www.vkremez.com Open in urlscan Pro
2606:4700:3031::681c:153e Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
Submission: On September 24 via api (September 24th 2020, 2:00:19 pm UTC) from US

Summary HTTP 92 Redirects Links 11 Behaviour Indicators

Summary

This website contacted 15 IPs in 4 countries across 11 domains to perform 92 HTTP transactions. The main IP is 2606:4700:3031::681c:153e, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.vkremez.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on July 9th 2020. Valid for: a year.

This is the only time www.vkremez.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
5	2606:4700:303... 2606:4700:3031::681c:153e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 16	2a00:1450:400... 2a00:1450:4001:81f::2009	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6810:a723	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:821::200e	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:820::200e	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c0c::9b	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:819::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:818::2003	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:819::200e	15169 (GOOGLE) (GOOGLE)
6	2606:2800:234... 2606:2800:234:59:254c:406:2366:268c	15133 (EDGECAST) (EDGECAST)
28	2a00:1450:400... 2a00:1450:4001:806::2001	15169 (GOOGLE) (GOOGLE)
27	2a00:1450:400... 2a00:1450:4001:819::2001	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:802::200e	15169 (GOOGLE) (GOOGLE)
1	2a03:2880:f11... 2a03:2880:f11c:8183:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1 1	2a00:1450:400... 2a00:1450:4001:821::200d	15169 (GOOGLE) (GOOGLE)
92	15

5 2606:4700:3031::681c:153e (United States)

ASN13335 (CLOUDFLARENET, US)

www.vkremez.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 2a00:1450:4001:81f::2009 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.blogger.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.blogblog.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:a723 (United States)

ASN13335 (CLOUDFLARENET, US)

ajax.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:821::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:820::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c0c::9b (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:819::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:818::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:819::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

apis.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2606:2800:234:59:254c:406:2366:268c (United States)

ASN15133 (EDGECAST, US)

platform.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

28 2a00:1450:4001:806::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

1.bp.blogspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

27 2a00:1450:4001:819::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

3.bp.blogspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
4.bp.blogspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
2.bp.blogspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:802::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

apis.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f11c:8183:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:821::200d (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

accounts.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
55	blogspot.com 1.bp.blogspot.com 3.bp.blogspot.com 4.bp.blogspot.com 2.bp.blogspot.com	489 KB
10	blogger.com 1 redirects www.blogger.com	529 KB
6	twitter.com platform.twitter.com	60 KB
6	blogblog.com www.blogblog.com	304 KB
5	vkremez.com www.vkremez.com	20 KB
4	google.com 1 redirects www.google.com apis.google.com accounts.google.com	68 KB
2	google-analytics.com www.google-analytics.com	18 KB
1	facebook.com www.facebook.com
1	google.de www.google.de	106 B
1	doubleclick.net stats.g.doubleclick.net	88 B
1	cloudflare.com ajax.cloudflare.com	4 KB
92	11

	Domain	Requested by
28	1.bp.blogspot.com	www.blogblog.com
10	4.bp.blogspot.com
10	www.blogger.com	1 redirects www.vkremez.com ajax.cloudflare.com www.blogblog.com
9	2.bp.blogspot.com
8	3.bp.blogspot.com
6	platform.twitter.com	www.blogblog.com platform.twitter.com
6	www.blogblog.com	ajax.cloudflare.com
5	www.vkremez.com	www.vkremez.com ajax.cloudflare.com www.blogblog.com
2	apis.google.com	www.blogblog.com apis.google.com
2	www.google-analytics.com	www.vkremez.com www.google-analytics.com
1	accounts.google.com	1 redirects
1	www.facebook.com	www.blogblog.com
1	www.google.de	www.vkremez.com
1	www.google.com	www.vkremez.com
1	stats.g.doubleclick.net	www.google-analytics.com
1	ajax.cloudflare.com	www.vkremez.com
92	16

This site contains links to these domains. Also see Links.

Domain
www.blogger.com
www.bleepingcomputer.com
1.bp.blogspot.com

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-07-09` - `2021-07-09`	a year	crt.sh
*.blogger.com GTS CA 1O1	`2020-08-26` - `2020-11-18`	3 months	crt.sh
ajax.cloudflare.com DigiCert ECC Secure Server CA	`2020-08-11` - `2022-08-16`	2 years	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2020-08-26` - `2020-11-18`	3 months	crt.sh
www.google.com GTS CA 1O1	`2020-08-26` - `2020-11-18`	3 months	crt.sh
www.google.de GTS CA 1O1	`2020-08-26` - `2020-11-18`	3 months	crt.sh
*.apis.google.com GTS CA 1O1	`2020-08-26` - `2020-11-18`	3 months	crt.sh
*.twimg.com DigiCert SHA2 High Assurance Server CA	`2019-11-12` - `2020-11-18`	a year	crt.sh
misc-sni.blogspot.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
*.googleusercontent.com GTS CA 1O1	`2020-08-26` - `2020-11-18`	3 months	crt.sh
*.google.com GTS CA 1O1	`2020-08-26` - `2020-11-18`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2020-09-11` - `2020-12-10`	3 months	crt.sh

This page contains 7 frames:

Primary Page: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
Frame ID: 2AC2C442641285DC5ABFD07CF356451A
Requests: 92 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/tweet_button.html?url=https%3A%2F%2Fwww.vkremez.com%2F2020%2F04%2Flets-learn-trickbot-bazarbackdoor.html&count=horizontal&text=Let%27s%20Learn%3A%20TrickBot%20%22BazarBackdoor%22%20Process%20Hollowing%20Injection%20Primer&size=medium
Frame ID: 21083969CCCCA188875B0B4CFE2E5502
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/plugins/like.php?href=http%3A%2F%2Fwww.vkremez.com%2F2020%2F04%2Flets-learn-trickbot-bazarbackdoor.html&send=false&layout=button_count&action=like&show_faces=false&colorscheme=light
Frame ID: C8EDB73AA0858F20E61BFE01B7E8A405
Requests: 1 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.2d7d9a6d04538bf11c7b23641e75738c.html?origin=https%3A%2F%2Fwww.vkremez.com
Frame ID: 10BE877238682E361B9E17D6F5D45091
Requests: 1 HTTP requests in this frame

Frame: https://platform.twitter.com/embed/index.html?dnt=false&embedId=twitter-widget-0&frame=false&hideCard=false&hideThread=false&id=1252303608747565057&lang=en&origin=https%3A%2F%2Fwww.vkremez.com%2F2020%2F04%2Flets-learn-trickbot-bazarbackdoor.html&theme=light&widgetsVersion=219d021%3A1598982042171&width=550px
Frame ID: 462DE8FA995DB32871FFDAC6FE661A8D
Requests: 1 HTTP requests in this frame

Frame: https://www.blogger.com/comment-iframe.g?blogID=3986785863650565253&postID=6114194039930120721
Frame ID: 9371BA2591947815A9245563AADC94B5
Requests: 1 HTTP requests in this frame

Frame: https://www.blogger.com/comment-iframe.g?blogID=3986785863650565253&postID=6114194039930120721&bpli=1
Frame ID: C66000515F1AF7441BF2A10DCFFCBD72
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Blogger (Blogs) Expand

Overall confidence: 100%
Detected patterns

meta generator /^Blogger$/i

Python (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

meta generator /^Blogger$/i

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

92
Requests

98 %
HTTPS

100 %
IPv6

11
Domains

16
Subdomains

15
IPs

4
Countries

1492 kB
Transfer

6732 kB
Size

4
Cookies

11 Outgoing links

These are links going to different origins than the main page.

URL: https://www.blogger.com/go/blogspot-cookies
Title: Weitere Informationen

Search URL Search Domain Scan URL

URL: https://www.blogger.com/post-edit.g?blogID=3986785863650565253&from=pencil

Search URL Search Domain Scan URL

URL: https://www.blogger.com/home

Search URL Search Domain Scan URL

URL: https://www.blogger.com/post-edit.g?blogID=3986785863650565253&postID=6114194039930120721&from=pencil

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/news/security/bazarbackdoor-trickbot-gang-s-new-stealthy-network-hacking-malware/
Title: BleepingComputer report

Search URL Search Domain Scan URL

URL: https://1.bp.blogspot.com/-ArgupP7N1rA/XqPjhNVmAcI/AAAAAAAAenA/IohRyVV3k_kl6qSvKSZB9g4yjl2MMIcZgCLcBGAsYHQ/s1600/Screen%2BShot%2B2020-04-25%2Bat%2B3.15.02%2BAM.png

Search URL Search Domain Scan URL

URL: https://1.bp.blogspot.com/-5Tvssi5LAWY/XqQEDI7d_rI/AAAAAAAAenc/M3bufTHGlEoTg2jMGzy0OhK67ucniHnAACLcBGAsYHQ/s1600/Untitled%2BDiagram.jpg

Search URL Search Domain Scan URL

URL: https://1.bp.blogspot.com/-q7KasYAefY8/XqQHGW1XOuI/AAAAAAAAen0/6MFwtbGsl64-PsqYExYmuqP3Cvm5uIdgwCLcBGAsYHQ/s1600/Screen%2BShot%2B2020-04-25%2Bat%2B5.44.40%2BAM.png

Search URL Search Domain Scan URL

URL: https://1.bp.blogspot.com/-ur46xL-v-Wc/XqQFrZ17mDI/AAAAAAAAeno/rVHOUI7n19wWLYhC3FGhm_1dyHjLG817QCLcBGAsYHQ/s1600/Screen%2BShot%2B2020-04-25%2Bat%2B5.40.39%2BAM.png

