-twitter.com/
5 KB
2 KB
Script
General
Full URL
https://static.ads-twitter.com/uwt.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVGC8KK
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.12.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
a53ea60fbea6cb1775430998564d5f295aba7d3bfe548a0ba79aa2a049aba839

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 22 Jul 2021 23:53:58 GMT
via
1.1 varnish
last-modified
Mon, 12 Jul 2021 21:25:31 GMT
age
85612
etag
"65cf0c0ceb852397f0d1e6732cd3c533+gzip"
vary
Accept-Encoding,Host
x-cache
HIT
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
content-encoding
gzip
cache-control
no-cache
accept-ranges
bytes
content-type
application/javascript; charset=utf-8
content-length
1958
x-timer
S1626998039.517821,VS0,VE0
x-served-by
cache-fra19155-FRA
conversion_async.js
www.googleadservices.com/pagead/
36 KB
14 KB
Script
General
Full URL
https://www.googleadservices.com/pagead/conversion_async.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVGC8KK
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s08-in-f2.1e100.net
Software
cafe /
Resource Hash
8069956acb4c566506ff71f7a23c8e23f75ce9443384fe3393ed5c846924026e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 22 Jul 2021 23:53:58 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13910
x-xss-protection
0
server
cafe
etag
8154934153164151798
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Thu, 22 Jul 2021 23:53:58 GMT
munchkin.js
munchkin.marketo.net/
1 KB
1 KB
Script
General
Full URL
https://munchkin.marketo.net/munchkin.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVGC8KK
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.234.67 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-234-67.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
026c5db877da222d2316bf1197b8947a96c7623d51a4d462c91bf927dece3429

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Thu, 22 Jul 2021 23:53:58 GMT
Content-Encoding
gzip
Last-Modified
Fri, 28 May 2021 01:40:41 GMT
Server
AkamaiNetStorage
ETag
"5379c4a40ff8ae9d2fc6484dd1c57349:1622166041.794746"
Vary
Accept-Encoding
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
application/x-javascript
Content-Length
753
jukebox.js
app.cdn.lookbookhq.com/production/jukebox/current/
766 KB
212 KB
Script
General
Full URL
https://app.cdn.lookbookhq.com/production/jukebox/current/jukebox.js
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.25.92 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-25-92.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
8eeb66bddaf1dc564b5c406c2d20dd94de1c64f7f562c3d50ed6544a287ec16b

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id
null
content-encoding
gzip
last-modified
Wed, 21 Jul 2021 00:56:53 GMT
server
AmazonS3
age
29431
etag
W/"d041272739a16640a95bfad93ff85536"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/javascript
via
1.1 0c0a9358491c37c184a221ad07b92016.cloudfront.net (CloudFront)
cache-control
max-age=43200
date
Thu, 22 Jul 2021 15:43:28 GMT
x-amz-cf-pop
FRA56-C2
x-amz-cf-id
9Ez6gl48uK-LAX8WVGsv__EdG55X6J1uecCJdPdjUjNrwX15Z19FHQ==
js
www.googletagmanager.com/gtag/
90 KB
36 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=DC-10870294
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVGC8KK
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
fcdfd21cc7e1430ec95b4b57b0edb05c5d2751eefa260b67b7fe5bb4035e6998
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 22 Jul 2021 23:53:58 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
37104
x-xss-protection
0
last-modified
Thu, 22 Jul 2021 22:30:48 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Thu, 22 Jul 2021 23:53:58 GMT
fbevents.js
connect.facebook.net/en_US/
95 KB
25 KB
Script
General
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
0d17b8a38d3dce6f7357bbc8da105d92c21b6cf1c4b92351ce2b1861b065f2c5
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
24676
x-xss-protection
0
pragma
public
x-fb-debug
NE3ww+RfCmj5WztajrZ083IrPLcVVgAy1U3ehEkOVH2NbTnmg6sPN/dqoUyMZPZOP/Hb5PGenTCLE3gETC0Shg==
x-fb-trip-id
686109401
x-frame-options
DENY
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-embedder-policy-report-only
require-corp;report-to="coop_report"
date
Thu, 22 Jul 2021 23:53:58 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
report-to
{"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}],"group":"coop_report"}
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
x-fb-rlafr
0
expires
Sat, 01 Jan 2000 00:00:00 GMT
truncated
/
7 KB
7 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
716384b3b8c4f5d4e8d89c23b9a4f9516d78f82b6060ae89c493697d7f20f16c

Request headers

Origin
https://www.fireeye.com
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
application/x-font-woff2
analytics.js
www.google-analytics.com/
48 KB
20 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVGC8KK
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
73d6a5ea11fb7bf6e6a6ccd44b1635d52c79b0a00623d0387c9dddd4b7c68e89
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 09 Jun 2021 17:36:57 GMT
server
Golfe2
age
3779
date
Thu, 22 Jul 2021 22:50:59 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
19661
expires
Fri, 23 Jul 2021 00:50:59 GMT
lftracker_v1_3P1w24dgrmJ7mY5n.js
lftracker.leadfeeder.com/
20 KB
8 KB
Script
General
Full URL
https://lftracker.leadfeeder.com/lftracker_v1_3P1w24dgrmJ7mY5n.js
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.226.145.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-145-91.dus51.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
4d4982e8369b9bfb2dc115fb09af671ea5f0e7337828ae9bfe4ae882bb67d9ed

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id
zGWu76VO1j0KaZxoQsXOIySLo1bUhIRE
content-encoding
gzip
last-modified
Fri, 25 Jun 2021 17:43:36 GMT
server
AmazonS3
x-amz-cf-pop
DUS51-C1
etag
W/"894b42f3593a6586f657981d233f3cae"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
via
1.1 e542677c3bd2d6c30a5ed3dab78f8476.cloudfront.net (CloudFront)
cache-control
max-age=3600
date
Thu, 22 Jul 2021 23:53:58 GMT
x-amz-cf-id
UBWfOVCmvAQMSVLCnc5dIGWcJSxbVarGTtNpD5kVhzmGDem-1w5pPQ==
collect
px4.ads.linkedin.com/
Redirect Chain
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=6572&time=1626998038523&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2013%2F04%2Fmalware-callbacks.html
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D6572%26time%3D1626998038523%26url%3Dhttps%253A%252F%252Fwww.fireeye.com%252Fblog%...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=6572&time=1626998038523&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2013%2F04%2Fmalware-callbacks.html&liSync=true
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=6572&time=1626998038523&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2013%2F04%2Fmalware-callbacks.html&liSync=true&e_ipv6=AQI5EB...
0
156 B
Image
General
Full URL
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=6572&time=1626998038523&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2013%2F04%2Fmalware-callbacks.html&liSync=true&e_ipv6=AQI5EBUFyn_HwwAAAXrQo-NFQukAJtIr2GG2mv7jLLGxZPzLoFaLrez2HJs3OAfKhMnfjw-M
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
108.174.10.14 , United States, ASN14413 (LINKEDIN, US),
Reverse DNS
108-174-10-14.fwd.linkedin.com
Software
Play /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 22 Jul 2021 23:54:00 GMT
server
Play
linkedin-action
1
x-li-fabric
prod-lor1
x-li-proto
http/2
x-li-pop
prod-edc2
content-type
application/javascript
content-length
0
x-li-uuid
GbmMCxlClBbgPhkIFCsAAA==

