www.malwarebytes.com Open in urlscan Pro
192.0.66.233  Public Scan

41 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

72 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
4 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request new-metastealer-malvertising-campaigns Show response www.malwarebytes.com/blog/threat-intelligence/2023/12/	352 KB 79 KB	21ms 6ms	Document text/html	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://www.malwarebytes.com/blog/threat-intelligence/2023/12/new-metastealer-malvertising-campaigns Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash bc46d4cdf270a8531ff7c7728c9249c660442768552b0fd169b4f688e459f1e6 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options DENY Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers accept-ranges bytes age 313 cache-control max-age=300, must-revalidate content-encoding br content-length 80759 content-type text/html; charset=UTF-8 date Thu, 11 Jan 2024 15:07:27 GMT host-header a9130478a60e5f9135f765b23f26593b link <https://www.malwarebytes.com/wp-json/>; rel="https://api.w.org/" <https://www.malwarebytes.com/wp-json/wp/v2/posts/101050>; rel="alternate"; type="application/json" <https://www.malwarebytes.com/?p=101050>; rel=shortlink referrer-policy strict-origin-when-cross-origin server nginx strict-transport-security max-age=31536000 vary Accept-Encoding x-cache hit x-content-type-options nosniff x-frame-options DENY x-rq hhn2 96 184 443
GET H2	200	/ www.malwarebytes.com/_static/	276 KB 50 KB	10ms 8ms	Stylesheet text/css	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://www.malwarebytes.com/_static/??-eJyNjEEKgDAMBD+kRqsgHsS3pBqx0LTSREp/b8EPeFxmZiHf7R6DUlDQi5gEGH3GRLZoHShCKmAf549KXOh2kQb+Vd7ZhKlATeCseouZJDJ1/P1svA5zP83GLP34Al5dMxQ= Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/new-metastealer-malvertising-campaigns Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash ce05657f272fa45daa8878d0c75209bffabe8b859c29e9d1f841a5e074f91708 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://www.malwarebytes.com/blog/threat-intelligence/2023/12/new-metastealer-malvertising-campaigns User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers date Thu, 11 Jan 2024 15:07:27 GMT content-encoding br strict-transport-security max-age=31536000 last-modified Mon, 08 Jan 2024 14:08:23 GMT server nginx x-rq hhn2 96 184 443 vary Accept-Encoding x-cache HIT content-type text/css;charset=utf-8 cache-control max-age=31536000
GET H2	200	gtm.js Show response www.googletagmanager.com/	384 KB 116 KB	179ms 61ms	Script application/javascript	2a00:1450:4001:80f::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-MKSKW3 Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/new-metastealer-malvertising-campaigns Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash cc2466ec4133b7824522b234a667e3c4b0bc0dbb01a64146e66b6f7d96f0e6e1 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.malwarebytes.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers date Thu, 11 Jan 2024 15:07:27 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true cross-origin-resource-policy cross-origin access-control-allow-headers Cache-Control content-length 118874 x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 expires Thu, 11 Jan 2024 15:07:27 GMT
GET H2	200	script.js Show response plausible.io/js/	1 KB 1 KB	70ms 23ms	Script application/javascript	2400:52e0:1e00::1080:1 BUNNYCDN
General Check archive.org Show headers Download Go to Full URL https://plausible.io/js/script.js Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/new-metastealer-malvertising-campaigns Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2400:52e0:1e00::1080:1 , Germany, ASN200325 (BUNNYCDN, SI), Reverse DNS Software BunnyCDN-DE1-1080 / Resource Hash 021f0fd27042b279a49e982215c6dc3c3ab84e95b35553a119dfdbd50af6be94 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.malwarebytes.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers date Thu, 11 Jan 2024 15:07:27 GMT content-encoding br x-content-type-options nosniff cdn-edgestorageid 1081 cdn-cachedat 01/11/2024 13:20:20 cdn-pullzone 682664 cross-origin-resource-policy cross-origin application 10.0.1.2 alt-svc h3=":443"; ma=2592000 server BunnyCDN-DE1-1080 cdn-proxyver 1.04 cdn-requestpullcode 200 vary Accept-Encoding, Accept-Encoding content-type application/javascript access-control-allow-origin * cdn-cache HIT cdn-uid 153cb5b1-399a-48ef-b5bf-098c03770254 cache-control public, must-revalidate, max-age=86400 permissions-policy interest-cohort=() cdn-requestid f2d01ac4062cde2436dc3a27defceb34 cdn-requestcountrycode DE cdn-status 200 cdn-requestpullsuccess True
GET H2	200	product-menu-screen.webp www.malwarebytes.com/wp-content/uploads/sites/2/2023/09/	16 KB 16 KB	10ms 9ms	Image image/webp	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://www.malwarebytes.com/wp-content/uploads/sites/2/2023/09/product-menu-screen.webp?w=356 Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/new-metastealer-malvertising-campaigns Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 2fc88556de1ebed9f55afb87d495d90d43f939a515f3afa5d59e953b8fc0ab20 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://www.malwarebytes.com/blog/threat-intelligence/2023/12/new-metastealer-malvertising-campaigns User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers date Thu, 11 Jan 2024 15:07:27 GMT strict-transport-security max-age=31536000 x-rq hhn2 109 195 443 last-modified Wed, 08 Nov 2023 01:04:49 GMT server nginx etag "99a2a2e0844c2dfe" vary Accept x-cache HIT content-type image/webp cache-control max-age=31536000 accept-ranges bytes content-length 16616
GET H2	200	malwarebytes-state-of-malware-report-2023.jpg www.malwarebytes.com/wp-content/uploads/sites/2/2023/07/	72 KB 72 KB	10ms 8ms	Image image/jpeg	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://www.malwarebytes.com/wp-content/uploads/sites/2/2023/07/malwarebytes-state-of-malware-report-2023.jpg Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/new-metastealer-malvertising-campaigns Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 32a0ce8663059aa406b6a9e8d569b840ee324c6af0f97c57d98ec1a6b6286b01 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://www.malwarebytes.com/blog/threat-intelligence/2023/12/new-metastealer-malvertising-campaigns User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers date Thu, 11 Jan 2024 15:07:27 GMT strict-transport-security max-age=31536000 x-rq hhn2 109 32 443 last-modified Mon, 30 Oct 2023 19:40:32 GMT server nginx etag "0f1fd79d974f3f8c" vary Accept x-cache HIT content-type image/jpeg cache-control max-age=300 accept-ranges bytes content-length 73655
GET H2	200	metastealer.png www.malwarebytes.com/wp-content/uploads/sites/2/2023/12/	28 KB 28 KB	10ms 9ms	Image image/webp	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://www.malwarebytes.com/wp-content/uploads/sites/2/2023/12/metastealer.png Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/new-metastealer-malvertising-campaigns Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash b67dfe8e9f236468f2cc62d6925e61bacbfa0252a93396accac8c86d9341e99e Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://www.malwarebytes.com/blog/threat-intelligence/2023/12/new-metastealer-malvertising-campaigns User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers date Thu, 11 Jan 2024 15:07:27 GMT strict-transport-security max-age=31536000 x-rq hhn2 109 84 443 last-modified Tue, 19 Dec 2023 23:28:33 GMT server nginx etag "719f0506762e6a78" vary Accept x-cache HIT content-type image/webp cache-control max-age=31536000 accept-ranges bytes content-length 28806
GET H2	200	image-11.png www.malwarebytes.com/wp-content/uploads/sites/2/2023/12/	23 KB 23 KB	10ms 9ms	Image image/webp	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://www.malwarebytes.com/wp-content/uploads/sites/2/2023/12/image-11.png Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/new-metastealer-malvertising-campaigns Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash bc96438dea405ef1203394d85837cdc1ad45ef4f2c7d5853814722473b7c35a6 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://www.malwarebytes.com/blog/threat-intelligence/2023/12/new-metastealer-malvertising-campaigns User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers date Thu, 11 Jan 2024 15:07:27 GMT strict-transport-security max-age=31536000 x-rq hhn2 109 198 443 last-modified Tue, 19 Dec 2023 23:28:33 GMT server nginx etag "b5035b6b0ac13d1b" vary Accept x-cache HIT content-type image/webp cache-control max-age=31536000 accept-ranges bytes content-length 23146
GET H/1.1	200 OK	embed.js Show response malwarebytesunpacked.disqus.com/	79 KB 26 KB	37ms 8ms	Script application/javascript	199.232.196.134 FASTLY
General Check archive.org Show headers Download Go to Full URL https://malwarebytesunpacked.disqus.com/embed.js Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/new-metastealer-malvertising-campaigns Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 199.232.196.134 , United States, ASN54113 (FASTLY, US), Reverse DNS Software openresty / Resource Hash 13bc48192dd5e0b8bb130e1e1d0184825d3a1f7d123c8f4d6a8e6029203d602d Security Headers Name Value Strict-Transport-Security max-age=300; includeSubdomains Request headers accept-language de-DE,de;q=0.9 Referer https://www.malwarebytes.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers Date Thu, 11 Jan 2024 15:07:27 GMT content-encoding gzip Strict-Transport-Security max-age=300; includeSubdomains server openresty Age 26 Vary Accept-Encoding content-type application/javascript; charset=utf-8 Cache-Control private, max-age=60 x-service router Cross-Origin-Resource-Policy cross-origin Connection keep-alive Link <https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect Content-Length 26123
GET H2	200	footer-globe.svg www.malwarebytes.com/wp-content/themes/malwarebytes/assets/src/images/	4 KB 2 KB	10ms 9ms	Image image/svg+xml	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://www.malwarebytes.com/wp-content/themes/malwarebytes/assets/src/images/footer-globe.svg Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/new-metastealer-malvertising-campaigns Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 17844b6e32a1300ba44a13e98c650fe16e4759364491b8161510e28aa648e79e Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://www.malwarebytes.com/blog/threat-intelligence/2023/12/new-metastealer-malvertising-campaigns User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers date Thu, 11 Jan 2024 15:07:27 GMT content-encoding br strict-transport-security max-age=31536000 last-modified Mon, 21 Aug 2023 16:24:11 GMT server nginx x-rq hhn2 96 184 443 etag W/"64e38fab-103f" vary Accept-Encoding x-cache HIT content-type image/svg+xml cache-control max-age=31536000
GET H/1.1	200 OK	count.js Show response malwarebytesunpacked.disqus.com/	1 KB 2 KB	43ms 15ms	Script application/javascript	199.232.196.134 FASTLY