Search URL Search Domain Scan URL

URL: https://1.bp.blogspot.com/-_BTtTjFpyo8/XqQJtRbivDI/AAAAAAAAeoA/DSOaPB_JydcF4Cyk3NL56PGvVj7BnrOCACLcBGAsYHQ/s1600/Screen%2BShot%2B2020-04-25%2Bat%2B5.57.30%2BAM.png

Search URL Search Domain Scan URL

URL: https://www.blogger.com/profile/08061973052790292809
Title: Vitali Kremez

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 97

https://www.blogger.com/comment-iframe.g?blogID=3986785863650565253&postID=6114194039930120721 HTTP 302
https://accounts.google.com/ServiceLogin?continue=https://www.blogger.com/comment-iframe.g?blogID%3D3986785863650565253%26postID%3D6114194039930120721%26bpli%3D1&followup=https://www.blogger.com/comment-iframe.g?blogID%3D3986785863650565253%26postID%3D6114194039930120721%26bpli%3D1&passive=true&go=true HTTP 302
https://www.blogger.com/comment-iframe.g?blogID=3986785863650565253&postID=6114194039930120721&bpli=1

92 HTTP transactions
7 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request lets-learn-trickbot-bazarbackdoor.html Show response
www.vkremez.com/2020/04/ 22 KB
6 KB 222ms
199ms Document
text/html 2606:4700:3031::681c:153e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3031::681c:153e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6c0ebe5f6ec903f685e9d02e3d8a7464333c65a83edd639a62d002d17334beda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.vkremez.com
:scheme: https
:path: /2020/04/lets-learn-trickbot-bazarbackdoor.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Thu, 24 Sep 2020 14:00:02 GMT
content-type: text/html; charset=UTF-8
set-cookie: __cfduid=d542c33b70ce7fa59ae4214e8572ad0d41600956002; expires=Sat, 24-Oct-20 14:00:02 GMT; path=/; domain=.vkremez.com; HttpOnly; SameSite=Lax
expires: Thu, 24 Sep 2020 14:00:02 GMT
cache-control: private, max-age=0
last-modified: Tue, 22 Sep 2020 11:50:05 GMT
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cf-cache-status: DYNAMIC
cf-request-id: 05620307aa0000dfbb3d19e200000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 5d7d0785decbdfbb-FRA
content-encoding: br

GET
H2 200 rCFq0Q-zTsMxcd3V8sTNUHIcYvw.js Show response
www.vkremez.com/cdn-cgi/apps/head/ 6 KB
2 KB 37ms
36ms Script
application/javascript 2606:4700:3031::681c:153e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.vkremez.com/cdn-cgi/apps/head/rCFq0Q-zTsMxcd3V8sTNUHIcYvw.js
Requested by: Host: www.vkremez.com
URL: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681c:153e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d9bf20fa1e29339c8dcbe0df9f1cd23ee01df3ae0877cdc80d08c33a30d41ab4

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 14:00:02 GMT
content-encoding: br
cf-cache-status: HIT
age: 326955
status: 200
x-amz-request-id: 3671FC886FFC0F26
x-amz-id-2: tSNGo4lfBgbRUmjQNlsN3Rwgh96ulAm3ZMU1Ou0zsXKS99iN+JhuaRNs+SoWPBrbaRdFKwA3EtY=
last-modified: Thu, 20 Jul 2017 22:51:20 GMT
server: cloudflare
etag: W/"279e89472487866cc22f82d8f249bc9e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
x-amz-version-id: mzdAianDF56VdV788peQgLeXBaEyDfbD
cf-request-id: 056203087d0000dfbb3d1b0200000001
cf-ray: 5d7d07872a2fdfbb-FRA

GET
H2 200 3416767676-css_bundle_v2.css
www.blogger.com/static/v1/widgets/ 36 KB
8 KB 30ms
6ms Stylesheet
text/css 2a00:1450:4001:81f::2009
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.blogger.com/static/v1/widgets/3416767676-css_bundle_v2.css

Requested by

Host: www.vkremez.com
URL: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::2009 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c91afadbe63dd834aac00b49bc715795da58970e7d500c4bd8f50ed713c77880

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 21 Sep 2020 00:01:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Sun, 20 Sep 2020 14:30:32 GMT
server: sffe
age: 309538
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7982
x-xss-protection: 0
expires: Tue, 21 Sep 2021 00:01:04 GMT

GET
H2 200 rocket-loader.min.js Show response
ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/ 12 KB
4 KB 49ms
25ms Script
application/javascript 2606:4700::6810:a723
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js

Requested by

Host: www.vkremez.com
URL: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:a723 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b08cdbc2d30e656a86b20f8342428d5863f70f4b30135b4f4061f754ce932f5e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 14:00:02 GMT
content-encoding: gzip
vary: Accept-Encoding
last-modified: Mon, 14 Sep 2020 19:48:52 GMT
server: cloudflare
etag: W/"5f5fc924-3016"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
content-type: application/javascript
status: 200
cache-control: max-age=172800, public
strict-transport-security: max-age=15780000; includeSubDomains
cf-ray: 5d7d07875d9405c4-FRA
cf-request-id: 0562030893000005c4bebcd200000001
expires: Sat, 26 Sep 2020 14:00:02 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 45 KB
18 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:821::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.vkremez.com
URL: https://www.vkremez.com/cdn-cgi/apps/head/rCFq0Q-zTsMxcd3V8sTNUHIcYvw.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:821::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

60863e86aa7743d1ac841da7f473a05cd57fba81d661cef658e385437f80d5ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 09 Sep 2020 01:50:37 GMT
server: Golfe2
age: 2662
date: Thu, 24 Sep 2020 13:15:40 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18650
expires: Thu, 24 Sep 2020 15:15:40 GMT

GET
H2 200 6Un-tcGipDRUsckjwkdswoMYqSY.js Show response
www.vkremez.com/cdn-cgi/apps/body/ 11 KB
5 KB 13ms
12ms Script
application/javascript 2606:4700:3031::681c:153e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.vkremez.com/cdn-cgi/apps/body/6Un-tcGipDRUsckjwkdswoMYqSY.js
Requested by: Host: www.vkremez.com
URL: https://www.vkremez.com/cdn-cgi/apps/head/rCFq0Q-zTsMxcd3V8sTNUHIcYvw.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681c:153e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5d4f00b740c987fdd882682830c76c2ff10b2b8982ae7ac58086758c274fc935

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 14:00:02 GMT
content-encoding: br
cf-cache-status: HIT
age: 205862
status: 200
x-amz-request-id: CAC04B4957D585E6
x-amz-id-2: 6BxbIIgnIavDArE0vG9P2FYGrgxGfTdJnO1D3kSGuXzdjox5C1ZBa7X44Bt8zL6F3kw7u3CgoWk=
last-modified: Thu, 20 Jul 2017 22:51:20 GMT
server: cloudflare
etag: W/"9fdd0c96e9162120a77ae3a5505c5a13"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
x-amz-version-id: oSpWrK3hBysq.HtSVcNdZvYr4ggdNm5s
cf-request-id: 05620308b10000dfbb3d1b1200000001
cf-ray: 5d7d07878afbdfbb-FRA

GET
H2 200 jquery.js Show response
www.blogblog.com/dynamicviews/de918fe7fca9ee54/js/thirdparty/ 97 KB
34 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:81f::2009
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.blogblog.com/dynamicviews/de918fe7fca9ee54/js/thirdparty/jquery.js

Requested by

Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::2009 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ef25f2d6f5aa424f594bbaa63c1f86a634e2b87911e1db695b2a0c2e6927353a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Wed, 23 Sep 2020 00:59:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 22 Sep 2020 01:36:07 GMT
server: sffe
age: 133237
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35009
x-xss-protection: 0
expires: Wed, 30 Sep 2020 00:59:25 GMT

POST
H3-Q050 200 collect Show response
www.google-analytics.com/j/ 4 B
70 B 14ms
13ms XHR
text/plain 2a00:1450:4001:820::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j86&a=438331343&t=pageview&_s=1&dl=https%3A%2F%2Fwww.vkremez.com%2F2020%2F04%2Flets-learn-trickbot-bazarbackdoor.html&ul=en-us&de=UTF-8&dt=Vitali%20Kremez%20%7C%20Ethical%20Hacker%20%7C%20Reverse%20Engineer%3A%20Let%27s%20Learn%3A%20TrickBot%20%22BazarBackdoor%22%20Process%20Hollowing%20Injection%20Primer&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAAC~&jid=1002642783&gjid=1758815890&cid=2108925075.1600956002&tid=UA-68445231-1&_gid=2619915.1600956002&_r=1&_slc=1&z=360062122

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:820::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 24 Sep 2020 14:00:02 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
status: 200
content-type: text/plain
access-control-allow-origin: https://www.vkremez.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ 1 KB
0 Stylesheet
text/css

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c89a2cf8bf444df7e11af2befd8c1f20a96c34bee6d13270e7692441843395da

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: text/css;charset=utf-8

GET
H3-Q050 200 jquery-mousewheel.js Show response
www.blogblog.com/dynamicviews/de918fe7fca9ee54/js/thirdparty/ 3 KB
2 KB 34ms
10ms Script
text/javascript 2a00:1450:4001:81f::2009
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.blogblog.com/dynamicviews/de918fe7fca9ee54/js/thirdparty/jquery-mousewheel.js

