cofense.com Open in urlscan Pro
35.188.168.180 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://cofense.com/closer-look-qakbot-malware-dangerous/
Submission: On September 25 via api (September 25th 2020, 1:58:23 pm UTC) from US

Summary HTTP 130 Redirects Links 20 Behaviour Indicators

Summary

This website contacted 31 IPs in 7 countries across 26 domains to perform 130 HTTP transactions. The main IP is 35.188.168.180, located in United States and belongs to GOOGLE, US. The main domain is cofense.com.
TLS certificate: Issued by Let's Encrypt Authority X3 on August 7th 2020. Valid for: 3 months.

This is the only time cofense.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	35.188.168.180 35.188.168.180	15169 (GOOGLE) (GOOGLE)
73	108.161.188.228 108.161.188.228	33438 (HIGHWINDS2) (HIGHWINDS2)
4	23.111.9.35 23.111.9.35	33438 (HIGHWINDS2) (HIGHWINDS2)
2	2a00:1450:400... 2a00:1450:4001:802::200a	15169 (GOOGLE) (GOOGLE)
1	2600:9000:205... 2600:9000:2057:3e00:c:d51b:4400:21	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:81a::2008	15169 (GOOGLE) (GOOGLE)
5	2a00:1450:400... 2a00:1450:4001:825::2003	15169 (GOOGLE) (GOOGLE)
2	52.84.112.124 52.84.112.124	16509 (AMAZON-02) (AMAZON-02)
1	151.139.128.11 151.139.128.11	20446 (HIGHWINDS3) (HIGHWINDS3)
1	184.73.100.94 184.73.100.94	14618 (AMAZON-AES) (AMAZON-AES)
1	172.217.18.2 172.217.18.2	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:821::200e	15169 (GOOGLE) (GOOGLE)
1	147.75.102.203 147.75.102.203	54825 (PACKET) (PACKET)
2	2a02:26f0:470... 2a02:26f0:4700:1a2::25ea	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1 3	35.171.71.143 35.171.71.143	14618 (AMAZON-AES) (AMAZON-AES)
1	151.101.112.157 151.101.112.157	54113 (FASTLY) (FASTLY)
1	104.16.101.12 104.16.101.12	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	2a00:1450:400... 2a00:1450:4001:820::200e	15169 (GOOGLE) (GOOGLE)
1 2	2a05:f500:10:... 2a05:f500:10:101::b93f:9105	14413 (LINKEDIN) (LINKEDIN)
1 1	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	2a00:1450:400... 2a00:1450:400c:c0c::9c	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:817::2002	15169 (GOOGLE) (GOOGLE)
1	104.244.42.5 104.244.42.5	13414 (TWITTER) (TWITTER)
1	52.22.109.130 52.22.109.130	14618 (AMAZON-AES) (AMAZON-AES)
4	2a00:1450:400... 2a00:1450:4001:824::2004	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:818::2003	15169 (GOOGLE) (GOOGLE)
1	147.75.102.197 147.75.102.197	54825 (PACKET) (PACKET)
1	147.75.32.125 147.75.32.125	54825 (PACKET) (PACKET)
1	107.20.147.136 107.20.147.136	14618 (AMAZON-AES) (AMAZON-AES)
1	52.17.9.66 52.17.9.66	16509 (AMAZON-02) (AMAZON-02)
2	35.174.151.106 35.174.151.106	14618 (AMAZON-AES) (AMAZON-AES)
1	104.244.42.3 104.244.42.3	13414 (TWITTER) (TWITTER)
130	31

1 35.188.168.180 (United States)

ASN15169 (GOOGLE, US)
PTR: 180.168.188.35.bc.googleusercontent.com

cofense.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

73 108.161.188.228 (United States)

ASN33438 (HIGHWINDS2, US)

qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 23.111.9.35 (Phoenix, United States)

ASN33438 (HIGHWINDS2, US)

use.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:802::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2057:3e00:c:d51b:4400:21 (United States)

ASN16509 (AMAZON-02, US)

dsms0mj1bbhn4.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:81a::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:825::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.84.112.124 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-84-112-124.sof50.r.cloudfront.net

js.driftt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.139.128.11 (Dallas, United States)

ASN20446 (HIGHWINDS3, US)

m9m6e2w5.stackpathcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 184.73.100.94 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-184-73-100-94.compute-1.amazonaws.com

www.shareaholic.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.18.2 (United States)

ASN15169 (GOOGLE, US)
PTR: fra15s28-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:821::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 147.75.102.203 (Central, Hong Kong)

ASN54825 (PACKET, US)
PTR: pkt-ams-k2-shared-ingress15

static.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:4700:1a2::25ea (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.171.71.143 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-35-171-71-143.compute-1.amazonaws.com

t.sf14g.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
tracking.leadlander.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.112.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.16.101.12 (United States)

ASN13335 (CLOUDFLARENET, US)

ws.zoominfo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:820::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a05:f500:10:101::b93f:9105 (Ireland) 1 redirects

ASN14413 (LINKEDIN, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:21::14 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400c:c0c::9c (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:817::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.5 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.22.109.130 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-22-109-130.compute-1.amazonaws.com

analytics.shareaholic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:824::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:818::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 147.75.102.197 (Central, Hong Kong)

ASN54825 (PACKET, US)
PTR: pkt-ams-k2-shared-ingress11

script.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 147.75.32.125 (Amsterdam, Netherlands)

ASN54825 (PACKET, US)
PTR: pkt-ams-k2-shared-ingress4

vars.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 107.20.147.136 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-107-20-147-136.compute-1.amazonaws.com

partner.shareaholic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.17.9.66 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-17-9-66.eu-west-1.compute.amazonaws.com

in.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.174.151.106 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: pi0-lba1-4-ue1.aws.pardot.com

pi.pardot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.3 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
73	netdna-ssl.com qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com	2 MB
8	google-analytics.com www.google-analytics.com	51 KB
5	gstatic.com fonts.gstatic.com	85 KB
4	google.de www.google.de	1 KB
4	google.com www.google.com	1 KB
4	doubleclick.net stats.g.doubleclick.net googleads.g.doubleclick.net	5 KB
4	hotjar.com static.hotjar.com script.hotjar.com vars.hotjar.com in.hotjar.com	74 KB
4	fontawesome.com use.fontawesome.com	173 KB
3	linkedin.com 2 redirects px.ads.linkedin.com www.linkedin.com	3 KB
2	pardot.com pi.pardot.com	4 KB
2	leadlander.com 1 redirects tracking.leadlander.com	520 B
2	shareaholic.com analytics.shareaholic.com partner.shareaholic.com	641 B
2	licdn.com snap.licdn.com	3 KB
2	driftt.com js.driftt.com	45 KB
2	googletagmanager.com www.googletagmanager.com	90 KB
2	googleapis.com fonts.googleapis.com	2 KB
1	twitter.com analytics.twitter.com	652 B
1	t.co t.co	448 B
1	zoominfo.com ws.zoominfo.com	724 B
1	ads-twitter.com static.ads-twitter.com	2 KB
1	sf14g.com t.sf14g.com	37 KB
1	googleadservices.com www.googleadservices.com	12 KB
1	shareaholic.net www.shareaholic.net	2 KB
1	stackpathcdn.com m9m6e2w5.stackpathcdn.com	42 KB
1	cloudfront.net dsms0mj1bbhn4.cloudfront.net	4 KB
1	cofense.com cofense.com	29 KB
130	26

	Domain	Requested by
73	qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com	cofense.com qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com
8	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com cofense.com
5	fonts.gstatic.com	fonts.googleapis.com
4	www.google.de	cofense.com
4	www.google.com	cofense.com
4	use.fontawesome.com	cofense.com use.fontawesome.com
2	pi.pardot.com	cofense.com pi.pardot.com
2	tracking.leadlander.com	1 redirects cofense.com
2	googleads.g.doubleclick.net	www.googleadservices.com
2	stats.g.doubleclick.net	www.google-analytics.com
2	px.ads.linkedin.com	1 redirects cofense.com
2	snap.licdn.com	www.googletagmanager.com snap.licdn.com
2	js.driftt.com	cofense.com js.driftt.com
2	www.googletagmanager.com	cofense.com
2	fonts.googleapis.com	cofense.com
1	analytics.twitter.com	static.ads-twitter.com
1	in.hotjar.com	script.hotjar.com
1	partner.shareaholic.com	m9m6e2w5.stackpathcdn.com
1	vars.hotjar.com	static.hotjar.com
1	script.hotjar.com	static.hotjar.com
1	analytics.shareaholic.com	m9m6e2w5.stackpathcdn.com
1	t.co	cofense.com
1	www.linkedin.com	1 redirects
1	ws.zoominfo.com	cofense.com
1	static.ads-twitter.com	cofense.com
1	t.sf14g.com	cofense.com
1	static.hotjar.com	www.googletagmanager.com
1	www.googleadservices.com	www.googletagmanager.com
1	www.shareaholic.net	dsms0mj1bbhn4.cloudfront.net
1	m9m6e2w5.stackpathcdn.com	dsms0mj1bbhn4.cloudfront.net
1	dsms0mj1bbhn4.cloudfront.net	cofense.com
1	cofense.com
130	32

This site contains links to these domains. Also see Links.

Domain
www.facebook.com
twitter.com
www.linkedin.com
community.cofense.com
cofenselabs.com
developer.cofense.com
go.cofense.com
www.vkremez.com
raw.githubusercontent.com
github.com
attack.mitre.org
blog.talosintelligence.com
www.bleepingcomputer.com
www.bankinfosecurity.com
www.infosecurity-magazine.com

Subject Issuer	Validity	Valid
cofense.com Let's Encrypt Authority X3	`2020-08-07` - `2020-11-05`	3 months	crt.sh
*.netdna-ssl.com Sectigo RSA Domain Validation Secure Server CA	`2020-02-18` - `2021-03-18`	a year	crt.sh
*.fontawesome.com DigiCert SHA2 Secure Server CA	`2019-10-28` - `2020-12-23`	a year	crt.sh
upload.video.google.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
*.cloudfront.net DigiCert Global CA G2	`2020-05-26` - `2021-04-21`	a year	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
*.gstatic.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
drift.com Amazon	`2020-09-21` - `2021-10-23`	a year	crt.sh
*.stackpathcdn.com Go Daddy Secure Certificate Authority - G2	`2019-06-27` - `2021-06-27`	2 years	crt.sh
*.shareaholic.net Let's Encrypt Authority X3	`2020-09-23` - `2020-12-22`	3 months	crt.sh
www.googleadservices.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
static.hotjar.com Let's Encrypt Authority X3	`2020-08-16` - `2020-11-14`	3 months	crt.sh
*.licdn.com DigiCert SHA2 Secure Server CA	`2019-04-01` - `2021-05-07`	2 years	crt.sh
t.sf14g.com Go Daddy Secure Certificate Authority - G2	`2020-09-09` - `2021-09-09`	a year	crt.sh
ads-twitter.com DigiCert SHA2 High Assurance Server CA	`2020-08-14` - `2021-08-19`	a year	crt.sh
zoominfo.com Cloudflare Inc ECC CA-3	`2020-07-04` - `2021-07-04`	a year	crt.sh
px.ads.linkedin.com DigiCert SHA2 Secure Server CA	`2020-08-05` - `2021-02-05`	6 months	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
t.co DigiCert SHA2 High Assurance Server CA	`2020-03-05` - `2021-03-02`	a year	crt.sh
shareaholic.com Amazon	`2020-07-03` - `2021-08-03`	a year	crt.sh
www.google.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
www.google.de GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
script.hotjar.com Let's Encrypt Authority X3	`2020-08-17` - `2020-11-15`	3 months	crt.sh
vars.hotjar.com Let's Encrypt Authority X3	`2020-08-15` - `2020-11-13`	3 months	crt.sh
*.shareaholic.com Let's Encrypt Authority X3	`2020-09-23` - `2020-12-22`	3 months	crt.sh
*.hotjar.com Amazon	`2020-08-29` - `2021-09-28`	a year	crt.sh
*.google.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
*.google.de GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
*.leadlander.com Go Daddy Secure Certificate Authority - G2	`2020-04-28` - `2022-04-28`	2 years	crt.sh
pi.pardot.com DigiCert SHA2 Secure Server CA	`2019-12-26` - `2020-12-26`	a year	crt.sh
*.twitter.com DigiCert SHA2 High Assurance Server CA	`2020-03-05` - `2021-03-02`	a year	crt.sh

This page contains 3 frames:

Primary Page: https://cofense.com/closer-look-qakbot-malware-dangerous/
Frame ID: 4AFB71B3A235517110B55D5320BDF7E2
Requests: 128 HTTP requests in this frame

Frame: https://vars.hotjar.com/box-469cf41adb11dc78be68c1ae7f9457a4.html
Frame ID: C0E08B4A1FA47561E3803A494F96B6A9
Requests: 1 HTTP requests in this frame

Frame: https://js.driftt.com/deploy/assets/index.html
Frame ID: 8489B493FB379139AD9077D3877DF221
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

130
Requests

100 %
HTTPS

41 %
IPv6

26
Domains

32
Subdomains

31
IPs

7
Countries

2782 kB
Transfer

5526 kB
Size

1
Cookies

20 Outgoing links

These are links going to different origins than the main page.