General Check archive.org Show headers Download Go to Full URL https://malwarebytesunpacked.disqus.com/count.js Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/new-metastealer-malvertising-campaigns Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 199.232.196.134 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 3487ef2baf0c08ba660a8a143cdeb8ebeec961eea04bccd7c49096b4eb26b875 Security Headers Name Value Strict-Transport-Security max-age=300; includeSubdomains X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.malwarebytes.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers Date Thu, 11 Jan 2024 15:07:27 GMT Content-Encoding gzip X-Content-Type-Options nosniff Strict-Transport-Security max-age=300; includeSubdomains X-Amz-Cf-Pop DFW3-C1 Age 98 Cross-Origin-Resource-Policy cross-origin Connection keep-alive Content-Length 871 X-XSS-Protection 1; mode=block Last-Modified Tue, 02 Jan 2024 14:37:25 GMT Server nginx ETag "65941fa5-367" Vary Accept-Encoding Content-Type application/javascript; charset=utf-8 Cache-Control public, max-age=300 Link <https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect X-Amz-Cf-Id Pl_V38_XD4Ct4UvT569BhBLfdYFv1lNEZBsbmeRt1gIo5dva2w_E7w==
GET H2	200	jquery.min.js Show response www.malwarebytes.com/wp-includes/js/jquery/	86 KB 31 KB	10ms 9ms	Script application/javascript	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://www.malwarebytes.com/wp-includes/js/jquery/jquery.min.js?ver=1.0 Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/new-metastealer-malvertising-campaigns Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://www.malwarebytes.com/blog/threat-intelligence/2023/12/new-metastealer-malvertising-campaigns User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers date Thu, 11 Jan 2024 15:07:27 GMT content-encoding br strict-transport-security max-age=31536000 last-modified Wed, 06 Dec 2023 23:24:04 GMT server nginx x-rq hhn2 96 184 443 etag W/"65710294-15601" vary Accept-Encoding x-cache HIT content-type application/javascript cache-control max-age=31536000
GET H2	200	/ Show response www.malwarebytes.com/_static/	15 KB 5 KB	10ms 10ms	Script application/javascript	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://www.malwarebytes.com/_static/??-eJyVy0sOgCAMANELiQU3xIXxLEVqhPAxtIZ4e7mCy8nkQb/VUYtQEZCLMjFkTB0buVdGIDMJg3tC8uOEMkee4A86G5HytZdU0Q+9581YvaxGW23jB1QwLyg= Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/new-metastealer-malvertising-campaigns Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash d6693d78eb6f5c5e5ed5edaf6ecebad27225578f87a9e46e0876ca90093dc6c8 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://www.malwarebytes.com/blog/threat-intelligence/2023/12/new-metastealer-malvertising-campaigns User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers date Thu, 11 Jan 2024 15:07:27 GMT content-encoding br strict-transport-security max-age=31536000 last-modified Mon, 18 Dec 2023 14:45:07 GMT server nginx x-rq hhn2 96 184 443 vary Accept-Encoding x-cache HIT content-type application/javascript cache-control max-age=31536000
GET H2	200	e-202402.js Show response stats.wp.com/	7 KB 3 KB	34ms 4ms	Script application/javascript	192.0.76.3 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://stats.wp.com/e-202402.js Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/new-metastealer-malvertising-campaigns Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 4f9f4e2e225088f9cf3b6b54aa421e0f776d1802255505d2f752e1f83f441641 Request headers accept-language de-DE,de;q=0.9 Referer https://www.malwarebytes.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers x-minify-cache hit x-nc HIT hhn date Thu, 11 Jan 2024 15:07:27 GMT content-encoding br server nginx x-minify t etag W/14377-1704402358485.9985 vary Accept-Encoding access-control-allow-methods GET, HEAD content-type application/javascript access-control-allow-origin * cache-control max-age=31536000 alt-svc h3=":443"; ma=86400 expires Sun, 05 Jan 2025 21:20:19 GMT
GET DATA	200 OK	truncated /	577 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash b556aa0c99a333220bef9718a277f81139f356534c0c707430252f445f769b8b Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	436 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 242aa88120783594cb0c56ff247407db601e2a09c4f598f7c7d40b9b2ba6369e Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	1 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 63ccbd40f783b34fe6bc9ef9e971de08e32012b91ee81dd54b325ecf527c1dac Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	1 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash c2bf4235c36480dd023ae5a3161be4b1d3c5f4728c753788d43530cece558812 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers Content-Type image/svg+xml
GET H2	200	Roboto-Regular.b009a76a.woff2 www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/	15 KB 16 KB	15ms 14ms	Font application/font-woff2	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/Roboto-Regular.b009a76a.woff2 Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/new-metastealer-malvertising-campaigns Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://www.malwarebytes.com/blog/threat-intelligence/2023/12/new-metastealer-malvertising-campaigns Origin https://www.malwarebytes.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers date Thu, 11 Jan 2024 15:07:27 GMT strict-transport-security max-age=31536000 x-rq hhn2 96 184 443 last-modified Mon, 21 Aug 2023 16:24:11 GMT server nginx etag "64e38fab-3d80" x-cache HIT content-type application/font-woff2 access-control-allow-origin * access-control-allow-methods GET, HEAD cache-control max-age=31536000 accept-ranges bytes content-length 15744
GET H2	200	Graphik-Regular.3fdd19ea.woff2 www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/	38 KB 38 KB	16ms 15ms	Font application/font-woff2	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/Graphik-Regular.3fdd19ea.woff2 Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/new-metastealer-malvertising-campaigns Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 9e1c5b7f15bcd940814677515f306113aa93921b6e7f0d184a6de904d07b6f43 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://www.malwarebytes.com/blog/threat-intelligence/2023/12/new-metastealer-malvertising-campaigns Origin https://www.malwarebytes.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers date Thu, 11 Jan 2024 15:07:27 GMT strict-transport-security max-age=31536000 x-rq hhn2 96 184 443 last-modified Mon, 21 Aug 2023 16:24:11 GMT server nginx etag "64e38fab-97a8" x-cache HIT content-type application/font-woff2 access-control-allow-origin * access-control-allow-methods GET, HEAD cache-control max-age=31536000 accept-ranges bytes content-length 38824
GET H2	200	Graphik-Medium.3ff48deb.woff2 www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/	42 KB 42 KB	16ms 15ms	Font application/font-woff2	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/Graphik-Medium.3ff48deb.woff2 Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/new-metastealer-malvertising-campaigns Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash fc4c4327594c7559168718f24efe82754660fdd55f62aa796baefee1e9b8d3d3 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://www.malwarebytes.com/blog/threat-intelligence/2023/12/new-metastealer-malvertising-campaigns Origin https://www.malwarebytes.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers date Thu, 11 Jan 2024 15:07:27 GMT strict-transport-security max-age=31536000 x-rq hhn2 96 184 443 last-modified Mon, 21 Aug 2023 16:24:11 GMT server nginx etag "64e38fab-a738" x-cache HIT content-type application/font-woff2 access-control-allow-origin * access-control-allow-methods GET, HEAD cache-control max-age=31536000 accept-ranges bytes content-length 42808
GET H2	200	Graphik-Semibold.b023d334.woff2 www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/	42 KB 42 KB	16ms 15ms	Font application/font-woff2	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/Graphik-Semibold.b023d334.woff2 Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/new-metastealer-malvertising-campaigns Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 33441b6e44fb33343a5769858ca65653ce482e5e0c58c6eb1cee0e50aa06ddf6 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://www.malwarebytes.com/blog/threat-intelligence/2023/12/new-metastealer-malvertising-campaigns Origin https://www.malwarebytes.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers date Thu, 11 Jan 2024 15:07:27 GMT strict-transport-security max-age=31536000 x-rq hhn2 96 184 443 last-modified Mon, 21 Aug 2023 16:24:11 GMT server nginx etag "64e38fab-a63c" x-cache HIT content-type application/font-woff2 access-control-allow-origin * access-control-allow-methods GET, HEAD cache-control max-age=31536000 accept-ranges bytes content-length 42556
GET H2	200	Roboto-Bold.227c9319.woff2 www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/	15 KB 16 KB	16ms 15ms	Font application/font-woff2	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/Roboto-Bold.227c9319.woff2 Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/new-metastealer-malvertising-campaigns Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://www.malwarebytes.com/blog/threat-intelligence/2023/12/new-metastealer-malvertising-campaigns Origin https://www.malwarebytes.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers date Thu, 11 Jan 2024 15:07:27 GMT strict-transport-security max-age=31536000 x-rq hhn2 96 184 443 last-modified Mon, 21 Aug 2023 16:24:11 GMT server nginx etag "64e38fab-3df4" x-cache HIT content-type application/font-woff2 access-control-allow-origin * access-control-allow-methods GET, HEAD cache-control max-age=31536000 accept-ranges bytes content-length 15860
GET H2	200	Roboto-Medium.f25d774e.woff2 www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/	16 KB 16 KB	16ms 16ms	Font application/font-woff2	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/Roboto-Medium.f25d774e.woff2 Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/new-metastealer-malvertising-campaigns Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://www.malwarebytes.com/blog/threat-intelligence/2023/12/new-metastealer-malvertising-campaigns Origin https://www.malwarebytes.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers date Thu, 11 Jan 2024 15:07:27 GMT strict-transport-security max-age=31536000 x-rq hhn2 96 184 443 last-modified Mon, 21 Aug 2023 16:24:11 GMT server nginx etag "64e38fab-3e30" x-cache HIT content-type application/font-woff2 access-control-allow-origin * access-control-allow-methods GET, HEAD cache-control max-age=31536000 accept-ranges bytes content-length 15920
