www.malwarebytes.com Open in urlscan Pro
192.0.66.233 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.malwarebytes.com/blog/threat-intelligence/2023/12/pikabot-distributed-via-malicious-ads
Submission: On January 04 via api (January 4th 2024, 9:38:07 am UTC) from DE — Scanned from DE

Summary HTTP 65 Redirects Links 43 Behaviour Indicators

Summary

This website contacted 14 IPs in 3 countries across 10 domains to perform 65 HTTP transactions. The main IP is 192.0.66.233, located in San Francisco, United States and belongs to AUTOMATTIC, US. The main domain is www.malwarebytes.com. The Cisco Umbrella rank of the primary domain is 135202.
TLS certificate: Issued by DigiCert Global G2 TLS RSA SHA256 202... on October 17th 2023. Valid for: a year.

This is the only time www.malwarebytes.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
20	192.0.66.233 192.0.66.233	2635 (AUTOMATTIC) (AUTOMATTIC)
1	2a00:1450:400... 2a00:1450:4001:80f::2008	15169 (GOOGLE) (GOOGLE)
2	2400:52e0:1e0... 2400:52e0:1e00::1082:1	200325 (BUNNYCDN) (BUNNYCDN)
3	199.232.196.134 199.232.196.134	54113 (FASTLY) (FASTLY)
1	2a04:fa87:fff... 2a04:fa87:fffe::c000:4902	2635 (AUTOMATTIC) (AUTOMATTIC)
2	192.0.76.3 192.0.76.3	2635 (AUTOMATTIC) (AUTOMATTIC)
1	50.16.74.83 50.16.74.83	14618 (AMAZON-AES) (AMAZON-AES)
4	151.101.192.134 151.101.192.134	54113 (FASTLY) (FASTLY)
12	2606:4700::68... 2606:4700::6812:82ec	13335 (CLOUDFLAR...) (CLOUDFLARENET)
16	2600:9000:211... 2600:9000:211a:1600:6:8656:f5c0:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700:440... 2606:4700:4400::ac40:9b77	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:82a::200a	15169 (GOOGLE) (GOOGLE)
1	199.232.192.134 199.232.192.134	54113 (FASTLY) (FASTLY)
65	14

20 192.0.66.233 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)

www.malwarebytes.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80f::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2400:52e0:1e00::1082:1 (Germany)

ASN200325 (BUNNYCDN, SI)

plausible.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 199.232.196.134 (United States)

ASN54113 (FASTLY, US)

malwarebytesunpacked.disqus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:fa87:fffe::c000:4902 (Ireland)

ASN2635 (AUTOMATTIC, US)

secure.gravatar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 192.0.76.3 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)

stats.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 50.16.74.83 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-50-16-74-83.compute-1.amazonaws.com

genesis.malwarebytes.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 151.101.192.134 (United States)

ASN54113 (FASTLY, US)

disqus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2606:4700::6812:82ec (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.cookielaw.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 2600:9000:211a:1600:6:8656:f5c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

c.disquscdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::ac40:9b77 (United States)

ASN13335 (CLOUDFLARENET, US)

geolocation.onetrust.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82a::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 199.232.192.134 (United States)

ASN54113 (FASTLY, US)

referrer.disqus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
21	malwarebytes.com www.malwarebytes.com — Cisco Umbrella Rank: 135202 genesis.malwarebytes.com — Cisco Umbrella Rank: 317304	681 KB
16	disquscdn.com c.disquscdn.com — Cisco Umbrella Rank: 5225	347 KB
12	cookielaw.org cdn.cookielaw.org — Cisco Umbrella Rank: 625	198 KB
8	disqus.com malwarebytesunpacked.disqus.com disqus.com — Cisco Umbrella Rank: 1931 referrer.disqus.com — Cisco Umbrella Rank: 7213	58 KB
2	wp.com stats.wp.com — Cisco Umbrella Rank: 3634 pixel.wp.com — Cisco Umbrella Rank: 3321	3 KB
2	plausible.io plausible.io — Cisco Umbrella Rank: 13183	2 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 115	1 KB
1	onetrust.com geolocation.onetrust.com — Cisco Umbrella Rank: 950	310 B
1	gravatar.com secure.gravatar.com — Cisco Umbrella Rank: 3313	10 KB
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 114	116 KB
65	10

	Domain	Requested by
20	www.malwarebytes.com	www.malwarebytes.com
16	c.disquscdn.com	disqus.com c.disquscdn.com
12	cdn.cookielaw.org	www.malwarebytes.com cdn.cookielaw.org
4	disqus.com	malwarebytesunpacked.disqus.com c.disquscdn.com
3	malwarebytesunpacked.disqus.com	www.malwarebytes.com malwarebytesunpacked.disqus.com
2	plausible.io	www.malwarebytes.com plausible.io
1	referrer.disqus.com
1	fonts.googleapis.com	client
1	geolocation.onetrust.com	cdn.cookielaw.org
1	pixel.wp.com	www.malwarebytes.com
1	genesis.malwarebytes.com	www.malwarebytes.com
1	stats.wp.com	www.malwarebytes.com
1	secure.gravatar.com	www.malwarebytes.com
1	www.googletagmanager.com	www.malwarebytes.com
65	14

This site contains links to these domains. Also see Links.

Domain
support.malwarebytes.com
service.malwarebytes.com
try.malwarebytes.com
my.malwarebytes.com
cloud.malwarebytes.com
partners.malwarebytes.com
www.threatdown.com
forums.malwarebytes.com
www.youtube.com
www.facebook.com
twitter.com
www.linkedin.com
www.proofpoint.com
cofense.com
www.fbi.gov
research.openanalysis.net
infosec.exchange
www.joesandbox.com
www.instagram.com
de.malwarebytes.com
es.malwarebytes.com
fr.malwarebytes.com
it.malwarebytes.com
pt.malwarebytes.com
br.malwarebytes.com
nl.malwarebytes.com
pl.malwarebytes.com
ru.malwarebytes.com
www.onetrust.com

Subject Issuer	Validity	Valid
*.malwarebytes.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-10-17` - `2024-10-04`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
plausible.io R3	`2023-12-13` - `2024-03-12`	3 months	crt.sh
*.disqus.com Sectigo RSA Domain Validation Secure Server CA	`2023-04-13` - `2024-04-20`	a year	crt.sh
*.gravatar.com Sectigo ECC Domain Validation Secure Server CA	`2023-12-05` - `2025-01-04`	a year	crt.sh
*.wp.com Sectigo ECC Domain Validation Secure Server CA	`2023-11-28` - `2024-12-28`	a year	crt.sh
malwarebytes.com Amazon RSA 2048 M02	`2023-09-05` - `2024-10-03`	a year	crt.sh
cookielaw.org Cloudflare Inc ECC CA-3	`2023-04-01` - `2024-03-31`	a year	crt.sh
a.disquscdn.com Amazon RSA 2048 M01	`2023-08-31` - `2024-09-27`	a year	crt.sh
onetrust.com Cloudflare Inc ECC CA-3	`2023-11-13` - `2024-11-12`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/pikabot-distributed-via-malicious-ads
Frame ID: 6F6990D2D1D7140E36A8AADC662A2B70
Requests: 47 HTTP requests in this frame

Frame: https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=100758&t_u=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fthreat-intelligence%2F2023%2F12%2Fpikabot-distributed-via-malicious-ads&t_d=PikaBot%20distributed%20via%20malicious%20search%20ads&t_t=PikaBot%20distributed%20via%20malicious%20search%20ads&s_o=default
Frame ID: 56229438C2064105E66FBAE1AF79D79D
Requests: 22 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

PikaBot distributed via malicious search ads | MalwarebytesrssBack ButtonSearch IconFilter Icon

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js

OneTrust (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

cdn\.cookielaw\.org
otSDKStub\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

65
Requests

100 %
HTTPS

54 %
IPv6

10
Domains

14
Subdomains

14
IPs

3
Countries

1417 kB
Transfer

3622 kB
Size

1
Cookies

43 Outgoing links

These are links going to different origins than the main page.

URL: https://support.malwarebytes.com/
Title: Personal Support

Search URL Search Domain Scan URL

URL: https://service.malwarebytes.com/
Title: Business Support

Search URL Search Domain Scan URL

URL: https://try.malwarebytes.com/custom-quote/?ref=NAV
Title: Talk to Sales

Search URL Search Domain Scan URL

URL: https://my.malwarebytes.com/en/login
Title: MyAccount sign in: manage your personal or Teams subscription >

Search URL Search Domain Scan URL

URL: https://cloud.malwarebytes.com/
Title: Cloud Console sign in: manage your cloud business products >

Search URL Search Domain Scan URL

URL: https://partners.malwarebytes.com/English
Title: Partner Portal sign in: management for Resellers and MSPs >

Search URL Search Domain Scan URL

URL: https://my.malwarebytes.com/login
Title: Manage your subscription

Search URL Search Domain Scan URL

URL: https://support.malwarebytes.com/hc/en-us
Title: Visit our support page

Search URL Search Domain Scan URL

URL: https://www.threatdown.com/pricing/
Title: Core

Search URL Search Domain Scan URL

URL: https://www.threatdown.com/security-advisor/
Title: Security Advisor

Search URL Search Domain Scan URL

URL: https://www.threatdown.com/products/
Title: Full technology list >

Search URL Search Domain Scan URL

URL: https://try.malwarebytes.com/2023-state-of-malware/?utm_source=website
Title: The State of Malware 2023 Report

Search URL Search Domain Scan URL

URL: https://forums.malwarebytes.com/
Title: Forums

Search URL Search Domain Scan URL

URL: https://support.malwarebytes.com/hc/en-us/articles/360038524154-Report-a-false-positive-to-Malwarebytes-Support
Title: Report a False Positive

Search URL Search Domain Scan URL

URL: https://support.malwarebytes.com/hc/en-us/articles/360046199873-Activate-Malwarebytes-Privacy-on-Windows-device
Title: See Content

Search URL Search Domain Scan URL

URL: https://www.youtube.com/malwarebytes
Title: Product Videos

Search URL Search Domain Scan URL

URL: https://www.facebook.com/Malwarebytes/

Search URL Search Domain Scan URL

URL: https://twitter.com/malwarebytes

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/malwarebytes

Search URL Search Domain Scan URL

URL: https://twitter.com/Unit42_Intel/status/1623349272061136900
Title: identified

Search URL Search Domain Scan URL

URL: https://www.proofpoint.com/us/blog/threat-insight/first-step-initial-access-leads-ransomware
Title: TA577

Search URL Search Domain Scan URL

URL: https://cofense.com/blog/are-darkgate-and-pikabot-the-new-qakbot/
Title: observed

Search URL Search Domain Scan URL

URL: https://www.fbi.gov/news/stories/fbi-partners-dismantle-qakbot-infrastructure-in-multinational-cyber-takedown
Title: takedown

Search URL Search Domain Scan URL

URL: https://research.openanalysis.net/pikabot/debugging/string%20decryption/2023/11/12/new-pikabot.html#Analysis
Title: described by OALabs

Search URL Search Domain Scan URL

URL: https://infosec.exchange/@th3_protoCOL/111564318665696767
Title: observed

Search URL Search Domain Scan URL

URL: https://twitter.com/OleVilladsen
Title: Ole Villadsen

Search URL Search Domain Scan URL

URL: https://www.joesandbox.com/analysis/1362406/0/html
Title: JoeSandbox

Search URL Search Domain Scan URL

URL: http://www.facebook.com/sharer.php?u=https://www.malwarebytes.com/blog/threat-intelligence/2023/12/pikabot-distributed-via-malicious-ads