Redirect headers

date
Thu, 22 Jul 2021 23:53:59 GMT
server
Play
linkedin-action
1
x-li-fabric
prod-lor1
location
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=6572&time=1626998038523&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2013%2F04%2Fmalware-callbacks.html&liSync=true&e_ipv6=AQI5EBUFyn_HwwAAAXrQo-NFQukAJtIr2GG2mv7jLLGxZPzLoFaLrez2HJs3OAfKhMnfjw-M
x-li-proto
http/2
x-li-pop
prod-esv5
content-length
0
x-li-uuid
yJIbuRhClBaQozv2BysAAA==
adsct
t.co/i/
43 B
455 B
Image
General
Full URL
https://t.co/i/adsct?type=javascript&version=2.0.1&p_id=Twitter&p_user_id=0&txn_id=nw2v7&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tw_document_href=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2013%2F04%2Fmalware-callbacks.html
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.42.5 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=0
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 22 Jul 2021 23:53:58 GMT
content-encoding
gzip
x-content-type-options
nosniff
status
200 OK
x-twitter-response-tags
BouncerCompliant
content-length
65
x-xss-protection
0
pragma
no-cache
last-modified
Thu, 22 Jul 2021 23:53:58 GMT
server
tsa_o
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=0
content-type
image/gif;charset=utf-8
cache-control
no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash
f3b565fbab5f628e5192860f89af0ad1455f6c6120e3da5841abc46a72c33158
x-transaction
25cdf848afd0127c
expires
Tue, 31 Mar 1981 05:00:00 GMT
313630683245423
connect.facebook.net/signals/config/
260 KB
74 KB
Script
General
Full URL
https://connect.facebook.net/signals/config/313630683245423?v=2.9.43&r=stable
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
efb755bfe1f080ae024aaac25030ccf1e87dca318e78c8162c1591bd83463bc2
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
x-xss-protection
0
pragma
public
x-fb-debug
F8pXG1Y5Mpe5FJpJqDf+Umv4bwJaW/0gCVu/1NcbcYBN6d9bRa8p4ZgIEeJX2YOYX+5Zgh1xIBuENohcJC0pMQ==
cross-origin-embedder-policy-report-only
require-corp;report-to="coop_report"
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
DENY
date
Thu, 22 Jul 2021 23:53:58 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
report-to
{"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}],"group":"coop_report"}
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
x-fb-rlafr
0
priority
u=3,i
expires
Sat, 01 Jan 2000 00:00:00 GMT
5870833.js
bat.bing.com/p/action/
0
127 B
Script
General
Full URL
https://bat.bing.com/p/action/5870833.js
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/ ARR/3.0
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin
*
date
Thu, 22 Jul 2021 23:53:58 GMT
cache-control
private,max-age=86400
x-msedge-ref
Ref A: 77FA0F857A61400D85703E75E28D316C Ref B: FRAEDGE1321 Ref C: 2021-07-22T23:53:58Z
x-powered-by
ARR/3.0
x-cache
CONFIG_NOCACHE
collect
www.google-analytics.com/j/
2 B
22 B
XHR
General
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j91&a=1733707541&t=pageview&_s=1&dl=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2013%2F04%2Fmalware-callbacks.html&ul=en-us&de=UTF-8&dt=Malware%20Callbacks%20%7C%20FireEye%20Inc&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEABAAAAAC~&jid=91444485&gjid=652499849&cid=133491924.1626998039&tid=UA-363943-1&_gid=1784014858.1626998039&_r=1&gtm=2wg7l1MVGC8KK&cd39=133491924.1626998039&z=1667575451
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Thu, 22 Jul 2021 23:53:58 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.fireeye.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/968899429/
2 KB
2 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/968899429/?random=1626998038577&cv=9&fst=1626998038577&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg7l1&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2013%2F04%2Fmalware-callbacks.html&tiba=Malware%20Callbacks%20%7C%20FireEye%20Inc&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
1e30eab6c297cca04d7e72f217d0debfc7ce5904d1bb746febd67babf845d265
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 22 Jul 2021 23:53:58 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1042
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
v1.js
www.googletagmanager.com/dclk/ns/
2 KB
1 KB
Script
General
Full URL
https://www.googletagmanager.com/dclk/ns/v1.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-10870294
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
03bef1eeac54d221d1da744095e12a9caae78fb47a16f0d9a7598fa83cd79fcf
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sun, 18 Jul 2021 23:45:20 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
346118
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/analytics-container-tag-serving
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1094
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=604800
accept-ranges
bytes
expires
Sun, 25 Jul 2021 23:45:20 GMT
collect
stats.g.doubleclick.net/j/
4 B
463 B
XHR
General
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j91&tid=UA-363943-1&cid=133491924.1626998039&jid=91444485&gjid=652499849&_gid=1784014858.1626998039&_u=YEBAAEAAAAAAAC~&z=1594063096
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c08::9a Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Thu, 22 Jul 2021 23:53:58 GMT
content-type
text/plain
access-control-allow-origin
https://www.fireeye.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.facebook.com/tr/
44 B
297 B
Image
General
Full URL
https://www.facebook.com/tr/?id=313630683245423&ev=PageView&dl=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2013%2F04%2Fmalware-callbacks.html&rl=&if=false&ts=1626998038630&sw=1600&sh=1200&v=2.9.43&r=stable&ec=0&o=30&fbp=fb.1.1626998038629.1391533438&it=1626998038539&coo=false&dpo=LDU&dpoco=0&dpost=0&rqm=GET
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 22 Jul 2021 23:53:58 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
cache-control
no-cache, must-revalidate, max-age=0
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
44
expires
Thu, 22 Jul 2021 23:53:58 GMT
website_experience
jukebox.pathfactory.com/api/public/v1/ Frame
0
0
Preflight
General
Full URL
https://jukebox.pathfactory.com/api/public/v1/website_experience?clientId=LB-9AC90F09-10427&visitorUuid=52033cbc-f25a-4a05-b03a-a24d434ba751&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2013%2F04%2Fmalware-callbacks.html
Protocol
H2
Server
35.173.142.174 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-142-174.compute-1.amazonaws.com
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Method
GET
Access-Control-Request-Headers
content-type
Origin
https://www.fireeye.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Thu, 22 Jul 2021 23:53:58 GMT
content-type
text/plain
access-control-allow-origin
https://www.fireeye.com
access-control-allow-methods
GET, PUT, POST, PATCH, OPTIONS
access-control-expose-headers
access-control-max-age
1728000
access-control-allow-credentials
true
access-control-allow-headers
content-type
content-encoding
gzip
vary
Accept-Encoding
font-awesome.min.css
maxcdn.bootstrapcdn.com/font-awesome/4.6.1/css/
28 KB
7 KB
Stylesheet
General
Full URL
https://maxcdn.bootstrapcdn.com/font-awesome/4.6.1/css/font-awesome.min.css
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b5d7707ea8fc00aae40bf500ac7498d7f32f6b1bbff7b4fde976a40345eb5f9d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 22 Jul 2021 23:53:58 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
cdn-edgestorageid
632, 617
age
10550259
cdn-cachedat
2021-03-11 11:58:15
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
timing-allow-origin
*
access-control-allow-origin
*
last-modified
Mon, 25 Jan 2021 22:04:54 GMT
server
cloudflare
cdn-requestpullcode
200
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/css; charset=utf-8
cdn-cache
HIT
vary
Accept-Encoding
cache-control
public, max-age=31919000
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid
a754e168c4f0fb62e4072354b1d05890
cf-ray
6730976deb36bf0a-FRA
cdn-requestcountrycode
DE
cdn-requestpullsuccess
True
css
fonts.googleapis.com/
4 KB
1 KB
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Roboto:400,700
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
f7bba0cc484923e9dc8eb46a451efbd2ebe40980e07195777adaa39956bc5cd5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Thu, 22 Jul 2021 23:47:00 GMT
server
ESF
date
Thu, 22 Jul 2021 23:53:58 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Thu, 22 Jul 2021 23:53:58 GMT
website_forms
jukebox.pathfactory.com/api/public/v1/ Frame
0
0
Preflight
General
Full URL
https://jukebox.pathfactory.com/api/public/v1/website_forms?clientId=LB-9AC90F09-10427&visitorUuid=52033cbc-f25a-4a05-b03a-a24d434ba751&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2013%2F04%2Fmalware-callbacks.html
Protocol
H2
Server
35.173.142.174 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-142-174.compute-1.amazonaws.com
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Method
GET
Access-Control-Request-Headers
content-type
Origin
https://www.fireeye.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Thu, 22 Jul 2021 23:53:58 GMT
content-type
text/plain
access-control-allow-origin
https://www.fireeye.com
access-control-allow-methods
GET, PUT, POST, PATCH, OPTIONS
access-control-expose-headers
access-control-max-age
1728000
access-control-allow-credentials
true
access-control-allow-headers
content-type
content-encoding
gzip
vary
Accept-Encoding
website_experience
jukebox.pathfactory.com/api/public/v1/
4 KB
2 KB
XHR
General
Full URL
https://jukebox.pathfactory.com/api/public/v1/website_experience?clientId=LB-9AC90F09-10427&visitorUuid=52033cbc-f25a-4a05-b03a-a24d434ba751&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2013%2F04%2Fmalware-callbacks.html
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.142.174 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-142-174.compute-1.amazonaws.com
Software
/
Resource Hash
33e63bc3e8d5dbdc8a03bd27c194202c33663886e8ffcdc654a3ebf3216b00c8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

Accept
application/json
Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
application/json

Response headers

date
Thu, 22 Jul 2021 23:53:59 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains
vary
Origin, Accept-Encoding
x-request-id
674e6db6-9d70-406c-b733-9110e8d5a3c4
x-runtime
0.066325
referrer-policy
no-referrer-when-downgrade
etag
W/"33e63bc3e8d5dbdc8a03bd27c194202c"
access-control-max-age
1728000
access-control-allow-methods
GET, PUT, POST, PATCH, OPTIONS
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.fireeye.com
access-control-expose-headers
cache-control
max-age=0, private, must-revalidate
access-control-allow-credentials
true
website_forms
jukebox.pathfactory.com/api/public/v1/
0
411 B
XHR
General
Full URL
https://jukebox.pathfactory.com/api/public/v1/website_forms?clientId=LB-9AC90F09-10427&visitorUuid=52033cbc-f25a-4a05-b03a-a24d434ba751&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2013%2F04%2Fmalware-callbacks.html
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.142.174 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-142-174.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept
application/json
Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
application/json

Response headers

x-runtime
0.012617
date
Thu, 22 Jul 2021 23:53:59 GMT
referrer-policy
no-referrer-when-downgrade
access-control-max-age
1728000
access-control-allow-methods
GET, PUT, POST, PATCH, OPTIONS
access-control-allow-origin
https://www.fireeye.com
access-control-expose-headers
cache-control
no-cache
access-control-allow-credentials
true
vary
Origin
x-content-type-options
nosniff
x-request-id
6313868c-b23d-41af-8a45-146014a5220b
init
jukebox.pathfactory.com/api/public/v1/
388 B
881 B
XHR
General
Full URL
https://jukebox.pathfactory.com/api/public/v1/init?clientId=LB-9AC90F09-10427&image=&title=&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2013%2F04%2Fmalware-callbacks.html
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.142.174 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-142-174.compute-1.amazonaws.com
Software
/
Resource Hash
9113fbb8f97202c632a76b08ed09530d1ea97d55fd2df42438c081d2e22290b9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

Accept
application/json
Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
application/json