GET H2	200	Roboto-Black.2e8becfc.woff2 www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/	15 KB 16 KB	16ms 16ms	Font application/font-woff2	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/Roboto-Black.2e8becfc.woff2 Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/new-metastealer-malvertising-campaigns Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 7e262106f82cc52663e403f5b73795bbeab9ca0630c33c03579354fbcd4fae1e Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://www.malwarebytes.com/blog/threat-intelligence/2023/12/new-metastealer-malvertising-campaigns Origin https://www.malwarebytes.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers date Thu, 11 Jan 2024 15:07:27 GMT strict-transport-security max-age=31536000 x-rq hhn2 96 185 443 last-modified Mon, 21 Aug 2023 16:24:11 GMT server nginx etag "64e38fab-3d88" x-cache HIT content-type application/font-woff2 access-control-allow-origin * access-control-allow-methods GET, HEAD cache-control max-age=31536000 accept-ranges bytes content-length 15752
GET H2	200	image-16.png www.malwarebytes.com/wp-content/uploads/sites/2/2023/12/	15 KB 15 KB	23ms 8ms	Image image/webp	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://www.malwarebytes.com/wp-content/uploads/sites/2/2023/12/image-16.png Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/new-metastealer-malvertising-campaigns Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 90f7d0b628938419847583d31f91cf08f9b299f1a45d43954cb674537cfd9634 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://www.malwarebytes.com/blog/threat-intelligence/2023/12/new-metastealer-malvertising-campaigns User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers date Thu, 11 Jan 2024 15:07:27 GMT strict-transport-security max-age=31536000 x-rq hhn2 109 84 443 last-modified Wed, 20 Dec 2023 00:02:20 GMT server nginx etag "5a81ae64ecf31574" vary Accept x-cache HIT content-type image/webp cache-control max-age=31536000 accept-ranges bytes content-length 15404
GET H2	200	image-12.png www.malwarebytes.com/wp-content/uploads/sites/2/2023/12/	206 KB 206 KB	23ms 8ms	Image image/webp	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://www.malwarebytes.com/wp-content/uploads/sites/2/2023/12/image-12.png Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/new-metastealer-malvertising-campaigns Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 4b4b18b369151cd7d3ae8d1dd2c855d721da4fbaf55d81ca73ef345c21614a59 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://www.malwarebytes.com/blog/threat-intelligence/2023/12/new-metastealer-malvertising-campaigns User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers date Thu, 11 Jan 2024 15:07:27 GMT strict-transport-security max-age=31536000 x-rq hhn2 109 28 443 last-modified Wed, 20 Dec 2023 00:02:20 GMT server nginx etag "e20eb8fc3265a302" vary Accept x-cache HIT content-type image/webp cache-control max-age=31536000 accept-ranges bytes content-length 210578
GET H2	200	image-13.png www.malwarebytes.com/wp-content/uploads/sites/2/2023/12/	79 KB 80 KB	24ms 8ms	Image image/webp	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://www.malwarebytes.com/wp-content/uploads/sites/2/2023/12/image-13.png Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/new-metastealer-malvertising-campaigns Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash b0d400b1c5e4f196f44f16384a4f966ca7fa3c3579ce51582342c31dcefaf3d3 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://www.malwarebytes.com/blog/threat-intelligence/2023/12/new-metastealer-malvertising-campaigns User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers date Thu, 11 Jan 2024 15:07:27 GMT strict-transport-security max-age=31536000 x-rq hhn2 109 198 443 last-modified Wed, 20 Dec 2023 00:02:20 GMT server nginx etag "e0c3c66464329f03" vary Accept x-cache HIT content-type image/webp cache-control max-age=31536000 accept-ranges bytes content-length 81244
GET H2	200	image-20.png www.malwarebytes.com/wp-content/uploads/sites/2/2023/12/	13 KB 13 KB	24ms 9ms	Image image/webp	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://www.malwarebytes.com/wp-content/uploads/sites/2/2023/12/image-20.png Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/new-metastealer-malvertising-campaigns Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash d86e8b8a03a378f6bbf52669b726f60f24698b695a1316de6fbef9082f889ff7 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://www.malwarebytes.com/blog/threat-intelligence/2023/12/new-metastealer-malvertising-campaigns User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers date Thu, 11 Jan 2024 15:07:27 GMT strict-transport-security max-age=31536000 x-rq hhn2 109 32 443 last-modified Wed, 20 Dec 2023 00:02:20 GMT server nginx etag "913c1c47525d6352" vary Accept x-cache HIT content-type image/webp cache-control max-age=31536000 accept-ranges bytes content-length 13536
GET H2	200	8ff7688dd7aaf66effb89c65203ee7c3 secure.gravatar.com/avatar/	10 KB 10 KB	38ms 6ms	Image image/jpeg	2a04:fa87:fffe::c000:4902 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://secure.gravatar.com/avatar/8ff7688dd7aaf66effb89c65203ee7c3?size=300 Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/new-metastealer-malvertising-campaigns Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 4ca7509272fd378d23ad6d1c7f7bfce000ae1569832b6347b8bce568816ed159 Request headers accept-language de-DE,de;q=0.9 Referer https://www.malwarebytes.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers x-nc HIT hhn 2 date Thu, 11 Jan 2024 15:07:27 GMT last-modified Thu, 19 Nov 2020 20:30:53 GMT server nginx content-type image/jpeg access-control-allow-origin * cache-control max-age=300 content-disposition inline; filename="8ff7688dd7aaf66effb89c65203ee7c3.jpg" accept-ranges bytes link <https://gravatar.com/avatar/8ff7688dd7aaf66effb89c65203ee7c3?size=300>; rel="canonical" content-length 10272 alt-svc h3=":443"; ma=86400 expires Thu, 11 Jan 2024 15:12:27 GMT
GET H2	200	Graphik-Light.8512717f.woff2 www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/	41 KB 41 KB	10ms 8ms	Font application/font-woff2	192.0.66.233 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/Graphik-Light.8512717f.woff2 Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/new-metastealer-malvertising-campaigns Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 039bb21133a0657e78917ed224bc151347123282bbd3bf1e0c5da81bccb93da6 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://www.malwarebytes.com/blog/threat-intelligence/2023/12/new-metastealer-malvertising-campaigns Origin https://www.malwarebytes.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers date Thu, 11 Jan 2024 15:07:27 GMT strict-transport-security max-age=31536000 x-rq hhn2 96 184 443 last-modified Mon, 21 Aug 2023 16:24:11 GMT server nginx etag "64e38fab-a410" x-cache HIT content-type application/font-woff2 access-control-allow-origin * access-control-allow-methods GET, HEAD cache-control max-age=31536000 accept-ranges bytes content-length 42000
GET H2	200	locate Show response genesis.malwarebytes.com/api/v1/	410 B 592 B	316ms 104ms	XHR application/json	3.212.34.19 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://genesis.malwarebytes.com/api/v1/locate Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/new-metastealer-malvertising-campaigns Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.212.34.19 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-212-34-19.compute-1.amazonaws.com Software / Resource Hash 9d920a7484b4fcddc0d834dd0d2ccc4c0ad7548e2e4556269ba647035e154852 Request headers accept-language de-DE,de;q=0.9 Referer https://www.malwarebytes.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers access-control-allow-origin https://www.malwarebytes.com date Thu, 11 Jan 2024 15:07:27 GMT content-length 410 vary Origin, Access-Control-Request-Method, Access-Control-Request-Headers content-type application/json
GET H2	200	g.gif pixel.wp.com/	50 B 177 B	6ms 6ms	Image image/gif	192.0.76.3 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://pixel.wp.com/g.gif?v=ext&blog=227197325&post=101050&tz=-8&srv=www.malwarebytes.com&hp=vip&j=1%3A12.9.3&host=www.malwarebytes.com&ref=&fcp=111&rand=0.04188887482623316 Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/new-metastealer-malvertising-campaigns Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1 Request headers accept-language de-DE,de;q=0.9 Referer https://www.malwarebytes.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers access-control-allow-origin * date Thu, 11 Jan 2024 15:07:27 GMT cache-control no-cache server nginx alt-svc h3=":443"; ma=86400 content-length 50 content-type image/gif
GET H/1.1	200 OK	count-data.js Show response malwarebytesunpacked.disqus.com/	355 B 938 B	8ms 8ms	Script application/javascript	199.232.196.134 FASTLY
General Check archive.org Show headers Download Go to Full URL https://malwarebytesunpacked.disqus.com/count-data.js?1=101709&1=101736&1=101753&1=101921&1=101936 Requested by Host: malwarebytesunpacked.disqus.com URL: https://malwarebytesunpacked.disqus.com/count.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 199.232.196.134 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 011f1f7965f2c123a262d48219bbe5ac5509f7d42104212d50a93af62601a3bf Security Headers Name Value Strict-Transport-Security max-age=300; includeSubdomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.malwarebytes.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers Date Thu, 11 Jan 2024 15:07:27 GMT Strict-Transport-Security max-age=300; includeSubdomains X-Content-Type-Options nosniff Server nginx Age 546 X-Frame-Options SAMEORIGIN Vary Accept-Encoding p3p CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM" Content-Type application/javascript; charset=UTF-8 Cache-Control public, max-age=600 Cross-Origin-Resource-Policy cross-origin Connection keep-alive Link <https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect Content-Length 355 X-XSS-Protection 1; mode=block
POST H2	202	event Show response plausible.io/api/	2 B 501 B	30ms 15ms	XHR text/plain	2400:52e0:1e00::1080:1 BUNNYCDN
General Check archive.org Show headers Download Go to Full URL https://plausible.io/api/event Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/new-metastealer-malvertising-campaigns Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2400:52e0:1e00::1080:1 , Germany, ASN200325 (BUNNYCDN, SI), Reverse DNS Software BunnyCDN-DE1-1080 / Resource Hash 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df Request headers Referer https://www.malwarebytes.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Content-Type text/plain Response headers date Thu, 11 Jan 2024 15:07:27 GMT cdn-edgestorageid 1080 cdn-cachedat 01/11/2024 15:07:27 cdn-pullzone 682664 application 10.0.0.3 alt-svc h3=":443"; ma=2592000 content-length 2 x-request-id F6lTadRmn0dBcTIII1cO server BunnyCDN-DE1-1080 cdn-proxyver 1.04 cdn-requestpullcode 202 content-type text/plain; charset=utf-8 access-control-allow-origin * cdn-uid 153cb5b1-399a-48ef-b5bf-098c03770254 cache-control must-revalidate, max-age=0, private access-control-allow-credentials true permissions-policy interest-cohort=() cdn-requestid 73fb2510773ae3eb568dccd306e6bc89 cdn-requestcountrycode DE cdn-requestpullsuccess True