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?text=PikaBot+distributed+via+malicious+search+ads+https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fthreat-intelligence%2F2023%2F12%2Fpikabot-distributed-via-malicious-ads&via=Malwarebytes

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/shareArticle?mini=true&url=https://www.malwarebytes.com/blog/threat-intelligence/2023/12/pikabot-distributed-via-malicious-ads&summary=&source=

Search URL Search Domain Scan URL

URL: https://www.facebook.com/Malwarebytes
Title: Facebook

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/Malwarebytes
Title: Youtube

Search URL Search Domain Scan URL

URL: https://www.instagram.com/malwarebytesofficial
Title: Instagram

Search URL Search Domain Scan URL

URL: https://de.malwarebytes.com/
Title: Deutsch

Search URL Search Domain Scan URL

URL: https://es.malwarebytes.com/
Title: Español

Search URL Search Domain Scan URL

URL: https://fr.malwarebytes.com/
Title: Français

Search URL Search Domain Scan URL

URL: https://it.malwarebytes.com/
Title: Italiano

Search URL Search Domain Scan URL

URL: https://pt.malwarebytes.com/
Title: Português (Portugal)

Search URL Search Domain Scan URL

URL: https://br.malwarebytes.com/
Title: Português (Brasil)

Search URL Search Domain Scan URL

URL: https://nl.malwarebytes.com/
Title: Nederlands

Search URL Search Domain Scan URL

URL: https://pl.malwarebytes.com/
Title: Polski

Search URL Search Domain Scan URL

URL: https://ru.malwarebytes.com/
Title: Pусский

Search URL Search Domain Scan URL

URL: https://www.onetrust.com/products/cookie-consent/

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

65 HTTP transactions
4 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request pikabot-distributed-via-malicious-ads Show response
www.malwarebytes.com/blog/threat-intelligence/2023/12/ 306 KB
64 KB 85ms
28ms Document
text/html 192.0.66.233
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.malwarebytes.com/blog/threat-intelligence/2023/12/pikabot-distributed-via-malicious-ads

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

fefd59c5420bffa07f30dd911d23643ec4036dcb727d5c29efba46a889165502

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 459
cache-control: max-age=300, must-revalidate
content-encoding: br
content-length: 65355
content-type: text/html; charset=UTF-8
date: Thu, 04 Jan 2024 09:38:02 GMT
host-header: a9130478a60e5f9135f765b23f26593b
link: <https://www.malwarebytes.com/wp-json/>; rel="https://api.w.org/" <https://www.malwarebytes.com/wp-json/wp/v2/posts/100758>; rel="alternate"; type="application/json" <https://www.malwarebytes.com/?p=100758>; rel=shortlink
referrer-policy: strict-origin-when-cross-origin
server: nginx
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-cache: hit
x-content-type-options: nosniff
x-frame-options: DENY
x-rq: hhn2 96 184 443

GET
H2 200 /
www.malwarebytes.com/_static/ 374 KB
68 KB 28ms
28ms Stylesheet
text/css 192.0.66.233
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.malwarebytes.com/_static/??-eJyNzEESwiAMBdALCSlloRvHs4Q2KkooQ8Iwvb3ouHThMv//F+jFLFtWygp6JyYBxtSxUth1HChCKhBaTOtoYraLyAH+UymGinWHQeA65gY7ycZk+ccfbqakdotZ4EFacHkaN9vTB3+Dt7nw2R0nP83OO/8CCIpFtw==

Requested by

Host: www.malwarebytes.com
URL: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/pikabot-distributed-via-malicious-ads

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

9bdd701c0629752935c98cbdb5a9671cba6af18797867921989b11ccc457e966

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/pikabot-distributed-via-malicious-ads
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Thu, 04 Jan 2024 09:38:02 GMT
content-encoding: br
strict-transport-security: max-age=31536000
last-modified: Tue, 19 Dec 2023 21:28:33 GMT
server: nginx
x-rq: hhn2 96 184 443
vary: Accept-Encoding
x-cache: HIT
content-type: text/css;charset=utf-8
cache-control: max-age=31536000

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 382 KB
116 KB 257ms
105ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-MKSKW3

Requested by

Host: www.malwarebytes.com
URL: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/pikabot-distributed-via-malicious-ads

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

f9482dfaea36c8cf88657505545bfa58dd25f4c5efbfc5c334ed97cd3b615999

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Thu, 04 Jan 2024 09:38:02 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 118508
x-xss-protection: 0
last-modified: Thu, 04 Jan 2024 09:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 04 Jan 2024 09:38:02 GMT

GET
H2 200 script.js Show response
plausible.io/js/ 1 KB
1 KB 99ms
41ms Script
application/javascript 2400:52e0:1e00::1082:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL

https://plausible.io/js/script.js

Requested by

Host: www.malwarebytes.com
URL: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/pikabot-distributed-via-malicious-ads

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2400:52e0:1e00::1082:1 , Germany, ASN200325 (BUNNYCDN, SI),

Reverse DNS

Software

BunnyCDN-DE1-1082 /

Resource Hash

021f0fd27042b279a49e982215c6dc3c3ab84e95b35553a119dfdbd50af6be94

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Thu, 04 Jan 2024 09:38:02 GMT
content-encoding: br
x-content-type-options: nosniff
cdn-edgestorageid: 1080
cdn-cachedat: 01/04/2024 07:28:41
cdn-pullzone: 682664
cross-origin-resource-policy: cross-origin
application: 10.0.0.3
alt-svc: h3=":443"; ma=2592000
server: BunnyCDN-DE1-1082
cdn-proxyver: 1.04
cdn-requestpullcode: 200
vary: Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 153cb5b1-399a-48ef-b5bf-098c03770254
cache-control: public, must-revalidate, max-age=86400
permissions-policy: interest-cohort=()
cdn-requestid: 5fb82ec34c1ba5cf6e073b7b220635ab
cdn-requestcountrycode: SE
cdn-status: 200
cdn-requestpullsuccess: True

GET
DATA 200
OK truncated
/ 577 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b556aa0c99a333220bef9718a277f81139f356534c0c707430252f445f769b8b

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 436 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 242aa88120783594cb0c56ff247407db601e2a09c4f598f7c7d40b9b2ba6369e

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 Roboto-Regular.b009a76a.woff2
www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/ 15 KB
16 KB 36ms
36ms Font
application/font-woff2 192.0.66.233
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/Roboto-Regular.b009a76a.woff2

Requested by

Host: www.malwarebytes.com
URL: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/pikabot-distributed-via-malicious-ads

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/pikabot-distributed-via-malicious-ads
Origin: https://www.malwarebytes.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Thu, 04 Jan 2024 09:38:02 GMT
strict-transport-security: max-age=31536000
x-rq: hhn2 96 185 443
last-modified: Mon, 21 Aug 2023 16:24:11 GMT
server: nginx
etag: "64e38fab-3d80"
x-cache: HIT
content-type: application/font-woff2
access-control-allow-origin: *
access-control-allow-methods: GET, HEAD
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 15744

GET
H2 200 Graphik-Regular.3fdd19ea.woff2
www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/ 38 KB
38 KB 37ms
36ms Font
application/font-woff2 192.0.66.233
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/Graphik-Regular.3fdd19ea.woff2

Requested by

Host: www.malwarebytes.com
URL: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/pikabot-distributed-via-malicious-ads

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

9e1c5b7f15bcd940814677515f306113aa93921b6e7f0d184a6de904d07b6f43

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/pikabot-distributed-via-malicious-ads
Origin: https://www.malwarebytes.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Thu, 04 Jan 2024 09:38:02 GMT
strict-transport-security: max-age=31536000
x-rq: hhn2 96 185 443
last-modified: Mon, 21 Aug 2023 16:24:11 GMT
server: nginx
etag: "64e38fab-97a8"
x-cache: HIT
content-type: application/font-woff2
access-control-allow-origin: *
access-control-allow-methods: GET, HEAD
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 38824

GET
H2 200 Graphik-Medium.3ff48deb.woff2
www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/ 42 KB
42 KB 37ms
37ms Font
application/font-woff2 192.0.66.233
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/Graphik-Medium.3ff48deb.woff2

Requested by

Host: www.malwarebytes.com
URL: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/pikabot-distributed-via-malicious-ads

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

fc4c4327594c7559168718f24efe82754660fdd55f62aa796baefee1e9b8d3d3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/pikabot-distributed-via-malicious-ads
Origin: https://www.malwarebytes.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Thu, 04 Jan 2024 09:38:02 GMT
strict-transport-security: max-age=31536000
x-rq: hhn2 96 185 443
last-modified: Mon, 21 Aug 2023 16:24:11 GMT
server: nginx
etag: "64e38fab-a738"
x-cache: HIT
content-type: application/font-woff2
access-control-allow-origin: *
access-control-allow-methods: GET, HEAD
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 42808

GET
H2 200 Graphik-Semibold.b023d334.woff2
www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/ 42 KB
42 KB 37ms
37ms Font
application/font-woff2 192.0.66.233
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/Graphik-Semibold.b023d334.woff2

Requested by

Host: www.malwarebytes.com
URL: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/pikabot-distributed-via-malicious-ads

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

33441b6e44fb33343a5769858ca65653ce482e5e0c58c6eb1cee0e50aa06ddf6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/pikabot-distributed-via-malicious-ads
Origin: https://www.malwarebytes.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Thu, 04 Jan 2024 09:38:02 GMT
strict-transport-security: max-age=31536000
x-rq: hhn2 96 185 443
last-modified: Mon, 21 Aug 2023 16:24:11 GMT
server: nginx
etag: "64e38fab-a63c"
x-cache: HIT
content-type: application/font-woff2
access-control-allow-origin: *
access-control-allow-methods: GET, HEAD
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 42556

GET
H2 200 product-menu-screen.webp
www.malwarebytes.com/wp-content/uploads/sites/2/2023/09/ 16 KB
16 KB 48ms
47ms Image
image/webp 192.0.66.233
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.malwarebytes.com/wp-content/uploads/sites/2/2023/09/product-menu-screen.webp?w=356

Requested by

Host: www.malwarebytes.com
URL: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/pikabot-distributed-via-malicious-ads

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

2fc88556de1ebed9f55afb87d495d90d43f939a515f3afa5d59e953b8fc0ab20

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/pikabot-distributed-via-malicious-ads
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Thu, 04 Jan 2024 09:38:02 GMT
strict-transport-security: max-age=31536000
x-rq: hhn2 109 195 443
last-modified: Wed, 08 Nov 2023 01:04:49 GMT
server: nginx
etag: "99a2a2e0844c2dfe"
vary: Accept
x-cache: HIT
content-type: image/webp
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 16616

GET
H2 200 malwarebytes-state-of-malware-report-2023.jpg
www.malwarebytes.com/wp-content/uploads/sites/2/2023/07/ 72 KB
72 KB 48ms
47ms Image
image/jpeg 192.0.66.233
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.malwarebytes.com/wp-content/uploads/sites/2/2023/07/malwarebytes-state-of-malware-report-2023.jpg

Requested by

Host: www.malwarebytes.com
URL: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/pikabot-distributed-via-malicious-ads

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

32a0ce8663059aa406b6a9e8d569b840ee324c6af0f97c57d98ec1a6b6286b01

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/pikabot-distributed-via-malicious-ads
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Thu, 04 Jan 2024 09:38:02 GMT
strict-transport-security: max-age=31536000
x-rq: hhn2 109 32 443
last-modified: Mon, 30 Oct 2023 19:40:32 GMT
server: nginx
etag: "0f1fd79d974f3f8c"
vary: Accept
x-cache: HIT
content-type: image/jpeg
cache-control: max-age=300
accept-ranges: bytes
content-length: 73655