Response headers

date
Thu, 22 Jul 2021 23:53:59 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains
vary
Origin, Accept-Encoding
x-request-id
f23fe09f-372d-49ca-a761-99edeb5051ee
x-runtime
0.012497
referrer-policy
no-referrer-when-downgrade
etag
W/"9113fbb8f97202c632a76b08ed09530d"
access-control-max-age
1728000
access-control-allow-methods
GET, PUT, POST, PATCH, OPTIONS
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.fireeye.com
access-control-expose-headers
cache-control
max-age=0, private, must-revalidate
access-control-allow-credentials
true
init
jukebox.pathfactory.com/api/public/v1/ Frame
0
0
Preflight
General
Full URL
https://jukebox.pathfactory.com/api/public/v1/init?clientId=LB-9AC90F09-10427&image=&title=&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2013%2F04%2Fmalware-callbacks.html
Protocol
H2
Server
35.173.142.174 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-142-174.compute-1.amazonaws.com
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Method
GET
Access-Control-Request-Headers
content-type
Origin
https://www.fireeye.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Thu, 22 Jul 2021 23:53:58 GMT
content-type
text/plain
access-control-allow-origin
https://www.fireeye.com
access-control-allow-methods
GET, PUT, POST, PATCH, OPTIONS
access-control-expose-headers
access-control-max-age
1728000
access-control-allow-credentials
true
access-control-allow-headers
content-type
content-encoding
gzip
vary
Accept-Encoding
ga-audiences
www.google.com/ads/
42 B
293 B
Image
General
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j91&tid=UA-363943-1&cid=133491924.1626998039&jid=91444485&_u=YEBAAEAAAAAAAC~&z=1044163215
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 22 Jul 2021 23:53:58 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/
42 B
522 B
Image
General
Full URL
https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j91&tid=UA-363943-1&cid=133491924.1626998039&jid=91444485&_u=YEBAAEAAAAAAAC~&z=1044163215
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 22 Jul 2021 23:53:58 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/968899429/
42 B
154 B
Image
General
Full URL
https://www.google.com/pagead/1p-user-list/968899429/?random=1626998038577&cv=9&fst=1626994800000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg7l1&sendb=1&frm=0&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2013%2F04%2Fmalware-callbacks.html&tiba=Malware%20Callbacks%20%7C%20FireEye%20Inc&async=1&fmt=3&is_vtc=1&random=4275352249&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 22 Jul 2021 23:53:58 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/968899429/
42 B
154 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/968899429/?random=1626998038577&cv=9&fst=1626994800000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg7l1&sendb=1&frm=0&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2013%2F04%2Fmalware-callbacks.html&tiba=Malware%20Callbacks%20%7C%20FireEye%20Inc&async=1&fmt=3&is_vtc=1&random=4275352249&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 22 Jul 2021 23:53:58 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.facebook.com/tr/
44 B
91 B
Image
General
Full URL
https://www.facebook.com/tr/?id=313630683245423&ev=Microdata&dl=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2013%2F04%2Fmalware-callbacks.html&rl=&if=false&ts=1626998039132&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22Malware%20Callbacks%20%7C%20FireEye%20Inc%22%2C%22meta%3Adescription%22%3A%22%22%7D&cd[OpenGraph]=%7B%22og%3Atitle%22%3A%22Malware%20Callbacks%22%2C%22og%3Atype%22%3A%22website%22%2C%22og%3Aurl%22%3A%22https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2013%2F04%2Fmalware-callbacks.html%22%2C%22og%3Aimage%22%3A%22https%3A%2F%2Fwww.fireeye.com%2Fcontent%2Fdam%2Ffireeye-www%2Ffw%2Fimages%2Ffireeye-2-color-square.png%22%2C%22og%3Adescription%22%3A%22%22%2C%22og%3Asite_name%22%3A%22FireEye%22%7D&cd[Schema.org]=%5B%7B%22dimensions%22%3A%7B%22h%22%3A86%2C%22w%22%3A1600%7D%2C%22properties%22%3A%7B%7D%2C%22subscopes%22%3A%5B%5D%2C%22type%22%3A%22http%3A%2F%2Fschema.org%2FWebPage%22%7D%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.43&r=stable&ec=1&o=30&fbp=fb.1.1626998038629.1391533438&it=1626998038539&coo=false&dpo=LDU&dpoco=0&dpost=0&es=automatic&tm=3&rqm=GET
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 22 Jul 2021 23:53:59 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
cache-control
no-cache, must-revalidate, max-age=0
cross-origin-resource-policy
cross-origin
content-length
44
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority
u=3,i
expires
Thu, 22 Jul 2021 23:53:59 GMT
truncated
/
27 KB
27 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
93144b711b7ef4bed3c9b9d28983347edf6d70d2290911886f13467d6cabc911

Request headers

Origin
https://www.fireeye.com
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
application/x-font-woff2
truncated
/
27 KB
27 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
c9b7d6e7a5672d872763ce1eee54e278c0e2294e4bdb23ba19120e50a757a02b

Request headers

Origin
https://www.fireeye.com
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
application/x-font-woff2
truncated
/
28 KB
28 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
fb384da9d5c974e03adbec0785369381df8f2c656d21faf6d9e10c96612ff14b

Request headers

Origin
https://www.fireeye.com
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
application/x-font-woff2
truncated
/
7 KB
7 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
295cc2973fd8e0ea98700592bf1c04cec651e78313d891e5047cf4e46d2aa667

Request headers

Origin
https://www.fireeye.com
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
application/x-font-woff2
truncated
/
7 KB
7 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
c5d851f82aed40520103262006a2c0fd15a861db9d478f3befc4184a6ee67279

Request headers

Origin
https://www.fireeye.com
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
application/x-font-woff2
truncated
/
7 KB
7 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
4945b7b3e791e1d8813c97e2df9d392a99b977362b5c6e4dc24e47851357d7bf

Request headers

Origin
https://www.fireeye.com
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
application/x-font-woff2
getForm
www2.fireeye.com/index.php/form/
8 KB
2 KB
Script
General
Full URL
https://www2.fireeye.com/index.php/form/getForm?munchkinId=848-DID-242&form=3353&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2013%2F04%2Fmalware-callbacks.html&callback=jQuery112408144002875571841_1626998039345&_=1626998039346
Requested by
Host: www2.fireeye.com
URL: https://www2.fireeye.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.70.206 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
09f69437d1bc5422c3ce06b678dc8620cbcad40843bf5e55038e0134b1e85a39

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 22 Jul 2021 23:53:59 GMT
content-encoding
gzip
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cf-ray
673097720aaa331e-CDG
cached
true
moatframe.js
z.moatads.com/addthismoatframe568911941483/
2 KB
1 KB
Script
General
Full URL
https://z.moatads.com/addthismoatframe568911941483/moatframe.js
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 22 Jul 2021 23:53:59 GMT
content-encoding
gzip
last-modified
Fri, 08 Nov 2019 20:13:52 GMT
server
AmazonS3
x-amz-request-id
D5503D14AA2F06AA
etag
"f14b4e1f799b14f798a195f43cf58376"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=57779
accept-ranges
bytes
content-length
948
x-amz-id-2
JgalEtxvSAtZmM7+naGfrhsdf0JFS0gJW8lypWF8Tp90EkcPp4c3eAnpK+RDOIL1ltWgpx8wc3s=
me
js.maxmind.com/geoip/v2.1/country/
771 B
847 B
XHR
General
Full URL
https://js.maxmind.com/geoip/v2.1/country/me?referrer=https%3A%2F%2Fwww.fireeye.com
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:262f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c6f75c5c38c416c778acab5a9141630848f46cdabc05c1920ed1c763c486f51f

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 22 Jul 2021 23:53:59 GMT
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type
application/vnd.maxmind.com-country+json; charset=UTF-8; version=2.1
access-control-allow-origin
*
cf-ray
6730977289afbebf-FRA
content-length
771
segmentation.segment.js
www.fireeye.com/etc/
0
533 B
XHR
General
Full URL
https://www.fireeye.com/etc/segmentation.segment.js
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff nosniff
X-Frame-Options ALLOW-FROM https://content.fireeye.com
X-Xss-Protection 1; mode=block

Request headers

sec-fetch-mode
cors
accept-encoding
gzip, deflate, br
accept-language
en-US
x-requested-with
XMLHttpRequest
sec-fetch-dest
empty
cookie
_gcl_au=1.1.267643188.1626998038; _ga=GA1.2.133491924.1626998039; _gid=GA1.2.1784014858.1626998039; _gat_UA-363943-1=1; _fbp=fb.1.1626998038629.1391533438
:path
/etc/segmentation.segment.js
pragma
no-cache
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
cache-control
no-cache
:authority
www.fireeye.com
referer
https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept
text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Referer
https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-dispatcher
dispatcher2uswest1
date
Thu, 22 Jul 2021 23:54:00 GMT
x-content-type-options
nosniff nosniff
cf-cache-status
MISS
x-vhost
publish
vary
User-Agent, Accept-Encoding
content-length
0
x-xss-protection
1; mode=block
server
cloudflare
x-frame-options
ALLOW-FROM https://content.fireeye.com
etag
"d41d8cd98f00b204e9800998ecf8427e"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/x-javascript
cache-control
public, max-age=691200
content-security-policy
worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges
bytes
cf-ray
673097728fa52c0d-FRA
expires
Fri, 30 Jul 2021 23:54:00 GMT
stores.init.js
www.fireeye.com/etc/clientcontext/default/content/jcr:content/
3 KB
1 KB
XHR
General
Full URL
https://www.fireeye.com/etc/clientcontext/default/content/jcr:content/stores.init.js?path=%2Fcontent%2Ffireeye-www%2Fen_US%2Fblog%2Fthreat-research%2F2013%2F04%2Fmalware-callbacks&_=1626998038327
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9142284b40303e65c6d8c8aa302e88e55d94ebc54b7b5abde86d6ae97a03c502
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

sec-fetch-mode
cors
accept-encoding
gzip, deflate, br
accept-language
en-US
x-requested-with
XMLHttpRequest
sec-fetch-dest
empty
cookie
_gcl_au=1.1.267643188.1626998038; _ga=GA1.2.133491924.1626998039; _gid=GA1.2.1784014858.1626998039; _gat_UA-363943-1=1; _fbp=fb.1.1626998038629.1391533438
:path
/etc/clientcontext/default/content/jcr:content/stores.init.js?path=%2Fcontent%2Ffireeye-www%2Fen_US%2Fblog%2Fthreat-research%2F2013%2F04%2Fmalware-callbacks&_=1626998038327
pragma
no-cache
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
cache-control
no-cache
:authority
www.fireeye.com
referer
https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept
text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Referer
https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 22 Jul 2021 23:53:59 GMT
content-encoding
gzip
vary
Accept-Encoding
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
SAMEORIGIN
content-type
text/html; charset=UTF-8
cache-control
private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray
673097728fab2c0d-FRA
cf-request-id
0b723cfb9800002c0d17246000000001
expires
Thu, 01 Jan 1970 00:00:01 GMT
munchkin.js
munchkin.marketo.net/160/
11 KB
5 KB
Script
General
Full URL
https://munchkin.marketo.net/160/munchkin.js
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.234.67 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-234-67.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
99fa5a280296b5fc7b63433ee121a359fc68c4a37f04a87d363e751164b96ff1

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Thu, 22 Jul 2021 23:53:59 GMT
Content-Encoding
gzip
Last-Modified
Fri, 19 Feb 2021 02:54:38 GMT
Server
AkamaiNetStorage
ETag
"19a9335fd71267d56e65bc19390f3100:1613703278.138281"
Vary
Accept-Encoding
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control
max-age=8640000
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
application/x-javascript
Content-Length
4811
Expires
Sat, 30 Oct 2021 23:53:59 GMT
read-blogentries
www.fireeye.com/bin/www-blogs/
101 KB
18 KB
XHR
General
Full URL
https://www.fireeye.com/bin/www-blogs/read-blogentries?categoryPath=%2Fcontent%2Ffireeye-www%2Fen_US%2Fblog%2Fthreat-research
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:300b::a29f:f67d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1f717b6a6f4d7dcc20d0f00d507763647d102ba63df5397980879b1bee7eae00
Security Headers
Name Value
Content-Security-Policy worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff nosniff
X-Frame-Options ALLOW-FROM https://content.fireeye.com
X-Xss-Protection 1; mode=block

