blog.malwarebytes.com Open in urlscan Pro
130.211.198.3 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Submission: On August 27 via api (August 27th 2021, 2:52:28 pm UTC) from US

Summary HTTP 224 Redirects Links 91 Behaviour Indicators

Summary

This website contacted 54 IPs in 5 countries across 35 domains to perform 224 HTTP transactions. The main IP is 130.211.198.3, located in Council Bluffs, United States and belongs to GOOGLE, US. The main domain is blog.malwarebytes.com.
TLS certificate: Issued by DigiCert TLS RSA SHA256 2020 CA1 on July 1st 2021. Valid for: a year.

This is the only time blog.malwarebytes.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
72	130.211.198.3 130.211.198.3	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80f::200a	15169 (GOOGLE) (GOOGLE)
1	2a04:4e42:3::485 2a04:4e42:3::485	54113 (FASTLY) (FASTLY)
1 11	2600:9000:21f... 2600:9000:21f3:fe00:16:26c7:ff80:93a1	16509 (AMAZON-02) (AMAZON-02)
2	52.239.137.4 52.239.137.4	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2606:4700:10:... 2606:4700:10::6814:b944	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:80e::2008	15169 (GOOGLE) (GOOGLE)
1	2a04:fa87:fff... 2a04:fa87:fffe::c000:4902	2635 (AUTOMATTIC) (AUTOMATTIC)
7	151.101.12.134 151.101.12.134	54113 (FASTLY) (FASTLY)
1	2600:1f18:21a... 2600:1f18:21ae:6700:f931:acf0:5bbb:8761	14618 (AMAZON-AES) (AMAZON-AES)
2	2a02:26f0:6c0... 2a02:26f0:6c00:296::25ea	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
6	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	2a00:1450:400... 2a00:1450:4001:831::200e	15169 (GOOGLE) (GOOGLE)
2	2a00:1288:80:... 2a00:1288:80:800::7000	203220 (YAHOO-DEB) (YAHOO-DEB)
1	13.224.96.5 13.224.96.5	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700::68... 2606:4700::6810:7eaf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 3	142.250.185.230 142.250.185.230	15169 (GOOGLE) (GOOGLE)
2	2a02:26f0:6c0... 2a02:26f0:6c00:2a3::1931	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	13.224.100.124 13.224.100.124	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:809::2008	15169 (GOOGLE) (GOOGLE)
1	18.215.205.165 18.215.205.165	14618 (AMAZON-AES) (AMAZON-AES)
33	2600:9000:219... 2600:9000:2190:6600:6:8656:f5c0:93a1	16509 (AMAZON-02) (AMAZON-02)
11	151.101.192.134 151.101.192.134	54113 (FASTLY) (FASTLY)
2	2a00:1450:400... 2a00:1450:4001:809::200e	15169 (GOOGLE) (GOOGLE)
2 2	2620:119:50e4... 2620:119:50e4:101::6cae:b55	14413 (LINKEDIN) (LINKEDIN)
1 1	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	108.174.10.14 108.174.10.14	14413 (LINKEDIN) (LINKEDIN)
2	142.250.184.194 142.250.184.194	15169 (GOOGLE) (GOOGLE)
1	13.224.96.62 13.224.96.62	16509 (AMAZON-02) (AMAZON-02)
2 2	52.16.214.249 52.16.214.249	16509 (AMAZON-02) (AMAZON-02)
1 2	13.224.96.51 13.224.96.51	16509 (AMAZON-02) (AMAZON-02)
1	35.244.174.68 35.244.174.68	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c0c::9b	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:80f::2004	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:809::2003	15169 (GOOGLE) (GOOGLE)
1 3	2a00:1450:400... 2a00:1450:4001:812::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:831::2002	15169 (GOOGLE) (GOOGLE)
1 3	2a00:1450:400... 2a00:1450:4001:831::2004	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:802::2003	15169 (GOOGLE) (GOOGLE)
3	199.232.80.84 199.232.80.84	54113 (FASTLY) (FASTLY)
4	151.101.14.49 151.101.14.49	54113 (FASTLY) (FASTLY)
1	2a03:2880:f02... 2a03:2880:f02d:100:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
4	2a00:1450:400... 2a00:1450:4001:812::200e	15169 (GOOGLE) (GOOGLE)
3	2a03:2880:f02... 2a03:2880:f02d:12:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	2a03:2880:f12... 2a03:2880:f12d:181:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	2a00:1450:400... 2a00:1450:4001:80e::200d	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:812::2003	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:812::200d	15169 (GOOGLE) (GOOGLE)
1 3	142.250.186.166 142.250.186.166	15169 (GOOGLE) (GOOGLE)
4	2606:4700::68... 2606:4700::6813:9408	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	151.101.12.157 151.101.12.157	54113 (FASTLY) (FASTLY)
2	52.30.148.233 52.30.148.233	16509 (AMAZON-02) (AMAZON-02)
1	104.244.42.195 104.244.42.195	13414 (TWITTER) (TWITTER)
1	104.244.42.5 104.244.42.5	13414 (TWITTER) (TWITTER)
1 1	2a00:1450:400... 2a00:1450:4001:809::2002	15169 (GOOGLE) (GOOGLE)
1	69.16.175.42 69.16.175.42	20446 (HIGHWINDS3) (HIGHWINDS3)
5	192.132.33.46 192.132.33.46	18568 (BIDTELLECT) (BIDTELLECT)
224	54

72 130.211.198.3 (Council Bluffs, United States)

ASN15169 (GOOGLE, US)
PTR: 3.198.211.130.bc.googleusercontent.com

blog.malwarebytes.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80f::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:3::485 (United States)

ASN54113 (FASTLY, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2600:9000:21f3:fe00:16:26c7:ff80:93a1 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

www.malwarebytes.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.239.137.4 (Dublin, Ireland)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

optanon.blob.core.windows.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:10::6814:b944 (United States)

ASN13335 (CLOUDFLARENET, US)

geolocation.onetrust.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80e::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:fa87:fffe::c000:4902 (Ireland)

ASN2635 (AUTOMATTIC, US)

secure.gravatar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 151.101.12.134 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

malwarebytesunpacked.disqus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
referrer.disqus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1f18:21ae:6700:f931:acf0:5bbb:8761 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

genesis.malwarebytes.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:6c00:296::25ea (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:831::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1288:80:800::7000 (Frankfurt am Main, Germany)

ASN203220 (YAHOO-DEB, GB)

s.yimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.224.96.5 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-96-5.zrh50.r.cloudfront.net

scripts.demandbase.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:7eaf (United States)

ASN13335 (CLOUDFLARENET, US)

unpkg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.185.230 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s53-in-f6.1e100.net

9812475.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:6c00:2a3::1931 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

s.pinimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.224.100.124 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-100-124.zrh50.r.cloudfront.net

js.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:809::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.215.205.165 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-18-215-205-165.compute-1.amazonaws.com

q.quora.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

33 2600:9000:2190:6600:6:8656:f5c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

c.disquscdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 151.101.192.134 (United States)

ASN54113 (FASTLY, US)

disqus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:809::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:119:50e4:101::6cae:b55 (United States) 2 redirects

ASN14413 (LINKEDIN, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:21::14 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.174.10.14 (United States)

ASN14413 (LINKEDIN, US)
PTR: 108-174-10-14.fwd.linkedin.com

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.184.194 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s11-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.224.96.62 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-96-62.zrh50.r.cloudfront.net

api.company-target.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.16.214.249 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-16-214-249.eu-west-1.compute.amazonaws.com

match.prod.bidr.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.224.96.51 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-13-224-96-51.zrh50.r.cloudfront.net

segments.company-target.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.244.174.68 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 68.174.244.35.bc.googleusercontent.com

id.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c0c::9b (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80f::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:809::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:812::2002 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:831::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:831::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:802::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 199.232.80.84 (Marseille, France)

ASN54113 (FASTLY, US)

ct.pinterest.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 151.101.14.49 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

a.disquscdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f02d:100:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:812::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

apis.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a03:2880:f02d:12:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f12d:181:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80e::200d (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

accounts.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:812::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ssl.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:812::200d (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

accounts.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.186.166 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s08-in-f6.1e100.net

5118230.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700::6813:9408 (United States)

ASN13335 (CLOUDFLARENET, US)

script.crazyegg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.12.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.30.148.233 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-30-148-233.eu-west-1.compute.amazonaws.com

insight.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.195 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.5 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:809::2002 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.16.175.42 (United States)

ASN20446 (HIGHWINDS3, US)
PTR: hwcdn.net

cdn.bttrack.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 192.132.33.46 (United States)

ASN18568 (BIDTELLECT, US)
PTR: 46.bidtellect.com

bttrack.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
84	malwarebytes.com 1 redirects blog.malwarebytes.com www.malwarebytes.com genesis.malwarebytes.com	3 MB
37	disquscdn.com c.disquscdn.com a.disquscdn.com	1 MB
18	disqus.com malwarebytesunpacked.disqus.com disqus.com referrer.disqus.com	150 KB
15	google.com 1 redirects www.google.com adservice.google.com apis.google.com accounts.google.com	80 KB
10	doubleclick.net 3 redirects 9812475.fls.doubleclick.net stats.g.doubleclick.net googleads.g.doubleclick.net 5118230.fls.doubleclick.net	5 KB
6	bttrack.com cdn.bttrack.com bttrack.com	6 KB
6	bing.com bat.bing.com	10 KB
5	google.de 1 redirects www.google.de adservice.google.de	565 B
4	crazyegg.com script.crazyegg.com	25 KB
4	facebook.net connect.facebook.net	138 KB
4	linkedin.com 3 redirects px.ads.linkedin.com www.linkedin.com px4.ads.linkedin.com	4 KB
4	google-analytics.com www.google-analytics.com	20 KB
3	pinterest.com ct.pinterest.com	1010 B
3	company-target.com 1 redirects api.company-target.com segments.company-target.com	2 KB
3	adsrvr.org js.adsrvr.org insight.adsrvr.org	3 KB
3	googletagmanager.com www.googletagmanager.com	161 KB
2	gstatic.com ssl.gstatic.com	79 KB
2	bidr.io 2 redirects match.prod.bidr.io	1019 B
2	googleadservices.com www.googleadservices.com	15 KB
2	pinimg.com s.pinimg.com	18 KB
2	yimg.com s.yimg.com	7 KB
2	licdn.com snap.licdn.com	5 KB
2	windows.net optanon.blob.core.windows.net	27 KB
1	t.co t.co	455 B
1	twitter.com analytics.twitter.com	660 B
1	ads-twitter.com static.ads-twitter.com	2 KB
1	facebook.com www.facebook.com
1	rlcdn.com id.rlcdn.com	66 B
1	quora.com q.quora.com	421 B
1	unpkg.com unpkg.com	2 KB
1	demandbase.com scripts.demandbase.com	16 KB
1	gravatar.com secure.gravatar.com	11 KB
1	onetrust.com geolocation.onetrust.com	111 B
1	jsdelivr.net cdn.jsdelivr.net	2 KB
1	googleapis.com fonts.googleapis.com	1 KB
224	35

	Domain	Requested by
72	blog.malwarebytes.com	blog.malwarebytes.com www.malwarebytes.com
33	c.disquscdn.com	malwarebytesunpacked.disqus.com disqus.com c.disquscdn.com blog.malwarebytes.com
11	disqus.com	malwarebytesunpacked.disqus.com c.disquscdn.com
11	www.malwarebytes.com	1 redirects blog.malwarebytes.com www.googletagmanager.com
6	bat.bing.com	www.googletagmanager.com bat.bing.com blog.malwarebytes.com
5	bttrack.com	cdn.bttrack.com bttrack.com
5	www.google.com	1 redirects blog.malwarebytes.com
5	malwarebytesunpacked.disqus.com	blog.malwarebytes.com malwarebytesunpacked.disqus.com www.malwarebytes.com
4	script.crazyegg.com	www.googletagmanager.com script.crazyegg.com
4	accounts.google.com	apis.google.com ssl.gstatic.com
4	apis.google.com	c.disquscdn.com apis.google.com
4	connect.facebook.net	c.disquscdn.com connect.facebook.net
4	a.disquscdn.com	blog.malwarebytes.com c.disquscdn.com
4	www.google.de	blog.malwarebytes.com
4	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com blog.malwarebytes.com
3	5118230.fls.doubleclick.net	1 redirects www.malwarebytes.com adservice.google.com
3	ct.pinterest.com	s.pinimg.com blog.malwarebytes.com
3	googleads.g.doubleclick.net	1 redirects www.googleadservices.com
3	9812475.fls.doubleclick.net	1 redirects www.googletagmanager.com blog.malwarebytes.com
3	www.googletagmanager.com	blog.malwarebytes.com www.googletagmanager.com
2	insight.adsrvr.org	js.adsrvr.org
2	referrer.disqus.com	blog.malwarebytes.com
2	ssl.gstatic.com	accounts.google.com
2	adservice.google.com	9812475.fls.doubleclick.net 5118230.fls.doubleclick.net
2	segments.company-target.com	1 redirects blog.malwarebytes.com
2	match.prod.bidr.io	2 redirects
2	www.googleadservices.com	www.googletagmanager.com www.googleadservices.com
2	px.ads.linkedin.com	2 redirects
2	s.pinimg.com	www.googletagmanager.com s.pinimg.com
2	s.yimg.com	blog.malwarebytes.com s.yimg.com
2	snap.licdn.com	www.googletagmanager.com
2	optanon.blob.core.windows.net	blog.malwarebytes.com optanon.blob.core.windows.net
1	cdn.bttrack.com	5118230.fls.doubleclick.net
1	adservice.google.de	1 redirects
1	t.co
1	analytics.twitter.com	static.ads-twitter.com
1	static.ads-twitter.com	blog.malwarebytes.com
1	www.facebook.com	c.disquscdn.com
1	stats.g.doubleclick.net	www.google-analytics.com
1	id.rlcdn.com	blog.malwarebytes.com
1	api.company-target.com	scripts.demandbase.com
1	px4.ads.linkedin.com	blog.malwarebytes.com
1	www.linkedin.com	1 redirects
1	q.quora.com	blog.malwarebytes.com
1	js.adsrvr.org	www.googletagmanager.com
1	unpkg.com	www.googletagmanager.com
1	scripts.demandbase.com	blog.malwarebytes.com
1	genesis.malwarebytes.com	www.malwarebytes.com
1	secure.gravatar.com	blog.malwarebytes.com
1	geolocation.onetrust.com	www.malwarebytes.com
1	cdn.jsdelivr.net	blog.malwarebytes.com
1	fonts.googleapis.com	blog.malwarebytes.com
224	52

This site contains links to these domains. Also see Links.

Domain
www.malwarebytes.com
onetrust.com
resources.malwarebytes.com
press.malwarebytes.com
www.rsaconference.com
support.malwarebytes.com
forums.malwarebytes.com
www.youtube.com
jobs.malwarebytes.com
my.malwarebytes.com
cloud.malwarebytes.com
partners.malwarebytes.com
www.facebook.com
twitter.com
www.linkedin.com
googleprojectzero.blogspot.com
e.cyberint.com
blog.alyac.co.kr
www.instagram.com
de.malwarebytes.com
es.malwarebytes.com
fr.malwarebytes.com
it.malwarebytes.com
pt.malwarebytes.com
br.malwarebytes.com
nl.malwarebytes.com
pl.malwarebytes.com
ru.malwarebytes.com

Subject Issuer	Validity	Valid
blog.malwarebytes.com DigiCert TLS RSA SHA256 2020 CA1	`2021-07-01` - `2022-07-14`	a year	crt.sh
upload.video.google.com GTS CA 1O1	`2021-08-16` - `2021-11-08`	3 months	crt.sh
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2020	`2021-04-30` - `2022-06-01`	a year	crt.sh
www.malwarebytes.com Amazon	`2021-05-26` - `2022-06-24`	a year	crt.sh
*.blob.core.windows.net Microsoft RSA TLS CA 01	`2021-06-02` - `2022-06-02`	a year	crt.sh
onetrust.com Cloudflare Inc ECC CA-3	`2021-02-12` - `2022-02-11`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2021-08-16` - `2021-11-08`	3 months	crt.sh
*.gravatar.com Sectigo RSA Domain Validation Secure Server CA	`2020-08-14` - `2022-11-16`	2 years	crt.sh
*.disqus.com DigiCert SHA2 Secure Server CA	`2020-04-20` - `2022-05-09`	2 years	crt.sh
*.malwarebytes.com DigiCert SHA2 High Assurance Server CA	`2020-04-10` - `2022-05-23`	2 years	crt.sh
*.licdn.com DigiCert SHA2 Secure Server CA	`2021-04-30` - `2022-05-11`	a year	crt.sh
www.bing.com Microsoft RSA TLS CA 02	`2021-07-06` - `2022-01-06`	6 months	crt.sh
*.yahoo.com DigiCert SHA2 High Assurance Server CA	`2021-07-26` - `2021-09-15`	2 months	crt.sh
tag.demandbase.com Go Daddy Secure Certificate Authority - G2	`2020-10-14` - `2021-11-15`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-07-02` - `2022-07-01`	a year	crt.sh
*.doubleclick.net GTS CA 1C3	`2021-07-26` - `2021-10-18`	3 months	crt.sh
*.pinterest.com DigiCert TLS RSA SHA256 2020 CA1	`2021-07-26` - `2022-08-05`	a year	crt.sh
*.adsrvr.org GlobalSign GCC R3 DV TLS CA 2020	`2021-03-18` - `2022-04-19`	a year	crt.sh
*.quora.com R3	`2021-08-22` - `2021-11-20`	3 months	crt.sh
a.disquscdn.com Amazon	`2020-11-30` - `2021-12-29`	a year	crt.sh
px.ads.linkedin.com DigiCert SHA2 Secure Server CA	`2021-04-15` - `2021-10-15`	6 months	crt.sh
www.googleadservices.com GTS CA 1C3	`2021-08-16` - `2021-11-08`	3 months	crt.sh
api.demandbase.com Go Daddy Secure Certificate Authority - G2	`2020-10-09` - `2021-10-28`	a year	crt.sh
*.company-target.com Go Daddy Secure Certificate Authority - G2	`2021-06-19` - `2022-07-21`	a year	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2021-02-25` - `2022-03-28`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2021-08-16` - `2021-11-08`	3 months	crt.sh
www.google.com GTS CA 1C3	`2021-08-16` - `2021-11-08`	3 months	crt.sh
www.google.de GTS CA 1C3	`2021-07-26` - `2021-10-18`	3 months	crt.sh
*.google.com GTS CA 1C3	`2021-07-26` - `2021-10-18`	3 months	crt.sh
*.googleadservices.com GTS CA 1C3	`2021-08-16` - `2021-11-08`	3 months	crt.sh
*.google.de GTS CA 1C3	`2021-07-26` - `2021-10-18`	3 months	crt.sh
*.disquscdn.com GlobalSign Atlas R3 DV TLS CA 2020	`2021-03-22` - `2022-04-23`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2021-07-20` - `2021-10-18`	3 months	crt.sh
*.apis.google.com GTS CA 1C3	`2021-07-26` - `2021-10-18`	3 months	crt.sh
accounts.google.com GTS CA 1C3	`2021-08-16` - `2021-11-08`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2021-07-26` - `2021-10-18`	3 months	crt.sh
ads-twitter.com DigiCert TLS RSA SHA256 2020 CA1	`2021-07-21` - `2022-07-26`	a year	crt.sh
*.twitter.com DigiCert TLS RSA SHA256 2020 CA1	`2021-02-05` - `2022-02-04`	a year	crt.sh
t.co DigiCert TLS RSA SHA256 2020 CA1	`2021-02-05` - `2022-02-04`	a year	crt.sh
*.bttrack.com Sectigo RSA Domain Validation Secure Server CA	`2021-03-29` - `2022-03-29`	a year	crt.sh

This page contains 11 frames:

Primary Page: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Frame ID: 5A8E26A3482B0DF084F08B7842124081
Requests: 154 HTTP requests in this frame

Frame: https://9812475.fls.doubleclick.net/activityi;dc_pre=CP7NroW60fICFRsEBgAdHegAag;src=9812475;type=conve0;cat=forms000;ord=1;num=3139837301765;gtm=2wg8p0;auiddc=497475147.1630075928;ps=1;~oref=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F
Frame ID: AC8B170895FE0A2CC66818DEA9E1BBC7
Requests: 2 HTTP requests in this frame

Frame: https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=50703%20https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D50703&t_u=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F&t_e=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&t_d=%0A%09%09%09%09%09New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia%09%09%09%09&t_t=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&s_o=default
Frame ID: CBC6B9A9317F5C70F20F52B318509F11
Requests: 27 HTTP requests in this frame

Frame: https://accounts.google.com/o/oauth2/iframe
Frame ID: C99B36DCD9604CBE0E08E7F614B4D8FB
Requests: 3 HTTP requests in this frame

Frame: https://5118230.fls.doubleclick.net/activityi;dc_pre=CPvRlYa60fICFZXO1Qoduh0MOw;src=5118230;type=count0;cat=secur00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1;num=4345294801504.378
Frame ID: A5A4246C4ECA9BE1E11B809DB73B4B55
Requests: 1 HTTP requests in this frame

Frame: https://insight.adsrvr.org/track/up?adv=8mirph5&ref=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F&upid=r8yigtp&upv=1.1.0
Frame ID: 51A842C65754F7266AE7751276ED957F
Requests: 1 HTTP requests in this frame

Frame: https://adservice.google.com/ddm/fls/i/dc_pre=CPvRlYa60fICFZXO1Qoduh0MOw;src=5118230;type=count0;cat=secur00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1;num=4345294801504.378;~oref=https://blog.malwarebytes.com/
Frame ID: D2B4CCCF682FF1DBA30B5A04B156DADC
Requests: 1 HTTP requests in this frame

Frame: https://5118230.fls.doubleclick.net/ddm/fls/r/dc_pre=CPvRlYa60fICFZXO1Qoduh0MOw;src=5118230;type=count0;cat=secur00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1;num=4345294801504.378;~oref=https://blog.malwarebytes.com/
Frame ID: F8F47293EE3F10E2FD2BDFAB64CCF5C3
Requests: 7 HTTP requests in this frame

Frame: https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=50703%20https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D50703&t_u=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F&t_e=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&t_d=%0A%09%09%09%09%09New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia%09%09%09%09&t_t=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&s_o=default
Frame ID: 89A5FA5645F0638D1B37ABC3E031770B
Requests: 2 HTTP requests in this frame

Frame: https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=50703%20https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D50703&t_u=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F&t_e=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&t_d=%0A%09%09%09%09%09New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia%09%09%09%09&t_t=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&s_o=default
Frame ID: 3BF7A7126C084B0AA6E96EBAC0825C21
Requests: 25 HTTP requests in this frame

Frame: https://accounts.google.com/o/oauth2/iframe
Frame ID: DA0452A4A37F1CBFDC93444143551886
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

New variant of Konni malware used in campaign targetting Russia - Malwarebytes Labs | Malwarebytes Labs The official Malwarebytes logo

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

headers link /rel="https:\/\/api\.w\.org\/"/i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers link /rel="https:\/\/api\.w\.org\/"/i

MySQL (Databases) Expand

Overall confidence: 100%
Detected patterns

headers link /rel="https:\/\/api\.w\.org\/"/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

224
Requests

100 %
HTTPS

60 %
IPv6

35
Domains

52
Subdomains

54
IPs

5
Countries

5135 kB
Transfer

8429 kB
Size

5
Cookies

91 Outgoing links

These are links going to different origins than the main page.

URL: https://www.malwarebytes.com/privacy/
Title: More Information

Search URL Search Domain Scan URL

URL: https://onetrust.com/poweredbyonetrust

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/premium/
Title: Malwarebytes for Windows

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/mac/
Title: Malwarebytes for Mac

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/chromebook/
Title: Malwarebytes for Chromebook

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/browserguard/
Title: Malwarebytes Browser Guard

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/for-home/
Title: Overview

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/android/
Title: Malwarebytes for Android

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/ios/
Title: Malwarebytes for iOS

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/vpn/
Title: Malwarebytes Privacy VPN

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/for-home/products/
Title: Explore all Personal Products

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/pricing/
Title: Explore Pricing

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/mwb-download/thankyou/
Title: Free Trial of Malwarebytes Premium Protect your devices, your data, and your privacy—at home or on the go. Get free trial

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/business/solutions
Title: Solutions

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/business/solutions/small-business
Title: Small Business

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/pricing/business

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/business/solutions/mid-market/
Title: Mid-size Businesses

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/business/solutions/enterprise/
Title: Large Enterprise

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/education/
Title: Education

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/finance/
Title: Finance

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/healthcare/
Title: Healthcare

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/business/products
Title: Products

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/business/teams/
Title: For Teams

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/business/endpoint-protection/
Title: Endpoint Protection

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/business/edr/
Title: Endpoint Detection & Response

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/business/incident-response/
Title: Incident Response

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/business/crowdstrike/
Title: Remediation for CrowdStrike®

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/business/endpoint-protection/server-security/
Title: Endpoint Protection for Servers

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/business/edr/server-security/
Title: Endpoint Detection & Response for Servers

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/business/cloud/
Title: Nebula

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/business/product-selector
Title: Help me choose a product

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/business/request_trial?ref=nav
Title: Get a free trial

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/partners/
Title: Explore Partnerships

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/partners/solution-providers/
Title: Resellers

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/partners/managed-service-providers/
Title: Managed Service Providers

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/techbench/
Title: Computer Repair

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/integrations/
Title: Technology Partners

Search URL Search Domain Scan URL

URL: https://resources.malwarebytes.com/casestudy/optimus-systems-delivers-trusted-desktop-security-services-malwarebytes-managed-services-provider/
Title: See full story

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/antivirus/
Title: Antivirus

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/malware/
Title: Malware

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/ransomware/
Title: Ransomware

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/cybersecurity/
Title: See all

Search URL Search Domain Scan URL

URL: https://resources.malwarebytes.com/#reviews
Title: Reviews

Search URL Search Domain Scan URL

URL: https://resources.malwarebytes.com/#analyst-reports
Title: Analyst Reports

Search URL Search Domain Scan URL

URL: https://resources.malwarebytes.com/casestudies/
Title: Case Studies

Search URL Search Domain Scan URL

URL: https://resources.malwarebytes.com/
Title: See all

Search URL Search Domain Scan URL

URL: https://press.malwarebytes.com/
Title: Learn more

Search URL Search Domain Scan URL

URL: https://www.rsaconference.com/usa
Title: See Event

Search URL Search Domain Scan URL

URL: https://support.malwarebytes.com/hc/en-us
Title: Support

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/business/services/
Title: Premium Services

Search URL Search Domain Scan URL

URL: https://forums.malwarebytes.com/
Title: Forums

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/secure/
Title: Vulnerability Disclosure

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCB7JQhkZpiyvGPufW2RPBoQ
Title: Training for Personal Products

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/business/academy/
Title: Training for Business Products

Search URL Search Domain Scan URL

URL: https://support.malwarebytes.com/hc/en-us/articles/360046199873-Activate-Malwarebytes-Privacy-on-Windows-device
Title: See Content

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/contact/
Title: CONTACT US

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/company/
Title: About Malwarebytes

Search URL Search Domain Scan URL

URL: https://jobs.malwarebytes.com/
Title: Careers

Search URL Search Domain Scan URL

URL: https://my.malwarebytes.com/en/login/
Title: My Account

Search URL Search Domain Scan URL

URL: https://cloud.malwarebytes.com/
Title: Cloud Console

Search URL Search Domain Scan URL

URL: https://partners.malwarebytes.com/English/
Title: Partner Portal

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/newsletter/?email=&source=labs
Title: SUBSCRIBE

Search URL Search Domain Scan URL

URL: https://www.facebook.com/Malwarebytes/

Search URL Search Domain Scan URL

URL: https://twitter.com/malwarebytes

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/malwarebytes

Search URL Search Domain Scan URL

URL: https://googleprojectzero.blogspot.com/2019/12/
Title: Google Project Zero

Search URL Search Domain Scan URL

URL: https://e.cyberint.com/hubfs/Cyberint_Konni%20Malware%202019%20Campaign_Report.pdf
Title: 2019 campaign

Search URL Search Domain Scan URL

URL: https://blog.alyac.co.kr/2474
Title: ESTsecurity

Search URL Search Domain Scan URL

URL: http://www.facebook.com/sharer.php?u=https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D50703&t=New+variant+of+Konni+malware+used+in+campaign+targetting+Russia

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?text=New+variant+of+Konni+malware+used+in+campaign+targetting+Russia+https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D50703&via=Malwarebytes

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D50703&title=New+variant+of+Konni+malware+used+in+campaign+targetting+Russia&summary=&source=

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/Malwarebytes

Search URL Search Domain Scan URL

URL: https://www.instagram.com/malwarebytesofficial/

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/business/
Title: FOR BUSINESS

Search URL Search Domain Scan URL

URL: https://my.malwarebytes.com/en/login
Title: SIGN IN

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/legal/
Title: Legal

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/legal/privacy-policy
Title: Privacy

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/accessibility/
Title: Accessibility

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/tos/
Title: Terms of Service

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/
Title: English

Search URL Search Domain Scan URL

URL: https://de.malwarebytes.com/
Title: Deutsch

Search URL Search Domain Scan URL

URL: https://es.malwarebytes.com/
Title: Español

Search URL Search Domain Scan URL

URL: https://fr.malwarebytes.com/
Title: Français

Search URL Search Domain Scan URL

URL: https://it.malwarebytes.com/
Title: Italiano

Search URL Search Domain Scan URL

URL: https://pt.malwarebytes.com/
Title: Português (Portugal)

Search URL Search Domain Scan URL

URL: https://br.malwarebytes.com/
Title: Português (Brasil)

Search URL Search Domain Scan URL

URL: https://nl.malwarebytes.com/
Title: Nederlands

Search URL Search Domain Scan URL

URL: https://pl.malwarebytes.com/
Title: Polski

Search URL Search Domain Scan URL

URL: https://ru.malwarebytes.com/
Title: Pусский

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/jp/
Title: 日本語

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/se/
Title: Svenska

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 23

https://www.malwarebytes.com/css/NEW-NAV.css HTTP 301
https://www.malwarebytes.com/css/new-nav.css

Request Chain 97

https://9812475.fls.doubleclick.net/activityi;src=9812475;type=conve0;cat=forms000;ord=1;num=3139837301765;gtm=2wg8p0;auiddc=497475147.1630075928;ps=1;~oref=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F HTTP 302
https://9812475.fls.doubleclick.net/activityi;dc_pre=CP7NroW60fICFRsEBgAdHegAag;src=9812475;type=conve0;cat=forms000;ord=1;num=3139837301765;gtm=2wg8p0;auiddc=497475147.1630075928;ps=1;~oref=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F

Request Chain 111

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2567940&time=1630075928528&url=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D2567940%26time%3D1630075928528%26url%3Dhttps%253A%252F%252Fblog.malwarebytes.com%252Fthreat-intelligence%252F2021%252F08%252Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%252F%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2567940&time=1630075928528&url=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F&liSync=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=2567940&time=1630075928528&url=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F&liSync=true&e_ipv6=AQIq583woU4V1gAAAXuIGMP9t4y7mPy59LgjyEcHT3wDi0hA-kEIQ3hynW9nzF59by06Y7mr

Request Chain 120

https://match.prod.bidr.io/cookie-sync/demandbase HTTP 303
https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1 HTTP 303
https://segments.company-target.com/log?vendor=choca&user_id=AABnUE7CUfgAABqkD-OmHQ HTTP 303
https://segments.company-target.com/validateCookie?vendor=choca&user_id=AABnUE7CUfgAABqkD-OmHQ&verifyHash=385536fbe4dc83053782ca90799acf8d6bb0c6ff

Request Chain 136

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/380232391/?random=349996654&cv=9&fst=1630075928688&num=1&label=_XHlCK3XlI0CEMfFp7UB&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa8p0&sendb=1&ig=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F&tiba=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia%20-%20Malwarebytes%20Labs%20%7C%20Malwarebytes%20Labs&auid=497475147.1630075928&capi=1&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=GPwoYbSAK5iq7gOh86DAAg&sscte=1&crd= HTTP 302
https://www.google.com/pagead/1p-conversion/380232391/?random=349996654&cv=9&fst=1630075928688&num=1&label=_XHlCK3XlI0CEMfFp7UB&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa8p0&sendb=1&ig=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F&tiba=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia%20-%20Malwarebytes%20Labs%20%7C%20Malwarebytes%20Labs&auid=497475147.1630075928&capi=1&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=GPwoYbSAK5iq7gOh86DAAg&cid=CAQSKQCNIrLMBHSxoQJQXiFgWcQqlyqZ-n1dOl62bltXuTwLDQNsYdb_k3_V&random=3037640391&resp=GooglemKTybQhCsO HTTP 302
https://www.google.de/pagead/1p-conversion/380232391/?random=349996654&cv=9&fst=1630075928688&num=1&label=_XHlCK3XlI0CEMfFp7UB&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa8p0&sendb=1&ig=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F&tiba=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia%20-%20Malwarebytes%20Labs%20%7C%20Malwarebytes%20Labs&auid=497475147.1630075928&capi=1&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=GPwoYbSAK5iq7gOh86DAAg&cid=CAQSKQCNIrLMBHSxoQJQXiFgWcQqlyqZ-n1dOl62bltXuTwLDQNsYdb_k3_V&random=3037640391&resp=GooglemKTybQhCsO&ipr=y

Request Chain 170

https://5118230.fls.doubleclick.net/activityi;src=5118230;type=count0;cat=secur00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1;num=4345294801504.378 HTTP 302
https://5118230.fls.doubleclick.net/activityi;dc_pre=CPvRlYa60fICFZXO1Qoduh0MOw;src=5118230;type=count0;cat=secur00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1;num=4345294801504.378

Request Chain 187

https://adservice.google.de/ddm/fls/i/dc_pre=CPvRlYa60fICFZXO1Qoduh0MOw;src=5118230;type=count0;cat=secur00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1;num=4345294801504.378;~oref=https://blog.malwarebytes.com/ HTTP 302
https://5118230.fls.doubleclick.net/ddm/fls/r/dc_pre=CPvRlYa60fICFZXO1Qoduh0MOw;src=5118230;type=count0;cat=secur00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1;num=4345294801504.378;~oref=https://blog.malwarebytes.com/

224 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/ 175 KB
38 KB 379ms
141ms Document
text/html 130.211.198.3
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

130.211.198.3 Council Bluffs, United States, ASN15169 (GOOGLE, US),

Reverse DNS

3.198.211.130.bc.googleusercontent.com

Software

nginx / WP Engine

Resource Hash

8472a288d54aaa7e8d250caa237cfbd45115a25d0c87e1f484e8c207085dab48

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors none;
X-Frame-Options	DENY

Request headers

:method: GET
:authority: blog.malwarebytes.com
:scheme: https
:path: /threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

server: nginx
date: Fri, 27 Aug 2021 14:52:07 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding Accept-Encoding Accept-Encoding,Cookie
x-pingback: https://blog.malwarebytes.com/xmlrpc.php
link: <https://blog.malwarebytes.com/wp-json/>; rel="https://api.w.org/" <https://blog.malwarebytes.com/wp-json/wp/v2/posts/50703>; rel="alternate"; type="application/json" <https://blog.malwarebytes.com/?p=50703>; rel=shortlink
x-powered-by: WP Engine
x-cacheable: SHORT
cache-control: max-age=600, must-revalidate
x-cache: HIT: 4
x-cache-group: normal
x-frame-options: DENY
content-security-policy: frame-ancestors none;
content-encoding: br

GET
H2 200 style.min.css
blog.malwarebytes.com/wp-includes/css/dist/block-library/ 79 KB
11 KB 132ms
127ms Stylesheet
text/css 130.211.198.3
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.malwarebytes.com/wp-includes/css/dist/block-library/style.min.css?ver=5.8
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 130.211.198.3 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 3.198.211.130.bc.googleusercontent.com
Software: nginx /
Resource Hash: 9110fc122dda3067c424d9b8ff7747e2030b0bd9298f69a3683d399ad3373a6a

Request headers

:path: /wp-includes/css/dist/block-library/style.min.css?ver=5.8
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: blog.malwarebytes.com
referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:07 GMT
content-encoding: br
last-modified: Mon, 19 Jul 2021 00:56:57 GMT
server: nginx
etag: W/"60f4cdd9-13abe"
vary: Accept-Encoding Accept-Encoding Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 prettyPhoto.min.css
blog.malwarebytes.com/wp-content/plugins/responsive-lightbox/assets/prettyphoto/ 19 KB
3 KB 132ms
128ms Stylesheet
text/css 130.211.198.3
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.malwarebytes.com/wp-content/plugins/responsive-lightbox/assets/prettyphoto/prettyPhoto.min.css?ver=2.3.2
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 130.211.198.3 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 3.198.211.130.bc.googleusercontent.com
Software: nginx /
Resource Hash: 3df56cf5e9b367ce3a1f69c52fe68655893e7443d0b9df0a8a094606775657c0