GET
H2 200 robot.jpg
www.malwarebytes.com/wp-content/uploads/sites/2/2021/06/ 36 KB
36 KB 48ms
47ms Image
image/webp 192.0.66.233
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.malwarebytes.com/wp-content/uploads/sites/2/2021/06/robot.jpg

Requested by

Host: www.malwarebytes.com
URL: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/pikabot-distributed-via-malicious-ads

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

e676d6ef7d0563377e7ca9097d51c29f45ca47c4192d91e32b794ef7ed0a922d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/pikabot-distributed-via-malicious-ads
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Thu, 04 Jan 2024 09:38:02 GMT
strict-transport-security: max-age=31536000
x-rq: hhn2 109 83 443
last-modified: Fri, 15 Dec 2023 19:18:18 GMT
server: nginx
etag: "0167d2c0776641d6"
vary: Accept
x-cache: HIT
content-type: image/webp
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 36892

GET
H2 200 image-7.png
www.malwarebytes.com/wp-content/uploads/sites/2/2023/12/ 14 KB
15 KB 48ms
47ms Image
image/webp 192.0.66.233
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.malwarebytes.com/wp-content/uploads/sites/2/2023/12/image-7.png

Requested by

Host: www.malwarebytes.com
URL: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/pikabot-distributed-via-malicious-ads

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

5d73add4b4c244e37f72201f51447f26ac9f30970e9e02ce45d0e05a5e58b21c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/pikabot-distributed-via-malicious-ads
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Thu, 04 Jan 2024 09:38:02 GMT
strict-transport-security: max-age=31536000
x-rq: hhn2 109 142 443
last-modified: Fri, 15 Dec 2023 19:18:18 GMT
server: nginx
etag: "3cf03c1011faa589"
vary: Accept
x-cache: HIT
content-type: image/webp
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 14622

GET
H/1.1 200
OK embed.js Show response
malwarebytesunpacked.disqus.com/ 79 KB
26 KB 87ms
28ms Script
application/javascript 199.232.196.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://malwarebytesunpacked.disqus.com/embed.js

Requested by

Host: www.malwarebytes.com
URL: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/pikabot-distributed-via-malicious-ads

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

199.232.196.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

openresty /

Resource Hash

c45109f3cafbc678c807f5b678c8c9a34f426ceea5e1c09d0e88e53e0760c1d1

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Date: Thu, 04 Jan 2024 09:38:02 GMT
content-encoding: gzip
Strict-Transport-Security: max-age=300; includeSubdomains
server: openresty
Age: 60
Vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
Cache-Control: private, max-age=60
x-service: router
Cross-Origin-Resource-Policy: cross-origin
Connection: keep-alive
Link: <https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
Content-Length: 26121

GET
H2 200 footer-globe.svg
www.malwarebytes.com/wp-content/themes/malwarebytes/assets/src/images/ 4 KB
2 KB 47ms
47ms Image
image/svg+xml 192.0.66.233
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.malwarebytes.com/wp-content/themes/malwarebytes/assets/src/images/footer-globe.svg

Requested by

Host: www.malwarebytes.com
URL: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/pikabot-distributed-via-malicious-ads

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

17844b6e32a1300ba44a13e98c650fe16e4759364491b8161510e28aa648e79e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/pikabot-distributed-via-malicious-ads
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Thu, 04 Jan 2024 09:38:02 GMT
content-encoding: br
strict-transport-security: max-age=31536000
last-modified: Mon, 21 Aug 2023 16:24:11 GMT
server: nginx
x-rq: hhn2 96 185 443
etag: W/"64e38fab-103f"
vary: Accept-Encoding
x-cache: HIT
content-type: image/svg+xml
cache-control: max-age=31536000

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c2bf4235c36480dd023ae5a3161be4b1d3c5f4728c753788d43530cece558812

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 Roboto-Medium.f25d774e.woff2
www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/ 16 KB
16 KB 44ms
43ms Font
application/font-woff2 192.0.66.233
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/Roboto-Medium.f25d774e.woff2

Requested by

Host: www.malwarebytes.com
URL: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/pikabot-distributed-via-malicious-ads

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/pikabot-distributed-via-malicious-ads
Origin: https://www.malwarebytes.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Thu, 04 Jan 2024 09:38:02 GMT
strict-transport-security: max-age=31536000
x-rq: hhn2 96 185 443
last-modified: Mon, 21 Aug 2023 16:24:11 GMT
server: nginx
etag: "64e38fab-3e30"
x-cache: HIT
content-type: application/font-woff2
access-control-allow-origin: *
access-control-allow-methods: GET, HEAD
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 15920

GET
H2 200 Roboto-Bold.227c9319.woff2
www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/ 15 KB
16 KB 44ms
43ms Font
application/font-woff2 192.0.66.233
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/Roboto-Bold.227c9319.woff2

Requested by

Host: www.malwarebytes.com
URL: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/pikabot-distributed-via-malicious-ads

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/pikabot-distributed-via-malicious-ads
Origin: https://www.malwarebytes.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Thu, 04 Jan 2024 09:38:02 GMT
strict-transport-security: max-age=31536000
x-rq: hhn2 96 184 443
last-modified: Mon, 21 Aug 2023 16:24:11 GMT
server: nginx
etag: "64e38fab-3df4"
x-cache: HIT
content-type: application/font-woff2
access-control-allow-origin: *
access-control-allow-methods: GET, HEAD
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 15860

GET
H2 200 Roboto-Black.2e8becfc.woff2
www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/ 15 KB
16 KB 44ms
43ms Font
application/font-woff2 192.0.66.233
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/Roboto-Black.2e8becfc.woff2

Requested by

Host: www.malwarebytes.com
URL: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/pikabot-distributed-via-malicious-ads

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

7e262106f82cc52663e403f5b73795bbeab9ca0630c33c03579354fbcd4fae1e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/pikabot-distributed-via-malicious-ads
Origin: https://www.malwarebytes.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Thu, 04 Jan 2024 09:38:02 GMT
strict-transport-security: max-age=31536000
x-rq: hhn2 96 185 443
last-modified: Mon, 21 Aug 2023 16:24:11 GMT
server: nginx
etag: "64e38fab-3d88"
x-cache: HIT
content-type: application/font-woff2
access-control-allow-origin: *
access-control-allow-methods: GET, HEAD
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 15752

GET
H2 200 image-2.png
www.malwarebytes.com/wp-content/uploads/sites/2/2023/12/ 36 KB
36 KB 39ms
39ms Image
image/webp 192.0.66.233
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.malwarebytes.com/wp-content/uploads/sites/2/2023/12/image-2.png

Requested by

Host: www.malwarebytes.com
URL: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/pikabot-distributed-via-malicious-ads

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

c009a64085905de705aa36130211009e6ad252f7460e476f5498a065b0d6e4f0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/pikabot-distributed-via-malicious-ads
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Thu, 04 Jan 2024 09:38:02 GMT
strict-transport-security: max-age=31536000
x-rq: hhn2 109 139 443
last-modified: Fri, 15 Dec 2023 19:09:54 GMT
server: nginx
etag: "5e0ecb170fdd0d96"
vary: Accept
x-cache: HIT
content-type: image/webp
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 36802

GET
H2 200 image-4.png
www.malwarebytes.com/wp-content/uploads/sites/2/2023/12/ 100 KB
100 KB 39ms
39ms Image
image/webp 192.0.66.233
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.malwarebytes.com/wp-content/uploads/sites/2/2023/12/image-4.png

Requested by

Host: www.malwarebytes.com
URL: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/pikabot-distributed-via-malicious-ads

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

9a0f5f040f639e0018ac2452cb66fa7871163de8613f3385f6960123f6b0a1fa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/pikabot-distributed-via-malicious-ads
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Thu, 04 Jan 2024 09:38:02 GMT
strict-transport-security: max-age=31536000
x-rq: hhn2 109 27 443
last-modified: Fri, 15 Dec 2023 19:32:24 GMT
server: nginx
etag: "058e532fc9439eea"
vary: Accept
x-cache: HIT
content-type: image/webp
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 102302

GET
H2 200 image-5.png
www.malwarebytes.com/wp-content/uploads/sites/2/2023/12/ 8 KB
9 KB 39ms
39ms Image
image/webp 192.0.66.233
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.malwarebytes.com/wp-content/uploads/sites/2/2023/12/image-5.png

Requested by

Host: www.malwarebytes.com
URL: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/pikabot-distributed-via-malicious-ads

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

323afff76b71bf2771d47f84f88ac7e7e7fd3fff5e0742f34225e4236867faf0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/pikabot-distributed-via-malicious-ads
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Thu, 04 Jan 2024 09:38:02 GMT
strict-transport-security: max-age=31536000
x-rq: hhn2 109 142 443
last-modified: Fri, 15 Dec 2023 19:32:41 GMT
server: nginx
etag: "5121b2bebd4818ae"
vary: Accept
x-cache: HIT
content-type: image/webp
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 8644

GET
H2 200 8ff7688dd7aaf66effb89c65203ee7c3
secure.gravatar.com/avatar/ 10 KB
10 KB 84ms
27ms Image
image/jpeg 2a04:fa87:fffe::c000:4902
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.gravatar.com/avatar/8ff7688dd7aaf66effb89c65203ee7c3?size=300
Requested by: Host: www.malwarebytes.com
URL: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/pikabot-distributed-via-malicious-ads
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 4ca7509272fd378d23ad6d1c7f7bfce000ae1569832b6347b8bce568816ed159

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Thu, 04 Jan 2024 09:38:02 GMT
last-modified: Thu, 19 Nov 2020 20:30:53 GMT
server: nginx
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=300
content-disposition: inline; filename="8ff7688dd7aaf66effb89c65203ee7c3.jpg"
accept-ranges: bytes
link: <https://gravatar.com/avatar/8ff7688dd7aaf66effb89c65203ee7c3?size=300>; rel="canonical"
content-length: 10272
alt-svc: h3=":443"; ma=86400
expires: Thu, 04 Jan 2024 09:43:02 GMT

GET
H/1.1 200
OK count.js Show response
malwarebytesunpacked.disqus.com/ 1 KB
2 KB 85ms
27ms Script
application/javascript 199.232.196.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://malwarebytesunpacked.disqus.com/count.js

Requested by

Host: www.malwarebytes.com
URL: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/pikabot-distributed-via-malicious-ads

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

199.232.196.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

3487ef2baf0c08ba660a8a143cdeb8ebeec961eea04bccd7c49096b4eb26b875

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Date: Thu, 04 Jan 2024 09:38:02 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=300; includeSubdomains
X-Amz-Cf-Pop: DFW3-C1
Age: 85
Cross-Origin-Resource-Policy: cross-origin
Connection: keep-alive
Content-Length: 871
X-XSS-Protection: 1; mode=block
Last-Modified: Tue, 02 Jan 2024 14:37:25 GMT
Server: nginx
ETag: "65941fa5-367"
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Cache-Control: public, max-age=300
Link: <https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
X-Amz-Cf-Id: Pl_V38_XD4Ct4UvT569BhBLfdYFv1lNEZBsbmeRt1gIo5dva2w_E7w==

GET
H2 200 jquery.min.js Show response
www.malwarebytes.com/wp-includes/js/jquery/ 86 KB
31 KB 37ms
37ms Script
application/javascript 192.0.66.233
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.malwarebytes.com/wp-includes/js/jquery/jquery.min.js?ver=1.0

Requested by

Host: www.malwarebytes.com
URL: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/pikabot-distributed-via-malicious-ads

