www.vkremez.com Open in urlscan Pro
2606:4700:3030::681c:143e Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
Submission: On September 24 via api (September 24th 2020, 2:00:18 pm UTC) from US

Summary HTTP 91 Redirects Links 11 Behaviour Indicators

Summary

This website contacted 15 IPs in 4 countries across 11 domains to perform 91 HTTP transactions. The main IP is 2606:4700:3030::681c:143e, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.vkremez.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on July 9th 2020. Valid for: a year.

This is the only time www.vkremez.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
5	2606:4700:303... 2606:4700:3030::681c:143e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 16	2a00:1450:400... 2a00:1450:4001:81f::2009	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6810:a723	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:821::200e	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:820::200e	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c0c::9b	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:819::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:818::2003	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:819::200e	15169 (GOOGLE) (GOOGLE)
5	151.101.12.157 151.101.12.157	54113 (FASTLY) (FASTLY)
31	2a00:1450:400... 2a00:1450:4001:819::2001	15169 (GOOGLE) (GOOGLE)
24	2a00:1450:400... 2a00:1450:4001:806::2001	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:802::200e	15169 (GOOGLE) (GOOGLE)
1	2a03:2880:f11... 2a03:2880:f11c:8183:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1 1	2a00:1450:400... 2a00:1450:4001:800::200d	15169 (GOOGLE) (GOOGLE)
91	15

5 2606:4700:3030::681c:143e (United States)

ASN13335 (CLOUDFLARENET, US)

www.vkremez.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 2a00:1450:4001:81f::2009 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.blogger.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.blogblog.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:a723 (United States)

ASN13335 (CLOUDFLARENET, US)

ajax.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:821::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:820::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c0c::9b (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:819::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:818::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:819::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

apis.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 151.101.12.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

platform.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

31 2a00:1450:4001:819::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

1.bp.blogspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
4.bp.blogspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
2.bp.blogspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
3.bp.blogspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

24 2a00:1450:4001:806::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

1.bp.blogspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
3.bp.blogspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:802::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

apis.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f11c:8183:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:800::200d (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

accounts.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
55	blogspot.com 1.bp.blogspot.com 3.bp.blogspot.com 4.bp.blogspot.com 2.bp.blogspot.com	489 KB
10	blogger.com 1 redirects www.blogger.com	529 KB
6	blogblog.com www.blogblog.com	304 KB
5	twitter.com platform.twitter.com	31 KB
5	vkremez.com www.vkremez.com	20 KB
4	google.com 1 redirects www.google.com apis.google.com accounts.google.com	69 KB
2	google-analytics.com www.google-analytics.com	18 KB
1	facebook.com www.facebook.com
1	google.de www.google.de	106 B
1	doubleclick.net stats.g.doubleclick.net	88 B
1	cloudflare.com ajax.cloudflare.com	4 KB
91	11

	Domain	Requested by
28	1.bp.blogspot.com	www.blogblog.com
10	4.bp.blogspot.com
10	www.blogger.com	1 redirects www.vkremez.com ajax.cloudflare.com www.blogblog.com
9	2.bp.blogspot.com
8	3.bp.blogspot.com
6	www.blogblog.com	ajax.cloudflare.com
5	platform.twitter.com	www.blogblog.com platform.twitter.com
5	www.vkremez.com	www.vkremez.com ajax.cloudflare.com www.blogblog.com
2	apis.google.com	www.blogblog.com apis.google.com
2	www.google-analytics.com	www.vkremez.com www.google-analytics.com
1	accounts.google.com	1 redirects
1	www.facebook.com	www.blogblog.com
1	www.google.de	www.vkremez.com
1	www.google.com	www.vkremez.com
1	stats.g.doubleclick.net	www.google-analytics.com
1	ajax.cloudflare.com	www.vkremez.com
91	16

This site contains links to these domains. Also see Links.

Domain
www.blogger.com
www.bleepingcomputer.com
1.bp.blogspot.com

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-07-09` - `2021-07-09`	a year	crt.sh
*.blogger.com GTS CA 1O1	`2020-08-26` - `2020-11-18`	3 months	crt.sh
ajax.cloudflare.com DigiCert ECC Secure Server CA	`2020-08-11` - `2022-08-16`	2 years	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2020-08-26` - `2020-11-18`	3 months	crt.sh
www.google.com GTS CA 1O1	`2020-08-26` - `2020-11-18`	3 months	crt.sh
www.google.de GTS CA 1O1	`2020-08-26` - `2020-11-18`	3 months	crt.sh
*.apis.google.com GTS CA 1O1	`2020-08-26` - `2020-11-18`	3 months	crt.sh
platform.twitter.com DigiCert SHA2 High Assurance Server CA	`2020-08-13` - `2021-08-18`	a year	crt.sh
misc-sni.blogspot.com GTS CA 1O1	`2020-08-26` - `2020-11-18`	3 months	crt.sh
*.google.com GTS CA 1O1	`2020-08-26` - `2020-11-18`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2020-09-11` - `2020-12-10`	3 months	crt.sh

This page contains 7 frames:

Primary Page: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
Frame ID: AAB5797C3A326FB769C78D160F4304D4
Requests: 91 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/tweet_button.html?url=https%3A%2F%2Fwww.vkremez.com%2F2020%2F04%2Flets-learn-trickbot-bazarbackdoor.html&count=horizontal&text=Let%27s%20Learn%3A%20TrickBot%20%22BazarBackdoor%22%20Process%20Hollowing%20Injection%20Primer&size=medium
Frame ID: E71ED0FE7CFEA63F2B6792326008A202
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/plugins/like.php?href=http%3A%2F%2Fwww.vkremez.com%2F2020%2F04%2Flets-learn-trickbot-bazarbackdoor.html&send=false&layout=button_count&action=like&show_faces=false&colorscheme=light
Frame ID: 499E43E986C74346CDD01339376AAD56
Requests: 1 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.2d7d9a6d04538bf11c7b23641e75738c.html?origin=https%3A%2F%2Fwww.vkremez.com
Frame ID: C214E37670CD654E7A7D9A9BF4008429
Requests: 1 HTTP requests in this frame

Frame: https://platform.twitter.com/embed/index.html?dnt=false&embedId=twitter-widget-0&frame=false&hideCard=false&hideThread=false&id=1252303608747565057&lang=en&origin=https%3A%2F%2Fwww.vkremez.com%2F2020%2F04%2Flets-learn-trickbot-bazarbackdoor.html&theme=light&widgetsVersion=219d021%3A1598982042171&width=550px
Frame ID: BBC0A98CA89F4CB48AC8BE846B47EC3F
Requests: 1 HTTP requests in this frame

Frame: https://www.blogger.com/comment-iframe.g?blogID=3986785863650565253&postID=6114194039930120721
Frame ID: 014CC0B95C2C9172680725EF8851049D
Requests: 1 HTTP requests in this frame

Frame: https://www.blogger.com/comment-iframe.g?blogID=3986785863650565253&postID=6114194039930120721&bpli=1
Frame ID: 1EFD9E28ED8D27575F0CAF4156EE6411
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Blogger (Blogs) Expand

Overall confidence: 100%
Detected patterns

meta generator /^Blogger$/i

Python (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

meta generator /^Blogger$/i

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

91
Requests

98 %
HTTPS

93 %
IPv6

11
Domains

16
Subdomains

15
IPs

4
Countries

1463 kB
Transfer

6640 kB
Size

4
Cookies

11 Outgoing links

These are links going to different origins than the main page.

URL: https://www.blogger.com/go/blogspot-cookies
Title: Weitere Informationen

Search URL Search Domain Scan URL

URL: https://www.blogger.com/post-edit.g?blogID=3986785863650565253&from=pencil

Search URL Search Domain Scan URL

URL: https://www.blogger.com/home

Search URL Search Domain Scan URL

URL: https://www.blogger.com/post-edit.g?blogID=3986785863650565253&postID=6114194039930120721&from=pencil

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/news/security/bazarbackdoor-trickbot-gang-s-new-stealthy-network-hacking-malware/
Title: BleepingComputer report

Search URL Search Domain Scan URL

URL: https://1.bp.blogspot.com/-ArgupP7N1rA/XqPjhNVmAcI/AAAAAAAAenA/IohRyVV3k_kl6qSvKSZB9g4yjl2MMIcZgCLcBGAsYHQ/s1600/Screen%2BShot%2B2020-04-25%2Bat%2B3.15.02%2BAM.png

Search URL Search Domain Scan URL

URL: https://1.bp.blogspot.com/-5Tvssi5LAWY/XqQEDI7d_rI/AAAAAAAAenc/M3bufTHGlEoTg2jMGzy0OhK67ucniHnAACLcBGAsYHQ/s1600/Untitled%2BDiagram.jpg

Search URL Search Domain Scan URL

URL: https://1.bp.blogspot.com/-q7KasYAefY8/XqQHGW1XOuI/AAAAAAAAen0/6MFwtbGsl64-PsqYExYmuqP3Cvm5uIdgwCLcBGAsYHQ/s1600/Screen%2BShot%2B2020-04-25%2Bat%2B5.44.40%2BAM.png

Search URL Search Domain Scan URL

URL: https://1.bp.blogspot.com/-ur46xL-v-Wc/XqQFrZ17mDI/AAAAAAAAeno/rVHOUI7n19wWLYhC3FGhm_1dyHjLG817QCLcBGAsYHQ/s1600/Screen%2BShot%2B2020-04-25%2Bat%2B5.40.39%2BAM.png

Search URL Search Domain Scan URL

URL: https://1.bp.blogspot.com/-_BTtTjFpyo8/XqQJtRbivDI/AAAAAAAAeoA/DSOaPB_JydcF4Cyk3NL56PGvVj7BnrOCACLcBGAsYHQ/s1600/Screen%2BShot%2B2020-04-25%2Bat%2B5.57.30%2BAM.png

Search URL Search Domain Scan URL

URL: https://www.blogger.com/profile/08061973052790292809
Title: Vitali Kremez

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 96

https://www.blogger.com/comment-iframe.g?blogID=3986785863650565253&postID=6114194039930120721 HTTP 302
https://accounts.google.com/ServiceLogin?continue=https://www.blogger.com/comment-iframe.g?blogID%3D3986785863650565253%26postID%3D6114194039930120721%26bpli%3D1&followup=https://www.blogger.com/comment-iframe.g?blogID%3D3986785863650565253%26postID%3D6114194039930120721%26bpli%3D1&passive=true&go=true HTTP 302
https://www.blogger.com/comment-iframe.g?blogID=3986785863650565253&postID=6114194039930120721&bpli=1

91 HTTP transactions
7 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request lets-learn-trickbot-bazarbackdoor.html Show response
www.vkremez.com/2020/04/ 22 KB
6 KB 315ms
274ms Document
text/html 2606:4700:3030::681c:143e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3030::681c:143e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

68cc61d3b31fe39f3f1115803f0c63c6635131a8d3f242bde12cc0e820055257

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.vkremez.com
:scheme: https
:path: /2020/04/lets-learn-trickbot-bazarbackdoor.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Thu, 24 Sep 2020 14:00:01 GMT
content-type: text/html; charset=UTF-8
set-cookie: __cfduid=d6a2e7d776b39f8ba100683c0e511c75e1600956001; expires=Sat, 24-Oct-20 14:00:01 GMT; path=/; domain=.vkremez.com; HttpOnly; SameSite=Lax
expires: Thu, 24 Sep 2020 14:00:01 GMT
cache-control: private, max-age=0
last-modified: Tue, 22 Sep 2020 11:50:05 GMT
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cf-cache-status: DYNAMIC
cf-request-id: 05620305a40000e00703085200000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 5d7d0782ad0ce007-FRA
content-encoding: br

GET
H2 200 rCFq0Q-zTsMxcd3V8sTNUHIcYvw.js Show response
www.vkremez.com/cdn-cgi/apps/head/ 6 KB
2 KB 18ms
17ms Script
application/javascript 2606:4700:3030::681c:143e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.vkremez.com/cdn-cgi/apps/head/rCFq0Q-zTsMxcd3V8sTNUHIcYvw.js
Requested by: Host: www.vkremez.com
URL: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3030::681c:143e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d9bf20fa1e29339c8dcbe0df9f1cd23ee01df3ae0877cdc80d08c33a30d41ab4

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 14:00:01 GMT
content-encoding: br
cf-cache-status: HIT
age: 326954
status: 200
x-amz-request-id: 3671FC886FFC0F26
x-amz-id-2: tSNGo4lfBgbRUmjQNlsN3Rwgh96ulAm3ZMU1Ou0zsXKS99iN+JhuaRNs+SoWPBrbaRdFKwA3EtY=
last-modified: Thu, 20 Jul 2017 22:51:20 GMT
server: cloudflare
etag: W/"279e89472487866cc22f82d8f249bc9e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
x-amz-version-id: mzdAianDF56VdV788peQgLeXBaEyDfbD
cf-request-id: 05620306be0000e007030a4200000001
cf-ray: 5d7d07846966e007-FRA

GET
H2 200 3416767676-css_bundle_v2.css
www.blogger.com/static/v1/widgets/ 36 KB
8 KB 34ms
6ms Stylesheet
text/css 2a00:1450:4001:81f::2009
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.blogger.com/static/v1/widgets/3416767676-css_bundle_v2.css

Requested by

Host: www.vkremez.com
URL: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::2009 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c91afadbe63dd834aac00b49bc715795da58970e7d500c4bd8f50ed713c77880

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 21 Sep 2020 00:01:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Sun, 20 Sep 2020 14:30:32 GMT
server: sffe
age: 309538
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7982
x-xss-protection: 0
expires: Tue, 21 Sep 2021 00:01:04 GMT

GET
H2 200 rocket-loader.min.js Show response
ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/ 12 KB
4 KB 9ms
8ms Script
application/javascript 2606:4700::6810:a723
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js

Requested by

Host: www.vkremez.com
URL: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:a723 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b08cdbc2d30e656a86b20f8342428d5863f70f4b30135b4f4061f754ce932f5e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 14:00:01 GMT
content-encoding: gzip
vary: Accept-Encoding
last-modified: Mon, 14 Sep 2020 19:48:52 GMT
server: cloudflare
etag: W/"5f5fc924-3016"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
content-type: application/javascript
status: 200
cache-control: max-age=172800, public
strict-transport-security: max-age=15780000; includeSubDomains
cf-ray: 5d7d07846fd805ed-FRA
cf-request-id: 05620306bc000005ede6391200000001
expires: Sat, 26 Sep 2020 14:00:01 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 45 KB
18 KB 9ms
5ms Script
text/javascript 2a00:1450:4001:821::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.vkremez.com
URL: https://www.vkremez.com/cdn-cgi/apps/head/rCFq0Q-zTsMxcd3V8sTNUHIcYvw.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:821::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

60863e86aa7743d1ac841da7f473a05cd57fba81d661cef658e385437f80d5ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 09 Sep 2020 01:50:37 GMT
server: Golfe2
age: 2662
date: Thu, 24 Sep 2020 13:15:40 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18650
expires: Thu, 24 Sep 2020 15:15:40 GMT

GET
H2 200 6Un-tcGipDRUsckjwkdswoMYqSY.js Show response
www.vkremez.com/cdn-cgi/apps/body/ 11 KB
5 KB 26ms
25ms Script
application/javascript 2606:4700:3030::681c:143e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.vkremez.com/cdn-cgi/apps/body/6Un-tcGipDRUsckjwkdswoMYqSY.js
Requested by: Host: www.vkremez.com
URL: https://www.vkremez.com/cdn-cgi/apps/head/rCFq0Q-zTsMxcd3V8sTNUHIcYvw.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3030::681c:143e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5d4f00b740c987fdd882682830c76c2ff10b2b8982ae7ac58086758c274fc935