URL: https://www.facebook.com/cofense

Search URL Search Domain Scan URL

URL: https://twitter.com/cofense

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/11500065/

Search URL Search Domain Scan URL

URL: https://community.cofense.com/
Title: Community

Search URL Search Domain Scan URL

URL: https://cofenselabs.com/
Title: Cofense Labs

Search URL Search Domain Scan URL

URL: https://developer.cofense.com/
Title: Cofense Dev

Search URL Search Domain Scan URL

URL: https://go.cofense.com/live-demo/
Title: Get a Demo

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https://cofense.com/closer-look-qakbot-malware-dangerous/
Title:

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/shareArticle?mini=true&url=https://cofense.com/closer-look-qakbot-malware-dangerous/&title=A%20Closer%20Look%20at%20Why%20the%20QakBot%20Malware%20Is%20So%20Dangerous&source=https://cofense.com
Title:

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?text=A%20Closer%20Look%20at%20Why%20the%20QakBot%20Malware%20Is%20So%20Dangerous&url=https://cofense.com/closer-look-qakbot-malware-dangerous/&via=cofense
Title:

Search URL Search Domain Scan URL

URL: https://www.vkremez.com/2018/07/lets-learn-in-depth-reversing-of-qakbot.html
Title: history

Search URL Search Domain Scan URL

URL: https://raw.githubusercontent.com/EmpireProject/Empire/master/data/module_source/credentials/Invoke-Mimikatz.ps1
Title: Invoke-Mimikatz.ps1

Search URL Search Domain Scan URL

URL: https://github.com/EmpireProject/Empire
Title: framework

Search URL Search Domain Scan URL

URL: https://github.com/gentilkiwi/mimikatz
Title: Mimikatz

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1075/
Title: pass the hash

Search URL Search Domain Scan URL

URL: https://blog.talosintelligence.com/2016/04/qbot-on-the-rise.html
Title: SMB

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/news/security/emotet-malware-strikes-us-businesses-with-covid-19-spam/
Title: 14-August-2020 Emotet malware strikes U.S. businesses with COVID-19 spam Bleeping Computer

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/news/security/emotet-malware-now-steals-your-email-attachments-to-attack-contacts/
Title: 28-July-2020 Emotet malware now steals your email attachments to attack contacts Bleeping Computer

Search URL Search Domain Scan URL

URL: https://www.bankinfosecurity.com/phishing-attacks-dodge-email-security-a-14681
Title: 22-July-2020 Phishing Attacks Dodge Email Security Bank Info Security

Search URL Search Domain Scan URL

URL: https://www.infosecurity-magazine.com/news/confense-hmrc-covid-tax-scam/
Title: 15-July-2020 Cofense Detects HMRC #COVID19 Tax Relief Scam InfoSecurity

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 99

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=300721&time=1601042273055&url=https%3A%2F%2Fcofense.com%2Fcloser-look-qakbot-malware-dangerous%2F HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D300721%26time%3D1601042273055%26url%3Dhttps%253A%252F%252Fcofense.com%252Fcloser-look-qakbot-malware-dangerous%252F%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=300721&time=1601042273055&url=https%3A%2F%2Fcofense.com%2Fcloser-look-qakbot-malware-dangerous%2F&liSync=true

Request Chain 116

https://tracking.leadlander.com/api/tracking?accountId=19612&page=https%3A%2F%2Fcofense.com%2Fcloser-look-qakbot-malware-dangerous%2F&referer=&fp=5d2f10942569cca69057fc09abaea819 HTTP 302
https://tracking.leadlander.com/tracking.png

130 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
cofense.com/closer-look-qakbot-malware-dangerous/ 173 KB
29 KB 446ms
169ms Document
text/html 35.188.168.180
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.188.168.180 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx / WP Engine
Resource Hash: ee4b99a20bdc97642e5c23b2cb0bc8c83220985dac4c0f4bcffcf40fef944e58

Request headers

:method: GET
:authority: cofense.com
:scheme: https
:path: /closer-look-qakbot-malware-dangerous/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
server: nginx
date: Fri, 25 Sep 2020 13:57:52 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding Accept-Encoding Accept-Encoding,Cookie
x-pingback: https://cofense.com/xmlrpc.php
link: <https://cofense.com/?p=16408>; rel=shortlink
x-powered-by: WP Engine
x-cacheable: SHORT
cache-control: max-age=600, must-revalidate
x-cache: HIT: 2
x-cache-group: normal
content-encoding: br

GET
H2 200 cache.skin.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/mega_main_menu/src/css/ 213 B
401 B 130ms
37ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/mega_main_menu/src/css/cache.skin.css?ver=5.4.2
Requested by: Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: fb192c1648b3f3f1d33c7cb0dc247f98d32e9995731598adb483fd34e25a5083

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
content-encoding: gzip
last-modified: Fri, 25 Sep 2020 12:59:35 GMT
server: NetDNA-cache/2.2
status: 200
etag: W/"5f6de9b7-d5"
vary: Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 style.min.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-includes/css/dist/block-library/ 52 KB
8 KB 132ms
39ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-includes/css/dist/block-library/style.min.css?ver=5.4.2
Requested by: Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: bca7af0b45b6fc6a2064e8e7a34f2041f3e77261e63f0257209bcde6bc40545d

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
content-encoding: gzip
last-modified: Fri, 25 Sep 2020 12:57:30 GMT
server: NetDNA-cache/2.2
status: 200
etag: W/"5f6de93a-d159"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 ihover.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/mega-addons-for-visual-composer/css/ 428 KB
76 KB 152ms
59ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/mega-addons-for-visual-composer/css/ihover.css?ver=5.4.2
Requested by: Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: e89fa95988dcf7bf63bc92866b4ebd12c7ededfda65f8040105b51cb41f0414e

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
content-encoding: gzip
last-modified: Fri, 25 Sep 2020 12:59:39 GMT
server: NetDNA-cache/2.2
status: 200
etag: W/"5f6de9bb-6ae1e"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 style.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/mega-addons-for-visual-composer/css/ 1 KB
825 B 179ms
86ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/mega-addons-for-visual-composer/css/style.css?ver=5.4.2
Requested by: Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: c95b879561e19ae45fa002f19fab5a8d1b0ca8c9f975409eb3abd829cf83031d

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
content-encoding: gzip
last-modified: Fri, 25 Sep 2020 12:59:35 GMT
server: NetDNA-cache/2.2
status: 200
etag: W/"5f6de9b7-568"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 font-awesome.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/mega-addons-for-visual-composer/css/font-awesome/css/ 37 KB
8 KB 181ms
88ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/mega-addons-for-visual-composer/css/font-awesome/css/font-awesome.css?ver=5.4.2
Requested by: Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 36e0a7e08bee65774168528938072c536437669c1b7458ac77976ec788e4439c

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
content-encoding: gzip
last-modified: Fri, 25 Sep 2020 12:59:35 GMT
server: NetDNA-cache/2.2
status: 200
etag: W/"5f6de9b7-9226"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 page-list.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/page-list/css/ 2 KB
790 B 181ms
89ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/page-list/css/page-list.css?ver=5.1
Requested by: Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: b3fd2bd251945091f3e856b2d244d662e7980d715b6d7f1722fde67e6dd321ef

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
content-encoding: gzip
last-modified: Fri, 25 Sep 2020 12:59:34 GMT
server: NetDNA-cache/2.2
status: 200
etag: W/"5f6de9b6-60c"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 all.css
use.fontawesome.com/releases/v5.13.0/css/ 57 KB
14 KB 217ms
129ms Stylesheet
text/css 23.111.9.35
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v5.13.0/css/all.css
Requested by: Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.111.9.35 Phoenix, United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 876d023d9d10c97941b80c3b03e2a5b94631ff7a4af9cee5604a6a2d39718d84

Request headers

Origin: https://cofense.com
Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
content-encoding: gzip
last-modified: Mon, 23 Mar 2020 16:09:20 GMT
server: NetDNA-cache/2.2
status: 200
etag: W/"76cb46c10b6c0293433b371bae2414b2"
vary: Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
access-control-max-age: 3000
cache-control: max-age=31556926
x-cache: HIT

GET
H2 200 magnific-popup.min.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/elite-addons-vc/assets/libs/magnific-popup/ 6 KB
2 KB 202ms
110ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/elite-addons-vc/assets/libs/magnific-popup/magnific-popup.min.css?ver=0.9.9
Requested by: Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 347cd2766d64da2e2d3ba740c9b07659352d583fd5e42a3d6b794acd43748129

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
content-encoding: gzip
last-modified: Fri, 25 Sep 2020 12:59:36 GMT
server: NetDNA-cache/2.2
status: 200
etag: W/"5f6de9b8-1802"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 animate.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/elite-addons-vc/assets/ 67 KB
4 KB 182ms
90ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/elite-addons-vc/assets/animate.css?ver=5.4.2
Requested by: Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 0f3ffa7f0b928b893a75953b1b233b2bf8dc84f94851a6d24225a59d862c270b

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
content-encoding: gzip
last-modified: Fri, 25 Sep 2020 12:59:36 GMT
server: NetDNA-cache/2.2
status: 200
etag: W/"5f6de9b8-10cbc"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 css
fonts.googleapis.com/ 5 KB
667 B 20ms
15ms Stylesheet
text/css 2a00:1450:4001:802::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Raleway%3A300%2C400%2C700&ver=1

Requested by

Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

01047f6f2af472213a6b11d2517feb5f792ac86eb0ce91772b317a54e00f2a38

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 25 Sep 2020 13:57:52 GMT
server: ESF
date: Fri, 25 Sep 2020 13:57:52 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 25 Sep 2020 13:57:52 GMT

GET
H2 200 elegant-icons.min.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/libs/elegant-icons/ 4 KB
1 KB 199ms
108ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/libs/elegant-icons/elegant-icons.min.css?ver=1.0
Requested by: Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 4dc068edecd14f25d56b1f3093a42c9162e0f66a937827f0f1392359094e1208

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
content-encoding: gzip
last-modified: Fri, 25 Sep 2020 12:59:30 GMT
server: NetDNA-cache/2.2
status: 200
etag: W/"5f6de9b2-103d"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 owl.carousel.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/libs/owl-carousel/ 22 KB
3 KB 198ms
106ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/libs/owl-carousel/owl.carousel.css?ver=5.4.2
Requested by: Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 83f6604f4c4ca11246131304ec9a76d75e3b2db2ece8a477c4f0bf580b26a093

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
content-encoding: gzip
last-modified: Fri, 25 Sep 2020 12:59:30 GMT
server: NetDNA-cache/2.2
status: 200
etag: W/"5f6de9b2-577a"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 theme-styles.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/ 608 KB
72 KB 187ms
96ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/theme-styles.css?ver=1
Requested by: Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: e066e27304a41a9bd1eba18c512de3e7bc743488f4002fe21b97b222a822a9c4

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
content-encoding: gzip
last-modified: Fri, 25 Sep 2020 12:59:35 GMT
server: NetDNA-cache/2.2
status: 200
etag: W/"5f6de9b7-980d1"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 theme-shortcodes.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/ 28 KB
5 KB 183ms
92ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/theme-shortcodes.css?ver=1
Requested by: Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: d2caf4e20c60ec1b01fb2b59d947b111d50d667850f9ef13af194183f0574bed

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
content-encoding: gzip
last-modified: Fri, 25 Sep 2020 12:59:30 GMT
server: NetDNA-cache/2.2
status: 200
etag: W/"5f6de9b2-6f98"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 custom-styles.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/ 113 KB
19 KB 200ms
109ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/custom-styles.css?ver=1601038771
Requested by: Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: abee3b66f6dd218919cfb15e9be9c474bc2797a331ff3d27659bb857468efda5

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
content-encoding: gzip
last-modified: Fri, 25 Sep 2020 12:59:31 GMT
server: NetDNA-cache/2.2
status: 200
etag: W/"5f6de9b3-1c254"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 wmx-styles.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/ 5 KB
1 KB 200ms
109ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/wmx-styles.css?ver=1601038770
Requested by: Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: c4af296b65d25387b38e738018ce430397082b09449a7ce8da08baaa53c4c77d

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
content-encoding: gzip
last-modified: Fri, 25 Sep 2020 12:59:30 GMT
server: NetDNA-cache/2.2
status: 200
etag: W/"5f6de9b2-1572"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 responsive.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/ 102 KB
12 KB 199ms
108ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/responsive.css?ver=1
Requested by: Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 643ced756fe32f82d14c178ac0002a181a12d128402bd63b9b74c3cbdd85e66a

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
content-encoding: gzip
last-modified: Fri, 25 Sep 2020 12:59:30 GMT
server: NetDNA-cache/2.2
status: 200
etag: W/"5f6de9b2-198c3"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 select2.min.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/vendor/ 15 KB
2 KB 199ms
108ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/vendor/select2.min.css?ver=5.4.2
Requested by: Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: c066d830135d79d0b9aa4500ec1ba098dc25e08f606bcd9505fa94cb420c616b

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
content-encoding: gzip
last-modified: Fri, 25 Sep 2020 12:59:30 GMT
server: NetDNA-cache/2.2
status: 200
etag: W/"5f6de9b2-3aed"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 style.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/ 98 KB
16 KB 200ms
109ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/style.css?ver=5.4.2
Requested by: Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: be854277e60b095845c52d0b79a37e0d9adf3e2cb9ad93b20e757a18860c42dc

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
content-encoding: gzip
last-modified: Fri, 25 Sep 2020 12:59:31 GMT
server: NetDNA-cache/2.2
status: 200
etag: W/"5f6de9b3-187fc"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 css
fonts.googleapis.com/ 28 KB
1 KB 21ms
17ms Stylesheet
text/css 2a00:1450:4001:802::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A100%2C300%2C400%2C500%2C700%2C900%2C100italic%2C300italic%2C400italic%2C500italic%2C700italic%2C900italic&ver=5.4.2

Requested by

Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

94df22701bd80fca42c776b7064a4505986161b616007963e1ba60adba6f84d5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 25 Sep 2020 13:57:52 GMT
server: ESF
date: Fri, 25 Sep 2020 13:57:52 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 25 Sep 2020 13:57:52 GMT

GET
H2 200 v4-shims.css
use.fontawesome.com/releases/v5.13.0/css/ 26 KB
5 KB 236ms
150ms Stylesheet
text/css 23.111.9.35
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v5.13.0/css/v4-shims.css
Requested by: Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.111.9.35 Phoenix, United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: c0ded025aa80c10d37920521c8de04536a6145d0e42eb4186c57b412fa50eb45