Request headers

:path: /wp-content/plugins/responsive-lightbox/assets/prettyphoto/prettyPhoto.min.css?ver=2.3.2
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: blog.malwarebytes.com
referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:07 GMT
content-encoding: br
last-modified: Tue, 23 Feb 2021 22:11:49 GMT
server: nginx
etag: W/"60357da5-4bdc"
vary: Accept-Encoding Accept-Encoding Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 css
fonts.googleapis.com/ 16 KB
1 KB 19ms
15ms Stylesheet
text/css 2a00:1450:4001:80f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro%3A300%2C400%2C700%2C300italic%2C400italic%2C700italic%7CBitter%3A400%2C700&subset=latin%2Clatin-ext

Requested by

Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3fd4cc1421303e460ad0c220e457f0cd7ceb35a0956eb15bb61b299b4e66f55

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Origin: https://blog.malwarebytes.com
Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 27 Aug 2021 14:08:28 GMT
server: ESF
date: Fri, 27 Aug 2021 14:52:07 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 27 Aug 2021 14:52:07 GMT

GET
H2 200 genericons.css
blog.malwarebytes.com/wp-content/plugins/jetpack/_inc/genericons/genericons/ 28 KB
16 KB 198ms
193ms Stylesheet
text/css 130.211.198.3
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.malwarebytes.com/wp-content/plugins/jetpack/_inc/genericons/genericons/genericons.css?ver=3.1
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 130.211.198.3 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 3.198.211.130.bc.googleusercontent.com
Software: nginx /
Resource Hash: 4ed10d0d64bb1515397e8666a63f484d640dbc5678fa62574e077b7aef1c3af2

Request headers

:path: /wp-content/plugins/jetpack/_inc/genericons/genericons/genericons.css?ver=3.1
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: blog.malwarebytes.com
referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:07 GMT
content-encoding: br
last-modified: Thu, 03 Jun 2021 18:16:10 GMT
server: nginx
etag: W/"60b91c6a-6e6a"
vary: Accept-Encoding Accept-Encoding Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 jquery.min.js Show response
blog.malwarebytes.com/wp-includes/js/jquery/ 87 KB
31 KB 217ms
213ms Script
application/javascript 130.211.198.3
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.malwarebytes.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.0
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 130.211.198.3 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 3.198.211.130.bc.googleusercontent.com
Software: nginx /
Resource Hash: bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea

Request headers

:path: /wp-includes/js/jquery/jquery.min.js?ver=3.6.0
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: blog.malwarebytes.com
referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:07 GMT
content-encoding: br
last-modified: Wed, 10 Mar 2021 15:07:24 GMT
server: nginx
etag: W/"6048e0ac-15db1"
vary: Accept-Encoding Accept-Encoding Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 jquery-migrate.min.js Show response
blog.malwarebytes.com/wp-includes/js/jquery/ 11 KB
4 KB 218ms
213ms Script
application/javascript 130.211.198.3
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.malwarebytes.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 130.211.198.3 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 3.198.211.130.bc.googleusercontent.com
Software: nginx /
Resource Hash: 029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300

Request headers

:path: /wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: blog.malwarebytes.com
referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:07 GMT
content-encoding: br
last-modified: Wed, 18 Nov 2020 09:06:06 GMT
server: nginx
etag: W/"5fb4e3fe-2bd8"
vary: Accept-Encoding Accept-Encoding Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 jquery.prettyPhoto.min.js Show response
blog.malwarebytes.com/wp-content/plugins/responsive-lightbox/assets/prettyphoto/ 22 KB
6 KB 227ms
222ms Script
application/javascript 130.211.198.3
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.malwarebytes.com/wp-content/plugins/responsive-lightbox/assets/prettyphoto/jquery.prettyPhoto.min.js?ver=2.3.2
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 130.211.198.3 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 3.198.211.130.bc.googleusercontent.com
Software: nginx /
Resource Hash: ba0504cfd673e9fbf0bab2b70a67ac1bbea97891e12fc8cd3f94070f0c4898f8

Request headers

:path: /wp-content/plugins/responsive-lightbox/assets/prettyphoto/jquery.prettyPhoto.min.js?ver=2.3.2
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: blog.malwarebytes.com
referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:07 GMT
content-encoding: br
last-modified: Tue, 23 Feb 2021 22:11:49 GMT
server: nginx
etag: W/"60357da5-5955"
vary: Accept-Encoding Accept-Encoding Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 underscore.min.js Show response
blog.malwarebytes.com/wp-includes/js/ 19 KB
8 KB 241ms
236ms Script
application/javascript 130.211.198.3
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.malwarebytes.com/wp-includes/js/underscore.min.js?ver=1.8.3
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 130.211.198.3 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 3.198.211.130.bc.googleusercontent.com
Software: nginx /
Resource Hash: 5dacc86b8a64742e60d70192353e5643da219a3f84c0b26cf6116b06b67fff32

Request headers

:path: /wp-includes/js/underscore.min.js?ver=1.8.3
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: blog.malwarebytes.com
referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:07 GMT
content-encoding: br
last-modified: Thu, 27 May 2021 19:33:19 GMT
server: nginx
etag: W/"60aff3ff-4a84"
vary: Accept-Encoding Accept-Encoding Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 infinite-scroll.pkgd.min.js Show response
blog.malwarebytes.com/wp-content/plugins/responsive-lightbox/assets/infinitescroll/ 25 KB
7 KB 255ms
251ms Script
application/javascript 130.211.198.3
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.malwarebytes.com/wp-content/plugins/responsive-lightbox/assets/infinitescroll/infinite-scroll.pkgd.min.js?ver=5.8
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 130.211.198.3 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 3.198.211.130.bc.googleusercontent.com
Software: nginx /
Resource Hash: 378f79bc8e52dc7c86332d048c8b8f57ad672c3c917ca54b08630bb487b99d3f

Request headers

:path: /wp-content/plugins/responsive-lightbox/assets/infinitescroll/infinite-scroll.pkgd.min.js?ver=5.8
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: blog.malwarebytes.com
referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:07 GMT
content-encoding: br
last-modified: Tue, 23 Feb 2021 22:11:49 GMT
server: nginx
etag: W/"60357da5-64e6"
vary: Accept-Encoding Accept-Encoding Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 front.js Show response
blog.malwarebytes.com/wp-content/plugins/responsive-lightbox/js/ 26 KB
6 KB 206ms
202ms Script
application/javascript 130.211.198.3
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.malwarebytes.com/wp-content/plugins/responsive-lightbox/js/front.js?ver=2.3.2
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 130.211.198.3 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 3.198.211.130.bc.googleusercontent.com
Software: nginx /
Resource Hash: 3c8ba982e1a7629cb5be1c6e7ac909bb494b895a63affce2f6306e5cd244505a

Request headers

:path: /wp-content/plugins/responsive-lightbox/js/front.js?ver=2.3.2
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: blog.malwarebytes.com
referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:07 GMT
content-encoding: br
last-modified: Tue, 23 Feb 2021 22:11:49 GMT
server: nginx
etag: W/"60357da5-68e8"
vary: Accept-Encoding Accept-Encoding Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 normalize.css
cdn.jsdelivr.net/npm/normalize.css@8.0.1/ 6 KB
2 KB 9ms
5ms Stylesheet
text/css 2a04:4e42:3::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/normalize.css@8.0.1/normalize.css

Requested by

Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:3::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

580818700724d42d7fcc4979b0197971fca1c6d2e0286769237a0ac897df5512

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
age: 454202
x-jsd-version: 8.0.1
x-cache: HIT
cross-origin-resource-policy: cross-origin
content-length: 1738
etag: W/"17fa-f/3jQ73xCt0fBS88QwihUYDrRAQ"
x-served-by: cache-fra19166-FRA
x-jsd-version-type: version
date: Fri, 27 Aug 2021 14:52:07 GMT
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 style.css
www.malwarebytes.com/css/ 222 KB
34 KB 47ms
16ms Stylesheet
text/css 2600:9000:21f3:fe00:16:26c7:ff80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.malwarebytes.com/css/style.css?12-20-2016
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21f3:fe00:16:26c7:ff80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 106ff2dcabdf33e3a570650ebd622f534c02c6f751a8320ed879e172d767bbd2

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:48:01 GMT
content-encoding: gzip
last-modified: Tue, 20 Jul 2021 14:26:52 GMT
server: Microsoft-IIS/10.0
age: 245
x-powered-by: ASP.NET
etag: W/"60f6b548737dd71:0"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/css
via: 1.1 e5b747ffd1713cb17ddd7d55234a3301.cloudfront.net (CloudFront)
cache-control: max-age=900
x-amz-cf-pop: FRA2-C2
x-amz-cf-id: 5GW_HrpI0xZ9-sNQj-wkHxsYrc5L6LDwn8mbr0RDNRkAXDOyRmgfHg==

GET
H2 200 style.css
blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/ 192 KB
31 KB 216ms
212ms Stylesheet
text/css 130.211.198.3
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/style.css?18-08-2021
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 130.211.198.3 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 3.198.211.130.bc.googleusercontent.com
Software: nginx /
Resource Hash: f19f9a64724da1dc19ec99a7f0c83d637552787be8a4eb9bbec9ca6ec5a369d5

Request headers

:path: /wp-content/themes/mb-labs-theme-3.5.13/style.css?18-08-2021
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: blog.malwarebytes.com
referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:07 GMT
content-encoding: br
last-modified: Wed, 18 Aug 2021 21:09:52 GMT
server: nginx
etag: W/"611d7720-2ff4a"
vary: Accept-Encoding Accept-Encoding Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 jquery-1.11.3.min.js Show response
www.malwarebytes.com/js/ 94 KB
33 KB 52ms
21ms Script
application/javascript 2600:9000:21f3:fe00:16:26c7:ff80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.malwarebytes.com/js/jquery-1.11.3.min.js
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21f3:fe00:16:26c7:ff80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: ecb916133a9376911f10bc5c659952eb0031e457f5df367cde560edbfba38fb8

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:07 GMT
content-encoding: gzip
etag: W/"2cfb9e0bc7dd71:0"
last-modified: Tue, 20 Jul 2021 23:13:40 GMT
server: Microsoft-IIS/10.0
x-amz-cf-pop: FRA2-C2
x-powered-by: ASP.NET
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 e5b747ffd1713cb17ddd7d55234a3301.cloudfront.net (CloudFront)
cache-control: max-age=900
x-amz-cf-id: C8TRblFyzzvaHOlrK8aG8TWiJO3Wo3NHE28kh4z7RRYh8bClPdpw8Q==

GET
H/1.1 200
OK 9530a107-0af8-4204-a2c2-217efb78222b.js Show response
optanon.blob.core.windows.net/consent/ 140 KB
21 KB 127ms
32ms Script
application/x-javascript 52.239.137.4
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://optanon.blob.core.windows.net/consent/9530a107-0af8-4204-a2c2-217efb78222b.js
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.239.137.4 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: ec442600e3c090c1171e6d0aca38073cc048af3a7a301ec06bf933da6aa65c1b

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
Date: Fri, 27 Aug 2021 14:52:06 GMT
Content-Encoding: GZIP
Last-Modified: Wed, 19 Aug 2020 23:29:25 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Content-MD5: NyuiOqvVdJMyWTtUb2ZlDA==
ETag: 0x8D84497B6030FBF
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *
x-ms-request-id: f78bf5b0-601e-016b-5853-9bc3e5000000
Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
Cache-Control: public, max-age=14400
x-ms-version: 2009-09-19
Content-Length: 20591

GET
H2 200 bootstrap.js Show response
www.malwarebytes.com/js/ 74 KB
14 KB 52ms
21ms Script
application/javascript 2600:9000:21f3:fe00:16:26c7:ff80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.malwarebytes.com/js/bootstrap.js
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21f3:fe00:16:26c7:ff80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: d4e61ea4aafc5da0b582e7e15077addf35379acc4b7b03df0128ed33ba589884

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:49:23 GMT
content-encoding: gzip
etag: W/"f29e8b10b67dd71:0"
last-modified: Tue, 20 Jul 2021 22:24:54 GMT
server: Microsoft-IIS/10.0
age: 194
x-powered-by: ASP.NET
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 e5b747ffd1713cb17ddd7d55234a3301.cloudfront.net (CloudFront)
cache-control: max-age=900
x-amz-cf-pop: FRA2-C2
x-amz-cf-id: kMyWciO_8tbuMhvEye1whIsc51gve9XBZEOH6R1ZZimayyV16hhOUg==

GET
H2 200 respond.min.js Show response
www.malwarebytes.com/js/ie-fixes/ 4 KB
3 KB 47ms
17ms Script
application/javascript 2600:9000:21f3:fe00:16:26c7:ff80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.malwarebytes.com/js/ie-fixes/respond.min.js
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21f3:fe00:16:26c7:ff80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 6252f8d40b521387483f57b7d0c812912a1d59ce038fdde2bcf67cf920486cac

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:49:23 GMT
content-encoding: gzip
etag: W/"10e31071bc7dd71:0"
last-modified: Tue, 20 Jul 2021 23:10:33 GMT
server: Microsoft-IIS/10.0
age: 194
x-powered-by: ASP.NET
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 e5b747ffd1713cb17ddd7d55234a3301.cloudfront.net (CloudFront)
cache-control: max-age=900
x-amz-cf-pop: FRA2-C2
x-amz-cf-id: hKxBKOlUAlKtJs26p9xRZyvjJoTEwRJ4-cfzY1bKo1uR4LdZ5_IFOQ==

GET
H2 200 modernizr.js Show response
blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/ 17 KB
7 KB 297ms
294ms Script
application/javascript 130.211.198.3
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/modernizr.js
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 130.211.198.3 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 3.198.211.130.bc.googleusercontent.com
Software: nginx /
Resource Hash: da819542692b3f1c2a667ba34eff3465a82d9756953a1446ab7d0772f9b1edd5

Request headers

:path: /wp-content/themes/mb-labs-theme-3.5.13/modernizr.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: blog.malwarebytes.com
referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:07 GMT
content-encoding: br
last-modified: Wed, 18 Aug 2021 21:09:52 GMT
server: nginx
etag: W/"611d7720-434b"
vary: Accept-Encoding Accept-Encoding Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 nav-resize.js Show response
www.malwarebytes.com/js/ 12 KB
4 KB 46ms
16ms Script
application/javascript 2600:9000:21f3:fe00:16:26c7:ff80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.malwarebytes.com/js/nav-resize.js
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21f3:fe00:16:26c7:ff80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 93e43a00cd73303f914fe90d7be15dc032f4796891b571bf6cd9d9f36f4c91eb

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:48:52 GMT
content-encoding: gzip
last-modified: Mon, 17 May 2021 00:58:50 GMT
server: Microsoft-IIS/10.0
age: 194
x-powered-by: ASP.NET
etag: W/"9ee890ccb74ad71:0"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 e5b747ffd1713cb17ddd7d55234a3301.cloudfront.net (CloudFront)
cache-control: max-age=900
x-amz-cf-pop: FRA2-C2
x-amz-cf-id: -wnC0KhsK0-b7Nwndl-k_vdxCVbz_ZZgb8zHLIQ9457ttnl4C9Y_Vg==

GET
H2 200 flexibility.js Show response
www.malwarebytes.com/js/ 17 KB
6 KB 51ms
21ms Script
application/javascript 2600:9000:21f3:fe00:16:26c7:ff80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.malwarebytes.com/js/flexibility.js
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21f3:fe00:16:26c7:ff80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 58c13e24cdfb6384c26836e3eac52d17701cd9d686c56ebf93efbbe9426f8cd6

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:46:46 GMT
content-encoding: gzip
last-modified: Tue, 20 Jul 2021 23:13:07 GMT
server: Microsoft-IIS/10.0
age: 320
x-powered-by: ASP.NET
etag: W/"838aeaccbc7dd71:0"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 e5b747ffd1713cb17ddd7d55234a3301.cloudfront.net (CloudFront)
cache-control: max-age=900
x-amz-cf-pop: FRA2-C2
x-amz-cf-id: mOOe1GrowwlpXN1ZTMzzOUJd3kJcJ160Wp6p2mTYO_skop1DY0D9eQ==

GET
H2 200 global.js Show response
www.malwarebytes.com/js/ 21 KB
8 KB 57ms
27ms Script
application/javascript 2600:9000:21f3:fe00:16:26c7:ff80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.malwarebytes.com/js/global.js
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21f3:fe00:16:26c7:ff80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 80ac8548037a7878edd91fd417514656e1541d36d1acd239daf94134081a26e8

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:49:45 GMT
content-encoding: gzip
last-modified: Wed, 16 Jun 2021 21:07:36 GMT
server: Microsoft-IIS/10.0
age: 141
x-powered-by: ASP.NET
etag: W/"2c592ca2f362d71:0"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 e5b747ffd1713cb17ddd7d55234a3301.cloudfront.net (CloudFront)
cache-control: max-age=900
x-amz-cf-pop: FRA2-C2
x-amz-cf-id: vcxirkVZoV3Tfw7LbHdjhq0EOpQsoAxo9tImHTPb0hdTjz4AfpAYWA==

GET
H2 200 xs.js Show response
www.malwarebytes.com/js/ 9 KB
3 KB 56ms
26ms Script
application/javascript 2600:9000:21f3:fe00:16:26c7:ff80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.malwarebytes.com/js/xs.js
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21f3:fe00:16:26c7:ff80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: c13527e6600d478c3cd7ae449acd6813e1c7209a97c0334702ee8d1a999a3a93

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:48:01 GMT
content-encoding: gzip
last-modified: Tue, 20 Jul 2021 23:10:17 GMT
server: Microsoft-IIS/10.0
age: 245
x-powered-by: ASP.NET
etag: W/"f2378867bc7dd71:0"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 e5b747ffd1713cb17ddd7d55234a3301.cloudfront.net (CloudFront)
cache-control: max-age=900
x-amz-cf-pop: FRA2-C2
x-amz-cf-id: 2KIe0WEJKFGN9cRfqfLPlp5JJxS0YJsCyQhvMCAA5YKblgxU2fMwDw==

GET
H2 200 search.js Show response
blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/js/ 1 KB
713 B 297ms
295ms Script
application/javascript 130.211.198.3
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/js/search.js
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 130.211.198.3 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 3.198.211.130.bc.googleusercontent.com
Software: nginx /
Resource Hash: 1dc2b8fb26c1a74260a66519a2a5fdf37a938d1b43bbe4d8da7fcd652acc61b9

Request headers

:path: /wp-content/themes/mb-labs-theme-3.5.13/js/search.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: blog.malwarebytes.com
referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:07 GMT
content-encoding: br
last-modified: Wed, 18 Aug 2021 21:09:52 GMT
server: nginx
etag: W/"611d7720-55e"
vary: Accept-Encoding Accept-Encoding Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2

200

new-nav.css
www.malwarebytes.com/css/
Redirect Chain

https://www.malwarebytes.com/css/NEW-NAV.css
https://www.malwarebytes.com/css/new-nav.css

22 KB
4 KB

14ms
13ms

Stylesheet
text/css

2600:9000:21f3:fe00:16:26c7:ff80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.malwarebytes.com/css/new-nav.css
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21f3:fe00:16:26c7:ff80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 72622641b79819e5c8b5c0543d105a45e30f13b1a6c0b5c3701e72de5b57e427

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:48:02 GMT
content-encoding: gzip
last-modified: Thu, 22 Apr 2021 13:23:18 GMT
server: Microsoft-IIS/10.0
age: 244
x-powered-by: ASP.NET
etag: W/"55eeb1a87a37d71:0"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/css
via: 1.1 e5b747ffd1713cb17ddd7d55234a3301.cloudfront.net (CloudFront)
cache-control: max-age=900
x-amz-cf-pop: FRA2-C2
x-amz-cf-id: 4r8kN3urJNQgMAKFTpkmDL48dGNmhtKLoZHRMqWc0xoUIIUvQhIrNw==

Redirect headers

date: Fri, 27 Aug 2021 14:48:01 GMT
via: 1.1 e5b747ffd1713cb17ddd7d55234a3301.cloudfront.net (CloudFront)
server: Microsoft-IIS/10.0
age: 245
x-powered-by: ASP.NET
x-cache: Hit from cloudfront
content-type: text/html; charset=UTF-8
location: https://www.malwarebytes.com/css/new-nav.css
cache-control: max-age=900
x-amz-cf-pop: FRA2-C2
content-length: 167
x-amz-cf-id: LZf280AzZr2VSiUxtaaOMElBIpMnehc2xa4gNyDhN78y4ytoVdryiw==

GET
H2 200 new-nav.js Show response
blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/js/ 6 KB
2 KB 297ms
295ms Script
application/javascript 130.211.198.3
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/js/new-nav.js
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 130.211.198.3 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 3.198.211.130.bc.googleusercontent.com
Software: nginx /
Resource Hash: a2b3f57762f2932505c6fa9b43932cb13856966074febc5bb048052f17100bf6

Request headers

:path: /wp-content/themes/mb-labs-theme-3.5.13/js/new-nav.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: blog.malwarebytes.com
referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:07 GMT
content-encoding: br
last-modified: Wed, 18 Aug 2021 21:09:52 GMT
server: nginx
etag: W/"611d7720-1703"
vary: Accept-Encoding Accept-Encoding Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 arrow.svg
blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/images/refreshed_homepage/ 2 KB
1 KB 127ms
120ms Image
image/svg+xml 130.211.198.3
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/images/refreshed_homepage/arrow.svg
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 130.211.198.3 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 3.198.211.130.bc.googleusercontent.com
Software: nginx /
Resource Hash: ad15e02b8d9bee31a51c502cff1977983fa2c8103b769db7ab097750f34016a9

Request headers

:path: /wp-content/themes/mb-labs-theme-3.5.13/images/refreshed_homepage/arrow.svg
pragma: no-cache
cookie: OptanonConsent=isIABGlobal=false&datestamp=Fri+Aug+27+2021+16%3A52%3A07+GMT%2B0200+(Central+European+Summer+Time)&version=6.4.0&landingPath=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: blog.malwarebytes.com
referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:07 GMT
content-encoding: br
last-modified: Wed, 18 Aug 2021 21:09:52 GMT
server: nginx
etag: W/"611d7720-94e"
vary: Accept-Encoding Accept-Encoding Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 personal-icon.svg
blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/images/icons/ 2 KB
1 KB 127ms
121ms Image
image/svg+xml 130.211.198.3
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/images/icons/personal-icon.svg
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 130.211.198.3 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 3.198.211.130.bc.googleusercontent.com
Software: nginx /
Resource Hash: 9d815528e2ed7985b63e839cbeb0b684e1fa8da87da3c1a0962b1eecfe437614

Request headers

:path: /wp-content/themes/mb-labs-theme-3.5.13/images/icons/personal-icon.svg
pragma: no-cache
cookie: OptanonConsent=isIABGlobal=false&datestamp=Fri+Aug+27+2021+16%3A52%3A07+GMT%2B0200+(Central+European+Summer+Time)&version=6.4.0&landingPath=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: blog.malwarebytes.com
referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:07 GMT
content-encoding: br
last-modified: Wed, 18 Aug 2021 21:09:52 GMT
server: nginx
etag: W/"611d7720-6f4"
vary: Accept-Encoding Accept-Encoding Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 pricing-icon.svg
blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/images/icons/ 2 KB
1022 B 128ms
122ms Image
image/svg+xml 130.211.198.3
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/images/icons/pricing-icon.svg
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 130.211.198.3 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 3.198.211.130.bc.googleusercontent.com
Software: nginx /
Resource Hash: 21da5195f86350f2b52a0ee70a668d4f72542d0413b57dd84f06593e0e0f7207

Request headers

:path: /wp-content/themes/mb-labs-theme-3.5.13/images/icons/pricing-icon.svg
pragma: no-cache
cookie: OptanonConsent=isIABGlobal=false&datestamp=Fri+Aug+27+2021+16%3A52%3A07+GMT%2B0200+(Central+European+Summer+Time)&version=6.4.0&landingPath=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: blog.malwarebytes.com
referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:07 GMT
content-encoding: br
last-modified: Wed, 18 Aug 2021 21:09:52 GMT
server: nginx
etag: W/"611d7720-73c"
vary: Accept-Encoding Accept-Encoding Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 smb.svg
blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/images/nav/ 2 KB
1 KB 128ms
122ms Image
image/svg+xml 130.211.198.3
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/images/nav/smb.svg
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 130.211.198.3 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 3.198.211.130.bc.googleusercontent.com
Software: nginx /
Resource Hash: 80f0eb912943ad0deab2ad7a8125b7404b726bac65dca9e6be97b063ca490662

Request headers

:path: /wp-content/themes/mb-labs-theme-3.5.13/images/nav/smb.svg
pragma: no-cache
cookie: OptanonConsent=isIABGlobal=false&datestamp=Fri+Aug+27+2021+16%3A52%3A07+GMT%2B0200+(Central+European+Summer+Time)&version=6.4.0&landingPath=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: blog.malwarebytes.com
referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:07 GMT
content-encoding: br
last-modified: Wed, 18 Aug 2021 21:09:52 GMT
server: nginx
etag: W/"611d7720-9ac"
vary: Accept-Encoding Accept-Encoding Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 buy-label.svg
blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/images/nav/ 3 KB
1 KB 128ms
122ms Image
image/svg+xml 130.211.198.3
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/images/nav/buy-label.svg
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 130.211.198.3 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 3.198.211.130.bc.googleusercontent.com
Software: nginx /
Resource Hash: b569dd28a56f53339cc04cc2e251dcfb426262bd7ad60ed44cc35da0dd3b2cc6

Request headers

:path: /wp-content/themes/mb-labs-theme-3.5.13/images/nav/buy-label.svg
pragma: no-cache
cookie: OptanonConsent=isIABGlobal=false&datestamp=Fri+Aug+27+2021+16%3A52%3A07+GMT%2B0200+(Central+European+Summer+Time)&version=6.4.0&landingPath=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: blog.malwarebytes.com
referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:07 GMT
content-encoding: br
last-modified: Wed, 18 Aug 2021 21:09:52 GMT
server: nginx
etag: W/"611d7720-aa1"
vary: Accept-Encoding Accept-Encoding Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 mid-size.svg
blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/images/nav/ 1 KB
1011 B 183ms
178ms Image
image/svg+xml 130.211.198.3
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/images/nav/mid-size.svg
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 130.211.198.3 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 3.198.211.130.bc.googleusercontent.com
Software: nginx /
Resource Hash: 7e6aa30a919ae381fbcf4d4d6f970531bf513bf0847097e7927123bf032b0f09

Request headers

:path: /wp-content/themes/mb-labs-theme-3.5.13/images/nav/mid-size.svg
pragma: no-cache
cookie: OptanonConsent=isIABGlobal=false&datestamp=Fri+Aug+27+2021+16%3A52%3A07+GMT%2B0200+(Central+European+Summer+Time)&version=6.4.0&landingPath=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: blog.malwarebytes.com
referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:07 GMT
content-encoding: br
last-modified: Wed, 18 Aug 2021 21:09:52 GMT
server: nginx
etag: W/"611d7720-5d2"
vary: Accept-Encoding Accept-Encoding Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 large-ent.svg
blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/images/nav/ 2 KB
1 KB 184ms
178ms Image
image/svg+xml 130.211.198.3
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/images/nav/large-ent.svg
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 130.211.198.3 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 3.198.211.130.bc.googleusercontent.com
Software: nginx /
Resource Hash: 5d09ea31b4f26497480482f539fdc221990ae192c8b8be5002f4f2b9bef26876

Request headers

:path: /wp-content/themes/mb-labs-theme-3.5.13/images/nav/large-ent.svg
pragma: no-cache
cookie: OptanonConsent=isIABGlobal=false&datestamp=Fri+Aug+27+2021+16%3A52%3A07+GMT%2B0200+(Central+European+Summer+Time)&version=6.4.0&landingPath=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: blog.malwarebytes.com
referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:07 GMT
content-encoding: br
last-modified: Wed, 18 Aug 2021 21:09:52 GMT
server: nginx
etag: W/"611d7720-7bd"
vary: Accept-Encoding Accept-Encoding Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 call.svg
blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/images/nav/ 2 KB
1 KB 184ms
178ms Image
image/svg+xml 130.211.198.3
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/images/nav/call.svg
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 130.211.198.3 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 3.198.211.130.bc.googleusercontent.com
Software: nginx /
Resource Hash: e2adf740376f608d5a3b6977b793a5e1c92c4de9e0a792921b8e24476e56c9ed

Request headers

:path: /wp-content/themes/mb-labs-theme-3.5.13/images/nav/call.svg
pragma: no-cache
cookie: OptanonConsent=isIABGlobal=false&datestamp=Fri+Aug+27+2021+16%3A52%3A07+GMT%2B0200+(Central+European+Summer+Time)&version=6.4.0&landingPath=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: blog.malwarebytes.com
referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:07 GMT
content-encoding: br
last-modified: Wed, 18 Aug 2021 21:09:52 GMT
server: nginx
etag: W/"611d7720-679"
vary: Accept-Encoding Accept-Encoding Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 partner-icon.svg
blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/images/icons/ 4 KB
2 KB 184ms
179ms Image
image/svg+xml 130.211.198.3
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/images/icons/partner-icon.svg
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 130.211.198.3 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 3.198.211.130.bc.googleusercontent.com
Software: nginx /
Resource Hash: f8869aa9427c07872b91f3bb5485a65a0e389302f54ad6fe1b684c59d97d154a

Request headers

:path: /wp-content/themes/mb-labs-theme-3.5.13/images/icons/partner-icon.svg
pragma: no-cache
cookie: OptanonConsent=isIABGlobal=false&datestamp=Fri+Aug+27+2021+16%3A52%3A07+GMT%2B0200+(Central+European+Summer+Time)&version=6.4.0&landingPath=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: blog.malwarebytes.com
referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:07 GMT
content-encoding: br
last-modified: Wed, 18 Aug 2021 21:09:52 GMT
server: nginx
etag: W/"611d7720-116b"
vary: Accept-Encoding Accept-Encoding Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 optimus-systems.webp
blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/images/partners/ 2 KB
2 KB 184ms
179ms Image
image/webp 130.211.198.3
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/images/partners/optimus-systems.webp
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 130.211.198.3 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 3.198.211.130.bc.googleusercontent.com
Software: nginx /
Resource Hash: 8528b83134ef333f8b4f3b722f422569b5121e6fa817c9942bcbb91f5f61ea93

Request headers

:path: /wp-content/themes/mb-labs-theme-3.5.13/images/partners/optimus-systems.webp
pragma: no-cache
cookie: OptanonConsent=isIABGlobal=false&datestamp=Fri+Aug+27+2021+16%3A52%3A07+GMT%2B0200+(Central+European+Summer+Time)&version=6.4.0&landingPath=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: blog.malwarebytes.com
referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:07 GMT
last-modified: Wed, 18 Aug 2021 21:09:52 GMT
server: nginx
etag: "611d7720-728"
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 1832

GET
H2 200 rsa2021.jpg
blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/images/ 27 KB
28 KB 185ms
180ms Image
image/jpeg 130.211.198.3
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/images/rsa2021.jpg
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 130.211.198.3 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 3.198.211.130.bc.googleusercontent.com
Software: nginx /
Resource Hash: 8a849c6ffa64946fefa17e874080dea467783d0e20857bbfbb23480739625648

Request headers

:path: /wp-content/themes/mb-labs-theme-3.5.13/images/rsa2021.jpg
pragma: no-cache
cookie: OptanonConsent=isIABGlobal=false&datestamp=Fri+Aug+27+2021+16%3A52%3A07+GMT%2B0200+(Central+European+Summer+Time)&version=6.4.0&landingPath=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: blog.malwarebytes.com
referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:07 GMT
last-modified: Wed, 18 Aug 2021 21:09:52 GMT
server: nginx
etag: "611d7720-6d66"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 28006

GET
H2 200 watch-personal-icon.svg
blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/images/icons/ 1 KB
830 B 185ms
180ms Image
image/svg+xml 130.211.198.3
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/images/icons/watch-personal-icon.svg
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 130.211.198.3 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 3.198.211.130.bc.googleusercontent.com
Software: nginx /
Resource Hash: fa07bfad3039513f81cc0551de10a79c7c823bce84a5fbfba5a547f96479a367

Request headers

:path: /wp-content/themes/mb-labs-theme-3.5.13/images/icons/watch-personal-icon.svg
pragma: no-cache
cookie: OptanonConsent=isIABGlobal=false&datestamp=Fri+Aug+27+2021+16%3A52%3A07+GMT%2B0200+(Central+European+Summer+Time)&version=6.4.0&landingPath=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: blog.malwarebytes.com
referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:07 GMT
content-encoding: br
last-modified: Wed, 18 Aug 2021 21:09:52 GMT
server: nginx
etag: W/"611d7720-4f9"
vary: Accept-Encoding Accept-Encoding Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 watch-business-icon.svg
blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/images/icons/ 1 KB
824 B 185ms
180ms Image
image/svg+xml 130.211.198.3
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/images/icons/watch-business-icon.svg
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 130.211.198.3 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 3.198.211.130.bc.googleusercontent.com
Software: nginx /
Resource Hash: 361aabb783830d45d3de5f19c4fe47d295e11518fb0279dd99d589eea8d43319

Request headers

:path: /wp-content/themes/mb-labs-theme-3.5.13/images/icons/watch-business-icon.svg
pragma: no-cache
cookie: OptanonConsent=isIABGlobal=false&datestamp=Fri+Aug+27+2021+16%3A52%3A07+GMT%2B0200+(Central+European+Summer+Time)&version=6.4.0&landingPath=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: blog.malwarebytes.com
referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:07 GMT
content-encoding: br
last-modified: Wed, 18 Aug 2021 21:09:52 GMT
server: nginx
etag: W/"611d7720-504"
vary: Accept-Encoding Accept-Encoding Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 privacy.svg
blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/images/ 4 KB
2 KB 185ms
180ms Image
image/svg+xml 130.211.198.3
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/images/privacy.svg
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 130.211.198.3 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 3.198.211.130.bc.googleusercontent.com
Software: nginx /
Resource Hash: 0d8ac30d9520ce94e0246020e4bff9b6fea04f92ac0b5f09c7346104b9f5772a

Request headers

:path: /wp-content/themes/mb-labs-theme-3.5.13/images/privacy.svg
pragma: no-cache
cookie: OptanonConsent=isIABGlobal=false&datestamp=Fri+Aug+27+2021+16%3A52%3A07+GMT%2B0200+(Central+European+Summer+Time)&version=6.4.0&landingPath=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: blog.malwarebytes.com
referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:07 GMT
content-encoding: br
last-modified: Wed, 18 Aug 2021 21:09:52 GMT
server: nginx
etag: W/"611d7720-10a3"
vary: Accept-Encoding Accept-Encoding Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 search.svg
blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/images/ 296 B
438 B 185ms
181ms Image
image/svg+xml 130.211.198.3
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/images/search.svg
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 130.211.198.3 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 3.198.211.130.bc.googleusercontent.com
Software: nginx /
Resource Hash: 8f796d398e512c5d19a2fecc943d19a204927ff3cf9ec2cb3f75a025535268cd

Request headers

:path: /wp-content/themes/mb-labs-theme-3.5.13/images/search.svg
pragma: no-cache
cookie: OptanonConsent=isIABGlobal=false&datestamp=Fri+Aug+27+2021+16%3A52%3A07+GMT%2B0200+(Central+European+Summer+Time)&version=6.4.0&landingPath=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: blog.malwarebytes.com
referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:07 GMT
content-encoding: br
last-modified: Wed, 18 Aug 2021 21:09:52 GMT
server: nginx
etag: W/"611d7720-128"
vary: Accept-Encoding Accept-Encoding Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 photodune-2058636-network-xl-900x506.jpg
blog.malwarebytes.com/wp-content/uploads/2017/03/ 87 KB
87 KB 133ms
128ms Image
image/jpeg 130.211.198.3
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.malwarebytes.com/wp-content/uploads/2017/03/photodune-2058636-network-xl-900x506.jpg
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 130.211.198.3 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 3.198.211.130.bc.googleusercontent.com
Software: nginx /
Resource Hash: 042f0a89d25fe49da053ba6d34ae43e5e25bb3cb0a698b5bce6da6d0ae3f68b0

Request headers

:path: /wp-content/uploads/2017/03/photodune-2058636-network-xl-900x506.jpg
pragma: no-cache
cookie: OptanonConsent=isIABGlobal=false&datestamp=Fri+Aug+27+2021+16%3A52%3A07+GMT%2B0200+(Central+European+Summer+Time)&version=6.4.0&landingPath=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: blog.malwarebytes.com
referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:07 GMT
last-modified: Mon, 06 Mar 2017 21:02:46 GMT
server: nginx
etag: "58bdce76-15b32"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 88882

GET
H2 200 wp-emoji-release.min.js Show response
blog.malwarebytes.com/wp-includes/js/ 18 KB
5 KB 182ms
178ms Script
application/javascript 130.211.198.3
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.malwarebytes.com/wp-includes/js/wp-emoji-release.min.js?ver=5.8
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 130.211.198.3 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 3.198.211.130.bc.googleusercontent.com
Software: nginx /
Resource Hash: def5de6254be138b8b35d680d1fdd8b07827d03b8626daebfeeb4157ec330ea7