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 14:00:02 GMT
content-encoding: br
cf-cache-status: HIT
age: 205862
status: 200
x-amz-request-id: CAC04B4957D585E6
x-amz-id-2: 6BxbIIgnIavDArE0vG9P2FYGrgxGfTdJnO1D3kSGuXzdjox5C1ZBa7X44Bt8zL6F3kw7u3CgoWk=
last-modified: Thu, 20 Jul 2017 22:51:20 GMT
server: cloudflare
etag: W/"9fdd0c96e9162120a77ae3a5505c5a13"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
x-amz-version-id: oSpWrK3hBysq.HtSVcNdZvYr4ggdNm5s
cf-request-id: 05620306e40000e007030a8200000001
cf-ray: 5d7d0784a9f5e007-FRA

GET
H2 200 jquery.js Show response
www.blogblog.com/dynamicviews/de918fe7fca9ee54/js/thirdparty/ 97 KB
34 KB 16ms
7ms Script
text/javascript 2a00:1450:4001:81f::2009
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.blogblog.com/dynamicviews/de918fe7fca9ee54/js/thirdparty/jquery.js

Requested by

Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::2009 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ef25f2d6f5aa424f594bbaa63c1f86a634e2b87911e1db695b2a0c2e6927353a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Wed, 23 Sep 2020 00:59:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 22 Sep 2020 01:36:07 GMT
server: sffe
age: 133237
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35009
x-xss-protection: 0
expires: Wed, 30 Sep 2020 00:59:25 GMT

POST
H3-Q050 200 collect Show response
www.google-analytics.com/j/ 4 B
70 B 14ms
13ms XHR
text/plain 2a00:1450:4001:820::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j86&a=321689884&t=pageview&_s=1&dl=https%3A%2F%2Fwww.vkremez.com%2F2020%2F04%2Flets-learn-trickbot-bazarbackdoor.html&ul=en-us&de=UTF-8&dt=Vitali%20Kremez%20%7C%20Ethical%20Hacker%20%7C%20Reverse%20Engineer%3A%20Let%27s%20Learn%3A%20TrickBot%20%22BazarBackdoor%22%20Process%20Hollowing%20Injection%20Primer&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAAC~&jid=238369300&gjid=385603864&cid=127819044.1600956002&tid=UA-68445231-1&_gid=425208281.1600956002&_r=1&_slc=1&z=1316519003

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:820::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 24 Sep 2020 14:00:02 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
status: 200
content-type: text/plain
access-control-allow-origin: https://www.vkremez.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ 1 KB
0 Stylesheet
text/css

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c89a2cf8bf444df7e11af2befd8c1f20a96c34bee6d13270e7692441843395da

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: text/css;charset=utf-8

GET
H3-Q050 200 jquery-mousewheel.js Show response
www.blogblog.com/dynamicviews/de918fe7fca9ee54/js/thirdparty/ 3 KB
2 KB 28ms
14ms Script
text/javascript 2a00:1450:4001:81f::2009
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.blogblog.com/dynamicviews/de918fe7fca9ee54/js/thirdparty/jquery-mousewheel.js

Requested by

Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81f::2009 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7e41f7333fa9b59a516a5a4f3af346bb24a4c3c8a7bc26551b6fec8d0f6b8555

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Wed, 23 Sep 2020 00:59:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 22 Sep 2020 01:36:07 GMT
server: sffe
age: 133237
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1289
x-xss-protection: 0
expires: Wed, 30 Sep 2020 00:59:25 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
88 B 16ms
15ms XHR
text/plain 2a00:1450:400c:c0c::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j86&tid=UA-68445231-1&cid=127819044.1600956002&jid=238369300&gjid=385603864&_gid=425208281.1600956002&_u=IEBAAEAAAAAAAC~&z=1764649443

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c0c::9b Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Thu, 24 Sep 2020 14:00:02 GMT
status: 200
content-type: text/plain
access-control-allow-origin: https://www.vkremez.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
106 B 34ms
33ms Image
image/gif 2a00:1450:4001:819::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j86&tid=UA-68445231-1&cid=127819044.1600956002&jid=238369300&_u=IEBAAEAAAAAAAC~&z=2018636046

Requested by

Host: www.vkremez.com
URL: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Sep 2020 14:00:02 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
106 B 19ms
18ms Image
image/gif 2a00:1450:4001:818::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j86&tid=UA-68445231-1&cid=127819044.1600956002&jid=238369300&_u=IEBAAEAAAAAAAC~&z=2018636046

Requested by

Host: www.vkremez.com
URL: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Sep 2020 14:00:02 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 common.js Show response
www.blogblog.com/dynamicviews/de918fe7fca9ee54/js/ 214 KB
89 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:81f::2009
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.blogblog.com/dynamicviews/de918fe7fca9ee54/js/common.js

Requested by

Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81f::2009 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4f37cc26aefc6f7ac0b0104cd3ab477f9f88d06ce2a05640f78565002fa6902f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Wed, 23 Sep 2020 00:59:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 22 Sep 2020 01:36:07 GMT
server: sffe
age: 133237
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 90763
x-xss-protection: 0
expires: Wed, 30 Sep 2020 00:59:25 GMT

GET
H3-Q050 200 sidebar.js Show response
www.blogblog.com/dynamicviews/de918fe7fca9ee54/js/ 116 KB
40 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:81f::2009
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.blogblog.com/dynamicviews/de918fe7fca9ee54/js/sidebar.js

Requested by

Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81f::2009 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5bad31055fddde526b7b4e43621f46ff190776a7ee57243072f1d7dd1fa702e7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Wed, 23 Sep 2020 01:32:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 22 Sep 2020 01:36:07 GMT
server: sffe
age: 131224
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40410
x-xss-protection: 0
expires: Wed, 30 Sep 2020 01:32:58 GMT

GET
H3-Q050 200 gadgets.js Show response
www.blogblog.com/dynamicviews/de918fe7fca9ee54/js/ 63 KB
20 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:81f::2009
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.blogblog.com/dynamicviews/de918fe7fca9ee54/js/gadgets.js

Requested by

Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81f::2009 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1856965de5b049979677f4eb5e149f93464e76d8b4beccc66d1befbcd1c6ff56

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Wed, 23 Sep 2020 00:59:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 22 Sep 2020 01:36:07 GMT
server: sffe
age: 133237
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20577
x-xss-protection: 0
expires: Wed, 30 Sep 2020 00:59:25 GMT

GET
H3-Q050 200 comments.js Show response
www.blogblog.com/dynamicviews/4224c15c4e7c9321/js/ 390 KB
119 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:81f::2009
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.blogblog.com/dynamicviews/4224c15c4e7c9321/js/comments.js

Requested by

Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81f::2009 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

266c8725e6911ff0e2f23572d0ebf1e30c7594e49ea8bed00af914c924fc086a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Tue, 22 Sep 2020 01:20:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 14 May 2012 20:21:35 GMT
server: sffe
age: 218375
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 122175
x-xss-protection: 0
expires: Tue, 29 Sep 2020 01:20:27 GMT

GET
H3-Q050 200 authorization.css
www.blogger.com/dyn-css/ 1 B
646 B 115ms
114ms Stylesheet
text/css 2a00:1450:4001:81f::2009
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.blogger.com/dyn-css/authorization.css?targetBlogID=3986785863650565253&zx=af58694e-b051-4e56-bf66-c9a1c9f6f812

Requested by

Host: www.vkremez.com
URL: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81f::2009 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b

Security Headers

Name	Value
Content-Security-Policy	script-src 'self' .google.com .google-analytics.com 'unsafe-inline' 'unsafe-eval' .gstatic.com .googlesyndication.com .blogger.com .googleapis.com uds.googleusercontent.com https://s.ytimg.com https://i18n-cloud.appspot.com www-onepick-opensocial.googleusercontent.com www-bloggervideo-opensocial.googleusercontent.com www-blogger-opensocial.googleusercontent.com https://www.blogblog.com; report-uri /cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: script-src 'self' *.google.com *.google-analytics.com 'unsafe-inline' 'unsafe-eval' *.gstatic.com *.googlesyndication.com *.blogger.com *.googleapis.com uds.googleusercontent.com https://s.ytimg.com https://i18n-cloud.appspot.com www-onepick-opensocial.googleusercontent.com www-bloggervideo-opensocial.googleusercontent.com www-blogger-opensocial.googleusercontent.com https://www.blogblog.com; report-uri /cspreport
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="This is not a P3P policy! See https://www.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info."
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Thu, 24 Sep 2020 14:00:02 GMT
server: GSE
date: Thu, 24 Sep 2020 14:00:02 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=UTF-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 3369543813-widgets.js Show response
www.blogger.com/static/v1/widgets/ 140 KB
51 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:81f::2009
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.blogger.com/static/v1/widgets/3369543813-widgets.js

Requested by

Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81f::2009 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ada150b19834590e9b541a6de7bc403dea550444de15d4841fe5ac5afc8281e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 21 Sep 2020 00:34:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Sun, 20 Sep 2020 23:09:26 GMT
server: sffe
age: 307518
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 52287
x-xss-protection: 0
expires: Tue, 21 Sep 2021 00:34:44 GMT

GET
H2 200 cookienotice.js Show response
www.vkremez.com/js/ 4 KB
1 KB 19ms
18ms Script
text/javascript 2606:4700:3030::681c:143e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.vkremez.com/js/cookienotice.js

Requested by

Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3030::681c:143e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1385fe6c7366b4ab71c2806b9d327c837c8b5d74e35aa762200da83feb6113a8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 14:00:02 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 517177
cf-polished: origSize=6513
status: 200
cf-bgj: minify
cf-request-id: 05620307d00000e007030c2200000001
last-modified: Fri, 18 Sep 2020 13:09:37 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
x-xss-protection: 0
cache-control: public, max-age=604800
cf-ray: 5d7d07861dbae007-FRA
expires: Fri, 25 Sep 2020 14:20:25 GMT

GET
H3-Q050 200 authorization.css
www.blogger.com/dyn-css/ 1 B
46 B 496ms
495ms Stylesheet
text/css 2a00:1450:4001:81f::2009
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.blogger.com/dyn-css/authorization.css?targetBlogID=3986785863650565253&zx=af58694e-b051-4e56-bf66-c9a1c9f6f812

Requested by

Host: www.vkremez.com
URL: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81f::2009 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b

Security Headers

Name	Value
Content-Security-Policy	script-src 'self' .google.com .google-analytics.com 'unsafe-inline' 'unsafe-eval' .gstatic.com .googlesyndication.com .blogger.com .googleapis.com uds.googleusercontent.com https://s.ytimg.com https://i18n-cloud.appspot.com www-onepick-opensocial.googleusercontent.com www-bloggervideo-opensocial.googleusercontent.com www-blogger-opensocial.googleusercontent.com https://www.blogblog.com; report-uri /cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: script-src 'self' *.google.com *.google-analytics.com 'unsafe-inline' 'unsafe-eval' *.gstatic.com *.googlesyndication.com *.blogger.com *.googleapis.com uds.googleusercontent.com https://s.ytimg.com https://i18n-cloud.appspot.com www-onepick-opensocial.googleusercontent.com www-bloggervideo-opensocial.googleusercontent.com www-blogger-opensocial.googleusercontent.com https://www.blogblog.com; report-uri /cspreport
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="This is not a P3P policy! See https://www.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info."
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Thu, 24 Sep 2020 14:00:02 GMT
server: GSE
date: Thu, 24 Sep 2020 14:00:02 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=UTF-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ 13 KB
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4286fd6f7ca4c6d12f1573d042d24982f0564a0dc35080bf44a560b0845bf4e7

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/gif

GET
H3-Q050 200 default Show response
www.blogger.com/feeds/3986785863650565253/posts/ 2 MB
248 KB 1161ms
1161ms Script
text/javascript 2a00:1450:4001:81f::2009
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.blogger.com/feeds/3986785863650565253/posts/default?alt=json&v=2&dynamicviews=1&orderby=published&max-results=25&rewriteforssl=true&callback=jQuery112505078703914712992_1600956002057&_=1600956002058

Requested by

Host: www.blogblog.com
URL: https://www.blogblog.com/dynamicviews/de918fe7fca9ee54/js/thirdparty/jquery.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81f::2009 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

cde46891f57c8a4986240aab850b56736963fd68ed193dd265fdb525c906fd60

Security Headers

Name	Value
Content-Security-Policy	script-src 'self' .google.com .google-analytics.com 'unsafe-inline' 'unsafe-eval' .gstatic.com .googlesyndication.com .blogger.com .googleapis.com uds.googleusercontent.com https://s.ytimg.com https://i18n-cloud.appspot.com www-onepick-opensocial.googleusercontent.com www-bloggervideo-opensocial.googleusercontent.com www-blogger-opensocial.googleusercontent.com https://www.blogblog.com; report-uri /cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: script-src 'self' *.google.com *.google-analytics.com 'unsafe-inline' 'unsafe-eval' *.gstatic.com *.googlesyndication.com *.blogger.com *.googleapis.com uds.googleusercontent.com https://s.ytimg.com https://i18n-cloud.appspot.com www-onepick-opensocial.googleusercontent.com www-bloggervideo-opensocial.googleusercontent.com www-blogger-opensocial.googleusercontent.com https://www.blogblog.com; report-uri /cspreport
content-encoding: gzip
etag: W/"D0MERH05fyp7ImA9XxZTF0o."
access-control-allow-origin: *
p3p: CP="This is not a P3P policy! See https://www.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info."
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 1; mode=block
last-modified: Tue, 22 Sep 2020 11:50:05 GMT
server: GSE
x-frame-options: SAMEORIGIN
date: Thu, 24 Sep 2020 14:00:03 GMT
vary: Accept, X-GData-Authorization, GData-Version
content-type: text/javascript; charset=UTF-8
gdata-version: 2.0
cache-control: private, max-age=0, must-revalidate, no-transform
x-content-type-options: nosniff
expires: Thu, 24 Sep 2020 14:00:03 GMT

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c0d078d779c6d50be940b91eafdc1e0091ee1aef73087fdcddfb7771470b3c59

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/gif

GET
DATA 200
OK truncated
/ 385 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 39e1d583fa516a045854dd31d01795224685f184c7309e649805f961db4c0d4b

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 380 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 34c6eb5fe76799775f269cf110d2b953f50c439b693e6ef0c9ce52426bb5c2fb

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 6114194039930120721 Show response
www.vkremez.com//feeds/posts/default/ 41 KB
5 KB 224ms
223ms XHR
application/json 2606:4700:3030::681c:143e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.vkremez.com//feeds/posts/default/6114194039930120721?alt=json&v=2&dynamicviews=1&rewriteforssl=true

Requested by

Host: www.blogblog.com
URL: https://www.blogblog.com/dynamicviews/de918fe7fca9ee54/js/thirdparty/jquery.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3030::681c:143e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

38c7b9dfaa94c5bb687b94856b3f667b3fc32558cefc8db2462e428b22f3f272

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 14:00:05 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
status: 200
cf-request-id: 05620311e10000e0070316a200000001
last-modified: Sat, 25 Apr 2020 10:23:38 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"ab35f24ac5860f50ec29cacd5798add2ff4e5eb36392c0a27cc52061de8ed941"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/json; charset=UTF-8
x-xss-protection: 0
cache-control: public, must-revalidate, proxy-revalidate, max-age=1
cf-ray: 5d7d07963e4ee007-FRA
expires: Thu, 24 Sep 2020 14:00:05 GMT