Request headers

Origin: https://cofense.com
Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
content-encoding: gzip
last-modified: Mon, 23 Mar 2020 16:09:22 GMT
server: NetDNA-cache/2.2
status: 200
etag: W/"fb073a92592d70e5aa6e3cce1cf93a11"
vary: Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
access-control-max-age: 3000
cache-control: max-age=31556926
x-cache: HIT

GET
H2 200 jquery.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-includes/js/jquery/ 95 KB
34 KB 200ms
110ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Requested by: Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
content-encoding: gzip
last-modified: Fri, 25 Sep 2020 12:57:30 GMT
server: NetDNA-cache/2.2
status: 200
etag: W/"5f6de93a-17a69"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 jquery-migrate.min.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-includes/js/jquery/ 10 KB
4 KB 202ms
112ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1
Requested by: Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
content-encoding: gzip
last-modified: Fri, 25 Sep 2020 12:57:30 GMT
server: NetDNA-cache/2.2
status: 200
etag: W/"5f6de93a-2748"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 core.min.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-includes/js/jquery/ui/ 4 KB
2 KB 201ms
111ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-includes/js/jquery/ui/core.min.js?ver=1.11.4
Requested by: Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 46e6f42a22054a793841935920cbbc723856e339fead50fa33c1f1bb3ec5a251

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
content-encoding: gzip
last-modified: Fri, 25 Sep 2020 12:57:30 GMT
server: NetDNA-cache/2.2
status: 200
etag: W/"5f6de93a-f5b"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 script.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/mega-addons-for-visual-composer/js/ 3 KB
1 KB 200ms
111ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/mega-addons-for-visual-composer/js/script.js?ver=5.4.2
Requested by: Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: bfe8ebbb9a154092de88c4c438e3721fe9622818aaa98a8852bb02550cd8342f

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
content-encoding: gzip
last-modified: Fri, 25 Sep 2020 12:59:35 GMT
server: NetDNA-cache/2.2
status: 200
etag: W/"5f6de9b7-c1c"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 modernizr.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/elite-addons-vc/assets/ 10 KB
5 KB 199ms
111ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/elite-addons-vc/assets/modernizr.js?ver=1.1
Requested by: Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 71209f63fc1592e55fcff12d74e9f6108505190c6e70df5cc7d5748af32b9365

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
content-encoding: gzip
last-modified: Fri, 25 Sep 2020 12:59:36 GMT
server: NetDNA-cache/2.2
status: 200
etag: W/"5f6de9b8-283b"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 shareaholic.js Show response
dsms0mj1bbhn4.cloudfront.net/assets/pub/ 9 KB
4 KB 41ms
6ms Script
application/javascript 2600:9000:2057:3e00:c:d51b:4400:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dsms0mj1bbhn4.cloudfront.net/assets/pub/shareaholic.js
Requested by: Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2057:3e00:c:d51b:4400:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 185659ffe9d121675c69f00a89a8c7686051c56817d5ebc0348898b6cac9004a

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:55:03 GMT
content-encoding: gzip
age: 169
x-cache: Hit from cloudfront
status: 200
x-hello-human: Join the fun! Apply at www.shareaholic.com/jobs
content-length: 3697
access-control-allow-origin: *
last-modified: Tue, 15 Sep 2020 20:18:12 GMT
server: nginx
etag: "056d0ae1f3ea2c2f0332290f2ee87f6c"
content-type: application/javascript; charset=UTF-8
via: 1.1 a350f357b825293e306b1b0a2cb490c1.cloudfront.net (CloudFront)
cache-control: max-age=900, public
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
x-amz-cf-id: 3_AbVIu_A8ydtgy9uOcIB_DUeor1EFTrrDv3INzbyPfvGtNlqSBkaQ==

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 90 KB
36 KB 66ms
31ms Script
application/javascript 2a00:1450:4001:81a::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-1061448384

Requested by

Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

dbb66a357d226e1ffed77b285e2fcbf386d4e37434f3048bdacefd3f1975efc6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36449
x-xss-protection: 0
last-modified: Fri, 25 Sep 2020 12:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 25 Sep 2020 13:57:52 GMT

GET
H2 200 cofense-logo.svg
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/images/ 3 KB
1 KB 72ms
58ms Image
image/svg+xml 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/images/cofense-logo.svg
Requested by: Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: ca57cc407c7eefa8e3901cc501b0988fdefbea8a5c2043cf9178dacbd4c197f9

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
content-encoding: gzip
last-modified: Fri, 25 Sep 2020 12:59:30 GMT
server: NetDNA-cache/2.2
status: 200
etag: W/"5f6de9b2-b20"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 cofense-cbfree.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/ 3 KB
3 KB 75ms
61ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/cofense-cbfree.png
Requested by: Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 2cf13ef8a0e548d45203297ecc6e21ad5f82fe24e759acbf9a9600996aa4528c

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
last-modified: Fri, 25 Sep 2020 12:58:25 GMT
server: NetDNA-cache/2.2
status: 200
etag: "5f6de971-c2a"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 3114

GET
H2 200 cofense-lms.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/ 3 KB
3 KB 76ms
63ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/cofense-lms.png
Requested by: Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 102f598e077a43ea681594e0750b0e835960f288bada922fff4107785b3c7e31

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
last-modified: Fri, 25 Sep 2020 12:58:25 GMT
server: NetDNA-cache/2.2
status: 200
etag: "5f6de971-cd3"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 3283

GET
H2 200 cofense-reporter.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/ 3 KB
3 KB 78ms
64ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/cofense-reporter.png
Requested by: Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: f6fa548f3755570ef254a6b934091fcd2634717a57060511fd414a704e7dc95c

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
last-modified: Fri, 25 Sep 2020 12:58:25 GMT
server: NetDNA-cache/2.2
status: 200
etag: "5f6de971-b2e"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 2862

GET
H2 200 cofense-triage.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/ 3 KB
3 KB 78ms
65ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/cofense-triage.png
Requested by: Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 12a5ec5674ef088f8c198091b7eb6d0478cf5aae6465c09634abae505332d149

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
last-modified: Fri, 25 Sep 2020 12:58:25 GMT
server: NetDNA-cache/2.2
status: 200
etag: "5f6de971-c04"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 3076

GET
H2 200 cofense-vision.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/ 3 KB
3 KB 78ms
65ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/cofense-vision.png
Requested by: Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 1a71c8fe9799162a1bbb1faf1f7e60c7db8e90eb15779a9b6b1bf4e0812890f3

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
last-modified: Fri, 25 Sep 2020 12:58:25 GMT
server: NetDNA-cache/2.2
status: 200
etag: "5f6de971-ad5"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 2773

GET
H2 200 cofense-pds.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/ 4 KB
4 KB 78ms
66ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/cofense-pds.png
Requested by: Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: f498997e7a39cb345fb129f9158745de59167f8aee78cc573554bd2f5dbc92c7

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
last-modified: Fri, 25 Sep 2020 12:58:25 GMT
server: NetDNA-cache/2.2
status: 200
etag: "5f6de971-ff4"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 4084

GET
H2 200 cofense-intelligence.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/ 3 KB
3 KB 78ms
66ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/cofense-intelligence.png
Requested by: Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 7fd52abcc46a46e1d1f39cf3677e2a581b4365872258b5fbc5e28eb183fb6410

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
last-modified: Fri, 25 Sep 2020 12:58:25 GMT
server: NetDNA-cache/2.2
status: 200
etag: "5f6de971-c34"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 3124

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 160 KB
54 KB 91ms
59ms Script
application/javascript 2a00:1450:4001:81a::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5RQ37KH

Requested by

Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

15ffa4319971385160ecc0bd1d53a66ed4c9ef1a937b2a6880cb28bde1aacc66

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 55192
x-xss-protection: 0
last-modified: Fri, 25 Sep 2020 12:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 25 Sep 2020 13:57:52 GMT

GET
H2 200 cofense-livefeed.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/ 5 KB
5 KB 78ms
67ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/cofense-livefeed.png
Requested by: Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 201ac106aa78dbaf7062e570803b878ae8d4e909608bc19dc77bdfdc39fe85d0

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
last-modified: Fri, 25 Sep 2020 12:58:25 GMT
server: NetDNA-cache/2.2
status: 200
etag: "5f6de971-12ad"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 4781

GET
H2 200 virus-01.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2020/03/ 6 KB
7 KB 79ms
67ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2020/03/virus-01.png
Requested by: Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: d2dcdaca89cc8422fd1d1ab405630bd6a5e6dd4adebe8723a11ed050a60461c4

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
last-modified: Fri, 25 Sep 2020 12:57:50 GMT
server: NetDNA-cache/2.2
status: 200
etag: "5f6de94e-198b"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 6539

GET
H2 200 wfh-01.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2020/04/ 4 KB
5 KB 79ms
68ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2020/04/wfh-01.png
Requested by: Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: f4f38c2e3b869558658a4303d42a3a0fc5f81ad2e72517be88f22da35c617b6f

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
last-modified: Fri, 25 Sep 2020 12:57:46 GMT
server: NetDNA-cache/2.2
status: 200
etag: "5f6de94a-111d"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 4381

GET
H2 200 cofense-threat_education.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/ 4 KB
4 KB 84ms
73ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/cofense-threat_education.png
Requested by: Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: dc83f496595b1d3b55fd6aeae76471a9d89284e1026849b5ab805bc3e8116739

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
last-modified: Fri, 25 Sep 2020 12:58:25 GMT
server: NetDNA-cache/2.2
status: 200
etag: "5f6de971-e51"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 3665

GET
H2 200 phishing-threats-db.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2020/06/ 5 KB
5 KB 85ms
74ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2020/06/phishing-threats-db.png
Requested by: Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: fdf1d02d0e923da1e187476e11f688c61482e25abba482b857674fbb3d79ef45

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
last-modified: Fri, 25 Sep 2020 12:57:42 GMT
server: NetDNA-cache/2.2
status: 200
etag: "5f6de946-1469"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 5225

GET
H2 200 cofense-cloud_seeker.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/ 4 KB
5 KB 85ms
75ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/cofense-cloud_seeker.png
Requested by: Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: fde4dd0ab5add3a76f91f880c510718310cdf21d8fed6e65b5bd0a624a02ea69

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
last-modified: Fri, 25 Sep 2020 12:58:25 GMT
server: NetDNA-cache/2.2
status: 200
etag: "5f6de971-1166"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 4454

GET
H2 200 cofense-threat_alerts.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/ 3 KB
3 KB 86ms
76ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/cofense-threat_alerts.png
Requested by: Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 2f646c0b23cd81ccb0a37a96186572b394b4e2dfd4974da05559d7381d5989a4

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
last-modified: Fri, 25 Sep 2020 12:58:25 GMT
server: NetDNA-cache/2.2
status: 200
etag: "5f6de971-c7a"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 3194

GET
H2 200 Picture1-2-768x99.jpg
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/02/ 17 KB
18 KB 295ms
285ms Image
image/jpeg 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/02/Picture1-2-768x99.jpg
Requested by: Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: bf3ac74b1daf2f65acd123805dc98026f54cce1fd0db0648f2650468e3e45121

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
last-modified: Fri, 25 Sep 2020 12:58:20 GMT
server: NetDNA-cache/2.2
status: 200
etag: "5f6de96c-45a1"
vary: Accept-Encoding
x-cache: MISS
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 17825

GET
H2 200 Picture2-2-768x395.jpg
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/02/ 65 KB
66 KB 392ms
382ms Image
image/jpeg 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/02/Picture2-2-768x395.jpg
Requested by: Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 6f3af746d7b6b55cd157863dce65e89532542c8f89bc23d0a3209891eaecb39c

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
last-modified: Fri, 25 Sep 2020 12:58:21 GMT
server: NetDNA-cache/2.2
status: 200
etag: "5f6de96d-1050d"
vary: Accept-Encoding
x-cache: MISS
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 66829

GET
H2 200 Picture3-2-768x256.jpg
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/02/ 50 KB
51 KB 294ms
285ms Image
image/jpeg 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/02/Picture3-2-768x256.jpg
Requested by: Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 759e691e4926ce31adf9e9ed380dacb937b3024aae7b95d21106fe44c154d93f

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
last-modified: Fri, 25 Sep 2020 12:58:21 GMT
server: NetDNA-cache/2.2
status: 200
etag: "5f6de96d-c91c"
vary: Accept-Encoding
x-cache: MISS
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 51484

GET
H2 200 Picture4-2-338x270.jpg
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/02/ 14 KB
14 KB 295ms
286ms Image
image/jpeg 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/02/Picture4-2-338x270.jpg
Requested by: Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 0270df20975d3a7de06fa0fa42b02a43d28eb710037f42beb293215ffe763840

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
last-modified: Fri, 25 Sep 2020 12:58:21 GMT
server: NetDNA-cache/2.2
status: 200
etag: "5f6de96d-38f7"
vary: Accept-Encoding
x-cache: MISS
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 14583

GET
H2 200 Picture6-2-768x126.jpg
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/02/ 26 KB
27 KB 391ms
382ms Image
image/jpeg 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/02/Picture6-2-768x126.jpg
Requested by: Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 77af2e2e20765a4a6cf514dc9fb85c24fc9e81b5c38fc35952504a9ad0b1e9ab

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
last-modified: Fri, 25 Sep 2020 12:58:21 GMT
server: NetDNA-cache/2.2
status: 200
etag: "5f6de96d-69e6"
vary: Accept-Encoding
x-cache: MISS
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 27110

GET
H2 200 Picture7-2-768x355.jpg
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/02/ 47 KB
47 KB 296ms
287ms Image
image/jpeg 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/02/Picture7-2-768x355.jpg
Requested by: Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: c08632b4ad71fd912cff6d4bc38b3475554d10d67cd2d1ccbd31998bf48b14e8