Requested by

Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81f::2009 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7e41f7333fa9b59a516a5a4f3af346bb24a4c3c8a7bc26551b6fec8d0f6b8555

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Wed, 23 Sep 2020 00:59:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 22 Sep 2020 01:36:07 GMT
server: sffe
age: 133237
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1289
x-xss-protection: 0
expires: Wed, 30 Sep 2020 00:59:25 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
88 B 16ms
16ms XHR
text/plain 2a00:1450:400c:c0c::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j86&tid=UA-68445231-1&cid=2108925075.1600956002&jid=1002642783&gjid=1758815890&_gid=2619915.1600956002&_u=IEBAAEAAAAAAAC~&z=1725372011

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c0c::9b Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Thu, 24 Sep 2020 14:00:02 GMT
status: 200
content-type: text/plain
access-control-allow-origin: https://www.vkremez.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
106 B 29ms
28ms Image
image/gif 2a00:1450:4001:819::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j86&tid=UA-68445231-1&cid=2108925075.1600956002&jid=1002642783&_u=IEBAAEAAAAAAAC~&z=1363609022

Requested by

Host: www.vkremez.com
URL: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Sep 2020 14:00:02 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
106 B 20ms
19ms Image
image/gif 2a00:1450:4001:818::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j86&tid=UA-68445231-1&cid=2108925075.1600956002&jid=1002642783&_u=IEBAAEAAAAAAAC~&z=1363609022

Requested by

Host: www.vkremez.com
URL: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Sep 2020 14:00:02 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 common.js Show response
www.blogblog.com/dynamicviews/de918fe7fca9ee54/js/ 214 KB
89 KB 10ms
9ms Script
text/javascript 2a00:1450:4001:81f::2009
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.blogblog.com/dynamicviews/de918fe7fca9ee54/js/common.js

Requested by

Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81f::2009 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4f37cc26aefc6f7ac0b0104cd3ab477f9f88d06ce2a05640f78565002fa6902f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Wed, 23 Sep 2020 00:59:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 22 Sep 2020 01:36:07 GMT
server: sffe
age: 133237
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 90763
x-xss-protection: 0
expires: Wed, 30 Sep 2020 00:59:25 GMT

GET
H3-Q050 200 sidebar.js Show response
www.blogblog.com/dynamicviews/de918fe7fca9ee54/js/ 116 KB
40 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:81f::2009
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.blogblog.com/dynamicviews/de918fe7fca9ee54/js/sidebar.js

Requested by

Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81f::2009 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5bad31055fddde526b7b4e43621f46ff190776a7ee57243072f1d7dd1fa702e7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Wed, 23 Sep 2020 01:32:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 22 Sep 2020 01:36:07 GMT
server: sffe
age: 131224
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40410
x-xss-protection: 0
expires: Wed, 30 Sep 2020 01:32:58 GMT

GET
H3-Q050 200 gadgets.js Show response
www.blogblog.com/dynamicviews/de918fe7fca9ee54/js/ 63 KB
20 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:81f::2009
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.blogblog.com/dynamicviews/de918fe7fca9ee54/js/gadgets.js

Requested by

Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81f::2009 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1856965de5b049979677f4eb5e149f93464e76d8b4beccc66d1befbcd1c6ff56

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Wed, 23 Sep 2020 00:59:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 22 Sep 2020 01:36:07 GMT
server: sffe
age: 133237
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20577
x-xss-protection: 0
expires: Wed, 30 Sep 2020 00:59:25 GMT

GET
H3-Q050 200 comments.js Show response
www.blogblog.com/dynamicviews/4224c15c4e7c9321/js/ 390 KB
119 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:81f::2009
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.blogblog.com/dynamicviews/4224c15c4e7c9321/js/comments.js

Requested by

Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81f::2009 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

266c8725e6911ff0e2f23572d0ebf1e30c7594e49ea8bed00af914c924fc086a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Tue, 22 Sep 2020 01:20:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 14 May 2012 20:21:35 GMT
server: sffe
age: 218375
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 122175
x-xss-protection: 0
expires: Tue, 29 Sep 2020 01:20:27 GMT

GET
H3-Q050 200 authorization.css
www.blogger.com/dyn-css/ 1 B
646 B 114ms
112ms Stylesheet
text/css 2a00:1450:4001:81f::2009
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.blogger.com/dyn-css/authorization.css?targetBlogID=3986785863650565253&zx=af58694e-b051-4e56-bf66-c9a1c9f6f812

Requested by

Host: www.vkremez.com
URL: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81f::2009 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b

Security Headers

Name	Value
Content-Security-Policy	script-src 'self' .google.com .google-analytics.com 'unsafe-inline' 'unsafe-eval' .gstatic.com .googlesyndication.com .blogger.com .googleapis.com uds.googleusercontent.com https://s.ytimg.com https://i18n-cloud.appspot.com www-onepick-opensocial.googleusercontent.com www-bloggervideo-opensocial.googleusercontent.com www-blogger-opensocial.googleusercontent.com https://www.blogblog.com; report-uri /cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: script-src 'self' *.google.com *.google-analytics.com 'unsafe-inline' 'unsafe-eval' *.gstatic.com *.googlesyndication.com *.blogger.com *.googleapis.com uds.googleusercontent.com https://s.ytimg.com https://i18n-cloud.appspot.com www-onepick-opensocial.googleusercontent.com www-bloggervideo-opensocial.googleusercontent.com www-blogger-opensocial.googleusercontent.com https://www.blogblog.com; report-uri /cspreport
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="This is not a P3P policy! See https://www.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info."
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Thu, 24 Sep 2020 14:00:02 GMT
server: GSE
date: Thu, 24 Sep 2020 14:00:02 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=UTF-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 3369543813-widgets.js Show response
www.blogger.com/static/v1/widgets/ 140 KB
51 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:81f::2009
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.blogger.com/static/v1/widgets/3369543813-widgets.js

Requested by

Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81f::2009 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ada150b19834590e9b541a6de7bc403dea550444de15d4841fe5ac5afc8281e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 21 Sep 2020 00:34:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Sun, 20 Sep 2020 23:09:26 GMT
server: sffe
age: 307518
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 52287
x-xss-protection: 0
expires: Tue, 21 Sep 2021 00:34:44 GMT

GET
H2 200 cookienotice.js Show response
www.vkremez.com/js/ 4 KB
1 KB 14ms
13ms Script
text/javascript 2606:4700:3031::681c:153e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.vkremez.com/js/cookienotice.js

Requested by

Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3031::681c:153e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1385fe6c7366b4ab71c2806b9d327c837c8b5d74e35aa762200da83feb6113a8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 14:00:02 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 517177
cf-polished: origSize=6513
status: 200
cf-bgj: minify
cf-request-id: 05620309b70000dfbb3d1c2200000001
last-modified: Fri, 18 Sep 2020 13:09:37 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
x-xss-protection: 0
cache-control: public, max-age=604800
cf-ray: 5d7d07892ee5dfbb-FRA
expires: Fri, 25 Sep 2020 14:20:25 GMT

GET
H3-Q050 200 authorization.css
www.blogger.com/dyn-css/ 1 B
92 B 501ms
501ms Stylesheet
text/css 2a00:1450:4001:81f::2009
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.blogger.com/dyn-css/authorization.css?targetBlogID=3986785863650565253&zx=af58694e-b051-4e56-bf66-c9a1c9f6f812

Requested by

Host: www.vkremez.com
URL: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81f::2009 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b

Security Headers

Name	Value
Content-Security-Policy	script-src 'self' .google.com .google-analytics.com 'unsafe-inline' 'unsafe-eval' .gstatic.com .googlesyndication.com .blogger.com .googleapis.com uds.googleusercontent.com https://s.ytimg.com https://i18n-cloud.appspot.com www-onepick-opensocial.googleusercontent.com www-bloggervideo-opensocial.googleusercontent.com www-blogger-opensocial.googleusercontent.com https://www.blogblog.com; report-uri /cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: script-src 'self' *.google.com *.google-analytics.com 'unsafe-inline' 'unsafe-eval' *.gstatic.com *.googlesyndication.com *.blogger.com *.googleapis.com uds.googleusercontent.com https://s.ytimg.com https://i18n-cloud.appspot.com www-onepick-opensocial.googleusercontent.com www-bloggervideo-opensocial.googleusercontent.com www-blogger-opensocial.googleusercontent.com https://www.blogblog.com; report-uri /cspreport
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="This is not a P3P policy! See https://www.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info."
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Thu, 24 Sep 2020 14:00:03 GMT
server: GSE
date: Thu, 24 Sep 2020 14:00:03 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=UTF-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ 13 KB
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4286fd6f7ca4c6d12f1573d042d24982f0564a0dc35080bf44a560b0845bf4e7

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/gif

GET
H3-Q050 200 default Show response
www.blogger.com/feeds/3986785863650565253/posts/ 2 MB
248 KB 1163ms
1162ms Script
text/javascript 2a00:1450:4001:81f::2009
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.blogger.com/feeds/3986785863650565253/posts/default?alt=json&v=2&dynamicviews=1&orderby=published&max-results=25&rewriteforssl=true&callback=jQuery112509335208543837514_1600956002522&_=1600956002523