Request headers

sec-fetch-mode
cors
accept-encoding
gzip, deflate, br
accept-language
en-US
x-requested-with
XMLHttpRequest
sec-fetch-dest
empty
cookie
_gcl_au=1.1.267643188.1626998038; _ga=GA1.2.133491924.1626998039; _gid=GA1.2.1784014858.1626998039; _gat_UA-363943-1=1; _fbp=fb.1.1626998038629.1391533438
:path
/bin/www-blogs/read-blogentries?categoryPath=%2Fcontent%2Ffireeye-www%2Fen_US%2Fblog%2Fthreat-research
pragma
no-cache
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
application/json, text/javascript, */*; q=0.01
cache-control
no-cache
:authority
www.fireeye.com
referer
https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-dispatcher
dispatcher1uswest1
date
Thu, 22 Jul 2021 23:54:00 GMT
content-encoding
gzip
x-content-type-options
nosniff nosniff
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
ALLOW-FROM https://content.fireeye.com
x-vhost
publish
content-security-policy
worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
strict-transport-security
max-age=31536000; includeSubDomains
cf-ray
673097728fae2c0d-FRA
vary
Accept-Encoding,User-Agent
content-length
18191
x-xss-protection
1; mode=block
adsct
analytics.twitter.com/i/
31 B
657 B
Script
General
Full URL
https://analytics.twitter.com/i/adsct?type=javascript&version=2.0.1&p_id=Twitter&p_user_id=0&txn_id=nw2v7&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2013%2F04%2Fmalware-callbacks.html
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.42.195 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 22 Jul 2021 23:54:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status
200 OK
x-twitter-response-tags
BouncerCompliant
content-length
57
x-xss-protection
0
pragma
no-cache
last-modified
Thu, 22 Jul 2021 23:54:00 GMT
server
tsa_o
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=631138519
content-type
application/javascript;charset=utf-8
cache-control
no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash
b6b6035baea4839089ac9a027263657eea394be086d82840e0de2b91e15aff25
x-transaction
09b10e4affd240d8
expires
Tue, 31 Mar 1981 05:00:00 GMT
MultiNoun.jsonp
d.la2c2.salesforceliveagent.com/chat/rest/System/
226 B
592 B
Script
General
Full URL
https://d.la2c2.salesforceliveagent.com/chat/rest/System/MultiNoun.jsonp?nouns=VisitorId,Settings&VisitorId.prefix=Visitor&Settings.prefix=Visitor&Settings.buttonIds=[573a00000008kP3]&Settings.updateBreadcrumb=1&Settings.urlPrefix=undefined&callback=liveagent._.handlePing&deployment_id=572a0000000H8aJ&org_id=00D3000000063LS&version=34
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
13.108.249.135 , United States, ASN14340 (SALESFORCE, US),
Reverse DNS
dcl4-ord.la1-c2-ord.salesforceliveagent.com
Software
/
Resource Hash
f9f99e3c0904ffd05bd59459afd3afa1df2de38e60117cf9303abc84f6802bb3
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Content-Type
text/javascript
Access-Control-Allow-Origin
*
Cache-Control
no-cache
Access-Control-Allow-Credentials
true
Connection
close
Expires
-1
_ate.track.config_resp
v1.addthisedge.com/live/boost/fewebadmin/
4 KB
1 KB
Script
General
Full URL
https://v1.addthisedge.com/live/boost/fewebadmin/_ate.track.config_resp
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.75.88.126 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-75-88-126.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
5cd804ec7036cddeb6403cd02cb908ebc248fe66e865dfc205df718463e3167c

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 22 Jul 2021 23:54:00 GMT
content-encoding
gzip
etag
-1477460652--gzip
vary
Accept-Encoding
content-type
application/javascript;charset=utf-8
cache-control
public, max-age=58, s-maxage=86400
content-disposition
attachment; filename=1.txt
content-length
899
0
bat.bing.com/action/
0
172 B
Image
General
Full URL
https://bat.bing.com/action/0?ti=5870833&tm=gtm001&Ver=2&mid=94bcc2a8-55ef-4590-8212-94eccf74fecb&sid=16062cd0eb4811eb892add8224c151bb&vid=16063e80eb4811eb87386ba8b4e8527a&vids=1&pi=0&lg=en-US&sw=1600&sh=1200&sc=24&tl=Malware%20Callbacks%20%7C%20FireEye%20Inc&p=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2013%2F04%2Fmalware-callbacks.html&r=&lt=3236&evt=pageLoad&msclkid=N&sv=1&rn=379745
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin
*
pragma
no-cache
date
Thu, 22 Jul 2021 23:53:59 GMT
cache-control
no-cache, must-revalidate
x-msedge-ref
Ref A: 2A19D451F4F74FA5BEACA51696BE2D22 Ref B: FRAEDGE1321 Ref C: 2021-07-22T23:54:00Z
x-cache
CONFIG_NOCACHE
expires
Fri, 01 Jan 1990 00:00:00 GMT
sp.min.js
cdnjs.cloudflare.com/ajax/libs/snowplow/2.17.3/
76 KB
23 KB
Script
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/snowplow/2.17.3/sp.min.js
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a876a773b46aea97d22c1f84dac918fbc98ee3c1e1729f21cef7911de52f141e
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 22 Jul 2021 23:54:00 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
8752980
cross-origin-resource-policy
cross-origin
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
22932
cf-request-id
096885202b000017722d1b4000000001
timing-allow-origin
*
last-modified
Tue, 16 Feb 2021 22:52:47 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"602c4cbf-12eb9"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WHYjV4KW%2BY5k79qXKc1rn3nbZJmjLjbdvWtSrMlWO7rtcN82Y%2B7JfpFpzNsLnY%2BDq683wgRJjC9%2F2YjuXww%2BTcgVIXrqAQVQQ%2Bt518%2BHsOPhKmvDroGbjXzaLkr0bmJYKOYJXuXi%2FyZff%2F7NMdILdrVv"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=30672000
accept-ranges
bytes
cf-ray
673097791d5a0605-FRA
expires
Tue, 12 Jul 2022 23:54:00 GMT
xray.js
cdn.perfdrive.com/aperture/
2 KB
918 B
Script
General
Full URL
https://cdn.perfdrive.com/aperture/xray.js
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
130.211.29.114 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
114.29.211.130.bc.googleusercontent.com
Software
nginx/1.10.1 /
Resource Hash
43589ba59da28a72ed7a6f7d2c56b83cd1b2466a9520f9848517935089405a56

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 22 Jul 2021 23:54:00 GMT
content-encoding
gzip
last-modified
Tue, 11 May 2021 04:49:40 GMT
server
nginx/1.10.1
age
0
etag
W/"609a0ce4-861"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=3600,public
alt-svc
clear
content-length
820
via
1.1 google
aperture.js
cdn.perfdrive.com/aperture/
44 KB
13 KB
Script
General
Full URL
https://cdn.perfdrive.com/aperture/aperture.js
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
130.211.29.114 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
114.29.211.130.bc.googleusercontent.com
Software
nginx/1.10.1 /
Resource Hash
1ef89c6057c63e1fd2bda3054817b95cb244d353dc1dafd2736e0ad49ca97924

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 22 Jul 2021 23:19:25 GMT
content-encoding
gzip
last-modified
Tue, 11 May 2021 04:49:39 GMT
server
nginx/1.10.1
age
2075
etag
W/"609a0ce3-ae3a"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=3600,public
alt-svc
clear
content-length
13453
via
1.1 google
json
fireeye.tt.omtrdc.net/m2/fireeye/mbox/
6 KB
786 B
XHR
General
Full URL
https://fireeye.tt.omtrdc.net/m2/fireeye/mbox/json?mbox=target-global-mbox&mboxSession=cfa1321770b34d9cbe007cf01792220a&mboxPC=&mboxPage=f584d491bd1340ad8f0449209e5dcae2&mboxRid=69311f153f274bbdb119ac0daa95626a&mboxVersion=1.7.1&mboxCount=1&mboxTime=1627005240512&mboxHost=www.fireeye.com&mboxURL=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2013%2F04%2Fmalware-callbacks.html&mboxReferrer=&browserHeight=1200&browserWidth=1600&browserTimeOffset=120&screenHeight=1200&screenWidth=1600&colorDepth=24&devicePixelRatio=1&screenOrientation=landscape
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.213.168.74 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-213-168-74.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
74fd866b1bf3f5fec6a0c3b524ea0ceaa04086c6a61fc50cc324523cb99da99f

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 22 Jul 2021 23:54:00 GMT
content-encoding
gzip
vary
origin,access-control-request-method,access-control-request-headers,accept-encoding
content-type
application/json;charset=UTF-8
access-control-allow-origin
https://www.fireeye.com
cache-control
no-cache
access-control-allow-credentials
true
timing-allow-origin
*
x-request-id
69311f153f274bbdb119ac0daa95626a
forms2.css
www2.fireeye.com/js/forms2/css/
13 KB
3 KB
Stylesheet
General
Full URL
https://www2.fireeye.com/js/forms2/css/forms2.css
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.70.206 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 22 Jul 2021 23:54:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
6498
content-length
2623
last-modified
Fri, 18 Jun 2021 20:07:07 GMT
server
cloudflare
etag
"403299-3437-5c50fde38d0c0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=14400
accept-ranges
bytes
cf-ray
673097795831331e-CDG
expires
Fri, 23 Jul 2021 03:54:00 GMT
forms2-theme-simple.css
www2.fireeye.com/js/forms2/css/
826 B
339 B
Stylesheet
General
Full URL
https://www2.fireeye.com/js/forms2/css/forms2-theme-simple.css
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.70.206 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
14c8c62dc692fd8faa04434e3fed25e7c23d596b732f9db88f6e9f9ff5dfa61c
Security Headers
Name Value
Strict-Transport-Security max-age=63113904
X-Content-Type-Options nosniff