Request headers

:path: /wp-includes/js/wp-emoji-release.min.js?ver=5.8
pragma: no-cache
cookie: OptanonConsent=isIABGlobal=false&datestamp=Fri+Aug+27+2021+16%3A52%3A07+GMT%2B0200+(Central+European+Summer+Time)&version=6.4.0&landingPath=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: blog.malwarebytes.com
referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:07 GMT
content-encoding: br
last-modified: Tue, 08 Jun 2021 22:15:12 GMT
server: nginx
etag: W/"60bfebf0-4705"
vary: Accept-Encoding Accept-Encoding Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 shutterstock_1015182034-604x270.jpg
blog.malwarebytes.com/wp-content/uploads/2019/05/ 46 KB
47 KB 182ms
178ms Image
image/jpeg 130.211.198.3
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.malwarebytes.com/wp-content/uploads/2019/05/shutterstock_1015182034-604x270.jpg
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 130.211.198.3 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 3.198.211.130.bc.googleusercontent.com
Software: nginx /
Resource Hash: 0e2d450425cfa5a67a9c9a1646a30a1f9a5c8faee86a127e5e30791b8882e3f1

Request headers

:path: /wp-content/uploads/2019/05/shutterstock_1015182034-604x270.jpg
pragma: no-cache
cookie: OptanonConsent=isIABGlobal=false&datestamp=Fri+Aug+27+2021+16%3A52%3A07+GMT%2B0200+(Central+European+Summer+Time)&version=6.4.0&landingPath=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: blog.malwarebytes.com
referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:07 GMT
last-modified: Tue, 16 Jul 2019 16:40:36 GMT
server: nginx
etag: "5d2dfe04-b9a0"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 47520

GET
H2 200 shutterstock_181197875-604x270.jpg
blog.malwarebytes.com/wp-content/uploads/2019/07/ 33 KB
34 KB 183ms
178ms Image
image/jpeg 130.211.198.3
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.malwarebytes.com/wp-content/uploads/2019/07/shutterstock_181197875-604x270.jpg
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 130.211.198.3 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 3.198.211.130.bc.googleusercontent.com
Software: nginx /
Resource Hash: b0a7006565d1b9832eb952238ec8113f95403807517bcd995077e68df8915d87

Request headers

:path: /wp-content/uploads/2019/07/shutterstock_181197875-604x270.jpg
pragma: no-cache
cookie: OptanonConsent=isIABGlobal=false&datestamp=Fri+Aug+27+2021+16%3A52%3A07+GMT%2B0200+(Central+European+Summer+Time)&version=6.4.0&landingPath=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: blog.malwarebytes.com
referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:07 GMT
last-modified: Wed, 24 Jul 2019 01:11:21 GMT
server: nginx
etag: "5d37b039-85a9"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 34217

GET
H2 200 shutterstock_1154383498-604x270.jpg
blog.malwarebytes.com/wp-content/uploads/2019/09/ 26 KB
27 KB 183ms
179ms Image
image/jpeg 130.211.198.3
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.malwarebytes.com/wp-content/uploads/2019/09/shutterstock_1154383498-604x270.jpg
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 130.211.198.3 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 3.198.211.130.bc.googleusercontent.com
Software: nginx /
Resource Hash: ab0303f8e9a5dd71a5f2cad73a836604f723c441b5cba246920d06615c0ac4b6

Request headers

:path: /wp-content/uploads/2019/09/shutterstock_1154383498-604x270.jpg
pragma: no-cache
cookie: OptanonConsent=isIABGlobal=false&datestamp=Fri+Aug+27+2021+16%3A52%3A07+GMT%2B0200+(Central+European+Summer+Time)&version=6.4.0&landingPath=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: blog.malwarebytes.com
referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:07 GMT
last-modified: Mon, 16 Sep 2019 16:45:32 GMT
server: nginx
etag: "5d7fbc2c-69bd"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 27069

GET
H2 200 shutterstock_206726899-1-604x270.jpg
blog.malwarebytes.com/wp-content/uploads/2019/09/ 18 KB
18 KB 183ms
179ms Image
image/jpeg 130.211.198.3
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.malwarebytes.com/wp-content/uploads/2019/09/shutterstock_206726899-1-604x270.jpg
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 130.211.198.3 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 3.198.211.130.bc.googleusercontent.com
Software: nginx /
Resource Hash: 3dff338c7baa6bd83b65f12941ae8cb7f65affd351b9e285f6cc74e0b3ed0d13

Request headers

:path: /wp-content/uploads/2019/09/shutterstock_206726899-1-604x270.jpg
pragma: no-cache
cookie: OptanonConsent=isIABGlobal=false&datestamp=Fri+Aug+27+2021+16%3A52%3A07+GMT%2B0200+(Central+European+Summer+Time)&version=6.4.0&landingPath=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: blog.malwarebytes.com
referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:07 GMT
last-modified: Mon, 23 Sep 2019 18:14:40 GMT
server: nginx
etag: "5d890b90-4701"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 18177

GET
H2 200 shutterstock_605996666-604x270.png
blog.malwarebytes.com/wp-content/uploads/2019/10/ 313 KB
313 KB 183ms
179ms Image
image/png 130.211.198.3
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.malwarebytes.com/wp-content/uploads/2019/10/shutterstock_605996666-604x270.png
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 130.211.198.3 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 3.198.211.130.bc.googleusercontent.com
Software: nginx /
Resource Hash: c2b0506fadb13182e425d4968e3555f1ebb3b490440929aa9ea0b17d588af14d

Request headers

:path: /wp-content/uploads/2019/10/shutterstock_605996666-604x270.png
pragma: no-cache
cookie: OptanonConsent=isIABGlobal=false&datestamp=Fri+Aug+27+2021+16%3A52%3A07+GMT%2B0200+(Central+European+Summer+Time)&version=6.4.0&landingPath=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: blog.malwarebytes.com
referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:07 GMT
last-modified: Tue, 01 Oct 2019 16:14:58 GMT
server: nginx
etag: "5d937b82-4e35b"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 320347

GET
H2 200 labs-nav.js Show response
blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/js/ 493 B
413 B 120ms
113ms Script
application/javascript 130.211.198.3
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/js/labs-nav.js
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 130.211.198.3 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 3.198.211.130.bc.googleusercontent.com
Software: nginx /
Resource Hash: 19333622f176d68bc17e307d8df96b15447864fbb0bbaac495e507fa64d96077

Request headers

:path: /wp-content/themes/mb-labs-theme-3.5.13/js/labs-nav.js
pragma: no-cache
cookie: OptanonConsent=isIABGlobal=false&datestamp=Fri+Aug+27+2021+16%3A52%3A07+GMT%2B0200+(Central+European+Summer+Time)&version=6.4.0&landingPath=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: blog.malwarebytes.com
referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:07 GMT
content-encoding: br
last-modified: Wed, 18 Aug 2021 21:09:52 GMT
server: nginx
etag: W/"611d7720-1ed"
vary: Accept-Encoding Accept-Encoding Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 contributors.svg
blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/images/footer/ 910 B
743 B 184ms
180ms Image
image/svg+xml 130.211.198.3
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/images/footer/contributors.svg
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 130.211.198.3 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 3.198.211.130.bc.googleusercontent.com
Software: nginx /
Resource Hash: 6429fe0ed81fca5f6bb18cb0a0aacae3bd9de79192635aeed4cbda438139d75d

Request headers

:path: /wp-content/themes/mb-labs-theme-3.5.13/images/footer/contributors.svg
pragma: no-cache
cookie: OptanonConsent=isIABGlobal=false&datestamp=Fri+Aug+27+2021+16%3A52%3A07+GMT%2B0200+(Central+European+Summer+Time)&version=6.4.0&landingPath=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: blog.malwarebytes.com
referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:07 GMT
content-encoding: br
last-modified: Wed, 18 Aug 2021 21:09:52 GMT
server: nginx
etag: W/"611d7720-38e"
vary: Accept-Encoding Accept-Encoding Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 threat-center.svg
blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/images/footer/ 2 KB
852 B 184ms
180ms Image
image/svg+xml 130.211.198.3
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/images/footer/threat-center.svg
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 130.211.198.3 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 3.198.211.130.bc.googleusercontent.com
Software: nginx /
Resource Hash: 32d4b293bb7f25a21cc44e81184d4bbcb3bdd1837e026b98ed0ad85b3b1a5292

Request headers

:path: /wp-content/themes/mb-labs-theme-3.5.13/images/footer/threat-center.svg
pragma: no-cache
cookie: OptanonConsent=isIABGlobal=false&datestamp=Fri+Aug+27+2021+16%3A52%3A07+GMT%2B0200+(Central+European+Summer+Time)&version=6.4.0&landingPath=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: blog.malwarebytes.com
referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:07 GMT
content-encoding: br
last-modified: Wed, 18 Aug 2021 21:09:52 GMT
server: nginx
etag: W/"611d7720-812"
vary: Accept-Encoding Accept-Encoding Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 glossary.svg
blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/images/footer/ 760 B
654 B 184ms
181ms Image
image/svg+xml 130.211.198.3
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/images/footer/glossary.svg
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 130.211.198.3 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 3.198.211.130.bc.googleusercontent.com
Software: nginx /
Resource Hash: b4e6efb587f3fdfb8155148201d0c51ac95d249a6727e8256acdfe624ade69af

Request headers

:path: /wp-content/themes/mb-labs-theme-3.5.13/images/footer/glossary.svg
pragma: no-cache
cookie: OptanonConsent=isIABGlobal=false&datestamp=Fri+Aug+27+2021+16%3A52%3A07+GMT%2B0200+(Central+European+Summer+Time)&version=6.4.0&landingPath=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: blog.malwarebytes.com
referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:07 GMT
content-encoding: br
last-modified: Wed, 18 Aug 2021 21:09:52 GMT
server: nginx
etag: W/"611d7720-2f8"
vary: Accept-Encoding Accept-Encoding Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 scams.svg
blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/images/footer/ 842 B
698 B 184ms
181ms Image
image/svg+xml 130.211.198.3
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/images/footer/scams.svg
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 130.211.198.3 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 3.198.211.130.bc.googleusercontent.com
Software: nginx /
Resource Hash: 05a173cb58022e81eb499529ac56df6ad7bafe1c61b8128dca8b76f300b5b60e

Request headers

:path: /wp-content/themes/mb-labs-theme-3.5.13/images/footer/scams.svg
pragma: no-cache
cookie: OptanonConsent=isIABGlobal=false&datestamp=Fri+Aug+27+2021+16%3A52%3A07+GMT%2B0200+(Central+European+Summer+Time)&version=6.4.0&landingPath=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: blog.malwarebytes.com
referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:07 GMT
content-encoding: br
last-modified: Wed, 18 Aug 2021 21:09:52 GMT
server: nginx
etag: W/"611d7720-34a"
vary: Accept-Encoding Accept-Encoding Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 write.svg
blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/images/footer/ 615 B
585 B 184ms
181ms Image
image/svg+xml 130.211.198.3
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/images/footer/write.svg
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 130.211.198.3 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 3.198.211.130.bc.googleusercontent.com
Software: nginx /
Resource Hash: a6a97c4046257c7e4e063c9f76434c7ce2c1f105e46b07424fabfc054f2d4d24

Request headers

:path: /wp-content/themes/mb-labs-theme-3.5.13/images/footer/write.svg
pragma: no-cache
cookie: OptanonConsent=isIABGlobal=false&datestamp=Fri+Aug+27+2021+16%3A52%3A07+GMT%2B0200+(Central+European+Summer+Time)&version=6.4.0&landingPath=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: blog.malwarebytes.com
referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:07 GMT
content-encoding: br
last-modified: Wed, 18 Aug 2021 21:09:52 GMT
server: nginx
etag: W/"611d7720-267"
vary: Accept-Encoding Accept-Encoding Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 ic-pin-map.svg
blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/images/footer/ 1 KB
821 B 184ms
181ms Image
image/svg+xml 130.211.198.3
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/images/footer/ic-pin-map.svg
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 130.211.198.3 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 3.198.211.130.bc.googleusercontent.com
Software: nginx /
Resource Hash: 928759d761adf61723feb7a9affc2b058cc9d5044831da66fcadd823e265ab1c

Request headers

:path: /wp-content/themes/mb-labs-theme-3.5.13/images/footer/ic-pin-map.svg
pragma: no-cache
cookie: OptanonConsent=isIABGlobal=false&datestamp=Fri+Aug+27+2021+16%3A52%3A07+GMT%2B0200+(Central+European+Summer+Time)&version=6.4.0&landingPath=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: blog.malwarebytes.com
referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:07 GMT
content-encoding: br
last-modified: Wed, 18 Aug 2021 21:09:52 GMT
server: nginx
etag: W/"611d7720-45a"
vary: Accept-Encoding Accept-Encoding Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 world.svg
blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/images/footer/ 4 KB
2 KB 184ms
181ms Image
image/svg+xml 130.211.198.3
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/images/footer/world.svg
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 130.211.198.3 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 3.198.211.130.bc.googleusercontent.com
Software: nginx /
Resource Hash: 05369fa3ab175c5ba5e63b7c60a872a64f82ddcb1de6a950d73004ed25930e69

Request headers

:path: /wp-content/themes/mb-labs-theme-3.5.13/images/footer/world.svg
pragma: no-cache
cookie: OptanonConsent=isIABGlobal=false&datestamp=Fri+Aug+27+2021+16%3A52%3A07+GMT%2B0200+(Central+European+Summer+Time)&version=6.4.0&landingPath=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: blog.malwarebytes.com
referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:07 GMT
content-encoding: br
last-modified: Wed, 18 Aug 2021 21:09:52 GMT
server: nginx
etag: W/"611d7720-1019"
vary: Accept-Encoding Accept-Encoding Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 jetpack-carousel.css
blog.malwarebytes.com/wp-content/plugins/jetpack/modules/carousel/ 26 KB
5 KB 121ms
115ms Stylesheet
text/css 130.211.198.3
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.malwarebytes.com/wp-content/plugins/jetpack/modules/carousel/jetpack-carousel.css?ver=9.5.3
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 130.211.198.3 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 3.198.211.130.bc.googleusercontent.com
Software: nginx /
Resource Hash: ff37be8081d97cd5da09dea014d573e75a3b34365476f1cc459cdb0dfadab3ec

Request headers

:path: /wp-content/plugins/jetpack/modules/carousel/jetpack-carousel.css?ver=9.5.3
pragma: no-cache
cookie: OptanonConsent=isIABGlobal=false&datestamp=Fri+Aug+27+2021+16%3A52%3A07+GMT%2B0200+(Central+European+Summer+Time)&version=6.4.0&landingPath=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: blog.malwarebytes.com
referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:07 GMT
content-encoding: br
last-modified: Thu, 03 Jun 2021 18:16:10 GMT
server: nginx
etag: W/"60b91c6a-6859"
vary: Accept-Encoding Accept-Encoding Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 comment_count.js Show response
blog.malwarebytes.com/wp-content/plugins/disqus-comment-system/public/js/ 889 B
620 B 122ms
116ms Script
application/javascript 130.211.198.3
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.malwarebytes.com/wp-content/plugins/disqus-comment-system/public/js/comment_count.js?ver=3.0.21
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 130.211.198.3 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 3.198.211.130.bc.googleusercontent.com
Software: nginx /
Resource Hash: cea0a05c5af6e21a409875328ed2e3dba79131b7c41f8ea07d0e0e02c7b7b59e

Request headers

:path: /wp-content/plugins/disqus-comment-system/public/js/comment_count.js?ver=3.0.21
pragma: no-cache
cookie: OptanonConsent=isIABGlobal=false&datestamp=Fri+Aug+27+2021+16%3A52%3A07+GMT%2B0200+(Central+European+Summer+Time)&version=6.4.0&landingPath=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: blog.malwarebytes.com
referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:07 GMT
content-encoding: br
last-modified: Tue, 23 Feb 2021 22:11:47 GMT
server: nginx
etag: W/"60357da3-379"
vary: Accept-Encoding Accept-Encoding Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 comment_embed.js Show response
blog.malwarebytes.com/wp-content/plugins/disqus-comment-system/public/js/ 1 KB
686 B 127ms
120ms Script
application/javascript 130.211.198.3
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.malwarebytes.com/wp-content/plugins/disqus-comment-system/public/js/comment_embed.js?ver=3.0.21
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 130.211.198.3 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 3.198.211.130.bc.googleusercontent.com
Software: nginx /
Resource Hash: f055e217bde76d711bd8b42af773f9f99b8a29d81ad9ed10b6379cc7e6c60452

Request headers

:path: /wp-content/plugins/disqus-comment-system/public/js/comment_embed.js?ver=3.0.21
pragma: no-cache
cookie: OptanonConsent=isIABGlobal=false&datestamp=Fri+Aug+27+2021+16%3A52%3A07+GMT%2B0200+(Central+European+Summer+Time)&version=6.4.0&landingPath=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: blog.malwarebytes.com
referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:07 GMT
content-encoding: br
last-modified: Tue, 23 Feb 2021 22:11:47 GMT
server: nginx
etag: W/"60357da3-47e"
vary: Accept-Encoding Accept-Encoding Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 functions.js Show response
blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/js/ 2 KB
1 KB 121ms
115ms Script
application/javascript 130.211.198.3
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/js/functions.js?ver=2013-07-18
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 130.211.198.3 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 3.198.211.130.bc.googleusercontent.com
Software: nginx /
Resource Hash: 9fcb181721162ce0d395b7b9b1e5bb5ca82c5f79bde749d4d0467ec2e65fcb4a

Request headers

:path: /wp-content/themes/mb-labs-theme-3.5.13/js/functions.js?ver=2013-07-18
pragma: no-cache
cookie: OptanonConsent=isIABGlobal=false&datestamp=Fri+Aug+27+2021+16%3A52%3A07+GMT%2B0200+(Central+European+Summer+Time)&version=6.4.0&landingPath=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: blog.malwarebytes.com
referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:07 GMT
content-encoding: br
last-modified: Wed, 18 Aug 2021 21:09:52 GMT
server: nginx
etag: W/"611d7720-8f9"
vary: Accept-Encoding Accept-Encoding Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 wp-embed.min.js Show response
blog.malwarebytes.com/wp-includes/js/ 1 KB
947 B 122ms
116ms Script
application/javascript 130.211.198.3
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.malwarebytes.com/wp-includes/js/wp-embed.min.js?ver=5.8
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 130.211.198.3 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 3.198.211.130.bc.googleusercontent.com
Software: nginx /
Resource Hash: 5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991

Request headers

:path: /wp-includes/js/wp-embed.min.js?ver=5.8
pragma: no-cache
cookie: OptanonConsent=isIABGlobal=false&datestamp=Fri+Aug+27+2021+16%3A52%3A07+GMT%2B0200+(Central+European+Summer+Time)&version=6.4.0&landingPath=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: blog.malwarebytes.com
referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:07 GMT
content-encoding: br
last-modified: Wed, 06 Jan 2021 15:29:24 GMT
server: nginx
etag: W/"5ff5d754-592"
vary: Accept-Encoding Accept-Encoding Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 jetpack-carousel.min.js Show response
blog.malwarebytes.com/wp-content/plugins/jetpack/_inc/build/carousel/ 28 KB
8 KB 125ms
119ms Script
application/javascript 130.211.198.3
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.malwarebytes.com/wp-content/plugins/jetpack/_inc/build/carousel/jetpack-carousel.min.js?ver=9.5.3
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 130.211.198.3 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 3.198.211.130.bc.googleusercontent.com
Software: nginx /
Resource Hash: 1b596dd656e3aa66a49c4cd29839bf3987beafe7e08f286b4334f7484fbd2c9e

Request headers

:path: /wp-content/plugins/jetpack/_inc/build/carousel/jetpack-carousel.min.js?ver=9.5.3
pragma: no-cache
cookie: OptanonConsent=isIABGlobal=false&datestamp=Fri+Aug+27+2021+16%3A52%3A07+GMT%2B0200+(Central+European+Summer+Time)&version=6.4.0&landingPath=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: blog.malwarebytes.com
referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:07 GMT
content-encoding: br
last-modified: Thu, 03 Jun 2021 18:16:10 GMT
server: nginx
etag: W/"60b91c6a-70f0"
vary: Accept-Encoding Accept-Encoding Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 standard-search-results-footer.js Show response
blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/js/ 2 KB
772 B 126ms
119ms Script
application/javascript 130.211.198.3
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/js/standard-search-results-footer.js
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 130.211.198.3 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 3.198.211.130.bc.googleusercontent.com
Software: nginx /
Resource Hash: 1532b16aa9cd1fef51c097aaf1abeac6cb6f239b026660e7105e49f4ae6549ff

Request headers

:path: /wp-content/themes/mb-labs-theme-3.5.13/js/standard-search-results-footer.js
pragma: no-cache
cookie: OptanonConsent=isIABGlobal=false&datestamp=Fri+Aug+27+2021+16%3A52%3A07+GMT%2B0200+(Central+European+Summer+Time)&version=6.4.0&landingPath=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: blog.malwarebytes.com
referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:07 GMT
content-encoding: br
last-modified: Wed, 18 Aug 2021 21:09:52 GMT
server: nginx
etag: W/"611d7720-704"
vary: Accept-Encoding Accept-Encoding Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H/1.1 200
OK optanon.css
optanon.blob.core.windows.net/skins/6.4.0/default_flat_bottom_two_button_white/v2/css/ 23 KB
6 KB 34ms
34ms Stylesheet
text/css 52.239.137.4
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://optanon.blob.core.windows.net/skins/6.4.0/default_flat_bottom_two_button_white/v2/css/optanon.css
Requested by: Host: optanon.blob.core.windows.net
URL: https://optanon.blob.core.windows.net/consent/9530a107-0af8-4204-a2c2-217efb78222b.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.239.137.4 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 8c20518cd7e51066b82e8a8a1e8035210741cf808c02268915747960f531061c

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
Date: Fri, 27 Aug 2021 14:52:06 GMT
Content-Encoding: gzip
Last-Modified: Thu, 13 Aug 2020 04:48:01 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Content-MD5: E062TbpGx6vwVsuuNM/jFw==
ETag: 0x8D83F440F482A65
Content-Type: text/css
Access-Control-Allow-Origin: *
x-ms-request-id: f78bf609-601e-016b-2553-9bc3e5000000
Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
Content-Length: 5561

GET
H2 200 EU Show response
geolocation.onetrust.com/cookieconsentpub/v1/geo/countries/ 32 B
111 B 24ms
21ms Script
text/javascript 2606:4700:10::6814:b944
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://geolocation.onetrust.com/cookieconsentpub/v1/geo/countries/EU?callback=jQuery111305556768471516136_1630075927502&_=1630075927503

Requested by

Host: www.malwarebytes.com
URL: https://www.malwarebytes.com/js/jquery-1.11.3.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6814:b944 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b0817a0d6a87f2d42532035e42b20ea55cfaa5ca1092c761f5fc5e734790bdbf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:07 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 68561f335ab1dfa5-FRA
content-length: 32

GET
H2 200 Locator-Light.woff
blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/css/fonts/ 29 KB
29 KB 118ms
117ms Font
font/woff 130.211.198.3
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/css/fonts/Locator-Light.woff
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/style.css?18-08-2021
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 130.211.198.3 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 3.198.211.130.bc.googleusercontent.com
Software: nginx /
Resource Hash: ed2491fc7526ff0b5cfec3fe6f4cf8153796520fc845b735286b0f42183da98a

Request headers

sec-fetch-mode: cors
origin: https://blog.malwarebytes.com
accept-encoding: gzip, deflate, br
accept-language: en-US
sec-fetch-dest: font
cookie: OptanonConsent=isIABGlobal=false&datestamp=Fri+Aug+27+2021+16%3A52%3A07+GMT%2B0200+(Central+European+Summer+Time)&version=6.4.0&landingPath=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F
:path: /wp-content/themes/mb-labs-theme-3.5.13/css/fonts/Locator-Light.woff
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: */*
cache-control: no-cache
:authority: blog.malwarebytes.com
referer: https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/style.css?18-08-2021
:scheme: https
sec-fetch-site: same-origin
:method: GET
Origin: https://blog.malwarebytes.com
Referer: https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/style.css?18-08-2021
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:07 GMT
last-modified: Wed, 18 Aug 2021 21:09:52 GMT
server: nginx
etag: "611d7720-7330"
vary: Accept-Encoding
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 29488

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 288 KB
84 KB 18ms
15ms Script
application/javascript 2a00:1450:4001:80e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-MKSKW3

Requested by

Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

6ae4a28c6942a6eb8b2f62bc2f80285602ad827cf03cd01c0a2df0b0546007cd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:07 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 85806
x-xss-protection: 0
last-modified: Fri, 27 Aug 2021 12:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 27 Aug 2021 14:52:07 GMT

GET
H2 200 box-link-rings-personal.svg
blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/images/backgrounds/ 1 KB
813 B 173ms
172ms Image
image/svg+xml 130.211.198.3
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/images/backgrounds/box-link-rings-personal.svg
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/style.css?18-08-2021
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 130.211.198.3 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 3.198.211.130.bc.googleusercontent.com
Software: nginx /
Resource Hash: 2409f262a4b65de1c6867ad7d607898380900587b69a60b881a9b888bd53e625

Request headers

:path: /wp-content/themes/mb-labs-theme-3.5.13/images/backgrounds/box-link-rings-personal.svg
pragma: no-cache
cookie: OptanonConsent=isIABGlobal=false&datestamp=Fri+Aug+27+2021+16%3A52%3A07+GMT%2B0200+(Central+European+Summer+Time)&version=6.4.0&landingPath=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: blog.malwarebytes.com
referer: https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/style.css?18-08-2021
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/style.css?18-08-2021
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:07 GMT
content-encoding: br
last-modified: Wed, 18 Aug 2021 21:09:52 GMT
server: nginx
etag: W/"611d7720-52c"
vary: Accept-Encoding Accept-Encoding Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 num-comments.svg
blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/images/ 1 KB
810 B 167ms
167ms Image
image/svg+xml 130.211.198.3
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/images/num-comments.svg
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/style.css?18-08-2021
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 130.211.198.3 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 3.198.211.130.bc.googleusercontent.com
Software: nginx /
Resource Hash: da1c1ad273854673c3a3f7e8f76aae5d7c9c73f3ebd224c2be1f93106680b1d4

Request headers

:path: /wp-content/themes/mb-labs-theme-3.5.13/images/num-comments.svg
pragma: no-cache
cookie: OptanonConsent=isIABGlobal=false&datestamp=Fri+Aug+27+2021+16%3A52%3A07+GMT%2B0200+(Central+European+Summer+Time)&version=6.4.0&landingPath=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: blog.malwarebytes.com
referer: https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/style.css?18-08-2021
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/style.css?18-08-2021
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:07 GMT
content-encoding: br
last-modified: Wed, 18 Aug 2021 21:09:52 GMT
server: nginx
etag: W/"611d7720-4d3"
vary: Accept-Encoding Accept-Encoding Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 Graphik-Light.otf
blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/css/fonts/ 132 KB
132 KB 166ms
164ms Font
application/octet-stream 130.211.198.3
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/css/fonts/Graphik-Light.otf
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/style.css?18-08-2021
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 130.211.198.3 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 3.198.211.130.bc.googleusercontent.com
Software: nginx /
Resource Hash: 30b410ec60b2dda5e521206ed5b3a9318922f62828db7409240f047f21593bcc

Request headers

sec-fetch-mode: cors
origin: https://blog.malwarebytes.com
accept-encoding: gzip, deflate, br
accept-language: en-US
sec-fetch-dest: font
cookie: OptanonConsent=isIABGlobal=false&datestamp=Fri+Aug+27+2021+16%3A52%3A07+GMT%2B0200+(Central+European+Summer+Time)&version=6.4.0&landingPath=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F
:path: /wp-content/themes/mb-labs-theme-3.5.13/css/fonts/Graphik-Light.otf
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: */*
cache-control: no-cache
:authority: blog.malwarebytes.com
referer: https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/style.css?18-08-2021
:scheme: https
sec-fetch-site: same-origin
:method: GET
Origin: https://blog.malwarebytes.com
Referer: https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/style.css?18-08-2021
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:07 GMT
last-modified: Wed, 18 Aug 2021 21:09:52 GMT
server: nginx
etag: "611d7720-20e60"
vary: Accept-Encoding
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 134752

GET
H2 200 Graphik-Medium.otf
blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/css/fonts/ 134 KB
135 KB 166ms
164ms Font
application/octet-stream 130.211.198.3
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/css/fonts/Graphik-Medium.otf
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/style.css?18-08-2021
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 130.211.198.3 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 3.198.211.130.bc.googleusercontent.com
Software: nginx /
Resource Hash: a7d4e6165ce4042167fcaaa0623eab885d6992458eb05c4fc74184cee79a9eb3

Request headers

sec-fetch-mode: cors
origin: https://blog.malwarebytes.com
accept-encoding: gzip, deflate, br
accept-language: en-US
sec-fetch-dest: font
cookie: OptanonConsent=isIABGlobal=false&datestamp=Fri+Aug+27+2021+16%3A52%3A07+GMT%2B0200+(Central+European+Summer+Time)&version=6.4.0&landingPath=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F
:path: /wp-content/themes/mb-labs-theme-3.5.13/css/fonts/Graphik-Medium.otf
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: */*
cache-control: no-cache
:authority: blog.malwarebytes.com
referer: https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/style.css?18-08-2021
:scheme: https
sec-fetch-site: same-origin
:method: GET
Origin: https://blog.malwarebytes.com
Referer: https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/style.css?18-08-2021
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:07 GMT
last-modified: Wed, 18 Aug 2021 21:09:52 GMT
server: nginx
etag: "611d7720-219c0"
vary: Accept-Encoding
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 137664

GET
H2 200 Graphik-Regular.otf
blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/css/fonts/ 128 KB
128 KB 166ms
164ms Font
application/octet-stream 130.211.198.3
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/css/fonts/Graphik-Regular.otf
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/style.css?18-08-2021
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 130.211.198.3 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 3.198.211.130.bc.googleusercontent.com
Software: nginx /
Resource Hash: f575112df5398271c1f04b48a995ccc6e17d69730e37304078178d46781152da

Request headers

sec-fetch-mode: cors
origin: https://blog.malwarebytes.com
accept-encoding: gzip, deflate, br
accept-language: en-US
sec-fetch-dest: font
cookie: OptanonConsent=isIABGlobal=false&datestamp=Fri+Aug+27+2021+16%3A52%3A07+GMT%2B0200+(Central+European+Summer+Time)&version=6.4.0&landingPath=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F
:path: /wp-content/themes/mb-labs-theme-3.5.13/css/fonts/Graphik-Regular.otf
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: */*
cache-control: no-cache
:authority: blog.malwarebytes.com
referer: https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/style.css?18-08-2021
:scheme: https
sec-fetch-site: same-origin
:method: GET
Origin: https://blog.malwarebytes.com
Referer: https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/style.css?18-08-2021
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:07 GMT
last-modified: Wed, 18 Aug 2021 21:09:52 GMT
server: nginx
etag: "611d7720-20084"
vary: Accept-Encoding
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 131204

GET
H2 200 Locator-Medium.woff
blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/css/fonts/ 29 KB
29 KB 166ms
164ms Font
font/woff 130.211.198.3
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/css/fonts/Locator-Medium.woff
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/style.css?18-08-2021
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 130.211.198.3 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 3.198.211.130.bc.googleusercontent.com
Software: nginx /
Resource Hash: a52bbdb7b132e850fdaf5740012fcc0bc3f6ef0be520bc4b987d8761d40d015a

Request headers

sec-fetch-mode: cors
origin: https://blog.malwarebytes.com
accept-encoding: gzip, deflate, br
accept-language: en-US
sec-fetch-dest: font
cookie: OptanonConsent=isIABGlobal=false&datestamp=Fri+Aug+27+2021+16%3A52%3A07+GMT%2B0200+(Central+European+Summer+Time)&version=6.4.0&landingPath=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F
:path: /wp-content/themes/mb-labs-theme-3.5.13/css/fonts/Locator-Medium.woff
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: */*
cache-control: no-cache
:authority: blog.malwarebytes.com
referer: https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/style.css?18-08-2021
:scheme: https
sec-fetch-site: same-origin
:method: GET
Origin: https://blog.malwarebytes.com
Referer: https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/style.css?18-08-2021
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:07 GMT
last-modified: Wed, 18 Aug 2021 21:09:52 GMT
server: nginx
etag: "611d7720-734c"
vary: Accept-Encoding
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 29516

GET
H2 200 socicon.woff
blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/css/fonts/ 20 KB
20 KB 167ms
165ms Font
font/woff 130.211.198.3
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/css/fonts/socicon.woff
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/style.css?18-08-2021
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 130.211.198.3 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 3.198.211.130.bc.googleusercontent.com
Software: nginx /
Resource Hash: 0ed37960a59a6ec6b443f9ef043864d09a51db6fd276ae578d9166467bf986d1

Request headers

sec-fetch-mode: cors
origin: https://blog.malwarebytes.com
accept-encoding: gzip, deflate, br
accept-language: en-US
sec-fetch-dest: font
cookie: OptanonConsent=isIABGlobal=false&datestamp=Fri+Aug+27+2021+16%3A52%3A07+GMT%2B0200+(Central+European+Summer+Time)&version=6.4.0&landingPath=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F
:path: /wp-content/themes/mb-labs-theme-3.5.13/css/fonts/socicon.woff
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: */*
cache-control: no-cache
:authority: blog.malwarebytes.com
referer: https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/style.css?18-08-2021
:scheme: https
sec-fetch-site: same-origin
:method: GET
Origin: https://blog.malwarebytes.com
Referer: https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/style.css?18-08-2021
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:07 GMT
last-modified: Wed, 18 Aug 2021 21:09:52 GMT
server: nginx
etag: "611d7720-4ff8"
vary: Accept-Encoding
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 20472

GET
H2 200 Locator-LightItalic.woff
blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/css/fonts/ 30 KB
30 KB 166ms
164ms Font
font/woff 130.211.198.3
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/css/fonts/Locator-LightItalic.woff
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/style.css?18-08-2021
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 130.211.198.3 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 3.198.211.130.bc.googleusercontent.com
Software: nginx /
Resource Hash: ad2cc26b0fdde8f4eb637ed12b25364e85af0bfba227dad42cb997ff4ad23eeb

Request headers

sec-fetch-mode: cors
origin: https://blog.malwarebytes.com
accept-encoding: gzip, deflate, br
accept-language: en-US
sec-fetch-dest: font
cookie: OptanonConsent=isIABGlobal=false&datestamp=Fri+Aug+27+2021+16%3A52%3A07+GMT%2B0200+(Central+European+Summer+Time)&version=6.4.0&landingPath=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F
:path: /wp-content/themes/mb-labs-theme-3.5.13/css/fonts/Locator-LightItalic.woff
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: */*
cache-control: no-cache
:authority: blog.malwarebytes.com
referer: https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/style.css?18-08-2021
:scheme: https
sec-fetch-site: same-origin
:method: GET
Origin: https://blog.malwarebytes.com
Referer: https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/style.css?18-08-2021
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:07 GMT
last-modified: Wed, 18 Aug 2021 21:09:52 GMT
server: nginx
etag: "611d7720-7888"
vary: Accept-Encoding
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 30856

GET
H2 200 k-1.jpg
blog.malwarebytes.com/wp-content/uploads/2021/08/ 151 KB
151 KB 138ms
135ms Image
image/jpeg 130.211.198.3
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.malwarebytes.com/wp-content/uploads/2021/08/k-1.jpg
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 130.211.198.3 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 3.198.211.130.bc.googleusercontent.com
Software: nginx /
Resource Hash: ae68db317018c88fabc345e03b11cbd556a8ca6134896a56bece99f6801f819b

Request headers

:path: /wp-content/uploads/2021/08/k-1.jpg
pragma: no-cache
cookie: OptanonConsent=isIABGlobal=false&datestamp=Fri+Aug+27+2021+16%3A52%3A07+GMT%2B0200+(Central+European+Summer+Time)&version=6.4.0&landingPath=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: blog.malwarebytes.com
referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:07 GMT
last-modified: Thu, 19 Aug 2021 15:07:45 GMT
server: nginx
etag: "611e73c1-25a8f"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 154255

GET
H2 200 lures.jpg
blog.malwarebytes.com/wp-content/uploads/2021/08/ 775 KB
776 KB 138ms
135ms Image
image/jpeg 130.211.198.3
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.malwarebytes.com/wp-content/uploads/2021/08/lures.jpg
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 130.211.198.3 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 3.198.211.130.bc.googleusercontent.com
Software: nginx /
Resource Hash: da6424700547aae41ebbcd325d419b8c80e92a2123c6de5302892b8bdd66439c

Request headers

:path: /wp-content/uploads/2021/08/lures.jpg
pragma: no-cache
cookie: OptanonConsent=isIABGlobal=false&datestamp=Fri+Aug+27+2021+16%3A52%3A07+GMT%2B0200+(Central+European+Summer+Time)&version=6.4.0&landingPath=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: blog.malwarebytes.com
referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:07 GMT
last-modified: Thu, 19 Aug 2021 15:12:51 GMT
server: nginx
etag: "611e74f3-c1d30"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 793904