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/pikabot-distributed-via-malicious-ads
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Thu, 04 Jan 2024 09:38:02 GMT
content-encoding: br
strict-transport-security: max-age=31536000
last-modified: Wed, 06 Dec 2023 23:24:04 GMT
server: nginx
x-rq: hhn2 96 184 443
etag: W/"65710294-15601"
vary: Accept-Encoding
x-cache: HIT
content-type: application/javascript
cache-control: max-age=31536000

GET
H2 200 / Show response
www.malwarebytes.com/_static/ 15 KB
5 KB 35ms
34ms Script
application/javascript 192.0.66.233
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.malwarebytes.com/_static/??-eJyVy0sOgCAMANELiQU3xIXxLEVqhPAxtIZ4e7mCy8nkQb/VUYtQEZCLMjFkTB0buVdGIDMJg3tC8uOEMkee4A86G5HytZdU0Q+9581YvaxGW23jB1QwLyg=

Requested by

Host: www.malwarebytes.com
URL: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/pikabot-distributed-via-malicious-ads

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

d6693d78eb6f5c5e5ed5edaf6ecebad27225578f87a9e46e0876ca90093dc6c8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/pikabot-distributed-via-malicious-ads
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Thu, 04 Jan 2024 09:38:02 GMT
content-encoding: br
strict-transport-security: max-age=31536000
last-modified: Mon, 18 Dec 2023 14:45:07 GMT
server: nginx
x-rq: hhn2 96 185 443
vary: Accept-Encoding
x-cache: HIT
content-type: application/javascript
cache-control: max-age=31536000

GET
H2 200 e-202401.js Show response
stats.wp.com/ 7 KB
3 KB 83ms
27ms Script
application/javascript 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.wp.com/e-202401.js
Requested by: Host: www.malwarebytes.com
URL: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/pikabot-distributed-via-malicious-ads
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ca7752fb33cf3a98c0f29bc4eec563112025da4109a0dcc69dabf5f861751258

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

x-minify-cache: hit
x-nc: HIT hhn
date: Thu, 04 Jan 2024 09:38:02 GMT
content-encoding: br
server: nginx
x-minify: t
etag: W/13576-1684460848292.3706
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
alt-svc: h3=":443"; ma=86400
expires: Mon, 30 Dec 2024 06:54:41 GMT

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 63ccbd40f783b34fe6bc9ef9e971de08e32012b91ee81dd54b325ecf527c1dac

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 Graphik-Light.8512717f.woff2
www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/ 41 KB
41 KB 34ms
34ms Font
application/font-woff2 192.0.66.233
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.malwarebytes.com/wp-content/themes/malwarebytes/assets/build/fonts/Graphik-Light.8512717f.woff2

Requested by

Host: www.malwarebytes.com
URL: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/pikabot-distributed-via-malicious-ads

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.66.233 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

039bb21133a0657e78917ed224bc151347123282bbd3bf1e0c5da81bccb93da6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/pikabot-distributed-via-malicious-ads
Origin: https://www.malwarebytes.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Thu, 04 Jan 2024 09:38:02 GMT
strict-transport-security: max-age=31536000
x-rq: hhn2 96 184 443
last-modified: Mon, 21 Aug 2023 16:24:11 GMT
server: nginx
etag: "64e38fab-a410"
x-cache: HIT
content-type: application/font-woff2
access-control-allow-origin: *
access-control-allow-methods: GET, HEAD
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 42000

POST
H2 202 event Show response
plausible.io/api/ 2 B
501 B 92ms
36ms XHR
text/plain 2400:52e0:1e00::1082:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL: https://plausible.io/api/event
Requested by: Host: plausible.io
URL: https://plausible.io/js/script.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2400:52e0:1e00::1082:1 , Germany, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software: BunnyCDN-DE1-1082 /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Referer: https://www.malwarebytes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 04 Jan 2024 09:38:02 GMT
cdn-edgestorageid: 1082
cdn-cachedat: 01/04/2024 09:38:02
cdn-pullzone: 682664
application: 10.0.1.2
alt-svc: h3=":443"; ma=2592000
content-length: 2
x-request-id: F6cbX9sGMb7hlF0A126I
server: BunnyCDN-DE1-1082
cdn-proxyver: 1.04
cdn-requestpullcode: 202
content-type: text/plain; charset=utf-8
access-control-allow-origin: *
cdn-uid: 153cb5b1-399a-48ef-b5bf-098c03770254
cache-control: must-revalidate, max-age=0, private
access-control-allow-credentials: true
permissions-policy: interest-cohort=()
cdn-requestid: 04e50b9af08b85a67a4d140ebfa4f5e4
cdn-requestcountrycode: SE
cdn-requestpullsuccess: True

GET
H2 200 locate Show response
genesis.malwarebytes.com/api/v1/ 404 B
586 B 361ms
121ms XHR
application/json 50.16.74.83
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://genesis.malwarebytes.com/api/v1/locate
Requested by: Host: www.malwarebytes.com
URL: https://www.malwarebytes.com/_static/??-eJyVy0sOgCAMANELiQU3xIXxLEVqhPAxtIZ4e7mCy8nkQb/VUYtQEZCLMjFkTB0buVdGIDMJg3tC8uOEMkee4A86G5HytZdU0Q+9581YvaxGW23jB1QwLyg=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.16.74.83 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-50-16-74-83.compute-1.amazonaws.com
Software: /
Resource Hash: 34cffbf270a64813450be6374b31df86a1c8ce0fdb540777c18f4b4db1932aa7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

access-control-allow-origin: https://www.malwarebytes.com
date: Thu, 04 Jan 2024 09:38:02 GMT
content-length: 404
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-type: application/json

GET
H2 200 g.gif
pixel.wp.com/ 50 B
177 B 28ms
27ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?v=ext&blog=227197325&post=100758&tz=-8&srv=www.malwarebytes.com&hp=vip&j=1%3A12.8.1&host=www.malwarebytes.com&ref=&fcp=151&rand=0.9719746707202628
Requested by: Host: www.malwarebytes.com
URL: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/pikabot-distributed-via-malicious-ads
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

access-control-allow-origin: *
date: Thu, 04 Jan 2024 09:38:02 GMT
cache-control: no-cache
server: nginx
alt-svc: h3=":443"; ma=86400
content-length: 50
content-type: image/gif

GET
H/1.1 200
OK count-data.js Show response
malwarebytesunpacked.disqus.com/ 355 B
938 B 29ms
29ms Script
application/javascript 199.232.196.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://malwarebytesunpacked.disqus.com/count-data.js?1=100188&1=101347&1=101419&1=101452&1=101460

Requested by

Host: malwarebytesunpacked.disqus.com
URL: https://malwarebytesunpacked.disqus.com/count.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

199.232.196.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

38f3c32e50f3f80b71090bd258d5ae64ea9424488bd063424a1f53554f09114f

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Date: Thu, 04 Jan 2024 09:38:02 GMT
Strict-Transport-Security: max-age=300; includeSubdomains
X-Content-Type-Options: nosniff
Server: nginx
Age: 297
X-Frame-Options: SAMEORIGIN
Vary: Accept-Encoding
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Content-Type: application/javascript; charset=UTF-8
Cache-Control: public, max-age=600
Cross-Origin-Resource-Policy: cross-origin
Connection: keep-alive
Link: <https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
Content-Length: 355
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK / Show response
disqus.com/embed/comments/ Frame 5622 7 KB
4 KB 85ms
28ms Document
text/html 151.101.192.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=100758&t_u=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fthreat-intelligence%2F2023%2F12%2Fpikabot-distributed-via-malicious-ads&t_d=PikaBot%20distributed%20via%20malicious%20search%20ads&t_t=PikaBot%20distributed%20via%20malicious%20search%20ads&s_o=default

Requested by

Host: malwarebytesunpacked.disqus.com
URL: https://malwarebytesunpacked.disqus.com/embed.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

151.101.192.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

9e88b7199433a1d13f972993042c9ba967066a989c593fd1f0a79231475bffd4

Security Headers

Name	Value
Content-Security-Policy	script-src https://.twitter.com: https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://.services.disqus.com: https://cdn.boomtrain.com/p13n/ https://com-disqus.netmng.com:* 'unsafe-inline' https://referrer.disqus.com/juggler/ https://connect.facebook.net/en_US/sdk.js https://cdn.syndication.twimg.com/tweets.json https://apis.google.com https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.malwarebytes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Age: 1
Cache-Control: stale-if-error=3600, s-stalewhilerevalidate=3600, stale-while-revalidate=30, no-cache, must-revalidate, public, s-maxage=5
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 2947
Content-Security-Policy: script-src https://*.twitter.com:* https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://*.services.disqus.com:* https://cdn.boomtrain.com/p13n/ https://com-disqus.netmng.com:* 'unsafe-inline' https://referrer.disqus.com/juggler/ https://connect.facebook.net/en_US/sdk.js https://cdn.syndication.twimg.com/tweets.json https://apis.google.com https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com
Content-Type: text/html; charset=utf-8
Cross-Origin-Resource-Policy: cross-origin
Date: Thu, 04 Jan 2024 09:38:02 GMT
ETag: W/"lounge:view:9981309803.225de93cb05732fbee0c0df0c0ce20a0.2"
Last-Modified: Fri, 15 Dec 2023 19:00:27 GMT
Link: <https://c.disquscdn.com>;rel=preconnect,<https://c.disquscdn.com>;rel=dns-prefetch
Referrer-Policy: no-referrer-when-downgrade
Server: nginx
Strict-Transport-Security: max-age=300; includeSubdomains
Timing-Allow-Origin: *
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"

GET
H2 200 otSDKStub.js Show response
cdn.cookielaw.org/scripttemplates/ 21 KB
7 KB 107ms
42ms Script
application/javascript 2606:4700::6812:82ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Requested by

Host: www.malwarebytes.com
URL: https://www.malwarebytes.com/blog/threat-intelligence/2023/12/pikabot-distributed-via-malicious-ads

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6d72fa0f78c80b1874d3ee4aadf43d973edc442a65fef83d37e684ac559893b7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 04 Jan 2024 09:38:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: 5rel+BW+cbOCNkEJ4C4NBQ==
age: 35681
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 6841
x-ms-lease-status: unlocked
last-modified: Thu, 21 Dec 2023 21:19:55 GMT
server: cloudflare
etag: 0x8DC026A943751A5
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: d530a67f-201e-0007-3283-3455e0000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 840281a03c8d3516-WAW

GET
H2 200 lounge.load.51dfeea10554db37f6ba310f2efb9cb8.js Show response
c.disquscdn.com/next/embed/ Frame 5622 1 KB
1 KB 131ms
44ms Script
application/javascript 2600:9000:211a:1600:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/lounge.load.51dfeea10554db37f6ba310f2efb9cb8.js

Requested by

Host: disqus.com
URL: https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=100758&t_u=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fthreat-intelligence%2F2023%2F12%2Fpikabot-distributed-via-malicious-ads&t_d=PikaBot%20distributed%20via%20malicious%20search%20ads&t_t=PikaBot%20distributed%20via%20malicious%20search%20ads&s_o=default

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:211a:1600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

fce841aa7866c534d46a4a89dd89b85cf390919126d75e2527d84e8e30b63a32

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=100758&t_u=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fthreat-intelligence%2F2023%2F12%2Fpikabot-distributed-via-malicious-ads&t_d=PikaBot%20distributed%20via%20malicious%20search%20ads&t_t=PikaBot%20distributed%20via%20malicious%20search%20ads&s_o=default
Origin: https://disqus.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

x-cache-hits: 0
date: Thu, 21 Dec 2023 18:53:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 218366faeb88f6d265d2589e37ea2dac.cloudfront.net (CloudFront)
x-amz-cf-pop: VIE50-C2
age: 1176276
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 629
x-xss-protection: 1; mode=block
x-served-by: static-web-1
surrogate-key: next
last-modified: Thu, 21 Dec 2023 17:55:36 GMT
server: nginx
etag: "65847c18-275"
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable, no-transform
timing-allow-origin: *
x-amz-cf-id: -V7LyM-e8lIyVCAmQbZqxXnwkLa4X41ARqgELTsz13DJPoYL8MnVbw==
expires: Fri, 20 Dec 2024 18:53:27 GMT