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 22 Jul 2021 23:54:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
6498
vary
Accept-Encoding
content-length
242
last-modified
Fri, 18 Jun 2021 20:07:07 GMT
server
cloudflare
etag
"2b9d-33a-5c50fde38d0c0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=63113904
content-type
text/css
cache-control
public, max-age=14400
accept-ranges
bytes
cf-ray
673097796835331e-CDG
expires
Fri, 23 Jul 2021 03:54:00 GMT
layers.fa6cd1947ce26e890d3d.js
s7.addthis.com/static/
263 KB
76 KB
Script
General
Full URL
https://s7.addthis.com/static/layers.fa6cd1947ce26e890d3d.js
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.75.88.126 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-75-88-126.deploy.static.akamaitechnologies.com
Software
nginx/1.15.8 /
Resource Hash
6121ca306ad1045453d52517b8f436eb5a68055c82aefa46a9a77de36996a3df
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=15724800; includeSubDomains
content-encoding
gzip
last-modified
Mon, 26 Oct 2020 18:11:48 GMT
server
nginx/1.15.8
etag
W/"5f971164-41cf5"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=86313600
date
Thu, 22 Jul 2021 23:54:00 GMT
x-host
s7.addthis.com
timing-allow-origin
*
content-length
77617
jsdata
cas.avalon.perfdrive.com/
151 B
272 B
XHR
General
Full URL
https://cas.avalon.perfdrive.com/jsdata?
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.241.15.240 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
240.15.241.35.bc.googleusercontent.com
Software
/
Resource Hash
7f8b05b543294401fa81eff64e2d63776f075dd77efc8431488596bfff9f6849

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

access-control-allow-origin
*
x-response-time
0ms
date
Thu, 22 Jul 2021 23:54:00 GMT
via
1.1 google
alt-svc
clear
content-length
151
content-type
text/plain; charset=UTF-8
jsdata
cas.avalon.perfdrive.com/
151 B
210 B
XHR
General
Full URL
https://cas.avalon.perfdrive.com/jsdata?
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.241.15.240 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
240.15.241.35.bc.googleusercontent.com
Software
/
Resource Hash
3bc14e18d6fb50b3d7dadb73e34b110d6e4cc002c736610906c2813a819d2380

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

access-control-allow-origin
*
x-response-time
0ms
date
Thu, 22 Jul 2021 23:54:00 GMT
via
1.1 google
alt-svc
clear
content-length
151
content-type
text/plain; charset=UTF-8
jsdata
cas.avalon.perfdrive.com/
151 B
215 B
XHR
General
Full URL
https://cas.avalon.perfdrive.com/jsdata?
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.241.15.240 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
240.15.241.35.bc.googleusercontent.com
Software
/
Resource Hash
83af705bec1841a313ee3ce5d97c4329da11089ed6dcd848f09a6333764ce84b

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

access-control-allow-origin
*
x-response-time
9ms
date
Thu, 22 Jul 2021 23:54:00 GMT
via
1.1 google
alt-svc
clear
content-length
151
content-type
text/plain; charset=UTF-8
recommendations
jukebox.pathfactory.com/api/public/v1/ Frame
0
0
Preflight
General
Full URL
https://jukebox.pathfactory.com/api/public/v1/recommendations?clientId=LB-9AC90F09-10427&sourceType=2&visitorUuid=52033cbc-f25a-4a05-b03a-a24d434ba751&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2013%2F04%2Fmalware-callbacks.html&contentPoolId=2ca285d7-8aca-463c-ac25-1b615d9c2519&appearanceId=1014&recommendationType=trending&sessionId=0e1d86b3-4de7-42b9-afaa-a97dec7afefa&isBot=false
Protocol
H2
Server
35.173.142.174 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-142-174.compute-1.amazonaws.com
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Method
GET
Access-Control-Request-Headers
content-type
Origin
https://www.fireeye.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Thu, 22 Jul 2021 23:54:00 GMT
content-type
text/plain
access-control-allow-origin
https://www.fireeye.com
access-control-allow-methods
GET, PUT, POST, PATCH, OPTIONS
access-control-expose-headers
access-control-max-age
1728000
access-control-allow-credentials
true
access-control-allow-headers
content-type
content-encoding
gzip
vary
Accept-Encoding
recommendations
jukebox.pathfactory.com/api/public/v1/ Frame
0
0
Preflight
General
Full URL
https://jukebox.pathfactory.com/api/public/v1/recommendations?clientId=LB-9AC90F09-10427&sourceType=2&visitorUuid=52033cbc-f25a-4a05-b03a-a24d434ba751&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2013%2F04%2Fmalware-callbacks.html&contentPoolId=2ca285d7-8aca-463c-ac25-1b615d9c2519&appearanceId=1014&recommendationType=yml&sessionId=0e1d86b3-4de7-42b9-afaa-a97dec7afefa&isBot=false
Protocol
H2
Server
35.173.142.174 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-142-174.compute-1.amazonaws.com
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Method
GET
Access-Control-Request-Headers
content-type
Origin
https://www.fireeye.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Thu, 22 Jul 2021 23:54:00 GMT
content-type
text/plain
access-control-allow-origin
https://www.fireeye.com
access-control-allow-methods
GET, PUT, POST, PATCH, OPTIONS
access-control-expose-headers
access-control-max-age
1728000
access-control-allow-credentials
true
access-control-allow-headers
content-type
content-encoding
gzip
vary
Accept-Encoding
tp2
spcollector.pathfactory.com/com.snowplowanalytics.snowplow/ Frame
0
0
Preflight
General
Full URL
https://spcollector.pathfactory.com/com.snowplowanalytics.snowplow/tp2
Protocol
HTTP/1.1
Server
23.20.13.199 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-23-20-13-199.compute-1.amazonaws.com
Software
akka-http/10.0.9 /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Method
POST
Access-Control-Request-Headers
content-type
Origin
https://www.fireeye.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

Access-Control-Allow-Credentials
true
Access-Control-Allow-Headers
Content-Type
Access-Control-Allow-Origin
https://www.fireeye.com
Access-Control-Max-Age
5
Date
Thu, 22 Jul 2021 23:54:00 GMT
Server
akka-http/10.0.9
Content-Length
0
Connection
keep-alive
tp2
jukebox.pathfactory.com/com.snowplowanalytics.snowplow/ Frame
0
0
Preflight
General
Full URL
https://jukebox.pathfactory.com/com.snowplowanalytics.snowplow/tp2
Protocol
H2
Server
35.173.142.174 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-142-174.compute-1.amazonaws.com
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Method
POST
Access-Control-Request-Headers
content-type
Origin
https://www.fireeye.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Thu, 22 Jul 2021 23:54:00 GMT
content-type
text/plain
access-control-allow-origin
https://www.fireeye.com
access-control-allow-methods
GET, PUT, POST, PATCH, OPTIONS
access-control-expose-headers
access-control-max-age
1728000
access-control-allow-credentials
true
access-control-allow-headers
content-type
content-encoding
gzip
vary
Accept-Encoding
recommendations
jukebox.pathfactory.com/api/public/v1/
3 KB
1 KB
XHR
General
Full URL
https://jukebox.pathfactory.com/api/public/v1/recommendations?clientId=LB-9AC90F09-10427&sourceType=2&visitorUuid=52033cbc-f25a-4a05-b03a-a24d434ba751&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2013%2F04%2Fmalware-callbacks.html&contentPoolId=2ca285d7-8aca-463c-ac25-1b615d9c2519&appearanceId=1014&recommendationType=trending&sessionId=0e1d86b3-4de7-42b9-afaa-a97dec7afefa&isBot=false
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.142.174 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-142-174.compute-1.amazonaws.com
Software
/
Resource Hash
e5e16a3909fe9567d86c2a756e0d35855104d32a5ac0a908d803910a074b937f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

Accept
application/json
Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
application/json

Response headers

date
Thu, 22 Jul 2021 23:54:02 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains
vary
Origin, Accept-Encoding
x-request-id
2e9786e2-54e5-4358-8e0a-6069f8fb10e1
x-runtime
1.758409
referrer-policy
no-referrer-when-downgrade
etag
W/"e5e16a3909fe9567d86c2a756e0d3585"
access-control-max-age
1728000
access-control-allow-methods
GET, PUT, POST, PATCH, OPTIONS
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.fireeye.com
access-control-expose-headers
cache-control
max-age=0, private, must-revalidate
access-control-allow-credentials
true
recommendations
jukebox.pathfactory.com/api/public/v1/
3 KB
2 KB
XHR
General
Full URL
https://jukebox.pathfactory.com/api/public/v1/recommendations?clientId=LB-9AC90F09-10427&sourceType=2&visitorUuid=52033cbc-f25a-4a05-b03a-a24d434ba751&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2013%2F04%2Fmalware-callbacks.html&contentPoolId=2ca285d7-8aca-463c-ac25-1b615d9c2519&appearanceId=1014&recommendationType=yml&sessionId=0e1d86b3-4de7-42b9-afaa-a97dec7afefa&isBot=false
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.142.174 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-142-174.compute-1.amazonaws.com
Software
/
Resource Hash
c0a8988a55d32b36009a7fd0882ca60a54762cd85bb3b653316c794d659c015f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

Accept
application/json
Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
application/json

Response headers

date
Thu, 22 Jul 2021 23:54:01 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains
vary
Origin, Accept-Encoding
x-request-id
c1e41feb-a1d4-4291-ae53-ce0fcae29ee8
x-runtime
1.031693
referrer-policy
no-referrer-when-downgrade
etag
W/"c0a8988a55d32b36009a7fd0882ca60a"
access-control-max-age
1728000
access-control-allow-methods
GET, PUT, POST, PATCH, OPTIONS
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.fireeye.com
access-control-expose-headers
cache-control
max-age=0, private, must-revalidate
access-control-allow-credentials
true
tp2
spcollector.pathfactory.com/com.snowplowanalytics.snowplow/
2 B
460 B
XHR
General
Full URL
https://spcollector.pathfactory.com/com.snowplowanalytics.snowplow/tp2
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
23.20.13.199 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-23-20-13-199.compute-1.amazonaws.com
Software
akka-http/10.0.9 /
Resource Hash
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
application/json; charset=UTF-8

Response headers

Date
Thu, 22 Jul 2021 23:54:01 GMT
Server
akka-http/10.0.9
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Access-Control-Allow-Origin
https://www.fireeye.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/plain; charset=UTF-8
Content-Length
2
tp2
jukebox.pathfactory.com/com.snowplowanalytics.snowplow/
0
419 B
XHR
General
Full URL
https://jukebox.pathfactory.com/com.snowplowanalytics.snowplow/tp2
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.142.174 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-142-174.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
application/json; charset=UTF-8