GET
H2 200 macro-2048x721.jpg
blog.malwarebytes.com/wp-content/uploads/2021/08/ 196 KB
196 KB 138ms
136ms Image
image/jpeg 130.211.198.3
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.malwarebytes.com/wp-content/uploads/2021/08/macro-2048x721.jpg
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 130.211.198.3 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 3.198.211.130.bc.googleusercontent.com
Software: nginx /
Resource Hash: f3c2074e3b28f9092bb4f09dfb92d5f9c75f149f706db29cb075740330352166

Request headers

:path: /wp-content/uploads/2021/08/macro-2048x721.jpg
pragma: no-cache
cookie: OptanonConsent=isIABGlobal=false&datestamp=Fri+Aug+27+2021+16%3A52%3A07+GMT%2B0200+(Central+European+Summer+Time)&version=6.4.0&landingPath=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: blog.malwarebytes.com
referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:07 GMT
last-modified: Thu, 19 Aug 2021 15:14:02 GMT
server: nginx
etag: "611e753a-30f6d"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 200557

GET
H2 200 yjs-2048x735.jpg
blog.malwarebytes.com/wp-content/uploads/2021/08/ 308 KB
308 KB 137ms
135ms Image
image/jpeg 130.211.198.3
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.malwarebytes.com/wp-content/uploads/2021/08/yjs-2048x735.jpg
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 130.211.198.3 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 3.198.211.130.bc.googleusercontent.com
Software: nginx /
Resource Hash: a039155a82ca2634b4da1153b34ddbebc3eb4d2f6299ba653b8ee20afdba8d2b

Request headers

:path: /wp-content/uploads/2021/08/yjs-2048x735.jpg
pragma: no-cache
cookie: OptanonConsent=isIABGlobal=false&datestamp=Fri+Aug+27+2021+16%3A52%3A07+GMT%2B0200+(Central+European+Summer+Time)&version=6.4.0&landingPath=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: blog.malwarebytes.com
referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:07 GMT
last-modified: Thu, 19 Aug 2021 15:14:32 GMT
server: nginx
etag: "611e7558-4cf01"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 315137

GET
H2 200 psfile.jpg
blog.malwarebytes.com/wp-content/uploads/2021/08/ 196 KB
197 KB 138ms
136ms Image
image/jpeg 130.211.198.3
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.malwarebytes.com/wp-content/uploads/2021/08/psfile.jpg
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 130.211.198.3 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 3.198.211.130.bc.googleusercontent.com
Software: nginx /
Resource Hash: 1dfc63631707194ac22fc6800b4f2ff8701081fefcf4016fbf113d38298b1afe

Request headers

:path: /wp-content/uploads/2021/08/psfile.jpg
pragma: no-cache
cookie: OptanonConsent=isIABGlobal=false&datestamp=Fri+Aug+27+2021+16%3A52%3A07+GMT%2B0200+(Central+European+Summer+Time)&version=6.4.0&landingPath=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: blog.malwarebytes.com
referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:07 GMT
last-modified: Thu, 19 Aug 2021 15:15:13 GMT
server: nginx
etag: "611e7581-31070"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 200816

GET
H2 200 yy.js_.jpg
blog.malwarebytes.com/wp-content/uploads/2021/08/ 95 KB
95 KB 138ms
136ms Image
image/jpeg 130.211.198.3
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.malwarebytes.com/wp-content/uploads/2021/08/yy.js_.jpg
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 130.211.198.3 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 3.198.211.130.bc.googleusercontent.com
Software: nginx /
Resource Hash: 9008a9948be12471db87fb0d0c45a464b7003854213cd598c30eae831ada7865

Request headers

:path: /wp-content/uploads/2021/08/yy.js_.jpg
pragma: no-cache
cookie: OptanonConsent=isIABGlobal=false&datestamp=Fri+Aug+27+2021+16%3A52%3A07+GMT%2B0200+(Central+European+Summer+Time)&version=6.4.0&landingPath=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: blog.malwarebytes.com
referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:07 GMT
last-modified: Thu, 19 Aug 2021 15:16:27 GMT
server: nginx
etag: "611e75cb-17bc9"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 97225

GET
H2 200 check.jpg
blog.malwarebytes.com/wp-content/uploads/2021/08/ 70 KB
70 KB 138ms
136ms Image
image/jpeg 130.211.198.3
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.malwarebytes.com/wp-content/uploads/2021/08/check.jpg
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 130.211.198.3 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 3.198.211.130.bc.googleusercontent.com
Software: nginx /
Resource Hash: 075a5ea1844fded548a58ea96d4efa71bbd41131a0c9d1fbd4d3098f2f78e004

Request headers

:path: /wp-content/uploads/2021/08/check.jpg
pragma: no-cache
cookie: OptanonConsent=isIABGlobal=false&datestamp=Fri+Aug+27+2021+16%3A52%3A07+GMT%2B0200+(Central+European+Summer+Time)&version=6.4.0&landingPath=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: blog.malwarebytes.com
referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:07 GMT
last-modified: Thu, 19 Aug 2021 15:17:05 GMT
server: nginx
etag: "611e75f1-1176e"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 71534

GET
H2 200 install-600x275.jpg
blog.malwarebytes.com/wp-content/uploads/2021/08/ 24 KB
24 KB 137ms
136ms Image
image/jpeg 130.211.198.3
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.malwarebytes.com/wp-content/uploads/2021/08/install-600x275.jpg
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 130.211.198.3 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 3.198.211.130.bc.googleusercontent.com
Software: nginx /
Resource Hash: e40306762b011c7f1c327bd3a1e67746175a53b3ee8a53395b1f75cae0db7eeb

Request headers

:path: /wp-content/uploads/2021/08/install-600x275.jpg
pragma: no-cache
cookie: OptanonConsent=isIABGlobal=false&datestamp=Fri+Aug+27+2021+16%3A52%3A07+GMT%2B0200+(Central+European+Summer+Time)&version=6.4.0&landingPath=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: blog.malwarebytes.com
referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:07 GMT
last-modified: Thu, 19 Aug 2021 15:18:45 GMT
server: nginx
etag: "611e7655-610e"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 24846

GET
H2 200 147cd7280d6ece931e4488a3a10809d9
secure.gravatar.com/avatar/ 11 KB
11 KB 20ms
5ms Image
image/png 2a04:fa87:fffe::c000:4902
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.gravatar.com/avatar/147cd7280d6ece931e4488a3a10809d9?s=96&d=identicon&r=g
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1f462c2a1a60b244e8901d78293b03c6f554ea0364b57e7412550cd842484b90

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Fri, 27 Aug 2021 14:52:07 GMT
last-modified: Thu, 18 Jul 2019 15:17:37 GMT
server: nginx
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=300
content-disposition: inline; filename="147cd7280d6ece931e4488a3a10809d9.png"
accept-ranges: bytes
link: <https://www.gravatar.com/avatar/147cd7280d6ece931e4488a3a10809d9?s=96&d=identicon&r=g>; rel="canonical"
content-length: 11084
expires: Fri, 27 Aug 2021 14:57:07 GMT

GET
H2 200 instagram_icon.svg
blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/images/icons/ 5 KB
2 KB 127ms
127ms Image
image/svg+xml 130.211.198.3
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/images/icons/instagram_icon.svg
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/style.css?18-08-2021
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 130.211.198.3 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 3.198.211.130.bc.googleusercontent.com
Software: nginx /
Resource Hash: 5b62da3ed3fe1c94582c2a75526716000f7361ff70c0cc41aae4ee8212735c3e

Request headers

:path: /wp-content/themes/mb-labs-theme-3.5.13/images/icons/instagram_icon.svg
pragma: no-cache
cookie: OptanonConsent=isIABGlobal=false&datestamp=Fri+Aug+27+2021+16%3A52%3A07+GMT%2B0200+(Central+European+Summer+Time)&version=6.4.0&landingPath=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: blog.malwarebytes.com
referer: https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/style.css?18-08-2021
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/style.css?18-08-2021
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:07 GMT
content-encoding: br
last-modified: Wed, 18 Aug 2021 21:09:52 GMT
server: nginx
etag: W/"611d7720-1225"
vary: Accept-Encoding Accept-Encoding Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 ic-search.svg
blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/images/footer/ 601 B
604 B 127ms
127ms Image
image/svg+xml 130.211.198.3
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/images/footer/ic-search.svg
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/style.css?18-08-2021
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 130.211.198.3 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 3.198.211.130.bc.googleusercontent.com
Software: nginx /
Resource Hash: d6f36a088f7c6dc6459a02c048b23e2407bf38a5249ecbc9547be2fce143f63a

Request headers

:path: /wp-content/themes/mb-labs-theme-3.5.13/images/footer/ic-search.svg
pragma: no-cache
cookie: OptanonConsent=isIABGlobal=false&datestamp=Fri+Aug+27+2021+16%3A52%3A07+GMT%2B0200+(Central+European+Summer+Time)&version=6.4.0&landingPath=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: blog.malwarebytes.com
referer: https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/style.css?18-08-2021
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/style.css?18-08-2021
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:07 GMT
content-encoding: br
last-modified: Wed, 18 Aug 2021 21:09:52 GMT
server: nginx
etag: W/"611d7720-259"
vary: Accept-Encoding Accept-Encoding Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H/1.1 200
OK count.js Show response
malwarebytesunpacked.disqus.com/ 1 KB
1 KB 40ms
17ms Script
application/javascript 151.101.12.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://malwarebytesunpacked.disqus.com/count.js

Requested by

Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/wp-content/plugins/disqus-comment-system/public/js/comment_count.js?ver=3.0.21

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.12.134 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

3487ef2baf0c08ba660a8a143cdeb8ebeec961eea04bccd7c49096b4eb26b875

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Fri, 27 Aug 2021 14:52:07 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Age: 98
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 871
X-XSS-Protection: 1; mode=block
Last-Modified: Tue, 17 Aug 2021 23:15:34 GMT
Server: nginx
ETag: "611c4316-367"
Strict-Transport-Security: max-age=300; includeSubdomains
Content-Type: application/javascript; charset=utf-8
Cache-Control: public, max-age=300
X-Amz-Cf-Pop: DFW3-C1
Link: <https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
X-Amz-Cf-Id: Kpk5fqVpv4tqELYYe-ZUzZS1_oBLwlKRtfrqFWI_-Gs0BpUOagheAw==

GET
H/1.1 200
OK embed.js Show response
malwarebytesunpacked.disqus.com/ 74 KB
25 KB 179ms
156ms Script
application/javascript 151.101.12.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://malwarebytesunpacked.disqus.com/embed.js

Requested by

Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/wp-content/plugins/disqus-comment-system/public/js/comment_embed.js?ver=3.0.21

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.12.134 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

openresty /

Resource Hash

377a6598c6facc027e0926adb5e5465f0999cafdf7faeb6978273cabdb344b5d

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Fri, 27 Aug 2021 14:52:08 GMT
Content-Encoding: gzip
Server: openresty
Age: 0
Vary: Accept-Encoding
Connection: keep-alive
Content-Type: application/javascript; charset=utf-8
Cache-Control: private, max-age=60
X-Service: router
Strict-Transport-Security: max-age=300; includeSubdomains
Link: <https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
Content-Length: 24675

GET
H2 200 wai.gif Show response
genesis.malwarebytes.com/api/v1/ 343 B
565 B 294ms
95ms XHR
application/json 2600:1f18:21ae:6700:f931:acf0:5bbb:8761
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://genesis.malwarebytes.com/api/v1/wai.gif
Requested by: Host: www.malwarebytes.com
URL: https://www.malwarebytes.com/js/jquery-1.11.3.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:21ae:6700:f931:acf0:5bbb:8761 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: Apache-Coyote/1.1 /
Resource Hash: 624de26e418e30e37a6022b5822a9d09e42807828e10742acab7377dab034cce

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

access-control-allow-origin: *
date: Fri, 27 Aug 2021 14:52:08 GMT
access-control-allow-credentials: true
server: Apache-Coyote/1.1
access-control-allow-headers: origin, content-type, accept, authorization
access-control-allow-methods: GET, POST
content-type: application/json

GET
H2 200 pillarpages.json Show response
blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/ 100 B
413 B 172ms
171ms XHR
application/json 130.211.198.3
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/pillarpages.json

Requested by

Host: www.malwarebytes.com
URL: https://www.malwarebytes.com/js/jquery-1.11.3.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

130.211.198.3 Council Bluffs, United States, ASN15169 (GOOGLE, US),

Reverse DNS

3.198.211.130.bc.googleusercontent.com

Software

nginx / WP Engine

Resource Hash

7e9bcd405af64ba784d4ead6dba8ed5c146a22c5bb6f264e756e3ded19a6fb6f

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors none;
X-Frame-Options	DENY

Request headers

:path: /wp-content/themes/mb-labs-theme-3.5.13/pillarpages.json
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: cors
accept: application/json, text/javascript, */*; q=0.01
cache-control: no-cache
sec-fetch-dest: empty
:authority: blog.malwarebytes.com
x-requested-with: XMLHttpRequest
:scheme: https
sec-fetch-site: same-origin
referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
:method: GET
Accept: application/json, text/javascript, */*; q=0.01
Referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:08 GMT
vary: Accept-Encoding,Cookie
last-modified: Fri, 27 Aug 2021 14:51:07 GMT
server: nginx
x-cacheable: SHORT
x-powered-by: WP Engine
etag: W/"64-5ca8b9d0357b7"
x-frame-options: DENY
x-cache: HIT: 22
content-type: application/json
cache-control: max-age=600, must-revalidate
content-security-policy: frame-ancestors none;
accept-ranges: bytes
content-length: 100
x-cache-group: normal

GET
H2 200 intl-sites.json Show response
blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/ 890 B
630 B 172ms
172ms XHR
application/json 130.211.198.3
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme-3.5.13/intl-sites.json

Requested by

Host: www.malwarebytes.com
URL: https://www.malwarebytes.com/js/jquery-1.11.3.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

130.211.198.3 Council Bluffs, United States, ASN15169 (GOOGLE, US),

Reverse DNS

3.198.211.130.bc.googleusercontent.com

Software

nginx / WP Engine

Resource Hash

728054ccf1f41ec0afdb688b6db421601bb60d505d9e1e2c2de16d9e4a14b774

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors none;
X-Frame-Options	DENY

Request headers

:path: /wp-content/themes/mb-labs-theme-3.5.13/intl-sites.json
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: cors
accept: application/json, text/javascript, */*; q=0.01
cache-control: no-cache
sec-fetch-dest: empty
:authority: blog.malwarebytes.com
x-requested-with: XMLHttpRequest
:scheme: https
sec-fetch-site: same-origin
referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
:method: GET
Accept: application/json, text/javascript, */*; q=0.01
Referer: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:08 GMT
content-encoding: gzip
vary: Accept-Encoding Accept-Encoding Accept-Encoding,Cookie
last-modified: Fri, 27 Aug 2021 14:51:07 GMT
server: nginx
x-cacheable: SHORT
x-powered-by: WP Engine
etag: W/"37a-5ca8b9d04039c"
x-frame-options: DENY
x-cache: HIT: 22
content-type: application/json
cache-control: max-age=600, must-revalidate
content-security-policy: frame-ancestors none;
x-cache-group: normal

GET
H/1.1 200
OK insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 5 KB
2 KB 34ms
15ms Script
application/x-javascript 2a02:26f0:6c00:296::25ea
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKSKW3
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:296::25ea Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: fed785a6a8ca96fb67230fec5d85f9c508db49f4075aa0ef284af56cd89813e3

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Fri, 27 Aug 2021 14:52:08 GMT
Content-Encoding: gzip
Last-Modified: Fri, 13 Aug 2021 21:34:05 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=26944
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2036

GET
H2 200 bat.js Show response
bat.bing.com/ 30 KB
9 KB 34ms
34ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://bat.bing.com/bat.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKSKW3
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 5c1282fb121104f5a505ecbfd7194e64c98db6b830684450dcfc478021d05257

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:07 GMT
content-encoding: gzip
last-modified: Wed, 28 Jul 2021 18:27:37 GMT
x-msedge-ref: Ref A: 5C41E621603447DF9D06B84B0CC15D43 Ref B: FRAEDGE1408 Ref C: 2021-08-27T14:52:08Z
etag: "80f2963dde83d71:0"
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript
access-control-allow-origin: *
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 9024

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 48 KB
19 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:831::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKSKW3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

fd222137f245c06ddb4c4d44db41f12138dad6cf8ef5d4d4a5e500f38f0c8c62

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 11 Aug 2021 00:32:57 GMT
server: Golfe2
age: 4
date: Fri, 27 Aug 2021 14:52:04 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19747
expires: Fri, 27 Aug 2021 16:52:04 GMT

GET
H2 200 ytc.js Show response
s.yimg.com/wi/ 15 KB
6 KB 29ms
15ms Script
application/javascript 2a00:1288:80:800::7000
YAHOO-DEB

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/ytc.js

Requested by

Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:800::7000 Frankfurt am Main, Germany, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

b9e6c38b3493790e6525ba6715ad839211cab5db3ddc80c7f70f20f92679fee6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

ats-carp-promotion: 1
date: Fri, 27 Aug 2021 14:14:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2254
x-amz-server-side-encryption: AES256
vary: Origin, Accept-Encoding
content-length: 5639
x-amz-id-2: VPcUMsLcbHVlzEdXI6DU8l9aEdMC9aI2qoKP751+KMOpleBJ7QkmnLSX1HLyvZU5cL743WvoccE=
referrer-policy: no-referrer-when-downgrade
x-amz-expiration: expiry-date="Sat, 02 Jul 2022 00:00:00 GMT", rule-id="oath-standard-lifecycle"
last-modified: Thu, 27 May 2021 13:00:20 GMT
server: ATS
etag: "6de43f1c725d89777edaa2bc5d679ecb-df"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
x-amz-request-id: MXN1DM3SRHSYPA7F
x-xss-protection: 1; mode=block
cache-control: public,max-age=3600
x-amz-version-id: Bv0RNzsjZsSn6kGrZjdvdggYqc20u__d
accept-ranges: bytes
content-type: application/javascript

GET
H2 200 HWyTnY16.min.js Show response
scripts.demandbase.com/ 60 KB
16 KB 169ms
30ms Script
application/javascript 13.224.96.5
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://scripts.demandbase.com/HWyTnY16.min.js
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.96.5 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-96-5.zrh50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 16f961e4eedc84409f706d7043ec879d9a7783c6f317640b0d97a73e98e9e8ea

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

x-amz-version-id: IE5IzYwU4gx7oNbzFWwbL4ZS6nSJjwBv
content-encoding: gzip
last-modified: Tue, 08 Dec 2020 23:24:47 GMT
server: AmazonS3
age: 1489
etag: W/"c890c8c9866d4d0ee9b287e7db203091"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript; charset=utf-8
via: 1.1 9349ae4f82564896b96f5303b030d189.cloudfront.net (CloudFront)
cache-control: public, max-age=3600
date: Fri, 27 Aug 2021 14:28:37 GMT
x-amz-cf-pop: ZRH50-C1
x-amz-cf-id: pyOzd-j__yDbVK_-o6x-P2jEILNlFSfCyKZuphJgd00mn5226BQaRw==

GET
H2 200 web-vitals.umd.js Show response
unpkg.com/web-vitals@1.1.0/dist/ 4 KB
2 KB 32ms
31ms Script
application/javascript 2606:4700::6810:7eaf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://unpkg.com/web-vitals@1.1.0/dist/web-vitals.umd.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKSKW3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7eaf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

22f39a41a30342a5c51d150be48c4726245655a560d154af893337d1ae953f62

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:08 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 13628794
vary: Accept-Encoding
last-modified: Sat, 26 Oct 1985 08:15:00 GMT
server: cloudflare
etag: W/"1060-9qPq4bqeRCeFWudNuS98Bp0PQDY"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-cloud-trace-context: e9412a941d9e2178046a5378c46b42d2
cache-control: public, max-age=31536000
cf-ray: 68561f37bc653258-FRA

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 96 KB
38 KB 15ms
14ms Script
application/javascript 2a00:1450:4001:80e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-380232391

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKSKW3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

691c9c84a063b01b9e46ca092f814db79486dd1bb17984935fb53392149b32d9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:08 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39270
x-xss-protection: 0
last-modified: Fri, 27 Aug 2021 12:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 27 Aug 2021 14:52:08 GMT

GET
H3-29

200

activityi;dc_pre=CP7NroW60fICFRsEBgAdHegAag;src=9812475;type=conve0;cat=forms000;ord=1;num=3139837301765;gtm=2wg8p0;auiddc=497475147.1630075928;ps=1;~oref=https%3A%2F%2Fblog.malwarebytes.com%2Fthre... Show response
9812475.fls.doubleclick.net/ Frame AC8B
Redirect Chain

https://9812475.fls.doubleclick.net/activityi;src=9812475;type=conve0;cat=forms000;ord=1;num=3139837301765;gtm=2wg8p0;auiddc=497475147.1630075928;ps=1;~oref=https%3A%2F%2Fblog.malwarebytes.com%2Fth...
https://9812475.fls.doubleclick.net/activityi;dc_pre=CP7NroW60fICFRsEBgAdHegAag;src=9812475;type=conve0;cat=forms000;ord=1;num=3139837301765;gtm=2wg8p0;auiddc=497475147.1630075928;ps=1;~oref=https%...

510 B
432 B

73ms
57ms

Document
text/html

142.250.185.230
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://9812475.fls.doubleclick.net/activityi;dc_pre=CP7NroW60fICFRsEBgAdHegAag;src=9812475;type=conve0;cat=forms000;ord=1;num=3139837301765;gtm=2wg8p0;auiddc=497475147.1630075928;ps=1;~oref=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKSKW3

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.230 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f6.1e100.net

Software

cafe /

Resource Hash

af0adf879c15a1a49044bb5be1d00ae031831db011ab6bfe05d5e14eb4222cef

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 9812475.fls.doubleclick.net
:scheme: https
:path: /activityi;dc_pre=CP7NroW60fICFRsEBgAdHegAag;src=9812475;type=conve0;cat=forms000;ord=1;num=3139837301765;gtm=2wg8p0;auiddc=497475147.1630075928;ps=1;~oref=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F?
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://blog.malwarebytes.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: about:blank

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Fri, 27 Aug 2021 14:52:08 GMT
expires: Fri, 27 Aug 2021 14:52:08 GMT
cache-control: private, max-age=0
strict-transport-security: max-age=21600
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 407
x-xss-protection: 0
set-cookie: IDE=AHWqTUm3fBq-moxw3LGHYWNjv55bXJBQ63du3aRp9CDGScDmk-SCuaYtnOKTwYhZoKw; expires=Wed, 21-Sep-2022 14:52:08 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none test_cookie=; expires=Fri, 01-Aug-2008 22:45:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Fri, 27 Aug 2021 14:52:08 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
follow-only-when-prerender-shown: 1
strict-transport-security: max-age=21600
location: https://9812475.fls.doubleclick.net/activityi;dc_pre=CP7NroW60fICFRsEBgAdHegAag;src=9812475;type=conve0;cat=forms000;ord=1;num=3139837301765;gtm=2wg8p0;auiddc=497475147.1630075928;ps=1;~oref=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F?
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 core.js Show response
s.pinimg.com/ct/ 1 KB
832 B 129ms
115ms Script
application/javascript 2a02:26f0:6c00:2a3::1931
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://s.pinimg.com/ct/core.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKSKW3
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:2a3::1931 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: ce23bdc14eb22eecad91cef112ea740ebd6928a8cdef11362d1d5b25320bd5d4

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-encoding: gzip
x-cdn: akamai
etag: "d281f5ef4add283680ff41edc6dd28c4"
vary: Accept-Encoding, Origin
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: max-age=7200
x-fallback: 4104dbc6-2.16.186.126
accept-ranges: bytes
content-length: 584
access-control-expose-headers: X-CDN

GET
H/1.1 200
OK up_loader.1.1.0.js Show response
js.adsrvr.org/ 4 KB
2 KB 102ms
27ms Script
application/x-javascript 13.224.100.124
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.adsrvr.org/up_loader.1.1.0.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKSKW3
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.100.124 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-100-124.zrh50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: ee3a7301fe1e0c0f6bf6acff0d7a8d107f5cb3f62a2566740c0416d8e61f00b9

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Fri, 27 Aug 2021 00:25:13 GMT
Content-Encoding: gzip
Last-Modified: Thu, 24 Sep 2020 15:15:34 GMT
Server: AmazonS3
Age: 52016
ETag: W/"98d98b3499058b76d58073cf8ede2f10"
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Content-Type: application/x-javascript
Via: 1.1 eb7b239aed47669f8a7b6ac95bc8aff1.cloudfront.net (CloudFront)
Connection: keep-alive
Transfer-Encoding: chunked
X-Amz-Cf-Pop: ZRH50-C1
X-Amz-Cf-Id: WQAzspSZyzb3OYDMWE04JnSPXWJctoIf5nIB2kxCrXmaI3zkW_2wQg==

GET
H2 200 demandbase-forms.js Show response
www.malwarebytes.com/js/ 3 KB
1 KB 11ms
9ms Script
application/javascript 2600:9000:21f3:fe00:16:26c7:ff80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.malwarebytes.com/js/demandbase-forms.js?d=2020-02-04-15-03-08--0800
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKSKW3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21f3:fe00:16:26c7:ff80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 5576e25dd8a4d45e90da43e0f127c4efb4d16eebcb7a1bc55fbb66e7cf504f9d

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:47:17 GMT
content-encoding: gzip
etag: W/"178b70bdbc7dd71:0"
last-modified: Tue, 20 Jul 2021 23:12:41 GMT
server: Microsoft-IIS/10.0
age: 392
x-powered-by: ASP.NET
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 e5b747ffd1713cb17ddd7d55234a3301.cloudfront.net (CloudFront)
cache-control: max-age=900
x-amz-cf-pop: FRA2-C2
x-amz-cf-id: WYVi7mo8KtkqIUP4kuEW3aP-uslfKfLLadj3UrMM2mNNoq7TKV5qvA==

GET
H3-29 200 js Show response
www.googletagmanager.com/gtag/ 97 KB
39 KB 67ms
62ms Script
application/javascript 2a00:1450:4001:809::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-930356311

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKSKW3

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

604884eafb6b13b5030d86bcd92d2d4508a19f5dd361ae2013542af4721cd2aa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:08 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39430
x-xss-protection: 0
last-modified: Fri, 27 Aug 2021 12:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 27 Aug 2021 14:52:08 GMT

GET
H2 200 activityi;register_conversion=1;src=9812475;type=conve0;cat=forms000;ord=1;num=3139837301765;gtm=2wg8p0;auiddc=497475147.1630075928;ps=1;~oref=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intellige...
9812475.fls.doubleclick.net/ 0
0 81ms
15ms Image
text/html 142.250.185.230
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://9812475.fls.doubleclick.net/activityi;register_conversion=1;src=9812475;type=conve0;cat=forms000;ord=1;num=3139837301765;gtm=2wg8p0;auiddc=497475147.1630075928;ps=1;~oref=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F?
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.185.230 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s53-in-f6.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

GET
H/1.1 200
OK pixel
q.quora.com/_/ad/64fab857ca52427587d3bd14a8d437b7/ 43 B
421 B 583ms
104ms Image
image/gif 18.215.205.165
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://q.quora.com/_/ad/64fab857ca52427587d3bd14a8d437b7/pixel?tag=ViewContent&i=gtm&u=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F

Requested by

Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.215.205.165 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-18-215-205-165.compute-1.amazonaws.com

Software

nginx /

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Fri, 27 Aug 2021 14:52:08 GMT
Server: nginx
Connection: keep-alive
Content-Length: 43
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
X-Q-Stat: ,9f3c98ccd35e78433db5fd5821b28701,10.0.0.101,37480,89.249.64.211,,111430010486,1,1630075928.881,0.002,,.,0,0,0.000,0.000,-,0,0,197,83,41,10,26847,,,,,,-,
Content-Type: image/gif

GET
H/1.1 200
OK count-data.js Show response
malwarebytesunpacked.disqus.com/ 560 B
1 KB 97ms
96ms Script
application/javascript 151.101.12.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://malwarebytesunpacked.disqus.com/count-data.js?1=38700%20https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D38700&1=39215%20https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D39215&1=40435%20https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D40435&1=40544%20https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D40544&1=40665%20https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D40665

Requested by

Host: malwarebytesunpacked.disqus.com
URL: https://malwarebytesunpacked.disqus.com/count.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.12.134 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

a462b5bc1a980ad8d6a93556ae89a5f94770ee3eef3c9bc921dc7a310fe34e83

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Fri, 27 Aug 2021 14:52:08 GMT
X-Content-Type-Options: nosniff
Server: nginx
Age: 149
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=300; includeSubdomains
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Vary: Accept-Encoding
Cache-Control: public, max-age=600
Connection: keep-alive
Content-Type: application/javascript; charset=UTF-8
Link: <https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
Content-Length: 560
X-XSS-Protection: 1; mode=block

GET
H2 200 lounge.8affdad980167da3f2dd9f1e933d0669.css
c.disquscdn.com/next/embed/styles/ 0
26 KB 42ms
13ms Other
text/css 2600:9000:2190:6600:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/styles/lounge.8affdad980167da3f2dd9f1e933d0669.css

Requested by

Host: malwarebytesunpacked.disqus.com
URL: https://malwarebytesunpacked.disqus.com/embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2190:6600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 19 Aug 2021 19:29:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 674579
x-cache: Hit from cloudfront
content-length: 25754
x-xss-protection: 1; mode=block
x-served-by: static-web-1
access-control-allow-origin: *
surrogate-key: next
last-modified: Thu, 19 Aug 2021 18:18:14 GMT
server: nginx
etag: "611ea066-649a"
content-type: text/css; charset=utf-8
via: 1.1 e1532b3ffd3d84bfecb9972a863a75ef.cloudfront.net (CloudFront)
expires: Fri, 19 Aug 2022 19:29:09 GMT
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: ZRH50-C1
timing-allow-origin: *
x-amz-cf-id: vPUjILi6oEmvswMWcwLpAxDZOTWF21r5fwnuycIjS-_zoOLvqHaGbA==
x-cache-hits: 0

GET
H2 200 common.bundle.ee2555081038338ea4f41cbb3ea1bc17.js
c.disquscdn.com/next/embed/ 0
93 KB 87ms
58ms Other
application/javascript 2600:9000:2190:6600:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/common.bundle.ee2555081038338ea4f41cbb3ea1bc17.js

Requested by

Host: malwarebytesunpacked.disqus.com
URL: https://malwarebytesunpacked.disqus.com/embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2190:6600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 19 Jul 2021 20:07:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3350695
x-cache: Hit from cloudfront
content-length: 94790
x-xss-protection: 1; mode=block
x-served-by: static-web-1
access-control-allow-origin: *
surrogate-key: next
last-modified: Mon, 19 Jul 2021 19:39:06 GMT
server: nginx
etag: "60f5d4da-17246"
content-type: application/javascript; charset=utf-8
via: 1.1 e1532b3ffd3d84bfecb9972a863a75ef.cloudfront.net (CloudFront)
expires: Tue, 19 Jul 2022 20:07:13 GMT
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: ZRH50-C1
timing-allow-origin: *
x-amz-cf-id: Jnq3WIZfrirQKVxfTPy2YCrkcBT29yx_HRQVlY6Y5-A4IXcR2Kvigg==
x-cache-hits: 0

GET
H2 200 lounge.bundle.dc50d72ac077058faccdd9a761fea0bc.js
c.disquscdn.com/next/embed/ 0
118 KB 100ms
72ms Other
application/javascript 2600:9000:2190:6600:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/lounge.bundle.dc50d72ac077058faccdd9a761fea0bc.js

Requested by

Host: malwarebytesunpacked.disqus.com
URL: https://malwarebytesunpacked.disqus.com/embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2190:6600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 21:21:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 235809
x-cache: Hit from cloudfront
content-length: 120189
x-xss-protection: 1; mode=block
x-served-by: static-web-2
access-control-allow-origin: *
surrogate-key: next
last-modified: Tue, 24 Aug 2021 21:06:44 GMT
server: nginx
etag: "61255f64-1d57d"
content-type: application/javascript; charset=utf-8
via: 1.1 e1532b3ffd3d84bfecb9972a863a75ef.cloudfront.net (CloudFront)
expires: Wed, 24 Aug 2022 21:21:59 GMT
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: ZRH50-C1
timing-allow-origin: *
x-amz-cf-id: 94bSvPwx_0mdydkekDcQdGO2ZQsrG3QiESYUFKMe4TN2O6IZoIAfNA==
x-cache-hits: 0

GET
H/1.1 200
OK config.js
disqus.com/next/ 0
13 KB 25ms
7ms Other
application/javascript 151.101.192.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://disqus.com/next/config.js

Requested by

Host: malwarebytesunpacked.disqus.com
URL: https://malwarebytesunpacked.disqus.com/embed.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.192.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Fri, 27 Aug 2021 14:52:08 GMT
X-Content-Type-Options: nosniff
Content-Type: application/javascript; charset=UTF-8
Server: nginx
Age: 37
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=300; includeSubdomains
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Access-Control-Allow-Origin: *
Cache-Control: public, stale-while-revalidate=300, s-stalewhilerevalidate=3600, max-age=60
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 12357
X-XSS-Protection: 1; mode=block

GET
H3-29 200 linkid.js Show response
www.google-analytics.com/plugins/ua/ 2 KB
882 B 39ms
39ms Script
text/javascript 2a00:1450:4001:809::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/plugins/ua/linkid.js

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:21:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
age: 1824
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=3600
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 859
x-xss-protection: 0
expires: Fri, 27 Aug 2021 15:21:44 GMT

GET
H2 200 10110317.json Show response
s.yimg.com/wi/config/ 46 B
711 B 119ms
105ms XHR
application/octet-stream 2a00:1288:80:800::7000
YAHOO-DEB

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/config/10110317.json

Requested by

Host: s.yimg.com
URL: https://s.yimg.com/wi/ytc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:800::7000 Frankfurt am Main, Germany, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

51f4cf88527819ae3950b1820aa534ebf6c2fcbc0894db427ba5ab59d9efd659

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

ats-carp-promotion: 1
date: Fri, 27 Aug 2021 14:51:57 GMT
x-content-type-options: nosniff
age: 12
x-amz-server-side-encryption: AES256
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method
x-amz-request-id: 94S2JVYTYC9T88VK
x-amz-id-2: nhdi0V05suSBjDb7k+xvdh6w1HX+Pd5SpOaz+bxN+mM5CrFZYOWxFTNPUGog4he39a6cJXk6FqE=
accept-ranges: bytes
referrer-policy: no-referrer-when-downgrade
x-amz-expiration: expiry-date="Mon, 05 Sep 2022 00:00:00 GMT", rule-id="oath-standard-lifecycle"
last-modified: Sat, 31 Jul 2021 04:48:16 GMT
server: ATS
etag: "cc3d0e0815ad7ef45a521c2a63b65393"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
access-control-allow-methods: GET
x-amz-version-id: t1HBn5w9YatPOKrzg1L4mhqDLWfX4l9q
access-control-allow-origin: *
x-xss-protection: 1; mode=block
content-length: 46
content-type: application/octet-stream

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2567940&time=1630075928528&url=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campai...
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D2567940%26time%3D1630075928528%26url%3Dhttps%253A%252F%252Fblog.malwarebytes.com%...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2567940&time=1630075928528&url=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campai...
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=2567940&time=1630075928528&url=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campa...