GET
H2 200 plusone.js Show response
apis.google.com/js/ 49 KB
19 KB 34ms
34ms Script
application/javascript 2a00:1450:4001:819::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/js/plusone.js?_=1600956002059

Requested by

Host: www.blogblog.com
URL: https://www.blogblog.com/dynamicviews/de918fe7fca9ee54/js/thirdparty/jquery.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

995d27f93763429f51cb7f2056a378dfcf77bfe016742b18fa8833bd37e686bb

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-Xf38zGgls4YmDs5oxDvElg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 14:00:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
status: 200
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
x-ua-compatible: IE=edge, chrome=1
server: ESF
etag: "87aa0f886dd418a2960068ca1c6a4b1a"
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=1800, stale-while-revalidate=1800
content-security-policy: script-src 'report-sample' 'nonce-Xf38zGgls4YmDs5oxDvElg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
timing-allow-origin: *
expires: Thu, 24 Sep 2020 14:00:04 GMT

GET
DATA 200
OK truncated
/ 288 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 088734158a6c69e32f928ffa72f2e6505312e5a76bca31ff34bbe85ce100e992

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 widgets.js Show response
platform.twitter.com/ 95 KB
29 KB 102ms
35ms Script
application/javascript 151.101.12.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets.js
Requested by: Host: www.blogblog.com
URL: https://www.blogblog.com/dynamicviews/de918fe7fca9ee54/js/thirdparty/jquery.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.12.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: a761b426004caba495cdac2c93ce7dd306c47bc4d7bdc63c4840c3d8182396a9

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 14:00:05 GMT
content-encoding: gzip
x-cache: HIT, HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200
content-length: 28881
x-served-by: cache-bwi5141-BWI, cache-fra19134-FRA
last-modified: Tue, 01 Sep 2020 20:40:54 GMT
etag: "a58136137a93f33c1d165df7d4d973f8+gzip"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=1800
accept-ranges: bytes
tw-cdn: FT

GET
H2 200 Screen%2BShot%2B2020-04-25%2Bat%2B3.15.02%2BAM.png
1.bp.blogspot.com/-ArgupP7N1rA/XqPjhNVmAcI/AAAAAAAAenA/IohRyVV3k_kl6qSvKSZB9g4yjl2MMIcZgCLcBGAsYHQ/s640/ 107 KB
107 KB 12ms
10ms Image
image/png 2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1.bp.blogspot.com/-ArgupP7N1rA/XqPjhNVmAcI/AAAAAAAAenA/IohRyVV3k_kl6qSvKSZB9g4yjl2MMIcZgCLcBGAsYHQ/s640/Screen%2BShot%2B2020-04-25%2Bat%2B3.15.02%2BAM.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

a3526975153401491b2ebe96da9193881276911067fea1859d559fa0af980e0f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 12:11:07 GMT
x-content-type-options: nosniff
age: 6538
status: 200
content-disposition: inline;filename="Screen Shot 2020-04-25 at 3.15.02 AM.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 109507
x-xss-protection: 0
server: fife
etag: "v7a71"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sat, 19 Sep 2020 21:08:41 GMT

GET
H2 200 Untitled%2BDiagram.jpg
1.bp.blogspot.com/-5Tvssi5LAWY/XqQEDI7d_rI/AAAAAAAAenc/M3bufTHGlEoTg2jMGzy0OhK67ucniHnAACLcBGAsYHQ/s640/ 89 KB
89 KB 23ms
21ms Image
image/jpeg 2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1.bp.blogspot.com/-5Tvssi5LAWY/XqQEDI7d_rI/AAAAAAAAenc/M3bufTHGlEoTg2jMGzy0OhK67ucniHnAACLcBGAsYHQ/s640/Untitled%2BDiagram.jpg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

84d8ff0b83ae2d4534af3e612a96a91a1ff9b6281e24e9566b9916417ceb63b9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 12:11:07 GMT
x-content-type-options: nosniff
age: 6538
status: 200
content-disposition: inline;filename="Untitled Diagram.jpg"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 91436
x-xss-protection: 0
server: fife
etag: "v7a78"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sat, 19 Sep 2020 21:08:41 GMT

GET
H2 200 Screen%2BShot%2B2020-04-25%2Bat%2B5.44.40%2BAM.png
1.bp.blogspot.com/-q7KasYAefY8/XqQHGW1XOuI/AAAAAAAAen0/6MFwtbGsl64-PsqYExYmuqP3Cvm5uIdgwCLcBGAsYHQ/s640/ 117 KB
117 KB 19ms
18ms Image
image/png 2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1.bp.blogspot.com/-q7KasYAefY8/XqQHGW1XOuI/AAAAAAAAen0/6MFwtbGsl64-PsqYExYmuqP3Cvm5uIdgwCLcBGAsYHQ/s640/Screen%2BShot%2B2020-04-25%2Bat%2B5.44.40%2BAM.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

a97f410f65e2faae69fac5ef8c34a937808d1094960062ded1682d5af3d669ac

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 12:11:07 GMT
x-content-type-options: nosniff
age: 6538
status: 200
content-disposition: inline;filename="Screen Shot 2020-04-25 at 5.44.40 AM.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 119376
x-xss-protection: 0
server: fife
etag: "v7a7e"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sat, 19 Sep 2020 21:08:42 GMT

GET
H2 200 Screen%2BShot%2B2020-04-25%2Bat%2B5.40.39%2BAM.png
1.bp.blogspot.com/-ur46xL-v-Wc/XqQFrZ17mDI/AAAAAAAAeno/rVHOUI7n19wWLYhC3FGhm_1dyHjLG817QCLcBGAsYHQ/s640/ 16 KB
16 KB 18ms
17ms Image
image/png 2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1.bp.blogspot.com/-ur46xL-v-Wc/XqQFrZ17mDI/AAAAAAAAeno/rVHOUI7n19wWLYhC3FGhm_1dyHjLG817QCLcBGAsYHQ/s640/Screen%2BShot%2B2020-04-25%2Bat%2B5.40.39%2BAM.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

6d6b2397c0429050dd22ca4322bd54351a88692ff74c0603ac20d9cdfc68a191

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 12:11:07 GMT
x-content-type-options: nosniff
age: 6538
status: 200
content-disposition: inline;filename="Screen Shot 2020-04-25 at 5.40.39 AM.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16740
x-xss-protection: 0
server: fife
etag: "v7a7b"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sat, 19 Sep 2020 21:08:42 GMT

GET
H2 200 Screen%2BShot%2B2020-04-25%2Bat%2B5.57.30%2BAM.png
1.bp.blogspot.com/-_BTtTjFpyo8/XqQJtRbivDI/AAAAAAAAeoA/DSOaPB_JydcF4Cyk3NL56PGvVj7BnrOCACLcBGAsYHQ/s640/ 34 KB
34 KB 20ms
19ms Image
image/png 2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1.bp.blogspot.com/-_BTtTjFpyo8/XqQJtRbivDI/AAAAAAAAeoA/DSOaPB_JydcF4Cyk3NL56PGvVj7BnrOCACLcBGAsYHQ/s640/Screen%2BShot%2B2020-04-25%2Bat%2B5.57.30%2BAM.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

2dde0068aa6abd942461e9f5a2ce63505faa130295454b6b6bbec371de6fe009

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 12:11:07 GMT
x-content-type-options: nosniff
age: 6538
status: 200
content-disposition: inline;filename="Screen Shot 2020-04-25 at 5.57.30 AM.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34395
x-xss-protection: 0
server: fife
etag: "v7a81"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sat, 19 Sep 2020 21:08:42 GMT

GET
H3-Q050 200 Screen%2BShot%2B2020-04-25%2Bat%2B3.15.02%2BAM.png
1.bp.blogspot.com/-ArgupP7N1rA/XqPjhNVmAcI/AAAAAAAAenA/IohRyVV3k_kl6qSvKSZB9g4yjl2MMIcZgCLcBGAsYHQ/s30-p/ 1 KB
2 KB 71ms
21ms Image
image/png 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1.bp.blogspot.com/-ArgupP7N1rA/XqPjhNVmAcI/AAAAAAAAenA/IohRyVV3k_kl6qSvKSZB9g4yjl2MMIcZgCLcBGAsYHQ/s30-p/Screen%2BShot%2B2020-04-25%2Bat%2B3.15.02%2BAM.png

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

60f2ee8979a830df28592bdc641f0ec2772430031e7a50b4c7d9592c8a7733ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 10:11:25 GMT
x-content-type-options: nosniff
age: 13720
status: 200
content-disposition: inline;filename="Screen Shot 2020-04-25 at 3.15.02 AM.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1279
x-xss-protection: 0
server: fife
etag: "v7a71"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sun, 20 Sep 2020 12:25:37 GMT

GET
H3-Q050 200 Screen%2BShot%2B2020-02-24%2Bat%2B6.09.24%2BPM.png
1.bp.blogspot.com/-wRqDCGKGUmU/XlSDqTVA80I/AAAAAAAAH2k/bpC4X8IdXkcrYpWHed5FaKAdzIfl3M12gCLcBGAsYHQ/s30-p/ 764 B
869 B 72ms
21ms Image
image/png 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1.bp.blogspot.com/-wRqDCGKGUmU/XlSDqTVA80I/AAAAAAAAH2k/bpC4X8IdXkcrYpWHed5FaKAdzIfl3M12gCLcBGAsYHQ/s30-p/Screen%2BShot%2B2020-02-24%2Bat%2B6.09.24%2BPM.png

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

10e1b9c2de3504f2345907eef55f57ab8db35cafc72afdec0ac986f45291a8e8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 10:11:25 GMT
x-content-type-options: nosniff
age: 13720
status: 200
content-disposition: inline;filename="Screen Shot 2020-02-24 at 6.09.24 PM.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 764
x-xss-protection: 0
server: fife
etag: "v1f6a"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Thu, 24 Sep 2020 05:21:08 GMT

GET
H3-Q050 200 Screen%2BShot%2B2020-02-19%2Bat%2B5.26.15%2BAM.png
1.bp.blogspot.com/-zRHtoHc0g_M/Xk03iK0UUcI/AAAAAAAAH1o/ULWyAPMdCzQYn_bzwJn2aq-re7ah9H8-wCLcBGAsYHQ/s30-p/ 2 KB
2 KB 78ms
28ms Image
image/png 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1.bp.blogspot.com/-zRHtoHc0g_M/Xk03iK0UUcI/AAAAAAAAH1o/ULWyAPMdCzQYn_bzwJn2aq-re7ah9H8-wCLcBGAsYHQ/s30-p/Screen%2BShot%2B2020-02-19%2Bat%2B5.26.15%2BAM.png

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

f749661c02cee9c7aef6745e82a1125d68762c4759dcdbfd163e3f24bde6be57

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 10:11:25 GMT
x-content-type-options: nosniff
age: 13720
status: 200
content-disposition: inline;filename="Screen Shot 2020-02-19 at 5.26.15 AM.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1772
x-xss-protection: 0
server: fife
etag: "v1f5b"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Thu, 24 Sep 2020 05:21:08 GMT

GET
H3-Q050 200 Screen%2BShot%2B2019-10-17%2Bat%2B3.23.25%2BAM.png
1.bp.blogspot.com/-BFB9g8hHghc/XahDwQnC0bI/AAAAAAAAHtg/yIfJR0nnQ4oCZeThx3QJozdf_o-6plbsACLcBGAsYHQ/s30-p/ 2 KB
2 KB 88ms
38ms Image
image/png 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1.bp.blogspot.com/-BFB9g8hHghc/XahDwQnC0bI/AAAAAAAAHtg/yIfJR0nnQ4oCZeThx3QJozdf_o-6plbsACLcBGAsYHQ/s30-p/Screen%2BShot%2B2019-10-17%2Bat%2B3.23.25%2BAM.png

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

d310a2a2ad6bcac4068391482c43950cc7e672ad698641309af0c8dbaa673456

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 10:11:25 GMT
x-content-type-options: nosniff
age: 13720
status: 200
content-disposition: inline;filename="Screen Shot 2019-10-17 at 3.23.25 AM.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1990
x-xss-protection: 0
server: fife
etag: "v1eda"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Thu, 24 Sep 2020 05:21:08 GMT

GET
H2 200 Screen%2BShot%2B2019-04-09%2Bat%2B11.33.21%2BPM.png
3.bp.blogspot.com/-xrGuSSykGbk/XK1xBfvzJkI/AAAAAAAAHek/ZnqzET1gra4g0TXilKnzVn0lYtf5ZSHNQCLcBGAs/s30-p/ 2 KB
2 KB 30ms
6ms Image
image/png 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://3.bp.blogspot.com/-xrGuSSykGbk/XK1xBfvzJkI/AAAAAAAAHek/ZnqzET1gra4g0TXilKnzVn0lYtf5ZSHNQCLcBGAs/s30-p/Screen%2BShot%2B2019-04-09%2Bat%2B11.33.21%2BPM.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

12956acbc65984f465f513dadb036a69899a5320d464ecc44fbdff33d47d402c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 10:11:25 GMT
x-content-type-options: nosniff
age: 13720
status: 200
content-disposition: inline;filename="Screen Shot 2019-04-09 at 11.33.21 PM.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2027
x-xss-protection: 0
server: fife
etag: "v1dea"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Thu, 24 Sep 2020 08:41:52 GMT

GET
H2 200 Screen%2BShot%2B2019-03-25%2Bat%2B5.34.42%2BPM.png
4.bp.blogspot.com/--NaQfTZyMpY/XJs0JKp4ccI/AAAAAAAAHcE/CY_hI1R1N4wCnA8pUERPBCOR-Cth9q-5gCLcBGAs/s30-p/ 2 KB
2 KB 38ms
13ms Image
image/png 2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://4.bp.blogspot.com/--NaQfTZyMpY/XJs0JKp4ccI/AAAAAAAAHcE/CY_hI1R1N4wCnA8pUERPBCOR-Cth9q-5gCLcBGAs/s30-p/Screen%2BShot%2B2019-03-25%2Bat%2B5.34.42%2BPM.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

e0c75a3728746941983a7e3b362dd5df7c2d67dcb49567724fabb15b1ef50947

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 13:05:58 GMT
x-content-type-options: nosniff
age: 3247
status: 200
content-disposition: inline;filename="Screen Shot 2019-03-25 at 5.34.42 PM.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1848
x-xss-protection: 0
server: fife
etag: "v1dc2"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sat, 19 Sep 2020 14:20:37 GMT

GET
H3-Q050 200 Screen%2BShot%2B2019-01-26%2Bat%2B2.24.40%2BPM.png
1.bp.blogspot.com/-rXa2_1hlcBM/XEy2wI8ErII/AAAAAAAAHYw/uHEGwusPGW8EKj_Vu8JJHaSEMa5vCcZPwCLcBGAs/s30-p/ 1 KB
1 KB 99ms
50ms Image
image/png 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1.bp.blogspot.com/-rXa2_1hlcBM/XEy2wI8ErII/AAAAAAAAHYw/uHEGwusPGW8EKj_Vu8JJHaSEMa5vCcZPwCLcBGAs/s30-p/Screen%2BShot%2B2019-01-26%2Bat%2B2.24.40%2BPM.png