GET H2	200	otSDKStub.js Show response cdn.cookielaw.org/scripttemplates/	21 KB 7 KB	53ms 24ms	Script application/javascript	2606:4700::6812:82ec CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/otSDKStub.js Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/new-metastealer-malvertising-campaigns Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 98bc0753b3f7392176a4af252bfae9bcd1f2804b73dee374119899d8f52ae3d2 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.malwarebytes.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Thu, 11 Jan 2024 15:07:27 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 FWT01iLvZ++xUAz3aesSug== age 35931 strict-transport-security max-age=31536000; includeSubDomains; preload content-length 6841 x-ms-lease-status unlocked last-modified Wed, 10 Jan 2024 21:25:34 GMT server cloudflare etag 0x8DC1222AE9FBDCC vary Accept-Encoding content-type application/javascript access-control-allow-origin * x-ms-request-id 0c6d2fe2-501e-0040-453b-443ebb000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control max-age=86400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 843e11cbbf423816-FRA
GET H/1.1	200 OK	/ Show response disqus.com/embed/comments/ Frame EDE2	7 KB 4 KB	25ms 7ms	Document text/html	151.101.64.134 FASTLY
General Check archive.org Show headers Download Go to Full URL https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=101050&t_u=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fthreat-intelligence%2F2023%2F12%2Fnew-metastealer-malvertising-campaigns&t_d=New%20MetaStealer%20malvertising%20campaigns&t_t=New%20MetaStealer%20malvertising%20campaigns&s_o=default Requested by Host: malwarebytesunpacked.disqus.com URL: https://malwarebytesunpacked.disqus.com/embed.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 151.101.64.134 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 0b706552d005672e4dcc4306cff62e9ff090bedb813106968c77ef093899ac6d Security Headers Name Value Content-Security-Policy script-src https://*.twitter.com:* https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://*.services.disqus.com:* https://cdn.boomtrain.com/p13n/ https://com-disqus.netmng.com:* 'unsafe-inline' https://referrer.disqus.com/juggler/ https://connect.facebook.net/en_US/sdk.js https://cdn.syndication.twimg.com/tweets.json https://apis.google.com https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com Strict-Transport-Security max-age=300; includeSubdomains X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://www.malwarebytes.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Age 2 Cache-Control stale-if-error=3600, s-stalewhilerevalidate=3600, stale-while-revalidate=30, no-cache, must-revalidate, public, s-maxage=5 Connection keep-alive Content-Encoding gzip Content-Length 2904 Content-Security-Policy script-src https://*.twitter.com:* https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://*.services.disqus.com:* https://cdn.boomtrain.com/p13n/ https://com-disqus.netmng.com:* 'unsafe-inline' https://referrer.disqus.com/juggler/ https://connect.facebook.net/en_US/sdk.js https://cdn.syndication.twimg.com/tweets.json https://apis.google.com https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com Content-Type text/html; charset=utf-8 Cross-Origin-Resource-Policy cross-origin Date Thu, 11 Jan 2024 15:07:28 GMT ETag W/"lounge:view:9987428885.42e7af6e3301f22e450cdf9fe7f28757.2" Last-Modified Wed, 10 Jan 2024 13:22:07 GMT Link <https://c.disquscdn.com>;rel=preconnect,<https://c.disquscdn.com>;rel=dns-prefetch Referrer-Policy no-referrer-when-downgrade Server nginx Strict-Transport-Security max-age=300; includeSubdomains Timing-Allow-Origin * Vary Accept-Encoding X-Content-Type-Options nosniff X-XSS-Protection 1; mode=block p3p CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
GET H2	200	lounge.load.cb3f36bfade5c758ef967a494d077f95.js Show response c.disquscdn.com/next/embed/ Frame EDE2	1 KB 1 KB	55ms 17ms	Script application/javascript	2600:9000:211a:e200:6:8656:f5c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://c.disquscdn.com/next/embed/lounge.load.cb3f36bfade5c758ef967a494d077f95.js Requested by Host: disqus.com URL: https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=101050&t_u=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fthreat-intelligence%2F2023%2F12%2Fnew-metastealer-malvertising-campaigns&t_d=New%20MetaStealer%20malvertising%20campaigns&t_t=New%20MetaStealer%20malvertising%20campaigns&s_o=default Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:211a:e200:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 76e2eb5e5e17ae7c75ded230b7e5f8d0c7c0e1ae63e9014f7bb9e58617dc852f Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=101050&t_u=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fthreat-intelligence%2F2023%2F12%2Fnew-metastealer-malvertising-campaigns&t_d=New%20MetaStealer%20malvertising%20campaigns&t_t=New%20MetaStealer%20malvertising%20campaigns&s_o=default Origin https://disqus.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers x-cache-hits 0 date Thu, 04 Jan 2024 17:59:55 GMT content-encoding gzip x-content-type-options nosniff via 1.1 dcb9765526b3272617b95932c8fefee2.cloudfront.net (CloudFront) x-amz-cf-pop VIE50-C2 age 594453 x-cache Hit from cloudfront cross-origin-resource-policy cross-origin content-length 630 x-xss-protection 1; mode=block x-served-by static-web-1 surrogate-key next last-modified Thu, 04 Jan 2024 17:51:50 GMT server nginx etag "6596f036-276" content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000, public, immutable, no-transform timing-allow-origin * x-amz-cf-id 4nuqEmbP7JxlFZxayFNQ35t1G7en3Y_1knNnY0tUTl6t_iC6xNY3LQ== expires Fri, 03 Jan 2025 17:59:55 GMT
GET H2	200	common.bundle.38c5aabc45d4259965d7e2fa23a41f7b.js Show response c.disquscdn.com/next/embed/ Frame EDE2	280 KB 93 KB	56ms 20ms	Script application/javascript	2600:9000:211a:e200:6:8656:f5c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://c.disquscdn.com/next/embed/common.bundle.38c5aabc45d4259965d7e2fa23a41f7b.js Requested by Host: c.disquscdn.com URL: https://c.disquscdn.com/next/embed/lounge.load.cb3f36bfade5c758ef967a494d077f95.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:211a:e200:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash a12ed1612f455158732f858b4cf1395777f2a53584d46bf9cd8530ed9f53e4df Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=101050&t_u=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fthreat-intelligence%2F2023%2F12%2Fnew-metastealer-malvertising-campaigns&t_d=New%20MetaStealer%20malvertising%20campaigns&t_t=New%20MetaStealer%20malvertising%20campaigns&s_o=default User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers x-cache-hits 0 date Mon, 18 Dec 2023 17:28:44 GMT content-encoding gzip x-content-type-options nosniff via 1.1 e41179d785de304a9240d5e97b2e4cbc.cloudfront.net (CloudFront) x-amz-cf-pop VIE50-C2 age 2065124 x-cache Hit from cloudfront cross-origin-resource-policy cross-origin content-length 94199 x-xss-protection 1; mode=block x-served-by static-web-1 surrogate-key next last-modified Mon, 18 Dec 2023 16:49:31 GMT server nginx etag "6580781b-16ff7" content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000, public, immutable, no-transform timing-allow-origin * x-amz-cf-id 56T9wCQncrmYox-L_e5RkzzGiZa5wjP1QDGB7ZyRion01BLceA0pGw== expires Tue, 17 Dec 2024 17:28:44 GMT
GET H2	200	lounge.f7ae30d42a8946a9460cc262732d4da8.css c.disquscdn.com/next/embed/styles/ Frame EDE2	233 KB 33 KB	19ms 19ms	Stylesheet text/css	2600:9000:211a:e200:6:8656:f5c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://c.disquscdn.com/next/embed/styles/lounge.f7ae30d42a8946a9460cc262732d4da8.css Requested by Host: c.disquscdn.com URL: https://c.disquscdn.com/next/embed/common.bundle.38c5aabc45d4259965d7e2fa23a41f7b.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:211a:e200:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash f17fa1d863ade20f6e8af77a09d3ea79b694c4cea7a50f11aa2d65b5d4755d4b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=101050&t_u=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fthreat-intelligence%2F2023%2F12%2Fnew-metastealer-malvertising-campaigns&t_d=New%20MetaStealer%20malvertising%20campaigns&t_t=New%20MetaStealer%20malvertising%20campaigns&s_o=default User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers x-cache-hits 0 date Mon, 18 Dec 2023 17:28:45 GMT content-encoding gzip x-content-type-options nosniff via 1.1 e41179d785de304a9240d5e97b2e4cbc.cloudfront.net (CloudFront) x-amz-cf-pop VIE50-C2 age 2065123 x-cache Hit from cloudfront cross-origin-resource-policy cross-origin content-length 33312 x-xss-protection 1; mode=block x-served-by static-web-1 surrogate-key next last-modified Mon, 18 Dec 2023 16:49:31 GMT server nginx etag "6580781b-8220" content-type text/css; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000, public, immutable, no-transform timing-allow-origin * x-amz-cf-id Bvo-sNjkveDeyhPMKUW1YNgDKFEPqc4BJkXoG6_49LcpgC_tajqTVg== expires Tue, 17 Dec 2024 17:28:45 GMT
GET H2	200	lounge.bundle.2f86b371c469b373967566d21bc76e78.js Show response c.disquscdn.com/next/embed/ Frame EDE2	513 KB 129 KB	19ms 19ms	Script application/javascript	2600:9000:211a:e200:6:8656:f5c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://c.disquscdn.com/next/embed/lounge.bundle.2f86b371c469b373967566d21bc76e78.js Requested by Host: c.disquscdn.com URL: https://c.disquscdn.com/next/embed/common.bundle.38c5aabc45d4259965d7e2fa23a41f7b.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:211a:e200:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 343cc2ae21bbaf76ed55ccd75441f693b5ed63a18f1d2ce7bf4195ef0d8a7b63 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=101050&t_u=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fthreat-intelligence%2F2023%2F12%2Fnew-metastealer-malvertising-campaigns&t_d=New%20MetaStealer%20malvertising%20campaigns&t_t=New%20MetaStealer%20malvertising%20campaigns&s_o=default User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers x-cache-hits 0 date Thu, 04 Jan 2024 17:59:56 GMT content-encoding gzip x-content-type-options nosniff via 1.1 e41179d785de304a9240d5e97b2e4cbc.cloudfront.net (CloudFront) x-amz-cf-pop VIE50-C2 age 594452 x-cache Hit from cloudfront cross-origin-resource-policy cross-origin content-length 131052 x-xss-protection 1; mode=block x-served-by static-web-2 surrogate-key next last-modified Thu, 04 Jan 2024 17:51:50 GMT server nginx etag "6596f036-1ffec" content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000, public, immutable, no-transform timing-allow-origin * x-amz-cf-id oMCHEBWm7ii0YVXScI0fYDY-CTZxhBPFK1Z2PERvc55MyH4QSS3N3g== expires Fri, 03 Jan 2025 17:59:56 GMT