0
155 B

378ms
186ms

Image
application/javascript

108.174.10.14
LINKEDIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=2567940&time=1630075928528&url=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F&liSync=true&e_ipv6=AQIq583woU4V1gAAAXuIGMP9t4y7mPy59LgjyEcHT3wDi0hA-kEIQ3hynW9nzF59by06Y7mr
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.174.10.14 , United States, ASN14413 (LINKEDIN, US),
Reverse DNS: 108-174-10-14.fwd.linkedin.com
Software: Play /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:09 GMT
server: Play
linkedin-action: 1
x-li-fabric: prod-lor1
x-li-proto: http/2
x-li-pop: prod-edc2
content-type: application/javascript
content-length: 0
x-li-uuid: mu2Y92sxnxaQ0uMLIysAAA==

Redirect headers

date: Fri, 27 Aug 2021 14:52:09 GMT
server: Play
linkedin-action: 1
x-li-fabric: prod-lor1
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=2567940&time=1630075928528&url=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F&liSync=true&e_ipv6=AQIq583woU4V1gAAAXuIGMP9t4y7mPy59LgjyEcHT3wDi0hA-kEIQ3hynW9nzF59by06Y7mr
x-li-proto: http/2
x-li-pop: prod-edc2
content-length: 0
x-li-uuid: /yPT4WsxnxZQrg2tYysAAA==

GET
H2 204 4072696.js Show response
bat.bing.com/p/action/ 0
133 B 32ms
32ms Script
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://bat.bing.com/p/action/4072696.js
Requested by: Host: bat.bing.com
URL: https://bat.bing.com/bat.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

access-control-allow-origin: *
date: Fri, 27 Aug 2021 14:52:08 GMT
cache-control: private,max-age=86400
x-msedge-ref: Ref A: FFC2FA7C39844BDFAC846BADAF255396 Ref B: FRAEDGE1408 Ref C: 2021-08-27T14:52:08Z
x-cache: CONFIG_NOCACHE

GET
H2 204 0
bat.bing.com/action/ 0
94 B 31ms
30ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bat.bing.com/action/0?ti=4072696&tm=gtm001&Ver=2&mid=34d027be-3b12-426b-81ad-f9d3ed1c21c1&sid=5a4773a0074611ecadbd6fa814a3be90&vid=5a480430074611ecb33db58e001b63e3&vids=1&pi=0&lg=en-US&sw=1600&sh=1200&sc=24&tl=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia%20-%20Malwarebytes%20Labs%20%7C%20Malwarebytes%20Labs&p=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F&r=&lt=1483&evt=pageLoad&msclkid=N&sv=1&rn=62495
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

access-control-allow-origin: *
pragma: no-cache
date: Fri, 27 Aug 2021 14:52:08 GMT
cache-control: no-cache, must-revalidate
x-msedge-ref: Ref A: 90333CDB4E24461E89E1938259B556AF Ref B: FRAEDGE1408 Ref C: 2021-08-27T14:52:08Z
x-cache: CONFIG_NOCACHE
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 0
bat.bing.com/action/ 0
95 B 30ms
29ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bat.bing.com/action/0?ti=4072696&tm=gtm001&Ver=2&mid=34d027be-3b12-426b-81ad-f9d3ed1c21c1&sid=5a4773a0074611ecadbd6fa814a3be90&vid=5a480430074611ecb33db58e001b63e3&vids=0&ec=form&gc=USD&tpp=1&en=Y&evt=custom&msclkid=N&rn=21183
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

access-control-allow-origin: *
pragma: no-cache
date: Fri, 27 Aug 2021 14:52:08 GMT
cache-control: no-cache, must-revalidate
x-msedge-ref: Ref A: 984EECE75AA342FEB65B28930E0AFBAB Ref B: FRAEDGE1408 Ref C: 2021-08-27T14:52:08Z
x-cache: CONFIG_NOCACHE
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 0
bat.bing.com/action/ 0
107 B 30ms
29ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bat.bing.com/action/0?ti=4072696&tm=gtm001&Ver=2&mid=34d027be-3b12-426b-81ad-f9d3ed1c21c1&sid=5a4773a0074611ecadbd6fa814a3be90&vid=5a480430074611ecb33db58e001b63e3&vids=0&ec=form&gc=USD&tpp=1&en=Y&evt=custom&msclkid=N&rn=890636
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

access-control-allow-origin: *
pragma: no-cache
date: Fri, 27 Aug 2021 14:52:08 GMT
cache-control: no-cache, must-revalidate
x-msedge-ref: Ref A: 6B1D8E92F4084CC687200A17D4678CC8 Ref B: FRAEDGE1408 Ref C: 2021-08-27T14:52:08Z
x-cache: CONFIG_NOCACHE
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 0
bat.bing.com/action/ 0
136 B 29ms
29ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bat.bing.com/action/0?ti=4072696&tm=gtm001&Ver=2&mid=34d027be-3b12-426b-81ad-f9d3ed1c21c1&sid=5a4773a0074611ecadbd6fa814a3be90&vid=5a480430074611ecb33db58e001b63e3&vids=0&ec=form&gc=USD&tpp=1&en=Y&evt=custom&msclkid=N&rn=310009
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

access-control-allow-origin: *
pragma: no-cache
date: Fri, 27 Aug 2021 14:52:08 GMT
cache-control: no-cache, must-revalidate
x-msedge-ref: Ref A: 2DDBF67901C0487DA8107EAA486C39D0 Ref B: FRAEDGE1408 Ref C: 2021-08-27T14:52:08Z
x-cache: CONFIG_NOCACHE
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 36 KB
14 KB 84ms
36ms Script
text/javascript 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-380232391

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

cafe /

Resource Hash

4763031532a7e8158dd70840883891162d509da2ab0e35a615a761899d00e29b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14024
x-xss-protection: 0
server: cafe
etag: 2823035467097736592
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Fri, 27 Aug 2021 14:52:08 GMT

GET
H/1.1 200
OK / Show response
disqus.com/embed/comments/ Frame CBC6 7 KB
4 KB 130ms
130ms Document
text/html 151.101.192.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=50703%20https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D50703&t_u=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F&t_e=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&t_d=%0A%09%09%09%09%09New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia%09%09%09%09&t_t=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&s_o=default

Requested by

Host: malwarebytesunpacked.disqus.com
URL: https://malwarebytesunpacked.disqus.com/embed.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.192.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

5c222890d05dad942e8179621c10021658794c5d8bd1e10539e0ec6dd60590d7

Security Headers

Name	Value
Content-Security-Policy	script-src https://.twitter.com: https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://.services.disqus.com: https://cdn.boomtrain.com/p13n/ https://apis.google.com https://cdn.syndication.twimg.com/tweets.json https://connect.facebook.net/en_US/sdk.js https://referrer.disqus.com/juggler/ 'unsafe-inline' https://com-disqus.netmng.com:* https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Host: disqus.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://blog.malwarebytes.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://blog.malwarebytes.com/

Response headers

Connection: keep-alive
Content-Length: 2939
Server: nginx
Content-Security-Policy: script-src https://*.twitter.com:* https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://*.services.disqus.com:* https://cdn.boomtrain.com/p13n/ https://apis.google.com https://cdn.syndication.twimg.com/tweets.json https://connect.facebook.net/en_US/sdk.js https://referrer.disqus.com/juggler/ 'unsafe-inline' https://com-disqus.netmng.com:* https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com
Link: <https://c.disquscdn.com>;rel=preconnect,<https://c.disquscdn.com>;rel=dns-prefetch
Cache-Control: stale-if-error=3600, s-stalewhilerevalidate=3600, stale-while-revalidate=30, no-cache, must-revalidate, public, s-maxage=5
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Content-Type: text/html; charset=utf-8
Last-Modified: Thu, 26 Aug 2021 05:03:31 GMT
ETag: W/"lounge:view:8733192328.19ec38c35e2ebdd73bda909808275906.2"
Referrer-Policy: no-referrer-when-downgrade
Content-Encoding: gzip
Date: Fri, 27 Aug 2021 14:52:08 GMT
Age: 0
Vary: Accept-Encoding
Strict-Transport-Security: max-age=300; includeSubdomains

GET
H2 200 ip.json Show response
api.company-target.com/api/v2/ 1 KB
1 KB 169ms
93ms XHR
application/json 13.224.96.62
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.company-target.com/api/v2/ip.json?referrer=&page=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F&page_title=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia%20-%20Malwarebytes%20Labs%20%7C%20Malwarebytes%20Labs&src=tag&key=5527c2aa519592df7d44a24d0105731b
Requested by: Host: scripts.demandbase.com
URL: https://scripts.demandbase.com/HWyTnY16.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.96.62 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-96-62.zrh50.r.cloudfront.net
Software: nginx /
Resource Hash: 9cd291e0d448c524c55f79a46f5f17a3a3a3f8d8ea5a83d84338c170ba41fdc1

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:08 GMT
identification-source: CENTRAL
vary: Accept-Encoding, Origin
x-amz-cf-pop: ZRH50-C1
x-cache: Miss from cloudfront
request-id: 6be24ab1-e4e4-4d02-8f6d-89cc932a10c5
content-encoding: gzip
pragma: no-cache
access-control-allow-origin: https://blog.malwarebytes.com
server: nginx
access-control-max-age: 7200
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json;charset=utf-8
via: 1.1 7245e91891539560c1f484b1e46159c9.cloudfront.net (CloudFront)
access-control-expose-headers
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
api-version: v2
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: gWwheFESiEEhbGEEcBTpZEU8bEnN8lnXn8S7TOV9e7Sx8u7CP5o2Hg==
expires: Thu, 26 Aug 2021 14:52:08 GMT

GET
H/1.1

200
OK

validateCookie
segments.company-target.com/
Redirect Chain

https://match.prod.bidr.io/cookie-sync/demandbase
https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1
https://segments.company-target.com/log?vendor=choca&user_id=AABnUE7CUfgAABqkD-OmHQ
https://segments.company-target.com/validateCookie?vendor=choca&user_id=AABnUE7CUfgAABqkD-OmHQ&verifyHash=385536fbe4dc83053782ca90799acf8d6bb0c6ff

26 B
409 B

118ms
117ms

Image
image/gif

13.224.96.51
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://segments.company-target.com/validateCookie?vendor=choca&user_id=AABnUE7CUfgAABqkD-OmHQ&verifyHash=385536fbe4dc83053782ca90799acf8d6bb0c6ff
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.96.51 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-96-51.zrh50.r.cloudfront.net
Software: /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Fri, 27 Aug 2021 14:52:09 GMT
Via: 1.1 697e9166a29142e018dae0e083c25f18.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: ZRH50-C1
Vary: Origin
X-Cache: Miss from cloudfront
Content-Type: image/gif
Transfer-Encoding: chunked
Connection: keep-alive
trace-id: ca6e01dc82a5cac5
X-Amz-Cf-Id: apo2gg1fJK5aH4UgazVEhoA5JVfCmQL_xp78nGiR4SbcMsK8uZKhpg==

Redirect headers

Date: Fri, 27 Aug 2021 14:52:09 GMT
Via: 1.1 697e9166a29142e018dae0e083c25f18.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: ZRH50-C1
Vary: Origin
X-Cache: Miss from cloudfront
Location: /validateCookie?vendor=choca&user_id=AABnUE7CUfgAABqkD-OmHQ&verifyHash=385536fbe4dc83053782ca90799acf8d6bb0c6ff
Connection: keep-alive
trace-id: 06c5f1871eb2b93e
Content-Length: 0
X-Amz-Cf-Id: 0bD-rzkmfLQuL14ad53bWz09ESOruSJA53wkzjgYnX2po6PNM9dNKA==

GET
H2 451 464526.gif
id.rlcdn.com/ 0
66 B 88ms
15ms Image
text/plain 35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://id.rlcdn.com/464526.gif
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:08 GMT
via: 1.1 google
alt-svc: clear
content-length: 0

GET
H2 200 main.89cd5bf4.js Show response
s.pinimg.com/ct/lib/ 49 KB
17 KB 113ms
112ms Script
application/javascript 2a02:26f0:6c00:2a3::1931
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://s.pinimg.com/ct/lib/main.89cd5bf4.js
Requested by: Host: s.pinimg.com
URL: https://s.pinimg.com/ct/core.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:2a3::1931 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: eb0b072c78ba88e87b07c39c22f9bef724ea89f29f2a195ec4ab33b3bc75797d

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-encoding: gzip
x-cdn: akamai
etag: "6deee3ea7ecc4a5d9687c1bd57018c16"
vary: Accept-Encoding, Origin
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: max-age=1209600
x-fallback: 4104dd9d-2.16.186.126
accept-ranges: bytes
content-length: 17418
access-control-expose-headers: X-CDN

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
92 B 14ms
14ms XHR
text/plain 2a00:1450:400c:c0c::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j93&tid=UA-3347303-10&cid=2041133347.1630075929&jid=544991007&uid=E47AF0F3-70E7-4020-8C2C-44824C7E93B5&gjid=1599389563&_gid=495482462.1630075929&_u=aGBAgEAjAAAAAE~&z=923448464

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c0c::9b Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Fri, 27 Aug 2021 14:52:08 GMT
content-type: text/plain
access-control-allow-origin: https://blog.malwarebytes.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 collect
www.google-analytics.com/ 35 B
55 B 6ms
6ms Image
image/gif 2a00:1450:4001:809::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j93&a=174951133&t=pageview&_s=1&dl=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F&ul=en-us&de=UTF-8&dt=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia%20-%20Malwarebytes%20Labs%20%7C%20Malwarebytes%20Labs&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aGBAgEAj~&jid=544991007&gjid=1599389563&cid=2041133347.1630075929&uid=E47AF0F3-70E7-4020-8C2C-44824C7E93B5&tid=UA-3347303-10&_gid=495482462.1630075929&gtm=2wg8p0MKSKW3&z=2022158818

Requested by

Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 Aug 2021 17:11:15 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 78053
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
144 B 31ms
31ms Image
image/gif 2a00:1450:4001:80f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j93&tid=UA-3347303-10&cid=2041133347.1630075929&jid=544991007&_u=aGBAgEAjAAAAAE~&z=224838858

Requested by

Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Aug 2021 14:52:08 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
107 B 30ms
30ms Image
image/gif 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j93&tid=UA-3347303-10&cid=2041133347.1630075929&jid=544991007&_u=aGBAgEAjAAAAAE~&z=224838858

Requested by

Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Aug 2021 14:52:08 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dc_pre=CP7NroW60fICFRsEBgAdHegAag;src=9812475;type=conve0;cat=forms000;ord=1;num=3139837301765;gtm=2wg8p0;auiddc=*;ps=1;~oref=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2...
adservice.google.com/ddm/fls/z/ Frame AC8B 42 B
107 B 31ms
30ms Image
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CP7NroW60fICFRsEBgAdHegAag;src=9812475;type=conve0;cat=forms000;ord=1;num=3139837301765;gtm=2wg8p0;auiddc=*;ps=1;~oref=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F

Requested by

Host: 9812475.fls.doubleclick.net
URL: https://9812475.fls.doubleclick.net/activityi;dc_pre=CP7NroW60fICFRsEBgAdHegAag;src=9812475;type=conve0;cat=forms000;ord=1;num=3139837301765;gtm=2wg8p0;auiddc=497475147.1630075928;ps=1;~oref=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://9812475.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Aug 2021 14:52:08 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/380232391/ 3 KB
1 KB 22ms
22ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/380232391/?random=1630075928686&cv=9&fst=1630075928686&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa8p0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F&tiba=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia%20-%20Malwarebytes%20Labs%20%7C%20Malwarebytes%20Labs&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8702018b5c8809434a3459d4b81440f67c261280bac213730e1fc128d7cff11e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Aug 2021 14:52:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1127
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 / Show response
www.googleadservices.com/pagead/conversion/380232391/ 2 KB
1 KB 27ms
25ms Script
text/javascript 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion/380232391/?random=1630075928688&cv=9&fst=1630075928688&num=1&label=_XHlCK3XlI0CEMfFp7UB&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa8p0&sendb=1&ig=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F&tiba=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia%20-%20Malwarebytes%20Labs%20%7C%20Malwarebytes%20Labs&auid=497475147.1630075928&capi=1&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

cafe /

Resource Hash

79cedbb48b73d61e196f272011efafa43c3bad823161643a62814b224f26ab84

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Aug 2021 14:52:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1252
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/privacysandbox/conversion/380232391/ 0
0 15ms
15ms Image
text/html 2a00:1450:4001:80f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/pagead/privacysandbox/conversion/380232391/?random=1630075928688&cv=9&fst=1630075928688&num=1&fmt=3&label=_XHlCK3XlI0CEMfFp7UB&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa8p0&sendb=1&ig=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F&tiba=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia%20-%20Malwarebytes%20Labs%20%7C%20Malwarebytes%20Labs&auid=497475147.1630075928&capi=1&hn=www.googleadservices.com&async=1
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:80f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/930356311/ 3 KB
1 KB 23ms
22ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/930356311/?random=1630075928692&cv=9&fst=1630075928692&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa8p0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F&tiba=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia%20-%20Malwarebytes%20Labs%20%7C%20Malwarebytes%20Labs&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c368834a92ee3366773dd94318efcd73eb1d451602b1cad916f9f3ed38b72c17

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Aug 2021 14:52:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1129
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 /
www.google.com/pagead/1p-user-list/380232391/ 42 B
67 B 31ms
24ms Image
image/gif 2a00:1450:4001:831::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/380232391/?random=1630075928686&cv=9&fst=1630072800000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa8p0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F&tiba=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia%20-%20Malwarebytes%20Labs%20%7C%20Malwarebytes%20Labs&async=1&fmt=3&is_vtc=1&random=736981500&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Aug 2021 14:52:08 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 /
www.google.de/pagead/1p-user-list/380232391/ 42 B
64 B 33ms
26ms Image
image/gif 2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/380232391/?random=1630075928686&cv=9&fst=1630072800000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa8p0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F&tiba=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia%20-%20Malwarebytes%20Labs%20%7C%20Malwarebytes%20Labs&async=1&fmt=3&is_vtc=1&random=736981500&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Aug 2021 14:52:08 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 /
www.google.com/pagead/1p-user-list/930356311/ 42 B
67 B 22ms
21ms Image
image/gif 2a00:1450:4001:831::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/930356311/?random=1630075928692&cv=9&fst=1630072800000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa8p0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F&tiba=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia%20-%20Malwarebytes%20Labs%20%7C%20Malwarebytes%20Labs&async=1&fmt=3&is_vtc=1&random=3337626417&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Aug 2021 14:52:08 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 /
www.google.de/pagead/1p-user-list/930356311/ 42 B
64 B 28ms
27ms Image
image/gif 2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/930356311/?random=1630075928692&cv=9&fst=1630072800000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa8p0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F&tiba=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia%20-%20Malwarebytes%20Labs%20%7C%20Malwarebytes%20Labs&async=1&fmt=3&is_vtc=1&random=3337626417&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Aug 2021 14:52:08 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
www.google.de/pagead/1p-conversion/380232391/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/380232391/?random=349996654&cv=9&fst=1630075928688&num=1&label=_XHlCK3XlI0CEMfFp7UB&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200...
https://www.google.com/pagead/1p-conversion/380232391/?random=349996654&cv=9&fst=1630075928688&num=1&label=_XHlCK3XlI0CEMfFp7UB&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u...
https://www.google.de/pagead/1p-conversion/380232391/?random=349996654&cv=9&fst=1630075928688&num=1&label=_XHlCK3XlI0CEMfFp7UB&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_...

42 B
108 B

111ms
14ms

Image
image/gif

2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-conversion/380232391/?random=349996654&cv=9&fst=1630075928688&num=1&label=_XHlCK3XlI0CEMfFp7UB&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa8p0&sendb=1&ig=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F&tiba=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia%20-%20Malwarebytes%20Labs%20%7C%20Malwarebytes%20Labs&auid=497475147.1630075928&capi=1&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=GPwoYbSAK5iq7gOh86DAAg&cid=CAQSKQCNIrLMBHSxoQJQXiFgWcQqlyqZ-n1dOl62bltXuTwLDQNsYdb_k3_V&random=3037640391&resp=GooglemKTybQhCsO&ipr=y

Requested by

Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Aug 2021 14:52:09 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 27 Aug 2021 14:52:08 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/gif
location: https://www.google.de/pagead/1p-conversion/380232391/?random=349996654&cv=9&fst=1630075928688&num=1&label=_XHlCK3XlI0CEMfFp7UB&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa8p0&sendb=1&ig=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F&tiba=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia%20-%20Malwarebytes%20Labs%20%7C%20Malwarebytes%20Labs&auid=497475147.1630075928&capi=1&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=GPwoYbSAK5iq7gOh86DAAg&cid=CAQSKQCNIrLMBHSxoQJQXiFgWcQqlyqZ-n1dOl62bltXuTwLDQNsYdb_k3_V&random=3037640391&resp=GooglemKTybQhCsO&ipr=y
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
ct.pinterest.com/user/ 443 B
716 B 176ms
66ms XHR
application/json 199.232.80.84
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://ct.pinterest.com/user/?tid=2614167509439&pd=%7B%22np%22%3A%22gtm%22%7D&cb=1630075928751
Requested by: Host: s.pinimg.com
URL: https://s.pinimg.com/ct/lib/main.89cd5bf4.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 199.232.80.84 Marseille, France, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 45eb4a06b8ac41231cacdee781d6a1175ed0dc544c3982b708305b281feaaab3

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Aug 2021 14:52:08 GMT
content-encoding: gzip
referrer-policy: origin
x-cdn: fastly
content-type: application/json; charset=utf-8
access-control-allow-origin: https://blog.malwarebytes.com
access-control-expose-headers: Epik,Pin-Unauth
cache-control: no-cache,no-store,must-revalidate,max-age=0
pin-unauth: dWlkPU9UQXpPR00xT0RndE9UY3dOUzAwTldNMExXRXhNemt0TXpVNE1qYzFNemd4TkRkbQ
x-pinterest-rid: 9130867739137366
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
content-length: 331
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 /
ct.pinterest.com/v3/ 35 B
96 B 175ms
66ms Image
image/gif 199.232.80.84
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ct.pinterest.com/v3/?tid=2614167509439&pd=%7B%22np%22%3A%22gtm%22%7D&event=init&ad=%7B%22loc%22%3A%22https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F%22%2C%22ref%22%3A%22%22%2C%22if%22%3Afalse%2C%22sh%22%3A1200%2C%22sw%22%3A1600%2C%22mh%22%3A%2289cd5bf4%22%2C%22ecm_enabled%22%3Afalse%7D&cb=1630075928753
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 199.232.80.84 Marseille, France, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 37b17c5135a176a9474521af147d96dfa1fb4ca0f43f00d1400bd1885be3ab9b

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Aug 2021 14:52:08 GMT
referrer-policy: origin
x-cdn: fastly
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache,no-store,must-revalidate,max-age=0
x-envoy-upstream-service-time: 2
x-pinterest-rid: 4742913369835011
content-length: 35
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 collect
www.google-analytics.com/ 35 B
100 B 130ms
0ms Image
image/gif 2a00:1450:4001:831::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j93&a=174951133&t=event&ni=1&_s=2&dl=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F&ul=en-us&de=UTF-8&dt=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia%20-%20Malwarebytes%20Labs%20%7C%20Malwarebytes%20Labs&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Demandbase&ea=API%20Resolution&el=IP%20API&_u=aHBAgEAjAAAAAE~&jid=&gjid=&cid=2041133347.1630075929&uid=E47AF0F3-70E7-4020-8C2C-44824C7E93B5&tid=UA-3347303-10&_gid=495482462.1630075929&gtm=2wg8p0MKSKW3&cd2=319205&cd3=Enterprise%20Business&cd4=Automotive&cd5=Paccar%20Inc&cd6=Paccar&cd7=Automotive&cd8=Manufacturing&cd9=Over%20%245B&cd10=3%2C000%2B&cd11=Bellevue&cd12=WA&cd13=(Non-AccountWatch%20Visitor)&cd14=(Non-AccountWatch%20Visitor)&cd15=(Non-AccountWatch%20Visitor)&cd16=(Non-AccountWatch%20Visitor)&cd17=US&cd18=paccar.com&z=745283911

Requested by

Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Aug 2021 10:16:04 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 16565
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 lounge.load.53c39e0ce65e4eb0af505908f71410f5.js Show response
c.disquscdn.com/next/embed/ Frame CBC6 1 KB
1 KB 205ms
11ms Script
application/javascript 2600:9000:2190:6600:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/lounge.load.53c39e0ce65e4eb0af505908f71410f5.js

Requested by

Host: disqus.com
URL: https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=50703%20https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D50703&t_u=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F&t_e=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&t_d=%0A%09%09%09%09%09New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia%09%09%09%09&t_t=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&s_o=default

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2190:6600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

30da4c48d022cae31aecd5ed03eb37be68f9cf0ace03efc80eb2e1497cc55612

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Origin: https://disqus.com
Referer: https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=50703%20https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D50703&t_u=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F&t_e=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&t_d=%0A%09%09%09%09%09New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia%09%09%09%09&t_t=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 21:22:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 235809
x-cache: Hit from cloudfront
content-length: 534
x-xss-protection: 1; mode=block
x-served-by: static-web-2
access-control-allow-origin: *
surrogate-key: next
last-modified: Tue, 24 Aug 2021 21:06:44 GMT
server: nginx
etag: "61255f64-216"
content-type: application/javascript; charset=utf-8
via: 1.1 a2037d86ccb1a548f20827ebd95a65f3.cloudfront.net (CloudFront)
expires: Wed, 24 Aug 2022 21:22:00 GMT
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: ZRH50-C1
timing-allow-origin: *
x-amz-cf-id: vI2pGhAeatK6r6lXoo_ui2tK__qvWgk4iMdYMHWPl9_gIgIzqE0sgg==
x-cache-hits: 0

POST
H2 204 / Show response
ct.pinterest.com/md/ 0
198 B 146ms
62ms XHR
text/plain 199.232.80.84
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://ct.pinterest.com/md/
Requested by: Host: s.pinimg.com
URL: https://s.pinimg.com/ct/lib/main.89cd5bf4.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 199.232.80.84 Marseille, France, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 27 Aug 2021 14:52:09 GMT
referrer-policy: origin
x-cdn: fastly
access-control-allow-origin: *
cache-control: no-cache,no-store,must-revalidate,max-age=0
x-envoy-upstream-service-time: 2
x-pinterest-rid: 1562982083117307
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 common.bundle.ee2555081038338ea4f41cbb3ea1bc17.js Show response
c.disquscdn.com/next/embed/ Frame CBC6 282 KB
93 KB 13ms
11ms Script
application/javascript 2600:9000:2190:6600:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/common.bundle.ee2555081038338ea4f41cbb3ea1bc17.js

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/lounge.load.53c39e0ce65e4eb0af505908f71410f5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2190:6600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

443211c7845e0012dea1dfe8cda1ce659e7fef3c7b5af2b470704ed8186945c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=50703%20https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D50703&t_u=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F&t_e=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&t_d=%0A%09%09%09%09%09New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia%09%09%09%09&t_t=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 19 Jul 2021 20:07:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3350696
x-cache: Hit from cloudfront
content-length: 94790
x-xss-protection: 1; mode=block
x-served-by: static-web-1
access-control-allow-origin: *
surrogate-key: next
last-modified: Mon, 19 Jul 2021 19:39:06 GMT
server: nginx
etag: "60f5d4da-17246"
content-type: application/javascript; charset=utf-8
via: 1.1 e1532b3ffd3d84bfecb9972a863a75ef.cloudfront.net (CloudFront)
expires: Tue, 19 Jul 2022 20:07:13 GMT
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: ZRH50-C1
timing-allow-origin: *
x-amz-cf-id: Ak085cITTP5Jc8bNbeTjDKLEuTVLpPChTwA0KrjQm6eJA9-9-2gaTw==
x-cache-hits: 0

GET
H2 200 lounge.8affdad980167da3f2dd9f1e933d0669.css
c.disquscdn.com/next/embed/styles/ Frame CBC6 161 KB
26 KB 13ms
12ms Stylesheet
text/css 2600:9000:2190:6600:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/styles/lounge.8affdad980167da3f2dd9f1e933d0669.css

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.ee2555081038338ea4f41cbb3ea1bc17.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2190:6600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

88e7deb2dcbccbe8fa97dfc6973ea174f0b3db01ace23c0d72a8228452171a5e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=50703%20https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D50703&t_u=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F&t_e=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&t_d=%0A%09%09%09%09%09New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia%09%09%09%09&t_t=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 19 Aug 2021 19:29:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 674580
x-cache: Hit from cloudfront
content-length: 25754
x-xss-protection: 1; mode=block
x-served-by: static-web-1
access-control-allow-origin: *
surrogate-key: next
last-modified: Thu, 19 Aug 2021 18:18:14 GMT
server: nginx
etag: "611ea066-649a"
content-type: text/css; charset=utf-8
via: 1.1 e1532b3ffd3d84bfecb9972a863a75ef.cloudfront.net (CloudFront)
expires: Fri, 19 Aug 2022 19:29:09 GMT
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: ZRH50-C1
timing-allow-origin: *
x-amz-cf-id: CNTuHtAHW6Cg9HKhCWRn83JIlaoFzZgJhawBDCOkkRuZli703DOLFA==
x-cache-hits: 0

GET
H2 200 lounge.bundle.dc50d72ac077058faccdd9a761fea0bc.js Show response
c.disquscdn.com/next/embed/ Frame CBC6 465 KB
118 KB 14ms
13ms Script
application/javascript 2600:9000:2190:6600:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/lounge.bundle.dc50d72ac077058faccdd9a761fea0bc.js

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.ee2555081038338ea4f41cbb3ea1bc17.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2190:6600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

b1bb91151130d620bb916cf8f4b0ac0aa27ed9ab91da8aa3ecc1f845b317170d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=50703%20https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D50703&t_u=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F&t_e=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&t_d=%0A%09%09%09%09%09New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia%09%09%09%09&t_t=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 21:21:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 235810
x-cache: Hit from cloudfront
content-length: 120189
x-xss-protection: 1; mode=block
x-served-by: static-web-2
access-control-allow-origin: *
surrogate-key: next
last-modified: Tue, 24 Aug 2021 21:06:44 GMT
server: nginx
etag: "61255f64-1d57d"
content-type: application/javascript; charset=utf-8
via: 1.1 e1532b3ffd3d84bfecb9972a863a75ef.cloudfront.net (CloudFront)
expires: Wed, 24 Aug 2022 21:21:59 GMT
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: ZRH50-C1
timing-allow-origin: *
x-amz-cf-id: gLST_pozJnOLW0UIXhgIbArMvDoUCEzndnLj0Nr_WlVxxgZ8quihxg==
x-cache-hits: 0

GET
H/1.1 200
OK config.js Show response
disqus.com/next/ Frame CBC6 12 KB
13 KB 18ms
17ms Script
application/javascript 151.101.192.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://disqus.com/next/config.js

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.ee2555081038338ea4f41cbb3ea1bc17.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.192.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

4d90717f4917373623ee8fe964f4e559770f3764a3f95334ebe3c0da753df65e

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=50703%20https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D50703&t_u=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F&t_e=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&t_d=%0A%09%09%09%09%09New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia%09%09%09%09&t_t=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Fri, 27 Aug 2021 14:52:09 GMT
X-Content-Type-Options: nosniff
Content-Type: application/javascript; charset=UTF-8
Server: nginx
Age: 38
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=300; includeSubdomains
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Access-Control-Allow-Origin: *
Cache-Control: public, stale-while-revalidate=300, s-stalewhilerevalidate=3600, max-age=60
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 12357
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK details Show response
disqus.com/api/3.0/forums/ Frame CBC6 3 KB
4 KB 111ms
111ms XHR
application/json 151.101.192.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://disqus.com/api/3.0/forums/details?forum=malwarebytesunpacked&attach=forumFeatures&api_key=E8Uh5l5fHZ6gD8U3KycjAIAk46f68Zw7C6eW8WSjZvCLXebZ7p0r1yrYDrLilk2F

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.ee2555081038338ea4f41cbb3ea1bc17.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.192.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

3c04dc33962483f3e11d05b43568d2a4f7fc83fa9020cb9391168d19d0e33f7a

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: */*
Referer: https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=50703%20https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D50703&t_u=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F&t_e=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&t_d=%0A%09%09%09%09%09New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia%09%09%09%09&t_t=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&s_o=default
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Fri, 27 Aug 2021 14:52:09 GMT
X-Content-Type-Options: nosniff
Server: nginx
Age: 0
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=300; includeSubdomains
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Connection: keep-alive
Content-Type: application/json
Vary: Origin, Cookie
Content-Length: 3266
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK loadReactions Show response
disqus.com/api/3.0/threadReactions/ Frame CBC6 1 KB
2 KB 133ms
118ms XHR
application/json 151.101.192.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://disqus.com/api/3.0/threadReactions/loadReactions?thread=8733192328&api_key=E8Uh5l5fHZ6gD8U3KycjAIAk46f68Zw7C6eW8WSjZvCLXebZ7p0r1yrYDrLilk2F

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.ee2555081038338ea4f41cbb3ea1bc17.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.192.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

dab24cfdc4ae18663125086c84a5857d206ac6a91f19d5c6e094d17895284d7e

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=50703%20https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D50703&t_u=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F&t_e=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&t_d=%0A%09%09%09%09%09New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia%09%09%09%09&t_t=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&s_o=default
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Fri, 27 Aug 2021 14:52:09 GMT
X-Content-Type-Options: nosniff
Server: nginx
Age: 0
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=300; includeSubdomains
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Cache-Control: stale-while-revalidate=30, max-age=60
Connection: keep-alive
Content-Type: application/json
Vary: Origin, Cookie
Content-Length: 1125
X-XSS-Protection: 1; mode=block

GET
H2 200 noavatar92.png
a.disquscdn.com/1624570071/images/ Frame CBC6 2 KB
2 KB 24ms
7ms Image
image/png 151.101.14.49
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://a.disquscdn.com/1624570071/images/noavatar92.png

Requested by

Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.14.49 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

36ef66124133ca33c8b44c487293c3180e5ab681ff3cad3c728ea4f894ec3444

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=50703%20https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D50703&t_u=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F&t_e=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&t_d=%0A%09%09%09%09%09New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia%09%09%09%09&t_t=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:09 GMT
x-content-type-options: nosniff
last-modified: Fri, 26 Feb 2021 20:50:09 GMT
server: nginx
age: 1826424
etag: "60395f01-66c"
strict-transport-security: max-age=300; includeSubdomains
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
x-xss-protection: 1; mode=block
cache-control: max-age=2592000
x-amz-cf-pop: FRA2-C2
content-type: image/png
content-length: 1644
x-amz-cf-id: PbMVeM2iWmudwIaI31RBJmSVugFre_LpJLL2G4ilL6tNFDLra-hEMw==
expires: Fri, 06 Aug 2021 11:31:45 GMT

GET
DATA 200
OK truncated
/ Frame CBC6 37 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/gif

GET
H2 200 svg-sprite.4da5413f5086c5755b46094b813dbfcd.svg
c.disquscdn.com/next/embed/assets/img/ Frame CBC6 13 KB
13 KB 13ms
12ms Image
image/svg+xml 2600:9000:2190:6600:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/next/embed/assets/img/svg-sprite.4da5413f5086c5755b46094b813dbfcd.svg

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.8affdad980167da3f2dd9f1e933d0669.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2190:6600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

3270642c89180c12db93775e2a774b6dadd9bd98cffc963075c85afd2c17b6e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://c.disquscdn.com/next/embed/styles/lounge.8affdad980167da3f2dd9f1e933d0669.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 28 Apr 2021 14:37:41 GMT
via: 1.1 e1532b3ffd3d84bfecb9972a863a75ef.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 10455268
x-cache: Hit from cloudfront
content-length: 13079
x-xss-protection: 1; mode=block
x-served-by: static-web-1
surrogate-key: next
last-modified: Tue, 27 Apr 2021 21:01:56 GMT
server: nginx
etag: "60887bc4-3317"
content-type: image/svg+xml; charset=utf-8
access-control-allow-origin: *
expires: Thu, 28 Apr 2022 14:37:41 GMT
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: ZRH50-C1
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: kp5JM29suKtA3vSS3QmcQM0W60MhuDU9tAset4arlYhIOgQ19giMpw==
x-cache-hits: 0

GET
H2 200 loader.ba7c86e8b4b6135bb668d05223f8f127.gif
c.disquscdn.com/next/embed/assets/img/ Frame CBC6 3 KB
3 KB 12ms
11ms Image
image/gif 2600:9000:2190:6600:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/next/embed/assets/img/loader.ba7c86e8b4b6135bb668d05223f8f127.gif

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.8affdad980167da3f2dd9f1e933d0669.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2190:6600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

4c4491dcfa94cb46fb73742fc2caf49a1cd59027304af1830c7dc6ce1889857c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://c.disquscdn.com/next/embed/styles/lounge.8affdad980167da3f2dd9f1e933d0669.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 03 Feb 2021 04:58:07 GMT
via: 1.1 e1532b3ffd3d84bfecb9972a863a75ef.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 17747642
x-cache: Hit from cloudfront
content-length: 2971
x-xss-protection: 1; mode=block
x-served-by: static-web-2
surrogate-key: next
last-modified: Wed, 27 Jan 2021 17:23:07 GMT
server: nginx
etag: "6011a17b-b9b"
content-type: image/gif
access-control-allow-origin: *
expires: Thu, 03 Feb 2022 04:58:07 GMT
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: ZRH50-C1
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: UyCndx7G1_1Vqqjc0ekR45Z36HfjqbQRJNHRHritzDhHT7uJw-EMxQ==
x-cache-hits: 0

GET
H2 200 sprite.654110a9206fd22f08cca0798e34a65e.png
c.disquscdn.com/next/embed/assets/img/ Frame CBC6 2 KB
2 KB 12ms
12ms Image
image/png 2600:9000:2190:6600:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/next/embed/assets/img/sprite.654110a9206fd22f08cca0798e34a65e.png

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.8affdad980167da3f2dd9f1e933d0669.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2190:6600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

cdba739c28b41f39ce438f2bf204fe739dc81a26cf559a9394ceed56a0666bee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://c.disquscdn.com/next/embed/styles/lounge.8affdad980167da3f2dd9f1e933d0669.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 10:47:19 GMT
via: 1.1 e1532b3ffd3d84bfecb9972a863a75ef.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 6667490
x-cache: Hit from cloudfront
content-length: 1862
x-xss-protection: 1; mode=block
x-served-by: static-web-2
surrogate-key: next
last-modified: Thu, 10 Jun 2021 21:33:44 GMT
server: nginx
etag: "60c28538-746"
content-type: image/png
access-control-allow-origin: *
expires: Sat, 11 Jun 2022 10:47:19 GMT
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: ZRH50-C1
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: S6HWAgfOHvyhLGVMr3F2kCiAOpEvsREdIkgUimwkEeKC1A1qQBoWvQ==
x-cache-hits: 0

GET
H2 200 icons.4cc7a703d2fdfe684151ff8ac24d45f1.woff2
c.disquscdn.com/next/embed/assets/font/ Frame CBC6 8 KB
8 KB 13ms
13ms Font
application/octet-stream 2600:9000:2190:6600:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/assets/font/icons.4cc7a703d2fdfe684151ff8ac24d45f1.woff2