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

eba3881542a1ce2068c819ecebaf2f7ba9dbbf2cbde8f68eaa39a832ef66c6c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 10:11:25 GMT
x-content-type-options: nosniff
age: 13720
status: 200
content-disposition: inline;filename="Screen Shot 2019-01-26 at 2.24.40 PM.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1051
x-xss-protection: 0
server: fife
etag: "v1d8d"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sun, 20 Sep 2020 12:25:37 GMT

GET
H3-Q050 200 Screen%2BShot%2B2019-01-22%2Bat%2B4.44.18%2BAM.png
1.bp.blogspot.com/-SewP8w1rWhA/XEbmZlh0EPI/AAAAAAAAHYE/XyZI1h8Ee4MJ1602YpwD4XTJSVxDrOr0ACLcBGAs/s30-p/ 2 KB
2 KB 82ms
37ms Image
image/png 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1.bp.blogspot.com/-SewP8w1rWhA/XEbmZlh0EPI/AAAAAAAAHYE/XyZI1h8Ee4MJ1602YpwD4XTJSVxDrOr0ACLcBGAs/s30-p/Screen%2BShot%2B2019-01-22%2Bat%2B4.44.18%2BAM.png

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

352c0ffe232c95e651a332fc322419fc55330d3c91f7fbf51ff430847ee1623f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 10:11:25 GMT
x-content-type-options: nosniff
age: 13720
status: 200
content-disposition: inline;filename="Screen Shot 2019-01-22 at 4.44.18 AM.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2064
x-xss-protection: 0
server: fife
etag: "v1d82"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Thu, 24 Sep 2020 05:21:08 GMT

GET
H2 200 Screen%2BShot%2B2019-01-09%2Bat%2B5.20.46%2BPM.png
4.bp.blogspot.com/-sRfvVgl_kmU/XDaN88wxo6I/AAAAAAAAHXQ/ZJYnIss-Asof-cHT7nCindJ8K0v7eaa4wCLcBGAs/s30-p/ 1 KB
1 KB 35ms
14ms Image
image/png 2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://4.bp.blogspot.com/-sRfvVgl_kmU/XDaN88wxo6I/AAAAAAAAHXQ/ZJYnIss-Asof-cHT7nCindJ8K0v7eaa4wCLcBGAs/s30-p/Screen%2BShot%2B2019-01-09%2Bat%2B5.20.46%2BPM.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

e9c446e0dbaf6509c3f50825b8592884f7bf7d21aaf5b0fddaa98d7b389ecd5b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 13:05:58 GMT
x-content-type-options: nosniff
age: 3247
status: 200
content-disposition: inline;filename="Screen Shot 2019-01-09 at 5.20.46 PM.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1189
x-xss-protection: 0
server: fife
etag: "v1d76"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sat, 19 Sep 2020 14:20:37 GMT

GET
H3-Q050 200 Screen%2BShot%2B2019-01-07%2Bat%2B3.05.10%2BAM.png
1.bp.blogspot.com/-cwiFd3zTZVc/XDMIomqSUBI/AAAAAAAAHXE/Ra1R7BgM3sUDojjS7MAXV_WCrlJYSS7gwCLcBGAs/s30-p/ 1 KB
1 KB 83ms
39ms Image
image/png 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1.bp.blogspot.com/-cwiFd3zTZVc/XDMIomqSUBI/AAAAAAAAHXE/Ra1R7BgM3sUDojjS7MAXV_WCrlJYSS7gwCLcBGAs/s30-p/Screen%2BShot%2B2019-01-07%2Bat%2B3.05.10%2BAM.png

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

83adc88a1264b185cff852951ffdd42d68761f692b9e28951d26fa20eaccf2be

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 10:11:25 GMT
x-content-type-options: nosniff
age: 13720
status: 200
content-disposition: inline;filename="Screen Shot 2019-01-07 at 3.05.10 AM.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1254
x-xss-protection: 0
server: fife
etag: "v1d72"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Mon, 14 Sep 2020 11:08:16 GMT

GET
H2 200 Screen%2BShot%2B2018-12-23%2Bat%2B9.47.56%2BPM.png
3.bp.blogspot.com/-t8zscHidTek/XCBMp2PlXqI/AAAAAAAAHVo/9ilggnaHxew6zBDoCkayTr3gjA8Ko028ACLcBGAs/s30-p/ 2 KB
2 KB 30ms
10ms Image
image/png 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://3.bp.blogspot.com/-t8zscHidTek/XCBMp2PlXqI/AAAAAAAAHVo/9ilggnaHxew6zBDoCkayTr3gjA8Ko028ACLcBGAs/s30-p/Screen%2BShot%2B2018-12-23%2Bat%2B9.47.56%2BPM.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

eeea76d34a426787eab8f9ddf9209a6188a05f180b961b93f7fb767b908e96d9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 10:11:25 GMT
x-content-type-options: nosniff
age: 13720
status: 200
content-disposition: inline;filename="Screen Shot 2018-12-23 at 9.47.56 PM.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1620
x-xss-protection: 0
server: fife
etag: "v1d5c"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Thu, 24 Sep 2020 08:41:52 GMT

GET
H3-Q050 200 Screen%2BShot%2B2018-12-21%2Bat%2B3.14.20%2BAM.png
1.bp.blogspot.com/--UsOqUKJ80w/XByhiyP-PmI/AAAAAAAAHVA/dETYa0pXcK4IQkv6uOAQItI3TgTfw5W7QCLcBGAs/s30-p/ 1 KB
1 KB 81ms
38ms Image
image/png 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1.bp.blogspot.com/--UsOqUKJ80w/XByhiyP-PmI/AAAAAAAAHVA/dETYa0pXcK4IQkv6uOAQItI3TgTfw5W7QCLcBGAs/s30-p/Screen%2BShot%2B2018-12-21%2Bat%2B3.14.20%2BAM.png

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

f5fcff76c1da90c0cfa732560a2952a473fc0245c48c443d1df37b1d25fe3834

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 10:11:25 GMT
x-content-type-options: nosniff
age: 13720
status: 200
content-disposition: inline;filename="Screen Shot 2018-12-21 at 3.14.20 AM.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1056
x-xss-protection: 0
server: fife
etag: "v1d51"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Thu, 24 Sep 2020 05:21:09 GMT

GET
H2 200 Screen%2BShot%2B2018-12-15%2Bat%2B8.11.28%2BPM.png
3.bp.blogspot.com/-X6bXlNXerAg/XBXPWMljQNI/AAAAAAAAHTo/aF51svoEZgEnFK-M3dldF2DgKkhAjuuMgCLcBGAs/s30-p/ 1 KB
2 KB 28ms
9ms Image
image/png 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://3.bp.blogspot.com/-X6bXlNXerAg/XBXPWMljQNI/AAAAAAAAHTo/aF51svoEZgEnFK-M3dldF2DgKkhAjuuMgCLcBGAs/s30-p/Screen%2BShot%2B2018-12-15%2Bat%2B8.11.28%2BPM.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

672d64bef3ef92e42a5550c13238cc329787222e2874cbabbe4861a136d29dc2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 10:11:25 GMT
x-content-type-options: nosniff
age: 13720
status: 200
content-disposition: inline;filename="Screen Shot 2018-12-15 at 8.11.28 PM.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1433
x-xss-protection: 0
server: fife
etag: "v1d3b"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Thu, 24 Sep 2020 08:41:52 GMT

GET
H2 200 Screen%2BShot%2B2018-12-09%2Bat%2B9.44.22%2BPM.png
4.bp.blogspot.com/-hHt0KfFwTsI/XA3t55C7QeI/AAAAAAAAHSA/TCipE2G3AqssZl3FKANCjGDp19fqTQAJACLcBGAs/s30-p/ 2 KB
2 KB 34ms
15ms Image
image/png 2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://4.bp.blogspot.com/-hHt0KfFwTsI/XA3t55C7QeI/AAAAAAAAHSA/TCipE2G3AqssZl3FKANCjGDp19fqTQAJACLcBGAs/s30-p/Screen%2BShot%2B2018-12-09%2Bat%2B9.44.22%2BPM.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

83a2e9e77e37f8142be840b51bfe16f27c7d857ca614550e93aa860eb29391a9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 13:05:58 GMT
x-content-type-options: nosniff
age: 3247
status: 200
content-disposition: inline;filename="Screen Shot 2018-12-09 at 9.44.22 PM.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1711
x-xss-protection: 0
server: fife
etag: "v1d21"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sat, 19 Sep 2020 14:20:37 GMT

GET
H3-Q050 200 Screen%2BShot%2B2018-11-26%2Bat%2B5.06.22%2BAM.png
1.bp.blogspot.com/-s4gRRh4SEBs/W_vGIYXDYqI/AAAAAAAAHPI/Qlo-fQDqDuU-DvFARNmnwuX3Mr52mmWRgCLcBGAs/s30-p/ 1 KB
1 KB 103ms
59ms Image
image/png 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1.bp.blogspot.com/-s4gRRh4SEBs/W_vGIYXDYqI/AAAAAAAAHPI/Qlo-fQDqDuU-DvFARNmnwuX3Mr52mmWRgCLcBGAs/s30-p/Screen%2BShot%2B2018-11-26%2Bat%2B5.06.22%2BAM.png

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

f5b92e0c5428ee48219650011e0bcf48607dd9a390f1b36384fb38087b67f24d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 10:11:26 GMT
x-content-type-options: nosniff
age: 13719
status: 200
content-disposition: inline;filename="Screen Shot 2018-11-26 at 5.06.22 AM.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1352
x-xss-protection: 0
server: fife
etag: "v1cf3"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Thu, 24 Sep 2020 05:21:09 GMT

GET
H3-Q050 200 image1_macro_debuggin.png
1.bp.blogspot.com/-5MqO54-Xh2E/W_e_jEsacqI/AAAAAAAAHOc/3ICdhvTV02YIZylAvfZrC4tRLlksL6nDQCLcBGAs/s30-p/ 1 KB
1 KB 107ms
64ms Image
image/png 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1.bp.blogspot.com/-5MqO54-Xh2E/W_e_jEsacqI/AAAAAAAAHOc/3ICdhvTV02YIZylAvfZrC4tRLlksL6nDQCLcBGAs/s30-p/image1_macro_debuggin.png

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

a400d73caf87f08fa624b8ac9100a38d076f736bd718cc7131331b35c5e885c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 10:11:26 GMT
x-content-type-options: nosniff
age: 13719
status: 200
content-disposition: inline;filename="image1_macro_debuggin.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1081
x-xss-protection: 0
server: fife
etag: "v1ce8"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Thu, 24 Sep 2020 05:21:09 GMT

GET
H3-Q050 200 Screen%2BShot%2B2018-11-06%2Bat%2B4.39.53%2BPM.png
1.bp.blogspot.com/--cp1FNG6T40/W-J9-aFanZI/AAAAAAAAHMw/e4iaqzE9t_A5myXDmEJ8MlJdh-7o4EchQCLcBGAs/s30-p/ 2 KB
2 KB 79ms
36ms Image
image/png 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1.bp.blogspot.com/--cp1FNG6T40/W-J9-aFanZI/AAAAAAAAHMw/e4iaqzE9t_A5myXDmEJ8MlJdh-7o4EchQCLcBGAs/s30-p/Screen%2BShot%2B2018-11-06%2Bat%2B4.39.53%2BPM.png

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

870c88fd51fa56c52989ef0e94f106c46aef8e2036ad694d72cb02a8e307785f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 10:11:26 GMT
x-content-type-options: nosniff
age: 13719
status: 200
content-disposition: inline;filename="Screen Shot 2018-11-06 at 4.39.53 PM.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1937
x-xss-protection: 0
server: fife
etag: "v1ccd"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Thu, 24 Sep 2020 05:21:09 GMT

GET
H3-Q050 200 Screen%2BShot%2B2018-11-04%2Bat%2B8.44.34%2BPM.png
1.bp.blogspot.com/-05o9SnLltcw/W9-hH5gi4qI/AAAAAAAAHMM/9H71sQ89poQido3PSK81lJnYuzDvqmqBwCLcBGAs/s30-p/ 2 KB
2 KB 72ms
29ms Image
image/png 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1.bp.blogspot.com/-05o9SnLltcw/W9-hH5gi4qI/AAAAAAAAHMM/9H71sQ89poQido3PSK81lJnYuzDvqmqBwCLcBGAs/s30-p/Screen%2BShot%2B2018-11-04%2Bat%2B8.44.34%2BPM.png

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

0c239d58c774a19f664eb6ab5004a6ae3c449325ee5998ba65f892df4d6a5971

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 10:11:26 GMT
x-content-type-options: nosniff
age: 13719
status: 200
content-disposition: inline;filename="Screen Shot 2018-11-04 at 8.44.34 PM.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1646
x-xss-protection: 0
server: fife
etag: "v1cc4"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Thu, 24 Sep 2020 05:21:09 GMT

GET
H2 200 Screen%2BShot%2B2018-10-30%2Bat%2B6.58.15%2BPM.png
2.bp.blogspot.com/-Rz7n-eamwX4/W9jkh5B1wUI/AAAAAAAAHKQ/ZyZ7fueFMnMceFlK9KOo8AqUqPy_9yB3wCLcBGAs/s30-p/ 1 KB
1 KB 28ms
10ms Image
image/png 2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://2.bp.blogspot.com/-Rz7n-eamwX4/W9jkh5B1wUI/AAAAAAAAHKQ/ZyZ7fueFMnMceFlK9KOo8AqUqPy_9yB3wCLcBGAs/s30-p/Screen%2BShot%2B2018-10-30%2Bat%2B6.58.15%2BPM.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

146cf03f372f999168d4ec2a94380976f15f17fbfb08fbffde1c1a5f67438fee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 12:11:07 GMT
x-content-type-options: nosniff
age: 6538
status: 200
content-disposition: inline;filename="Screen Shot 2018-10-30 at 6.58.15 PM.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1196
x-xss-protection: 0
server: fife
etag: "v1ca6"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sat, 19 Sep 2020 14:57:54 GMT

GET
H2 200 Screen%2BShot%2B2018-09-10%2Bat%2B00.38.47.png
2.bp.blogspot.com/-PIyOirFZV6Y/W5YpFQcTVFI/AAAAAAAAHGw/T7-XrQawAkY6BaNc0J-3S0aMzsar2Z-jwCLcBGAs/s30-p/ 2 KB
2 KB 29ms
12ms Image
image/png 2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://2.bp.blogspot.com/-PIyOirFZV6Y/W5YpFQcTVFI/AAAAAAAAHGw/T7-XrQawAkY6BaNc0J-3S0aMzsar2Z-jwCLcBGAs/s30-p/Screen%2BShot%2B2018-09-10%2Bat%2B00.38.47.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

5114816a47dc958d23af84763e576b236d08aa1366f10b5ec37d2ba5052b74c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 12:11:07 GMT
x-content-type-options: nosniff
age: 6538
status: 200
content-disposition: inline;filename="Screen Shot 2018-09-10 at 00.38.47.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2135
x-xss-protection: 0
server: fife
etag: "v1c6d"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sat, 19 Sep 2020 14:57:54 GMT