GET
H2 200 82971089-2677-4e1e-8fab-44444f76330b.json Show response
cdn.cookielaw.org/consent/82971089-2677-4e1e-8fab-44444f76330b/ 6 KB
2 KB 115ms
52ms XHR
application/x-javascript 2606:4700::6812:82ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/82971089-2677-4e1e-8fab-44444f76330b/82971089-2677-4e1e-8fab-44444f76330b.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

163844c1004fe7f16a32cabbf1fa485c127c185fce968f992cba0baae232eac4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 04 Jan 2024 09:38:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 84781
content-md5: I4eep5WavqwFVcaJf34d6g==
content-length: 1947
x-ms-lease-status: unlocked
last-modified: Tue, 14 Nov 2023 18:51:59 GMT
server: cloudflare
etag: 0x8DBE542C8198A76
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 40340ffa-701e-008c-2f2b-17518d000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 840281a0ef2a3540-WAW
expires: Fri, 05 Jan 2024 09:38:03 GMT

GET
H2 200 common.bundle.38c5aabc45d4259965d7e2fa23a41f7b.js Show response
c.disquscdn.com/next/embed/ Frame 5622 280 KB
93 KB 138ms
52ms Script
application/javascript 2600:9000:211a:1600:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/common.bundle.38c5aabc45d4259965d7e2fa23a41f7b.js

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/lounge.load.51dfeea10554db37f6ba310f2efb9cb8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:211a:1600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

a12ed1612f455158732f858b4cf1395777f2a53584d46bf9cd8530ed9f53e4df

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=100758&t_u=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fthreat-intelligence%2F2023%2F12%2Fpikabot-distributed-via-malicious-ads&t_d=PikaBot%20distributed%20via%20malicious%20search%20ads&t_t=PikaBot%20distributed%20via%20malicious%20search%20ads&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

x-cache-hits: 0
date: Mon, 18 Dec 2023 17:28:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 639dd5dd68d7e7193120d95480cd44ca.cloudfront.net (CloudFront)
x-amz-cf-pop: VIE50-C2
age: 1440559
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 94199
x-xss-protection: 1; mode=block
x-served-by: static-web-1
surrogate-key: next
last-modified: Mon, 18 Dec 2023 16:49:31 GMT
server: nginx
etag: "6580781b-16ff7"
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable, no-transform
timing-allow-origin: *
x-amz-cf-id: 3hg-ZmFACUSTySkutPVrNDqDIqC1TmeEhViTZAegdW1uLZ_3z7xQKw==
expires: Tue, 17 Dec 2024 17:28:44 GMT

GET
H2 200 location Show response
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 72 B
310 B 82ms
46ms XHR
application/json 2606:4700:4400::ac40:9b77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:9b77 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6bd5068ee3f41ad2ed4f003c13c4e939021c77f7a69ac82d25211c72868b520e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept: application/json
Referer: https://www.malwarebytes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Thu, 04 Jan 2024 09:38:03 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS
content-type: application/json
access-control-allow-origin: *
cf-ray: 840281a1685f4541-TXL
access-control-allow-headers: Content-Type

GET
H2 200 otBannerSdk.js Show response
cdn.cookielaw.org/scripttemplates/202212.1.0/ 392 KB
94 KB 41ms
40ms Script
application/javascript 2606:4700::6812:82ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202212.1.0/otBannerSdk.js

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

063a721d5e221c66b0b3b52b66fd39f634d49e9aa16827ac5281666257d84e92

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 04 Jan 2024 09:38:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: fVkC4hw/1GZwVOLkH8kBAQ==
age: 13090
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 95639
x-ms-lease-status: unlocked
last-modified: Mon, 13 Feb 2023 03:39:55 GMT
server: cloudflare
etag: 0x8DB0D73F93A8C75
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 0fb21389-301e-00a2-7c1c-15039a000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 840281a1ce753516-WAW

GET
H2 200 en.json Show response
cdn.cookielaw.org/consent/82971089-2677-4e1e-8fab-44444f76330b/d6fb4b74-ed96-4d02-8ff1-69e7c0b82a9a/ 117 KB
24 KB 56ms
55ms Fetch
application/x-javascript 2606:4700::6812:82ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/82971089-2677-4e1e-8fab-44444f76330b/d6fb4b74-ed96-4d02-8ff1-69e7c0b82a9a/en.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202212.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

04cde96c06c1031c6552a6251fccd5edea82f47d79b1b6c0eb968b9808d4f614

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 04 Jan 2024 09:38:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 11175
content-md5: XzR/cEW8sxMM5q5LdGTu5g==
content-length: 24359
x-ms-lease-status: unlocked
last-modified: Tue, 14 Nov 2023 18:52:18 GMT
server: cloudflare
etag: 0x8DBE542D39B1A22
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: f27a52e8-401e-003e-362b-17aefc000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 840281a249173540-WAW
expires: Fri, 05 Jan 2024 09:38:03 GMT

GET
H2 200 lounge.f7ae30d42a8946a9460cc262732d4da8.css
c.disquscdn.com/next/embed/styles/ Frame 5622 233 KB
33 KB 48ms
48ms Stylesheet
text/css 2600:9000:211a:1600:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/styles/lounge.f7ae30d42a8946a9460cc262732d4da8.css

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.38c5aabc45d4259965d7e2fa23a41f7b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:211a:1600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

f17fa1d863ade20f6e8af77a09d3ea79b694c4cea7a50f11aa2d65b5d4755d4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=100758&t_u=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fthreat-intelligence%2F2023%2F12%2Fpikabot-distributed-via-malicious-ads&t_d=PikaBot%20distributed%20via%20malicious%20search%20ads&t_t=PikaBot%20distributed%20via%20malicious%20search%20ads&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

x-cache-hits: 0
date: Mon, 18 Dec 2023 17:28:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 639dd5dd68d7e7193120d95480cd44ca.cloudfront.net (CloudFront)
x-amz-cf-pop: VIE50-C2
age: 1440558
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 33312
x-xss-protection: 1; mode=block
x-served-by: static-web-1
surrogate-key: next
last-modified: Mon, 18 Dec 2023 16:49:31 GMT
server: nginx
etag: "6580781b-8220"
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable, no-transform
timing-allow-origin: *
x-amz-cf-id: HR9XtRqXMWNKb5T1-Dmb7sng_OnQO1emzE8ZcCY31cqJ0klFsfhdlA==
expires: Tue, 17 Dec 2024 17:28:45 GMT

GET
H2 200 lounge.bundle.6f83b00180eaa0269f7d0d0447c0b413.js Show response
c.disquscdn.com/next/embed/ Frame 5622 513 KB
129 KB 54ms
54ms Script
application/javascript 2600:9000:211a:1600:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/lounge.bundle.6f83b00180eaa0269f7d0d0447c0b413.js

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.38c5aabc45d4259965d7e2fa23a41f7b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:211a:1600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

5b2f2d0ecfa2e0904ce2d478eb6f2d95bf150f32d5ca4e8ef42690b868583e87

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=100758&t_u=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fthreat-intelligence%2F2023%2F12%2Fpikabot-distributed-via-malicious-ads&t_d=PikaBot%20distributed%20via%20malicious%20search%20ads&t_t=PikaBot%20distributed%20via%20malicious%20search%20ads&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

x-cache-hits: 0
date: Thu, 21 Dec 2023 18:53:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 639dd5dd68d7e7193120d95480cd44ca.cloudfront.net (CloudFront)
x-amz-cf-pop: VIE50-C2
age: 1176276
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 131032
x-xss-protection: 1; mode=block
x-served-by: static-web-1
surrogate-key: next
last-modified: Thu, 21 Dec 2023 17:55:36 GMT
server: nginx
etag: "65847c18-1ffd8"
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable, no-transform
timing-allow-origin: *
x-amz-cf-id: RpmmVIin0BZ7YA5_Qm9dran4FCFt7hajN_-B4-7gNVX93VChaqymEg==
expires: Fri, 20 Dec 2024 18:53:27 GMT

GET
H/1.1 200
OK config.js Show response
disqus.com/next/ Frame 5622 19 KB
19 KB 27ms
27ms Script
application/javascript 151.101.192.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://disqus.com/next/config.js

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.38c5aabc45d4259965d7e2fa23a41f7b.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

151.101.192.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

da2f1fac5906b74936165ede85aa6cd61bc1cea673d09cc8c323d253659b91a1

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=100758&t_u=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fthreat-intelligence%2F2023%2F12%2Fpikabot-distributed-via-malicious-ads&t_d=PikaBot%20distributed%20via%20malicious%20search%20ads&t_t=PikaBot%20distributed%20via%20malicious%20search%20ads&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Date: Thu, 04 Jan 2024 09:38:03 GMT
Strict-Transport-Security: max-age=300; includeSubdomains
X-Content-Type-Options: nosniff
Server: nginx
Age: 52
X-Frame-Options: SAMEORIGIN
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Access-Control-Allow-Origin: *
Content-Type: application/javascript; charset=UTF-8
Cache-Control: public, stale-while-revalidate=300, s-stalewhilerevalidate=3600, max-age=60
Cross-Origin-Resource-Policy: cross-origin
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 19297
X-XSS-Protection: 1; mode=block

GET
H2 200 otFlat.json Show response
cdn.cookielaw.org/scripttemplates/202212.1.0/assets/ 13 KB
3 KB 40ms
40ms Fetch
application/json 2606:4700::6812:82ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202212.1.0/assets/otFlat.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202212.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1df323c03e742ff217794c8ace2c647f3f0cf868c91d4396c166262ca1075acc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 04 Jan 2024 09:38:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: zqQbOscO3o5SqFKuQoJ/AA==
age: 6100
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 3020
x-ms-lease-status: unlocked
last-modified: Mon, 13 Feb 2023 03:39:48 GMT
server: cloudflare
etag: 0x8DB0D73F514CE73
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: d813b0ba-a01e-0036-29f1-1db4f3000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 840281a2b9a93540-WAW

GET
H2 200 otPcPanel.json Show response
cdn.cookielaw.org/scripttemplates/202212.1.0/assets/v2/ 63 KB
12 KB 42ms
41ms Fetch
application/json 2606:4700::6812:82ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202212.1.0/assets/v2/otPcPanel.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202212.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7e4619d147c3c6754720be1bad7c97cf6b3f9d696fbac16d97f1a9effe40e9dd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 04 Jan 2024 09:38:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: /zl861paWmceWHf3SA8vbQ==
age: 6842
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 12601
x-ms-lease-status: unlocked
last-modified: Mon, 13 Feb 2023 03:39:51 GMT
server: cloudflare
etag: 0x8DB0D73F67D0625
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: 6f1aea60-501e-0032-1162-2439f4000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 840281a2b9ab3540-WAW

GET
H2 200 otCookieSettingsButton.json Show response
cdn.cookielaw.org/scripttemplates/202212.1.0/assets/ 5 KB
2 KB 43ms
42ms Fetch
application/json 2606:4700::6812:82ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202212.1.0/assets/otCookieSettingsButton.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202212.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a09d0f89e99cf5a081315ff701187632005dabd23f3ca116a75790003faa7e8f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 04 Jan 2024 09:38:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: 7h2gubMR6XYxX8+GVPe5nw==
age: 6100
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 1767
x-ms-lease-status: unlocked
last-modified: Mon, 13 Feb 2023 03:39:50 GMT
server: cloudflare
etag: 0x8DB0D73F6218550
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: ebd3905e-601e-0064-5de6-1dc81b000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 840281a2b9ad3540-WAW