GET H/1.1	200 OK	config.js Show response disqus.com/next/ Frame EDE2	19 KB 19 KB	8ms 7ms	Script application/javascript	151.101.64.134 FASTLY
General Check archive.org Show headers Download Go to Full URL https://disqus.com/next/config.js Requested by Host: c.disquscdn.com URL: https://c.disquscdn.com/next/embed/common.bundle.38c5aabc45d4259965d7e2fa23a41f7b.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 151.101.64.134 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash ba7cfaa35518965e2f5f4e3bc541237723e1150f030b2e4c17504a996542c89a Security Headers Name Value Strict-Transport-Security max-age=300; includeSubdomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=101050&t_u=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fthreat-intelligence%2F2023%2F12%2Fnew-metastealer-malvertising-campaigns&t_d=New%20MetaStealer%20malvertising%20campaigns&t_t=New%20MetaStealer%20malvertising%20campaigns&s_o=default User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers Date Thu, 11 Jan 2024 15:07:28 GMT Strict-Transport-Security max-age=300; includeSubdomains X-Content-Type-Options nosniff Server nginx Age 36 X-Frame-Options SAMEORIGIN p3p CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM" Access-Control-Allow-Origin * Content-Type application/javascript; charset=UTF-8 Cache-Control public, stale-while-revalidate=300, s-stalewhilerevalidate=3600, max-age=60 Cross-Origin-Resource-Policy cross-origin Connection keep-alive Timing-Allow-Origin * Content-Length 19314 X-XSS-Protection 1; mode=block
GET H2	200	82971089-2677-4e1e-8fab-44444f76330b.json Show response cdn.cookielaw.org/consent/82971089-2677-4e1e-8fab-44444f76330b/	6 KB 2 KB	61ms 35ms	XHR application/x-javascript	2606:4700::6812:82ec CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/consent/82971089-2677-4e1e-8fab-44444f76330b/82971089-2677-4e1e-8fab-44444f76330b.json Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/new-metastealer-malvertising-campaigns Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 163844c1004fe7f16a32cabbf1fa485c127c185fce968f992cba0baae232eac4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.malwarebytes.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Thu, 11 Jan 2024 15:07:28 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT strict-transport-security max-age=31536000; includeSubDomains; preload age 22178 content-md5 I4eep5WavqwFVcaJf34d6g== content-length 1947 x-ms-lease-status unlocked last-modified Tue, 14 Nov 2023 18:51:59 GMT server cloudflare etag 0x8DBE542C8198A76 vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * x-ms-request-id 40340ffa-701e-008c-2f2b-17518d000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=86400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 843e11cd7b4703a0-FRA expires Fri, 12 Jan 2024 15:07:28 GMT
GET H2	200	nr-full-1.249.0.min.js Show response js-agent.newrelic.com/	73 KB 25 KB	26ms 6ms	Script application/javascript	151.101.130.137 FASTLY
General Check archive.org Show headers Download Go to Full URL https://js-agent.newrelic.com/nr-full-1.249.0.min.js Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/new-metastealer-malvertising-campaigns Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.130.137 , United States, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash 293596ca987a05b6966614b08a9369eb37ee12a373eed8faf64f188c79c98962 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.malwarebytes.com/ Origin https://www.malwarebytes.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers x-amz-version-id FG4gJKi4hvQMXbL6zhYA9xtMBWu49yZa content-encoding br via 1.1 varnish date Thu, 11 Jan 2024 15:07:28 GMT strict-transport-security max-age=300 x-amz-request-id HFQ88FE0VVWGFVEX x-amz-server-side-encryption AES256 x-cache HIT cross-origin-resource-policy cross-origin content-length 24848 x-amz-id-2 hgxrnbbAIUI6Y8QNDkR7AykF6oliz/3Zq/zZx3/fBAZRUpDa36fbCRob5TAmsIJwhcj1ohPdQbw= x-served-by cache-fra-eddf8230115-FRA last-modified Thu, 14 Dec 2023 16:36:09 GMT server AmazonS3 x-timer S1704985648.230337,VS0,VE0 etag "dde2becd3a0bbb615a3d81eb9ddc15b5" vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=86400, stale-if-error=86400 accept-ranges bytes x-cache-hits 20022
GET H/1.1	200 OK	details Show response disqus.com/api/3.0/forums/ Frame EDE2	3 KB 4 KB	8ms 7ms	XHR application/json	151.101.64.134 FASTLY
General Check archive.org Show headers Download Go to Full URL https://disqus.com/api/3.0/forums/details?forum=malwarebytesunpacked&attach=forumFeatures&api_key=E8Uh5l5fHZ6gD8U3KycjAIAk46f68Zw7C6eW8WSjZvCLXebZ7p0r1yrYDrLilk2F Requested by Host: c.disquscdn.com URL: https://c.disquscdn.com/next/embed/common.bundle.38c5aabc45d4259965d7e2fa23a41f7b.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 151.101.64.134 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 81e92370ccb8e15b47c44099d975ab97ba7512bf5c07fd615a37ccce872e3a31 Security Headers Name Value Strict-Transport-Security max-age=300; includeSubdomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept */* Referer https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=101050&t_u=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fthreat-intelligence%2F2023%2F12%2Fnew-metastealer-malvertising-campaigns&t_d=New%20MetaStealer%20malvertising%20campaigns&t_t=New%20MetaStealer%20malvertising%20campaigns&s_o=default X-Requested-With XMLHttpRequest accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers Date Thu, 11 Jan 2024 15:07:28 GMT Strict-Transport-Security max-age=300; includeSubdomains X-Content-Type-Options nosniff Server nginx Age 71 X-Frame-Options SAMEORIGIN Vary Origin, Cookie p3p CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM" Content-Type application/json Cross-Origin-Resource-Policy cross-origin Connection keep-alive Content-Length 3268 X-XSS-Protection 1; mode=block
GET H2	200	css2 fonts.googleapis.com/ Frame EDE2	11 KB 1 KB	173ms 60ms	Stylesheet text/css	2a00:1450:4001:831::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css2?family=Roboto:ital,wght@0,400;0,500;0,600;0,700;1,400;1,700&display=swap Requested by Host: client URL: about:client Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 4dbc45bd7ed8caf2aeeae8de34e519d874987d5285c79b5b4a93a1d670a929c4 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=101050&t_u=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fthreat-intelligence%2F2023%2F12%2Fnew-metastealer-malvertising-campaigns&t_d=New%20MetaStealer%20malvertising%20campaigns&t_t=New%20MetaStealer%20malvertising%20campaigns&s_o=default User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers strict-transport-security max-age=31536000 date Thu, 11 Jan 2024 15:07:28 GMT content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-xss-protection 0 last-modified Thu, 11 Jan 2024 13:33:54 GMT server ESF cross-origin-opener-policy same-origin-allow-popups x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Thu, 11 Jan 2024 15:07:28 GMT
GET H/1.1	200 OK	loadReactions Show response disqus.com/api/3.0/threadReactions/ Frame EDE2	1 KB 2 KB	7ms 7ms	XHR application/json	151.101.64.134 FASTLY
General Check archive.org Show headers Download Go to Full URL https://disqus.com/api/3.0/threadReactions/loadReactions?thread=9987428885&api_key=E8Uh5l5fHZ6gD8U3KycjAIAk46f68Zw7C6eW8WSjZvCLXebZ7p0r1yrYDrLilk2F Requested by Host: c.disquscdn.com URL: https://c.disquscdn.com/next/embed/common.bundle.38c5aabc45d4259965d7e2fa23a41f7b.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 151.101.64.134 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 02946f704fc242c011a0596d1a6c51dcb040a900a4027a4578bbdd74ba746301 Security Headers Name Value Strict-Transport-Security max-age=300; includeSubdomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept application/json, text/javascript, */*; q=0.01 Referer https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=101050&t_u=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fthreat-intelligence%2F2023%2F12%2Fnew-metastealer-malvertising-campaigns&t_d=New%20MetaStealer%20malvertising%20campaigns&t_t=New%20MetaStealer%20malvertising%20campaigns&s_o=default X-Requested-With XMLHttpRequest accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers Date Thu, 11 Jan 2024 15:07:28 GMT Strict-Transport-Security max-age=300; includeSubdomains X-Content-Type-Options nosniff Server nginx Age 26 X-Frame-Options SAMEORIGIN Vary Origin, Cookie p3p CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM" Content-Type application/json Cache-Control stale-while-revalidate=30, max-age=60 Cross-Origin-Resource-Policy cross-origin Connection keep-alive Content-Length 1125 X-XSS-Protection 1; mode=block
POST H/1.1	200	NRJS-51878192dd15f231213 Show response bam.nr-data.net/1/	40 B 408 B	138ms 124ms	XHR text/plain	162.247.243.29 FASTLY
General Check archive.org Show headers Download Go to Full URL https://bam.nr-data.net/1/NRJS-51878192dd15f231213?a=732197726&v=1.249.0&to=ZgNQMkpUVkYDBRVQXF9JcwVMXFdbTRUIV1RdAx8WV0ZM&rst=857&ck=0&s=0fee05216ad2ac80&ref=https://www.malwarebytes.com/blog/threat-intelligence/2023/12/new-metastealer-malvertising-campaigns&af=err,xhr,stn,ins&ap=493&be=21&fe=762&dc=433&at=SkRHRAJORRlAB0MDSEwb&fsh=1&perf=%7B%22timing%22:%7B%22of%22:1704985647422,%22n%22:0,%22dn%22:1,%22dne%22:1,%22c%22:1,%22s%22:7,%22ce%22:16,%22rq%22:16,%22rp%22:22,%22rpe%22:38,%22di%22:133,%22ds%22:454,%22de%22:454,%22dc%22:782,%22l%22:782,%22le%22:783%7D,%22navigation%22:%7B%7D%7D&fp=110&fcp=110 Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/new-metastealer-malvertising-campaigns Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 162.247.243.29 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash c831a58c25f63105a06a622b3435bc6761474664f87e8e7b6ef8dccafa0d890f Request headers Referer https://www.malwarebytes.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 content-type text/plain Response headers date Thu, 11 Jan 2024 15:07:28 GMT access-control-allow-methods GET, POST, PUT, HEAD, OPTIONS content-type text/plain access-control-allow-origin https://www.malwarebytes.com access-control-allow-credentials true cross-origin-resource-policy cross-origin Connection keep-alive Content-Length 40 x-served-by cache-fra-eddf8230043-FRA