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
last-modified: Fri, 25 Sep 2020 12:58:22 GMT
server: NetDNA-cache/2.2
status: 200
etag: "5f6de96e-ba04"
vary: Accept-Encoding
x-cache: MISS
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 47620

GET
H2 200 Picture8-1-768x290.jpg
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/02/ 59 KB
60 KB 389ms
381ms Image
image/jpeg 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/02/Picture8-1-768x290.jpg
Requested by: Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: a793c61791a121a6b278e220effd29e55aa61c44c559843630081b5ab99a7e22

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
last-modified: Fri, 25 Sep 2020 12:58:22 GMT
server: NetDNA-cache/2.2
status: 200
etag: "5f6de96e-ed63"
vary: Accept-Encoding
x-cache: MISS
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 60771

GET
H2 200 Picture9-1-591x439.jpg
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/02/ 79 KB
79 KB 389ms
381ms Image
image/jpeg 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/02/Picture9-1-591x439.jpg
Requested by: Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: ad28cf25206c57cd337861b73a3ad8321068c19b7456f997f09680940a07076a

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
last-modified: Fri, 25 Sep 2020 12:58:22 GMT
server: NetDNA-cache/2.2
status: 200
etag: "5f6de96e-13c4d"
vary: Accept-Encoding
x-cache: MISS
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 80973

GET
H2 200 Picture10-768x372.jpg
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/02/ 54 KB
54 KB 293ms
285ms Image
image/jpeg 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/02/Picture10-768x372.jpg
Requested by: Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: a58e130d9d84e9a93af8a9452ddcecaab125d1f8df1f309d6bfde50f0378409e

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
last-modified: Fri, 25 Sep 2020 12:58:21 GMT
server: NetDNA-cache/2.2
status: 200
etag: "5f6de96d-d858"
vary: Accept-Encoding
x-cache: MISS
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 55384

GET
H2 200 Picture11-480x300.jpg
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/02/ 25 KB
25 KB 389ms
381ms Image
image/jpeg 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/02/Picture11-480x300.jpg
Requested by: Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 4815d1377f9b925557aec4a141c1cc6053e20167e6b36c19fecfd083fb4c9aa4

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
last-modified: Fri, 25 Sep 2020 12:58:21 GMT
server: NetDNA-cache/2.2
status: 200
etag: "5f6de96d-62dc"
vary: Accept-Encoding
x-cache: MISS
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 25308

GET
H2 200 Picture12-768x385.jpg
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/02/ 70 KB
70 KB 294ms
286ms Image
image/jpeg 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/02/Picture12-768x385.jpg
Requested by: Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: a3dba71be49f748736ef65cd4f61f4690f653961412384dab978fdd7b2a061a5

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
last-modified: Fri, 25 Sep 2020 12:58:21 GMT
server: NetDNA-cache/2.2
status: 200
etag: "5f6de96d-118bf"
vary: Accept-Encoding
x-cache: MISS
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 71871

GET
H2 200 Picture13-480x475.jpg
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/02/ 84 KB
84 KB 293ms
286ms Image
image/jpeg 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/02/Picture13-480x475.jpg
Requested by: Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 1f06022fcac113c5545fdc9758d177bae67a4e1735877596375b73858886f152

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
last-modified: Fri, 25 Sep 2020 12:58:22 GMT
server: NetDNA-cache/2.2
status: 200
etag: "5f6de96e-15042"
vary: Accept-Encoding
x-cache: MISS
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 86082

GET
H2 200 Picture14-1-768x342.jpg
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/02/ 58 KB
59 KB 388ms
381ms Image
image/jpeg 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/02/Picture14-1-768x342.jpg
Requested by: Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: cb4c5423bc39004de027965fcbbd5ebc999165fa31f9eb7af74a4e254cbf2025

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
last-modified: Fri, 25 Sep 2020 12:58:21 GMT
server: NetDNA-cache/2.2
status: 200
etag: "5f6de96d-e983"
vary: Accept-Encoding
x-cache: MISS
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 59779

GET
H2 200 Picture15-768x415.jpg
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/02/ 72 KB
72 KB 293ms
286ms Image
image/jpeg 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/02/Picture15-768x415.jpg
Requested by: Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 031a0b0af9a1a3d9e277bc8da460e850f7bfef590b9b0b70aa60bbe4cc994433

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
last-modified: Fri, 25 Sep 2020 12:58:21 GMT
server: NetDNA-cache/2.2
status: 200
etag: "5f6de96d-11e78"
vary: Accept-Encoding
x-cache: MISS
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 73336

GET
H2 200 Picture16-600x340.jpg
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/02/ 49 KB
49 KB 389ms
382ms Image
image/jpeg 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/02/Picture16-600x340.jpg
Requested by: Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 7c56a3f07142400af288d25373dc18e436d73f6d44b6b5affeadd1b9cfe8dbf2

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
last-modified: Fri, 25 Sep 2020 12:58:21 GMT
server: NetDNA-cache/2.2
status: 200
etag: "5f6de96d-c2f2"
vary: Accept-Encoding
x-cache: MISS
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 49906

GET
H2 200 Picture17-297x480.jpg
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/02/ 25 KB
25 KB 293ms
286ms Image
image/jpeg 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/02/Picture17-297x480.jpg
Requested by: Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: c099ef1698e45cdc519a61e09f5415075be00229176a84387850b3732f4fdc3c

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
last-modified: Fri, 25 Sep 2020 12:58:21 GMT
server: NetDNA-cache/2.2
status: 200
etag: "5f6de96d-63f3"
vary: Accept-Encoding
x-cache: MISS
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 25587

GET
H2 200 jquery.t-countdown.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/jquery-t-countdown-widget/js/ 9 KB
3 KB 39ms
38ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/jquery-t-countdown-widget/js/jquery.t-countdown.js?ver=2.4.0
Requested by: Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: a6dcb2582661566fdc1517014d9eea855588c2a8409067eca719b8bb1da475dc

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
content-encoding: gzip
last-modified: Fri, 25 Sep 2020 12:59:35 GMT
server: NetDNA-cache/2.2
status: 200
etag: W/"5f6de9b7-23d2"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 wow.min.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/elite-addons-vc/assets/ 8 KB
3 KB 42ms
41ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/elite-addons-vc/assets/wow.min.js
Requested by: Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: cfa1739ee346d63a3d3cfdff8c18cbe8fdedbcb32d4b0895028c193ce828e7a5

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
content-encoding: gzip
last-modified: Fri, 25 Sep 2020 12:59:36 GMT
server: NetDNA-cache/2.2
status: 200
etag: W/"5f6de9b8-1ff6"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 modules.min.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/elite-addons-vc/assets/ 121 KB
35 KB 56ms
39ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/elite-addons-vc/assets/modules.min.js?ver=1.1
Requested by: Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 8b950c87c8fcca9e5a47bbe6143f7a2df9a783faf9a11b07559d35a7adddb504

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
content-encoding: gzip
last-modified: Fri, 25 Sep 2020 12:59:37 GMT
server: NetDNA-cache/2.2
status: 200
etag: W/"5f6de9b9-1e4e2"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 owl.carousel.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/libs/owl-carousel/ 38 KB
9 KB 61ms
45ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/libs/owl-carousel/owl.carousel.js?ver=1.0
Requested by: Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: e13c8733b82140ef6edef5f6ce96c0387419b93dd9b73fab8807a43a09d1fd73

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
content-encoding: gzip
last-modified: Fri, 25 Sep 2020 12:59:30 GMT
server: NetDNA-cache/2.2
status: 200
etag: W/"5f6de9b2-99c8"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 jquery.sticky.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/js/ 10 KB
3 KB 62ms
46ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/js/jquery.sticky.js?ver=30
Requested by: Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: bcf6b9b28cec8958f9d3f3ee39070e85ffd46d670f1f0baa7cd21aa24c188a00

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
content-encoding: gzip
last-modified: Fri, 25 Sep 2020 12:59:30 GMT
server: NetDNA-cache/2.2
status: 200
etag: W/"5f6de9b2-2765"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 custom.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/js/ 14 KB
4 KB 62ms
46ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/js/custom.js?ver=1601038770
Requested by: Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 1b889b5222373b8a0485f3fb325564e3b2b017a6cbb518d12a045a407d1eca83

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
content-encoding: gzip
last-modified: Fri, 25 Sep 2020 12:59:30 GMT
server: NetDNA-cache/2.2
status: 200
etag: W/"5f6de9b2-3802"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 theme-scripts.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/js/ 139 KB
39 KB 63ms
47ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/js/theme-scripts.js?ver=1
Requested by: Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 5c722519d5b20bb22f0453889d36e0ba6ce9bd967d93fbbe7a9682d31cf31be5

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
content-encoding: gzip
last-modified: Fri, 25 Sep 2020 12:59:32 GMT
server: NetDNA-cache/2.2
status: 200
etag: W/"5f6de9b4-22de9"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 select2.min.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/js/vendor/ 66 KB
19 KB 68ms
53ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/js/vendor/select2.min.js
Requested by: Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: d7dd05bfc68901dbb2c883a7bd65698c29b3917d61f0e12d1966dca14d5056c0

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
content-encoding: gzip
last-modified: Fri, 25 Sep 2020 12:59:30 GMT
server: NetDNA-cache/2.2
status: 200
etag: W/"5f6de9b2-10964"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 jquery.waypoints.min.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/js/vendor/ 9 KB
3 KB 68ms
53ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/js/vendor/jquery.waypoints.min.js?ver=3
Requested by: Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 368daab67b1a5b2b2802edbbac79a2aa4ba992a2ebf9c67b98ad784d8004018c

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
content-encoding: gzip
last-modified: Fri, 25 Sep 2020 12:59:30 GMT
server: NetDNA-cache/2.2
status: 200
etag: W/"5f6de9b2-2344"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 sticky.min.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/js/vendor/ 1 KB
829 B 69ms
53ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/js/vendor/sticky.min.js?ver=3
Requested by: Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 14c52b4f1daa1aa3a92d960a311d4518da07e80b7b1a443d3f1a55c0968c99a0

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
content-encoding: gzip
last-modified: Fri, 25 Sep 2020 12:59:30 GMT
server: NetDNA-cache/2.2
status: 200
etag: W/"5f6de9b2-4db"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 comment-reply.min.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-includes/js/ 2 KB
1 KB 69ms
54ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-includes/js/comment-reply.min.js?ver=5.4.2
Requested by: Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: a37ca4608218cccdfb8b6d4edbdfbf375d0e1368b46397e3b7049e0cbf5bc1f6

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
content-encoding: gzip
last-modified: Fri, 25 Sep 2020 12:57:30 GMT
server: NetDNA-cache/2.2
status: 200
etag: W/"5f6de93a-974"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 wp-embed.min.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-includes/js/ 1 KB
1020 B 69ms
54ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-includes/js/wp-embed.min.js?ver=5.4.2
Requested by: Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 6ebcda7a3a41ef97f0b4071160ceb1020e540fdc0f790079a5c2ef01ab654fe0

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
content-encoding: gzip
last-modified: Fri, 25 Sep 2020 12:57:30 GMT
server: NetDNA-cache/2.2
status: 200
etag: W/"5f6de93a-59a"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 jquery.json.min.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/gravityforms/js/ 2 KB
1 KB 70ms
55ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/gravityforms/js/jquery.json.min.js?ver=2.4.3
Requested by: Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: a9f6c03ce6f4d1654f29f2136651e883198d509cb2e26af1c24b1f87b6ccae13

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
content-encoding: gzip
last-modified: Fri, 25 Sep 2020 12:59:36 GMT
server: NetDNA-cache/2.2
status: 200
etag: W/"5f6de9b8-738"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 gravityforms.min.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/gravityforms/js/ 33 KB
10 KB 70ms
55ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/gravityforms/js/gravityforms.min.js?ver=2.4.3
Requested by: Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 98984bbc9d46fc5e6ef61b1882e77303377713b957b6ef0f8475ceca54dc6c18

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
content-encoding: gzip
last-modified: Fri, 25 Sep 2020 12:59:36 GMT
server: NetDNA-cache/2.2
status: 200
etag: W/"5f6de9b8-853b"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 1Ptug8zYS_SKggPNyC0IT4ttDfA.woff2
fonts.gstatic.com/s/raleway/v17/ 40 KB
40 KB 6ms
5ms Font
font/woff2 2a00:1450:4001:825::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/raleway/v17/1Ptug8zYS_SKggPNyC0IT4ttDfA.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Raleway%3A300%2C400%2C700&ver=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

293c1f5f923e599f3adadeb96b2367c11f890343508c57b2c905d1c91d2a07ea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://cofense.com
Referer: https://fonts.googleapis.com/css?family=Raleway%3A300%2C400%2C700&ver=1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 21 Sep 2020 09:07:26 GMT
x-content-type-options: nosniff
last-modified: Wed, 15 Jul 2020 20:51:40 GMT
server: sffe
age: 363026
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40692
x-xss-protection: 0
expires: Tue, 21 Sep 2021 09:07:26 GMT

GET
H2 200 28krvx2uf9n3.js Show response
js.driftt.com/include/1601042400000/ 137 KB
45 KB 295ms
192ms Script
application/javascript 52.84.112.124
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/include/1601042400000/28krvx2uf9n3.js

Requested by

Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.84.112.124 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-84-112-124.sof50.r.cloudfront.net

Software

nginx /

Resource Hash

7bc1dc7d2a673a36a6e7b3d26c7fd8f5cc42d8b2d41a98e4de2a5ebdaaea9bf7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
etag: "a48548cec5608126b24de4cbfe9bfb8d"
x-amz-cf-pop: SOF50-C1
x-amz-server-side-encryption: AES256
x-cache: RefreshHit from cloudfront
status: 200
access-control-allow-origin: *
last-modified: Wed, 23 Sep 2020 21:24:15 GMT
server: nginx
date: Fri, 25 Sep 2020 13:57:52 GMT
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=UTF-8
via: 1.1 ec6357e657c548ad9e9ce985f638540c.cloudfront.net (CloudFront)
cache-control: max-age=10
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 9TgDGAkumAhItV8bU1i3yKzn6B3z_VEy9bmmd5gCjWNRpE3T6hbpRg==