Requested by

Host: www.blogblog.com
URL: https://www.blogblog.com/dynamicviews/de918fe7fca9ee54/js/thirdparty/jquery.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81f::2009 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

a04e5061755422189bf006fd2aaa785ffceae0b9d07c61e9fdc1ca0465faea30

Security Headers

Name	Value
Content-Security-Policy	script-src 'self' .google.com .google-analytics.com 'unsafe-inline' 'unsafe-eval' .gstatic.com .googlesyndication.com .blogger.com .googleapis.com uds.googleusercontent.com https://s.ytimg.com https://i18n-cloud.appspot.com www-onepick-opensocial.googleusercontent.com www-bloggervideo-opensocial.googleusercontent.com www-blogger-opensocial.googleusercontent.com https://www.blogblog.com; report-uri /cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: script-src 'self' *.google.com *.google-analytics.com 'unsafe-inline' 'unsafe-eval' *.gstatic.com *.googlesyndication.com *.blogger.com *.googleapis.com uds.googleusercontent.com https://s.ytimg.com https://i18n-cloud.appspot.com www-onepick-opensocial.googleusercontent.com www-bloggervideo-opensocial.googleusercontent.com www-blogger-opensocial.googleusercontent.com https://www.blogblog.com; report-uri /cspreport
content-encoding: gzip
etag: W/"D0MERH05fyp7ImA9XxZTF0o."
access-control-allow-origin: *
p3p: CP="This is not a P3P policy! See https://www.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info."
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 1; mode=block
last-modified: Tue, 22 Sep 2020 11:50:05 GMT
server: GSE
x-frame-options: SAMEORIGIN
date: Thu, 24 Sep 2020 14:00:04 GMT
vary: Accept, X-GData-Authorization, GData-Version
content-type: text/javascript; charset=UTF-8
gdata-version: 2.0
cache-control: private, max-age=0, must-revalidate, no-transform
x-content-type-options: nosniff
expires: Thu, 24 Sep 2020 14:00:04 GMT

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c0d078d779c6d50be940b91eafdc1e0091ee1aef73087fdcddfb7771470b3c59

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/gif

GET
DATA 200
OK truncated
/ 385 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 39e1d583fa516a045854dd31d01795224685f184c7309e649805f961db4c0d4b

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 380 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 34c6eb5fe76799775f269cf110d2b953f50c439b693e6ef0c9ce52426bb5c2fb

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 6114194039930120721 Show response
www.vkremez.com//feeds/posts/default/ 41 KB
5 KB 195ms
194ms XHR
application/json 2606:4700:3031::681c:153e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.vkremez.com//feeds/posts/default/6114194039930120721?alt=json&v=2&dynamicviews=1&rewriteforssl=true

Requested by

Host: www.blogblog.com
URL: https://www.blogblog.com/dynamicviews/de918fe7fca9ee54/js/thirdparty/jquery.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3031::681c:153e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

38c7b9dfaa94c5bb687b94856b3f667b3fc32558cefc8db2462e428b22f3f272

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 14:00:05 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
status: 200
cf-request-id: 05620313c10000dfbb3d261200000001
last-modified: Sat, 25 Apr 2020 10:23:38 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"ab35f24ac5860f50ec29cacd5798add2ff4e5eb36392c0a27cc52061de8ed941"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/json; charset=UTF-8
x-xss-protection: 0
cache-control: public, must-revalidate, proxy-revalidate, max-age=1
cf-ray: 5d7d07993f6ddfbb-FRA
expires: Thu, 24 Sep 2020 14:00:06 GMT

GET
H2 200 plusone.js Show response
apis.google.com/js/ 49 KB
19 KB 26ms
26ms Script
application/javascript 2a00:1450:4001:819::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/js/plusone.js?_=1600956002524

Requested by

Host: www.blogblog.com
URL: https://www.blogblog.com/dynamicviews/de918fe7fca9ee54/js/thirdparty/jquery.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

477f12c7e6663b43c795c9dfc11bb8abe246f8fe12ab8336be2968eac0a4bab7

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-sYbokhj6Z4Tr8/8jnXReug' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 14:00:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
status: 200
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
x-ua-compatible: IE=edge, chrome=1
server: ESF
etag: "c47d1d101ae391b75bebfbb19d5b4f98"
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=1800, stale-while-revalidate=1800
content-security-policy: script-src 'report-sample' 'nonce-sYbokhj6Z4Tr8/8jnXReug' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
timing-allow-origin: *
expires: Thu, 24 Sep 2020 14:00:05 GMT

GET
DATA 200
OK truncated
/ 288 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 088734158a6c69e32f928ffa72f2e6505312e5a76bca31ff34bbe85ce100e992

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK widgets.js Show response
platform.twitter.com/ 95 KB
29 KB 9ms
8ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets.js
Requested by: Host: www.blogblog.com
URL: https://www.blogblog.com/dynamicviews/de918fe7fca9ee54/js/thirdparty/jquery.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (fcn/40FB) /
Resource Hash: a761b426004caba495cdac2c93ce7dd306c47bc4d7bdc63c4840c3d8182396a9

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 24 Sep 2020 14:00:05 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Age: 269
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Content-Length: 28881
x-tw-cdn: VZ
Last-Modified: Tue, 01 Sep 2020 20:40:54 GMT
Server: ECS (fcn/40FB)
Etag: "a58136137a93f33c1d165df7d4d973f8+gzip"
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=1800

GET
H2 200 Screen%2BShot%2B2020-04-25%2Bat%2B3.15.02%2BAM.png
1.bp.blogspot.com/-ArgupP7N1rA/XqPjhNVmAcI/AAAAAAAAenA/IohRyVV3k_kl6qSvKSZB9g4yjl2MMIcZgCLcBGAsYHQ/s640/ 107 KB
107 KB 78ms
40ms Image
image/png 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1.bp.blogspot.com/-ArgupP7N1rA/XqPjhNVmAcI/AAAAAAAAenA/IohRyVV3k_kl6qSvKSZB9g4yjl2MMIcZgCLcBGAsYHQ/s640/Screen%2BShot%2B2020-04-25%2Bat%2B3.15.02%2BAM.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

a3526975153401491b2ebe96da9193881276911067fea1859d559fa0af980e0f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 10:11:24 GMT
x-content-type-options: nosniff
age: 13721
status: 200
content-disposition: inline;filename="Screen Shot 2020-04-25 at 3.15.02 AM.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 109507
x-xss-protection: 0
server: fife
etag: "v7a71"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 23 Sep 2020 20:40:12 GMT

GET
H2 200 Untitled%2BDiagram.jpg
1.bp.blogspot.com/-5Tvssi5LAWY/XqQEDI7d_rI/AAAAAAAAenc/M3bufTHGlEoTg2jMGzy0OhK67ucniHnAACLcBGAsYHQ/s640/ 89 KB
89 KB 71ms
33ms Image
image/jpeg 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1.bp.blogspot.com/-5Tvssi5LAWY/XqQEDI7d_rI/AAAAAAAAenc/M3bufTHGlEoTg2jMGzy0OhK67ucniHnAACLcBGAsYHQ/s640/Untitled%2BDiagram.jpg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

84d8ff0b83ae2d4534af3e612a96a91a1ff9b6281e24e9566b9916417ceb63b9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 10:11:24 GMT
x-content-type-options: nosniff
age: 13721
status: 200
content-disposition: inline;filename="Untitled Diagram.jpg"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 91436
x-xss-protection: 0
server: fife
etag: "v7a78"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 23 Sep 2020 20:41:18 GMT

GET
H2 200 Screen%2BShot%2B2020-04-25%2Bat%2B5.44.40%2BAM.png
1.bp.blogspot.com/-q7KasYAefY8/XqQHGW1XOuI/AAAAAAAAen0/6MFwtbGsl64-PsqYExYmuqP3Cvm5uIdgwCLcBGAsYHQ/s640/ 117 KB
117 KB 57ms
24ms Image
image/png 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1.bp.blogspot.com/-q7KasYAefY8/XqQHGW1XOuI/AAAAAAAAen0/6MFwtbGsl64-PsqYExYmuqP3Cvm5uIdgwCLcBGAsYHQ/s640/Screen%2BShot%2B2020-04-25%2Bat%2B5.44.40%2BAM.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

a97f410f65e2faae69fac5ef8c34a937808d1094960062ded1682d5af3d669ac

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 10:11:26 GMT
x-content-type-options: nosniff
age: 13719
status: 200
content-disposition: inline;filename="Screen Shot 2020-04-25 at 5.44.40 AM.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 119376
x-xss-protection: 0
server: fife
etag: "v7a7e"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 23 Sep 2020 20:42:20 GMT

GET
H2 200 Screen%2BShot%2B2020-04-25%2Bat%2B5.40.39%2BAM.png
1.bp.blogspot.com/-ur46xL-v-Wc/XqQFrZ17mDI/AAAAAAAAeno/rVHOUI7n19wWLYhC3FGhm_1dyHjLG817QCLcBGAsYHQ/s640/ 16 KB
16 KB 56ms
23ms Image
image/png 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1.bp.blogspot.com/-ur46xL-v-Wc/XqQFrZ17mDI/AAAAAAAAeno/rVHOUI7n19wWLYhC3FGhm_1dyHjLG817QCLcBGAsYHQ/s640/Screen%2BShot%2B2020-04-25%2Bat%2B5.40.39%2BAM.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

6d6b2397c0429050dd22ca4322bd54351a88692ff74c0603ac20d9cdfc68a191

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 10:11:26 GMT
x-content-type-options: nosniff
age: 13719
status: 200
content-disposition: inline;filename="Screen Shot 2020-04-25 at 5.40.39 AM.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16740
x-xss-protection: 0
server: fife
etag: "v7a7b"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 23 Sep 2020 20:42:41 GMT