GET H2	200	svg-sprite.4da5413f5086c5755b46094b813dbfcd.svg c.disquscdn.com/next/embed/assets/img/ Frame EDE2	13 KB 13 KB	19ms 18ms	Image image/svg+xml	2600:9000:211a:e200:6:8656:f5c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://c.disquscdn.com/next/embed/assets/img/svg-sprite.4da5413f5086c5755b46094b813dbfcd.svg Requested by Host: c.disquscdn.com URL: https://c.disquscdn.com/next/embed/styles/lounge.f7ae30d42a8946a9460cc262732d4da8.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:211a:e200:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 3270642c89180c12db93775e2a774b6dadd9bd98cffc963075c85afd2c17b6e4 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://c.disquscdn.com/next/embed/styles/lounge.f7ae30d42a8946a9460cc262732d4da8.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers x-cache-hits 0 date Sat, 18 Nov 2023 05:39:28 GMT via 1.1 e41179d785de304a9240d5e97b2e4cbc.cloudfront.net (CloudFront) x-content-type-options nosniff x-amz-cf-pop VIE50-C2 age 4699680 x-cache Hit from cloudfront cross-origin-resource-policy cross-origin content-length 13079 x-xss-protection 1; mode=block x-served-by static-web-1 surrogate-key next last-modified Wed, 15 Nov 2023 20:36:05 GMT server nginx etag "65552bb5-3317" content-type image/svg+xml; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000, public, immutable, no-transform accept-ranges bytes timing-allow-origin * x-amz-cf-id ag4urBAppxbQO-IbAInmfqXNTXvlKhtI9NAKsa1rtvF5jyejxGp82A== expires Sun, 17 Nov 2024 05:39:28 GMT
GET H2	200	loader.ba7c86e8b4b6135bb668d05223f8f127.gif c.disquscdn.com/next/embed/assets/img/ Frame EDE2	3 KB 3 KB	19ms 19ms	Image image/gif	2600:9000:211a:e200:6:8656:f5c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://c.disquscdn.com/next/embed/assets/img/loader.ba7c86e8b4b6135bb668d05223f8f127.gif Requested by Host: c.disquscdn.com URL: https://c.disquscdn.com/next/embed/styles/lounge.f7ae30d42a8946a9460cc262732d4da8.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:211a:e200:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 4c4491dcfa94cb46fb73742fc2caf49a1cd59027304af1830c7dc6ce1889857c Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://c.disquscdn.com/next/embed/styles/lounge.f7ae30d42a8946a9460cc262732d4da8.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers x-cache-hits 0 date Sun, 20 Aug 2023 12:05:10 GMT via 1.1 e41179d785de304a9240d5e97b2e4cbc.cloudfront.net (CloudFront) x-content-type-options nosniff x-amz-cf-pop VIE50-C2 age 12452538 x-cache Hit from cloudfront cross-origin-resource-policy cross-origin content-length 2971 x-xss-protection 1; mode=block x-served-by static-web-2 surrogate-key next last-modified Wed, 02 Aug 2023 23:18:56 GMT server nginx etag "64cae460-b9b" content-type image/gif access-control-allow-origin * cache-control max-age=31536000, public, immutable, no-transform accept-ranges bytes timing-allow-origin * x-amz-cf-id hxojANs3sk6lXps6kuEPY-mDpD4Nrbh30RKM8crTxwzvupv4-b4-6A== expires Mon, 19 Aug 2024 12:05:10 GMT
GET H2	200	email.727e30eb9b6c1e85cb010b9c8eb04c7e.svg c.disquscdn.com/next/embed/assets/img/ Frame EDE2	840 B 1 KB	20ms 20ms	Image image/svg+xml	2600:9000:211a:e200:6:8656:f5c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://c.disquscdn.com/next/embed/assets/img/email.727e30eb9b6c1e85cb010b9c8eb04c7e.svg Requested by Host: c.disquscdn.com URL: https://c.disquscdn.com/next/embed/styles/lounge.f7ae30d42a8946a9460cc262732d4da8.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:211a:e200:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 0589c5845288117448d7aa710af60618b151d78efd1a2653f89a0b57f7eb3de8 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://c.disquscdn.com/next/embed/styles/lounge.f7ae30d42a8946a9460cc262732d4da8.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers x-cache-hits 0 date Thu, 21 Sep 2023 03:03:24 GMT via 1.1 e41179d785de304a9240d5e97b2e4cbc.cloudfront.net (CloudFront) x-content-type-options nosniff x-amz-cf-pop VIE50-C2 age 9720243 x-cache Hit from cloudfront cross-origin-resource-policy cross-origin content-length 840 x-xss-protection 1; mode=block x-served-by static-web-2 surrogate-key next last-modified Wed, 20 Sep 2023 10:55:06 GMT server nginx etag "650acf8a-348" content-type image/svg+xml; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000, public, immutable, no-transform accept-ranges bytes timing-allow-origin * x-amz-cf-id tGLyAXCvukqMx_v2yPX74wayBhWj9dPkrKzxCS6QtiB_IPvuOeYk8A== expires Fri, 20 Sep 2024 03:03:24 GMT
GET H2	200	privacy.8c96be6b50de1c3fab838c5f050e0be5.svg c.disquscdn.com/next/embed/assets/img/ Frame EDE2	891 B 1 KB	21ms 20ms	Image image/svg+xml	2600:9000:211a:e200:6:8656:f5c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://c.disquscdn.com/next/embed/assets/img/privacy.8c96be6b50de1c3fab838c5f050e0be5.svg Requested by Host: c.disquscdn.com URL: https://c.disquscdn.com/next/embed/styles/lounge.f7ae30d42a8946a9460cc262732d4da8.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:211a:e200:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 068753b8f09b32ad8a3283199c7252090d0076a56924df724dda72828ae31b95 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://c.disquscdn.com/next/embed/styles/lounge.f7ae30d42a8946a9460cc262732d4da8.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers x-cache-hits 0 date Wed, 26 Jul 2023 18:48:11 GMT via 1.1 e41179d785de304a9240d5e97b2e4cbc.cloudfront.net (CloudFront) x-content-type-options nosniff x-amz-cf-pop VIE50-C2 age 14588357 x-cache Hit from cloudfront cross-origin-resource-policy cross-origin content-length 891 x-xss-protection 1; mode=block x-served-by static-web-1 surrogate-key next last-modified Wed, 26 Jul 2023 16:31:55 GMT server nginx etag "64c14a7b-37b" content-type image/svg+xml; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000, public, immutable, no-transform accept-ranges bytes timing-allow-origin * x-amz-cf-id DaRtk1h85xl80EdnVr-AfbsMbgMnUEQZuRnlAyFC21jIJIKlEpkDAQ== expires Thu, 25 Jul 2024 18:48:11 GMT
GET H2	200	warning.3bc0b4bff6c268a4ceaf404014b9be42.svg c.disquscdn.com/next/embed/assets/img/ Frame EDE2	605 B 1 KB	21ms 21ms	Image image/svg+xml	2600:9000:211a:e200:6:8656:f5c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://c.disquscdn.com/next/embed/assets/img/warning.3bc0b4bff6c268a4ceaf404014b9be42.svg Requested by Host: c.disquscdn.com URL: https://c.disquscdn.com/next/embed/styles/lounge.f7ae30d42a8946a9460cc262732d4da8.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:211a:e200:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash a657bedd3bc0c106f7cfa5fe6556a0b7e175870d33bd7da9ef67ffcffbafda69 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://c.disquscdn.com/next/embed/styles/lounge.f7ae30d42a8946a9460cc262732d4da8.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers x-cache-hits 0 date Thu, 14 Sep 2023 03:57:58 GMT via 1.1 e41179d785de304a9240d5e97b2e4cbc.cloudfront.net (CloudFront) x-content-type-options nosniff x-amz-cf-pop VIE50-C2 age 10321770 x-cache Hit from cloudfront cross-origin-resource-policy cross-origin content-length 605 x-xss-protection 1; mode=block x-served-by static-web-1 surrogate-key next last-modified Wed, 13 Sep 2023 20:48:30 GMT server nginx etag "6502201e-25d" content-type image/svg+xml; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000, public, immutable, no-transform accept-ranges bytes timing-allow-origin * x-amz-cf-id Ayvj9RBXcrOpKEvQtmj93Im1wxznz9vraKMLViITyB71iC5t1YwCKw== expires Fri, 13 Sep 2024 03:57:58 GMT
GET H2	200	icons.79e576f9489bae308388e5b8e250aa86.woff2 c.disquscdn.com/next/embed/assets/font/ Frame EDE2	8 KB 9 KB	22ms 22ms	Font application/octet-stream	2600:9000:211a:e200:6:8656:f5c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://c.disquscdn.com/next/embed/assets/font/icons.79e576f9489bae308388e5b8e250aa86.woff2 Requested by Host: c.disquscdn.com URL: https://c.disquscdn.com/next/embed/styles/lounge.f7ae30d42a8946a9460cc262732d4da8.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:211a:e200:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 8dc675da542f629aca965669b35900a5ed0685f4d87dce9eac4660baf4493687 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://c.disquscdn.com/next/embed/styles/lounge.f7ae30d42a8946a9460cc262732d4da8.css Origin https://disqus.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers x-cache-hits 0 date Wed, 06 Dec 2023 19:49:42 GMT via 1.1 dcb9765526b3272617b95932c8fefee2.cloudfront.net (CloudFront) x-content-type-options nosniff x-amz-cf-pop VIE50-C2 age 3093466 x-cache Hit from cloudfront cross-origin-resource-policy cross-origin content-length 8216 x-xss-protection 1; mode=block x-served-by static-web-1 surrogate-key next last-modified Wed, 06 Dec 2023 19:40:12 GMT server nginx etag "6570ce1c-2018" content-type application/octet-stream access-control-allow-origin * cache-control max-age=31536000, public, immutable, no-transform accept-ranges bytes timing-allow-origin * x-amz-cf-id QbvXIcxG7hUFrBqMPYf7w-0WIb0AQV-8gtDfnq3YIfIY1QfCotkcnA== expires Thu, 05 Dec 2024 19:49:42 GMT
GET H2	200	location Show response geolocation.onetrust.com/cookieconsentpub/v1/geo/	66 B 303 B	60ms 28ms	XHR application/json	2606:4700:4400::6812:2089 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/new-metastealer-malvertising-campaigns Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:2089 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f90d159c7a961f8d49cf0197de9f4a31f91310b5cd03edc042f82beae766c88b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers accept application/json Referer https://www.malwarebytes.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers date Thu, 11 Jan 2024 15:07:28 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-encoding gzip server cloudflare vary Accept-Encoding access-control-allow-methods GET, OPTIONS content-type application/json access-control-allow-origin * cf-ray 843e11ce7cf771b9-FRA access-control-allow-headers Content-Type
GET H2	200	upvote-512x512.png c.disquscdn.com/next/current/publisher-admin/assets/img/emoji/ Frame EDE2	8 KB 8 KB	20ms 18ms	Image image/png	2600:9000:211a:e200:6:8656:f5c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://c.disquscdn.com/next/current/publisher-admin/assets/img/emoji/upvote-512x512.png Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:211a:e200:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash ddc6aec4144b67f0a2a12d687f3c4b8a9faf7c445847d0e25dcb5bd1a9ba9018 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=101050&t_u=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fthreat-intelligence%2F2023%2F12%2Fnew-metastealer-malvertising-campaigns&t_d=New%20MetaStealer%20malvertising%20campaigns&t_t=New%20MetaStealer%20malvertising%20campaigns&s_o=default User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers x-cache-hits 0 date Thu, 11 Jan 2024 15:04:44 GMT via 1.1 e41179d785de304a9240d5e97b2e4cbc.cloudfront.net (CloudFront) x-content-type-options nosniff x-amz-cf-pop VIE50-C2 age 169 x-cache Hit from cloudfront cross-origin-resource-policy cross-origin content-length 8170 x-xss-protection 1; mode=block x-served-by static-web-2 last-modified Mon, 08 Jan 2024 22:12:55 GMT server nginx etag "659c7367-1fea" content-type image/png access-control-allow-origin * cache-control max-age=300, public accept-ranges bytes timing-allow-origin * x-amz-cf-id X8Di18eezZgrXb6hUNe34gGtnlZIgNTMw8S-rR4WuTB_y_EHmF-v5A== expires Thu, 11 Jan 2024 15:09:39 GMT