Response headers

x-runtime
0.006949
date
Thu, 22 Jul 2021 23:54:00 GMT
content-encoding
gzip
referrer-policy
no-referrer-when-downgrade
vary
Origin, Accept-Encoding
access-control-allow-methods
GET, PUT, POST, PATCH, OPTIONS
content-type
text/html
access-control-allow-origin
https://www.fireeye.com
access-control-max-age
1728000
cache-control
no-cache
access-control-allow-credentials
true
x-content-type-options
nosniff
x-request-id
c6920517-e60c-47a2-a7e7-1741c9242c83
access-control-expose-headers
collect
www.google-analytics.com/
35 B
55 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j91&a=1733707541&t=event&ni=0&_s=1&dl=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2013%2F04%2Fmalware-callbacks.html&ul=en-us&de=UTF-8&dt=Malware%20Callbacks%20%7C%20FireEye%20Inc&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Page%20views%20with%20form&ea=view&el=Form&_u=aEDAAEABAAAAAC~&jid=&gjid=&cid=133491924.1626998039&tid=UA-363943-1&_gid=1784014858.1626998039&gtm=2wg7l1MVGC8KK&cd3=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2013%2F04%2Fmalware-callbacks.html&cd17=Form&cd18=3353&cd19=Malware%20Callbacks%20%7C%20FireEye%20Inc&z=40662068
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 22 Jul 2021 07:27:45 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
59175
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
XDFrame
www2.fireeye.com/index.php/form/ Frame 6ABB
2 KB
864 B
Document
General
Full URL
https://www2.fireeye.com/index.php/form/XDFrame
Requested by
Host: www2.fireeye.com
URL: https://www2.fireeye.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.70.206 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4ecd284b8811543e88f4c470ba7b3fe3f4b7a458c512bb92ab41d2b491aee6ca
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

:method
GET
:authority
www2.fireeye.com
:scheme
https
:path
/index.php/form/XDFrame
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
same-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.fireeye.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
_gcl_au=1.1.267643188.1626998038; __cf_bm=687a322a14aaf801c098049e0c279adb7befcd8d-1626998038-1800-AQssUm59xbydS974xiro2ol4tMVEtnjDiVV5uwWl4hdFmL5JwhgmaUBpXkJeIyL79VSNcjszqKjRYERbuWlU8Dc=; _ga=GA1.2.133491924.1626998039; _gid=GA1.2.1784014858.1626998039; _gat_UA-363943-1=1; _fbp=fb.1.1626998038629.1391533438; _uetsid=16062cd0eb4811eb892add8224c151bb; _uetvid=16063e80eb4811eb87386ba8b4e8527a; vid=52033cbc-f25a-4a05-b03a-a24d434ba751; check=true; mbox=session#cfa1321770b34d9cbe007cf01792220a#1626999901; __ssds=2; _pf_ses.81ef=*; _pf_id.81ef=52033cbc-f25a-4a05-b03a-a24d434ba751.1626998041.1.1626998041.1626998041.0e1d86b3-4de7-42b9-afaa-a97dec7afefa; __ssuzjsr2=a9be0cd8e; __uzmaj2=66a9a412-8ba6-4da9-8cfe-4f2430aaa8a0; __uzmbj2=1626998040; __uzmcj2=201101068293; __uzmdj2=1626998040
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://www.fireeye.com/

Response headers

date
Thu, 22 Jul 2021 23:54:00 GMT
content-type
text/html; charset=utf-8
cache-control
max-age=3600
x-content-type-options
nosniff
vary
Accept-Encoding
set-cookie
BIGipServersjiweb-nginx-app_https=!WJiDmUhO9MYcW9a7iv4ewrP5TPDRs8aXWkiF+vNEgHVGOgNN+UQyekeFq+BrDNMf3aP0Ck+lDPCz7is=;Path=/;Version=1;Secure;Httponly
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
67309779e896331e-CDG
content-encoding
gzip
forms2.min.js
www2.fireeye.com/js/forms2/js/ Frame 6ABB
204 KB
68 KB
Script
General
Full URL
https://www2.fireeye.com/js/forms2/js/forms2.min.js
Requested by
Host: www2.fireeye.com
URL: https://www2.fireeye.com/index.php/form/XDFrame
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.70.206 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
014de295141a456ceda8e3c4762085e53dca50f91ddf65906d227f70cf0b1a55
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www2.fireeye.com/index.php/form/XDFrame
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 22 Jul 2021 23:54:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
last-modified
Fri, 18 Jun 2021 20:07:07 GMT
server
cloudflare
age
4995
etag
"400c0-33187-5c50fde38d0c0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
public, max-age=14400
cf-ray
6730977b098b331e-CDG
expires
Fri, 23 Jul 2021 03:54:00 GMT
MultiNoun.jsonp
d.la1-c1-ia5.salesforceliveagent.com/chat/rest/System/
497 B
759 B
Script
General
Full URL
https://d.la1-c1-ia5.salesforceliveagent.com/chat/rest/System/MultiNoun.jsonp?nouns=VisitorId,Settings&VisitorId.prefix=Visitor&Settings.prefix=Visitor&Settings.buttonIds=[573a00000008kP3]&Settings.updateBreadcrumb=1&Settings.urlPrefix=undefined&callback=liveagent._.handlePing&deployment_id=572a0000000H8aJ&org_id=00D3000000063LS&version=34
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
13.110.43.53 , United States, ASN14340 (SALESFORCE, US),
Reverse DNS
dcl12-ncg1-c6-iad5.la1-c1-ia5.salesforceliveagent.com
Software
/
Resource Hash
77c5d779641e39d87ee40c55d1a28cb27f3aef91faaba10dfaeb2ef5f8fc1131
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Content-Type
text/javascript
Access-Control-Allow-Origin
*
Cache-Control
no-cache
Access-Control-Allow-Credentials
true
Connection
close
Expires
-1
collect
www.google-analytics.com/
35 B
55 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j91&a=1733707541&t=event&ni=0&_s=1&dl=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2013%2F04%2Fmalware-callbacks.html&ul=en-us&de=UTF-8&dt=Malware%20Callbacks%20%7C%20FireEye%20Inc&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Site%20Section&ea=FireEye%20Blogs&el=Threat%20Research&ev=0&_u=aHDAAEABAAAAAC~&jid=&gjid=&cid=133491924.1626998039&tid=UA-363943-1&_gid=1784014858.1626998039&gtm=2wg7l1MVGC8KK&z=1089070154
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 22 Jul 2021 07:27:45 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
59175
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/
35 B
55 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j91&a=1733707541&t=event&ni=0&_s=1&dl=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2013%2F04%2Fmalware-callbacks.html&ul=en-us&de=UTF-8&dt=Malware%20Callbacks%20%7C%20FireEye%20Inc&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Page%20Scroll&ea=25&el=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2013%2F04%2Fmalware-callbacks.html&_u=aHDAAEABAAAAAC~&jid=&gjid=&cid=133491924.1626998039&tid=UA-363943-1&_gid=1784014858.1626998039&gtm=2wg7l1MVGC8KK&z=1989802694
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 22 Jul 2021 07:27:45 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
59175
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/
35 B
55 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j91&a=1733707541&t=event&ni=0&_s=1&dl=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2013%2F04%2Fmalware-callbacks.html&ul=en-us&de=UTF-8&dt=Malware%20Callbacks%20%7C%20FireEye%20Inc&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Page%20Scroll&ea=50&el=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2013%2F04%2Fmalware-callbacks.html&_u=aHDAAEABAAAAAC~&jid=&gjid=&cid=133491924.1626998039&tid=UA-363943-1&_gid=1784014858.1626998039&gtm=2wg7l1MVGC8KK&z=1571735747
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 22 Jul 2021 07:27:45 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
59175
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
c6b2f539-15fb-4fd9-8a4e-b65b7aaf48ab.otf
app.cdn.lookbookhq.com/lbhq-production/10427/fonts/
97 KB
97 KB
Font
General
Full URL
https://app.cdn.lookbookhq.com/lbhq-production/10427/fonts/c6b2f539-15fb-4fd9-8a4e-b65b7aaf48ab.otf
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.25.92 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-25-92.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
8049cffe5562f5d5de279ab34e40e0fc5a217283d06eafbcd79aee6d2659e9a4

Request headers

Origin
https://www.fireeye.com
Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id
null
via
1.1 e6959f77d21557f69683da8f0cd5578a.cloudfront.net (CloudFront)
etag
"cab616e9b0bdf065765cf149a4bb82af"
x-amz-cf-pop
FRA56-C2
x-cache
RefreshHit from cloudfront
access-control-max-age
3000
content-length
99140
last-modified
Mon, 08 Apr 2019 20:27:15 GMT
server
AmazonS3
date
Thu, 22 Jul 2021 23:54:06 GMT
vary
Origin
access-control-allow-methods
GET, PUT, HEAD
access-control-allow-origin
*
cache-control
max-age=60, must-revalidate
accept-ranges
bytes
x-amz-cf-id
mBGXB-FngkRYd-UZrMI_mgjWjD6jL1tLi5U4oSIAA9W5lMqggd8bZA==
fontawesome-webfont.woff2
maxcdn.bootstrapcdn.com/font-awesome/4.6.1/fonts/
69 KB
70 KB
Font
General
Full URL
https://maxcdn.bootstrapcdn.com/font-awesome/4.6.1/fonts/fontawesome-webfont.woff2?v=4.6.1
Requested by
Host: maxcdn.bootstrapcdn.com
URL: https://maxcdn.bootstrapcdn.com/font-awesome/4.6.1/css/font-awesome.min.css
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d3ebb498192527b985939ae62cc4e5eb5c108efc1896184126b45d866868e73d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://www.fireeye.com
Referer
https://maxcdn.bootstrapcdn.com/font-awesome/4.6.1/css/font-awesome.min.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 22 Jul 2021 23:54:05 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
cdn-edgestorageid
632, 617, 617
age
7840802
cdn-cachedat
2021-04-23 07:52:38
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
70728
timing-allow-origin
*
access-control-allow-origin
*
last-modified
Mon, 25 Jan 2021 22:04:55 GMT
server
cloudflare
cdn-requestpullcode
200
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
font/woff2
cdn-cache
HIT
vary
Accept-Encoding
cache-control
public, max-age=31919000
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid
8f649c9bb5aa42d1d9619478b7180b7b
accept-ranges
bytes
cf-ray
673097986ac41786-FRA
cdn-requestcountrycode
DE
cdn-requestpullsuccess
True
4016ed74-b343-4630-b53a-4fa4742cd7f2.otf
app.cdn.lookbookhq.com/lbhq-production/10427/fonts/
97 KB
98 KB
Font
General
Full URL
https://app.cdn.lookbookhq.com/lbhq-production/10427/fonts/4016ed74-b343-4630-b53a-4fa4742cd7f2.otf
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.25.92 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-25-92.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
5607c31583a387bc428a264f2c51f7c3e332ca288fc7d98247f604b556ac6fdd