GET
H2 200 Screen%2BShot%2B2020-04-25%2Bat%2B5.57.30%2BAM.png
1.bp.blogspot.com/-_BTtTjFpyo8/XqQJtRbivDI/AAAAAAAAeoA/DSOaPB_JydcF4Cyk3NL56PGvVj7BnrOCACLcBGAsYHQ/s640/ 34 KB
34 KB 47ms
14ms Image
image/png 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1.bp.blogspot.com/-_BTtTjFpyo8/XqQJtRbivDI/AAAAAAAAeoA/DSOaPB_JydcF4Cyk3NL56PGvVj7BnrOCACLcBGAsYHQ/s640/Screen%2BShot%2B2020-04-25%2Bat%2B5.57.30%2BAM.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

2dde0068aa6abd942461e9f5a2ce63505faa130295454b6b6bbec371de6fe009

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 10:11:26 GMT
x-content-type-options: nosniff
age: 13719
status: 200
content-disposition: inline;filename="Screen Shot 2020-04-25 at 5.57.30 AM.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34395
x-xss-protection: 0
server: fife
etag: "v7a81"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 23 Sep 2020 20:42:41 GMT

GET
H3-Q050 200 Screen%2BShot%2B2020-04-25%2Bat%2B3.15.02%2BAM.png
1.bp.blogspot.com/-ArgupP7N1rA/XqPjhNVmAcI/AAAAAAAAenA/IohRyVV3k_kl6qSvKSZB9g4yjl2MMIcZgCLcBGAsYHQ/s30-p/ 1 KB
1 KB 49ms
19ms Image
image/png 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1.bp.blogspot.com/-ArgupP7N1rA/XqPjhNVmAcI/AAAAAAAAenA/IohRyVV3k_kl6qSvKSZB9g4yjl2MMIcZgCLcBGAsYHQ/s30-p/Screen%2BShot%2B2020-04-25%2Bat%2B3.15.02%2BAM.png

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

60f2ee8979a830df28592bdc641f0ec2772430031e7a50b4c7d9592c8a7733ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 10:11:25 GMT
x-content-type-options: nosniff
age: 13721
status: 200
content-disposition: inline;filename="Screen Shot 2020-04-25 at 3.15.02 AM.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1279
x-xss-protection: 0
server: fife
etag: "v7a71"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sun, 20 Sep 2020 12:25:37 GMT

GET
H3-Q050 200 Screen%2BShot%2B2020-02-24%2Bat%2B6.09.24%2BPM.png
1.bp.blogspot.com/-wRqDCGKGUmU/XlSDqTVA80I/AAAAAAAAH2k/bpC4X8IdXkcrYpWHed5FaKAdzIfl3M12gCLcBGAsYHQ/s30-p/ 764 B
897 B 42ms
11ms Image
image/png 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1.bp.blogspot.com/-wRqDCGKGUmU/XlSDqTVA80I/AAAAAAAAH2k/bpC4X8IdXkcrYpWHed5FaKAdzIfl3M12gCLcBGAsYHQ/s30-p/Screen%2BShot%2B2020-02-24%2Bat%2B6.09.24%2BPM.png

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

10e1b9c2de3504f2345907eef55f57ab8db35cafc72afdec0ac986f45291a8e8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 10:11:25 GMT
x-content-type-options: nosniff
age: 13721
status: 200
content-disposition: inline;filename="Screen Shot 2020-02-24 at 6.09.24 PM.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 764
x-xss-protection: 0
server: fife
etag: "v1f6a"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Thu, 24 Sep 2020 05:21:08 GMT

GET
H3-Q050 200 Screen%2BShot%2B2020-02-19%2Bat%2B5.26.15%2BAM.png
1.bp.blogspot.com/-zRHtoHc0g_M/Xk03iK0UUcI/AAAAAAAAH1o/ULWyAPMdCzQYn_bzwJn2aq-re7ah9H8-wCLcBGAsYHQ/s30-p/ 2 KB
2 KB 46ms
16ms Image
image/png 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1.bp.blogspot.com/-zRHtoHc0g_M/Xk03iK0UUcI/AAAAAAAAH1o/ULWyAPMdCzQYn_bzwJn2aq-re7ah9H8-wCLcBGAsYHQ/s30-p/Screen%2BShot%2B2020-02-19%2Bat%2B5.26.15%2BAM.png

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

f749661c02cee9c7aef6745e82a1125d68762c4759dcdbfd163e3f24bde6be57

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 10:11:25 GMT
x-content-type-options: nosniff
age: 13721
status: 200
content-disposition: inline;filename="Screen Shot 2020-02-19 at 5.26.15 AM.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1772
x-xss-protection: 0
server: fife
etag: "v1f5b"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Thu, 24 Sep 2020 05:21:08 GMT

GET
H3-Q050 200 Screen%2BShot%2B2019-10-17%2Bat%2B3.23.25%2BAM.png
1.bp.blogspot.com/-BFB9g8hHghc/XahDwQnC0bI/AAAAAAAAHtg/yIfJR0nnQ4oCZeThx3QJozdf_o-6plbsACLcBGAsYHQ/s30-p/ 2 KB
2 KB 44ms
14ms Image
image/png 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1.bp.blogspot.com/-BFB9g8hHghc/XahDwQnC0bI/AAAAAAAAHtg/yIfJR0nnQ4oCZeThx3QJozdf_o-6plbsACLcBGAsYHQ/s30-p/Screen%2BShot%2B2019-10-17%2Bat%2B3.23.25%2BAM.png

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

d310a2a2ad6bcac4068391482c43950cc7e672ad698641309af0c8dbaa673456

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 10:11:25 GMT
x-content-type-options: nosniff
age: 13721
status: 200
content-disposition: inline;filename="Screen Shot 2019-10-17 at 3.23.25 AM.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1990
x-xss-protection: 0
server: fife
etag: "v1eda"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Thu, 24 Sep 2020 05:21:08 GMT

GET
H2 200 Screen%2BShot%2B2019-04-09%2Bat%2B11.33.21%2BPM.png
3.bp.blogspot.com/-xrGuSSykGbk/XK1xBfvzJkI/AAAAAAAAHek/ZnqzET1gra4g0TXilKnzVn0lYtf5ZSHNQCLcBGAs/s30-p/ 2 KB
2 KB 19ms
9ms Image
image/png 2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://3.bp.blogspot.com/-xrGuSSykGbk/XK1xBfvzJkI/AAAAAAAAHek/ZnqzET1gra4g0TXilKnzVn0lYtf5ZSHNQCLcBGAs/s30-p/Screen%2BShot%2B2019-04-09%2Bat%2B11.33.21%2BPM.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

12956acbc65984f465f513dadb036a69899a5320d464ecc44fbdff33d47d402c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 12:11:07 GMT
x-content-type-options: nosniff
age: 6539
status: 200
content-disposition: inline;filename="Screen Shot 2019-04-09 at 11.33.21 PM.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2027
x-xss-protection: 0
server: fife
etag: "v1dea"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sat, 19 Sep 2020 14:57:53 GMT

GET
H2 200 Screen%2BShot%2B2019-03-25%2Bat%2B5.34.42%2BPM.png
4.bp.blogspot.com/--NaQfTZyMpY/XJs0JKp4ccI/AAAAAAAAHcE/CY_hI1R1N4wCnA8pUERPBCOR-Cth9q-5gCLcBGAs/s30-p/ 2 KB
2 KB 21ms
12ms Image
image/png 2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://4.bp.blogspot.com/--NaQfTZyMpY/XJs0JKp4ccI/AAAAAAAAHcE/CY_hI1R1N4wCnA8pUERPBCOR-Cth9q-5gCLcBGAs/s30-p/Screen%2BShot%2B2019-03-25%2Bat%2B5.34.42%2BPM.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

e0c75a3728746941983a7e3b362dd5df7c2d67dcb49567724fabb15b1ef50947

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 13:05:58 GMT
x-content-type-options: nosniff
age: 3248
status: 200
content-disposition: inline;filename="Screen Shot 2019-03-25 at 5.34.42 PM.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1848
x-xss-protection: 0
server: fife
etag: "v1dc2"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sat, 19 Sep 2020 14:20:37 GMT

GET
H3-Q050 200 Screen%2BShot%2B2019-01-26%2Bat%2B2.24.40%2BPM.png
1.bp.blogspot.com/-rXa2_1hlcBM/XEy2wI8ErII/AAAAAAAAHYw/uHEGwusPGW8EKj_Vu8JJHaSEMa5vCcZPwCLcBGAs/s30-p/ 1 KB
1 KB 43ms
13ms Image
image/png 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1.bp.blogspot.com/-rXa2_1hlcBM/XEy2wI8ErII/AAAAAAAAHYw/uHEGwusPGW8EKj_Vu8JJHaSEMa5vCcZPwCLcBGAs/s30-p/Screen%2BShot%2B2019-01-26%2Bat%2B2.24.40%2BPM.png

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

eba3881542a1ce2068c819ecebaf2f7ba9dbbf2cbde8f68eaa39a832ef66c6c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 10:11:25 GMT
x-content-type-options: nosniff
age: 13721
status: 200
content-disposition: inline;filename="Screen Shot 2019-01-26 at 2.24.40 PM.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1051
x-xss-protection: 0
server: fife
etag: "v1d8d"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sun, 20 Sep 2020 12:25:37 GMT