GET H2	200	funny-512x512.png c.disquscdn.com/next/current/publisher-admin/assets/img/emoji/ Frame EDE2	9 KB 9 KB	20ms 19ms	Image image/png	2600:9000:211a:e200:6:8656:f5c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://c.disquscdn.com/next/current/publisher-admin/assets/img/emoji/funny-512x512.png Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:211a:e200:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 20a91bd509668238b6af8e16475c5e2611bcd2861d0eec2e0d4f6815e81449bd Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=101050&t_u=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fthreat-intelligence%2F2023%2F12%2Fnew-metastealer-malvertising-campaigns&t_d=New%20MetaStealer%20malvertising%20campaigns&t_t=New%20MetaStealer%20malvertising%20campaigns&s_o=default User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers x-cache-hits 0 date Thu, 11 Jan 2024 15:02:35 GMT via 1.1 e41179d785de304a9240d5e97b2e4cbc.cloudfront.net (CloudFront) x-content-type-options nosniff x-amz-cf-pop VIE50-C2 age 293 x-cache Hit from cloudfront cross-origin-resource-policy cross-origin content-length 8883 x-xss-protection 1; mode=block x-served-by static-web-1 last-modified Mon, 08 Jan 2024 22:12:55 GMT server nginx etag "659c7367-22b3" content-type image/png access-control-allow-origin * cache-control max-age=300, public accept-ranges bytes timing-allow-origin * x-amz-cf-id bpskI-P3g7_5b_suLfAZJWmD3Z48ECqkWENzTLoR0v8XcM12YZpYnw== expires Thu, 11 Jan 2024 15:07:35 GMT
GET H2	200	love-512x512.png c.disquscdn.com/next/current/publisher-admin/assets/img/emoji/ Frame EDE2	12 KB 12 KB	21ms 20ms	Image image/png	2600:9000:211a:e200:6:8656:f5c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://c.disquscdn.com/next/current/publisher-admin/assets/img/emoji/love-512x512.png Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:211a:e200:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash e422b07ca1550e55cd90a518e910fd3cfb4d9337ea6092357f9761aa77ac9e33 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=101050&t_u=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fthreat-intelligence%2F2023%2F12%2Fnew-metastealer-malvertising-campaigns&t_d=New%20MetaStealer%20malvertising%20campaigns&t_t=New%20MetaStealer%20malvertising%20campaigns&s_o=default User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers x-cache-hits 0 date Thu, 11 Jan 2024 15:02:36 GMT via 1.1 e41179d785de304a9240d5e97b2e4cbc.cloudfront.net (CloudFront) x-content-type-options nosniff x-amz-cf-pop VIE50-C2 age 293 x-cache Hit from cloudfront cross-origin-resource-policy cross-origin content-length 11910 x-xss-protection 1; mode=block x-served-by static-web-2 last-modified Mon, 08 Jan 2024 22:12:55 GMT server nginx etag "659c7367-2e86" content-type image/png access-control-allow-origin * cache-control max-age=300, public accept-ranges bytes timing-allow-origin * x-amz-cf-id x8NDrYaoHtnBFG86YB-tn7TbdoG8lc7jEUKbRdbK7H6_NychLWiVDA== expires Thu, 11 Jan 2024 15:07:35 GMT
GET H2	200	angry-512x512.png c.disquscdn.com/next/current/publisher-admin/assets/img/emoji/ Frame EDE2	20 KB 21 KB	22ms 21ms	Image image/png	2600:9000:211a:e200:6:8656:f5c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://c.disquscdn.com/next/current/publisher-admin/assets/img/emoji/angry-512x512.png Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:211a:e200:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash db865c8f3642f3485829c0ee0008fe04a32cc66af70867b39f60395a7fed3984 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=101050&t_u=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fthreat-intelligence%2F2023%2F12%2Fnew-metastealer-malvertising-campaigns&t_d=New%20MetaStealer%20malvertising%20campaigns&t_t=New%20MetaStealer%20malvertising%20campaigns&s_o=default User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers x-cache-hits 0 date Thu, 11 Jan 2024 15:04:01 GMT via 1.1 e41179d785de304a9240d5e97b2e4cbc.cloudfront.net (CloudFront) x-content-type-options nosniff x-amz-cf-pop VIE50-C2 age 207 x-cache Hit from cloudfront cross-origin-resource-policy cross-origin content-length 20675 x-xss-protection 1; mode=block x-served-by static-web-2 last-modified Mon, 08 Jan 2024 22:12:55 GMT server nginx etag "659c7367-50c3" content-type image/png access-control-allow-origin * cache-control max-age=300, public accept-ranges bytes timing-allow-origin * x-amz-cf-id k_AUaXMPHGMv6ilkAHIjR9P-84PPeKEa5yHCdhCumX6OKY8KYx7SPA== expires Thu, 11 Jan 2024 15:09:01 GMT
GET H2	200	sad-512x512.png c.disquscdn.com/next/current/publisher-admin/assets/img/emoji/ Frame EDE2	9 KB 9 KB	25ms 24ms	Image image/png	2600:9000:211a:e200:6:8656:f5c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://c.disquscdn.com/next/current/publisher-admin/assets/img/emoji/sad-512x512.png Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:211a:e200:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 11c401a81e32b086bea3798c033009907b429fb601411da6ffc266b78184898a Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=101050&t_u=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fthreat-intelligence%2F2023%2F12%2Fnew-metastealer-malvertising-campaigns&t_d=New%20MetaStealer%20malvertising%20campaigns&t_t=New%20MetaStealer%20malvertising%20campaigns&s_o=default User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers x-cache-hits 0 date Thu, 11 Jan 2024 15:03:55 GMT via 1.1 e41179d785de304a9240d5e97b2e4cbc.cloudfront.net (CloudFront) x-content-type-options nosniff x-amz-cf-pop VIE50-C2 age 216 x-cache Hit from cloudfront cross-origin-resource-policy cross-origin content-length 8986 x-xss-protection 1; mode=block x-served-by static-web-2 last-modified Mon, 08 Jan 2024 22:12:55 GMT server nginx etag "659c7367-231a" content-type image/png access-control-allow-origin * cache-control max-age=300, public accept-ranges bytes timing-allow-origin * x-amz-cf-id 9YJMjcMU2zwk5qFViPahePnpf_59OmpsRDINftH05QWdQe0M9BvpPw== expires Thu, 11 Jan 2024 15:08:52 GMT
GET H/1.1	200 OK	event.gif referrer.disqus.com/juggler/ Frame EDE2	43 B 339 B	116ms 100ms	Image image/gif	199.232.192.134 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://referrer.disqus.com/juggler/event.gif?abe=0&embed_hidden=0&load_time=104&event=init_embed&thread=9987428885&forum=malwarebytesunpacked&forum_id=3107640&imp=4j4t34i1lkov8d&thread_slug=metastealer_malvertising_campaigns&user_type=anon&referrer=https%3A%2F%2Fwww.malwarebytes.com%2F&theme=next&dnt=0&tracking_enabled=0&experiment=prebidbidisrequired_hidden&variant=active&service=dynamic&promoted_enabled=false&max_enabled=false Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 199.232.192.134 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=101050&t_u=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fthreat-intelligence%2F2023%2F12%2Fnew-metastealer-malvertising-campaigns&t_d=New%20MetaStealer%20malvertising%20campaigns&t_t=New%20MetaStealer%20malvertising%20campaigns&s_o=default User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers Date Thu, 11 Jan 2024 15:07:28 GMT x-content-type-options nosniff last-modified Mon, 28 Sep 1970 06:00:00 GMT server nginx content-type image/gif Cross-Origin-Resource-Policy cross-origin Connection keep-alive Content-Length 43 x-xss-protection 1; mode=block
GET H2	200	otBannerSdk.js Show response cdn.cookielaw.org/scripttemplates/202212.1.0/	392 KB 94 KB	22ms 22ms	Script application/javascript	2606:4700::6812:82ec CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/202212.1.0/otBannerSdk.js Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 063a721d5e221c66b0b3b52b66fd39f634d49e9aa16827ac5281666257d84e92 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.malwarebytes.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Thu, 11 Jan 2024 15:07:28 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 fVkC4hw/1GZwVOLkH8kBAQ== age 32497 strict-transport-security max-age=31536000; includeSubDomains; preload content-length 95639 x-ms-lease-status unlocked last-modified Mon, 13 Feb 2023 03:39:55 GMT server cloudflare etag 0x8DB0D73F93A8C75 vary Accept-Encoding content-type application/javascript access-control-allow-origin * x-ms-request-id 7a340feb-e01e-00a1-027c-ebe2fe000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control max-age=86400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 843e11ceaa8a3816-FRA
GET H2	200	en.json Show response cdn.cookielaw.org/consent/82971089-2677-4e1e-8fab-44444f76330b/d6fb4b74-ed96-4d02-8ff1-69e7c0b82a9a/	117 KB 24 KB	35ms 35ms	Fetch application/x-javascript	2606:4700::6812:82ec CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/consent/82971089-2677-4e1e-8fab-44444f76330b/d6fb4b74-ed96-4d02-8ff1-69e7c0b82a9a/en.json Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/new-metastealer-malvertising-campaigns Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 04cde96c06c1031c6552a6251fccd5edea82f47d79b1b6c0eb968b9808d4f614 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.malwarebytes.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Thu, 11 Jan 2024 15:07:28 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT strict-transport-security max-age=31536000; includeSubDomains; preload age 6084 content-md5 XzR/cEW8sxMM5q5LdGTu5g== content-length 24359 x-ms-lease-status unlocked last-modified Tue, 14 Nov 2023 18:52:18 GMT server cloudflare etag 0x8DBE542D39B1A22 vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * x-ms-request-id f27a52e8-401e-003e-362b-17aefc000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=86400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 843e11cf0cf803a0-FRA expires Fri, 12 Jan 2024 15:07:28 GMT
GET H2	200	otFlat.json Show response cdn.cookielaw.org/scripttemplates/202212.1.0/assets/	13 KB 3 KB	28ms 28ms	Fetch application/json	2606:4700::6812:82ec CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/202212.1.0/assets/otFlat.json Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/new-metastealer-malvertising-campaigns Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 1df323c03e742ff217794c8ace2c647f3f0cf868c91d4396c166262ca1075acc Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.malwarebytes.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Thu, 11 Jan 2024 15:07:28 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 zqQbOscO3o5SqFKuQoJ/AA== age 18891 strict-transport-security max-age=31536000; includeSubDomains; preload content-length 3020 x-ms-lease-status unlocked last-modified Mon, 13 Feb 2023 03:39:48 GMT server cloudflare etag 0x8DB0D73F514CE73 vary Accept-Encoding content-type application/json access-control-allow-origin * x-ms-request-id d813b0ba-a01e-0036-29f1-1db4f3000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control max-age=86400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 843e11cf4d4103a0-FRA