GET
H2 200 Screen%2BShot%2B2018-09-06%2Bat%2B04.48.03.png
4.bp.blogspot.com/-uYF2NQ20lCo/W5DqRi1JG3I/AAAAAAAAHFg/8Ha8vfsn23wxxrekXp5gepLwWs072EkVwCLcBGAs/s30-p/ 1 KB
1 KB 30ms
12ms Image
image/png 2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://4.bp.blogspot.com/-uYF2NQ20lCo/W5DqRi1JG3I/AAAAAAAAHFg/8Ha8vfsn23wxxrekXp5gepLwWs072EkVwCLcBGAs/s30-p/Screen%2BShot%2B2018-09-06%2Bat%2B04.48.03.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

439476ca5fd109c0aeb8e6c55d4cc4e2e772a27a582c49109494f06f40c95cbc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 13:05:58 GMT
x-content-type-options: nosniff
age: 3247
status: 200
content-disposition: inline;filename="Screen Shot 2018-09-06 at 04.48.03.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1298
x-xss-protection: 0
server: fife
etag: "v1c59"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sat, 19 Sep 2020 14:20:37 GMT

GET
H2 200 Screen%2BShot%2B2018-08-28%2Bat%2B03.03.10.png
2.bp.blogspot.com/-9ubYbrXWp9k/W4T0eMzLBCI/AAAAAAAAHDw/oLJVlmoiBqQalzT-Eppbdu4TMBbBoIerQCLcBGAs/s30-p/ 1 KB
2 KB 22ms
11ms Image
image/png 2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://2.bp.blogspot.com/-9ubYbrXWp9k/W4T0eMzLBCI/AAAAAAAAHDw/oLJVlmoiBqQalzT-Eppbdu4TMBbBoIerQCLcBGAs/s30-p/Screen%2BShot%2B2018-08-28%2Bat%2B03.03.10.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

1ad705e628a38ac534ff5357e88b0ebe199385bd3afbc6a8a75eeadd9885fd24

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 12:11:07 GMT
x-content-type-options: nosniff
age: 6538
status: 200
content-disposition: inline;filename="Screen Shot 2018-08-28 at 03.03.10.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1472
x-xss-protection: 0
server: fife
etag: "v1c3d"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sat, 19 Sep 2020 14:57:54 GMT

GET
H2 200 Screen%2BShot%2B2018-08-19%2Bat%2B07.00.01.png
4.bp.blogspot.com/-iIEkOuxfkNc/W3lRgAF9MlI/AAAAAAAAHAk/BrzQCvSlnYkPBhF9wSjllynsDLLUPJ2CQCLcBGAs/s30-p/ 2 KB
2 KB 21ms
16ms Image
image/png 2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://4.bp.blogspot.com/-iIEkOuxfkNc/W3lRgAF9MlI/AAAAAAAAHAk/BrzQCvSlnYkPBhF9wSjllynsDLLUPJ2CQCLcBGAs/s30-p/Screen%2BShot%2B2018-08-19%2Bat%2B07.00.01.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

82def3e3ea5794d68c07253d6d5b547985b3bea4227b6942a29fba62fde49a63

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 13:05:58 GMT
x-content-type-options: nosniff
age: 3247
status: 200
content-disposition: inline;filename="Screen Shot 2018-08-19 at 07.00.01.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1918
x-xss-protection: 0
server: fife
etag: "v1c0a"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Fri, 18 Sep 2020 05:18:37 GMT

GET
H3-Q050 200 Screen%2BShot%2B2018-08-04%2Bat%2B03.25.26.png
1.bp.blogspot.com/-FsUD_n2eD3E/W2YW4hdyigI/AAAAAAAAG-w/0gTTGBZBLsEcc89IQ7d89Pw3S9sJ1bMzgCLcBGAs/s30-p/ 2 KB
2 KB 70ms
35ms Image
image/png 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1.bp.blogspot.com/-FsUD_n2eD3E/W2YW4hdyigI/AAAAAAAAG-w/0gTTGBZBLsEcc89IQ7d89Pw3S9sJ1bMzgCLcBGAs/s30-p/Screen%2BShot%2B2018-08-04%2Bat%2B03.25.26.png

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

882b7316b4f9053b6debabf8bf1d257950264d501cd30cd2c48972c59a164a8c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 10:11:26 GMT
x-content-type-options: nosniff
age: 13719
status: 200
content-disposition: inline;filename="Screen Shot 2018-08-04 at 03.25.26.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1616
x-xss-protection: 0
server: fife
etag: "v1bed"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Thu, 24 Sep 2020 05:21:10 GMT

GET
H2 200 Screen%2BShot%2B2018-07-29%2Bat%2B01.10.00.png
4.bp.blogspot.com/-CRdVdC0Psrc/W11XGprudiI/AAAAAAAAG9A/MMMwtq_S0a0QdZoOxGcShZ9Nn1nO_-gyACLcBGAs/s30-p/ 2 KB
2 KB 20ms
15ms Image
image/png 2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://4.bp.blogspot.com/-CRdVdC0Psrc/W11XGprudiI/AAAAAAAAG9A/MMMwtq_S0a0QdZoOxGcShZ9Nn1nO_-gyACLcBGAs/s30-p/Screen%2BShot%2B2018-07-29%2Bat%2B01.10.00.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

c678636b42cce155be48ee783b75a30e2851d08e7f81e5b6279520a24746d917

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 13:05:58 GMT
x-content-type-options: nosniff
age: 3247
status: 200
content-disposition: inline;filename="Screen Shot 2018-07-29 at 01.10.00.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1721
x-xss-protection: 0
server: fife
etag: "v1bd1"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Fri, 18 Sep 2020 05:18:37 GMT

GET
H3-Q050 200 Screen%2BShot%2B2020-04-25%2Bat%2B5.40.39%2BAM.png
1.bp.blogspot.com/-ur46xL-v-Wc/XqQFrZ17mDI/AAAAAAAAeno/rVHOUI7n19wWLYhC3FGhm_1dyHjLG817QCLcBGAsYHQ/s640/ 16 KB
17 KB 31ms
21ms Image
image/png 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1.bp.blogspot.com/-ur46xL-v-Wc/XqQFrZ17mDI/AAAAAAAAeno/rVHOUI7n19wWLYhC3FGhm_1dyHjLG817QCLcBGAsYHQ/s640/Screen%2BShot%2B2020-04-25%2Bat%2B5.40.39%2BAM.png

Requested by

Host: www.blogblog.com
URL: https://www.blogblog.com/dynamicviews/de918fe7fca9ee54/js/thirdparty/jquery.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

6d6b2397c0429050dd22ca4322bd54351a88692ff74c0603ac20d9cdfc68a191

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 10:11:26 GMT
x-content-type-options: nosniff
age: 13719
status: 200
content-disposition: inline;filename="Screen Shot 2020-04-25 at 5.40.39 AM.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16740
x-xss-protection: 0
server: fife
etag: "v7a7b"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 23 Sep 2020 20:42:41 GMT

GET
H3-Q050 200 Screen%2BShot%2B2020-04-25%2Bat%2B5.57.30%2BAM.png
1.bp.blogspot.com/-_BTtTjFpyo8/XqQJtRbivDI/AAAAAAAAeoA/DSOaPB_JydcF4Cyk3NL56PGvVj7BnrOCACLcBGAsYHQ/s640/ 34 KB
34 KB 31ms
21ms Image
image/png 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1.bp.blogspot.com/-_BTtTjFpyo8/XqQJtRbivDI/AAAAAAAAeoA/DSOaPB_JydcF4Cyk3NL56PGvVj7BnrOCACLcBGAsYHQ/s640/Screen%2BShot%2B2020-04-25%2Bat%2B5.57.30%2BAM.png

Requested by

Host: www.blogblog.com
URL: https://www.blogblog.com/dynamicviews/de918fe7fca9ee54/js/thirdparty/jquery.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

2dde0068aa6abd942461e9f5a2ce63505faa130295454b6b6bbec371de6fe009

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 10:11:26 GMT
x-content-type-options: nosniff
age: 13719
status: 200
content-disposition: inline;filename="Screen Shot 2020-04-25 at 5.57.30 AM.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34395
x-xss-protection: 0
server: fife
etag: "v7a81"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 23 Sep 2020 20:42:41 GMT

GET
H3-Q050 200 cb=gapi.loaded_0 Show response
apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.hc3rLxj9u8o.O/m=plusone/rt=j/sv=1/d=1/ed=1/am=wQE/rs=AGLTcCMtAagp6kGxB19Nep_bTJunj37kww/ 140 KB
49 KB 37ms
15ms Script
text/javascript 2a00:1450:4001:802::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.hc3rLxj9u8o.O/m=plusone/rt=j/sv=1/d=1/ed=1/am=wQE/rs=AGLTcCMtAagp6kGxB19Nep_bTJunj37kww/cb=gapi.loaded_0

Requested by

Host: apis.google.com
URL: https://apis.google.com/js/plusone.js?_=1600956002059

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

46c234230b7e6926223ed04e6112e1fe85ed6fcb6e1e8585d77bef2be1e83167

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 21 Sep 2020 11:10:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Sun, 02 Aug 2020 22:35:54 GMT
server: sffe
age: 269357
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
status: 200
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 50000
x-xss-protection: 0
expires: Tue, 21 Sep 2021 11:10:48 GMT

GET
H2 200 tweet_button.html
platform.twitter.com/widgets/ Frame E71E 0
0 35ms
34ms Document
text/html 151.101.12.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/tweet_button.html?url=https%3A%2F%2Fwww.vkremez.com%2F2020%2F04%2Flets-learn-trickbot-bazarbackdoor.html&count=horizontal&text=Let%27s%20Learn%3A%20TrickBot%20%22BazarBackdoor%22%20Process%20Hollowing%20Injection%20Primer&size=medium
Requested by: Host: www.blogblog.com
URL: https://www.blogblog.com/dynamicviews/de918fe7fca9ee54/js/thirdparty/jquery.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.12.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash

Request headers

:method: GET
:authority: platform.twitter.com
:scheme: https
:path: /widgets/tweet_button.html?url=https%3A%2F%2Fwww.vkremez.com%2F2020%2F04%2Flets-learn-trickbot-bazarbackdoor.html&count=horizontal&text=Let%27s%20Learn%3A%20TrickBot%20%22BazarBackdoor%22%20Process%20Hollowing%20Injection%20Primer&size=medium
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html

Response headers

status: 200
last-modified: Tue, 01 Sep 2020 20:41:41 GMT
cache-control: public, max-age=1800
content-type: text/html; charset=utf-8
etag: "27d090fda6390805d455b8bb53b86907+gzip"
content-encoding: gzip
access-control-allow-methods: GET
access-control-allow-origin: *
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
accept-ranges: bytes
date: Thu, 24 Sep 2020 14:00:05 GMT
x-served-by: cache-bwi5128-BWI, cache-fra19134-FRA
x-cache: HIT, HIT
vary: Accept-Encoding
tw-cdn: FT
content-length: 19285

GET
H2 200 like.php
www.facebook.com/plugins/ Frame 499E 0
0 64ms
64ms Document
text/html 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/plugins/like.php?href=http%3A%2F%2Fwww.vkremez.com%2F2020%2F04%2Flets-learn-trickbot-bazarbackdoor.html&send=false&layout=button_count&action=like&show_faces=false&colorscheme=light

Requested by

Host: www.blogblog.com
URL: https://www.blogblog.com/dynamicviews/de918fe7fca9ee54/js/thirdparty/jquery.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.facebook.com
:scheme: https
:path: /plugins/like.php?href=http%3A%2F%2Fwww.vkremez.com%2F2020%2F04%2Flets-learn-trickbot-bazarbackdoor.html&send=false&layout=button_count&action=like&show_faces=false&colorscheme=light
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html

Response headers

status: 200
vary: Accept-Encoding
pragma: no-cache
expires: Sat, 01 Jan 2000 00:00:00 GMT
content-encoding: br
strict-transport-security: max-age=15552000; preload
x-content-type-options: nosniff
timing-allow-origin: *
x-xss-protection: 0
cache-control: private, no-cache, no-store, must-revalidate
content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
content-type: text/html; charset="utf-8"
x-fb-debug: Tq9Yw8ySJQ04tDjM0RMcjD3zGbiL7otAV+QdDe4GvB/UQssAaCrMfCn4KIJ4faoZJJgDmQTl1itGVWCXGqlfAA==
date: Thu, 24 Sep 2020 14:00:05 GMT
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600

GET
H2 200 widget_iframe.2d7d9a6d04538bf11c7b23641e75738c.html
platform.twitter.com/widgets/ Frame C214 0
0 32ms
31ms Document
text/html 151.101.12.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/widget_iframe.2d7d9a6d04538bf11c7b23641e75738c.html?origin=https%3A%2F%2Fwww.vkremez.com
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.12.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash

Request headers

:method: GET
:authority: platform.twitter.com
:scheme: https
:path: /widgets/widget_iframe.2d7d9a6d04538bf11c7b23641e75738c.html?origin=https%3A%2F%2Fwww.vkremez.com
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html

Response headers

status: 200
last-modified: Tue, 01 Sep 2020 17:58:17 GMT
cache-control: public, max-age=315360000
content-type: text/html; charset=utf-8
etag: "9fa476ae827f556d5b037fe43632370d+gzip"
content-encoding: gzip
access-control-allow-methods: GET
access-control-allow-origin: *
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
accept-ranges: bytes
date: Thu, 24 Sep 2020 14:00:05 GMT
x-served-by: cache-bwi5127-BWI, cache-fra19134-FRA
x-cache: HIT, HIT
vary: Accept-Encoding
tw-cdn: FT
content-length: 5825

GET
H3-Q050 200 default Show response
www.blogger.com/feeds/3986785863650565253/posts/ 2 MB
218 KB 1246ms
1245ms Script
text/javascript 2a00:1450:4001:81f::2009
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.blogger.com/feeds/3986785863650565253/posts/default?alt=json&v=2&dynamicviews=1&orderby=published&max-results=25&published-max=2018-07-29T18%3A00%3A00.002Z&rewriteforssl=true&callback=jQuery112505078703914712992_1600956002057&_=1600956002060

Requested by

Host: www.blogblog.com
URL: https://www.blogblog.com/dynamicviews/de918fe7fca9ee54/js/thirdparty/jquery.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81f::2009 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

663df4beb7c54663a3132a3b302169799914a3e3e8685ae863ed029a1b0330eb

Security Headers

Name	Value
Content-Security-Policy	script-src 'self' .google.com .google-analytics.com 'unsafe-inline' 'unsafe-eval' .gstatic.com .googlesyndication.com .blogger.com .googleapis.com uds.googleusercontent.com https://s.ytimg.com https://i18n-cloud.appspot.com www-onepick-opensocial.googleusercontent.com www-bloggervideo-opensocial.googleusercontent.com www-blogger-opensocial.googleusercontent.com https://www.blogblog.com; report-uri /cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: script-src 'self' *.google.com *.google-analytics.com 'unsafe-inline' 'unsafe-eval' *.gstatic.com *.googlesyndication.com *.blogger.com *.googleapis.com uds.googleusercontent.com https://s.ytimg.com https://i18n-cloud.appspot.com www-onepick-opensocial.googleusercontent.com www-bloggervideo-opensocial.googleusercontent.com www-blogger-opensocial.googleusercontent.com https://www.blogblog.com; report-uri /cspreport
content-encoding: gzip
etag: W/"D0MERH05fyp7ImA9XxZTF0o."
access-control-allow-origin: *
p3p: CP="This is not a P3P policy! See https://www.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info."
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 1; mode=block
last-modified: Tue, 22 Sep 2020 11:50:05 GMT
server: GSE
x-frame-options: SAMEORIGIN
date: Thu, 24 Sep 2020 14:00:07 GMT
vary: Accept, X-GData-Authorization, GData-Version
content-type: text/javascript; charset=UTF-8
gdata-version: 2.0
cache-control: private, max-age=0, must-revalidate, no-transform
x-content-type-options: nosniff
expires: Thu, 24 Sep 2020 14:00:07 GMT