GET
H2 200 nav-arrow.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/images/ 3 KB
3 KB 78ms
76ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/images/nav-arrow.png
Requested by: Host: qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com
URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/custom-styles.css?ver=1601038771
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: a05ce29b1660d2755713106d272474ec04a2524269517b23603f325230d2d4c9

Request headers

Referer: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/custom-styles.css?ver=1601038771
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
last-modified: Fri, 25 Sep 2020 12:59:30 GMT
server: NetDNA-cache/2.2
status: 200
etag: "5f6de9b2-b8d"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 2957

GET
H2 200 icn-nav-search@2x.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/images/ 1 KB
1 KB 78ms
77ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/images/icn-nav-search@2x.png
Requested by: Host: qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com
URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/custom-styles.css?ver=1601038771
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 21110fa48987dc5804b08b84e1008e7c922f7b028c6291c64a6845fbb868014f

Request headers

Referer: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/custom-styles.css?ver=1601038771
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
last-modified: Fri, 25 Sep 2020 12:59:30 GMT
server: NetDNA-cache/2.2
status: 200
etag: "5f6de9b2-514"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 1300

GET
H2 200 b-g.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/images/ 840 KB
841 KB 73ms
71ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/images/b-g.png
Requested by: Host: qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com
URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/custom-styles.css?ver=1601038771
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 8c3f327cab31c3d02e5bf8d08bac753e210f1f12588a1197226bccff955a0df9

Request headers

Referer: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/custom-styles.css?ver=1601038771
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
last-modified: Fri, 25 Sep 2020 12:59:37 GMT
server: NetDNA-cache/2.2
status: 200
etag: "5f6de9b9-d20af"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 860335

GET
H2 200 footer-graphic.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2016/07/ 4 KB
4 KB 80ms
78ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2016/07/footer-graphic.png
Requested by: Host: qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com
URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/style.css?ver=5.4.2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: b4c873f99c6d9811d0b8663a59007825e1dd511a54336f08bac1df3a80a3fe29

Request headers

Referer: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/style.css?ver=5.4.2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
last-modified: Fri, 25 Sep 2020 12:59:13 GMT
server: NetDNA-cache/2.2
status: 200
etag: "5f6de9a1-e4e"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 3662

GET
H2 200 footer-graphic-b.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2016/07/ 212 B
438 B 80ms
79ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2016/07/footer-graphic-b.png
Requested by: Host: qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com
URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/style.css?ver=5.4.2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 88b758789019407fc4c2461c0d188aa776cb4b72d759e3c670b73d68fabf383a

Request headers

Referer: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/style.css?ver=5.4.2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
last-modified: Fri, 25 Sep 2020 12:59:13 GMT
server: NetDNA-cache/2.2
status: 200
etag: "5f6de9a1-d4"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 212

GET
H2 200 footer-graphic-a.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2016/07/ 107 B
333 B 80ms
79ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2016/07/footer-graphic-a.png
Requested by: Host: qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com
URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/style.css?ver=5.4.2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 0b0200866fae3fcc0c3f1acf6d8dc18fb93ce8b7a55cc7fbc31b231b01764ddb

Request headers

Referer: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/style.css?ver=5.4.2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
last-modified: Fri, 25 Sep 2020 12:59:13 GMT
server: NetDNA-cache/2.2
status: 200
etag: "5f6de9a1-6b"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 107

GET
H2 200 fa-solid-900.woff2
use.fontawesome.com/releases/v5.13.0/webfonts/ 78 KB
78 KB 47ms
47ms Font
font/woff2 23.111.9.35
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v5.13.0/webfonts/fa-solid-900.woff2
Requested by: Host: use.fontawesome.com
URL: https://use.fontawesome.com/releases/v5.13.0/css/all.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.111.9.35 Phoenix, United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 7f4d3fd0a705dbf8403298aad91d5de6972e6b5d536068eba8b24954a5a0a8c7

Request headers

Origin: https://cofense.com
Referer: https://use.fontawesome.com/releases/v5.13.0/css/all.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
last-modified: Mon, 23 Mar 2020 16:08:17 GMT
server: NetDNA-cache/2.2
status: 200
etag: "b15db15f746f29ffa02638cb455b8ec0"
vary: Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods: GET
content-type: font/woff2
access-control-allow-origin: *
access-control-max-age: 3000
cache-control: max-age=31556926
x-cache: HIT
accept-ranges: bytes
content-length: 79444

GET
H3-Q050 200 KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v20/ 11 KB
11 KB 37ms
23ms Font
font/woff2 2a00:1450:4001:825::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A100%2C300%2C400%2C500%2C700%2C900%2C100italic%2C300italic%2C400italic%2C500italic%2C700italic%2C900italic&ver=5.4.2

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:825::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ce897833ac6e362df7c91ac8223fe511c6defcf33964928a81004600a2dd4c2e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://cofense.com
Referer: https://fonts.googleapis.com/css?family=Roboto%3A100%2C300%2C400%2C500%2C700%2C900%2C100italic%2C300italic%2C400italic%2C500italic%2C700italic%2C900italic&ver=5.4.2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 21 Sep 2020 10:07:04 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:18:48 GMT
server: sffe
age: 359448
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11056
x-xss-protection: 0
expires: Tue, 21 Sep 2021 10:07:04 GMT

GET
H2 200 fa-brands-400.woff2
use.fontawesome.com/releases/v5.13.0/webfonts/ 75 KB
75 KB 73ms
73ms Font
font/woff2 23.111.9.35
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v5.13.0/webfonts/fa-brands-400.woff2
Requested by: Host: use.fontawesome.com
URL: https://use.fontawesome.com/releases/v5.13.0/css/all.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.111.9.35 Phoenix, United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 5d9190292acdd48ba0fc35080f7e7448f3cdf0d79199a4d23f0f49b5341fdf29

Request headers

Origin: https://cofense.com
Referer: https://use.fontawesome.com/releases/v5.13.0/css/all.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:52 GMT
last-modified: Mon, 23 Mar 2020 16:10:04 GMT
server: NetDNA-cache/2.2
status: 200
etag: "a06da7f0950f9dd366fc9db9d56d618a"
vary: Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods: GET
content-type: font/woff2
access-control-allow-origin: *
access-control-max-age: 3000
cache-control: max-age=31556926
x-cache: HIT
accept-ranges: bytes
content-length: 76612

GET
H3-Q050 200 KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
fonts.gstatic.com/s/roboto/v20/ 11 KB
11 KB 27ms
14ms Font
font/woff2 2a00:1450:4001:825::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:825::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://cofense.com
Referer: https://fonts.googleapis.com/css?family=Roboto%3A100%2C300%2C400%2C500%2C700%2C900%2C100italic%2C300italic%2C400italic%2C500italic%2C700italic%2C900italic&ver=5.4.2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 21 Sep 2020 09:06:19 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:18:50 GMT
server: sffe
age: 363093
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11016
x-xss-protection: 0
expires: Tue, 21 Sep 2021 09:06:19 GMT

GET
H3-Q050 200 KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v20/ 11 KB
11 KB 26ms
14ms Font
font/woff2 2a00:1450:4001:825::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:825::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0d9fd7ccabde9b202de45ee6b65878ce9594975d8e8810b0878d3f3fa3637d0e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://cofense.com
Referer: https://fonts.googleapis.com/css?family=Roboto%3A100%2C300%2C400%2C500%2C700%2C900%2C100italic%2C300italic%2C400italic%2C500italic%2C700italic%2C900italic&ver=5.4.2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 21 Sep 2020 09:06:15 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:18:58 GMT
server: sffe
age: 363097
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11020
x-xss-protection: 0
expires: Tue, 21 Sep 2021 09:06:15 GMT

GET
H3-Q050 200 KFOkCnqEu92Fr1Mu51xIIzIXKMny.woff2
fonts.gstatic.com/s/roboto/v20/ 12 KB
13 KB 22ms
13ms Font
font/woff2 2a00:1450:4001:825::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOkCnqEu92Fr1Mu51xIIzIXKMny.woff2

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:825::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3be0a916496d7936bb83ce60a4de9f10ef400f16c38e7dd7c65449c795e7739b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://cofense.com
Referer: https://fonts.googleapis.com/css?family=Roboto%3A100%2C300%2C400%2C500%2C700%2C900%2C100italic%2C300italic%2C400italic%2C500italic%2C700italic%2C900italic&ver=5.4.2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 21 Sep 2020 09:13:04 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:19:00 GMT
server: sffe
age: 362688
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12680
x-xss-protection: 0
expires: Tue, 21 Sep 2021 09:13:04 GMT

GET
H2 200 main.js Show response
m9m6e2w5.stackpathcdn.com/v2/74ebab12/ 145 KB
42 KB 156ms
52ms Script
application/javascript 151.139.128.11
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://m9m6e2w5.stackpathcdn.com/v2/74ebab12/main.js
Requested by: Host: dsms0mj1bbhn4.cloudfront.net
URL: https://dsms0mj1bbhn4.cloudfront.net/assets/pub/shareaholic.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.11 Dallas, United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: a6af364fb8e276d03bfe9825850586949491fe630a22df21bb7c9cbb9549d708

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:53 GMT
content-encoding: gzip
last-modified: Tue, 15 Sep 2020 20:18:10 GMT
server: nginx
x-amz-request-id: 4903ABDB7D0CB3D9
etag: "4ebff105480f13d55d08a046aabd7694"
x-hw: 1601042273.cds006.lo4.hn,1601042273.cds103.lo4.c
content-type: application/javascript; charset=UTF-8
status: 200
cache-control: max-age=31536000, public
x-hello-human: Join the fun! Apply at www.shareaholic.com/jobs
accept-ranges: bytes
access-control-allow-origin: *
content-length: 42680
x-amz-id-2: 9/XeLwYd8UbuZCLRzEWcxrRy1VyRULSY6S7VWVIo6R1zvVPZewewwRsA5nJ5l8YGWRQP/jP3CaA=

GET
H2 200 62df9f201cc7c19a56912daae814efca.json Show response
www.shareaholic.net/config/ 11 KB
2 KB 386ms
128ms XHR
application/json 184.73.100.94
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://www.shareaholic.net/config/62df9f201cc7c19a56912daae814efca.json
Requested by: Host: dsms0mj1bbhn4.cloudfront.net
URL: https://dsms0mj1bbhn4.cloudfront.net/assets/pub/shareaholic.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.73.100.94 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-184-73-100-94.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 1e6c1037c61147de087c99ee388b95a27833e77e820875f0fadcb64039abdb3b

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-client-geo-country: CZ,Czechia
date: Thu, 24 Sep 2020 18:27:22 GMT
content-encoding: gzip
vary: Accept-Encoding
access-control-allow-origin: *
status: 200
access-control-allow-methods: GET, HEAD
content-length: 1669
server: nginx
x-client-geo-region: 10,Hlavni mesto Praha
x-client-geo-metrocode
etag: W/"1e6c1037c61147de087c99ee388b95a2"
access-control-max-age: 2000
x-client-geo-city: Prague
x-varnish: 283584318 253914232
via: 1.1 varnish (Varnish/6.0)
access-control-expose-headers: Etag, Access-Control-Allow-Origin, x-client-geo-latlong, x-client-geo-country, x-client-geo-city, x-client-geo-zip, x-client-geo-region, x-client-geo-metrocode
cache-control: max-age=3, public, must-revalidate
x-client-geo-zip: 130 00
accept-ranges: bytes
content-type: application/json
access-control-allow-headers: *
x-client-geo-latlong: 50.076500,14.510400

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 29 KB
12 KB 112ms
40ms Script
text/javascript 172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-1061448384

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s28-in-f2.1e100.net

Software

cafe /

Resource Hash

6c9459a6400a8cf7ef815379f9316dc26aeec43bcc48da1d1bd58d99a6109f7b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 11311
x-xss-protection: 0
server: cafe
etag: 12833363978352728442
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Fri, 25 Sep 2020 13:57:53 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 45 KB
19 KB 30ms
8ms Script
text/javascript 2a00:1450:4001:821::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5RQ37KH

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:821::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

60863e86aa7743d1ac841da7f473a05cd57fba81d661cef658e385437f80d5ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 09 Sep 2020 01:50:37 GMT
server: Golfe2
age: 2533
date: Fri, 25 Sep 2020 13:15:40 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18650
expires: Fri, 25 Sep 2020 15:15:40 GMT

GET
H2 200 hotjar-1312741.js Show response
static.hotjar.com/c/ 11 KB
3 KB 139ms
45ms Script
application/javascript 147.75.102.203
PACKET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hotjar.com/c/hotjar-1312741.js?sv=7

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5RQ37KH

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

147.75.102.203 Central, Hong Kong, ASN54825 (PACKET, US),

Reverse DNS

pkt-ams-k2-shared-ingress15

Software

Resource Hash

8ae0b825cbd28b33ce1a6c0e4186a66db849ee52428206e910bee32b23ab9958

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:53 GMT
content-encoding: br
x-content-type-options: nosniff
content-type: application/javascript
section-io-tag: hotjarjs
age: 10
status: 200
section-io-cache: Hit
vary: Accept-Encoding
content-length: 2994
cache-control: max-age=60
etag: W/e613ec53c2eebebd7d928770c8d997cb
access-control-max-age: 600
section-io-origin-status: 304
access-control-allow-origin: *
x-cache-hit: 1
section-io-origin-time-seconds: 0.020
accept-ranges: bytes
section-io-id: 425587d2a0fc4f55150406379519db59
section-origin-responded: true