GET H2	200	otPcPanel.json Show response cdn.cookielaw.org/scripttemplates/202212.1.0/assets/v2/	63 KB 13 KB	25ms 25ms	Fetch application/json	2606:4700::6812:82ec CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/202212.1.0/assets/v2/otPcPanel.json Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/new-metastealer-malvertising-campaigns Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7e4619d147c3c6754720be1bad7c97cf6b3f9d696fbac16d97f1a9effe40e9dd Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.malwarebytes.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Thu, 11 Jan 2024 15:07:28 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 /zl861paWmceWHf3SA8vbQ== age 22177 strict-transport-security max-age=31536000; includeSubDomains; preload content-length 12601 x-ms-lease-status unlocked last-modified Mon, 13 Feb 2023 03:39:51 GMT server cloudflare etag 0x8DB0D73F67D0625 vary Accept-Encoding content-type application/json access-control-allow-origin * x-ms-request-id bcc062a7-c01e-001f-3486-0e8a87000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control max-age=86400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 843e11cf4d4203a0-FRA
GET H2	200	otCookieSettingsButton.json Show response cdn.cookielaw.org/scripttemplates/202212.1.0/assets/	5 KB 2 KB	26ms 26ms	Fetch application/json	2606:4700::6812:82ec CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/202212.1.0/assets/otCookieSettingsButton.json Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/new-metastealer-malvertising-campaigns Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a09d0f89e99cf5a081315ff701187632005dabd23f3ca116a75790003faa7e8f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.malwarebytes.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Thu, 11 Jan 2024 15:07:28 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 7h2gubMR6XYxX8+GVPe5nw== age 19473 strict-transport-security max-age=31536000; includeSubDomains; preload content-length 1767 x-ms-lease-status unlocked last-modified Mon, 13 Feb 2023 03:39:50 GMT server cloudflare etag 0x8DB0D73F6218550 vary Accept-Encoding content-type application/json access-control-allow-origin * x-ms-request-id ebd3905e-601e-0064-5de6-1dc81b000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control max-age=86400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 843e11cf4d4303a0-FRA
GET H2	200	otCommonStyles.css Show response cdn.cookielaw.org/scripttemplates/202212.1.0/assets/	21 KB 4 KB	26ms 26ms	Fetch text/css	2606:4700::6812:82ec CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/202212.1.0/assets/otCommonStyles.css Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/new-metastealer-malvertising-campaigns Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 930239150e702d9d4bf43c3881aa70f8ad5fd9068dcbecb7c8bcca654784f7f1 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.malwarebytes.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Thu, 11 Jan 2024 15:07:28 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT content-encoding gzip content-md5 XcxlleAcPGO2n5kTZrHH2Q== age 18891 x-ms-lease-status unlocked last-modified Mon, 13 Feb 2023 03:39:59 GMT server cloudflare vary Accept-Encoding content-type text/css access-control-allow-origin * x-ms-request-id 44bb2935-601e-004b-69c3-13c5d0000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control max-age=86400 x-ms-version 2009-09-19 cf-ray 843e11cf4d4503a0-FRA
GET H2	200	ot_close.svg cdn.cookielaw.org/logos/static/	651 B 600 B	48ms 48ms	Image image/svg+xml	2606:4700::6812:82ec CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.cookielaw.org/logos/static/ot_close.svg Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 901bb0e03b8c3c0a1cf4c487a177417328bb7d8c94106ecefceedd7d7f6c4ddc Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.malwarebytes.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Thu, 11 Jan 2024 15:07:28 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT content-encoding gzip content-md5 pcXWFGpuVeSg/jVnYCseRg== age 35804 x-ms-lease-status unlocked last-modified Wed, 10 Jan 2024 21:25:37 GMT server cloudflare vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * x-ms-request-id 1a12cd02-701e-000a-394a-449d34000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control max-age=86400 x-ms-version 2009-09-19 cf-ray 843e11cf8bf73816-FRA
GET H2	200	ot_guard_logo.svg Show response cdn.cookielaw.org/logos/static/	497 B 538 B	21ms 21ms	Fetch image/svg+xml	2606:4700::6812:82ec CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/logos/static/ot_guard_logo.svg Requested by Host: www.malwarebytes.com URL: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/new-metastealer-malvertising-campaigns Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 691dcdb24853a0f5ce4e6597e5713dea66799b57ffe2c2a10f28f98e0b569b19 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.malwarebytes.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Thu, 11 Jan 2024 15:07:28 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT content-encoding gzip content-md5 tXyZydHjxQshFMbbBT1/8A== age 18689 x-ms-lease-status unlocked last-modified Wed, 10 Jan 2024 21:25:36 GMT server cloudflare vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * x-ms-request-id 720f9cd0-501e-006f-635e-443370000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control max-age=86400 x-ms-version 2009-09-19 cf-ray 843e11cf9d8103a0-FRA
GET H2	200	MWB_logo_horizontal_RGB.png cdn.cookielaw.org/logos/4e1c8bc8-2743-413b-8699-aad2216e8616/3be7f101-47f0-48ab-ae22-e34efabb8a62/9b43fe5c-b22b-40eb-9d38-57e36d038e98/	46 KB 46 KB	34ms 34ms	Image image/png	2606:4700::6812:82ec CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.cookielaw.org/logos/4e1c8bc8-2743-413b-8699-aad2216e8616/3be7f101-47f0-48ab-ae22-e34efabb8a62/9b43fe5c-b22b-40eb-9d38-57e36d038e98/MWB_logo_horizontal_RGB.png Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash fdf7a139210ad25e0576a0721d45086e047dee38f88ba2995ce745643212c532 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.malwarebytes.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Thu, 11 Jan 2024 15:07:28 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT content-md5 g65E4kh32bbdSPqSevAl8Q== age 24672 content-length 47111 x-ms-lease-status unlocked last-modified Fri, 03 Jun 2022 20:09:47 GMT server cloudflare etag 0x8DA459D0252D23C vary Accept-Encoding content-type image/png access-control-allow-origin * x-ms-request-id 3de8db86-b01e-0067-79bf-21297f000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control max-age=86400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 843e11cfac2b3816-FRA
GET H2	200	powered_by_logo.svg cdn.cookielaw.org/logos/static/	5 KB 2 KB	31ms 31ms	Image image/svg+xml	2606:4700::6812:82ec CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.cookielaw.org/logos/static/powered_by_logo.svg Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.malwarebytes.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Thu, 11 Jan 2024 15:07:28 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT content-encoding gzip content-md5 Y+c301RBZNK39PvKQWrIBw== age 69901 x-ms-lease-status unlocked last-modified Wed, 10 Jan 2024 03:41:51 GMT server cloudflare vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * x-ms-request-id 1bad51f1-201e-004a-7978-439a0c000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control max-age=86400 x-ms-version 2009-09-19 cf-ray 843e11cfac2e3816-FRA
GET H2	200	KFOlCnqEu92Fr1MmWUlfBBc4.woff2 fonts.gstatic.com/s/roboto/v30/ Frame EDE2	15 KB 16 KB	173ms 64ms	Font font/woff2	2a00:1450:4001:812::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css2?family=Roboto:ital,wght@0,400;0,500;0,600;0,700;1,400;1,700&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://disqus.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers date Fri, 05 Jan 2024 16:39:21 GMT x-content-type-options nosniff age 512887 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 15860 x-xss-protection 0 last-modified Wed, 11 May 2022 19:24:42 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Sat, 04 Jan 2025 16:39:21 GMT
GET H2	200	KFOmCnqEu92Fr1Mu4mxK.woff2 fonts.gstatic.com/s/roboto/v30/ Frame EDE2	15 KB 16 KB	160ms 51ms	Font font/woff2	2a00:1450:4001:812::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css2?family=Roboto:ital,wght@0,400;0,500;0,600;0,700;1,400;1,700&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://disqus.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers date Tue, 09 Jan 2024 08:47:28 GMT x-content-type-options nosniff age 195600 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 15744 x-xss-protection 0 last-modified Wed, 11 May 2022 19:24:48 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Wed, 08 Jan 2025 08:47:28 GMT
GET H2	200	KFOkCnqEu92Fr1Mu51xIIzI.woff2 fonts.gstatic.com/s/roboto/v30/ Frame EDE2	17 KB 17 KB	235ms 128ms	Font font/woff2	2a00:1450:4001:812::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v30/KFOkCnqEu92Fr1Mu51xIIzI.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css2?family=Roboto:ital,wght@0,400;0,500;0,600;0,700;1,400;1,700&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash db0424fb67fb52e7e538490240cc7fb9c05aa076333a4968f3dee30b825dabf9 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://disqus.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers date Tue, 09 Jan 2024 08:58:09 GMT x-content-type-options nosniff age 194959 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 17368 x-xss-protection 0 last-modified Wed, 11 May 2022 19:24:42 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Wed, 08 Jan 2025 08:58:09 GMT
GET H2	200	KFOlCnqEu92Fr1MmEU9fBBc4.woff2 fonts.gstatic.com/s/roboto/v30/ Frame EDE2	16 KB 16 KB	215ms 109ms	Font font/woff2	2a00:1450:4001:812::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css2?family=Roboto:ital,wght@0,400;0,500;0,600;0,700;1,400;1,700&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://disqus.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers date Mon, 08 Jan 2024 17:38:05 GMT x-content-type-options nosniff age 250163 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 15920 x-xss-protection 0 last-modified Wed, 11 May 2022 19:24:45 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Tue, 07 Jan 2025 17:38:05 GMT
GET H2	200	KFOjCnqEu92Fr1Mu51TzBic6CsQ.woff2 fonts.gstatic.com/s/roboto/v30/ Frame EDE2	17 KB 17 KB	255ms 150ms	Font font/woff2	2a00:1450:4001:812::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v30/KFOjCnqEu92Fr1Mu51TzBic6CsQ.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css2?family=Roboto:ital,wght@0,400;0,500;0,600;0,700;1,400;1,700&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 6be97ca17228a69c406231d89c003194c3dfba7401eaa9fe9e9ed0ef1c18dc38 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://disqus.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers date Tue, 09 Jan 2024 13:02:14 GMT x-content-type-options nosniff age 180314 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 17032 x-xss-protection 0 last-modified Wed, 11 May 2022 19:24:52 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Wed, 08 Jan 2025 13:02:14 GMT