Request headers

Origin
https://www.fireeye.com
Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id
null
via
1.1 e6959f77d21557f69683da8f0cd5578a.cloudfront.net (CloudFront)
etag
"03dfaa3b91df30f10a7e1e9264545db7"
x-amz-cf-pop
FRA56-C2
x-cache
RefreshHit from cloudfront
access-control-max-age
3000
content-length
99364
last-modified
Mon, 08 Apr 2019 20:27:37 GMT
server
AmazonS3
date
Thu, 22 Jul 2021 23:54:06 GMT
vary
Origin
access-control-allow-methods
GET, PUT, HEAD
access-control-allow-origin
*
cache-control
max-age=60, must-revalidate
accept-ranges
bytes
x-amz-cf-id
VQRp-8k2qvdBBYhH0yQrPPwgCgL1J3JOcidA8cEHP5nHN9MxeX0A6g==
tp2
spcollector.pathfactory.com/com.snowplowanalytics.snowplow/ Frame
0
0
Preflight
General
Full URL
https://spcollector.pathfactory.com/com.snowplowanalytics.snowplow/tp2
Protocol
HTTP/1.1
Server
23.20.13.199 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-23-20-13-199.compute-1.amazonaws.com
Software
akka-http/10.0.9 /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Method
POST
Access-Control-Request-Headers
content-type
Origin
https://www.fireeye.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

Access-Control-Allow-Credentials
true
Access-Control-Allow-Headers
Content-Type
Access-Control-Allow-Origin
https://www.fireeye.com
Access-Control-Max-Age
5
Date
Thu, 22 Jul 2021 23:54:06 GMT
Server
akka-http/10.0.9
Content-Length
0
Connection
keep-alive
tp2
spcollector.pathfactory.com/com.snowplowanalytics.snowplow/
2 B
460 B
Ping
General
Full URL
https://spcollector.pathfactory.com/com.snowplowanalytics.snowplow/tp2
Requested by
Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/snowplow/2.17.3/sp.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
23.20.13.199 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-23-20-13-199.compute-1.amazonaws.com
Software
akka-http/10.0.9 /
Resource Hash
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
application/json

Response headers

Date
Thu, 22 Jul 2021 23:54:06 GMT
Server
akka-http/10.0.9
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Access-Control-Allow-Origin
https://www.fireeye.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/plain; charset=UTF-8
Content-Length
2
jsdata
cas.avalon.perfdrive.com/
151 B
210 B
XHR
General
Full URL
https://cas.avalon.perfdrive.com/jsdata?
Requested by
Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.241.15.240 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
240.15.241.35.bc.googleusercontent.com
Software
/
Resource Hash
99f701ef9695e8e85be5eeae932a249df2a0120168ca41961e16f2ba5b338edf

Request headers

Referer
https://www.fireeye.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

access-control-allow-origin
*
x-response-time
0ms
date
Thu, 22 Jul 2021 23:54:08 GMT
via
1.1 google
alt-svc
clear
content-length
151
content-type
text/plain; charset=UTF-8
tp2
spcollector.pathfactory.com/com.snowplowanalytics.snowplow/ Frame
0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
spcollector.pathfactory.com
URL
https://spcollector.pathfactory.com/com.snowplowanalytics.snowplow/tp2

Verdicts & Comments Add Verdict or Comment

202 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated undefined| companyDetails6Sense undefined| jsonVal undefined| companyRevenueRange undefined| companyCountry undefined| companyIndustry undefined| companyName undefined| companyRegion undefined| companyDomain undefined| segments object| dataLayer function| $ function| jQuery object| matched object| browser object| Granite object| fdc object| geoip2 undefined| cookiesOK function| onAccept function| onDecline function| ipLocation string| userAgent boolean| gomezAgent boolean| prtgAgent object| _satellite object| addthis_config object| addthis_share function| showCountryNotification undefined| _6SenseJsonObj undefined| _6SenseTime undefined| isJsonStale undefined| jsonObj function| targetPageParams object| _g function| $CQ object| CQ undefined| G_XHR_HOOK undefined| G_RELOAD_HOOK undefined| G_IS_HOOKED undefined| G_CONTENT_PATH function| _ function| generateURLSignature function| initializeTeaserLoader function| initializeLandingPageLoader object| CQ_Analytics object| CQ_Context boolean| CQ_trackTeasersStats boolean| CQ_trackLandingPagesStats object| ClientContext object| ContextCloud object| google_tag_manager function| postscribe object| google_tag_manager_external object| _laq object| google_tag_data string| _linkedin_data_partner_id object| uetq function| twq function| getParameterByName string| content_category_1 string| content_category_2 string| content_category_3 number| flag function| marketoFormSubmitGTMEvent function| bannerEvent function| validateMarketoform function| marketoFormViewGtmEvent function| getContentCategory function| fireproofFormSubmitGTMEvent object| jQuery112407672244649530342 function| lbhq object| ldfdr function| fbq function| _fbq string| GoogleAnalyticsObject function| ga function| lintrk boolean| _already_called_lintrk object| twttr function| UET function| UET_init function| UET_push object| gaplugins object| gaGlobal object| gaData function| GooglemKTybQhCsO function| google_trackConversion object| GooglebQhCsO function| mktoMunchkinFunction object| Munchkin function| mktoMunchkin function| gtag object| __dc_ns_processor boolean| __discoverInitialized function| setImmediate function| clearImmediate boolean| jukeboxInitialized boolean| liveAgentDeployment object| liveagent object| MktoForms2 object| digitalData object| feedcontainerSr undefined| feedurlSr undefined| levelsFeedSr undefined| typeofEmp undefined| jobDescriptinUrlSr object| content object| jobFunctionsArray function| displayFeedSR function| filterResultsSR function| getPostings function| populateDropDowns function| replaceQueryParam function| addMissingUTMsFromCookies number| slideTotal number| currentSlide string| target function| getCurrentSlide function| showHideControls string| activeLbox function| calculateTopMargin function| closec08 function| updatec08 function| fixCta function| showNav function| showNavSub function| showNavMore function| initNav number| totalSlides function| changeSlide function| initCarousel function| msieversion undefined| intervalId function| showSuggestions undefined| startTimer function| readCookie object| html5 object| Modernizr function| yepnope object| respond function| atwpjp string| _atd function| _euc function| _duc object| _atc string| _atr object| addthis string| addthis_pub function| emdot object| _ate object| _adr object| addthis_conf function| addthis_open function| addthis_close function| addthis_sendto object| GlobalSnowplowNamespace function| jukeboxTracker function| ssResponseCookieReader function| ssRet object| SSJSConnectorObj function| ssConf object| __klbfb function| onYouTubeIframeAPIReady object| adobe object| ___target_traces function| mboxCreate function| mboxDefine function| mboxUpdate object| MunchkinTracker boolean| __@@##MUH object| ssTimeLogs object| BrowserStyle string| j function| ssJSActionTaker function| ssJSConnWriteCookies number| __sstemp object| ssEventCollectorFunctions string| eventName object| Snowplow object| jQuery112408144002875571841 object| _atw string| addthis_exclude boolean| addthis_use_personalization string| addthis_options_default string| addthis_options_rank string| addthis_options object| __callbacks number| len function| ssEnvEvaluator

27 Cookies

Domain/Path Name / Value
www.fireeye.com/ Name: liveagent_vc
Value: 2
www.fireeye.com/ Name: liveagent_sid
Value: 29625611-bc23-4ada-b875-f114188934af
.fireeye.com/ Name: mbox
Value: session#cfa1321770b34d9cbe007cf01792220a#1626999901|PC#cfa1321770b34d9cbe007cf01792220a.37_0#1690242841
.fireeye.com/ Name: __uzmdj2
Value: 1626998040
.fireeye.com/ Name: _pf_ses.81ef
Value: *
.fireeye.com/ Name: __uzmaj2
Value: 66a9a412-8ba6-4da9-8cfe-4f2430aaa8a0
.fireeye.com/ Name: __uzmbj2
Value: 1626998040
www2.fireeye.com/ Name: BIGipServersjiweb-nginx-app_https
Value: !WJiDmUhO9MYcW9a7iv4ewrP5TPDRs8aXWkiF+vNEgHVGOgNN+UQyekeFq+BrDNMf3aP0Ck+lDPCz7is=
.fireeye.com/ Name: check
Value: true
.fireeye.com/ Name: vid
Value: 52033cbc-f25a-4a05-b03a-a24d434ba751
.fireeye.com/ Name: __uzmcj2
Value: 201101068293
.fireeye.com/ Name: __ssds
Value: 2
.www2.fireeye.com/ Name: __cf_bm
Value: 687a322a14aaf801c098049e0c279adb7befcd8d-1626998038-1800-AQssUm59xbydS974xiro2ol4tMVEtnjDiVV5uwWl4hdFmL5JwhgmaUBpXkJeIyL79VSNcjszqKjRYERbuWlU8Dc=
.fireeye.com/ Name: _gcl_au
Value: 1.1.267643188.1626998038
www.fireeye.com/ Name: __atuvs
Value: 60fa05179b24b920000
.fireeye.com/ Name: _ga
Value: GA1.2.133491924.1626998039
.fireeye.com/ Name: _uetvid
Value: 16063e80eb4811eb87386ba8b4e8527a
.fireeye.com/ Name: __ssuzjsr2
Value: a9be0cd8e
www.fireeye.com/ Name: liveagent_ptid
Value: 29625611-bc23-4ada-b875-f114188934af
www.fireeye.com/ Name: __atuvc
Value: 1%7C29
.fireeye.com/ Name: _uetsid
Value: 16062cd0eb4811eb892add8224c151bb
.fireeye.com/ Name: _pf_id.81ef
Value: 52033cbc-f25a-4a05-b03a-a24d434ba751.1626998041.1.1626998041.1626998041.0e1d86b3-4de7-42b9-afaa-a97dec7afefa
www.fireeye.com/ Name: liveagent_oref
Value:
.fireeye.com/ Name: _gid
Value: GA1.2.1784014858.1626998039
.fireeye.com/ Name: _fbp
Value: fb.1.1626998038629.1391533438
.fireeye.com/ Name: mboxEdgeCluster
Value: 37
.fireeye.com/ Name: _gat_UA-363943-1
Value: 1