GET
H3-Q050 200 Screen%2BShot%2B2019-01-22%2Bat%2B4.44.18%2BAM.png
1.bp.blogspot.com/-SewP8w1rWhA/XEbmZlh0EPI/AAAAAAAAHYE/XyZI1h8Ee4MJ1602YpwD4XTJSVxDrOr0ACLcBGAs/s30-p/ 2 KB
2 KB 42ms
12ms Image
image/png 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1.bp.blogspot.com/-SewP8w1rWhA/XEbmZlh0EPI/AAAAAAAAHYE/XyZI1h8Ee4MJ1602YpwD4XTJSVxDrOr0ACLcBGAs/s30-p/Screen%2BShot%2B2019-01-22%2Bat%2B4.44.18%2BAM.png

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

352c0ffe232c95e651a332fc322419fc55330d3c91f7fbf51ff430847ee1623f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 10:11:25 GMT
x-content-type-options: nosniff
age: 13721
status: 200
content-disposition: inline;filename="Screen Shot 2019-01-22 at 4.44.18 AM.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2064
x-xss-protection: 0
server: fife
etag: "v1d82"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Thu, 24 Sep 2020 05:21:08 GMT

GET
H2 200 Screen%2BShot%2B2019-01-09%2Bat%2B5.20.46%2BPM.png
4.bp.blogspot.com/-sRfvVgl_kmU/XDaN88wxo6I/AAAAAAAAHXQ/ZJYnIss-Asof-cHT7nCindJ8K0v7eaa4wCLcBGAs/s30-p/ 1 KB
1 KB 19ms
10ms Image
image/png 2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://4.bp.blogspot.com/-sRfvVgl_kmU/XDaN88wxo6I/AAAAAAAAHXQ/ZJYnIss-Asof-cHT7nCindJ8K0v7eaa4wCLcBGAs/s30-p/Screen%2BShot%2B2019-01-09%2Bat%2B5.20.46%2BPM.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

e9c446e0dbaf6509c3f50825b8592884f7bf7d21aaf5b0fddaa98d7b389ecd5b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 13:05:58 GMT
x-content-type-options: nosniff
age: 3248
status: 200
content-disposition: inline;filename="Screen Shot 2019-01-09 at 5.20.46 PM.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1189
x-xss-protection: 0
server: fife
etag: "v1d76"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sat, 19 Sep 2020 14:20:37 GMT

GET
H3-Q050 200 Screen%2BShot%2B2019-01-07%2Bat%2B3.05.10%2BAM.png
1.bp.blogspot.com/-cwiFd3zTZVc/XDMIomqSUBI/AAAAAAAAHXE/Ra1R7BgM3sUDojjS7MAXV_WCrlJYSS7gwCLcBGAs/s30-p/ 1 KB
1 KB 45ms
16ms Image
image/png 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1.bp.blogspot.com/-cwiFd3zTZVc/XDMIomqSUBI/AAAAAAAAHXE/Ra1R7BgM3sUDojjS7MAXV_WCrlJYSS7gwCLcBGAs/s30-p/Screen%2BShot%2B2019-01-07%2Bat%2B3.05.10%2BAM.png

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

83adc88a1264b185cff852951ffdd42d68761f692b9e28951d26fa20eaccf2be

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 10:11:25 GMT
x-content-type-options: nosniff
age: 13721
status: 200
content-disposition: inline;filename="Screen Shot 2019-01-07 at 3.05.10 AM.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1254
x-xss-protection: 0
server: fife
etag: "v1d72"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Mon, 14 Sep 2020 11:08:16 GMT

GET
H2 200 Screen%2BShot%2B2018-12-23%2Bat%2B9.47.56%2BPM.png
3.bp.blogspot.com/-t8zscHidTek/XCBMp2PlXqI/AAAAAAAAHVo/9ilggnaHxew6zBDoCkayTr3gjA8Ko028ACLcBGAs/s30-p/ 2 KB
2 KB 18ms
10ms Image
image/png 2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://3.bp.blogspot.com/-t8zscHidTek/XCBMp2PlXqI/AAAAAAAAHVo/9ilggnaHxew6zBDoCkayTr3gjA8Ko028ACLcBGAs/s30-p/Screen%2BShot%2B2018-12-23%2Bat%2B9.47.56%2BPM.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

eeea76d34a426787eab8f9ddf9209a6188a05f180b961b93f7fb767b908e96d9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 12:11:07 GMT
x-content-type-options: nosniff
age: 6539
status: 200
content-disposition: inline;filename="Screen Shot 2018-12-23 at 9.47.56 PM.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1620
x-xss-protection: 0
server: fife
etag: "v1d5c"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sat, 19 Sep 2020 14:57:54 GMT

GET
H3-Q050 200 Screen%2BShot%2B2018-12-21%2Bat%2B3.14.20%2BAM.png
1.bp.blogspot.com/--UsOqUKJ80w/XByhiyP-PmI/AAAAAAAAHVA/dETYa0pXcK4IQkv6uOAQItI3TgTfw5W7QCLcBGAs/s30-p/ 1 KB
1 KB 46ms
18ms Image
image/png 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1.bp.blogspot.com/--UsOqUKJ80w/XByhiyP-PmI/AAAAAAAAHVA/dETYa0pXcK4IQkv6uOAQItI3TgTfw5W7QCLcBGAs/s30-p/Screen%2BShot%2B2018-12-21%2Bat%2B3.14.20%2BAM.png

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

f5fcff76c1da90c0cfa732560a2952a473fc0245c48c443d1df37b1d25fe3834

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 10:11:25 GMT
x-content-type-options: nosniff
age: 13721
status: 200
content-disposition: inline;filename="Screen Shot 2018-12-21 at 3.14.20 AM.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1056
x-xss-protection: 0
server: fife
etag: "v1d51"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Thu, 24 Sep 2020 05:21:09 GMT

GET
H2 200 Screen%2BShot%2B2018-12-15%2Bat%2B8.11.28%2BPM.png
3.bp.blogspot.com/-X6bXlNXerAg/XBXPWMljQNI/AAAAAAAAHTo/aF51svoEZgEnFK-M3dldF2DgKkhAjuuMgCLcBGAs/s30-p/ 1 KB
2 KB 26ms
18ms Image
image/png 2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://3.bp.blogspot.com/-X6bXlNXerAg/XBXPWMljQNI/AAAAAAAAHTo/aF51svoEZgEnFK-M3dldF2DgKkhAjuuMgCLcBGAs/s30-p/Screen%2BShot%2B2018-12-15%2Bat%2B8.11.28%2BPM.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

672d64bef3ef92e42a5550c13238cc329787222e2874cbabbe4861a136d29dc2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 12:11:07 GMT
x-content-type-options: nosniff
age: 6539
status: 200
content-disposition: inline;filename="Screen Shot 2018-12-15 at 8.11.28 PM.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1433
x-xss-protection: 0
server: fife
etag: "v1d3b"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sat, 19 Sep 2020 14:57:54 GMT

GET
H2 200 Screen%2BShot%2B2018-12-09%2Bat%2B9.44.22%2BPM.png
4.bp.blogspot.com/-hHt0KfFwTsI/XA3t55C7QeI/AAAAAAAAHSA/TCipE2G3AqssZl3FKANCjGDp19fqTQAJACLcBGAs/s30-p/ 2 KB
2 KB 19ms
12ms Image
image/png 2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://4.bp.blogspot.com/-hHt0KfFwTsI/XA3t55C7QeI/AAAAAAAAHSA/TCipE2G3AqssZl3FKANCjGDp19fqTQAJACLcBGAs/s30-p/Screen%2BShot%2B2018-12-09%2Bat%2B9.44.22%2BPM.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

83a2e9e77e37f8142be840b51bfe16f27c7d857ca614550e93aa860eb29391a9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 13:05:58 GMT
x-content-type-options: nosniff
age: 3248
status: 200
content-disposition: inline;filename="Screen Shot 2018-12-09 at 9.44.22 PM.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1711
x-xss-protection: 0
server: fife
etag: "v1d21"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sat, 19 Sep 2020 14:20:37 GMT

GET
H3-Q050 200 Screen%2BShot%2B2018-11-26%2Bat%2B5.06.22%2BAM.png
1.bp.blogspot.com/-s4gRRh4SEBs/W_vGIYXDYqI/AAAAAAAAHPI/Qlo-fQDqDuU-DvFARNmnwuX3Mr52mmWRgCLcBGAs/s30-p/ 1 KB
1 KB 43ms
15ms Image
image/png 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1.bp.blogspot.com/-s4gRRh4SEBs/W_vGIYXDYqI/AAAAAAAAHPI/Qlo-fQDqDuU-DvFARNmnwuX3Mr52mmWRgCLcBGAs/s30-p/Screen%2BShot%2B2018-11-26%2Bat%2B5.06.22%2BAM.png

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

f5b92e0c5428ee48219650011e0bcf48607dd9a390f1b36384fb38087b67f24d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 10:11:26 GMT
x-content-type-options: nosniff
age: 13720
status: 200
content-disposition: inline;filename="Screen Shot 2018-11-26 at 5.06.22 AM.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1352
x-xss-protection: 0
server: fife
etag: "v1cf3"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Thu, 24 Sep 2020 05:21:09 GMT