GET
H2 200 otCommonStyles.css Show response
cdn.cookielaw.org/scripttemplates/202212.1.0/assets/ 21 KB
4 KB 44ms
44ms Fetch
text/css 2606:4700::6812:82ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202212.1.0/assets/otCommonStyles.css

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202212.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

930239150e702d9d4bf43c3881aa70f8ad5fd9068dcbecb7c8bcca654784f7f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 04 Jan 2024 09:38:03 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
content-md5: XcxlleAcPGO2n5kTZrHH2Q==
age: 6842
x-ms-lease-status: unlocked
last-modified: Mon, 13 Feb 2023 03:39:59 GMT
server: cloudflare
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-ms-request-id: 44bb2935-601e-004b-69c3-13c5d0000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
cf-ray: 840281a2b9b73540-WAW

GET
H2 200 ot_close.svg
cdn.cookielaw.org/logos/static/ 651 B
600 B 41ms
40ms Image
image/svg+xml 2606:4700::6812:82ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/static/ot_close.svg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

901bb0e03b8c3c0a1cf4c487a177417328bb7d8c94106ecefceedd7d7f6c4ddc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 04 Jan 2024 09:38:03 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
content-md5: pcXWFGpuVeSg/jVnYCseRg==
age: 11826
x-ms-lease-status: unlocked
last-modified: Thu, 04 Jan 2024 03:32:43 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: 338c4599-401e-0011-3eca-3ea337000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
cf-ray: 840281a3181b3516-WAW

GET
H2 200 ot_guard_logo.svg Show response
cdn.cookielaw.org/logos/static/ 497 B
538 B 41ms
41ms Fetch
image/svg+xml 2606:4700::6812:82ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/logos/static/ot_guard_logo.svg

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202212.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

691dcdb24853a0f5ce4e6597e5713dea66799b57ffe2c2a10f28f98e0b569b19

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 04 Jan 2024 09:38:03 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
content-md5: tXyZydHjxQshFMbbBT1/8A==
age: 10375
x-ms-lease-status: unlocked
last-modified: Wed, 03 Jan 2024 06:11:24 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: d47f3c32-401e-0097-5e13-3e6f8e000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
cf-ray: 840281a31a403540-WAW

GET
H2 200 MWB_logo_horizontal_RGB.png
cdn.cookielaw.org/logos/4e1c8bc8-2743-413b-8699-aad2216e8616/3be7f101-47f0-48ab-ae22-e34efabb8a62/9b43fe5c-b22b-40eb-9d38-57e36d038e98/ 46 KB
46 KB 47ms
46ms Image
image/png 2606:4700::6812:82ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/4e1c8bc8-2743-413b-8699-aad2216e8616/3be7f101-47f0-48ab-ae22-e34efabb8a62/9b43fe5c-b22b-40eb-9d38-57e36d038e98/MWB_logo_horizontal_RGB.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fdf7a139210ad25e0576a0721d45086e047dee38f88ba2995ce745643212c532

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 04 Jan 2024 09:38:03 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: g65E4kh32bbdSPqSevAl8Q==
age: 5348
content-length: 47111
x-ms-lease-status: unlocked
last-modified: Fri, 03 Jun 2022 20:09:47 GMT
server: cloudflare
etag: 0x8DA459D0252D23C
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
x-ms-request-id: ef9676d9-a01e-0036-2ff5-11b4f3000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 840281a328403516-WAW

GET
H2 200 powered_by_logo.svg
cdn.cookielaw.org/logos/static/ 5 KB
2 KB 42ms
42ms Image
image/svg+xml 2606:4700::6812:82ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/static/powered_by_logo.svg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 04 Jan 2024 09:38:03 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
content-md5: Y+c301RBZNK39PvKQWrIBw==
age: 11472
x-ms-lease-status: unlocked
last-modified: Thu, 04 Jan 2024 03:32:43 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: f81f2af0-701e-0035-13c1-3e5597000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
cf-ray: 840281a328423516-WAW

GET
H/1.1 200
OK details Show response
disqus.com/api/3.0/forums/ Frame 5622 3 KB
4 KB 29ms
29ms XHR
application/json 151.101.192.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://disqus.com/api/3.0/forums/details?forum=malwarebytesunpacked&attach=forumFeatures&api_key=E8Uh5l5fHZ6gD8U3KycjAIAk46f68Zw7C6eW8WSjZvCLXebZ7p0r1yrYDrLilk2F

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.38c5aabc45d4259965d7e2fa23a41f7b.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

151.101.192.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

afb8b9d2b43c87807d9cc489b7c07321f25f9c0a93487a6e49d85bbabea6770e

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: */*
Referer: https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=100758&t_u=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fthreat-intelligence%2F2023%2F12%2Fpikabot-distributed-via-malicious-ads&t_d=PikaBot%20distributed%20via%20malicious%20search%20ads&t_t=PikaBot%20distributed%20via%20malicious%20search%20ads&s_o=default
X-Requested-With: XMLHttpRequest
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Date: Thu, 04 Jan 2024 09:38:03 GMT
Strict-Transport-Security: max-age=300; includeSubdomains
X-Content-Type-Options: nosniff
Server: nginx
Age: 107
X-Frame-Options: SAMEORIGIN
Vary: Origin, Cookie
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Content-Type: application/json
Cross-Origin-Resource-Policy: cross-origin
Connection: keep-alive
Content-Length: 3269
X-XSS-Protection: 1; mode=block

GET
H2 200 css2
fonts.googleapis.com/ Frame 5622 11 KB
1 KB 233ms
81ms Stylesheet
text/css 2a00:1450:4001:82a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:ital,wght@0,400;0,500;0,600;0,700;1,400;1,700&display=swap

Requested by

Host: client
URL: about:client

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

4dbc45bd7ed8caf2aeeae8de34e519d874987d5285c79b5b4a93a1d670a929c4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=100758&t_u=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fthreat-intelligence%2F2023%2F12%2Fpikabot-distributed-via-malicious-ads&t_d=PikaBot%20distributed%20via%20malicious%20search%20ads&t_t=PikaBot%20distributed%20via%20malicious%20search%20ads&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 04 Jan 2024 09:38:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 04 Jan 2024 09:05:40 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 04 Jan 2024 09:38:03 GMT

GET
H/1.1 200
OK loadReactions Show response
disqus.com/api/3.0/threadReactions/ Frame 5622 1 KB
2 KB 33ms
29ms XHR
application/json 151.101.192.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://disqus.com/api/3.0/threadReactions/loadReactions?thread=9981309803&api_key=E8Uh5l5fHZ6gD8U3KycjAIAk46f68Zw7C6eW8WSjZvCLXebZ7p0r1yrYDrLilk2F

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.38c5aabc45d4259965d7e2fa23a41f7b.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

151.101.192.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

93e1e8eae9f8f0d5b1482d0c7a16e408a6412739cc4b12e784407aecd69a7d4e

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=100758&t_u=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fthreat-intelligence%2F2023%2F12%2Fpikabot-distributed-via-malicious-ads&t_d=PikaBot%20distributed%20via%20malicious%20search%20ads&t_t=PikaBot%20distributed%20via%20malicious%20search%20ads&s_o=default
X-Requested-With: XMLHttpRequest
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Date: Thu, 04 Jan 2024 09:38:03 GMT
Strict-Transport-Security: max-age=300; includeSubdomains
X-Content-Type-Options: nosniff
Server: nginx
Age: 58
X-Frame-Options: SAMEORIGIN
Vary: Origin, Cookie
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Content-Type: application/json
Cache-Control: stale-while-revalidate=30, max-age=60
Cross-Origin-Resource-Policy: cross-origin
Connection: keep-alive
Content-Length: 1125
X-XSS-Protection: 1; mode=block

GET
H2 200 svg-sprite.4da5413f5086c5755b46094b813dbfcd.svg
c.disquscdn.com/next/embed/assets/img/ Frame 5622 13 KB
13 KB 43ms
43ms Image
image/svg+xml 2600:9000:211a:1600:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/next/embed/assets/img/svg-sprite.4da5413f5086c5755b46094b813dbfcd.svg

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.f7ae30d42a8946a9460cc262732d4da8.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:211a:1600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

3270642c89180c12db93775e2a774b6dadd9bd98cffc963075c85afd2c17b6e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://c.disquscdn.com/next/embed/styles/lounge.f7ae30d42a8946a9460cc262732d4da8.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

x-cache-hits: 0
date: Sat, 18 Nov 2023 05:39:28 GMT
via: 1.1 639dd5dd68d7e7193120d95480cd44ca.cloudfront.net (CloudFront)
x-content-type-options: nosniff
x-amz-cf-pop: VIE50-C2
age: 4075115
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 13079
x-xss-protection: 1; mode=block
x-served-by: static-web-1
surrogate-key: next
last-modified: Wed, 15 Nov 2023 20:36:05 GMT
server: nginx
etag: "65552bb5-3317"
content-type: image/svg+xml; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable, no-transform
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: mdLBIv6m9Qg67kw1gAdlzCokInWE5eAK7QqLqoEFxQ5Vn0cUAkFPKw==
expires: Sun, 17 Nov 2024 05:39:28 GMT

GET
H2 200 loader.ba7c86e8b4b6135bb668d05223f8f127.gif
c.disquscdn.com/next/embed/assets/img/ Frame 5622 3 KB
3 KB 42ms
42ms Image
image/gif 2600:9000:211a:1600:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/next/embed/assets/img/loader.ba7c86e8b4b6135bb668d05223f8f127.gif

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.f7ae30d42a8946a9460cc262732d4da8.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:211a:1600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

4c4491dcfa94cb46fb73742fc2caf49a1cd59027304af1830c7dc6ce1889857c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://c.disquscdn.com/next/embed/styles/lounge.f7ae30d42a8946a9460cc262732d4da8.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

x-cache-hits: 0
date: Sun, 20 Aug 2023 12:05:10 GMT
via: 1.1 639dd5dd68d7e7193120d95480cd44ca.cloudfront.net (CloudFront)
x-content-type-options: nosniff
x-amz-cf-pop: VIE50-C2
age: 11827973
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 2971
x-xss-protection: 1; mode=block
x-served-by: static-web-2
surrogate-key: next
last-modified: Wed, 02 Aug 2023 23:18:56 GMT
server: nginx
etag: "64cae460-b9b"
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable, no-transform
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: _JxcftewlwDHo9-lt0Z0Bd_ndDd9zWOifWcYLgD6xh7ABAN0lifn0g==
expires: Mon, 19 Aug 2024 12:05:10 GMT

GET
H2 200 email.727e30eb9b6c1e85cb010b9c8eb04c7e.svg
c.disquscdn.com/next/embed/assets/img/ Frame 5622 840 B
1 KB 43ms
43ms Image
image/svg+xml 2600:9000:211a:1600:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/next/embed/assets/img/email.727e30eb9b6c1e85cb010b9c8eb04c7e.svg

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.f7ae30d42a8946a9460cc262732d4da8.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:211a:1600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