GET
H2 200 horizon_tweet.890a062bcacdb49527deac08bf9879da.js Show response
platform.twitter.com/js/ 6 KB
2 KB 33ms
31ms Script
application/javascript 151.101.12.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/js/horizon_tweet.890a062bcacdb49527deac08bf9879da.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.12.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 23b775e4e3b5b93742dad8a1bbfacb2ffc3271a15dbfc6d3ded21d713f2c3489

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 14:00:06 GMT
content-encoding: gzip
x-cache: HIT, HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200
content-length: 2197
x-served-by: cache-bwi5140-BWI, cache-fra19134-FRA
last-modified: Tue, 01 Sep 2020 17:58:08 GMT
etag: "8069bf9882ddc98f8144708faf345f30+gzip"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=315360000
accept-ranges: bytes
tw-cdn: FT

GET
H2 200 index.html
platform.twitter.com/embed/ Frame BBC0 0
0 34ms
33ms Document
text/html 151.101.12.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/embed/index.html?dnt=false&embedId=twitter-widget-0&frame=false&hideCard=false&hideThread=false&id=1252303608747565057&lang=en&origin=https%3A%2F%2Fwww.vkremez.com%2F2020%2F04%2Flets-learn-trickbot-bazarbackdoor.html&theme=light&widgetsVersion=219d021%3A1598982042171&width=550px
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.12.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash

Request headers

:method: GET
:authority: platform.twitter.com
:scheme: https
:path: /embed/index.html?dnt=false&embedId=twitter-widget-0&frame=false&hideCard=false&hideThread=false&id=1252303608747565057&lang=en&origin=https%3A%2F%2Fwww.vkremez.com%2F2020%2F04%2Flets-learn-trickbot-bazarbackdoor.html&theme=light&widgetsVersion=219d021%3A1598982042171&width=550px
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html

Response headers

status: 200
last-modified: Wed, 09 Sep 2020 20:24:51 GMT
cache-control: public, max-age=1800
content-type: text/html; charset=utf-8
etag: "462a23b15781d788fb9d65f4cb1fe44d+gzip"
content-encoding: gzip
access-control-allow-methods: GET
access-control-allow-origin: *
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
accept-ranges: bytes
date: Thu, 24 Sep 2020 14:00:06 GMT
x-served-by: cache-bwi5145-BWI, cache-fra19134-FRA
x-cache: HIT, HIT
vary: Accept-Encoding
tw-cdn: FT
content-length: 301

GET
H2 200 Screen%2BShot%2B2018-07-16%2Bat%2B03.25.42.png
2.bp.blogspot.com/-f4Sj9uOIEW8/W0xYno2IYqI/AAAAAAAAG8Q/trx0J_kbvmsb7SjLdIpP9Sg-JVWyghuxQCLcBGAs/s30-p/ 2 KB
2 KB 23ms
7ms Image
image/png 2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://2.bp.blogspot.com/-f4Sj9uOIEW8/W0xYno2IYqI/AAAAAAAAG8Q/trx0J_kbvmsb7SjLdIpP9Sg-JVWyghuxQCLcBGAs/s30-p/Screen%2BShot%2B2018-07-16%2Bat%2B03.25.42.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

649900d3905b9f2e7b125937917a96a473c0f3215cb51808d744bca68b081691

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 12:11:09 GMT
x-content-type-options: nosniff
age: 6539
status: 200
content-disposition: inline;filename="Screen Shot 2018-07-16 at 03.25.42.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1639
x-xss-protection: 0
server: fife
etag: "v1bc5"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sat, 12 Sep 2020 11:10:41 GMT

GET
H2 200 Screen%2BShot%2B2018-04-13%2Bat%2B10.33.03.png
2.bp.blogspot.com/-fydaerkDxjQ/WtDLm-RpkOI/AAAAAAAAG28/nTUrc-tHQOMjZOQ0W5JPcpNLQf_15u6QwCLcBGAs/s30-p/ 1 KB
1 KB 25ms
9ms Image
image/png 2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://2.bp.blogspot.com/-fydaerkDxjQ/WtDLm-RpkOI/AAAAAAAAG28/nTUrc-tHQOMjZOQ0W5JPcpNLQf_15u6QwCLcBGAs/s30-p/Screen%2BShot%2B2018-04-13%2Bat%2B10.33.03.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

3c2314a555c78ee37c995eaa1b964e1e889bb23bb32dc86b4d9fa4f0af0a3d0f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 12:11:09 GMT
x-content-type-options: nosniff
age: 6539
status: 200
content-disposition: inline;filename="Screen Shot 2018-04-13 at 10.33.03.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1185
x-xss-protection: 0
server: fife
etag: "v1b70"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sat, 19 Sep 2020 15:02:36 GMT

GET
H2 200 Screen%2BShot%2B2018-04-08%2Bat%2B15.39.55.png
4.bp.blogspot.com/-lfpI23_lx5A/Wsp4iOyl24I/AAAAAAAAG1M/gQPrA4N06YoFjQVitVCosujP5qBs8tulACLcBGAs/s30-p/ 1 KB
1 KB 34ms
19ms Image
image/png 2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://4.bp.blogspot.com/-lfpI23_lx5A/Wsp4iOyl24I/AAAAAAAAG1M/gQPrA4N06YoFjQVitVCosujP5qBs8tulACLcBGAs/s30-p/Screen%2BShot%2B2018-04-08%2Bat%2B15.39.55.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

4aaf228ccea0266ab752855d33240266d89fd483fb62eaf52d5558d417253be3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 13:06:00 GMT
x-content-type-options: nosniff
age: 3248
status: 200
content-disposition: inline;filename="Screen Shot 2018-04-08 at 15.39.55.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1323
x-xss-protection: 0
server: fife
etag: "v1b54"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sat, 19 Sep 2020 14:20:43 GMT

GET
H2 200 Screen%2BShot%2B2018-04-02%2Bat%2B20.12.26.png
1.bp.blogspot.com/-gHyFzq2539g/WsMaurFcTpI/AAAAAAAAGng/qXt_Yx_5nAwgn6P0jlJDg6iqvgKdoYGEACLcBGAs/s30-p/ 1 KB
1 KB 33ms
18ms Image
image/png 2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1.bp.blogspot.com/-gHyFzq2539g/WsMaurFcTpI/AAAAAAAAGng/qXt_Yx_5nAwgn6P0jlJDg6iqvgKdoYGEACLcBGAs/s30-p/Screen%2BShot%2B2018-04-02%2Bat%2B20.12.26.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

6f8f758d328fe50ec2ccd54786226624818171dff319ddecfd14a429d1d806a4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 12:11:09 GMT
x-content-type-options: nosniff
age: 6539
status: 200
content-disposition: inline;filename="Screen Shot 2018-04-02 at 20.12.26.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1402
x-xss-protection: 0
server: fife
etag: "v1a79"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Thu, 24 Sep 2020 06:15:31 GMT

GET
H2 200 Screen%2BShot%2B2018-04-02%2Bat%2B00.36.11.png
2.bp.blogspot.com/-1wrjX5wm6T0/WsG8GhGrlyI/AAAAAAAAGlQ/kJd1N5o4R1oQSI9RJu54MyyD25GzaIwNQCLcBGAs/s30-p/ 2 KB
2 KB 23ms
8ms Image
image/png 2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://2.bp.blogspot.com/-1wrjX5wm6T0/WsG8GhGrlyI/AAAAAAAAGlQ/kJd1N5o4R1oQSI9RJu54MyyD25GzaIwNQCLcBGAs/s30-p/Screen%2BShot%2B2018-04-02%2Bat%2B00.36.11.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

de4774067968f00ffcf4b72574b39f54cd766f1f956d7c21f0d815931f78fc5d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 12:11:09 GMT
x-content-type-options: nosniff
age: 6539
status: 200
content-disposition: inline;filename="Screen Shot 2018-04-02 at 00.36.11.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1770
x-xss-protection: 0
server: fife
etag: "v1a55"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sat, 19 Sep 2020 15:02:36 GMT

GET
H2 200 Screen%2BShot%2B2018-03-30%2Bat%2B00.28.41.png
3.bp.blogspot.com/-TEP_sQqpw_c/Wr3Oh1lfdqI/AAAAAAAAGks/LZ4S28w59akkRVZb9G7BUnaGwxSTCoqPACLcBGAs/s30-p/ 1 KB
1 KB 25ms
10ms Image
image/png 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://3.bp.blogspot.com/-TEP_sQqpw_c/Wr3Oh1lfdqI/AAAAAAAAGks/LZ4S28w59akkRVZb9G7BUnaGwxSTCoqPACLcBGAs/s30-p/Screen%2BShot%2B2018-03-30%2Bat%2B00.28.41.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

c425fc1d4bf6757927986974d71a777e077a47537471db8c29e52e469f71e876

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 10:11:33 GMT
x-content-type-options: nosniff
age: 13715
status: 200
content-disposition: inline;filename="Screen Shot 2018-03-30 at 00.28.41.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1205
x-xss-protection: 0
server: fife
etag: "v1a4c"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Thu, 24 Sep 2020 08:41:56 GMT

GET
H2 200 Screen%2BShot%2B2018-03-29%2Bat%2B19.12.08.png
1.bp.blogspot.com/-sx8TAnhDE3A/Wr2zhYAE3JI/AAAAAAAAGkc/wdI-Dd6QiksPWOfk_7CvHNPkWth-ZPh_gCLcBGAs/s30-p/ 1 KB
2 KB 30ms
16ms Image
image/png 2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1.bp.blogspot.com/-sx8TAnhDE3A/Wr2zhYAE3JI/AAAAAAAAGkc/wdI-Dd6QiksPWOfk_7CvHNPkWth-ZPh_gCLcBGAs/s30-p/Screen%2BShot%2B2018-03-29%2Bat%2B19.12.08.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

800cdca40b909aa85f1e0b5202e6c36a6317b4e43ef14dbce97f8b1174f95549

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 12:11:09 GMT
x-content-type-options: nosniff
age: 6539
status: 200
content-disposition: inline;filename="Screen Shot 2018-03-29 at 19.12.08.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1483
x-xss-protection: 0
server: fife
etag: "v1a48"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Thu, 24 Sep 2020 06:15:31 GMT

GET
H2 200 pic1.PNG
1.bp.blogspot.com/-ZuYVjcQj1qI/Wo4ddDb8JwI/AAAAAAAAGg4/Nsow2nw76r0L_y6egj4R4phoNTJh0FuggCLcBGAs/s30-p/ 907 B
1 KB 36ms
22ms Image
image/png 2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1.bp.blogspot.com/-ZuYVjcQj1qI/Wo4ddDb8JwI/AAAAAAAAGg4/Nsow2nw76r0L_y6egj4R4phoNTJh0FuggCLcBGAs/s30-p/pic1.PNG

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

b5a2ce54ddde57451e063e3db3e24ced1f67992231a23397f7b194a2fdaeb613

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 12:11:09 GMT
x-content-type-options: nosniff
age: 6539
status: 200
content-disposition: inline;filename="pic1.PNG"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 907
x-xss-protection: 0
server: fife
etag: "v1a0f"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sat, 19 Sep 2020 21:08:49 GMT

GET
H2 200 Screen%2BShot%2B2018-01-28%2Bat%2B18.15.49.png
1.bp.blogspot.com/-D6_8GKtyhm4/Wm5xyELI-rI/AAAAAAAAGfY/j9buNZNKAtg89fGmZapkiNm192jlojVQwCLcBGAs/s30-p/ 873 B
1019 B 34ms
20ms Image
image/png 2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1.bp.blogspot.com/-D6_8GKtyhm4/Wm5xyELI-rI/AAAAAAAAGfY/j9buNZNKAtg89fGmZapkiNm192jlojVQwCLcBGAs/s30-p/Screen%2BShot%2B2018-01-28%2Bat%2B18.15.49.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

e1d46ef344e5d9a593b69978ada52e7ffb85d3154389a532daae5036373d55a6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 12:11:09 GMT
x-content-type-options: nosniff
age: 6539
status: 200
content-disposition: inline;filename="Screen Shot 2018-01-28 at 18.15.49.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 873
x-xss-protection: 0
server: fife
etag: "v19f8"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sat, 19 Sep 2020 21:08:48 GMT

GET
H2 200 Screen%2BShot%2B2018-01-17%2Bat%2B03.11.05.png
3.bp.blogspot.com/-Vm8ikdvuRTw/Wl8Qh1y_jKI/AAAAAAAAGdc/gHOSm6p-RNQjKk-T1u8e5ysEkO8dpQuKQCLcBGAs/s30-p/ 1 KB
1 KB 28ms
14ms Image
image/png 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://3.bp.blogspot.com/-Vm8ikdvuRTw/Wl8Qh1y_jKI/AAAAAAAAGdc/gHOSm6p-RNQjKk-T1u8e5ysEkO8dpQuKQCLcBGAs/s30-p/Screen%2BShot%2B2018-01-17%2Bat%2B03.11.05.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

6466c0e7a97bb5944c95e0b50c4a78b729a002ebe349cc4c9496079adbafb30c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 10:11:33 GMT
x-content-type-options: nosniff
age: 13715
status: 200
content-disposition: inline;filename="Screen Shot 2018-01-17 at 03.11.05.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1312
x-xss-protection: 0
server: fife
etag: "v19d8"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Thu, 24 Sep 2020 08:41:56 GMT

GET
H3-Q050 200 Screen%2BShot%2B2018-01-12%2Bat%2B19.48.29.png
4.bp.blogspot.com/-kAj6qRS1lLE/WllXco3uCZI/AAAAAAAAGcw/NSnuJn7_R7cTpqazXeB7UE4AJSc-QYKWQCLcBGAs/s30-p/ 1 KB
1 KB 57ms
31ms Image
image/png 2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://4.bp.blogspot.com/-kAj6qRS1lLE/WllXco3uCZI/AAAAAAAAGcw/NSnuJn7_R7cTpqazXeB7UE4AJSc-QYKWQCLcBGAs/s30-p/Screen%2BShot%2B2018-01-12%2Bat%2B19.48.29.png

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

ae56a08ad120fa9cbaad5e2d0f29d15ab5995ec798b7fb646926e2b2f1432b88

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 13:06:00 GMT
x-content-type-options: nosniff
age: 3248
status: 200
content-disposition: inline;filename="Screen Shot 2018-01-12 at 19.48.29.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1118
x-xss-protection: 0
server: fife
etag: "v19cd"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sat, 19 Sep 2020 14:20:43 GMT

GET
H3-Q050 200 Screen%2BShot%2B2017-12-27%2Bat%2B05.04.04.png
1.bp.blogspot.com/-GWhFEQzGKcM/WkNxNvb8OwI/AAAAAAAAGbI/_Fa6ks1fqDU4StZhkB2KDIMWVf28EeH0wCLcBGAs/s30-p/ 2 KB
2 KB 20ms
10ms Image
image/png 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1.bp.blogspot.com/-GWhFEQzGKcM/WkNxNvb8OwI/AAAAAAAAGbI/_Fa6ks1fqDU4StZhkB2KDIMWVf28EeH0wCLcBGAs/s30-p/Screen%2BShot%2B2017-12-27%2Bat%2B05.04.04.png