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.8affdad980167da3f2dd9f1e933d0669.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2190:6600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

f2a341fc815d45c21da726d4c843c2c5d3e1f333465347c3c75d040d556df4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Origin: https://disqus.com
Referer: https://c.disquscdn.com/next/embed/styles/lounge.8affdad980167da3f2dd9f1e933d0669.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 04 May 2021 09:01:33 GMT
via: 1.1 a2037d86ccb1a548f20827ebd95a65f3.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 9957035
x-cache: Hit from cloudfront
content-length: 7900
x-xss-protection: 1; mode=block
x-served-by: static-web-2
surrogate-key: next
last-modified: Wed, 28 Apr 2021 21:48:08 GMT
server: nginx
etag: "6089d818-1edc"
content-type: application/octet-stream
access-control-allow-origin: *
expires: Wed, 04 May 2022 09:01:33 GMT
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: ZRH50-C1
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: 2SSQBOG3hPoYiQFiQe8enLmTPWepRCza5BhU4ylO-AZg2Z4bzPD5qQ==
x-cache-hits: 0

GET
H2 200 upvote-512x512.png
c.disquscdn.com/next/current/publisher-admin/assets/img/emoji/ Frame CBC6 8 KB
9 KB 18ms
17ms Image
image/png 2600:9000:2190:6600:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/next/current/publisher-admin/assets/img/emoji/upvote-512x512.png

Requested by

Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2190:6600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

f8afec44114c09f3e520fd8c89a7e00386e99bc567ccbbf16f23771b75b58a68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=50703%20https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D50703&t_u=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F&t_e=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&t_d=%0A%09%09%09%09%09New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia%09%09%09%09&t_t=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:50:10 GMT
via: 1.1 e1532b3ffd3d84bfecb9972a863a75ef.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 128
x-cache: Hit from cloudfront
content-length: 8212
x-xss-protection: 1; mode=block
x-served-by: static-web-2
last-modified: Tue, 24 Aug 2021 21:06:44 GMT
server: nginx
etag: "61255f64-2014"
content-type: image/png
access-control-allow-origin: *
expires: Fri, 27 Aug 2021 14:55:01 GMT
cache-control: max-age=300, public
x-amz-cf-pop: ZRH50-C1
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: YPaQ2_5ucDFShuKC6joegrhkcGr6fnGN9NsrQIlCp8A-0I7z1Fc4kw==
x-cache-hits: 0

GET
H2 200 funny-512x512.png
c.disquscdn.com/next/current/publisher-admin/assets/img/emoji/ Frame CBC6 9 KB
9 KB 18ms
17ms Image
image/png 2600:9000:2190:6600:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/next/current/publisher-admin/assets/img/emoji/funny-512x512.png

Requested by

Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2190:6600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

20a91bd509668238b6af8e16475c5e2611bcd2861d0eec2e0d4f6815e81449bd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=50703%20https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D50703&t_u=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F&t_e=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&t_d=%0A%09%09%09%09%09New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia%09%09%09%09&t_t=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:47:58 GMT
via: 1.1 e1532b3ffd3d84bfecb9972a863a75ef.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 251
x-cache: Hit from cloudfront
content-length: 8883
x-xss-protection: 1; mode=block
x-served-by: static-web-2
last-modified: Tue, 24 Aug 2021 21:06:44 GMT
server: nginx
etag: "61255f64-22b3"
content-type: image/png
access-control-allow-origin: *
expires: Fri, 27 Aug 2021 14:52:58 GMT
cache-control: max-age=300, public
x-amz-cf-pop: ZRH50-C1
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: kZi7NwHH2Ib1hIpLCgG_xyAu0K4vSPpl_owjD7AebpkfG8rq7Dv4ug==
x-cache-hits: 0

GET
H2 200 love-512x512.png
c.disquscdn.com/next/current/publisher-admin/assets/img/emoji/ Frame CBC6 12 KB
12 KB 18ms
17ms Image
image/png 2600:9000:2190:6600:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/next/current/publisher-admin/assets/img/emoji/love-512x512.png

Requested by

Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2190:6600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

e422b07ca1550e55cd90a518e910fd3cfb4d9337ea6092357f9761aa77ac9e33

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=50703%20https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D50703&t_u=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F&t_e=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&t_d=%0A%09%09%09%09%09New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia%09%09%09%09&t_t=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:47:58 GMT
via: 1.1 e1532b3ffd3d84bfecb9972a863a75ef.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 251
x-cache: Hit from cloudfront
content-length: 11910
x-xss-protection: 1; mode=block
x-served-by: static-web-2
last-modified: Tue, 24 Aug 2021 21:06:44 GMT
server: nginx
etag: "61255f64-2e86"
content-type: image/png
access-control-allow-origin: *
expires: Fri, 27 Aug 2021 14:52:58 GMT
cache-control: max-age=300, public
x-amz-cf-pop: ZRH50-C1
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: 5gNZxS3M1o6SPzmrm1q9WtB5aCZjvgeOaAw8ZiMxtiMClScn2mu-gA==
x-cache-hits: 0

GET
H2 200 angry-512x512.png
c.disquscdn.com/next/current/publisher-admin/assets/img/emoji/ Frame CBC6 17 KB
18 KB 20ms
19ms Image
image/png 2600:9000:2190:6600:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/next/current/publisher-admin/assets/img/emoji/angry-512x512.png

Requested by

Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2190:6600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

8630d3642f52a29b6198da00f23f7bd2481ad1cc19becfcf441a6c4ffe4ae099

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=50703%20https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D50703&t_u=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F&t_e=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&t_d=%0A%09%09%09%09%09New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia%09%09%09%09&t_t=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:51:37 GMT
via: 1.1 e1532b3ffd3d84bfecb9972a863a75ef.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 32
x-cache: Hit from cloudfront
content-length: 17794
x-xss-protection: 1; mode=block
x-served-by: static-web-1
last-modified: Tue, 24 Aug 2021 21:06:44 GMT
server: nginx
etag: "61255f64-4582"
content-type: image/png
access-control-allow-origin: *
expires: Fri, 27 Aug 2021 14:56:33 GMT
cache-control: max-age=300, public
x-amz-cf-pop: ZRH50-C1
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: T7B3CeHEZL5gtaETGYBEJtV8eXfqouaCGTcEr6jj9Vj1A-cHVn3uRQ==
x-cache-hits: 0

GET
H2 200 sad-512x512.png
c.disquscdn.com/next/current/publisher-admin/assets/img/emoji/ Frame CBC6 9 KB
9 KB 20ms
19ms Image
image/png 2600:9000:2190:6600:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/next/current/publisher-admin/assets/img/emoji/sad-512x512.png

Requested by

Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2190:6600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

11c401a81e32b086bea3798c033009907b429fb601411da6ffc266b78184898a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=50703%20https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D50703&t_u=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F&t_e=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&t_d=%0A%09%09%09%09%09New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia%09%09%09%09&t_t=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:51:32 GMT
via: 1.1 e1532b3ffd3d84bfecb9972a863a75ef.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 37
x-cache: Hit from cloudfront
content-length: 8986
x-xss-protection: 1; mode=block
x-served-by: static-web-1
last-modified: Tue, 24 Aug 2021 21:06:44 GMT
server: nginx
etag: "61255f64-231a"
content-type: image/png
access-control-allow-origin: *
expires: Fri, 27 Aug 2021 14:56:32 GMT
cache-control: max-age=300, public
x-amz-cf-pop: ZRH50-C1
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: CU_JHW8YOweJPIJVTEnmbtvmVlkJe3QhJGyMCy1_9vqnbK1X0BmTlw==
x-cache-hits: 0

GET
H2 200 svg-sprite.4da5413f5086c5755b46094b813dbfcd.svg
c.disquscdn.com/next/embed/assets/img/ Frame CBC6 13 KB
13 KB 16ms
16ms Image
image/svg+xml 2600:9000:2190:6600:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/next/embed/assets/img/svg-sprite.4da5413f5086c5755b46094b813dbfcd.svg

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.8affdad980167da3f2dd9f1e933d0669.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2190:6600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

3270642c89180c12db93775e2a774b6dadd9bd98cffc963075c85afd2c17b6e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://c.disquscdn.com/next/embed/styles/lounge.8affdad980167da3f2dd9f1e933d0669.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 28 Apr 2021 14:37:41 GMT
via: 1.1 e1532b3ffd3d84bfecb9972a863a75ef.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 10455268
x-cache: Hit from cloudfront
content-length: 13079
x-xss-protection: 1; mode=block
x-served-by: static-web-1
surrogate-key: next
last-modified: Tue, 27 Apr 2021 21:01:56 GMT
server: nginx
etag: "60887bc4-3317"
content-type: image/svg+xml; charset=utf-8
access-control-allow-origin: *
expires: Thu, 28 Apr 2022 14:37:41 GMT
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: ZRH50-C1
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: tT3ZhfgjLfLYsZ2htoxMtBIiTcuYVSTSfxt4rRmqCJh0dtrsqTKiVg==
x-cache-hits: 0

GET
H2 200 sdk.js Show response
connect.facebook.net/en_US/ Frame CBC6 3 KB
2 KB 8ms
7ms Script
application/x-javascript 2a03:2880:f02d:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.ee2555081038338ea4f41cbb3ea1bc17.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

2ee2bb70afdb2ebfc8248fba3e4b872c4d1f0a6c03e9c93872b294c9fa28b463

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=50703%20https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D50703&t_u=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F&t_e=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&t_d=%0A%09%09%09%09%09New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia%09%09%09%09&t_t=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: PekLNPX+qBSd1Ec0vMLznA==
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 1687
x-fb-rlafr: 0
x-fb-debug: qeZwbUQ8uIXL7JghMwlqMjanHh/5DByTZu5c33HGlTSuOTy02IwZAlDSMln4WUuF1hh9Kty0OnJgGZlvdZGEGA==
x-fb-trip-id: 917726464
x-fb-content-md5: 29479618d196c51a40e8f44058d6d64f
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Fri, 27 Aug 2021 14:52:09 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=1200,stale-while-revalidate=3600
etag: "98c64bef7907add06dab6224b124b409"
timing-allow-origin: *
priority: u=3,i
expires: Fri, 27 Aug 2021 15:07:38 GMT

GET
H2 200 api.js Show response
apis.google.com/js/ Frame CBC6 12 KB
5 KB 41ms
41ms Script
application/javascript 2a00:1450:4001:812::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/js/api.js

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.ee2555081038338ea4f41cbb3ea1bc17.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

0e3dae461ad9a493bcdab76a541bd225fd14a4a65ea481150aa4c4a2a0e936d4

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-osbYLBcU1BRM7jucpOuT6Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=50703%20https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D50703&t_u=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F&t_e=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&t_d=%0A%09%09%09%09%09New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia%09%09%09%09&t_t=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
x-ua-compatible: IE=edge, chrome=1
server: ESF
x-frame-options: SAMEORIGIN
etag: "2032ed7942a5d34892536c671c2a0068"
strict-transport-security: max-age=31536000
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=1800, stale-while-revalidate=1800
content-security-policy: script-src 'report-sample' 'nonce-osbYLBcU1BRM7jucpOuT6Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
timing-allow-origin: *
expires: Fri, 27 Aug 2021 14:52:09 GMT

GET
H3-29 200 sdk.js Show response
connect.facebook.net/en_US/ Frame CBC6 235 KB
68 KB 11ms
9ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js?hash=007ab7ee487b8503c0591fc630599753

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

c4df9527881456ebbf272ad8fdf150848de9d735af27b9312e320cef160ade1d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Origin: https://disqus.com
Referer: https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=50703%20https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D50703&t_u=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F&t_e=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&t_d=%0A%09%09%09%09%09New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia%09%09%09%09&t_t=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: 8mFy+rAyqV69vUL/qq0bjA==
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 69779
x-fb-rlafr: 0
x-fb-debug: 4EyK4raHXAlIAwwi/UPYm82I6k+pYoQ+IcDtjOfbi/lgOJ2pNF+QnL0AU51hpvxl2jZC8O9ypekqj0Yc06CCHQ==
x-fb-content-md5: cd32bd07c291aef86ff07fc4f6f4d015
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Fri, 27 Aug 2021 14:52:09 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
etag: "738ef0e94e414596d31d6e4acbb15286"
timing-allow-origin: *
priority: u=3,i
expires: Sat, 27 Aug 2022 12:21:53 GMT

GET
H2 200 status
www.facebook.com/x/oauth/ Frame CBC6 0
0 35ms
35ms Fetch
text/plain 2a03:2880:f12d:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/x/oauth/status?ancestor_origins=https%3A%2F%2Fblog.malwarebytes.com&client_id=52254943976&input_token&origin=1&redirect_uri=https%3A%2F%2Fdisqus.com%2Fembed%2Fcomments%2F%3Fbase%3Ddefault%26f%3Dmalwarebytesunpacked%26t_i%3D50703%2520https%253A%252F%252Fblog.malwarebytes.com%252F%253Fp%253D50703%26t_u%3Dhttps%253A%252F%252Fblog.malwarebytes.com%252Fthreat-intelligence%252F2021%252F08%252Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%252F%26t_e%3DNew%2520variant%2520of%2520Konni%2520malware%2520used%2520in%2520campaign%2520targetting%2520Russia%26t_d%3D%250A%2509%2509%2509%2509%2509New%2520variant%2520of%2520Konni%2520malware%2520used%2520in%2520campaign%2520targetting%2520Russia%2509%2509%2509%2509%26t_t%3DNew%2520variant%2520of%2520Konni%2520malware%2520used%2520in%2520campaign%2520targetting%2520Russia%26s_o%3Ddefault%23version%3D53c39e0ce65e4eb0af505908f71410f5&sdk=joey&wants_cookie_data=false

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.ee2555081038338ea4f41cbb3ea1bc17.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://disqus.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
x-content-type-options: nosniff
content-security-policy-report-only: default-src 'self' data: blob: https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src connect.facebook.net static.xx.fbcdn.net 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net data:;connect-src wss://gateway.facebook.com wss://edge-chat.facebook.com *.facebook.com *.fbcdn.net wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info *.atdmt.com blob: android-webview-video-poster:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com *.atdmt.com;worker-src blob:;report-uri https://www.facebook.com/csp/reporting/?minimize=0;
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 0
x-fb-rlafr: 0
pragma: no-cache
x-fb-debug: Hz2fq3l7QWWODfs4qVL//8JOVJ7e6ye0f/WuAdbbeefG50+559cgP3xXUfnMKTEHCKZ/ghYoRt0L3DLBjvrxHQ==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
fb-s: unknown
cross-origin-opener-policy: same-origin-allow-popups
date: Fri, 27 Aug 2021 14:52:09 GMT
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}],"group":"coep_report"}
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://disqus.com
access-control-expose-headers: fb-s
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3-29 200 cb=gapi.loaded_0 Show response
apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.a6RGRpfcCJc.O/m=auth2/rt=j/sv=1/d=1/ed=1/am=AQ/rs=AGLTcCMTvVGaCqN55uYyIRle9gw0SP9pNw/ Frame CBC6 103 KB
34 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:812::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.a6RGRpfcCJc.O/m=auth2/rt=j/sv=1/d=1/ed=1/am=AQ/rs=AGLTcCMTvVGaCqN55uYyIRle9gw0SP9pNw/cb=gapi.loaded_0

Requested by

Host: apis.google.com
URL: https://apis.google.com/js/api.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

368d7839a4853a0d5abfe3d384f513702a0339d6e10ed2f7651b4ec1de2780dd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=50703%20https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D50703&t_u=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F&t_e=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&t_d=%0A%09%09%09%09%09New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia%09%09%09%09&t_t=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 26 Aug 2021 18:30:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 73314
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34974
x-xss-protection: 0
last-modified: Wed, 25 Aug 2021 15:22:19 GMT
server: sffe
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
expires: Fri, 26 Aug 2022 18:30:15 GMT

GET
H2 200 iframe Show response
accounts.google.com/o/oauth2/ Frame C99B 513 B
547 B 18ms
17ms Document
text/html 2a00:1450:4001:80e::200d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.google.com/o/oauth2/iframe

Requested by

Host: apis.google.com
URL: https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.a6RGRpfcCJc.O/m=auth2/rt=j/sv=1/d=1/ed=1/am=AQ/rs=AGLTcCMTvVGaCqN55uYyIRle9gw0SP9pNw/cb=gapi.loaded_0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::200d Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

8e66ba8ec81710f183e83e210e60f2ea6499f2eb97d1e04178282f7149736a4f

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-X+gMRh7a9rOH5LPLX+XdAA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /o/cspreport
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: accounts.google.com
:scheme: https
:path: /o/oauth2/iframe
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=50703%20https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D50703&t_u=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F&t_e=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&t_d=%0A%09%09%09%09%09New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia%09%09%09%09&t_t=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&s_o=default
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: NID=222=XmPJCcfoKVGB1CCayqu5AVeqh01NuXwts2nRTk-qn42aeVXvxc0t3Xefhu-oGdSnBpdMr-R0mkn-4t9iZFU6GjdSUIoGUUAFH5BauSpiaEE94ad-yqumh3-Ix90Vu9TLCMvPmmVSd-84Pw3OY76ivKtXD_yCBfkS6gPmHeAqxQ8
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=50703%20https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D50703&t_u=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F&t_e=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&t_d=%0A%09%09%09%09%09New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia%09%09%09%09&t_t=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&s_o=default

Response headers

content-type: text/html; charset=utf-8
cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Fri, 27 Aug 2021 14:52:09 GMT
content-language: en-US
content-security-policy: script-src 'report-sample' 'nonce-X+gMRh7a9rOH5LPLX+XdAA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /o/cspreport
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 4131297854-idpiframe.js Show response
ssl.gstatic.com/accounts/o/ Frame C99B 116 KB
40 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ssl.gstatic.com/accounts/o/4131297854-idpiframe.js

Requested by

Host: accounts.google.com
URL: https://accounts.google.com/o/oauth2/iframe

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3f078a6a996e6a1628c6ddaece1d440c38441c4fd3051beb5a4948ff44421032

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://accounts.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 26 Aug 2021 13:53:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 89920
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/federated-signon-mpm-access
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40499
x-xss-protection: 0
last-modified: Fri, 20 Aug 2021 20:31:40 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 26 Aug 2022 13:53:29 GMT

GET
H3-29 200 iframerpc Show response
accounts.google.com/o/oauth2/ Frame C99B 14 B
58 B 25ms
23ms XHR
application/json 2a00:1450:4001:812::200d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.google.com/o/oauth2/iframerpc?action=checkOrigin&origin=https%3A%2F%2Fdisqus.com&client_id=508198334196-bgmagrg0a2rub674g0shidj8fnd50dji.apps.googleusercontent.com

Requested by

Host: ssl.gstatic.com
URL: https://ssl.gstatic.com/accounts/o/4131297854-idpiframe.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::200d Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

8daf09a6fc31937457dd77e9c25ce4b21349d605b561a8c5d557841bf964c9a0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://accounts.google.com/o/oauth2/iframe
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
X-Requested-With: XmlHttpRequest

Response headers

date: Fri, 27 Aug 2021 14:52:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
content-type: application/json; charset=utf-8
cache-control: public, max-age=3600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
expires: Fri, 27 Aug 2021 15:52:09 GMT

GET
H2 200 noavatar92.png
a.disquscdn.com/1624570071/images/ Frame CBC6 2 KB
2 KB 7ms
7ms Image
image/png 151.101.14.49
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://a.disquscdn.com/1624570071/images/noavatar92.png

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/lounge.bundle.dc50d72ac077058faccdd9a761fea0bc.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.14.49 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

36ef66124133ca33c8b44c487293c3180e5ab681ff3cad3c728ea4f894ec3444

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=50703%20https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D50703&t_u=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F&t_e=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&t_d=%0A%09%09%09%09%09New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia%09%09%09%09&t_t=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:09 GMT
x-content-type-options: nosniff
last-modified: Fri, 26 Feb 2021 20:50:09 GMT
server: nginx
age: 1826424
etag: "60395f01-66c"
strict-transport-security: max-age=300; includeSubdomains
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
x-xss-protection: 1; mode=block
cache-control: max-age=2592000
x-amz-cf-pop: FRA2-C2
content-type: image/png
content-length: 1644
x-amz-cf-id: PbMVeM2iWmudwIaI31RBJmSVugFre_LpJLL2G4ilL6tNFDLra-hEMw==
expires: Fri, 06 Aug 2021 11:31:45 GMT

GET
H/1.1 200
OK event.gif
referrer.disqus.com/juggler/ Frame CBC6 43 B
295 B 119ms
101ms Image
image/gif 151.101.12.134
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://referrer.disqus.com/juggler/event.gif?abe=0&embed_hidden=0&integration=wordpress%203.0.21&load_time=444&event=init_embed&thread=8733192328&forum=malwarebytesunpacked&forum_id=3107640&imp=qkg113nbv56d&prev_imp&thread_slug=new_variant_of_konni_malware_used_in_campaign_targetting_russia&user_type=anon&referrer=https%3A%2F%2Fblog.malwarebytes.com%2F&theme=next&dnt=0&tracking_enabled=0&experiment=network_default_hidden&variant=fallthrough&service=dynamic&promoted_enabled=false&max_enabled=false

Requested by

Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.12.134 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=50703%20https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D50703&t_u=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F&t_e=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&t_d=%0A%09%09%09%09%09New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia%09%09%09%09&t_t=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Fri, 27 Aug 2021 14:52:09 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT
Server: nginx
Content-Type: image/gif
Connection: keep-alive
Content-Length: 43
X-XSS-Protection: 1; mode=block

GET
H3-29

200

activityi;dc_pre=CPvRlYa60fICFZXO1Qoduh0MOw;src=5118230;type=count0;cat=secur00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1;num=4345294801504.378 Show response
5118230.fls.doubleclick.net/ Frame A5A4
Redirect Chain

https://5118230.fls.doubleclick.net/activityi;src=5118230;type=count0;cat=secur00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1;num=4345294801504.378?
https://5118230.fls.doubleclick.net/activityi;dc_pre=CPvRlYa60fICFZXO1Qoduh0MOw;src=5118230;type=count0;cat=secur00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1;num=4345294801504.378?

500 B
412 B

47ms
24ms

Document
text/html

142.250.186.166
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://5118230.fls.doubleclick.net/activityi;dc_pre=CPvRlYa60fICFZXO1Qoduh0MOw;src=5118230;type=count0;cat=secur00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1;num=4345294801504.378?

Requested by

Host: www.malwarebytes.com
URL: https://www.malwarebytes.com/js/jquery-1.11.3.min.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.166 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f6.1e100.net

Software

cafe /

Resource Hash

d57ba6e41a327ee60daeefa194dc0248880363fb978a2579085a2be5bc6c2017

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 5118230.fls.doubleclick.net
:scheme: https
:path: /activityi;dc_pre=CPvRlYa60fICFZXO1Qoduh0MOw;src=5118230;type=count0;cat=secur00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1;num=4345294801504.378?
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://blog.malwarebytes.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://blog.malwarebytes.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Fri, 27 Aug 2021 14:52:10 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
strict-transport-security: max-age=21600
content-type: text/html; charset=UTF-8
pragma: no-cache
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 387
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Fri, 27-Aug-2021 15:07:10 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Fri, 27 Aug 2021 14:52:10 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
follow-only-when-prerender-shown: 1
strict-transport-security: max-age=21600
location: https://5118230.fls.doubleclick.net/activityi;dc_pre=CPvRlYa60fICFZXO1Qoduh0MOw;src=5118230;type=count0;cat=secur00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1;num=4345294801504.378?
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK embed.js Show response
malwarebytesunpacked.disqus.com/ 74 KB
25 KB 130ms
130ms Script
application/javascript 151.101.12.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://malwarebytesunpacked.disqus.com/embed.js?_=1630075927504

Requested by

Host: www.malwarebytes.com
URL: https://www.malwarebytes.com/js/jquery-1.11.3.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.12.134 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

openresty /

Resource Hash

5df62ed830a14fa40b57484791205772a584eb96373d1f2c7a5e6d1feac53ed2

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Fri, 27 Aug 2021 14:52:10 GMT
Content-Encoding: gzip
Server: openresty
Age: 0
Vary: Accept-Encoding
Connection: keep-alive
Content-Type: application/javascript; charset=utf-8
Cache-Control: private, max-age=60
X-Service: router
Strict-Transport-Security: max-age=300; includeSubdomains
Link: <https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
Content-Length: 24674

GET
H/1.1 200
OK embed.js Show response
malwarebytesunpacked.disqus.com/ 74 KB
25 KB 150ms
150ms Script
application/javascript 151.101.12.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://malwarebytesunpacked.disqus.com/embed.js?_=1630075927505

Requested by

Host: www.malwarebytes.com
URL: https://www.malwarebytes.com/js/jquery-1.11.3.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.12.134 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

openresty /

Resource Hash

5df62ed830a14fa40b57484791205772a584eb96373d1f2c7a5e6d1feac53ed2

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Fri, 27 Aug 2021 14:52:10 GMT
Content-Encoding: gzip
Server: openresty
Age: 0
Vary: Accept-Encoding
Connection: keep-alive
Content-Type: application/javascript; charset=utf-8
Cache-Control: private, max-age=60
X-Service: router
Strict-Transport-Security: max-age=300; includeSubdomains
Link: <https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
Content-Length: 24674

GET
H2 200 2893.js Show response
script.crazyegg.com/pages/scripts/0081/ 5 KB
2 KB 45ms
18ms Script
text/javascript 2606:4700::6813:9408
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/scripts/0081/2893.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKSKW3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6813:9408 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf16a6be9c1f8d220216cd8bc2d5a7d68731c383f8a1d394c2727e7564a9ca7a

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:10 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 7054
cf-polished: origSize=4899
cf-ray: 68561f43685f4ed9-FRA
ce-version: 11.1.331
last-modified: Fri, 27 Aug 2021 12:54:36 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
access-control-expose-headers: CE-Version
cache-control: public, max-age=300, s-maxage=1209600
timing-allow-origin: *
cf-bgj: minify

GET
H/1.1 200
OK insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 5 KB
2 KB 9ms
8ms Script
application/x-javascript 2a02:26f0:6c00:296::25ea
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKSKW3
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:296::25ea Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: fed785a6a8ca96fb67230fec5d85f9c508db49f4075aa0ef284af56cd89813e3

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Fri, 27 Aug 2021 14:52:10 GMT
Content-Encoding: gzip
Last-Modified: Fri, 13 Aug 2021 21:34:05 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=26942
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2036

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 6 KB
2 KB 31ms
7ms Script
application/javascript 151.101.12.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: blog.malwarebytes.com
URL: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.12.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 7e8ee8f9d56ca7e35629a7c16b9f1c09fbb1e7d19fe922833a2f4edec48bfeea

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:10 GMT
via: 1.1 varnish
last-modified: Wed, 25 Aug 2021 16:20:44 GMT
age: 56011
etag: "934b8997f9fc81b2d0e16fca4cd0b8bb+gzip"
vary: Accept-Encoding,Host
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
content-encoding: gzip
cache-control: no-cache
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
content-length: 2119
x-timer: S1630075930.145366,VS0,VE0
x-served-by: cache-fra19161-FRA

GET
H2 200 /
insight.adsrvr.org/track/pxl/ 70 B
261 B 132ms
30ms Image
image/gif 52.30.148.233
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://insight.adsrvr.org/track/pxl/?adv=jtuxrxn&ct=0:fyckj1z&fmt=3
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.30.148.233 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-30-148-233.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Aug 2021 14:52:10 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H2 200 up Show response
insight.adsrvr.org/track/ Frame 51A8 0
181 B 131ms
30ms Document
text/html 52.30.148.233
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://insight.adsrvr.org/track/up?adv=8mirph5&ref=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F&upid=r8yigtp&upv=1.1.0
Requested by: Host: js.adsrvr.org
URL: https://js.adsrvr.org/up_loader.1.1.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.30.148.233 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-30-148-233.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:method: GET
:authority: insight.adsrvr.org
:scheme: https
:path: /track/up?adv=8mirph5&ref=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F&upid=r8yigtp&upv=1.1.0
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://blog.malwarebytes.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://blog.malwarebytes.com/

Response headers

date: Fri, 27 Aug 2021 14:52:10 GMT
content-type: text/html
cache-control: private,no-cache, must-revalidate
pragma: no-cache
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
660 B 203ms
131ms Script
application/javascript 104.244.42.195
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?type=javascript&version=2.0.3&p_id=Twitter&p_user_id=0&txn_id=o1m5j&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F

Requested by

Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.195 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 57
x-xss-protection: 0
pragma: no-cache
last-modified: Fri, 27 Aug 2021 14:52:10 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: c01848372703906feaa17d972576d9323d702227c1367187387c771d9f211065
x-transaction: e803935230ef9734
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 adsct
t.co/i/ 43 B
455 B 206ms
135ms Image
image/gif 104.244.42.5
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?type=javascript&version=2.0.3&p_id=Twitter&p_user_id=0&txn_id=o1m5j&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tw_document_href=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.5 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
pragma: no-cache
last-modified: Fri, 27 Aug 2021 14:52:10 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=0
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: ddda148fef71e2abcdf56759443ef046cfc209cd2696b4c134786877bf8a3329
x-transaction: 072ae2d3384c0579
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 2893.json Show response
script.crazyegg.com/pages/data-scripts/0081/ 4 KB
2 KB 35ms
18ms XHR
application/json 2606:4700::6813:9408
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/data-scripts/0081/2893.json?t=1
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0081/2893.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6813:9408 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 96ee2b969ffa7878f9448432c9f983f6a1db3ff43f24725c65ec9e7f3a101e3a

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:10 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 7053
ce-version: 11.1.331
content-length: 1407
timing-allow-origin: *
last-modified: Fri, 27 Aug 2021 12:54:36 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
access-control-expose-headers: CE-Version
cache-control: public, max-age=300, s-maxage=1209600
accept-ranges: bytes
cf-ray: 68561f43ab4c2b1e-FRA

GET
H2 200 / Show response
adservice.google.com/ddm/fls/i/dc_pre=CPvRlYa60fICFZXO1Qoduh0MOw;src=5118230;type=count0;cat=secur00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1;num=4345294801504.378;~oref=https://blo... Frame D2B4 499 B
457 B 37ms
37ms Document
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/ddm/fls/i/dc_pre=CPvRlYa60fICFZXO1Qoduh0MOw;src=5118230;type=count0;cat=secur00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1;num=4345294801504.378;~oref=https://blog.malwarebytes.com/

Requested by

Host: 5118230.fls.doubleclick.net
URL: https://5118230.fls.doubleclick.net/activityi;dc_pre=CPvRlYa60fICFZXO1Qoduh0MOw;src=5118230;type=count0;cat=secur00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1;num=4345294801504.378?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bae4bca72ab90a280ae93fa72942b62ae9bbfb3abe6a432d53b89a1ef472b3b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: adservice.google.com
:scheme: https
:path: /ddm/fls/i/dc_pre=CPvRlYa60fICFZXO1Qoduh0MOw;src=5118230;type=count0;cat=secur00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1;num=4345294801504.378;~oref=https://blog.malwarebytes.com/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://5118230.fls.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: NID=222=XmPJCcfoKVGB1CCayqu5AVeqh01NuXwts2nRTk-qn42aeVXvxc0t3Xefhu-oGdSnBpdMr-R0mkn-4t9iZFU6GjdSUIoGUUAFH5BauSpiaEE94ad-yqumh3-Ix90Vu9TLCMvPmmVSd-84Pw3OY76ivKtXD_yCBfkS6gPmHeAqxQ8
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://5118230.fls.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Fri, 27 Aug 2021 14:52:10 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
content-type: text/html; charset=UTF-8
pragma: no-cache
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 387
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 lounge.8affdad980167da3f2dd9f1e933d0669.css
c.disquscdn.com/next/embed/styles/ 0
26 KB 20ms
11ms Other
text/css 2600:9000:2190:6600:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/styles/lounge.8affdad980167da3f2dd9f1e933d0669.css

Requested by

Host: malwarebytesunpacked.disqus.com
URL: https://malwarebytesunpacked.disqus.com/embed.js?_=1630075927504

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2190:6600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 19 Aug 2021 19:29:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 674581
x-cache: Hit from cloudfront
content-length: 25754
x-xss-protection: 1; mode=block
x-served-by: static-web-1
access-control-allow-origin: *
surrogate-key: next
last-modified: Thu, 19 Aug 2021 18:18:14 GMT
server: nginx
etag: "611ea066-649a"
content-type: text/css; charset=utf-8
via: 1.1 e1532b3ffd3d84bfecb9972a863a75ef.cloudfront.net (CloudFront)
expires: Fri, 19 Aug 2022 19:29:09 GMT
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: ZRH50-C1
timing-allow-origin: *
x-amz-cf-id: nVi0LdsYULTsiSgOa9bCdyrdIb_GGG_uEDtXVHlwA2pwUCBNdS-W7Q==
x-cache-hits: 0

GET
H2 200 common.bundle.ee2555081038338ea4f41cbb3ea1bc17.js
c.disquscdn.com/next/embed/ 0
93 KB 18ms
12ms Other
application/javascript 2600:9000:2190:6600:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/common.bundle.ee2555081038338ea4f41cbb3ea1bc17.js

Requested by

Host: malwarebytesunpacked.disqus.com
URL: https://malwarebytesunpacked.disqus.com/embed.js?_=1630075927504

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2190:6600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 19 Jul 2021 20:07:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3350697
x-cache: Hit from cloudfront
content-length: 94790
x-xss-protection: 1; mode=block
x-served-by: static-web-1
access-control-allow-origin: *
surrogate-key: next
last-modified: Mon, 19 Jul 2021 19:39:06 GMT
server: nginx
etag: "60f5d4da-17246"
content-type: application/javascript; charset=utf-8
via: 1.1 e1532b3ffd3d84bfecb9972a863a75ef.cloudfront.net (CloudFront)
expires: Tue, 19 Jul 2022 20:07:13 GMT
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: ZRH50-C1
timing-allow-origin: *
x-amz-cf-id: SoBJMpoGcAWthShQ0boAHdBnOYa6UGlzLqoOBslrqhj0MGmVNkntrw==
x-cache-hits: 0

GET
H2 200 lounge.bundle.dc50d72ac077058faccdd9a761fea0bc.js
c.disquscdn.com/next/embed/ 0
118 KB 24ms
18ms Other
application/javascript 2600:9000:2190:6600:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/lounge.bundle.dc50d72ac077058faccdd9a761fea0bc.js

Requested by

Host: malwarebytesunpacked.disqus.com
URL: https://malwarebytesunpacked.disqus.com/embed.js?_=1630075927504

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2190:6600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 21:21:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 235811
x-cache: Hit from cloudfront
content-length: 120189
x-xss-protection: 1; mode=block
x-served-by: static-web-2
access-control-allow-origin: *
surrogate-key: next
last-modified: Tue, 24 Aug 2021 21:06:44 GMT
server: nginx
etag: "61255f64-1d57d"
content-type: application/javascript; charset=utf-8
via: 1.1 e1532b3ffd3d84bfecb9972a863a75ef.cloudfront.net (CloudFront)
expires: Wed, 24 Aug 2022 21:21:59 GMT
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: ZRH50-C1
timing-allow-origin: *
x-amz-cf-id: 8fmRVV6wkGLYpl-syqTVTZcm_jfyf9OdN1d7xvEHj4BvZ-mHZwZUZg==
x-cache-hits: 0

GET
H/1.1 200
OK config.js
disqus.com/next/ 0
13 KB 13ms
8ms Other
application/javascript 151.101.192.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://disqus.com/next/config.js

Requested by

Host: malwarebytesunpacked.disqus.com
URL: https://malwarebytesunpacked.disqus.com/embed.js?_=1630075927504

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.192.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Fri, 27 Aug 2021 14:52:10 GMT
X-Content-Type-Options: nosniff
Content-Type: application/javascript; charset=UTF-8
Server: nginx
Age: 39
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=300; includeSubdomains
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Access-Control-Allow-Origin: *
Cache-Control: public, stale-while-revalidate=300, s-stalewhilerevalidate=3600, max-age=60
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 12357
X-XSS-Protection: 1; mode=block

GET
H2 200 11.1.331.js Show response
script.crazyegg.com/pages/versioned/common-scripts/ 64 KB
21 KB 20ms
14ms Script
text/javascript 2606:4700::6813:9408
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/versioned/common-scripts/11.1.331.js
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0081/2893.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6813:9408 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1882996e48b3b800108df06670df431af4a6f9b18eb54f4a74c0d601af52c641

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 27 Aug 2021 14:52:10 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Wed, 25 Aug 2021 14:00:21 GMT
server: cloudflare
age: 7064
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=31536000
accept-ranges: bytes
cf-ray: 68561f43e9314ed9-FRA
content-length: 21512

GET
H3-29

200

/ Show response
5118230.fls.doubleclick.net/ddm/fls/r/dc_pre=CPvRlYa60fICFZXO1Qoduh0MOw;src=5118230;type=count0;cat=secur00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1;num=4345294801504.378;~oref=http... Frame F8F4
Redirect Chain

https://adservice.google.de/ddm/fls/i/dc_pre=CPvRlYa60fICFZXO1Qoduh0MOw;src=5118230;type=count0;cat=secur00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1;num=4345294801504.378;~oref=http...
https://5118230.fls.doubleclick.net/ddm/fls/r/dc_pre=CPvRlYa60fICFZXO1Qoduh0MOw;src=5118230;type=count0;cat=secur00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1;num=4345294801504.378;~o...