GET
H3-Q050 200 image1_macro_debuggin.png
1.bp.blogspot.com/-5MqO54-Xh2E/W_e_jEsacqI/AAAAAAAAHOc/3ICdhvTV02YIZylAvfZrC4tRLlksL6nDQCLcBGAs/s30-p/ 1 KB
1 KB 34ms
7ms Image
image/png 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1.bp.blogspot.com/-5MqO54-Xh2E/W_e_jEsacqI/AAAAAAAAHOc/3ICdhvTV02YIZylAvfZrC4tRLlksL6nDQCLcBGAs/s30-p/image1_macro_debuggin.png

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

a400d73caf87f08fa624b8ac9100a38d076f736bd718cc7131331b35c5e885c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 10:11:26 GMT
x-content-type-options: nosniff
age: 13720
status: 200
content-disposition: inline;filename="image1_macro_debuggin.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1081
x-xss-protection: 0
server: fife
etag: "v1ce8"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Thu, 24 Sep 2020 05:21:09 GMT

GET
H3-Q050 200 Screen%2BShot%2B2018-11-06%2Bat%2B4.39.53%2BPM.png
1.bp.blogspot.com/--cp1FNG6T40/W-J9-aFanZI/AAAAAAAAHMw/e4iaqzE9t_A5myXDmEJ8MlJdh-7o4EchQCLcBGAs/s30-p/ 2 KB
2 KB 41ms
13ms Image
image/png 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1.bp.blogspot.com/--cp1FNG6T40/W-J9-aFanZI/AAAAAAAAHMw/e4iaqzE9t_A5myXDmEJ8MlJdh-7o4EchQCLcBGAs/s30-p/Screen%2BShot%2B2018-11-06%2Bat%2B4.39.53%2BPM.png

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

870c88fd51fa56c52989ef0e94f106c46aef8e2036ad694d72cb02a8e307785f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 10:11:26 GMT
x-content-type-options: nosniff
age: 13720
status: 200
content-disposition: inline;filename="Screen Shot 2018-11-06 at 4.39.53 PM.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1937
x-xss-protection: 0
server: fife
etag: "v1ccd"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Thu, 24 Sep 2020 05:21:09 GMT

GET
H3-Q050 200 Screen%2BShot%2B2018-11-04%2Bat%2B8.44.34%2BPM.png
1.bp.blogspot.com/-05o9SnLltcw/W9-hH5gi4qI/AAAAAAAAHMM/9H71sQ89poQido3PSK81lJnYuzDvqmqBwCLcBGAs/s30-p/ 2 KB
2 KB 34ms
7ms Image
image/png 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1.bp.blogspot.com/-05o9SnLltcw/W9-hH5gi4qI/AAAAAAAAHMM/9H71sQ89poQido3PSK81lJnYuzDvqmqBwCLcBGAs/s30-p/Screen%2BShot%2B2018-11-04%2Bat%2B8.44.34%2BPM.png

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

0c239d58c774a19f664eb6ab5004a6ae3c449325ee5998ba65f892df4d6a5971

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 10:11:26 GMT
x-content-type-options: nosniff
age: 13720
status: 200
content-disposition: inline;filename="Screen Shot 2018-11-04 at 8.44.34 PM.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1646
x-xss-protection: 0
server: fife
etag: "v1cc4"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Thu, 24 Sep 2020 05:21:09 GMT

GET
H2 200 Screen%2BShot%2B2018-10-30%2Bat%2B6.58.15%2BPM.png
2.bp.blogspot.com/-Rz7n-eamwX4/W9jkh5B1wUI/AAAAAAAAHKQ/ZyZ7fueFMnMceFlK9KOo8AqUqPy_9yB3wCLcBGAs/s30-p/ 1 KB
1 KB 19ms
12ms Image
image/png 2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://2.bp.blogspot.com/-Rz7n-eamwX4/W9jkh5B1wUI/AAAAAAAAHKQ/ZyZ7fueFMnMceFlK9KOo8AqUqPy_9yB3wCLcBGAs/s30-p/Screen%2BShot%2B2018-10-30%2Bat%2B6.58.15%2BPM.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

146cf03f372f999168d4ec2a94380976f15f17fbfb08fbffde1c1a5f67438fee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 12:11:07 GMT
x-content-type-options: nosniff
age: 6539
status: 200
content-disposition: inline;filename="Screen Shot 2018-10-30 at 6.58.15 PM.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1196
x-xss-protection: 0
server: fife
etag: "v1ca6"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sat, 19 Sep 2020 14:57:54 GMT

GET
H2 200 Screen%2BShot%2B2018-09-10%2Bat%2B00.38.47.png
2.bp.blogspot.com/-PIyOirFZV6Y/W5YpFQcTVFI/AAAAAAAAHGw/T7-XrQawAkY6BaNc0J-3S0aMzsar2Z-jwCLcBGAs/s30-p/ 2 KB
2 KB 24ms
17ms Image
image/png 2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://2.bp.blogspot.com/-PIyOirFZV6Y/W5YpFQcTVFI/AAAAAAAAHGw/T7-XrQawAkY6BaNc0J-3S0aMzsar2Z-jwCLcBGAs/s30-p/Screen%2BShot%2B2018-09-10%2Bat%2B00.38.47.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

5114816a47dc958d23af84763e576b236d08aa1366f10b5ec37d2ba5052b74c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 12:11:07 GMT
x-content-type-options: nosniff
age: 6539
status: 200
content-disposition: inline;filename="Screen Shot 2018-09-10 at 00.38.47.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2135
x-xss-protection: 0
server: fife
etag: "v1c6d"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sat, 19 Sep 2020 14:57:54 GMT

GET
H2 200 Screen%2BShot%2B2018-09-06%2Bat%2B04.48.03.png
4.bp.blogspot.com/-uYF2NQ20lCo/W5DqRi1JG3I/AAAAAAAAHFg/8Ha8vfsn23wxxrekXp5gepLwWs072EkVwCLcBGAs/s30-p/ 1 KB
1 KB 17ms
11ms Image
image/png 2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://4.bp.blogspot.com/-uYF2NQ20lCo/W5DqRi1JG3I/AAAAAAAAHFg/8Ha8vfsn23wxxrekXp5gepLwWs072EkVwCLcBGAs/s30-p/Screen%2BShot%2B2018-09-06%2Bat%2B04.48.03.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

439476ca5fd109c0aeb8e6c55d4cc4e2e772a27a582c49109494f06f40c95cbc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 13:05:58 GMT
x-content-type-options: nosniff
age: 3248
status: 200
content-disposition: inline;filename="Screen Shot 2018-09-06 at 04.48.03.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1298
x-xss-protection: 0
server: fife
etag: "v1c59"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sat, 19 Sep 2020 14:20:37 GMT

GET
H2 200 Screen%2BShot%2B2018-08-28%2Bat%2B03.03.10.png
2.bp.blogspot.com/-9ubYbrXWp9k/W4T0eMzLBCI/AAAAAAAAHDw/oLJVlmoiBqQalzT-Eppbdu4TMBbBoIerQCLcBGAs/s30-p/ 1 KB
2 KB 23ms
17ms Image
image/png 2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://2.bp.blogspot.com/-9ubYbrXWp9k/W4T0eMzLBCI/AAAAAAAAHDw/oLJVlmoiBqQalzT-Eppbdu4TMBbBoIerQCLcBGAs/s30-p/Screen%2BShot%2B2018-08-28%2Bat%2B03.03.10.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

1ad705e628a38ac534ff5357e88b0ebe199385bd3afbc6a8a75eeadd9885fd24

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 12:11:07 GMT
x-content-type-options: nosniff
age: 6539
status: 200
content-disposition: inline;filename="Screen Shot 2018-08-28 at 03.03.10.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1472
x-xss-protection: 0
server: fife
etag: "v1c3d"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sat, 19 Sep 2020 14:57:54 GMT

GET
H2 200 Screen%2BShot%2B2018-08-19%2Bat%2B07.00.01.png
4.bp.blogspot.com/-iIEkOuxfkNc/W3lRgAF9MlI/AAAAAAAAHAk/BrzQCvSlnYkPBhF9wSjllynsDLLUPJ2CQCLcBGAs/s30-p/ 2 KB
2 KB 17ms
16ms Image
image/png 2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://4.bp.blogspot.com/-iIEkOuxfkNc/W3lRgAF9MlI/AAAAAAAAHAk/BrzQCvSlnYkPBhF9wSjllynsDLLUPJ2CQCLcBGAs/s30-p/Screen%2BShot%2B2018-08-19%2Bat%2B07.00.01.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

82def3e3ea5794d68c07253d6d5b547985b3bea4227b6942a29fba62fde49a63

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 13:05:58 GMT
x-content-type-options: nosniff
age: 3248
status: 200
content-disposition: inline;filename="Screen Shot 2018-08-19 at 07.00.01.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1918
x-xss-protection: 0
server: fife
etag: "v1c0a"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Fri, 18 Sep 2020 05:18:37 GMT

GET
H3-Q050 200 Screen%2BShot%2B2018-08-04%2Bat%2B03.25.26.png
1.bp.blogspot.com/-FsUD_n2eD3E/W2YW4hdyigI/AAAAAAAAG-w/0gTTGBZBLsEcc89IQ7d89Pw3S9sJ1bMzgCLcBGAs/s30-p/ 2 KB
2 KB 39ms
12ms Image
image/png 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1.bp.blogspot.com/-FsUD_n2eD3E/W2YW4hdyigI/AAAAAAAAG-w/0gTTGBZBLsEcc89IQ7d89Pw3S9sJ1bMzgCLcBGAs/s30-p/Screen%2BShot%2B2018-08-04%2Bat%2B03.25.26.png