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

5d08e3977ac882cac0b3ba2ca6bc235de70d4fd53b35479b36ec62d2b7962a93

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 10:11:33 GMT
x-content-type-options: nosniff
age: 13715
status: 200
content-disposition: inline;filename="Screen Shot 2017-12-27 at 05.04.04.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1835
x-xss-protection: 0
server: fife
etag: "v19b3"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Thu, 24 Sep 2020 05:21:16 GMT

GET
H3-Q050 200 Screen%2BShot%2B2017-12-21%2Bat%2B02.46.03.png
3.bp.blogspot.com/-L01qZql0nDQ/WjtoH0mnN0I/AAAAAAAAGZ8/VSZsd6aaZII3e5_GvzqDMwymidDPuqyEwCLcBGAs/s30-p/ 786 B
866 B 55ms
27ms Image
image/png 2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://3.bp.blogspot.com/-L01qZql0nDQ/WjtoH0mnN0I/AAAAAAAAGZ8/VSZsd6aaZII3e5_GvzqDMwymidDPuqyEwCLcBGAs/s30-p/Screen%2BShot%2B2017-12-21%2Bat%2B02.46.03.png

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

7e04d6abaf6bb7889fe5fcb79c3a1cc97c067bc798d6ac2dfc2c3852df9e3f37

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 12:11:09 GMT
x-content-type-options: nosniff
age: 6539
status: 200
content-disposition: inline;filename="Screen Shot 2017-12-21 at 02.46.03.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 786
x-xss-protection: 0
server: fife
etag: "v19a3"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sat, 19 Sep 2020 15:02:36 GMT

GET
H3-Q050 200 magniber2.png
1.bp.blogspot.com/-dafMS1R8uHo/WjeFIbPGEGI/AAAAAAAAGYo/pDfMVwtjPesGEjWZcjPO4g8v78cEzetQACLcBGAs/s30-p/ 2 KB
2 KB 20ms
10ms Image
image/png 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1.bp.blogspot.com/-dafMS1R8uHo/WjeFIbPGEGI/AAAAAAAAGYo/pDfMVwtjPesGEjWZcjPO4g8v78cEzetQACLcBGAs/s30-p/magniber2.png

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

d1252f3f1584dd033509867c51515623b05894f4b82a9e3c3da822326eaafc69

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 10:11:33 GMT
x-content-type-options: nosniff
age: 13715
status: 200
content-disposition: inline;filename="magniber2.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1659
x-xss-protection: 0
server: fife
etag: "v198c"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Thu, 24 Sep 2020 05:21:16 GMT

GET
H3-Q050 200 image1.png
4.bp.blogspot.com/-ghOLe4cowlc/WjDvM4V59EI/AAAAAAAAGXk/Kqb-bxKddYcab8UK8q0GMxi1yljr7NxnwCLcBGAs/s30-p/ 2 KB
2 KB 56ms
32ms Image
image/png 2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://4.bp.blogspot.com/-ghOLe4cowlc/WjDvM4V59EI/AAAAAAAAGXk/Kqb-bxKddYcab8UK8q0GMxi1yljr7NxnwCLcBGAs/s30-p/image1.png

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

0e7b4d1180187373e1e81dc52672389f9c4dfb477586cee1caea057fc042ad81

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 13:06:00 GMT
x-content-type-options: nosniff
age: 3248
status: 200
content-disposition: inline;filename="image1.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1543
x-xss-protection: 0
server: fife
etag: "v197a"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sat, 19 Sep 2020 14:20:43 GMT

GET
H3-Q050 200 trick1.png
2.bp.blogspot.com/-srnRcj3vjuI/WhPRX6-2LBI/AAAAAAAAGUU/WB6tRdBK1HA_pM8zY9KCHymaD4-uMEk8ACLcBGAs/s30-p/ 2 KB
2 KB 54ms
26ms Image
image/png 2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://2.bp.blogspot.com/-srnRcj3vjuI/WhPRX6-2LBI/AAAAAAAAGUU/WB6tRdBK1HA_pM8zY9KCHymaD4-uMEk8ACLcBGAs/s30-p/trick1.png

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

987d4cab1c85d764068420e5b35cb34e9d675e26042ba9a6b04f99327f4d3cca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 12:11:09 GMT
x-content-type-options: nosniff
age: 6539
status: 200
content-disposition: inline;filename="trick1.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1647
x-xss-protection: 0
server: fife
etag: "v1949"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sat, 19 Sep 2020 15:02:36 GMT

GET
H3-Q050 200 golroted1.png
3.bp.blogspot.com/-FdgC9OaYvNk/WggMA_2tBII/AAAAAAAAGKU/G9-uFOob2n4fR7wtkpJgXcv0UkfQ8N3PACLcBGAs/s30-p/ 1 KB
1 KB 55ms
28ms Image
image/png 2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://3.bp.blogspot.com/-FdgC9OaYvNk/WggMA_2tBII/AAAAAAAAGKU/G9-uFOob2n4fR7wtkpJgXcv0UkfQ8N3PACLcBGAs/s30-p/golroted1.png

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

a35d7973868226e4830f8b4c535aa94ba6a58bf46ae575d4ccf9931ab4b05af6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 12:11:09 GMT
x-content-type-options: nosniff
age: 6539
status: 200
content-disposition: inline;filename="golroted1.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1271
x-xss-protection: 0
server: fife
etag: "v18a9"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sat, 19 Sep 2020 15:02:36 GMT

GET
H3-Q050 200 Picture1.png
1.bp.blogspot.com/-T8yA4Tz4fnM/Wf7Xebk4RFI/AAAAAAAAGIQ/jICMx8fkjV8pMg6FMoKaOUIcmpLqSLtUgCLcBGAs/s30-p/ 1 KB
1 KB 20ms
10ms Image
image/png 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1.bp.blogspot.com/-T8yA4Tz4fnM/Wf7Xebk4RFI/AAAAAAAAGIQ/jICMx8fkjV8pMg6FMoKaOUIcmpLqSLtUgCLcBGAs/s30-p/Picture1.png

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

e1c8c674a5de7e5de010a6212157bdf0d1973fae8863fc34b883f344098bf04d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 10:11:33 GMT
x-content-type-options: nosniff
age: 13715
status: 200
content-disposition: inline;filename="Picture1.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1437
x-xss-protection: 0
server: fife
etag: "v1885"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Thu, 24 Sep 2020 05:21:16 GMT

GET
H3-Q050 200 Screen%2BShot%2B2017-09-15%2Bat%2B03.50.08.png
3.bp.blogspot.com/-xNKCCshBU6s/WbuH3EWeG9I/AAAAAAAAGDg/M2Ee_WQZBPsLTnSG4mdX9dxKHou_HE9vQCLcBGAs/s30-p/ 2 KB
2 KB 54ms
28ms Image
image/png 2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://3.bp.blogspot.com/-xNKCCshBU6s/WbuH3EWeG9I/AAAAAAAAGDg/M2Ee_WQZBPsLTnSG4mdX9dxKHou_HE9vQCLcBGAs/s30-p/Screen%2BShot%2B2017-09-15%2Bat%2B03.50.08.png

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

651fd27be7dfbf9449b590a95a02c96fe3a8a14b6fb1631db88e1a3f4c7ecd96

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 12:11:09 GMT
x-content-type-options: nosniff
age: 6539
status: 200
content-disposition: inline;filename="Screen Shot 2017-09-15 at 03.50.08.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1717
x-xss-protection: 0
server: fife
etag: "v1839"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sat, 19 Sep 2020 15:02:37 GMT

GET
H3-Q050 200 tricky1.png
2.bp.blogspot.com/-ibtoIfLasAU/WbZOulPWyqI/AAAAAAAAGCM/ZJ0NR26MtCsj_gRsCYUBoMr68AqbLe5RACLcBGAs/s30-p/ 2 KB
2 KB 57ms
30ms Image
image/png 2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://2.bp.blogspot.com/-ibtoIfLasAU/WbZOulPWyqI/AAAAAAAAGCM/ZJ0NR26MtCsj_gRsCYUBoMr68AqbLe5RACLcBGAs/s30-p/tricky1.png

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

b079f588738a4e47b7451f7f332b16fbbe60aa435499419a71df278688ad51a2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 12:11:09 GMT
x-content-type-options: nosniff
age: 6539
status: 200
content-disposition: inline;filename="tricky1.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1928
x-xss-protection: 0
server: fife
etag: "v1824"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sat, 19 Sep 2020 15:02:37 GMT

GET
H3-Q050 200 Screen%2BShot%2B2017-08-22%2Bat%2B00.37.01.png
4.bp.blogspot.com/-7uLTgL1bgkU/WZu1E4ZsfEI/AAAAAAAAF_0/3gSMtW08vrMfRNepJJaIGQbg4SRJxKNHACLcBGAs/s30-p/ 1 KB
1 KB 56ms
32ms Image
image/png 2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://4.bp.blogspot.com/-7uLTgL1bgkU/WZu1E4ZsfEI/AAAAAAAAF_0/3gSMtW08vrMfRNepJJaIGQbg4SRJxKNHACLcBGAs/s30-p/Screen%2BShot%2B2017-08-22%2Bat%2B00.37.01.png

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

14a06236a680dc1ea147e0fa0a105cead0d770e6287072da1720dccc19aa40bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 13:06:00 GMT
x-content-type-options: nosniff
age: 3248
status: 200
content-disposition: inline;filename="Screen Shot 2017-08-22 at 00.37.01.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1081
x-xss-protection: 0
server: fife
etag: "v17fe"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sat, 19 Sep 2020 14:20:44 GMT

GET
H3-Q050 200 Screen%2BShot%2B2017-08-15%2Bat%2B01.05.51.png
2.bp.blogspot.com/-wv7Sly9SVRA/WZKk_awIRfI/AAAAAAAAF-M/S5Xnp25K2eYic5AbrsFjiwdubieCiYQuACEwYBhgL/s30-p/ 1 KB
1 KB 56ms
29ms Image
image/png 2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://2.bp.blogspot.com/-wv7Sly9SVRA/WZKk_awIRfI/AAAAAAAAF-M/S5Xnp25K2eYic5AbrsFjiwdubieCiYQuACEwYBhgL/s30-p/Screen%2BShot%2B2017-08-15%2Bat%2B01.05.51.png

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

9c3db9fa3975bf7489a64f3fb8c606119ed03705fc15471b073d54e29df82629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 12:11:09 GMT
x-content-type-options: nosniff
age: 6539
status: 200
content-disposition: inline;filename="Screen Shot 2017-08-15 at 01.05.51.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1429
x-xss-protection: 0
server: fife
etag: "v17e3"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sat, 19 Sep 2020 15:02:37 GMT

GET
H3-Q050 200 Screen%2BShot%2B2017-08-13%2Bat%2B14.48.34.png
1.bp.blogspot.com/--vAXVDNhnn4/WZE2kQY0hJI/AAAAAAAAF8U/fksAHvqVJJskec1GoHQFYCE3TfEqCpALACLcBGAs/s30-p/ 2 KB
2 KB 20ms
11ms Image
image/png 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1.bp.blogspot.com/--vAXVDNhnn4/WZE2kQY0hJI/AAAAAAAAF8U/fksAHvqVJJskec1GoHQFYCE3TfEqCpALACLcBGAs/s30-p/Screen%2BShot%2B2017-08-13%2Bat%2B14.48.34.png

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

a59b19076bba9a965b8023f1983c71c9eabd80a1dee90a5515f59297aed977f9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 10:11:33 GMT
x-content-type-options: nosniff
age: 13715
status: 200
content-disposition: inline;filename="Screen Shot 2017-08-13 at 14.48.34.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1542
x-xss-protection: 0
server: fife
etag: "v17c8"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Thu, 24 Sep 2020 05:21:17 GMT

GET
H2 200 default Show response
www.blogger.com/feeds/3986785863650565253/6114194039930120721/comments/ 2 KB
2 KB 303ms
294ms Script
text/javascript 2a00:1450:4001:81f::2009
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.blogger.com/feeds/3986785863650565253/6114194039930120721/comments/default?alt=json&v=2&dynamicviews=1&orderby=published&reverse=false&max-results=50&rewriteforssl=true&callback=jQuery112505078703914712992_1600956002057&_=1600956002061

Requested by

Host: www.blogblog.com
URL: https://www.blogblog.com/dynamicviews/de918fe7fca9ee54/js/thirdparty/jquery.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::2009 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

2d235f2feb0ac49c2119c34273ad40a8467178d3fce07ab811ff3bbda84a0bf9

Security Headers

Name	Value
Content-Security-Policy	script-src 'self' .google.com .google-analytics.com 'unsafe-inline' 'unsafe-eval' .gstatic.com .googlesyndication.com .blogger.com .googleapis.com uds.googleusercontent.com https://s.ytimg.com https://i18n-cloud.appspot.com www-onepick-opensocial.googleusercontent.com www-bloggervideo-opensocial.googleusercontent.com www-blogger-opensocial.googleusercontent.com https://www.blogblog.com; report-uri /cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: script-src 'self' *.google.com *.google-analytics.com 'unsafe-inline' 'unsafe-eval' *.gstatic.com *.googlesyndication.com *.blogger.com *.googleapis.com uds.googleusercontent.com https://s.ytimg.com https://i18n-cloud.appspot.com www-onepick-opensocial.googleusercontent.com www-bloggervideo-opensocial.googleusercontent.com www-blogger-opensocial.googleusercontent.com https://www.blogblog.com; report-uri /cspreport
content-encoding: gzip
etag: W/"CU8BRnY4cSp7ImA9XB5UF08."
access-control-allow-origin: *
p3p: CP="This is not a P3P policy! See https://www.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info."
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 879
x-xss-protection: 1; mode=block
last-modified: Fri, 24 Apr 2020 10:24:17 GMT
server: GSE
x-frame-options: SAMEORIGIN
date: Thu, 24 Sep 2020 14:00:08 GMT
vary: Accept, X-GData-Authorization, GData-Version
content-type: text/javascript; charset=UTF-8
gdata-version: 2.0
cache-control: private, max-age=0, must-revalidate, no-transform
x-content-type-options: nosniff
expires: Thu, 24 Sep 2020 14:00:08 GMT

GET
H2 200 default Show response
www.blogger.com/feeds/3986785863650565253/6114194039930120721/comments/ 2 KB
949 B 518ms
517ms Script
text/javascript 2a00:1450:4001:81f::2009
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: www.blogblog.com
URL: https://www.blogblog.com/dynamicviews/de918fe7fca9ee54/js/thirdparty/jquery.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::2009 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

af19f0d3b5116541a41c8fb04efe90be3d7c45000450ce013f39dd8ab82d8abf

Security Headers

Name	Value
Content-Security-Policy	script-src 'self' .google.com .google-analytics.com 'unsafe-inline' 'unsafe-eval' .gstatic.com .googlesyndication.com .blogger.com .googleapis.com uds.googleusercontent.com https://s.ytimg.com https://i18n-cloud.appspot.com www-onepick-opensocial.googleusercontent.com www-bloggervideo-opensocial.googleusercontent.com www-blogger-opensocial.googleusercontent.com https://www.blogblog.com; report-uri /cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: script-src 'self' *.google.com *.google-analytics.com 'unsafe-inline' 'unsafe-eval' *.gstatic.com *.googlesyndication.com *.blogger.com *.googleapis.com uds.googleusercontent.com https://s.ytimg.com https://i18n-cloud.appspot.com www-onepick-opensocial.googleusercontent.com www-bloggervideo-opensocial.googleusercontent.com www-blogger-opensocial.googleusercontent.com https://www.blogblog.com; report-uri /cspreport
content-encoding: gzip
etag: W/"CU8BRnY4cSp7ImA9XB5UF08."
access-control-allow-origin: *
p3p: CP="This is not a P3P policy! See https://www.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info."
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 879
x-xss-protection: 1; mode=block
last-modified: Fri, 24 Apr 2020 10:24:17 GMT
server: GSE
x-frame-options: SAMEORIGIN
date: Thu, 24 Sep 2020 14:00:08 GMT
vary: Accept, X-GData-Authorization, GData-Version
content-type: text/javascript; charset=UTF-8
gdata-version: 2.0
cache-control: private, max-age=0, must-revalidate, no-transform
x-content-type-options: nosniff
expires: Thu, 24 Sep 2020 14:00:08 GMT