281 B
256 B

20ms
20ms

Document
text/html

142.250.186.166
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://5118230.fls.doubleclick.net/ddm/fls/r/dc_pre=CPvRlYa60fICFZXO1Qoduh0MOw;src=5118230;type=count0;cat=secur00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1;num=4345294801504.378;~oref=https://blog.malwarebytes.com/

Requested by

Host: adservice.google.com
URL: https://adservice.google.com/ddm/fls/i/dc_pre=CPvRlYa60fICFZXO1Qoduh0MOw;src=5118230;type=count0;cat=secur00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1;num=4345294801504.378;~oref=https://blog.malwarebytes.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.166 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f6.1e100.net

Software

cafe /

Resource Hash

f5d76a935b040c53784ebb3016c9d146ba823443eec42ee26fc2371304598757

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 5118230.fls.doubleclick.net
:scheme: https
:path: /ddm/fls/r/dc_pre=CPvRlYa60fICFZXO1Qoduh0MOw;src=5118230;type=count0;cat=secur00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1;num=4345294801504.378;~oref=https://blog.malwarebytes.com/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://adservice.google.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://adservice.google.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Fri, 27 Aug 2021 14:52:10 GMT
expires: Fri, 27 Aug 2021 14:52:10 GMT
cache-control: private, max-age=0
strict-transport-security: max-age=21600
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 231
x-xss-protection: 0
set-cookie: IDE=AHWqTUlxfgDmJFvCVyJL7lxAe-2xk7Xt4Tvyzda7zNzEsLaymBEjGul0oAPKc7QcGeU; expires=Wed, 21-Sep-2022 14:52:10 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none test_cookie=; expires=Fri, 01-Aug-2008 22:45:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Fri, 27 Aug 2021 14:52:10 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
location: https://5118230.fls.doubleclick.net/ddm/fls/r/dc_pre=CPvRlYa60fICFZXO1Qoduh0MOw;src=5118230;type=count0;cat=secur00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1;num=4345294801504.378;~oref=https://blog.malwarebytes.com/
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"

GET
H2 200 2893.json Show response
script.crazyegg.com/pages/sampling-data-scripts/0081/ 46 B
153 B 19ms
19ms XHR
application/json 2606:4700::6813:9408
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/sampling-data-scripts/0081/2893.json?t=452798
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/versioned/common-scripts/11.1.331.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6813:9408 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 980492bbf045d8206f17ebd8c3663da75806353a3cc4958b63dd35ba7fcb2c51

Request headers

Referer: https://blog.malwarebytes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:10 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 7053
ce-version: 11.1.331
content-length: 65
timing-allow-origin: *
last-modified: Fri, 27 Aug 2021 12:54:37 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
access-control-expose-headers: CE-Version
cache-control: public, max-age=300, s-maxage=1209600
accept-ranges: bytes
cf-ray: 68561f441bfc2b1e-FRA

GET
H/1.1 200
OK / Show response
disqus.com/embed/comments/ Frame 89A5 7 KB
4 KB 8ms
8ms Document
text/html 151.101.192.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: malwarebytesunpacked.disqus.com
URL: https://malwarebytesunpacked.disqus.com/embed.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.192.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

5c222890d05dad942e8179621c10021658794c5d8bd1e10539e0ec6dd60590d7

Security Headers

Name	Value
Content-Security-Policy	script-src https://.twitter.com: https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://.services.disqus.com: https://cdn.boomtrain.com/p13n/ https://apis.google.com https://cdn.syndication.twimg.com/tweets.json https://connect.facebook.net/en_US/sdk.js https://referrer.disqus.com/juggler/ 'unsafe-inline' https://com-disqus.netmng.com:* https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Host: disqus.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://blog.malwarebytes.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: __jid=qkg113nbv56d; disqus_unique=qkg3537ne7qu
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://blog.malwarebytes.com/

Response headers

Connection: keep-alive
Content-Length: 2939
Server: nginx
Content-Security-Policy: script-src https://*.twitter.com:* https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://*.services.disqus.com:* https://cdn.boomtrain.com/p13n/ https://apis.google.com https://cdn.syndication.twimg.com/tweets.json https://connect.facebook.net/en_US/sdk.js https://referrer.disqus.com/juggler/ 'unsafe-inline' https://com-disqus.netmng.com:* https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com
Link: <https://c.disquscdn.com>;rel=preconnect,<https://c.disquscdn.com>;rel=dns-prefetch
Cache-Control: stale-if-error=3600, s-stalewhilerevalidate=3600, stale-while-revalidate=30, no-cache, must-revalidate, public, s-maxage=5
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Content-Type: text/html; charset=utf-8
Last-Modified: Thu, 26 Aug 2021 05:03:31 GMT
ETag: W/"lounge:view:8733192328.19ec38c35e2ebdd73bda909808275906.2"
Referrer-Policy: no-referrer-when-downgrade
Content-Encoding: gzip
Date: Fri, 27 Aug 2021 14:52:10 GMT
Age: 2
Vary: Accept-Encoding
Strict-Transport-Security: max-age=300; includeSubdomains

GET lounge.load.53c39e0ce65e4eb0af505908f71410f5.js
c.disquscdn.com/next/embed/ Frame 89A5 0
0

GET
H/1.1 200
OK analytics.min.js Show response
cdn.bttrack.com/js/14102/analytics/1.0/ Frame F8F4 599 B
696 B 49ms
10ms Script
text/javascript 69.16.175.42
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.bttrack.com/js/14102/analytics/1.0/analytics.min.js
Requested by: Host: 5118230.fls.doubleclick.net
URL: https://5118230.fls.doubleclick.net/ddm/fls/r/dc_pre=CPvRlYa60fICFZXO1Qoduh0MOw;src=5118230;type=count0;cat=secur00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1;num=4345294801504.378;~oref=https://blog.malwarebytes.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 69.16.175.42 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS: hwcdn.net
Software: /
Resource Hash: fbf44047407fd1714993b1c5cebf5bf2b17915261b8c24ec8c70382b4d389ece

Request headers

Referer: https://5118230.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Fri, 27 Aug 2021 14:52:10 GMT
Content-Encoding: gzip
X-HW: 1630075930.dop227.fr8.t,1630075930.cds284.fr8.shn,1630075930.dop227.fr8.t,1630075930.cds241.fr8.c
Content-Type: text/javascript; charset=utf-8
Cache-Control: max-age=16875
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 368

GET
H/1.1 200
OK / Show response
disqus.com/embed/comments/ Frame 3BF7 7 KB
4 KB 8ms
7ms Document
text/html 151.101.192.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: malwarebytesunpacked.disqus.com
URL: https://malwarebytesunpacked.disqus.com/embed.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.192.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

5c222890d05dad942e8179621c10021658794c5d8bd1e10539e0ec6dd60590d7

Security Headers

Name	Value
Content-Security-Policy	script-src https://.twitter.com: https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://.services.disqus.com: https://cdn.boomtrain.com/p13n/ https://apis.google.com https://cdn.syndication.twimg.com/tweets.json https://connect.facebook.net/en_US/sdk.js https://referrer.disqus.com/juggler/ 'unsafe-inline' https://com-disqus.netmng.com:* https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Host: disqus.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://blog.malwarebytes.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: __jid=qkg113nbv56d; disqus_unique=qkg3537ne7qu
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://blog.malwarebytes.com/

Response headers

Connection: keep-alive
Content-Length: 2939
Server: nginx
Content-Security-Policy: script-src https://*.twitter.com:* https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://*.services.disqus.com:* https://cdn.boomtrain.com/p13n/ https://apis.google.com https://cdn.syndication.twimg.com/tweets.json https://connect.facebook.net/en_US/sdk.js https://referrer.disqus.com/juggler/ 'unsafe-inline' https://com-disqus.netmng.com:* https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com
Link: <https://c.disquscdn.com>;rel=preconnect,<https://c.disquscdn.com>;rel=dns-prefetch
Cache-Control: stale-if-error=3600, s-stalewhilerevalidate=3600, stale-while-revalidate=30, no-cache, must-revalidate, public, s-maxage=5
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Content-Type: text/html; charset=utf-8
Last-Modified: Thu, 26 Aug 2021 05:03:31 GMT
ETag: W/"lounge:view:8733192328.19ec38c35e2ebdd73bda909808275906.2"
Referrer-Policy: no-referrer-when-downgrade
Content-Encoding: gzip
Date: Fri, 27 Aug 2021 14:52:10 GMT
Age: 2
Vary: Accept-Encoding
Strict-Transport-Security: max-age=300; includeSubdomains

GET
H2 200 lounge.load.53c39e0ce65e4eb0af505908f71410f5.js Show response
c.disquscdn.com/next/embed/ Frame 3BF7 1 KB
1 KB 11ms
11ms Script
application/javascript 2600:9000:2190:6600:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/lounge.load.53c39e0ce65e4eb0af505908f71410f5.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2190:6600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

30da4c48d022cae31aecd5ed03eb37be68f9cf0ace03efc80eb2e1497cc55612

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Origin: https://disqus.com
Referer: https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=50703%20https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D50703&t_u=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F&t_e=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&t_d=%0A%09%09%09%09%09New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia%09%09%09%09&t_t=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 21:22:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 235810
x-cache: Hit from cloudfront
content-length: 534
x-xss-protection: 1; mode=block
x-served-by: static-web-2
access-control-allow-origin: *
surrogate-key: next
last-modified: Tue, 24 Aug 2021 21:06:44 GMT
server: nginx
etag: "61255f64-216"
content-type: application/javascript; charset=utf-8
via: 1.1 a2037d86ccb1a548f20827ebd95a65f3.cloudfront.net (CloudFront)
expires: Wed, 24 Aug 2022 21:22:00 GMT
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: ZRH50-C1
timing-allow-origin: *
x-amz-cf-id: iJaBZfHgPwgWynhqswDzChk0irrKMKmYcWyhvZSEQ1fGNLwYxmyKvw==
x-cache-hits: 0

GET
H2 200 common.bundle.ee2555081038338ea4f41cbb3ea1bc17.js Show response
c.disquscdn.com/next/embed/ Frame 3BF7 282 KB
93 KB 12ms
11ms Script
application/javascript 2600:9000:2190:6600:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/common.bundle.ee2555081038338ea4f41cbb3ea1bc17.js

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/lounge.load.53c39e0ce65e4eb0af505908f71410f5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2190:6600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

443211c7845e0012dea1dfe8cda1ce659e7fef3c7b5af2b470704ed8186945c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=50703%20https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D50703&t_u=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F&t_e=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&t_d=%0A%09%09%09%09%09New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia%09%09%09%09&t_t=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 19 Jul 2021 20:07:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3350697
x-cache: Hit from cloudfront
content-length: 94790
x-xss-protection: 1; mode=block
x-served-by: static-web-1
access-control-allow-origin: *
surrogate-key: next
last-modified: Mon, 19 Jul 2021 19:39:06 GMT
server: nginx
etag: "60f5d4da-17246"
content-type: application/javascript; charset=utf-8
via: 1.1 e1532b3ffd3d84bfecb9972a863a75ef.cloudfront.net (CloudFront)
expires: Tue, 19 Jul 2022 20:07:13 GMT
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: ZRH50-C1
timing-allow-origin: *
x-amz-cf-id: Yy7NUG_y0hP2QI-iHGmMvsvUvGNJDzEjQ1F1hpmCp2UYPFytUf1hfw==
x-cache-hits: 0

GET
H/1.1 200
OK js Show response
bttrack.com/engagement/ Frame F8F4 10 KB
4 KB 527ms
110ms Script
text/javascript 192.132.33.46
BIDTELLECT

General

Check archive.org

Show headers Download Go to

Full URL: https://bttrack.com/engagement/js?goalId=14102&cb=1630075930392
Requested by: Host: cdn.bttrack.com
URL: https://cdn.bttrack.com/js/14102/analytics/1.0/analytics.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 192.132.33.46 , United States, ASN18568 (BIDTELLECT, US),
Reverse DNS: 46.bidtellect.com
Software: Microsoft-IIS/8.5 /
Resource Hash: d55208289f2d86a2531d4bdca7a1d704fa38e5f268e0ada90f51545a809696d6

Request headers

Referer: https://5118230.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

X-ServerName: Track002-dc3
Pragma: no-cache
Date: Fri, 27 Aug 2021 14:51:47 GMT
Content-Encoding: gzip
X-AspNetMvc-Version: 5.2
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
P3P: CP="CAO DSP COR ADMo DEVo PSAo PSDo HISo IVAo IVDo OUR IND OTC"
Cache-Control: private,no-cache
Content-Type: text/javascript; charset=utf-8
Content-Length: 3517
Expires: -1

GET
H2 200 lounge.8affdad980167da3f2dd9f1e933d0669.css
c.disquscdn.com/next/embed/styles/ Frame 3BF7 161 KB
26 KB 12ms
11ms Stylesheet
text/css 2600:9000:2190:6600:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/styles/lounge.8affdad980167da3f2dd9f1e933d0669.css

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.ee2555081038338ea4f41cbb3ea1bc17.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2190:6600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

88e7deb2dcbccbe8fa97dfc6973ea174f0b3db01ace23c0d72a8228452171a5e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=50703%20https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D50703&t_u=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F&t_e=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&t_d=%0A%09%09%09%09%09New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia%09%09%09%09&t_t=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 19 Aug 2021 19:29:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 674581
x-cache: Hit from cloudfront
content-length: 25754
x-xss-protection: 1; mode=block
x-served-by: static-web-1
access-control-allow-origin: *
surrogate-key: next
last-modified: Thu, 19 Aug 2021 18:18:14 GMT
server: nginx
etag: "611ea066-649a"
content-type: text/css; charset=utf-8
via: 1.1 e1532b3ffd3d84bfecb9972a863a75ef.cloudfront.net (CloudFront)
expires: Fri, 19 Aug 2022 19:29:09 GMT
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: ZRH50-C1
timing-allow-origin: *
x-amz-cf-id: hTybaT6ziqyKU6aOqBOMvCDnojkhOeUTD9mgJ9FYXz4ti_cxTPVUTQ==
x-cache-hits: 0

GET
H2 200 lounge.bundle.dc50d72ac077058faccdd9a761fea0bc.js Show response
c.disquscdn.com/next/embed/ Frame 3BF7 465 KB
118 KB 12ms
11ms Script
application/javascript 2600:9000:2190:6600:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/lounge.bundle.dc50d72ac077058faccdd9a761fea0bc.js

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.ee2555081038338ea4f41cbb3ea1bc17.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2190:6600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

b1bb91151130d620bb916cf8f4b0ac0aa27ed9ab91da8aa3ecc1f845b317170d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=50703%20https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D50703&t_u=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F&t_e=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&t_d=%0A%09%09%09%09%09New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia%09%09%09%09&t_t=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 21:21:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 235811
x-cache: Hit from cloudfront
content-length: 120189
x-xss-protection: 1; mode=block
x-served-by: static-web-2
access-control-allow-origin: *
surrogate-key: next
last-modified: Tue, 24 Aug 2021 21:06:44 GMT
server: nginx
etag: "61255f64-1d57d"
content-type: application/javascript; charset=utf-8
via: 1.1 e1532b3ffd3d84bfecb9972a863a75ef.cloudfront.net (CloudFront)
expires: Wed, 24 Aug 2022 21:21:59 GMT
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: ZRH50-C1
timing-allow-origin: *
x-amz-cf-id: WjRhDEITV2bDDXQrcPrrSUK51jjNkdjmjQ9vEbPqKUr8xRr3eU8jZA==
x-cache-hits: 0

GET
H/1.1 200
OK config.js Show response
disqus.com/next/ Frame 3BF7 12 KB
13 KB 10ms
9ms Script
application/javascript 151.101.192.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://disqus.com/next/config.js

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.ee2555081038338ea4f41cbb3ea1bc17.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.192.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

4d90717f4917373623ee8fe964f4e559770f3764a3f95334ebe3c0da753df65e

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=50703%20https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D50703&t_u=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F&t_e=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&t_d=%0A%09%09%09%09%09New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia%09%09%09%09&t_t=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Fri, 27 Aug 2021 14:52:10 GMT
X-Content-Type-Options: nosniff
Content-Type: application/javascript; charset=UTF-8
Server: nginx
Age: 39
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=300; includeSubdomains
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Access-Control-Allow-Origin: *
Cache-Control: public, stale-while-revalidate=300, s-stalewhilerevalidate=3600, max-age=60
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 12357
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK details Show response
disqus.com/api/3.0/forums/ Frame 3BF7 3 KB
4 KB 115ms
115ms XHR
application/json 151.101.192.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://disqus.com/api/3.0/forums/details?forum=malwarebytesunpacked&attach=forumFeatures&api_key=E8Uh5l5fHZ6gD8U3KycjAIAk46f68Zw7C6eW8WSjZvCLXebZ7p0r1yrYDrLilk2F

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.ee2555081038338ea4f41cbb3ea1bc17.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.192.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

3c04dc33962483f3e11d05b43568d2a4f7fc83fa9020cb9391168d19d0e33f7a

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: */*
Referer: https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=50703%20https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D50703&t_u=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F&t_e=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&t_d=%0A%09%09%09%09%09New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia%09%09%09%09&t_t=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&s_o=default
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Fri, 27 Aug 2021 14:52:10 GMT
X-Content-Type-Options: nosniff
Server: nginx
Age: 0
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=300; includeSubdomains
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Connection: keep-alive
Content-Type: application/json
Vary: Origin, Cookie
Content-Length: 3266
X-XSS-Protection: 1; mode=block

GET
H2 200 noavatar92.png
a.disquscdn.com/1624570071/images/ Frame 3BF7 2 KB
2 KB 8ms
8ms Image
image/png 151.101.14.49
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://a.disquscdn.com/1624570071/images/noavatar92.png

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/lounge.bundle.dc50d72ac077058faccdd9a761fea0bc.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.14.49 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

36ef66124133ca33c8b44c487293c3180e5ab681ff3cad3c728ea4f894ec3444

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=50703%20https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D50703&t_u=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F&t_e=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&t_d=%0A%09%09%09%09%09New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia%09%09%09%09&t_t=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:10 GMT
x-content-type-options: nosniff
last-modified: Fri, 26 Feb 2021 20:50:09 GMT
server: nginx
age: 1826425
etag: "60395f01-66c"
strict-transport-security: max-age=300; includeSubdomains
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
x-xss-protection: 1; mode=block
cache-control: max-age=2592000
x-amz-cf-pop: FRA2-C2
content-type: image/png
content-length: 1644
x-amz-cf-id: PbMVeM2iWmudwIaI31RBJmSVugFre_LpJLL2G4ilL6tNFDLra-hEMw==
expires: Fri, 06 Aug 2021 11:31:45 GMT

GET
DATA 200
OK truncated
/ Frame 3BF7 37 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/gif

GET
H/1.1 200
OK loadReactions Show response
disqus.com/api/3.0/threadReactions/ Frame 3BF7 1 KB
2 KB 8ms
7ms XHR
application/json 151.101.192.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://disqus.com/api/3.0/threadReactions/loadReactions?thread=8733192328&api_key=E8Uh5l5fHZ6gD8U3KycjAIAk46f68Zw7C6eW8WSjZvCLXebZ7p0r1yrYDrLilk2F

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.ee2555081038338ea4f41cbb3ea1bc17.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.192.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

dab24cfdc4ae18663125086c84a5857d206ac6a91f19d5c6e094d17895284d7e

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=50703%20https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D50703&t_u=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F&t_e=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&t_d=%0A%09%09%09%09%09New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia%09%09%09%09&t_t=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&s_o=default
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Fri, 27 Aug 2021 14:52:10 GMT
X-Content-Type-Options: nosniff
Server: nginx
Age: 1
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=300; includeSubdomains
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Cache-Control: stale-while-revalidate=30, max-age=60
Connection: keep-alive
Content-Type: application/json
Vary: Origin, Cookie
Content-Length: 1125
X-XSS-Protection: 1; mode=block

GET
H2 200 svg-sprite.4da5413f5086c5755b46094b813dbfcd.svg
c.disquscdn.com/next/embed/assets/img/ Frame 3BF7 13 KB
13 KB 14ms
13ms Image
image/svg+xml 2600:9000:2190:6600:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/next/embed/assets/img/svg-sprite.4da5413f5086c5755b46094b813dbfcd.svg

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.8affdad980167da3f2dd9f1e933d0669.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2190:6600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

3270642c89180c12db93775e2a774b6dadd9bd98cffc963075c85afd2c17b6e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://c.disquscdn.com/next/embed/styles/lounge.8affdad980167da3f2dd9f1e933d0669.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 28 Apr 2021 14:37:41 GMT
via: 1.1 e1532b3ffd3d84bfecb9972a863a75ef.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 10455269
x-cache: Hit from cloudfront
content-length: 13079
x-xss-protection: 1; mode=block
x-served-by: static-web-1
surrogate-key: next
last-modified: Tue, 27 Apr 2021 21:01:56 GMT
server: nginx
etag: "60887bc4-3317"
content-type: image/svg+xml; charset=utf-8
access-control-allow-origin: *
expires: Thu, 28 Apr 2022 14:37:41 GMT
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: ZRH50-C1
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: CD3lQJ93em0ASJr0Wxe7l41BuF81oLbVt1Qze8nsqRziN-tw4JtDJw==
x-cache-hits: 0

GET
H2 200 loader.ba7c86e8b4b6135bb668d05223f8f127.gif
c.disquscdn.com/next/embed/assets/img/ Frame 3BF7 3 KB
3 KB 14ms
13ms Image
image/gif 2600:9000:2190:6600:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/next/embed/assets/img/loader.ba7c86e8b4b6135bb668d05223f8f127.gif

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.8affdad980167da3f2dd9f1e933d0669.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2190:6600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

4c4491dcfa94cb46fb73742fc2caf49a1cd59027304af1830c7dc6ce1889857c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://c.disquscdn.com/next/embed/styles/lounge.8affdad980167da3f2dd9f1e933d0669.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 03 Feb 2021 04:58:07 GMT
via: 1.1 e1532b3ffd3d84bfecb9972a863a75ef.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 17747643
x-cache: Hit from cloudfront
content-length: 2971
x-xss-protection: 1; mode=block
x-served-by: static-web-2
surrogate-key: next
last-modified: Wed, 27 Jan 2021 17:23:07 GMT
server: nginx
etag: "6011a17b-b9b"
content-type: image/gif
access-control-allow-origin: *
expires: Thu, 03 Feb 2022 04:58:07 GMT
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: ZRH50-C1
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: 86-56fT5vEZhd4ZBLCSPIk0V3MgDRKgfu0UZxzpeeierdGCNMJnJ6A==
x-cache-hits: 0

GET
H2 200 sprite.654110a9206fd22f08cca0798e34a65e.png
c.disquscdn.com/next/embed/assets/img/ Frame 3BF7 2 KB
2 KB 14ms
14ms Image
image/png 2600:9000:2190:6600:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/next/embed/assets/img/sprite.654110a9206fd22f08cca0798e34a65e.png

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.8affdad980167da3f2dd9f1e933d0669.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2190:6600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

cdba739c28b41f39ce438f2bf204fe739dc81a26cf559a9394ceed56a0666bee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://c.disquscdn.com/next/embed/styles/lounge.8affdad980167da3f2dd9f1e933d0669.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 10:47:19 GMT
via: 1.1 e1532b3ffd3d84bfecb9972a863a75ef.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 6667491
x-cache: Hit from cloudfront
content-length: 1862
x-xss-protection: 1; mode=block
x-served-by: static-web-2
surrogate-key: next
last-modified: Thu, 10 Jun 2021 21:33:44 GMT
server: nginx
etag: "60c28538-746"
content-type: image/png
access-control-allow-origin: *
expires: Sat, 11 Jun 2022 10:47:19 GMT
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: ZRH50-C1
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: WcEePnTAsnaTyEbaV_wA-AmLmU4ATpngT8HtIeU17jjIunREHF8TiA==
x-cache-hits: 0

GET
H2 200 icons.4cc7a703d2fdfe684151ff8ac24d45f1.woff2
c.disquscdn.com/next/embed/assets/font/ Frame 3BF7 8 KB
8 KB 14ms
14ms Font
application/octet-stream 2600:9000:2190:6600:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/assets/font/icons.4cc7a703d2fdfe684151ff8ac24d45f1.woff2

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.8affdad980167da3f2dd9f1e933d0669.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2190:6600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

f2a341fc815d45c21da726d4c843c2c5d3e1f333465347c3c75d040d556df4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Origin: https://disqus.com
Referer: https://c.disquscdn.com/next/embed/styles/lounge.8affdad980167da3f2dd9f1e933d0669.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 04 May 2021 09:01:33 GMT
via: 1.1 a2037d86ccb1a548f20827ebd95a65f3.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 9957036
x-cache: Hit from cloudfront
content-length: 7900
x-xss-protection: 1; mode=block
x-served-by: static-web-2
surrogate-key: next
last-modified: Wed, 28 Apr 2021 21:48:08 GMT
server: nginx
etag: "6089d818-1edc"
content-type: application/octet-stream
access-control-allow-origin: *
expires: Wed, 04 May 2022 09:01:33 GMT
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: ZRH50-C1
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: uQnc_gzaVQ-vqsz7eZNWthpTbHqHhtAFfk7owJck9rduQEpSckq4Yg==
x-cache-hits: 0

GET
H3-29 200 sdk.js Show response
connect.facebook.net/en_US/ Frame 3BF7 3 KB
2 KB 46ms
44ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.ee2555081038338ea4f41cbb3ea1bc17.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

8a6913a27f23cf7a09e4f22d402beee99d8a9de6565007214faee4e26f2da53b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=50703%20https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D50703&t_u=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F&t_e=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&t_d=%0A%09%09%09%09%09New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia%09%09%09%09&t_t=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: KU8GpVzT5cJO5rrttyacCw==
cross-origin-resource-policy: cross-origin
expires: Fri, 27 Aug 2021 14:52:18 GMT
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 1687
x-fb-rlafr: 0
x-fb-debug: +5qoXL4dLUP3qcxeepXnUdcQWly3CM0z35yXYjMyp+eS0lnObxNh7r36zm4t6jHZlMkBNYvTOivrrrrUu7iWfg==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
x-fb-content-md5: 097dee480366bdfad16e6157705881c0
cross-origin-opener-policy: same-origin-allow-popups
date: Fri, 27 Aug 2021 14:52:10 GMT
x-frame-options: DENY
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public,max-age=1200,stale-while-revalidate=3600
etag: "6236c507bd7cba6174cb1b8ab13c3159"
timing-allow-origin: *
priority: u=3,i
access-control-expose-headers: X-FB-Content-MD5

GET
H3-29 200 api.js Show response
apis.google.com/js/ Frame 3BF7 12 KB
5 KB 316ms
315ms Script
application/javascript 2a00:1450:4001:812::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/js/api.js

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.ee2555081038338ea4f41cbb3ea1bc17.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

0e3dae461ad9a493bcdab76a541bd225fd14a4a65ea481150aa4c4a2a0e936d4

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-UJNZWzKSHbs2HFS6yHUrjA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=50703%20https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D50703&t_u=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F&t_e=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&t_d=%0A%09%09%09%09%09New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia%09%09%09%09&t_t=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
x-ua-compatible: IE=edge, chrome=1
server: ESF
x-frame-options: SAMEORIGIN
etag: "2032ed7942a5d34892536c671c2a0068"
strict-transport-security: max-age=31536000
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=1800, stale-while-revalidate=1800
content-security-policy: script-src 'report-sample' 'nonce-UJNZWzKSHbs2HFS6yHUrjA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
timing-allow-origin: *
expires: Fri, 27 Aug 2021 14:52:10 GMT

GET
H2 200 upvote-512x512.png
c.disquscdn.com/next/current/publisher-admin/assets/img/emoji/ Frame 3BF7 8 KB
9 KB 13ms
11ms Image
image/png 2600:9000:2190:6600:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/next/current/publisher-admin/assets/img/emoji/upvote-512x512.png

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/lounge.bundle.dc50d72ac077058faccdd9a761fea0bc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2190:6600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

f8afec44114c09f3e520fd8c89a7e00386e99bc567ccbbf16f23771b75b58a68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=50703%20https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D50703&t_u=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F&t_e=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&t_d=%0A%09%09%09%09%09New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia%09%09%09%09&t_t=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:50:10 GMT
via: 1.1 e1532b3ffd3d84bfecb9972a863a75ef.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 129
x-cache: Hit from cloudfront
content-length: 8212
x-xss-protection: 1; mode=block
x-served-by: static-web-2
last-modified: Tue, 24 Aug 2021 21:06:44 GMT
server: nginx
etag: "61255f64-2014"
content-type: image/png
access-control-allow-origin: *
expires: Fri, 27 Aug 2021 14:55:01 GMT
cache-control: max-age=300, public
x-amz-cf-pop: ZRH50-C1
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: G3zhh47Akm0k2jtFj_voEfydYySrvLW2YACquqJsHG0SRzIQu5EFRA==
x-cache-hits: 0

GET
H2 200 funny-512x512.png
c.disquscdn.com/next/current/publisher-admin/assets/img/emoji/ Frame 3BF7 9 KB
9 KB 13ms
12ms Image
image/png 2600:9000:2190:6600:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/next/current/publisher-admin/assets/img/emoji/funny-512x512.png

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/lounge.bundle.dc50d72ac077058faccdd9a761fea0bc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2190:6600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

20a91bd509668238b6af8e16475c5e2611bcd2861d0eec2e0d4f6815e81449bd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=50703%20https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D50703&t_u=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F&t_e=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&t_d=%0A%09%09%09%09%09New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia%09%09%09%09&t_t=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:47:58 GMT
via: 1.1 e1532b3ffd3d84bfecb9972a863a75ef.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 252
x-cache: Hit from cloudfront
content-length: 8883
x-xss-protection: 1; mode=block
x-served-by: static-web-2
last-modified: Tue, 24 Aug 2021 21:06:44 GMT
server: nginx
etag: "61255f64-22b3"
content-type: image/png
access-control-allow-origin: *
expires: Fri, 27 Aug 2021 14:52:58 GMT
cache-control: max-age=300, public
x-amz-cf-pop: ZRH50-C1
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: 4JCBPzWofM_w9h_qCbr8-EAFuF7680BTeAfdqSGxxVRgm7-ZdLhSpQ==
x-cache-hits: 0

GET
H2 200 love-512x512.png
c.disquscdn.com/next/current/publisher-admin/assets/img/emoji/ Frame 3BF7 12 KB
12 KB 13ms
12ms Image
image/png 2600:9000:2190:6600:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/next/current/publisher-admin/assets/img/emoji/love-512x512.png

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/lounge.bundle.dc50d72ac077058faccdd9a761fea0bc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2190:6600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

e422b07ca1550e55cd90a518e910fd3cfb4d9337ea6092357f9761aa77ac9e33

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=50703%20https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D50703&t_u=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F&t_e=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&t_d=%0A%09%09%09%09%09New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia%09%09%09%09&t_t=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:47:58 GMT
via: 1.1 e1532b3ffd3d84bfecb9972a863a75ef.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 252
x-cache: Hit from cloudfront
content-length: 11910
x-xss-protection: 1; mode=block
x-served-by: static-web-2
last-modified: Tue, 24 Aug 2021 21:06:44 GMT
server: nginx
etag: "61255f64-2e86"
content-type: image/png
access-control-allow-origin: *
expires: Fri, 27 Aug 2021 14:52:58 GMT
cache-control: max-age=300, public
x-amz-cf-pop: ZRH50-C1
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: 1sfyncfRm9s0Viz9OJfbUC5ZS1XZ_2CeinnJXssNKVvOtwcKYPxFBg==
x-cache-hits: 0

GET
H2 200 angry-512x512.png
c.disquscdn.com/next/current/publisher-admin/assets/img/emoji/ Frame 3BF7 17 KB
18 KB 14ms
13ms Image
image/png 2600:9000:2190:6600:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/next/current/publisher-admin/assets/img/emoji/angry-512x512.png

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/lounge.bundle.dc50d72ac077058faccdd9a761fea0bc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2190:6600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

8630d3642f52a29b6198da00f23f7bd2481ad1cc19becfcf441a6c4ffe4ae099

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=50703%20https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D50703&t_u=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F&t_e=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&t_d=%0A%09%09%09%09%09New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia%09%09%09%09&t_t=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:51:37 GMT
via: 1.1 e1532b3ffd3d84bfecb9972a863a75ef.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 33
x-cache: Hit from cloudfront
content-length: 17794
x-xss-protection: 1; mode=block
x-served-by: static-web-1
last-modified: Tue, 24 Aug 2021 21:06:44 GMT
server: nginx
etag: "61255f64-4582"
content-type: image/png
access-control-allow-origin: *
expires: Fri, 27 Aug 2021 14:56:33 GMT
cache-control: max-age=300, public
x-amz-cf-pop: ZRH50-C1
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: YUiLhHxd6B_32wmEdjaKCj_PXbKBs6R55vMXcPsv80v9Ge_MavEzeg==
x-cache-hits: 0

GET
H2 200 sad-512x512.png
c.disquscdn.com/next/current/publisher-admin/assets/img/emoji/ Frame 3BF7 9 KB
9 KB 14ms
13ms Image
image/png 2600:9000:2190:6600:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/next/current/publisher-admin/assets/img/emoji/sad-512x512.png

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/lounge.bundle.dc50d72ac077058faccdd9a761fea0bc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2190:6600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

11c401a81e32b086bea3798c033009907b429fb601411da6ffc266b78184898a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=50703%20https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D50703&t_u=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F&t_e=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&t_d=%0A%09%09%09%09%09New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia%09%09%09%09&t_t=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:51:32 GMT
via: 1.1 e1532b3ffd3d84bfecb9972a863a75ef.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 38
x-cache: Hit from cloudfront
content-length: 8986
x-xss-protection: 1; mode=block
x-served-by: static-web-1
last-modified: Tue, 24 Aug 2021 21:06:44 GMT
server: nginx
etag: "61255f64-231a"
content-type: image/png
access-control-allow-origin: *
expires: Fri, 27 Aug 2021 14:56:32 GMT
cache-control: max-age=300, public
x-amz-cf-pop: ZRH50-C1
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: rYMBCNUNkuc5jIQP66p9daVnKhonphViE0Hs4NFfbDfKfsL1l6pXjQ==
x-cache-hits: 0

GET
H3-29 200 sdk.js Show response
connect.facebook.net/en_US/ Frame 3BF7 230 KB
67 KB 7ms
6ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js?hash=0307184951c7101bc03fac64b2b2fef1

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

1514d90c1accdfab721797b433eb7bab7cae54cb5a7ad7322c58c7ce1acb90fb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Origin: https://disqus.com
Referer: https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=50703%20https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D50703&t_u=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F&t_e=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&t_d=%0A%09%09%09%09%09New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia%09%09%09%09&t_t=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: j8I7vHKgM3icL9idqfk/vQ==
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 68336
x-fb-rlafr: 0
x-fb-debug: pZW131TtMkt1xvgXUjVODOzgEDGBB2ODWgpjH64kfsCalqVkQ5VzC6PJpe7Ru6rVcXNp1k2zKyQoT4EglycFXg==
x-fb-content-md5: 6e1d4deedd439fc492fead5b3648048f
x-frame-options: DENY
date: Fri, 27 Aug 2021 14:52:10 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
etag: "f8457daa67052f95fb0469b81f3ad39e"
timing-allow-origin: *
priority: u=3,i
expires: Sat, 27 Aug 2022 12:22:59 GMT

GET
H3-29 200 cb=gapi.loaded_0 Show response
apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.a6RGRpfcCJc.O/m=auth2/rt=j/sv=1/d=1/ed=1/am=AQ/rs=AGLTcCMTvVGaCqN55uYyIRle9gw0SP9pNw/ Frame 3BF7 103 KB
34 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:812::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.a6RGRpfcCJc.O/m=auth2/rt=j/sv=1/d=1/ed=1/am=AQ/rs=AGLTcCMTvVGaCqN55uYyIRle9gw0SP9pNw/cb=gapi.loaded_0

Requested by

Host: apis.google.com
URL: https://apis.google.com/js/api.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

368d7839a4853a0d5abfe3d384f513702a0339d6e10ed2f7651b4ec1de2780dd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=50703%20https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D50703&t_u=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F&t_e=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&t_d=%0A%09%09%09%09%09New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia%09%09%09%09&t_t=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 26 Aug 2021 18:30:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 73315
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34974
x-xss-protection: 0
last-modified: Wed, 25 Aug 2021 15:22:19 GMT
server: sffe
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
expires: Fri, 26 Aug 2022 18:30:15 GMT

GET
H3-29 200 iframe Show response
accounts.google.com/o/oauth2/ Frame DA04 513 B
355 B 16ms
16ms Document
text/html 2a00:1450:4001:812::200d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.google.com/o/oauth2/iframe

Requested by

Host: apis.google.com
URL: https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.a6RGRpfcCJc.O/m=auth2/rt=j/sv=1/d=1/ed=1/am=AQ/rs=AGLTcCMTvVGaCqN55uYyIRle9gw0SP9pNw/cb=gapi.loaded_0