9 Console Messages

Source Level URL
Text
console-api log URL: https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html(Line 1094)
Message:
currentPagePath :: /blog/threat-research/2013/04/malware-callbacks
console-api log URL: https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html(Line 1100)
Message:
[object Object]
console-api log URL: https://www.fireeye.com/blog/threat-research/2013/04/malware-callbacks.html(Line 1101)
Message:
[object Object]
console-api log (Line 27)
Message:
133491924.1626998039
console-api warning (Line 15)
Message:
AT: Failed actions [object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
console-api log URL: https://www.fireeye.com/etc/designs/fireeye-www/clientlibs_fw.min.js(Line 378)
Message:
cookie value
console-api log URL: https://www.fireeye.com/etc/designs/fireeye-www/clientlibs_fw.min.js(Line 378)
Message:
cookie value
console-api log URL: https://www.fireeye.com/etc/designs/fireeye-www/clientlibs_fw.min.js(Line 378)
Message:
cookie value
console-api log URL: https://www.fireeye.com/etc/designs/fireeye-www/clientlibs_fw.min.js(Line 378)
Message:
cookie value

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://content.fireeye.com
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

analytics.twitter.com
app.cdn.lookbookhq.com
bat.bing.com
c.la2c2.salesforceliveagent.com
cas.avalon.perfdrive.com
cdn.perfdrive.com
cdnjs.cloudflare.com
cloud.typography.com
connect.facebook.net
d.la1-c1-ia5.salesforceliveagent.com
d.la2c2.salesforceliveagent.com
fireeye.tt.omtrdc.net
fonts.googleapis.com
googleads.g.doubleclick.net
js.maxmind.com
jukebox.pathfactory.com
lftracker.leadfeeder.com
maxcdn.bootstrapcdn.com
munchkin.marketo.net
px.ads.linkedin.com
px4.ads.linkedin.com
s7.addthis.com
snap.licdn.com
spcollector.pathfactory.com
static.ads-twitter.com
stats.g.doubleclick.net
t.co
v1.addthisedge.com
www.facebook.com
www.fireeye.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.linkedin.com
www2.fireeye.com
z.moatads.com
spcollector.pathfactory.com
104.111.232.231
104.111.234.67
104.17.70.206
104.244.42.195
104.244.42.5
104.75.88.126
108.174.10.14
13.108.249.135
13.110.43.53
13.226.145.91
13.32.25.92
130.211.29.114
142.250.186.162
151.101.12.157
2.18.235.40
23.20.13.199
2606:4700:300b::a29f:f67d
2606:4700::6810:125e
2606:4700::6810:262f
2606:4700::6812:bcf
2620:119:50e1:101::6cae:b25
2620:1ec:21::14
2620:1ec:c11::200
2a00:1450:4001:80e::2003
2a00:1450:4001:80f::200e
2a00:1450:4001:810::2002
2a00:1450:4001:82b::2008
2a00:1450:4001:82f::2004
2a00:1450:4001:831::200a
2a00:1450:400c:c08::9a
2a02:26f0:6c00:2b0::25ea
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
35.173.142.174
35.241.15.240
52.213.168.74
014de295141a456ceda8e3c4762085e53dca50f91ddf65906d227f70cf0b1a55
026c5db877da222d2316bf1197b8947a96c7623d51a4d462c91bf927dece3429
03bef1eeac54d221d1da744095e12a9caae78fb47a16f0d9a7598fa83cd79fcf
05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd
09f69437d1bc5422c3ce06b678dc8620cbcad40843bf5e55038e0134b1e85a39
0d17b8a38d3dce6f7357bbc8da105d92c21b6cf1c4b92351ce2b1861b065f2c5
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
14c8c62dc692fd8faa04434e3fed25e7c23d596b732f9db88f6e9f9ff5dfa61c
1e30eab6c297cca04d7e72f217d0debfc7ce5904d1bb746febd67babf845d265
1ef89c6057c63e1fd2bda3054817b95cb244d353dc1dafd2736e0ad49ca97924
1f5615dc982df93ec052cf09795ccd312f7c1c7c6be25440b17de0d75a4cb107
1f717b6a6f4d7dcc20d0f00d507763647d102ba63df5397980879b1bee7eae00
256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
295cc2973fd8e0ea98700592bf1c04cec651e78313d891e5047cf4e46d2aa667
33d7568469159814a5802ca59e5792ec1623a9a4fb63e42eef604b4805613806
33e63bc3e8d5dbdc8a03bd27c194202c33663886e8ffcdc654a3ebf3216b00c8
355604a949ef95ceffcd21a7e9b5ed27c95d847f95127e0ddad5aa1793f1bb74
3bc14e18d6fb50b3d7dadb73e34b110d6e4cc002c736610906c2813a819d2380
4086c8cd4c3361452c1c1da9af3034fc90f4a375c4f6195f31d6dcf1c7b56f00
43589ba59da28a72ed7a6f7d2c56b83cd1b2466a9520f9848517935089405a56
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
4945b7b3e791e1d8813c97e2df9d392a99b977362b5c6e4dc24e47851357d7bf
4d4982e8369b9bfb2dc115fb09af671ea5f0e7337828ae9bfe4ae882bb67d9ed
4ecd284b8811543e88f4c470ba7b3fe3f4b7a458c512bb92ab41d2b491aee6ca
5607c31583a387bc428a264f2c51f7c3e332ca288fc7d98247f604b556ac6fdd
5cd804ec7036cddeb6403cd02cb908ebc248fe66e865dfc205df718463e3167c
6121ca306ad1045453d52517b8f436eb5a68055c82aefa46a9a77de36996a3df
6e6e6a03e72a528c28884b50bf296425667f38dd0aaf1dd17ce89199ffc85271
6e9e8d16e703a71a0020912bb5435e8af2e5b41bbd4661905471f84dfb52e1d3
716384b3b8c4f5d4e8d89c23b9a4f9516d78f82b6060ae89c493697d7f20f16c
73d6a5ea11fb7bf6e6a6ccd44b1635d52c79b0a00623d0387c9dddd4b7c68e89
74fd866b1bf3f5fec6a0c3b524ea0ceaa04086c6a61fc50cc324523cb99da99f
757eb886edd9a887fc95b701c88b08191eb743657027636c0c9d4973547ebb4a
77c5d779641e39d87ee40c55d1a28cb27f3aef91faaba10dfaeb2ef5f8fc1131
799cb15a25ed2fa78bdba496d1afbc68f033a3a5dd9ead12f4eaac4e0a93236d
79b2448738716f0daf11d4a206e105e3b79e9d082f9c9bf4ad2bd55e591a1a3c
7f8b05b543294401fa81eff64e2d63776f075dd77efc8431488596bfff9f6849
8049cffe5562f5d5de279ab34e40e0fc5a217283d06eafbcd79aee6d2659e9a4
8069956acb4c566506ff71f7a23c8e23f75ce9443384fe3393ed5c846924026e
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
83af705bec1841a313ee3ce5d97c4329da11089ed6dcd848f09a6333764ce84b
84a91ff2a1a995e3816750f53342b4499bfefc817a8ee1a5d4b401433692d510
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
85b6f75f021535da621a7a7f0974ef384720048e32aba9b217d1252329a287a3
8eeb66bddaf1dc564b5c406c2d20dd94de1c64f7f562c3d50ed6544a287ec16b
9113fbb8f97202c632a76b08ed09530d1ea97d55fd2df42438c081d2e22290b9
9142284b40303e65c6d8c8aa302e88e55d94ebc54b7b5abde86d6ae97a03c502
93144b711b7ef4bed3c9b9d28983347edf6d70d2290911886f13467d6cabc911
95687e1f33ad9db49292344fc79e6de6a4d35f4e796386f099323a98dc20694d
985a53bcdeef61498d5d62a66f67a440ae441de38cced2a9cfbc8bd6b029da58
99f701ef9695e8e85be5eeae932a249df2a0120168ca41961e16f2ba5b338edf
99fa5a280296b5fc7b63433ee121a359fc68c4a37f04a87d363e751164b96ff1
a4c67fe8115b40f60d96ecd24873ba492cfdc4d876d1368c1c1142237f56292a
a53ea60fbea6cb1775430998564d5f295aba7d3bfe548a0ba79aa2a049aba839
a83836ec8efa8e402e410455200c7a01b33e8e390c7b9ddfa5ab3224a0d44286
a876a773b46aea97d22c1f84dac918fbc98ee3c1e1729f21cef7911de52f141e
abd6fc0a5afb5d28db8874f1d70042c5c43031835ece5f9c439bfb8be0986537
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
acd2f7ad78edeebad4b6b0fdd17ff57d81c3726c60fd5435ee8c5a0115d29403
b397476bcbcf8c9eae3f82007cc4f9495661b367e02e6d3dea6e15f0610ef20a
b5d7707ea8fc00aae40bf500ac7498d7f32f6b1bbff7b4fde976a40345eb5f9d
b82c98e8c4f4a5c771ef6f061634b0fe49da9f53f915cdf0f576b1cf655db0c1
bb854d12c9f15b7e02f12ed4f774638aba6640d5f6f13a3bfa425dbbf0b745f3
c084b47104c493fb377b6d35d8c08df67d773f6dcf8294c0a7360710cd8cacbd
c0a8988a55d32b36009a7fd0882ca60a54762cd85bb3b653316c794d659c015f
c5d851f82aed40520103262006a2c0fd15a861db9d478f3befc4184a6ee67279
c6f75c5c38c416c778acab5a9141630848f46cdabc05c1920ed1c763c486f51f
c986afd07a4082d65befeef18869a4cd5e00f3ac6e8228d49658802c7453a1b8
c9b7d6e7a5672d872763ce1eee54e278c0e2294e4bdb23ba19120e50a757a02b
d3ebb498192527b985939ae62cc4e5eb5c108efc1896184126b45d866868e73d
d78bfcf1f62b6a4a6c403372ad3a4f46fcf2bda72822ae206129d38de72f4d84
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e5e16a3909fe9567d86c2a756e0d35855104d32a5ac0a908d803910a074b937f
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efb755bfe1f080ae024aaac25030ccf1e87dca318e78c8162c1591bd83463bc2
f684d50dc9b24df0a4845f688a45b856d945f79d79549240187e171e1655f236
f7bba0cc484923e9dc8eb46a451efbd2ebe40980e07195777adaa39956bc5cd5
f9f99e3c0904ffd05bd59459afd3afa1df2de38e60117cf9303abc84f6802bb3
fb384da9d5c974e03adbec0785369381df8f2c656d21faf6d9e10c96612ff14b
fbcc2c7d4dfbc5d0251c789843b8d7edf25306dfa23188ad267e2786357233c0
fcdfd21cc7e1430ec95b4b57b0edb05c5d2751eefa260b67b7fe5bb4035e6998