GET
H/1.1 200
OK insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 965 B
761 B 27ms
8ms Script
application/x-javascript 2a02:26f0:4700:1a2::25ea
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5RQ37KH
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:4700:1a2::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: /
Resource Hash: f10b9b0c4107ca5a40a5c69b1ac91a8948d84f39893dee6b429cdbdb05887093

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 25 Sep 2020 13:57:53 GMT
Content-Encoding: gzip
Last-Modified: Tue, 22 Sep 2020 22:01:48 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=11817
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 448

GET
H2 200 sf14g.js Show response
t.sf14g.com/ 37 KB
37 KB 507ms
236ms Script
application/javascript 35.171.71.143
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://t.sf14g.com/sf14g.js

Requested by

Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.171.71.143 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-35-171-71-143.compute-1.amazonaws.com

Software

Kestrel /

Resource Hash

86ecafc33ecb5976760d6b5f13a2874525e3f4bfa8b12a0e14d6c98ae9e727cd

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Sep 2020 13:57:53 GMT
last-modified: Thu, 06 Aug 2020 14:28:30 GMT
server: Kestrel
etag: "1d66bfddb0de89b"
strict-transport-security: max-age=2592000
content-type: application/javascript
status: 200
cache-control: no-cache, no-store
accept-ranges: bytes
content-length: 37787
expires: -1

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 5 KB
2 KB 99ms
31ms Script
application/javascript 151.101.112.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.112.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 8247f4332667950989fe6bf790f87723343db2ec83d975503e9c5dc13a6eb5dc

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:53 GMT
content-encoding: gzip
age: 59131
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200
content-length: 1958
x-served-by: cache-hhn4060-HHN
last-modified: Mon, 10 Aug 2020 18:10:59 GMT
x-timer: S1601042273.085917,VS0,VE0
etag: "a4cc3f907681b24a3efd540acd5d2996+gzip"
vary: Accept-Encoding,Host
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
cache-control: no-cache
accept-ranges: bytes

GET
H2 200 2Uq3HoQoVZEHgHXXf288 Show response
ws.zoominfo.com/pixel/ 0
724 B 409ms
313ms Script
text/javascript 104.16.101.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/pixel/2Uq3HoQoVZEHgHXXf288

Requested by

Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.101.12 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:53 GMT
via: 1.1 google
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-powered-by: Express
status: 200
content-length: 0
cf-request-id: 0567276b630000fa688f2a1200000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
access-control-allow-credentials: true
cf-ray: 5d8541bf0824fa68-AMS
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for

GET
H/1.1 200
OK insight.beta.min.js Show response
snap.licdn.com/li.lms-analytics/ 4 KB
2 KB 11ms
10ms Script
application/x-javascript 2a02:26f0:4700:1a2::25ea
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.beta.min.js
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:4700:1a2::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: /
Resource Hash: a8431bfe4316cdc20de936e824f735c9478bbc9ce3d3a51c774eca45faff637f

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 25 Sep 2020 13:57:53 GMT
Content-Encoding: gzip
Last-Modified: Tue, 22 Sep 2020 22:01:48 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=20392
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1799

GET
H3-Q050 200 js Show response
www.google-analytics.com/gtm/ 79 KB
31 KB 24ms
24ms Script
application/javascript 2a00:1450:4001:820::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/gtm/js?id=OPT-K29SPQM&t=gtm5&cid=299656550.1601042273&aip=true

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:820::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

2979bcd7bb97e9497fb83323c2a5c9696b3fb33fdbd0782be7810d78a79a888d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:53 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31995
x-xss-protection: 0
last-modified: Fri, 25 Sep 2020 12:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 25 Sep 2020 13:57:53 GMT

GET
H2

200

collect
px.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=300721&time=1601042273055&url=https%3A%2F%2Fcofense.com%2Fcloser-look-qakbot-malware-dangerous%2F
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D300721%26time%3D1601042273055%26url%3Dhttps%253A%252F%252Fcofense.com%252Fcloser-...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=300721&time=1601042273055&url=https%3A%2F%2Fcofense.com%2Fcloser-look-qakbot-malware-dangerous%2F&liSync=true

0
57 B

112ms
111ms

Image
application/javascript

2a05:f500:10:101::b93f:9105
LINKEDIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=300721&time=1601042273055&url=https%3A%2F%2Fcofense.com%2Fcloser-look-qakbot-malware-dangerous%2F&liSync=true
Requested by: Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:f500:10:101::b93f:9105 , Ireland, ASN14413 (LINKEDIN, US),
Reverse DNS
Software: Play /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:53 GMT
server: Play
linkedin-action: 1
x-li-fabric: prod-lva1
status: 200
x-li-proto: http/2
x-li-pop: prod-efr5
content-type: application/javascript
content-length: 0
x-li-uuid: Srj2A3cLOBaA922mRysAAA==

Redirect headers

content-security-policy: default-src *; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id https://lnkd.demdex.net/event blob: https://accounts.google.com/gsi/status https://linkedin.sc.omtrdc.net/b/ss/ www.google-analytics.com static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com https://snap.licdn.com/li.lms-analytics/ platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'; report-uri https://www.linkedin.com/platform-telemetry/csp?f=l
x-content-type-options: nosniff
linkedin-action: 1
status: 302
content-length: 0
x-li-uuid: ge/y/3YLOBaAJS0+FysAAA==
pragma: no-cache
x-li-pop: afd-prod-edc2
x-msedge-ref: Ref A: B3E5F11AA9DF4EED8F23060B1D861363 Ref B: FRAEDGE1508 Ref C: 2020-09-25T13:57:53Z
x-frame-options: sameorigin
date: Fri, 25 Sep 2020 13:57:53 GMT
expect-ct: max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct"
strict-transport-security: max-age=2592000
x-li-fabric: prod-lva1
location: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=300721&time=1601042273055&url=https%3A%2F%2Fcofense.com%2Fcloser-look-qakbot-malware-dangerous%2F&liSync=true
x-xss-protection: 1; mode=block
cache-control: no-cache, no-store
x-li-proto: http/2
expires: Thu, 01 Jan 1970 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
451 B 42ms
16ms XHR
text/plain 2a00:1450:400c:c0c::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j86&tid=UA-114787942-1&cid=299656550.1601042273&jid=141135954&gjid=528766344&_gid=1570997550.1601042273&_u=aGDAgUADQAAAAE~&z=807764559

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c0c::9c Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Fri, 25 Sep 2020 13:57:53 GMT
status: 200
content-type: text/plain
access-control-allow-origin: https://cofense.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 collect
www.google-analytics.com/ 35 B
62 B 6ms
6ms Image
image/gif 2a00:1450:4001:820::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j86&aip=1&a=1608385319&t=pageview&_s=1&dl=https%3A%2F%2Fcofense.com%2Fcloser-look-qakbot-malware-dangerous%2F&ul=en-us&de=UTF-8&dt=A%20Closer%20Look%20at%20Why%20the%20QakBot%20Malware%20Is%20So%20Dangerous%20-%20Cofense&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aGDAgUADQ~&jid=141135954&gjid=528766344&cid=299656550.1601042273&tid=UA-114787942-1&_gid=1570997550.1601042273&gtm=2wg9g15RQ37KH&z=1147393696

Requested by

Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:820::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Sep 2020 14:29:39 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 84494
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/1061448384/ 2 KB
2 KB 36ms
17ms Script
text/javascript 2a00:1450:4001:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1061448384/?random=1601042273105&cv=9&fst=1601042273105&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa9g1&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcofense.com%2Fcloser-look-qakbot-malware-dangerous%2F&tiba=A%20Closer%20Look%20at%20Why%20the%20QakBot%20Malware%20Is%20So%20Dangerous%20-%20Cofense&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

133b08f5be6a7b534f17c80319259b0f5f2ec68de6f86e1417d247327570cf7f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Sep 2020 13:57:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1079
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 adsct
t.co/i/ 43 B
448 B 269ms
170ms Image
image/gif 104.244.42.5
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?type=javascript&version=1.1.0&p_id=Twitter&p_user_id=0&txn_id=nv828&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tw_document_href=https%3A%2F%2Fcofense.com%2Fcloser-look-qakbot-malware-dangerous%2F

Requested by

Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.5 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
x-response-time: 118
pragma: no-cache
last-modified: Fri, 25 Sep 2020 13:57:53 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=0
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: d0714aa169b202792826cf7f778c4fe8
x-transaction: 0022b740000f6f37
expires: Tue, 31 Mar 1981 05:00:00 GMT

POST
H2 200 e
analytics.shareaholic.com/ 43 B
376 B 390ms
130ms Other
image/gif 52.22.109.130
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.shareaholic.com/e

Requested by

Host: m9m6e2w5.stackpathcdn.com
URL: https://m9m6e2w5.stackpathcdn.com/v2/74ebab12/main.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.22.109.130 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-22-109-130.compute-1.amazonaws.com

Software

Resource Hash

a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Security Headers

Name	Value
Content-Security-Policy	referrer always

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Fri, 25 Sep 2020 13:57:53 GMT
status: 200
vary: Origin
p3p: CP="OTI DSP COR DEVo ADMa OUR CONo IND COM INT ONL PUR STA OTC"
access-control-allow-origin: https://cofense.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
referer-policy: unsafe-url
content-security-policy: referrer always
content-type: image/gif
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
106 B 48ms
28ms Image
image/gif 2a00:1450:4001:824::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j86&tid=UA-114787942-1&cid=299656550.1601042273&jid=141135954&_u=aGDAgUADQAAAAE~&z=411634542

Requested by

Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Sep 2020 13:57:53 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
106 B 49ms
29ms Image
image/gif 2a00:1450:4001:818::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j86&tid=UA-114787942-1&cid=299656550.1601042273&jid=141135954&_u=aGDAgUADQAAAAE~&z=411634542

Requested by

Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Sep 2020 13:57:53 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 modules.94fbf54e63238ed34ad8.js Show response
script.hotjar.com/ 360 KB
70 KB 136ms
45ms Script
application/javascript 147.75.102.197
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.hotjar.com/modules.94fbf54e63238ed34ad8.js
Requested by: Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-1312741.js?sv=7
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 147.75.102.197 Central, Hong Kong, ASN54825 (PACKET, US),
Reverse DNS: pkt-ams-k2-shared-ingress11
Software: /
Resource Hash: a5e260f8d1d46595c71cf35eb09243ef8ee32453ff9fe49ea9c5ac6d3919f721

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:53 GMT
content-encoding: br
age: 505
status: 200
section-io-cache: Hit
content-length: 71526
last-modified: Fri, 25 Sep 2020 13:45:49 GMT
etag: "80af45ee8f7a76b874d609a70491a556"
vary: Accept-Encoding
section-io-origin-status: 200
access-control-allow-origin: *
cache-control: max-age=31536000
section-io-origin-time-seconds: 0.025
section-io-id: e3399f57199b2497cb9fc7e8e1c6adac
accept-ranges: bytes
content-type: application/javascript
section-origin-responded: true

GET
H2 200 /
www.google.com/pagead/1p-user-list/1061448384/ 42 B
560 B 30ms
19ms Image
image/gif 2a00:1450:4001:824::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/1061448384/?random=1601042273105&cv=9&fst=1601038800000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa9g1&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcofense.com%2Fcloser-look-qakbot-malware-dangerous%2F&tiba=A%20Closer%20Look%20at%20Why%20the%20QakBot%20Malware%20Is%20So%20Dangerous%20-%20Cofense&async=1&fmt=3&is_vtc=1&random=2464503242&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Sep 2020 13:57:53 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/1061448384/ 42 B
560 B 31ms
20ms Image
image/gif 2a00:1450:4001:818::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/1061448384/?random=1601042273105&cv=9&fst=1601038800000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa9g1&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcofense.com%2Fcloser-look-qakbot-malware-dangerous%2F&tiba=A%20Closer%20Look%20at%20Why%20the%20QakBot%20Malware%20Is%20So%20Dangerous%20-%20Cofense&async=1&fmt=3&is_vtc=1&random=2464503242&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Sep 2020 13:57:53 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 box-469cf41adb11dc78be68c1ae7f9457a4.html
vars.hotjar.com/ Frame C0E0 0
0 137ms
44ms Document
text/html 147.75.32.125
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://vars.hotjar.com/box-469cf41adb11dc78be68c1ae7f9457a4.html
Requested by: Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-1312741.js?sv=7
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 147.75.32.125 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS: pkt-ams-k2-shared-ingress4
Software: /
Resource Hash

Request headers

:method: GET
:authority: vars.hotjar.com
:scheme: https
:path: /box-469cf41adb11dc78be68c1ae7f9457a4.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/

Response headers

status: 200
date: Fri, 25 Sep 2020 13:57:53 GMT
content-type: text/html
content-length: 851
last-modified: Mon, 17 Aug 2020 18:24:17 GMT
etag: "d594f1d4c3e5dbd6b556c60d34e0daea"
cache-control: max-age=31536000
content-encoding: br
section-io-origin-status: 200
section-io-origin-time-seconds: 0.045
section-origin-responded: true
age: 3327417
vary: Accept-Encoding
section-io-cache: Hit
accept-ranges: bytes
section-io-id: 0b2a9348f96399090ec419319b383c26

GET
H2 200 partners.js Show response
partner.shareaholic.com/ 0
265 B 419ms
152ms Script
application/javascript 107.20.147.136
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://partner.shareaholic.com/partners.js?location=https%3A%2F%2Fcofense.com%2Fcloser-look-qakbot-malware-dangerous%2F&cl=en-US&id_sync=25d6f7cb-1e46-46a5-9e2a-42c72a3d87e7&minify=1&pvs=1&site=62df9f201cc7c19a56912daae814efca
Requested by: Host: m9m6e2w5.stackpathcdn.com
URL: https://m9m6e2w5.stackpathcdn.com/v2/74ebab12/main.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 107.20.147.136 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-107-20-147-136.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Sep 2020 13:57:53 GMT
vary: Accept-Encoding, User-Agent
p3p: CP='OTI DSP COR DEVo ADMa OUR CONo IND COM INT ONL PUR STA OTC'
status: 200
cache-control: no-cache, no-store, must-revalidate
content-type: application/javascript;charset=utf-8
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 GMT