0589c5845288117448d7aa710af60618b151d78efd1a2653f89a0b57f7eb3de8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://c.disquscdn.com/next/embed/styles/lounge.f7ae30d42a8946a9460cc262732d4da8.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

x-cache-hits: 0
date: Thu, 21 Sep 2023 03:03:24 GMT
via: 1.1 639dd5dd68d7e7193120d95480cd44ca.cloudfront.net (CloudFront)
x-content-type-options: nosniff
x-amz-cf-pop: VIE50-C2
age: 9095678
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 840
x-xss-protection: 1; mode=block
x-served-by: static-web-2
surrogate-key: next
last-modified: Wed, 20 Sep 2023 10:55:06 GMT
server: nginx
etag: "650acf8a-348"
content-type: image/svg+xml; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable, no-transform
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: PFNI3ev1_-_4WKf0pTQ9sYssvUgNLOCUr9QwW2oxPLvKXj0H3ueVNw==
expires: Fri, 20 Sep 2024 03:03:24 GMT

GET
H2 200 privacy.8c96be6b50de1c3fab838c5f050e0be5.svg
c.disquscdn.com/next/embed/assets/img/ Frame 5622 891 B
1 KB 44ms
43ms Image
image/svg+xml 2600:9000:211a:1600:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/next/embed/assets/img/privacy.8c96be6b50de1c3fab838c5f050e0be5.svg

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.f7ae30d42a8946a9460cc262732d4da8.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:211a:1600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

068753b8f09b32ad8a3283199c7252090d0076a56924df724dda72828ae31b95

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://c.disquscdn.com/next/embed/styles/lounge.f7ae30d42a8946a9460cc262732d4da8.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

x-cache-hits: 0
date: Wed, 26 Jul 2023 18:48:11 GMT
via: 1.1 639dd5dd68d7e7193120d95480cd44ca.cloudfront.net (CloudFront)
x-content-type-options: nosniff
x-amz-cf-pop: VIE50-C2
age: 13963792
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 891
x-xss-protection: 1; mode=block
x-served-by: static-web-1
surrogate-key: next
last-modified: Wed, 26 Jul 2023 16:31:55 GMT
server: nginx
etag: "64c14a7b-37b"
content-type: image/svg+xml; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable, no-transform
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: LcrLuJd2mSp5iVH9VqHgENeVmpiEOkFcGT_XGC_kbb9orPSvN7ro4g==
expires: Thu, 25 Jul 2024 18:48:11 GMT

GET
H2 200 warning.3bc0b4bff6c268a4ceaf404014b9be42.svg
c.disquscdn.com/next/embed/assets/img/ Frame 5622 605 B
1 KB 44ms
44ms Image
image/svg+xml 2600:9000:211a:1600:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/next/embed/assets/img/warning.3bc0b4bff6c268a4ceaf404014b9be42.svg

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.f7ae30d42a8946a9460cc262732d4da8.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:211a:1600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

a657bedd3bc0c106f7cfa5fe6556a0b7e175870d33bd7da9ef67ffcffbafda69

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://c.disquscdn.com/next/embed/styles/lounge.f7ae30d42a8946a9460cc262732d4da8.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

x-cache-hits: 0
date: Thu, 14 Sep 2023 03:57:58 GMT
via: 1.1 639dd5dd68d7e7193120d95480cd44ca.cloudfront.net (CloudFront)
x-content-type-options: nosniff
x-amz-cf-pop: VIE50-C2
age: 9697205
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 605
x-xss-protection: 1; mode=block
x-served-by: static-web-1
surrogate-key: next
last-modified: Wed, 13 Sep 2023 20:48:30 GMT
server: nginx
etag: "6502201e-25d"
content-type: image/svg+xml; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable, no-transform
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: VzRMdKhe6Rqj7IC_qyA50TyfCdpzjxS2_2xaSJHG6IHKzDprvt3_2w==
expires: Fri, 13 Sep 2024 03:57:58 GMT

GET
H2 200 sprite.ad630a07080a45451f139a7487853ff8.png
c.disquscdn.com/next/embed/assets/img/ Frame 5622 2 KB
2 KB 45ms
44ms Image
image/png 2600:9000:211a:1600:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/next/embed/assets/img/sprite.ad630a07080a45451f139a7487853ff8.png

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.f7ae30d42a8946a9460cc262732d4da8.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:211a:1600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

9714221c828961b20f45a782c3281c0596f6652cfe1299bee18097f98e8fb7b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://c.disquscdn.com/next/embed/styles/lounge.f7ae30d42a8946a9460cc262732d4da8.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

x-cache-hits: 0
date: Mon, 24 Jul 2023 12:53:27 GMT
via: 1.1 639dd5dd68d7e7193120d95480cd44ca.cloudfront.net (CloudFront)
x-content-type-options: nosniff
x-amz-cf-pop: VIE50-C2
age: 14157876
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 1763
x-xss-protection: 1; mode=block
x-served-by: static-web-1
surrogate-key: next
last-modified: Wed, 12 Jul 2023 14:04:56 GMT
server: nginx
etag: "64aeb308-6e3"
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable, no-transform
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: vH8aIRxI9x-MyQoz78NFXIP8j7WGkLH1Z1GGyrsDnRic4ZvgOrkIhg==
expires: Tue, 23 Jul 2024 12:53:27 GMT

GET
H2 200 icons.79e576f9489bae308388e5b8e250aa86.woff2
c.disquscdn.com/next/embed/assets/font/ Frame 5622 8 KB
9 KB 45ms
45ms Font
application/octet-stream 2600:9000:211a:1600:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/assets/font/icons.79e576f9489bae308388e5b8e250aa86.woff2

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.f7ae30d42a8946a9460cc262732d4da8.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:211a:1600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

8dc675da542f629aca965669b35900a5ed0685f4d87dce9eac4660baf4493687

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://c.disquscdn.com/next/embed/styles/lounge.f7ae30d42a8946a9460cc262732d4da8.css
Origin: https://disqus.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

x-cache-hits: 0
date: Wed, 06 Dec 2023 19:49:42 GMT
via: 1.1 218366faeb88f6d265d2589e37ea2dac.cloudfront.net (CloudFront)
x-content-type-options: nosniff
x-amz-cf-pop: VIE50-C2
age: 2468901
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 8216
x-xss-protection: 1; mode=block
x-served-by: static-web-1
surrogate-key: next
last-modified: Wed, 06 Dec 2023 19:40:12 GMT
server: nginx
etag: "6570ce1c-2018"
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable, no-transform
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: ItQZ5h2i5xMxjse3fJ4kqjIutLG3maC87ByJ9GnRYHc3mWmFYDLzhQ==
expires: Thu, 05 Dec 2024 19:49:42 GMT

GET
H2 200 upvote-512x512.png
c.disquscdn.com/next/current/publisher-admin/assets/img/emoji/ Frame 5622 8 KB
8 KB 54ms
53ms Image
image/png 2600:9000:211a:1600:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/next/current/publisher-admin/assets/img/emoji/upvote-512x512.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:211a:1600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

ddc6aec4144b67f0a2a12d687f3c4b8a9faf7c445847d0e25dcb5bd1a9ba9018

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=100758&t_u=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fthreat-intelligence%2F2023%2F12%2Fpikabot-distributed-via-malicious-ads&t_d=PikaBot%20distributed%20via%20malicious%20search%20ads&t_t=PikaBot%20distributed%20via%20malicious%20search%20ads&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

x-cache-hits: 0
date: Thu, 04 Jan 2024 09:34:00 GMT
via: 1.1 639dd5dd68d7e7193120d95480cd44ca.cloudfront.net (CloudFront)
x-content-type-options: nosniff
x-amz-cf-pop: VIE50-C2
age: 243
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 8170
x-xss-protection: 1; mode=block
x-served-by: static-web-1
last-modified: Thu, 21 Dec 2023 18:58:13 GMT
server: nginx
etag: "65848ac5-1fea"
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=300, public
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: wAz6ZqlpeRrS05NIrg3mljVouF2wlgcb17s8MVna0flf9B2QotFvEQ==
expires: Thu, 04 Jan 2024 09:39:00 GMT

GET
H2 200 funny-512x512.png
c.disquscdn.com/next/current/publisher-admin/assets/img/emoji/ Frame 5622 9 KB
9 KB 55ms
54ms Image
image/png 2600:9000:211a:1600:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/next/current/publisher-admin/assets/img/emoji/funny-512x512.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:211a:1600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

20a91bd509668238b6af8e16475c5e2611bcd2861d0eec2e0d4f6815e81449bd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=100758&t_u=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fthreat-intelligence%2F2023%2F12%2Fpikabot-distributed-via-malicious-ads&t_d=PikaBot%20distributed%20via%20malicious%20search%20ads&t_t=PikaBot%20distributed%20via%20malicious%20search%20ads&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

x-cache-hits: 0
date: Thu, 04 Jan 2024 09:37:35 GMT
via: 1.1 639dd5dd68d7e7193120d95480cd44ca.cloudfront.net (CloudFront)
x-content-type-options: nosniff
x-amz-cf-pop: VIE50-C2
age: 28
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 8883
x-xss-protection: 1; mode=block
x-served-by: static-web-1
last-modified: Thu, 21 Dec 2023 18:58:13 GMT
server: nginx
etag: "65848ac5-22b3"
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=300, public
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: BW3ysY8rIL9BKN1C3wLJqH1GoznOlnMoMG8Wd8z5BciDlAJOAtEHjA==
expires: Thu, 04 Jan 2024 09:42:35 GMT

GET
H2 200 love-512x512.png
c.disquscdn.com/next/current/publisher-admin/assets/img/emoji/ Frame 5622 12 KB
12 KB 56ms
55ms Image
image/png 2600:9000:211a:1600:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/next/current/publisher-admin/assets/img/emoji/love-512x512.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:211a:1600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

e422b07ca1550e55cd90a518e910fd3cfb4d9337ea6092357f9761aa77ac9e33

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=100758&t_u=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fthreat-intelligence%2F2023%2F12%2Fpikabot-distributed-via-malicious-ads&t_d=PikaBot%20distributed%20via%20malicious%20search%20ads&t_t=PikaBot%20distributed%20via%20malicious%20search%20ads&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

x-cache-hits: 0
date: Thu, 04 Jan 2024 09:37:35 GMT
via: 1.1 639dd5dd68d7e7193120d95480cd44ca.cloudfront.net (CloudFront)
x-content-type-options: nosniff
x-amz-cf-pop: VIE50-C2
age: 28
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 11910
x-xss-protection: 1; mode=block
x-served-by: static-web-2
last-modified: Thu, 21 Dec 2023 18:58:13 GMT
server: nginx
etag: "65848ac5-2e86"
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=300, public
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: -z3NDsYavEycd4XKks1jlJPgxslkaQuP3aPqVJ8f1sxnvPrK0Z9BSA==
expires: Thu, 04 Jan 2024 09:42:35 GMT

GET
H2 200 angry-512x512.png
c.disquscdn.com/next/current/publisher-admin/assets/img/emoji/ Frame 5622 20 KB
21 KB 58ms
57ms Image
image/png 2600:9000:211a:1600:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/next/current/publisher-admin/assets/img/emoji/angry-512x512.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:211a:1600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

db865c8f3642f3485829c0ee0008fe04a32cc66af70867b39f60395a7fed3984

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=100758&t_u=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fthreat-intelligence%2F2023%2F12%2Fpikabot-distributed-via-malicious-ads&t_d=PikaBot%20distributed%20via%20malicious%20search%20ads&t_t=PikaBot%20distributed%20via%20malicious%20search%20ads&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

x-cache-hits: 0
date: Thu, 04 Jan 2024 09:34:00 GMT
via: 1.1 639dd5dd68d7e7193120d95480cd44ca.cloudfront.net (CloudFront)
x-content-type-options: nosniff
x-amz-cf-pop: VIE50-C2
age: 243
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 20675
x-xss-protection: 1; mode=block
x-served-by: static-web-2
last-modified: Thu, 21 Dec 2023 18:58:13 GMT
server: nginx
etag: "65848ac5-50c3"
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=300, public
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: ebJEcv-tgW9mVP15104ewU5566kuTOEH0k6LC3B3n_VadOMEZikQmQ==
expires: Thu, 04 Jan 2024 09:39:00 GMT