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::200d Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

3b2edf13d03968e706c50671f28077dfc457f2641308219744627eccfbca41d8

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-4audqGavVniZbgAHcnCxZQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /o/cspreport
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: accounts.google.com
:scheme: https
:path: /o/oauth2/iframe
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=50703%20https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D50703&t_u=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F&t_e=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&t_d=%0A%09%09%09%09%09New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia%09%09%09%09&t_t=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&s_o=default
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: NID=222=XmPJCcfoKVGB1CCayqu5AVeqh01NuXwts2nRTk-qn42aeVXvxc0t3Xefhu-oGdSnBpdMr-R0mkn-4t9iZFU6GjdSUIoGUUAFH5BauSpiaEE94ad-yqumh3-Ix90Vu9TLCMvPmmVSd-84Pw3OY76ivKtXD_yCBfkS6gPmHeAqxQ8
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=50703%20https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D50703&t_u=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F&t_e=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&t_d=%0A%09%09%09%09%09New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia%09%09%09%09&t_t=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&s_o=default

Response headers

content-type: text/html; charset=utf-8
cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Fri, 27 Aug 2021 14:52:10 GMT
content-language: en-US
content-security-policy: script-src 'report-sample' 'nonce-4audqGavVniZbgAHcnCxZQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /o/cspreport
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 4131297854-idpiframe.js Show response
ssl.gstatic.com/accounts/o/ Frame DA04 116 KB
40 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ssl.gstatic.com/accounts/o/4131297854-idpiframe.js

Requested by

Host: accounts.google.com
URL: https://accounts.google.com/o/oauth2/iframe

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3f078a6a996e6a1628c6ddaece1d440c38441c4fd3051beb5a4948ff44421032

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://accounts.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 26 Aug 2021 13:53:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 89921
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/federated-signon-mpm-access
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40499
x-xss-protection: 0
last-modified: Fri, 20 Aug 2021 20:31:40 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 26 Aug 2022 13:53:29 GMT

GET
H/1.1 200
OK event Show response
bttrack.com/engagement/ Frame F8F4 0
401 B 378ms
94ms XHR
text/plain 192.132.33.46
BIDTELLECT

General

Check archive.org

Show headers Download Go to

Full URL: https://bttrack.com/engagement/event?input=%7B%22globalId%22%3A%2200000000-0000-0000-0000-000000000042%22%2C%22creativeId%22%3A%22%22%2C%22placementId%22%3A%22%22%2C%22goalId%22%3A%2214102%22%2C%22sessionId%22%3A%22661678ab-5dbb-43f4-af5c-7bc41899720e%22%2C%22parentPublisherId%22%3A%22%22%2C%22publisherId%22%3A%22%22%2C%22siteId%22%3A%22%22%2C%22commonId%22%3A%22%22%2C%22heartbeat%22%3A1%2C%22url%22%3A%22https%3A%2F%2F5118230.fls.doubleclick.net%2Fddm%2Ffls%2Fr%2Fdc_pre%3DCPvRlYa60fICFZXO1Qoduh0MOw%3Bsrc%3D5118230%3Btype%3Dcount0%3Bcat%3Dsecur00%3Bdc_lat%3D%3Bdc_rdid%3D%3Btag_for_child_directed_treatment%3D%3Bord%3D1%3Bnum%3D4345294801504.378%3B~oref%3Dhttps%3A%2F%2Fblog.malwarebytes.com%2F%22%2C%22fingerprint%22%3A%22%22%2C%22fingerprintProvider%22%3A%22%22%7D
Requested by: Host: bttrack.com
URL: https://bttrack.com/engagement/js?goalId=14102&cb=1630075930392
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 192.132.33.46 , United States, ASN18568 (BIDTELLECT, US),
Reverse DNS: 46.bidtellect.com
Software: Microsoft-IIS/8.5 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://5118230.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

X-ServerName: Track002-dc3
Pragma: no-cache
Date: Fri, 27 Aug 2021 14:51:47 GMT
Content-Encoding: gzip
X-AspNetMvc-Version: 5.2
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
P3P: CP="CAO DSP COR ADMo DEVo PSAo PSDo HISo IVAo IVDo OUR IND OTC"
Access-Control-Allow-Origin: *
Cache-Control: private,no-cache
Content-Type: text/plain
Content-Length: 0
Expires: -1

GET
H/1.1 200
OK getpixels Show response
bttrack.com/engagement/ Frame F8F4 0
400 B 377ms
94ms XHR
text/html 192.132.33.46
BIDTELLECT

General

Check archive.org

Show headers Download Go to

Full URL: https://bttrack.com/engagement/getpixels?gid=14102
Requested by: Host: bttrack.com
URL: https://bttrack.com/engagement/js?goalId=14102&cb=1630075930392
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 192.132.33.46 , United States, ASN18568 (BIDTELLECT, US),
Reverse DNS: 46.bidtellect.com
Software: Microsoft-IIS/8.5 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://5118230.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

X-ServerName: Track002-dc3
Pragma: no-cache
Date: Fri, 27 Aug 2021 14:51:47 GMT
Content-Encoding: gzip
X-AspNetMvc-Version: 5.2
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
P3P: CP="CAO DSP COR ADMo DEVo PSAo PSDo HISo IVAo IVDo OUR IND OTC"
Access-Control-Allow-Origin: *
Cache-Control: private,no-cache
Content-Type: text/html
Content-Length: 0
Expires: -1

GET
H3-29 200 iframerpc Show response
accounts.google.com/o/oauth2/ Frame DA04 14 B
58 B 17ms
16ms XHR
application/json 2a00:1450:4001:812::200d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.google.com/o/oauth2/iframerpc?action=checkOrigin&origin=https%3A%2F%2Fdisqus.com&client_id=508198334196-bgmagrg0a2rub674g0shidj8fnd50dji.apps.googleusercontent.com

Requested by

Host: ssl.gstatic.com
URL: https://ssl.gstatic.com/accounts/o/4131297854-idpiframe.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::200d Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

8daf09a6fc31937457dd77e9c25ce4b21349d605b561a8c5d557841bf964c9a0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://accounts.google.com/o/oauth2/iframe
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
X-Requested-With: XmlHttpRequest

Response headers

date: Fri, 27 Aug 2021 14:52:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
content-type: application/json; charset=utf-8
cache-control: public, max-age=3600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
expires: Fri, 27 Aug 2021 15:52:10 GMT

GET
H2 200 noavatar92.png
a.disquscdn.com/1624570071/images/ Frame 3BF7 2 KB
2 KB 17ms
16ms Image
image/png 151.101.14.49
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://a.disquscdn.com/1624570071/images/noavatar92.png

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/lounge.bundle.dc50d72ac077058faccdd9a761fea0bc.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.14.49 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

36ef66124133ca33c8b44c487293c3180e5ab681ff3cad3c728ea4f894ec3444

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=50703%20https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D50703&t_u=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F&t_e=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&t_d=%0A%09%09%09%09%09New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia%09%09%09%09&t_t=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 14:52:10 GMT
x-content-type-options: nosniff
last-modified: Fri, 26 Feb 2021 20:50:09 GMT
server: nginx
age: 1826425
etag: "60395f01-66c"
strict-transport-security: max-age=300; includeSubdomains
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
x-xss-protection: 1; mode=block
cache-control: max-age=2592000
x-amz-cf-pop: FRA2-C2
content-type: image/png
content-length: 1644
x-amz-cf-id: PbMVeM2iWmudwIaI31RBJmSVugFre_LpJLL2G4ilL6tNFDLra-hEMw==
expires: Fri, 06 Aug 2021 11:31:45 GMT

GET
H/1.1 200
OK event.gif
referrer.disqus.com/juggler/ Frame 3BF7 43 B
295 B 100ms
100ms Image
image/gif 151.101.12.134
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://referrer.disqus.com/juggler/event.gif?abe=0&embed_hidden=0&integration=wordpress%203.0.21&load_time=621&event=init_embed&thread=8733192328&forum=malwarebytesunpacked&forum_id=3107640&imp=qkdf1hu6n7k&prev_imp=qkg113nbv56d&thread_slug=new_variant_of_konni_malware_used_in_campaign_targetting_russia&user_type=anon&referrer=https%3A%2F%2Fblog.malwarebytes.com%2F&theme=next&dnt=0&tracking_enabled=0&experiment=network_default_hidden&variant=fallthrough&service=dynamic&promoted_enabled=false&max_enabled=false

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.12.134 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://disqus.com/embed/comments/?base=default&f=malwarebytesunpacked&t_i=50703%20https%3A%2F%2Fblog.malwarebytes.com%2F%3Fp%3D50703&t_u=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F&t_e=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&t_d=%0A%09%09%09%09%09New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia%09%09%09%09&t_t=New%20variant%20of%20Konni%20malware%20used%20in%20campaign%20targetting%20Russia&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Fri, 27 Aug 2021 14:52:11 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT
Server: nginx
Content-Type: image/gif
Connection: keep-alive
Content-Length: 43
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK event Show response
bttrack.com/engagement/ Frame F8F4 0
401 B 95ms
95ms XHR
text/plain 192.132.33.46
BIDTELLECT

General

Check archive.org

Show headers Download Go to

Full URL: https://bttrack.com/engagement/event?input=%7B%22globalId%22%3A%2200000000-0000-0000-0000-000000000042%22%2C%22creativeId%22%3A%22%22%2C%22placementId%22%3A%22%22%2C%22goalId%22%3A%2214102%22%2C%22sessionId%22%3A%22661678ab-5dbb-43f4-af5c-7bc41899720e%22%2C%22parentPublisherId%22%3A%22%22%2C%22publisherId%22%3A%22%22%2C%22siteId%22%3A%22%22%2C%22commonId%22%3A%22%22%2C%22heartbeat%22%3A2%2C%22url%22%3A%22https%3A%2F%2F5118230.fls.doubleclick.net%2Fddm%2Ffls%2Fr%2Fdc_pre%3DCPvRlYa60fICFZXO1Qoduh0MOw%3Bsrc%3D5118230%3Btype%3Dcount0%3Bcat%3Dsecur00%3Bdc_lat%3D%3Bdc_rdid%3D%3Btag_for_child_directed_treatment%3D%3Bord%3D1%3Bnum%3D4345294801504.378%3B~oref%3Dhttps%3A%2F%2Fblog.malwarebytes.com%2F%22%2C%22fingerprint%22%3A%22%22%2C%22fingerprintProvider%22%3A%22%22%7D
Requested by: Host: bttrack.com
URL: https://bttrack.com/engagement/js?goalId=14102&cb=1630075930392
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 192.132.33.46 , United States, ASN18568 (BIDTELLECT, US),
Reverse DNS: 46.bidtellect.com
Software: Microsoft-IIS/8.5 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://5118230.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

X-ServerName: Track002-dc3
Pragma: no-cache
Date: Fri, 27 Aug 2021 14:51:52 GMT
Content-Encoding: gzip
X-AspNetMvc-Version: 5.2
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
P3P: CP="CAO DSP COR ADMo DEVo PSAo PSDo HISo IVAo IVDo OUR IND OTC"
Access-Control-Allow-Origin: *
Cache-Control: private,no-cache
Content-Type: text/plain
Content-Length: 0
Expires: -1

GET
H/1.1 200
OK event Show response
bttrack.com/engagement/ Frame F8F4 0
401 B 95ms
95ms XHR
text/plain 192.132.33.46
BIDTELLECT

General

Check archive.org

Show headers Download Go to

Full URL: https://bttrack.com/engagement/event?input=%7B%22globalId%22%3A%2200000000-0000-0000-0000-000000000042%22%2C%22creativeId%22%3A%22%22%2C%22placementId%22%3A%22%22%2C%22goalId%22%3A%2214102%22%2C%22sessionId%22%3A%22661678ab-5dbb-43f4-af5c-7bc41899720e%22%2C%22parentPublisherId%22%3A%22%22%2C%22publisherId%22%3A%22%22%2C%22siteId%22%3A%22%22%2C%22commonId%22%3A%22%22%2C%22heartbeat%22%3A3%2C%22url%22%3A%22https%3A%2F%2F5118230.fls.doubleclick.net%2Fddm%2Ffls%2Fr%2Fdc_pre%3DCPvRlYa60fICFZXO1Qoduh0MOw%3Bsrc%3D5118230%3Btype%3Dcount0%3Bcat%3Dsecur00%3Bdc_lat%3D%3Bdc_rdid%3D%3Btag_for_child_directed_treatment%3D%3Bord%3D1%3Bnum%3D4345294801504.378%3B~oref%3Dhttps%3A%2F%2Fblog.malwarebytes.com%2F%22%2C%22fingerprint%22%3A%22%22%2C%22fingerprintProvider%22%3A%22%22%7D
Requested by: Host: bttrack.com
URL: https://bttrack.com/engagement/js?goalId=14102&cb=1630075930392
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 192.132.33.46 , United States, ASN18568 (BIDTELLECT, US),
Reverse DNS: 46.bidtellect.com
Software: Microsoft-IIS/8.5 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://5118230.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

X-ServerName: Track004-dc3
Pragma: no-cache
Date: Fri, 27 Aug 2021 14:51:56 GMT
Content-Encoding: gzip
X-AspNetMvc-Version: 5.2
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
P3P: CP="CAO DSP COR ADMo DEVo PSAo PSDo HISo IVAo IVDo OUR IND OTC"
Access-Control-Allow-Origin: *
Cache-Control: private,no-cache
Content-Type: text/plain
Content-Length: 0
Expires: -1

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/lounge.load.53c39e0ce65e4eb0af505908f71410f5.js

Verdicts & Comments Add Verdict or Comment

169 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

5 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
disqus.com/	1970-01-19 20:47:57	Name: __jid Value: qkg113nbv56d
.google.com/	1970-01-20 01:11:27	Name: NID Value: 222=XmPJCcfoKVGB1CCayqu5AVeqh01NuXwts2nRTk-qn42aeVXvxc0t3Xefhu-oGdSnBpdMr-R0mkn-4t9iZFU6GjdSUIoGUUAFH5BauSpiaEE94ad-yqumh3-Ix90Vu9TLCMvPmmVSd-84Pw3OY76ivKtXD_yCBfkS6gPmHeAqxQ8
.malwarebytes.com/	1970-01-20 05:33:31	Name: OptanonConsent Value: groups=1%3A1%2C0_165071%3A1%2C101%3A1%2C2%3A1%2C3%3A1%2C102%3A1%2C103%3A1%2C4%3A1%2C104%3A1%2C105%3A1%2C106%3A1%2C107%3A1%2C109%3A1%2C110%3A1%2C112%3A1%2C113%3A1%2C114%3A1%2C115%3A1%2C116%3A1%2C117%3A1%2C118%3A1%2C0_165051%3A1%2C0_165052%3A1%2C0_165053%3A1%2C0_165054%3A1%2C0_165055%3A1%2C0_165056%3A1%2C0_165057%3A1%2C0_165058%3A1%2C0_165059%3A1%2C0_165060%3A1%2C0_165061%3A1%2C0_165062%3A1%2C0_165063%3A1%2C0_165064%3A1%2C0_165065%3A1%2C0_165066%3A1%2C0_165067%3A1%2C0_165068%3A1%2C0_165069%3A1%2C0_165070%3A1%2C0_165072%3A1%2C0_165073%3A1%2C0_165074%3A1%2C0_168809%3A1%2C0_168810%3A1%2C0_171059%3A1%2C0_171060%3A1%2C0_171061%3A1%2C0_171062%3A1%2C0_171063%3A1%2C0_171064%3A1%2C0_172264%3A1%2C0_172327%3A1%2C0_179764%3A1%2C0_172332%3A1%2C0_172328%3A1%2C0_172329%3A1%2C108%3A1%2C111%3A1&datestamp=Fri+Aug+27+2021+16%3A52%3A10+GMT%2B0200+(Central+European+Summer+Time)&version=6.4.0
.disqus.com/	1970-01-20 05:33:31	Name: disqus_unique Value: qkg3537ne7qu
.blog.malwarebytes.com/	1970-01-20 05:33:31	Name: _pin_unauth Value: dWlkPU9UQXpPR00xT0RndE9UY3dOUzAwTldNMExXRXhNemt0TXpVNE1qYzFNemd4TkRkbQ

8 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://blog.malwarebytes.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2(Line 2) Message: JQMIGRATE: Migrate is installed, version 3.3.2
console-api	log	URL: https://www.malwarebytes.com/js/nav-resize.js(Line 268) Message: There is no hero section
console-api	log	URL: https://static.ads-twitter.com/uwt.js(Line 1) Message: Sending: https://analytics.twitter.com/i/adsct?type=javascript&version=2.0.3&p_id=Twitter&p_user_id=0&txn_id=o1m5j&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F
console-api	log	URL: https://static.ads-twitter.com/uwt.js(Line 1) Message: Building an script pixel with URL: https://analytics.twitter.com/i/adsct?type=javascript&version=2.0.3&p_id=Twitter&p_user_id=0&txn_id=o1m5j&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F
console-api	log	URL: https://static.ads-twitter.com/uwt.js(Line 1) Message: Sending: //t.co/i/adsct?type=javascript&version=2.0.3&p_id=Twitter&p_user_id=0&txn_id=o1m5j&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tw_document_href=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F
console-api	log	URL: https://static.ads-twitter.com/uwt.js(Line 1) Message: Building an image pixel with URL: //t.co/i/adsct?type=javascript&version=2.0.3&p_id=Twitter&p_user_id=0&txn_id=o1m5j&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tw_document_href=https%3A%2F%2Fblog.malwarebytes.com%2Fthreat-intelligence%2F2021%2F08%2Fnew-variant-of-konni-malware-used-in-campaign-targetting-russia%2F
console-api	log	URL: https://malwarebytesunpacked.disqus.com/embed.js(Line 47) Message: Use DISQUS.reset instead of reloading embed.js please.
console-api	log	URL: https://malwarebytesunpacked.disqus.com/embed.js(Line 47) Message: See https://help.disqus.com/customer/portal/articles/472107-using-disqus-on-ajax-sites

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors none;
X-Frame-Options	DENY

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

5118230.fls.doubleclick.net
9812475.fls.doubleclick.net
a.disquscdn.com
accounts.google.com
adservice.google.com
adservice.google.de
analytics.twitter.com
api.company-target.com
apis.google.com
bat.bing.com
blog.malwarebytes.com
bttrack.com
c.disquscdn.com
cdn.bttrack.com
cdn.jsdelivr.net
connect.facebook.net
ct.pinterest.com
disqus.com
fonts.googleapis.com
genesis.malwarebytes.com
geolocation.onetrust.com
googleads.g.doubleclick.net
id.rlcdn.com
insight.adsrvr.org
js.adsrvr.org
malwarebytesunpacked.disqus.com
match.prod.bidr.io
optanon.blob.core.windows.net
px.ads.linkedin.com
px4.ads.linkedin.com
q.quora.com
referrer.disqus.com
s.pinimg.com
s.yimg.com
script.crazyegg.com
scripts.demandbase.com
secure.gravatar.com
segments.company-target.com
snap.licdn.com
ssl.gstatic.com
static.ads-twitter.com
stats.g.doubleclick.net
t.co
unpkg.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.linkedin.com
www.malwarebytes.com
c.disquscdn.com
104.244.42.195
104.244.42.5
108.174.10.14
13.224.100.124
13.224.96.5
13.224.96.51
13.224.96.62
130.211.198.3
142.250.184.194
142.250.185.230
142.250.186.166
151.101.12.134
151.101.12.157
151.101.14.49
151.101.192.134
18.215.205.165
192.132.33.46
199.232.80.84
2600:1f18:21ae:6700:f931:acf0:5bbb:8761
2600:9000:2190:6600:6:8656:f5c0:93a1
2600:9000:21f3:fe00:16:26c7:ff80:93a1
2606:4700:10::6814:b944
2606:4700::6810:7eaf
2606:4700::6813:9408
2620:119:50e4:101::6cae:b55
2620:1ec:21::14
2620:1ec:c11::200
2a00:1288:80:800::7000
2a00:1450:4001:802::2003
2a00:1450:4001:809::2002
2a00:1450:4001:809::2003
2a00:1450:4001:809::2008
2a00:1450:4001:809::200e
2a00:1450:4001:80e::2008
2a00:1450:4001:80e::200d
2a00:1450:4001:80f::2004
2a00:1450:4001:80f::200a
2a00:1450:4001:812::2002
2a00:1450:4001:812::2003
2a00:1450:4001:812::200d
2a00:1450:4001:812::200e
2a00:1450:4001:831::2002
2a00:1450:4001:831::2004
2a00:1450:4001:831::200e
2a00:1450:400c:c0c::9b
2a02:26f0:6c00:296::25ea
2a02:26f0:6c00:2a3::1931
2a03:2880:f02d:100:face:b00c:0:3
2a03:2880:f02d:12:face:b00c:0:3
2a03:2880:f12d:181:face:b00c:0:25de
2a04:4e42:3::485
2a04:fa87:fffe::c000:4902
35.244.174.68
52.16.214.249
52.239.137.4
52.30.148.233
69.16.175.42
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300
042f0a89d25fe49da053ba6d34ae43e5e25bb3cb0a698b5bce6da6d0ae3f68b0
05369fa3ab175c5ba5e63b7c60a872a64f82ddcb1de6a950d73004ed25930e69
05a173cb58022e81eb499529ac56df6ad7bafe1c61b8128dca8b76f300b5b60e
075a5ea1844fded548a58ea96d4efa71bbd41131a0c9d1fbd4d3098f2f78e004
0d8ac30d9520ce94e0246020e4bff9b6fea04f92ac0b5f09c7346104b9f5772a
0e2d450425cfa5a67a9c9a1646a30a1f9a5c8faee86a127e5e30791b8882e3f1
0e3dae461ad9a493bcdab76a541bd225fd14a4a65ea481150aa4c4a2a0e936d4
0ed37960a59a6ec6b443f9ef043864d09a51db6fd276ae578d9166467bf986d1
106ff2dcabdf33e3a570650ebd622f534c02c6f751a8320ed879e172d767bbd2
11c401a81e32b086bea3798c033009907b429fb601411da6ffc266b78184898a
1514d90c1accdfab721797b433eb7bab7cae54cb5a7ad7322c58c7ce1acb90fb
1532b16aa9cd1fef51c097aaf1abeac6cb6f239b026660e7105e49f4ae6549ff
16f961e4eedc84409f706d7043ec879d9a7783c6f317640b0d97a73e98e9e8ea
1882996e48b3b800108df06670df431af4a6f9b18eb54f4a74c0d601af52c641
19333622f176d68bc17e307d8df96b15447864fbb0bbaac495e507fa64d96077
1b596dd656e3aa66a49c4cd29839bf3987beafe7e08f286b4334f7484fbd2c9e
1dc2b8fb26c1a74260a66519a2a5fdf37a938d1b43bbe4d8da7fcd652acc61b9
1dfc63631707194ac22fc6800b4f2ff8701081fefcf4016fbf113d38298b1afe
1f462c2a1a60b244e8901d78293b03c6f554ea0364b57e7412550cd842484b90
20a91bd509668238b6af8e16475c5e2611bcd2861d0eec2e0d4f6815e81449bd
21da5195f86350f2b52a0ee70a668d4f72542d0413b57dd84f06593e0e0f7207
22f39a41a30342a5c51d150be48c4726245655a560d154af893337d1ae953f62
2409f262a4b65de1c6867ad7d607898380900587b69a60b881a9b888bd53e625
2ee2bb70afdb2ebfc8248fba3e4b872c4d1f0a6c03e9c93872b294c9fa28b463
30b410ec60b2dda5e521206ed5b3a9318922f62828db7409240f047f21593bcc
30da4c48d022cae31aecd5ed03eb37be68f9cf0ace03efc80eb2e1497cc55612
3270642c89180c12db93775e2a774b6dadd9bd98cffc963075c85afd2c17b6e4
32d4b293bb7f25a21cc44e81184d4bbcb3bdd1837e026b98ed0ad85b3b1a5292
3487ef2baf0c08ba660a8a143cdeb8ebeec961eea04bccd7c49096b4eb26b875
361aabb783830d45d3de5f19c4fe47d295e11518fb0279dd99d589eea8d43319
368d7839a4853a0d5abfe3d384f513702a0339d6e10ed2f7651b4ec1de2780dd
36ef66124133ca33c8b44c487293c3180e5ab681ff3cad3c728ea4f894ec3444
377a6598c6facc027e0926adb5e5465f0999cafdf7faeb6978273cabdb344b5d
378f79bc8e52dc7c86332d048c8b8f57ad672c3c917ca54b08630bb487b99d3f
37b17c5135a176a9474521af147d96dfa1fb4ca0f43f00d1400bd1885be3ab9b
3b2edf13d03968e706c50671f28077dfc457f2641308219744627eccfbca41d8
3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1
3c04dc33962483f3e11d05b43568d2a4f7fc83fa9020cb9391168d19d0e33f7a
3c8ba982e1a7629cb5be1c6e7ac909bb494b895a63affce2f6306e5cd244505a
3df56cf5e9b367ce3a1f69c52fe68655893e7443d0b9df0a8a094606775657c0
3dff338c7baa6bd83b65f12941ae8cb7f65affd351b9e285f6cc74e0b3ed0d13
3f078a6a996e6a1628c6ddaece1d440c38441c4fd3051beb5a4948ff44421032
443211c7845e0012dea1dfe8cda1ce659e7fef3c7b5af2b470704ed8186945c0
45eb4a06b8ac41231cacdee781d6a1175ed0dc544c3982b708305b281feaaab3
4763031532a7e8158dd70840883891162d509da2ab0e35a615a761899d00e29b
4c4491dcfa94cb46fb73742fc2caf49a1cd59027304af1830c7dc6ce1889857c
4d90717f4917373623ee8fe964f4e559770f3764a3f95334ebe3c0da753df65e
4ed10d0d64bb1515397e8666a63f484d640dbc5678fa62574e077b7aef1c3af2
51f4cf88527819ae3950b1820aa534ebf6c2fcbc0894db427ba5ab59d9efd659
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
5576e25dd8a4d45e90da43e0f127c4efb4d16eebcb7a1bc55fbb66e7cf504f9d
580818700724d42d7fcc4979b0197971fca1c6d2e0286769237a0ac897df5512
58c13e24cdfb6384c26836e3eac52d17701cd9d686c56ebf93efbbe9426f8cd6
5b62da3ed3fe1c94582c2a75526716000f7361ff70c0cc41aae4ee8212735c3e
5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991
5c1282fb121104f5a505ecbfd7194e64c98db6b830684450dcfc478021d05257
5c222890d05dad942e8179621c10021658794c5d8bd1e10539e0ec6dd60590d7
5d09ea31b4f26497480482f539fdc221990ae192c8b8be5002f4f2b9bef26876
5dacc86b8a64742e60d70192353e5643da219a3f84c0b26cf6116b06b67fff32
5df62ed830a14fa40b57484791205772a584eb96373d1f2c7a5e6d1feac53ed2
604884eafb6b13b5030d86bcd92d2d4508a19f5dd361ae2013542af4721cd2aa
624de26e418e30e37a6022b5822a9d09e42807828e10742acab7377dab034cce
6252f8d40b521387483f57b7d0c812912a1d59ce038fdde2bcf67cf920486cac
6429fe0ed81fca5f6bb18cb0a0aacae3bd9de79192635aeed4cbda438139d75d
691c9c84a063b01b9e46ca092f814db79486dd1bb17984935fb53392149b32d9
6ae4a28c6942a6eb8b2f62bc2f80285602ad827cf03cd01c0a2df0b0546007cd
72622641b79819e5c8b5c0543d105a45e30f13b1a6c0b5c3701e72de5b57e427
728054ccf1f41ec0afdb688b6db421601bb60d505d9e1e2c2de16d9e4a14b774
79cedbb48b73d61e196f272011efafa43c3bad823161643a62814b224f26ab84
7e6aa30a919ae381fbcf4d4d6f970531bf513bf0847097e7927123bf032b0f09
7e8ee8f9d56ca7e35629a7c16b9f1c09fbb1e7d19fe922833a2f4edec48bfeea
7e9bcd405af64ba784d4ead6dba8ed5c146a22c5bb6f264e756e3ded19a6fb6f
80ac8548037a7878edd91fd417514656e1541d36d1acd239daf94134081a26e8
80f0eb912943ad0deab2ad7a8125b7404b726bac65dca9e6be97b063ca490662
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8472a288d54aaa7e8d250caa237cfbd45115a25d0c87e1f484e8c207085dab48
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
8528b83134ef333f8b4f3b722f422569b5121e6fa817c9942bcbb91f5f61ea93
8630d3642f52a29b6198da00f23f7bd2481ad1cc19becfcf441a6c4ffe4ae099
8702018b5c8809434a3459d4b81440f67c261280bac213730e1fc128d7cff11e
88e7deb2dcbccbe8fa97dfc6973ea174f0b3db01ace23c0d72a8228452171a5e
8a6913a27f23cf7a09e4f22d402beee99d8a9de6565007214faee4e26f2da53b
8a849c6ffa64946fefa17e874080dea467783d0e20857bbfbb23480739625648
8c20518cd7e51066b82e8a8a1e8035210741cf808c02268915747960f531061c
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
8daf09a6fc31937457dd77e9c25ce4b21349d605b561a8c5d557841bf964c9a0
8e66ba8ec81710f183e83e210e60f2ea6499f2eb97d1e04178282f7149736a4f
8f796d398e512c5d19a2fecc943d19a204927ff3cf9ec2cb3f75a025535268cd
9008a9948be12471db87fb0d0c45a464b7003854213cd598c30eae831ada7865
9110fc122dda3067c424d9b8ff7747e2030b0bd9298f69a3683d399ad3373a6a
928759d761adf61723feb7a9affc2b058cc9d5044831da66fcadd823e265ab1c
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
93e43a00cd73303f914fe90d7be15dc032f4796891b571bf6cd9d9f36f4c91eb
96ee2b969ffa7878f9448432c9f983f6a1db3ff43f24725c65ec9e7f3a101e3a
980492bbf045d8206f17ebd8c3663da75806353a3cc4958b63dd35ba7fcb2c51
9cd291e0d448c524c55f79a46f5f17a3a3a3f8d8ea5a83d84338c170ba41fdc1
9d815528e2ed7985b63e839cbeb0b684e1fa8da87da3c1a0962b1eecfe437614
9fcb181721162ce0d395b7b9b1e5bb5ca82c5f79bde749d4d0467ec2e65fcb4a
a039155a82ca2634b4da1153b34ddbebc3eb4d2f6299ba653b8ee20afdba8d2b
a2b3f57762f2932505c6fa9b43932cb13856966074febc5bb048052f17100bf6
a462b5bc1a980ad8d6a93556ae89a5f94770ee3eef3c9bc921dc7a310fe34e83
a52bbdb7b132e850fdaf5740012fcc0bc3f6ef0be520bc4b987d8761d40d015a
a6a97c4046257c7e4e063c9f76434c7ce2c1f105e46b07424fabfc054f2d4d24
a7d4e6165ce4042167fcaaa0623eab885d6992458eb05c4fc74184cee79a9eb3
ab0303f8e9a5dd71a5f2cad73a836604f723c441b5cba246920d06615c0ac4b6
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ad15e02b8d9bee31a51c502cff1977983fa2c8103b769db7ab097750f34016a9
ad2cc26b0fdde8f4eb637ed12b25364e85af0bfba227dad42cb997ff4ad23eeb
ae68db317018c88fabc345e03b11cbd556a8ca6134896a56bece99f6801f819b
af0adf879c15a1a49044bb5be1d00ae031831db011ab6bfe05d5e14eb4222cef
b0817a0d6a87f2d42532035e42b20ea55cfaa5ca1092c761f5fc5e734790bdbf
b0a7006565d1b9832eb952238ec8113f95403807517bcd995077e68df8915d87
b1bb91151130d620bb916cf8f4b0ac0aa27ed9ab91da8aa3ecc1f845b317170d
b4e6efb587f3fdfb8155148201d0c51ac95d249a6727e8256acdfe624ade69af
b569dd28a56f53339cc04cc2e251dcfb426262bd7ad60ed44cc35da0dd3b2cc6
b9e6c38b3493790e6525ba6715ad839211cab5db3ddc80c7f70f20f92679fee6
ba0504cfd673e9fbf0bab2b70a67ac1bbea97891e12fc8cd3f94070f0c4898f8
bae4bca72ab90a280ae93fa72942b62ae9bbfb3abe6a432d53b89a1ef472b3b2
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea
c13527e6600d478c3cd7ae449acd6813e1c7209a97c0334702ee8d1a999a3a93
c2b0506fadb13182e425d4968e3555f1ebb3b490440929aa9ea0b17d588af14d
c368834a92ee3366773dd94318efcd73eb1d451602b1cad916f9f3ed38b72c17
c4df9527881456ebbf272ad8fdf150848de9d735af27b9312e320cef160ade1d
cdba739c28b41f39ce438f2bf204fe739dc81a26cf559a9394ceed56a0666bee
ce23bdc14eb22eecad91cef112ea740ebd6928a8cdef11362d1d5b25320bd5d4
cea0a05c5af6e21a409875328ed2e3dba79131b7c41f8ea07d0e0e02c7b7b59e
cf16a6be9c1f8d220216cd8bc2d5a7d68731c383f8a1d394c2727e7564a9ca7a
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d4e61ea4aafc5da0b582e7e15077addf35379acc4b7b03df0128ed33ba589884
d55208289f2d86a2531d4bdca7a1d704fa38e5f268e0ada90f51545a809696d6
d57ba6e41a327ee60daeefa194dc0248880363fb978a2579085a2be5bc6c2017
d6f36a088f7c6dc6459a02c048b23e2407bf38a5249ecbc9547be2fce143f63a
da1c1ad273854673c3a3f7e8f76aae5d7c9c73f3ebd224c2be1f93106680b1d4
da6424700547aae41ebbcd325d419b8c80e92a2123c6de5302892b8bdd66439c
da819542692b3f1c2a667ba34eff3465a82d9756953a1446ab7d0772f9b1edd5
dab24cfdc4ae18663125086c84a5857d206ac6a91f19d5c6e094d17895284d7e
def5de6254be138b8b35d680d1fdd8b07827d03b8626daebfeeb4157ec330ea7
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
e2adf740376f608d5a3b6977b793a5e1c92c4de9e0a792921b8e24476e56c9ed
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3fd4cc1421303e460ad0c220e457f0cd7ceb35a0956eb15bb61b299b4e66f55
e40306762b011c7f1c327bd3a1e67746175a53b3ee8a53395b1f75cae0db7eeb
e422b07ca1550e55cd90a518e910fd3cfb4d9337ea6092357f9761aa77ac9e33
eb0b072c78ba88e87b07c39c22f9bef724ea89f29f2a195ec4ab33b3bc75797d
ec442600e3c090c1171e6d0aca38073cc048af3a7a301ec06bf933da6aa65c1b
ecb916133a9376911f10bc5c659952eb0031e457f5df367cde560edbfba38fb8
ed2491fc7526ff0b5cfec3fe6f4cf8153796520fc845b735286b0f42183da98a
ee3a7301fe1e0c0f6bf6acff0d7a8d107f5cb3f62a2566740c0416d8e61f00b9
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f055e217bde76d711bd8b42af773f9f99b8a29d81ad9ed10b6379cc7e6c60452
f19f9a64724da1dc19ec99a7f0c83d637552787be8a4eb9bbec9ca6ec5a369d5
f2a341fc815d45c21da726d4c843c2c5d3e1f333465347c3c75d040d556df4e5
f3c2074e3b28f9092bb4f09dfb92d5f9c75f149f706db29cb075740330352166
f575112df5398271c1f04b48a995ccc6e17d69730e37304078178d46781152da
f5d76a935b040c53784ebb3016c9d146ba823443eec42ee26fc2371304598757
f8869aa9427c07872b91f3bb5485a65a0e389302f54ad6fe1b684c59d97d154a
f8afec44114c09f3e520fd8c89a7e00386e99bc567ccbbf16f23771b75b58a68
fa07bfad3039513f81cc0551de10a79c7c823bce84a5fbfba5a547f96479a367
fbf44047407fd1714993b1c5cebf5bf2b17915261b8c24ec8c70382b4d389ece
fd222137f245c06ddb4c4d44db41f12138dad6cf8ef5d4d4a5e500f38f0c8c62
fed785a6a8ca96fb67230fec5d85f9c508db49f4075aa0ef284af56cd89813e3
ff37be8081d97cd5da09dea014d573e75a3b34365476f1cc459cdb0dfadab3ec

blog.malwarebytes.com Open in urlscan Pro 130.211.198.3 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

224 Requests

100 %HTTPS

60 %IPv6

35 Domains

52 Subdomains

54 IPs

5 Countries

5135 kBTransfer

8429 kBSize

5 Cookies

91 Outgoing links

Redirected requests

224 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

blog.malwarebytes.com Open in urlscan Pro
130.211.198.3 Public Scan

Screenshot
Live screenshot

Full Image

224
Requests

100 %
HTTPS

60 %
IPv6

35
Domains

52
Subdomains

54
IPs

5
Countries

5135 kB
Transfer

8429 kB
Size

5
Cookies

224 HTTP transactions
2 data transactions