POST
H2 200 visit-data Show response
in.hotjar.com/api/v2/client/sites/1312741/ 178 B
321 B 188ms
67ms XHR
application/json 52.17.9.66
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://in.hotjar.com/api/v2/client/sites/1312741/visit-data?sv=7
Requested by: Host: script.hotjar.com
URL: https://script.hotjar.com/modules.94fbf54e63238ed34ad8.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.17.9.66 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-17-9-66.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 6154d5f7f6961e042d013bab33fd02b691970d873f44f3c32d8fcc6e79ef5bcd

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain; charset=UTF-8

Response headers

date: Fri, 25 Sep 2020 13:57:53 GMT
content-encoding: br
status: 200
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
access-control-max-age: 86400
access-control-allow-credentials: true

GET
H3-Q050 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/1061448384/ 2 KB
2 KB 42ms
29ms Script
text/javascript 2a00:1450:4001:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1061448384/?random=1601042273394&cv=9&fst=1601042273394&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa9g1&sendb=1&ig=1&data=event%3Doptimize.callback&frm=0&url=https%3A%2F%2Fcofense.com%2Fcloser-look-qakbot-malware-dangerous%2F&tiba=A%20Closer%20Look%20at%20Why%20the%20QakBot%20Malware%20Is%20So%20Dangerous%20-%20Cofense&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

768509b0da3973e0a6e2fcbb2ac882e5a284e2139d35eccd54ed99895051c03d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Sep 2020 13:57:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1083
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.com/pagead/1p-user-list/1061448384/ 42 B
288 B 21ms
20ms Image
image/gif 2a00:1450:4001:824::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/1061448384/?random=1601042273394&cv=9&fst=1601038800000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa9g1&sendb=1&data=event%3Doptimize.callback&frm=0&url=https%3A%2F%2Fcofense.com%2Fcloser-look-qakbot-malware-dangerous%2F&tiba=A%20Closer%20Look%20at%20Why%20the%20QakBot%20Malware%20Is%20So%20Dangerous%20-%20Cofense&async=1&fmt=3&is_vtc=1&random=3710640455&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:824::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Sep 2020 13:57:53 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.de/pagead/1p-user-list/1061448384/ 42 B
538 B 39ms
25ms Image
image/gif 2a00:1450:4001:818::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/1061448384/?random=1601042273394&cv=9&fst=1601038800000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa9g1&sendb=1&data=event%3Doptimize.callback&frm=0&url=https%3A%2F%2Fcofense.com%2Fcloser-look-qakbot-malware-dangerous%2F&tiba=A%20Closer%20Look%20at%20Why%20the%20QakBot%20Malware%20Is%20So%20Dangerous%20-%20Cofense&async=1&fmt=3&is_vtc=1&random=3710640455&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:818::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Sep 2020 13:57:53 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

tracking.png
tracking.leadlander.com/
Redirect Chain

https://tracking.leadlander.com/api/tracking?accountId=19612&page=https%3A%2F%2Fcofense.com%2Fcloser-look-qakbot-malware-dangerous%2F&referer=&fp=5d2f10942569cca69057fc09abaea819
https://tracking.leadlander.com/tracking.png

68 B
296 B

131ms
131ms

Image
image/png

35.171.71.143
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tracking.leadlander.com/tracking.png

Requested by

Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.171.71.143 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-35-171-71-143.compute-1.amazonaws.com

Software

Kestrel /

Resource Hash

69539b5b3777cffda28a66d7f2aa9b17c91ee1ec8fd50c00c442af91753a60f7

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Sep 2020 13:57:54 GMT
last-modified: Wed, 26 Sep 2018 16:48:51 GMT
server: Kestrel
etag: "1d455b8cd761bc4"
strict-transport-security: max-age=2592000
content-type: image/png
status: 200
cache-control: no-cache, no-store
accept-ranges: bytes
content-length: 68
expires: -1

Redirect headers

status: 302
date: Fri, 25 Sep 2020 13:57:54 GMT
server: Kestrel
access-control-allow-origin: *
location: /tracking.png
content-length: 0
strict-transport-security: max-age=2592000

GET
H/1.1 200
OK pd.js Show response
pi.pardot.com/ 5 KB
2 KB 528ms
128ms Script
application/javascript 35.174.151.106
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://pi.pardot.com/pd.js
Requested by: Host: cofense.com
URL: https://cofense.com/closer-look-qakbot-malware-dangerous/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.174.151.106 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: pi0-lba1-4-ue1.aws.pardot.com
Software: PardotServer /
Resource Hash: 925be107869153b6120de872c1ae333977bfaee69a0f7c6271f32d4a8348bca8

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 25 Sep 2020 13:57:54 GMT
Content-Encoding: gzip
X-Pardot-Route: ea50fcd3dcf777490e1499615b883deb
X-Pardot-LB: a5df88223e39cf9fcb783877fed82f24
Last-Modified: Fri, 13 Mar 2020 17:28:24 GMT
Server: PardotServer
ETag: "1442-gzip"
Vary: Accept-Encoding,User-Agent
Content-Type: application/javascript
Cache-Control: max-age=63072000
Accept-Ranges: bytes
Content-Length: 1842
Expires: Sun, 25 Sep 2022 13:57:54 GMT

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
652 B 271ms
173ms Script
application/javascript 104.244.42.3
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?type=javascript&version=1.1.0&p_id=Twitter&p_user_id=0&txn_id=nv828&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fcofense.com%2Fcloser-look-qakbot-malware-dangerous%2F

Requested by

Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.3 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:57:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
strict-transport-security: max-age=631138519
content-length: 57
x-xss-protection: 0
x-response-time: 121
pragma: no-cache
last-modified: Fri, 25 Sep 2020 13:57:54 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 6adad29d03dc0678266d67ff8c7ea5c5
x-transaction: 001f54ca0000ad46
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 index.html
js.driftt.com/deploy/assets/ Frame 8489 0
0 93ms
92ms Document
text/html 52.84.112.124
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/deploy/assets/index.html

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/include/1601042400000/28krvx2uf9n3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.84.112.124 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-84-112-124.sof50.r.cloudfront.net

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:method: GET
:authority: js.driftt.com
:scheme: https
:path: /deploy/assets/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/

Response headers

status: 200
content-type: text/html; charset=utf-8
content-length: 894
server: nginx
last-modified: Wed, 23 Sep 2020 21:24:15 GMT
x-amz-server-side-encryption: AES256
accept-ranges: bytes
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
strict-transport-security: max-age=31536000; includeSubDomains
date: Fri, 25 Sep 2020 13:57:54 GMT
etag: "b3bacd7d12e9518cae16b0ee4750f4e8"
cache-control: max-age=10
x-cache: Hit from cloudfront
via: 1.1 ec6357e657c548ad9e9ce985f638540c.cloudfront.net (CloudFront)
x-amz-cf-pop: SOF50-C1
x-amz-cf-id: gAIUxtoWHr2Jlrp7Xr3fjJKYRLyIuFpPeaK8Xwp_hmRHcmxqFAFcWQ==

GET
H/1.0 200
OK analytics Show response
pi.pardot.com/ 1 KB
1 KB 183ms
183ms Script
text/javascript 35.174.151.106
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://pi.pardot.com/analytics?ver=3&visitor_id=&visitor_id_sign=&pi_opt_in=&campaign_id=1564&account_id=47382&title=A%20Closer%20Look%20at%20Why%20the%20QakBot%20Malware%20Is%20So%20Dangerous%20-%20Cofense&url=https%3A%2F%2Fcofense.com%2Fcloser-look-qakbot-malware-dangerous%2F&referrer=
Requested by: Host: pi.pardot.com
URL: https://pi.pardot.com/pd.js
Protocol: HTTP/1.0
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.174.151.106 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: pi0-lba1-4-ue1.aws.pardot.com
Software: PardotServer /
Resource Hash: ba2ea83824fa4727e553d845e6a35e7d5337d51ab12b3fc371260f6195003432

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 25 Sep 2020 13:57:55 GMT
Content-Encoding: gzip
X-Pardot-Route: 13c7a24cfc43e49b0467af9964bf67ec
X-Pardot-LB: a5df88223e39cf9fcb783877fed82f24
X-Pardot-Rsp: 16/87/217
Vary: Accept-Encoding,User-Agent
P3p: CP="CAO DSP AND SO ON" policyref="/w3c/p3p.xml", CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT", policyref="/w3c/p3p.xml"
Cache-Control: no-store, no-cache, must-revalidate
Connection: keep-alive
Content-Type: text/javascript; charset=utf-8
Content-Length: 672
Server: PardotServer
Expires: Thu, 19 Nov 1981 08:52:00 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 2 B
141 B 13ms
13ms XHR
text/plain 2a00:1450:4001:821::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j86&aip=1&a=1608385319&t=event&ni=1&_s=1&dl=https%3A%2F%2Fcofense.com%2Fcloser-look-qakbot-malware-dangerous%2F&ul=en-us&de=UTF-8&dt=A%20Closer%20Look%20at%20Why%20the%20QakBot%20Malware%20Is%20So%20Dangerous%20-%20Cofense&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Drift%20Widget&ea=Playbook%20Fired&el=Playbook%20ID%3A%202045820&_u=aHDAAUADQAAAAG~&jid=108744131&gjid=1877106008&cid=299656550.1601042273&tid=UA-114787942-1&_gid=1570997550.1601042273&_r=1&gtm=2wg9g15RQ37KH&z=1800462089

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:821::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 25 Sep 2020 13:57:58 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
status: 200
content-type: text/plain
access-control-allow-origin: https://cofense.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 collect
www.google-analytics.com/ 35 B
192 B 6ms
5ms Image
image/gif 2a00:1450:4001:821::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j86&aip=1&a=1608385319&t=event&ni=1&_s=2&dl=https%3A%2F%2Fcofense.com%2Fcloser-look-qakbot-malware-dangerous%2F&ul=en-us&de=UTF-8&dt=A%20Closer%20Look%20at%20Why%20the%20QakBot%20Malware%20Is%20So%20Dangerous%20-%20Cofense&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Drift%20Widget&ea=Message%20Received&el=Playbook%20ID%3A%202045820&_u=aHDAAUADQAAAAG~&jid=&gjid=&cid=299656550.1601042273&tid=UA-114787942-1&_gid=1570997550.1601042273&gtm=2wg9g15RQ37KH&z=1595744874

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:821::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Sep 2020 11:27:34 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 9024
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
69 B 16ms
15ms XHR
text/plain 2a00:1450:400c:c0c::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j86&tid=UA-114787942-1&cid=299656550.1601042273&jid=108744131&gjid=1877106008&_gid=1570997550.1601042273&_u=aHDAAUADQAAAAG~&z=270821363

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c0c::9c Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Fri, 25 Sep 2020 13:57:58 GMT
status: 200
content-type: text/plain
access-control-allow-origin: https://cofense.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
106 B 29ms
28ms Image
image/gif 2a00:1450:4001:824::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j86&tid=UA-114787942-1&cid=299656550.1601042273&jid=108744131&_u=aHDAAUADQAAAAG~&z=459488201

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Sep 2020 13:57:58 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
106 B 29ms
29ms Image
image/gif 2a00:1450:4001:818::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j86&tid=UA-114787942-1&cid=299656550.1601042273&jid=108744131&_u=aHDAAUADQAAAAG~&z=459488201

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Sep 2020 13:57:58 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 collect
www.google-analytics.com/ 35 B
62 B 6ms
6ms Image
image/gif 2a00:1450:4001:820::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j86&aip=1&a=1608385319&t=event&ni=1&_s=3&dl=https%3A%2F%2Fcofense.com%2Fcloser-look-qakbot-malware-dangerous%2F&ul=en-us&de=UTF-8&dt=A%20Closer%20Look%20at%20Why%20the%20QakBot%20Malware%20Is%20So%20Dangerous%20-%20Cofense&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Drift%20Widget&ea=Message%20Received&el=Playbook%20ID%3A%202045820&_u=aHDAAUADQAAAAG~&jid=&gjid=&cid=299656550.1601042273&tid=UA-114787942-1&_gid=1570997550.1601042273&gtm=2wg9g15RQ37KH&z=1833802290

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:820::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Sep 2020 14:29:39 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 84500
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 collect
www.google-analytics.com/ 35 B
57 B 6ms
6ms Image
image/gif 2a00:1450:4001:820::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j86&aip=1&a=1608385319&t=event&ni=1&_s=4&dl=https%3A%2F%2Fcofense.com%2Fcloser-look-qakbot-malware-dangerous%2F&ul=en-us&de=UTF-8&dt=A%20Closer%20Look%20at%20Why%20the%20QakBot%20Malware%20Is%20So%20Dangerous%20-%20Cofense&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Drift%20Widget&ea=Message%20Received&el=Playbook%20ID%3A%202045820&_u=aHDAAUADQAAAAG~&jid=&gjid=&cid=299656550.1601042273&tid=UA-114787942-1&_gid=1570997550.1601042273&gtm=2wg9g15RQ37KH&z=1220069131

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:820::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Sep 2020 14:29:39 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 84500
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 collect
www.google-analytics.com/ 35 B
62 B 6ms
6ms Image
image/gif 2a00:1450:4001:820::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j86&aip=1&a=1608385319&t=event&ni=1&_s=5&dl=https%3A%2F%2Fcofense.com%2Fcloser-look-qakbot-malware-dangerous%2F&ul=en-us&de=UTF-8&dt=A%20Closer%20Look%20at%20Why%20the%20QakBot%20Malware%20Is%20So%20Dangerous%20-%20Cofense&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Drift%20Widget&ea=Message%20Received&el=Playbook%20ID%3A%202045820&_u=aHDAAUADQAAAAG~&jid=&gjid=&cid=299656550.1601042273&tid=UA-114787942-1&_gid=1570997550.1601042273&gtm=2wg9g15RQ37KH&z=2004178053