GET
H2 200 sad-512x512.png
c.disquscdn.com/next/current/publisher-admin/assets/img/emoji/ Frame 5622 9 KB
9 KB 59ms
59ms Image
image/png 2600:9000:211a:1600:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/next/current/publisher-admin/assets/img/emoji/sad-512x512.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:211a:1600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

11c401a81e32b086bea3798c033009907b429fb601411da6ffc266b78184898a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=100758&t_u=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fthreat-intelligence%2F2023%2F12%2Fpikabot-distributed-via-malicious-ads&t_d=PikaBot%20distributed%20via%20malicious%20search%20ads&t_t=PikaBot%20distributed%20via%20malicious%20search%20ads&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

x-cache-hits: 0
date: Thu, 04 Jan 2024 09:35:11 GMT
via: 1.1 639dd5dd68d7e7193120d95480cd44ca.cloudfront.net (CloudFront)
x-content-type-options: nosniff
x-amz-cf-pop: VIE50-C2
age: 172
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 8986
x-xss-protection: 1; mode=block
x-served-by: static-web-1
last-modified: Thu, 21 Dec 2023 18:58:13 GMT
server: nginx
etag: "65848ac5-231a"
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=300, public
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: dy9I1JfNXmwLl_Wepch3VyFJJaoAFNXSh6osE-SPjetHGzLuSQlIxg==
expires: Thu, 04 Jan 2024 09:40:11 GMT

GET
H/1.1 200
OK event.gif
referrer.disqus.com/juggler/ Frame 5622 43 B
339 B 180ms
121ms Image
image/gif 199.232.192.134
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://referrer.disqus.com/juggler/event.gif?abe=0&embed_hidden=0&load_time=250&event=init_embed&thread=9981309803&forum=malwarebytesunpacked&forum_id=3107640&imp=40h8u0r3othqur&thread_slug=pikabot_distributed_via_malicious_ads&user_type=anon&referrer=https%3A%2F%2Fwww.malwarebytes.com%2F&theme=next&dnt=0&tracking_enabled=0&experiment=prebidbidisrequired_hidden&variant=active&service=dynamic&promoted_enabled=false&max_enabled=false

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

199.232.192.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=100758&t_u=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fthreat-intelligence%2F2023%2F12%2Fpikabot-distributed-via-malicious-ads&t_d=PikaBot%20distributed%20via%20malicious%20search%20ads&t_t=PikaBot%20distributed%20via%20malicious%20search%20ads&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Date: Thu, 04 Jan 2024 09:38:03 GMT
x-content-type-options: nosniff
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
server: nginx
content-type: image/gif
Cross-Origin-Resource-Policy: cross-origin
Connection: keep-alive
Content-Length: 43
x-xss-protection: 1; mode=block

Verdicts & Comments Add Verdict or Comment

56 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.malwarebytes.com/	1970-01-20 21:45:13	Name: OptanonConsent Value: isGpcEnabled=0&datestamp=Thu+Jan+04+2024+10%3A38%3A03+GMT%2B0100+(Central+European+Standard+Time)&version=202212.1.0&isIABGlobal=false&hosts=&consentId=ea1dad1d-f4c3-425c-93d8-1c9c6fe858b8&interactionCount=0&landingPath=https%3A%2F%2Fwww.malwarebytes.com%2Fblog%2Fthreat-intelligence%2F2023%2F12%2Fpikabot-distributed-via-malicious-ads&groups=C0001%3A1%2CC0003%3A0%2CC0002%3A0%2CC0004%3A0

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

c.disquscdn.com
cdn.cookielaw.org
disqus.com
fonts.googleapis.com
genesis.malwarebytes.com
geolocation.onetrust.com
malwarebytesunpacked.disqus.com
pixel.wp.com
plausible.io
referrer.disqus.com
secure.gravatar.com
stats.wp.com
www.googletagmanager.com
www.malwarebytes.com
151.101.192.134
192.0.66.233
192.0.76.3
199.232.192.134
199.232.196.134
2400:52e0:1e00::1082:1
2600:9000:211a:1600:6:8656:f5c0:93a1
2606:4700:4400::ac40:9b77
2606:4700::6812:82ec
2a00:1450:4001:80f::2008
2a00:1450:4001:82a::200a
2a04:fa87:fffe::c000:4902
50.16.74.83
021f0fd27042b279a49e982215c6dc3c3ab84e95b35553a119dfdbd50af6be94
039bb21133a0657e78917ed224bc151347123282bbd3bf1e0c5da81bccb93da6
04cde96c06c1031c6552a6251fccd5edea82f47d79b1b6c0eb968b9808d4f614
0589c5845288117448d7aa710af60618b151d78efd1a2653f89a0b57f7eb3de8
063a721d5e221c66b0b3b52b66fd39f634d49e9aa16827ac5281666257d84e92
068753b8f09b32ad8a3283199c7252090d0076a56924df724dda72828ae31b95
11c401a81e32b086bea3798c033009907b429fb601411da6ffc266b78184898a
163844c1004fe7f16a32cabbf1fa485c127c185fce968f992cba0baae232eac4
17844b6e32a1300ba44a13e98c650fe16e4759364491b8161510e28aa648e79e
1df323c03e742ff217794c8ace2c647f3f0cf868c91d4396c166262ca1075acc
20a91bd509668238b6af8e16475c5e2611bcd2861d0eec2e0d4f6815e81449bd
242aa88120783594cb0c56ff247407db601e2a09c4f598f7c7d40b9b2ba6369e
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
2fc88556de1ebed9f55afb87d495d90d43f939a515f3afa5d59e953b8fc0ab20
323afff76b71bf2771d47f84f88ac7e7e7fd3fff5e0742f34225e4236867faf0
3270642c89180c12db93775e2a774b6dadd9bd98cffc963075c85afd2c17b6e4
32a0ce8663059aa406b6a9e8d569b840ee324c6af0f97c57d98ec1a6b6286b01
33441b6e44fb33343a5769858ca65653ce482e5e0c58c6eb1cee0e50aa06ddf6
3487ef2baf0c08ba660a8a143cdeb8ebeec961eea04bccd7c49096b4eb26b875
34cffbf270a64813450be6374b31df86a1c8ce0fdb540777c18f4b4db1932aa7
38f3c32e50f3f80b71090bd258d5ae64ea9424488bd063424a1f53554f09114f
4c4491dcfa94cb46fb73742fc2caf49a1cd59027304af1830c7dc6ce1889857c
4ca7509272fd378d23ad6d1c7f7bfce000ae1569832b6347b8bce568816ed159
4dbc45bd7ed8caf2aeeae8de34e519d874987d5285c79b5b4a93a1d670a929c4
5b2f2d0ecfa2e0904ce2d478eb6f2d95bf150f32d5ca4e8ef42690b868583e87
5d73add4b4c244e37f72201f51447f26ac9f30970e9e02ce45d0e05a5e58b21c
5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d
63ccbd40f783b34fe6bc9ef9e971de08e32012b91ee81dd54b325ecf527c1dac
691dcdb24853a0f5ce4e6597e5713dea66799b57ffe2c2a10f28f98e0b569b19
6bd5068ee3f41ad2ed4f003c13c4e939021c77f7a69ac82d25211c72868b520e
6d72fa0f78c80b1874d3ee4aadf43d973edc442a65fef83d37e684ac559893b7
7e262106f82cc52663e403f5b73795bbeab9ca0630c33c03579354fbcd4fae1e
7e4619d147c3c6754720be1bad7c97cf6b3f9d696fbac16d97f1a9effe40e9dd
8dc675da542f629aca965669b35900a5ed0685f4d87dce9eac4660baf4493687
901bb0e03b8c3c0a1cf4c487a177417328bb7d8c94106ecefceedd7d7f6c4ddc
930239150e702d9d4bf43c3881aa70f8ad5fd9068dcbecb7c8bcca654784f7f1
93e1e8eae9f8f0d5b1482d0c7a16e408a6412739cc4b12e784407aecd69a7d4e
9714221c828961b20f45a782c3281c0596f6652cfe1299bee18097f98e8fb7b3
9a0f5f040f639e0018ac2452cb66fa7871163de8613f3385f6960123f6b0a1fa
9bdd701c0629752935c98cbdb5a9671cba6af18797867921989b11ccc457e966
9e1c5b7f15bcd940814677515f306113aa93921b6e7f0d184a6de904d07b6f43
9e88b7199433a1d13f972993042c9ba967066a989c593fd1f0a79231475bffd4
a09d0f89e99cf5a081315ff701187632005dabd23f3ca116a75790003faa7e8f
a12ed1612f455158732f858b4cf1395777f2a53584d46bf9cd8530ed9f53e4df
a657bedd3bc0c106f7cfa5fe6556a0b7e175870d33bd7da9ef67ffcffbafda69
afb8b9d2b43c87807d9cc489b7c07321f25f9c0a93487a6e49d85bbabea6770e
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
b556aa0c99a333220bef9718a277f81139f356534c0c707430252f445f769b8b
c009a64085905de705aa36130211009e6ad252f7460e476f5498a065b0d6e4f0
c2bf4235c36480dd023ae5a3161be4b1d3c5f4728c753788d43530cece558812
c45109f3cafbc678c807f5b678c8c9a34f426ceea5e1c09d0e88e53e0760c1d1
ca7752fb33cf3a98c0f29bc4eec563112025da4109a0dcc69dabf5f861751258
cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d6693d78eb6f5c5e5ed5edaf6ecebad27225578f87a9e46e0876ca90093dc6c8
da2f1fac5906b74936165ede85aa6cd61bc1cea673d09cc8c323d253659b91a1
db865c8f3642f3485829c0ee0008fe04a32cc66af70867b39f60395a7fed3984
ddc6aec4144b67f0a2a12d687f3c4b8a9faf7c445847d0e25dcb5bd1a9ba9018
e422b07ca1550e55cd90a518e910fd3cfb4d9337ea6092357f9761aa77ac9e33
e676d6ef7d0563377e7ca9097d51c29f45ca47c4192d91e32b794ef7ed0a922d
f17fa1d863ade20f6e8af77a09d3ea79b694c4cea7a50f11aa2d65b5d4755d4b
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
f9482dfaea36c8cf88657505545bfa58dd25f4c5efbfc5c334ed97cd3b615999
fc4c4327594c7559168718f24efe82754660fdd55f62aa796baefee1e9b8d3d3
fce841aa7866c534d46a4a89dd89b85cf390919126d75e2527d84e8e30b63a32
fdf7a139210ad25e0576a0721d45086e047dee38f88ba2995ce745643212c532
fefd59c5420bffa07f30dd911d23643ec4036dcb727d5c29efba46a889165502

www.malwarebytes.com Open in urlscan Pro 192.0.66.233 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

65 Requests

100 %HTTPS

54 %IPv6

10 Domains

14 Subdomains

14 IPs

3 Countries

1417 kBTransfer

3622 kBSize

1 Cookies

43 Outgoing links

Redirected requests

65 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.malwarebytes.com Open in urlscan Pro
192.0.66.233 Public Scan

Screenshot
Live screenshot

Full Image

65
Requests

100 %
HTTPS

54 %
IPv6

10
Domains

14
Subdomains

14
IPs

3
Countries

1417 kB
Transfer

3622 kB
Size

1
Cookies

65 HTTP transactions
4 data transactions