GET
DATA 200
OK truncated
/ 847 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1c5c2bf1131bd8f1578c106a85ef6394aae3192314ed6bab5f8fabc2b0be3495

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/gif

GET comment-iframe.g
www.blogger.com/ Frame 014C 0
0

GET comment-iframe.g
www.blogger.com/ Frame 1EFD 0
0

GET
H3-Q050

200

comment-iframe.g
www.blogger.com/ Frame 1EFD
Redirect Chain

https://www.blogger.com/comment-iframe.g?blogID=3986785863650565253&postID=6114194039930120721
https://accounts.google.com/ServiceLogin?continue=https://www.blogger.com/comment-iframe.g?blogID%3D3986785863650565253%26postID%3D6114194039930120721%26bpli%3D1&followup=https://www.blogger.com/co...
https://www.blogger.com/comment-iframe.g?blogID=3986785863650565253&postID=6114194039930120721&bpli=1

0
0

164ms
164ms

Document
text/html

2a00:1450:4001:81f::2009
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.blogger.com/comment-iframe.g?blogID=3986785863650565253&postID=6114194039930120721&bpli=1

Requested by

Host: www.blogblog.com
URL: https://www.blogblog.com/dynamicviews/de918fe7fca9ee54/js/common.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81f::2009 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'self' .google.com .google-analytics.com 'unsafe-inline' 'unsafe-eval' .gstatic.com .googlesyndication.com .blogger.com .googleapis.com uds.googleusercontent.com https://s.ytimg.com https://i18n-cloud.appspot.com www-onepick-opensocial.googleusercontent.com www-bloggervideo-opensocial.googleusercontent.com www-blogger-opensocial.googleusercontent.com https://www.blogblog.com; report-uri /cspreport
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.blogger.com
:scheme: https
:path: /comment-iframe.g?blogID=3986785863650565253&postID=6114194039930120721&bpli=1
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: about:blank

Response headers

status: 200
p3p: CP="This is not a P3P policy! See https://www.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info."
content-security-policy: script-src 'self' *.google.com *.google-analytics.com 'unsafe-inline' 'unsafe-eval' *.gstatic.com *.googlesyndication.com *.blogger.com *.googleapis.com uds.googleusercontent.com https://s.ytimg.com https://i18n-cloud.appspot.com www-onepick-opensocial.googleusercontent.com www-bloggervideo-opensocial.googleusercontent.com www-blogger-opensocial.googleusercontent.com https://www.blogblog.com; report-uri /cspreport
content-type: text/html; charset=UTF-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Thu, 24 Sep 2020 14:00:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 1740
server: GSE
set-cookie: S=blogger=FY5eGRRTiRdrr7Px0_Z7UPO5FyT1r8my0QtXdRcA7-Y; Domain=.blogger.com; Path=/; Secure; HttpOnly; Priority=LOW; SameSite=none
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

status: 302
content-type: text/html; charset=UTF-8
x-frame-options: DENY
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Thu, 24 Sep 2020 14:00:09 GMT
location: https://www.blogger.com/comment-iframe.g?blogID=3986785863650565253&postID=6114194039930120721&bpli=1
strict-transport-security: max-age=31536000; includeSubDomains
content-security-policy: script-src 'report-sample' 'nonce-MKchIqBRiMf1Ea3tsfIBYg' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreport
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 241
server: GSE
set-cookie: __Host-GAPS=1:hg_AVrA8pjZASlmV4J-RdDqQbJewGA:HKyYj02_TfDLjrYQ;Path=/;Expires=Sat, 24-Sep-2022 14:00:09 GMT;Secure;HttpOnly;Priority=HIGH
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.blogger.com
URL: https://www.blogger.com/comment-iframe.g?blogID=3986785863650565253&postID=6114194039930120721

Domain: www.blogger.com
URL: https://www.blogger.com/comment-iframe.g?blogID=3986785863650565253&postID=6114194039930120721

Verdicts & Comments Add Verdict or Comment

82 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.vkremez.com/	1970-01-19 12:42:36	Name: _gat Value: 1
.vkremez.com/	1970-01-19 12:44:02	Name: _gid Value: GA1.2.425208281.1600956002
.vkremez.com/	1970-01-20 06:13:48	Name: _ga Value: GA1.2.127819044.1600956002
.vkremez.com/	1970-01-19 13:25:48	Name: __cfduid Value: d6a2e7d776b39f8ba100683c0e511c75e1600956001

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

1.bp.blogspot.com
2.bp.blogspot.com
3.bp.blogspot.com
4.bp.blogspot.com
accounts.google.com
ajax.cloudflare.com
apis.google.com
platform.twitter.com
stats.g.doubleclick.net
www.blogblog.com
www.blogger.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.vkremez.com
www.blogger.com
151.101.12.157
2606:4700:3030::681c:143e
2606:4700::6810:a723
2a00:1450:4001:800::200d
2a00:1450:4001:802::200e
2a00:1450:4001:806::2001
2a00:1450:4001:818::2003
2a00:1450:4001:819::2001
2a00:1450:4001:819::2004
2a00:1450:4001:819::200e
2a00:1450:4001:81f::2009
2a00:1450:4001:820::200e
2a00:1450:4001:821::200e
2a00:1450:400c:c0c::9b
2a03:2880:f11c:8183:face:b00c:0:25de
01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
088734158a6c69e32f928ffa72f2e6505312e5a76bca31ff34bbe85ce100e992
0c239d58c774a19f664eb6ab5004a6ae3c449325ee5998ba65f892df4d6a5971
0e7b4d1180187373e1e81dc52672389f9c4dfb477586cee1caea057fc042ad81
10e1b9c2de3504f2345907eef55f57ab8db35cafc72afdec0ac986f45291a8e8
12956acbc65984f465f513dadb036a69899a5320d464ecc44fbdff33d47d402c
1385fe6c7366b4ab71c2806b9d327c837c8b5d74e35aa762200da83feb6113a8
146cf03f372f999168d4ec2a94380976f15f17fbfb08fbffde1c1a5f67438fee
14a06236a680dc1ea147e0fa0a105cead0d770e6287072da1720dccc19aa40bc
1856965de5b049979677f4eb5e149f93464e76d8b4beccc66d1befbcd1c6ff56
1ad705e628a38ac534ff5357e88b0ebe199385bd3afbc6a8a75eeadd9885fd24
1c5c2bf1131bd8f1578c106a85ef6394aae3192314ed6bab5f8fabc2b0be3495
23b775e4e3b5b93742dad8a1bbfacb2ffc3271a15dbfc6d3ded21d713f2c3489
266c8725e6911ff0e2f23572d0ebf1e30c7594e49ea8bed00af914c924fc086a
2d235f2feb0ac49c2119c34273ad40a8467178d3fce07ab811ff3bbda84a0bf9
2dde0068aa6abd942461e9f5a2ce63505faa130295454b6b6bbec371de6fe009
34c6eb5fe76799775f269cf110d2b953f50c439b693e6ef0c9ce52426bb5c2fb
352c0ffe232c95e651a332fc322419fc55330d3c91f7fbf51ff430847ee1623f
38c7b9dfaa94c5bb687b94856b3f667b3fc32558cefc8db2462e428b22f3f272
39e1d583fa516a045854dd31d01795224685f184c7309e649805f961db4c0d4b
3c2314a555c78ee37c995eaa1b964e1e889bb23bb32dc86b4d9fa4f0af0a3d0f
4286fd6f7ca4c6d12f1573d042d24982f0564a0dc35080bf44a560b0845bf4e7
439476ca5fd109c0aeb8e6c55d4cc4e2e772a27a582c49109494f06f40c95cbc
46c234230b7e6926223ed04e6112e1fe85ed6fcb6e1e8585d77bef2be1e83167
4aaf228ccea0266ab752855d33240266d89fd483fb62eaf52d5558d417253be3
4f37cc26aefc6f7ac0b0104cd3ab477f9f88d06ce2a05640f78565002fa6902f
5114816a47dc958d23af84763e576b236d08aa1366f10b5ec37d2ba5052b74c0
5bad31055fddde526b7b4e43621f46ff190776a7ee57243072f1d7dd1fa702e7
5d08e3977ac882cac0b3ba2ca6bc235de70d4fd53b35479b36ec62d2b7962a93
5d4f00b740c987fdd882682830c76c2ff10b2b8982ae7ac58086758c274fc935
60863e86aa7743d1ac841da7f473a05cd57fba81d661cef658e385437f80d5ef
60f2ee8979a830df28592bdc641f0ec2772430031e7a50b4c7d9592c8a7733ef
6466c0e7a97bb5944c95e0b50c4a78b729a002ebe349cc4c9496079adbafb30c
649900d3905b9f2e7b125937917a96a473c0f3215cb51808d744bca68b081691
651fd27be7dfbf9449b590a95a02c96fe3a8a14b6fb1631db88e1a3f4c7ecd96
663df4beb7c54663a3132a3b302169799914a3e3e8685ae863ed029a1b0330eb
672d64bef3ef92e42a5550c13238cc329787222e2874cbabbe4861a136d29dc2
68cc61d3b31fe39f3f1115803f0c63c6635131a8d3f242bde12cc0e820055257
6d6b2397c0429050dd22ca4322bd54351a88692ff74c0603ac20d9cdfc68a191
6f8f758d328fe50ec2ccd54786226624818171dff319ddecfd14a429d1d806a4
7e04d6abaf6bb7889fe5fcb79c3a1cc97c067bc798d6ac2dfc2c3852df9e3f37
7e41f7333fa9b59a516a5a4f3af346bb24a4c3c8a7bc26551b6fec8d0f6b8555
800cdca40b909aa85f1e0b5202e6c36a6317b4e43ef14dbce97f8b1174f95549
82def3e3ea5794d68c07253d6d5b547985b3bea4227b6942a29fba62fde49a63
83a2e9e77e37f8142be840b51bfe16f27c7d857ca614550e93aa860eb29391a9
83adc88a1264b185cff852951ffdd42d68761f692b9e28951d26fa20eaccf2be
84d8ff0b83ae2d4534af3e612a96a91a1ff9b6281e24e9566b9916417ceb63b9
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
870c88fd51fa56c52989ef0e94f106c46aef8e2036ad694d72cb02a8e307785f
882b7316b4f9053b6debabf8bf1d257950264d501cd30cd2c48972c59a164a8c
987d4cab1c85d764068420e5b35cb34e9d675e26042ba9a6b04f99327f4d3cca
995d27f93763429f51cb7f2056a378dfcf77bfe016742b18fa8833bd37e686bb
9c3db9fa3975bf7489a64f3fb8c606119ed03705fc15471b073d54e29df82629
a3526975153401491b2ebe96da9193881276911067fea1859d559fa0af980e0f
a35d7973868226e4830f8b4c535aa94ba6a58bf46ae575d4ccf9931ab4b05af6
a400d73caf87f08fa624b8ac9100a38d076f736bd718cc7131331b35c5e885c2
a59b19076bba9a965b8023f1983c71c9eabd80a1dee90a5515f59297aed977f9
a761b426004caba495cdac2c93ce7dd306c47bc4d7bdc63c4840c3d8182396a9
a97f410f65e2faae69fac5ef8c34a937808d1094960062ded1682d5af3d669ac
ada150b19834590e9b541a6de7bc403dea550444de15d4841fe5ac5afc8281e0
ae56a08ad120fa9cbaad5e2d0f29d15ab5995ec798b7fb646926e2b2f1432b88
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
af19f0d3b5116541a41c8fb04efe90be3d7c45000450ce013f39dd8ab82d8abf
b079f588738a4e47b7451f7f332b16fbbe60aa435499419a71df278688ad51a2
b08cdbc2d30e656a86b20f8342428d5863f70f4b30135b4f4061f754ce932f5e
b5a2ce54ddde57451e063e3db3e24ced1f67992231a23397f7b194a2fdaeb613
c0d078d779c6d50be940b91eafdc1e0091ee1aef73087fdcddfb7771470b3c59
c425fc1d4bf6757927986974d71a777e077a47537471db8c29e52e469f71e876
c678636b42cce155be48ee783b75a30e2851d08e7f81e5b6279520a24746d917
c89a2cf8bf444df7e11af2befd8c1f20a96c34bee6d13270e7692441843395da
c91afadbe63dd834aac00b49bc715795da58970e7d500c4bd8f50ed713c77880
cde46891f57c8a4986240aab850b56736963fd68ed193dd265fdb525c906fd60
d1252f3f1584dd033509867c51515623b05894f4b82a9e3c3da822326eaafc69
d310a2a2ad6bcac4068391482c43950cc7e672ad698641309af0c8dbaa673456
d9bf20fa1e29339c8dcbe0df9f1cd23ee01df3ae0877cdc80d08c33a30d41ab4
de4774067968f00ffcf4b72574b39f54cd766f1f956d7c21f0d815931f78fc5d
e0c75a3728746941983a7e3b362dd5df7c2d67dcb49567724fabb15b1ef50947
e1c8c674a5de7e5de010a6212157bdf0d1973fae8863fc34b883f344098bf04d
e1d46ef344e5d9a593b69978ada52e7ffb85d3154389a532daae5036373d55a6
e9c446e0dbaf6509c3f50825b8592884f7bf7d21aaf5b0fddaa98d7b389ecd5b
eba3881542a1ce2068c819ecebaf2f7ba9dbbf2cbde8f68eaa39a832ef66c6c8
eeea76d34a426787eab8f9ddf9209a6188a05f180b961b93f7fb767b908e96d9
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef25f2d6f5aa424f594bbaa63c1f86a634e2b87911e1db695b2a0c2e6927353a
f5b92e0c5428ee48219650011e0bcf48607dd9a390f1b36384fb38087b67f24d
f5fcff76c1da90c0cfa732560a2952a473fc0245c48c443d1df37b1d25fe3834
f749661c02cee9c7aef6745e82a1125d68762c4759dcdbfd163e3f24bde6be57

www.vkremez.com Open in urlscan Pro 2606:4700:3030::681c:143e Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

91 Requests

98 %HTTPS

93 %IPv6

11 Domains

16 Subdomains

15 IPs

4 Countries

1463 kBTransfer

6640 kBSize

4 Cookies

11 Outgoing links

Redirected requests

91 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 7 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.vkremez.com Open in urlscan Pro
2606:4700:3030::681c:143e Public Scan

Screenshot
Live screenshot

Full Image

91
Requests

98 %
HTTPS

93 %
IPv6

11
Domains

16
Subdomains

15
IPs

4
Countries

1463 kB
Transfer

6640 kB
Size

4
Cookies

91 HTTP transactions
7 data transactions