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:820::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://cofense.com/closer-look-qakbot-malware-dangerous/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Sep 2020 14:29:39 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 84501
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

208 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.cofense.com/	1970-01-19 12:44:02	Name: _gat_UA-114787942-1 Value: 1

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1(Line 2) Message: JQMIGRATE: Migrate is installed, version 1.4.1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

analytics.shareaholic.com
analytics.twitter.com
cofense.com
dsms0mj1bbhn4.cloudfront.net
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
in.hotjar.com
js.driftt.com
m9m6e2w5.stackpathcdn.com
partner.shareaholic.com
pi.pardot.com
px.ads.linkedin.com
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com
script.hotjar.com
snap.licdn.com
static.ads-twitter.com
static.hotjar.com
stats.g.doubleclick.net
t.co
t.sf14g.com
tracking.leadlander.com
use.fontawesome.com
vars.hotjar.com
ws.zoominfo.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.linkedin.com
www.shareaholic.net
104.16.101.12
104.244.42.3
104.244.42.5
107.20.147.136
108.161.188.228
147.75.102.197
147.75.102.203
147.75.32.125
151.101.112.157
151.139.128.11
172.217.18.2
184.73.100.94
23.111.9.35
2600:9000:2057:3e00:c:d51b:4400:21
2620:1ec:21::14
2a00:1450:4001:802::200a
2a00:1450:4001:817::2002
2a00:1450:4001:818::2003
2a00:1450:4001:81a::2008
2a00:1450:4001:820::200e
2a00:1450:4001:821::200e
2a00:1450:4001:824::2004
2a00:1450:4001:825::2003
2a00:1450:400c:c0c::9c
2a02:26f0:4700:1a2::25ea
2a05:f500:10:101::b93f:9105
35.171.71.143
35.174.151.106
35.188.168.180
52.17.9.66
52.22.109.130
52.84.112.124
01047f6f2af472213a6b11d2517feb5f792ac86eb0ce91772b317a54e00f2a38
0270df20975d3a7de06fa0fa42b02a43d28eb710037f42beb293215ffe763840
031a0b0af9a1a3d9e277bc8da460e850f7bfef590b9b0b70aa60bbe4cc994433
0b0200866fae3fcc0c3f1acf6d8dc18fb93ce8b7a55cc7fbc31b231b01764ddb
0d9fd7ccabde9b202de45ee6b65878ce9594975d8e8810b0878d3f3fa3637d0e
0f3ffa7f0b928b893a75953b1b233b2bf8dc84f94851a6d24225a59d862c270b
102f598e077a43ea681594e0750b0e835960f288bada922fff4107785b3c7e31
12a5ec5674ef088f8c198091b7eb6d0478cf5aae6465c09634abae505332d149
133b08f5be6a7b534f17c80319259b0f5f2ec68de6f86e1417d247327570cf7f
14c52b4f1daa1aa3a92d960a311d4518da07e80b7b1a443d3f1a55c0968c99a0
15ffa4319971385160ecc0bd1d53a66ed4c9ef1a937b2a6880cb28bde1aacc66
185659ffe9d121675c69f00a89a8c7686051c56817d5ebc0348898b6cac9004a
1a71c8fe9799162a1bbb1faf1f7e60c7db8e90eb15779a9b6b1bf4e0812890f3
1b889b5222373b8a0485f3fb325564e3b2b017a6cbb518d12a045a407d1eca83
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df
1e6c1037c61147de087c99ee388b95a27833e77e820875f0fadcb64039abdb3b
1f06022fcac113c5545fdc9758d177bae67a4e1735877596375b73858886f152
201ac106aa78dbaf7062e570803b878ae8d4e909608bc19dc77bdfdc39fe85d0
21110fa48987dc5804b08b84e1008e7c922f7b028c6291c64a6845fbb868014f
293c1f5f923e599f3adadeb96b2367c11f890343508c57b2c905d1c91d2a07ea
2979bcd7bb97e9497fb83323c2a5c9696b3fb33fdbd0782be7810d78a79a888d
2cf13ef8a0e548d45203297ecc6e21ad5f82fe24e759acbf9a9600996aa4528c
2f646c0b23cd81ccb0a37a96186572b394b4e2dfd4974da05559d7381d5989a4
347cd2766d64da2e2d3ba740c9b07659352d583fd5e42a3d6b794acd43748129
368daab67b1a5b2b2802edbbac79a2aa4ba992a2ebf9c67b98ad784d8004018c
36e0a7e08bee65774168528938072c536437669c1b7458ac77976ec788e4439c
3be0a916496d7936bb83ce60a4de9f10ef400f16c38e7dd7c65449c795e7739b
46e6f42a22054a793841935920cbbc723856e339fead50fa33c1f1bb3ec5a251
4815d1377f9b925557aec4a141c1cc6053e20167e6b36c19fecfd083fb4c9aa4
48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d
4dc068edecd14f25d56b1f3093a42c9162e0f66a937827f0f1392359094e1208
5c722519d5b20bb22f0453889d36e0ba6ce9bd967d93fbbe7a9682d31cf31be5
5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479
5d9190292acdd48ba0fc35080f7e7448f3cdf0d79199a4d23f0f49b5341fdf29
60863e86aa7743d1ac841da7f473a05cd57fba81d661cef658e385437f80d5ef
6154d5f7f6961e042d013bab33fd02b691970d873f44f3c32d8fcc6e79ef5bcd
643ced756fe32f82d14c178ac0002a181a12d128402bd63b9b74c3cbdd85e66a
69539b5b3777cffda28a66d7f2aa9b17c91ee1ec8fd50c00c442af91753a60f7
6c9459a6400a8cf7ef815379f9316dc26aeec43bcc48da1d1bd58d99a6109f7b
6ebcda7a3a41ef97f0b4071160ceb1020e540fdc0f790079a5c2ef01ab654fe0
6f3af746d7b6b55cd157863dce65e89532542c8f89bc23d0a3209891eaecb39c
71209f63fc1592e55fcff12d74e9f6108505190c6e70df5cc7d5748af32b9365
759e691e4926ce31adf9e9ed380dacb937b3024aae7b95d21106fe44c154d93f
768509b0da3973e0a6e2fcbb2ac882e5a284e2139d35eccd54ed99895051c03d
77af2e2e20765a4a6cf514dc9fb85c24fc9e81b5c38fc35952504a9ad0b1e9ab
7bc1dc7d2a673a36a6e7b3d26c7fd8f5cc42d8b2d41a98e4de2a5ebdaaea9bf7
7c56a3f07142400af288d25373dc18e436d73f6d44b6b5affeadd1b9cfe8dbf2
7f4d3fd0a705dbf8403298aad91d5de6972e6b5d536068eba8b24954a5a0a8c7
7fd52abcc46a46e1d1f39cf3677e2a581b4365872258b5fbc5e28eb183fb6410
8247f4332667950989fe6bf790f87723343db2ec83d975503e9c5dc13a6eb5dc
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
83f6604f4c4ca11246131304ec9a76d75e3b2db2ece8a477c4f0bf580b26a093
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
86ecafc33ecb5976760d6b5f13a2874525e3f4bfa8b12a0e14d6c98ae9e727cd
876d023d9d10c97941b80c3b03e2a5b94631ff7a4af9cee5604a6a2d39718d84
88b758789019407fc4c2461c0d188aa776cb4b72d759e3c670b73d68fabf383a
8ae0b825cbd28b33ce1a6c0e4186a66db849ee52428206e910bee32b23ab9958
8b950c87c8fcca9e5a47bbe6143f7a2df9a783faf9a11b07559d35a7adddb504
8c3f327cab31c3d02e5bf8d08bac753e210f1f12588a1197226bccff955a0df9
925be107869153b6120de872c1ae333977bfaee69a0f7c6271f32d4a8348bca8
94df22701bd80fca42c776b7064a4505986161b616007963e1ba60adba6f84d5
98984bbc9d46fc5e6ef61b1882e77303377713b957b6ef0f8475ceca54dc6c18
a05ce29b1660d2755713106d272474ec04a2524269517b23603f325230d2d4c9
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a37ca4608218cccdfb8b6d4edbdfbf375d0e1368b46397e3b7049e0cbf5bc1f6
a3dba71be49f748736ef65cd4f61f4690f653961412384dab978fdd7b2a061a5
a58e130d9d84e9a93af8a9452ddcecaab125d1f8df1f309d6bfde50f0378409e
a5e260f8d1d46595c71cf35eb09243ef8ee32453ff9fe49ea9c5ac6d3919f721
a6af364fb8e276d03bfe9825850586949491fe630a22df21bb7c9cbb9549d708
a6dcb2582661566fdc1517014d9eea855588c2a8409067eca719b8bb1da475dc
a793c61791a121a6b278e220effd29e55aa61c44c559843630081b5ab99a7e22
a8431bfe4316cdc20de936e824f735c9478bbc9ce3d3a51c774eca45faff637f
a9f6c03ce6f4d1654f29f2136651e883198d509cb2e26af1c24b1f87b6ccae13
abee3b66f6dd218919cfb15e9be9c474bc2797a331ff3d27659bb857468efda5
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ad28cf25206c57cd337861b73a3ad8321068c19b7456f997f09680940a07076a
b3fd2bd251945091f3e856b2d244d662e7980d715b6d7f1722fde67e6dd321ef
b4c873f99c6d9811d0b8663a59007825e1dd511a54336f08bac1df3a80a3fe29
ba2ea83824fa4727e553d845e6a35e7d5337d51ab12b3fc371260f6195003432
bca7af0b45b6fc6a2064e8e7a34f2041f3e77261e63f0257209bcde6bc40545d
bcf6b9b28cec8958f9d3f3ee39070e85ffd46d670f1f0baa7cd21aa24c188a00
be854277e60b095845c52d0b79a37e0d9adf3e2cb9ad93b20e757a18860c42dc
bf3ac74b1daf2f65acd123805dc98026f54cce1fd0db0648f2650468e3e45121
bfe8ebbb9a154092de88c4c438e3721fe9622818aaa98a8852bb02550cd8342f
c066d830135d79d0b9aa4500ec1ba098dc25e08f606bcd9505fa94cb420c616b
c08632b4ad71fd912cff6d4bc38b3475554d10d67cd2d1ccbd31998bf48b14e8
c099ef1698e45cdc519a61e09f5415075be00229176a84387850b3732f4fdc3c
c0ded025aa80c10d37920521c8de04536a6145d0e42eb4186c57b412fa50eb45
c4af296b65d25387b38e738018ce430397082b09449a7ce8da08baaa53c4c77d
c95b879561e19ae45fa002f19fab5a8d1b0ca8c9f975409eb3abd829cf83031d
ca57cc407c7eefa8e3901cc501b0988fdefbea8a5c2043cf9178dacbd4c197f9
cb4c5423bc39004de027965fcbbd5ebc999165fa31f9eb7af74a4e254cbf2025
ce897833ac6e362df7c91ac8223fe511c6defcf33964928a81004600a2dd4c2e
cfa1739ee346d63a3d3cfdff8c18cbe8fdedbcb32d4b0895028c193ce828e7a5
d2caf4e20c60ec1b01fb2b59d947b111d50d667850f9ef13af194183f0574bed
d2dcdaca89cc8422fd1d1ab405630bd6a5e6dd4adebe8723a11ed050a60461c4
d7dd05bfc68901dbb2c883a7bd65698c29b3917d61f0e12d1966dca14d5056c0
dbb66a357d226e1ffed77b285e2fcbf386d4e37434f3048bdacefd3f1975efc6
dc83f496595b1d3b55fd6aeae76471a9d89284e1026849b5ab805bc3e8116739
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
e066e27304a41a9bd1eba18c512de3e7bc743488f4002fe21b97b222a822a9c4
e13c8733b82140ef6edef5f6ce96c0387419b93dd9b73fab8807a43a09d1fd73
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e89fa95988dcf7bf63bc92866b4ebd12c7ededfda65f8040105b51cb41f0414e
ee4b99a20bdc97642e5c23b2cb0bc8c83220985dac4c0f4bcffcf40fef944e58
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f10b9b0c4107ca5a40a5c69b1ac91a8948d84f39893dee6b429cdbdb05887093
f498997e7a39cb345fb129f9158745de59167f8aee78cc573554bd2f5dbc92c7
f4f38c2e3b869558658a4303d42a3a0fc5f81ad2e72517be88f22da35c617b6f
f6fa548f3755570ef254a6b934091fcd2634717a57060511fd414a704e7dc95c
fb192c1648b3f3f1d33c7cb0dc247f98d32e9995731598adb483fd34e25a5083
fde4dd0ab5add3a76f91f880c510718310cdf21d8fed6e65b5bd0a624a02ea69
fdf1d02d0e923da1e187476e11f688c61482e25abba482b857674fbb3d79ef45

cofense.com Open in urlscan Pro 35.188.168.180 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

130 Requests

100 %HTTPS

41 %IPv6

26 Domains

32 Subdomains

31 IPs

7 Countries

2782 kBTransfer

5526 kBSize

1 Cookies

20 Outgoing links

Redirected requests

130 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

cofense.com Open in urlscan Pro
35.188.168.180 Public Scan

Screenshot
Live screenshot

Full Image

130
Requests

100 %
HTTPS

41 %
IPv6

26
Domains

32
Subdomains

31
IPs

7
Countries

2782 kB
Transfer

5526 kB
Size

1
Cookies

130 HTTP transactions
0 data transactions