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

882b7316b4f9053b6debabf8bf1d257950264d501cd30cd2c48972c59a164a8c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 10:11:26 GMT
x-content-type-options: nosniff
age: 13720
status: 200
content-disposition: inline;filename="Screen Shot 2018-08-04 at 03.25.26.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1616
x-xss-protection: 0
server: fife
etag: "v1bed"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Thu, 24 Sep 2020 05:21:10 GMT

GET
H2 200 Screen%2BShot%2B2018-07-29%2Bat%2B01.10.00.png
4.bp.blogspot.com/-CRdVdC0Psrc/W11XGprudiI/AAAAAAAAG9A/MMMwtq_S0a0QdZoOxGcShZ9Nn1nO_-gyACLcBGAs/s30-p/ 2 KB
2 KB 13ms
13ms Image
image/png 2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://4.bp.blogspot.com/-CRdVdC0Psrc/W11XGprudiI/AAAAAAAAG9A/MMMwtq_S0a0QdZoOxGcShZ9Nn1nO_-gyACLcBGAs/s30-p/Screen%2BShot%2B2018-07-29%2Bat%2B01.10.00.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

c678636b42cce155be48ee783b75a30e2851d08e7f81e5b6279520a24746d917

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 13:05:58 GMT
x-content-type-options: nosniff
age: 3248
status: 200
content-disposition: inline;filename="Screen Shot 2018-07-29 at 01.10.00.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1721
x-xss-protection: 0
server: fife
etag: "v1bd1"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Fri, 18 Sep 2020 05:18:37 GMT

GET
H3-Q050 200 Screen%2BShot%2B2020-04-25%2Bat%2B5.40.39%2BAM.png
1.bp.blogspot.com/-ur46xL-v-Wc/XqQFrZ17mDI/AAAAAAAAeno/rVHOUI7n19wWLYhC3FGhm_1dyHjLG817QCLcBGAsYHQ/s640/ 16 KB
16 KB 8ms
7ms Image
image/png 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1.bp.blogspot.com/-ur46xL-v-Wc/XqQFrZ17mDI/AAAAAAAAeno/rVHOUI7n19wWLYhC3FGhm_1dyHjLG817QCLcBGAsYHQ/s640/Screen%2BShot%2B2020-04-25%2Bat%2B5.40.39%2BAM.png

Requested by

Host: www.blogblog.com
URL: https://www.blogblog.com/dynamicviews/de918fe7fca9ee54/js/thirdparty/jquery.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

6d6b2397c0429050dd22ca4322bd54351a88692ff74c0603ac20d9cdfc68a191

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 10:11:26 GMT
x-content-type-options: nosniff
age: 13720
status: 200
content-disposition: inline;filename="Screen Shot 2020-04-25 at 5.40.39 AM.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16740
x-xss-protection: 0
server: fife
etag: "v7a7b"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 23 Sep 2020 20:42:41 GMT

GET
H3-Q050 200 Screen%2BShot%2B2020-04-25%2Bat%2B5.57.30%2BAM.png
1.bp.blogspot.com/-_BTtTjFpyo8/XqQJtRbivDI/AAAAAAAAeoA/DSOaPB_JydcF4Cyk3NL56PGvVj7BnrOCACLcBGAsYHQ/s640/ 34 KB
34 KB 9ms
8ms Image
image/png 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1.bp.blogspot.com/-_BTtTjFpyo8/XqQJtRbivDI/AAAAAAAAeoA/DSOaPB_JydcF4Cyk3NL56PGvVj7BnrOCACLcBGAsYHQ/s640/Screen%2BShot%2B2020-04-25%2Bat%2B5.57.30%2BAM.png

Requested by

Host: www.blogblog.com
URL: https://www.blogblog.com/dynamicviews/de918fe7fca9ee54/js/thirdparty/jquery.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

2dde0068aa6abd942461e9f5a2ce63505faa130295454b6b6bbec371de6fe009

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 10:11:26 GMT
x-content-type-options: nosniff
age: 13720
status: 200
content-disposition: inline;filename="Screen Shot 2020-04-25 at 5.57.30 AM.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34395
x-xss-protection: 0
server: fife
etag: "v7a81"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 23 Sep 2020 20:42:41 GMT

GET
H/1.1 200
OK widgets.js Show response
platform.twitter.com/ 95 KB
29 KB 8ms
8ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets.js
Requested by: Host: www.blogblog.com
URL: https://www.blogblog.com/dynamicviews/de918fe7fca9ee54/js/thirdparty/jquery.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (fcn/40FB) /
Resource Hash: a761b426004caba495cdac2c93ce7dd306c47bc4d7bdc63c4840c3d8182396a9

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 24 Sep 2020 14:00:06 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Age: 270
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Content-Length: 28881
x-tw-cdn: VZ
Last-Modified: Tue, 01 Sep 2020 20:40:54 GMT
Server: ECS (fcn/40FB)
Etag: "a58136137a93f33c1d165df7d4d973f8+gzip"
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=1800

GET
H3-Q050 200 cb=gapi.loaded_0 Show response
apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.rMJI4WR09CY.O/m=plusone/rt=j/sv=1/d=1/ed=1/am=wQE/rs=AGLTcCPRb_B1g8z3qIwl7l27GWLe47nxIA/ 137 KB
48 KB 57ms
39ms Script
text/javascript 2a00:1450:4001:802::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.rMJI4WR09CY.O/m=plusone/rt=j/sv=1/d=1/ed=1/am=wQE/rs=AGLTcCPRb_B1g8z3qIwl7l27GWLe47nxIA/cb=gapi.loaded_0

Requested by

Host: apis.google.com
URL: https://apis.google.com/js/plusone.js?_=1600956002524

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5754a78fea82bb52d068d3c64de5ab9ae7ed70de719090407bb2ade232a5b7ee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 23 Sep 2020 19:45:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 08 Sep 2020 19:28:50 GMT
server: sffe
age: 65651
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
status: 200
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 49024
x-xss-protection: 0
expires: Thu, 23 Sep 2021 19:45:55 GMT

GET
H/1.1 200
OK tweet_button.html
platform.twitter.com/widgets/ Frame 2108 0
0 7ms
6ms Document
text/html 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/tweet_button.html?url=https%3A%2F%2Fwww.vkremez.com%2F2020%2F04%2Flets-learn-trickbot-bazarbackdoor.html&count=horizontal&text=Let%27s%20Learn%3A%20TrickBot%20%22BazarBackdoor%22%20Process%20Hollowing%20Injection%20Primer&size=medium
Requested by: Host: www.blogblog.com
URL: https://www.blogblog.com/dynamicviews/de918fe7fca9ee54/js/thirdparty/jquery.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (fcn/40FB) /
Resource Hash

Request headers

Host: platform.twitter.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html

Response headers

Content-Encoding: gzip
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Age: 59
Cache-Control: public, max-age=1800
Content-Type: text/html; charset=utf-8
Date: Thu, 24 Sep 2020 14:00:06 GMT
Etag: "27d090fda6390805d455b8bb53b86907+gzip"
Last-Modified: Tue, 01 Sep 2020 20:41:41 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (fcn/40FB)
Vary: Accept-Encoding
X-Cache: HIT
x-tw-cdn: VZ
Content-Length: 19285

GET
H2 200 like.php
www.facebook.com/plugins/ Frame C8ED 0
0 108ms
54ms Document
text/html 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/plugins/like.php?href=http%3A%2F%2Fwww.vkremez.com%2F2020%2F04%2Flets-learn-trickbot-bazarbackdoor.html&send=false&layout=button_count&action=like&show_faces=false&colorscheme=light

Requested by

Host: www.blogblog.com
URL: https://www.blogblog.com/dynamicviews/de918fe7fca9ee54/js/thirdparty/jquery.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.facebook.com
:scheme: https
:path: /plugins/like.php?href=http%3A%2F%2Fwww.vkremez.com%2F2020%2F04%2Flets-learn-trickbot-bazarbackdoor.html&send=false&layout=button_count&action=like&show_faces=false&colorscheme=light
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html

Response headers

status: 200
vary: Accept-Encoding
pragma: no-cache
expires: Sat, 01 Jan 2000 00:00:00 GMT
content-encoding: br
strict-transport-security: max-age=15552000; preload
x-content-type-options: nosniff
timing-allow-origin: *
x-xss-protection: 0
cache-control: private, no-cache, no-store, must-revalidate
content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
content-type: text/html; charset="utf-8"
x-fb-debug: JJCXi4e3h0EOwuqlLm/byvzqHF6hZzaHnOesFqgKsa8VC+40n1zoRNHFgQj+xp+zRGU8qq+APjYENqr0BRcItA==
date: Thu, 24 Sep 2020 14:00:06 GMT
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600

GET
H/1.1 200
OK widget_iframe.2d7d9a6d04538bf11c7b23641e75738c.html
platform.twitter.com/widgets/ Frame 10BE 0
0 11ms
9ms Document
text/html 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/widget_iframe.2d7d9a6d04538bf11c7b23641e75738c.html?origin=https%3A%2F%2Fwww.vkremez.com
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (fcn/4187) /
Resource Hash

Request headers

Host: platform.twitter.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html

Response headers

Content-Encoding: gzip
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Age: 748793
Cache-Control: public, max-age=315360000
Content-Type: text/html; charset=utf-8
Date: Thu, 24 Sep 2020 14:00:06 GMT
Etag: "9fa476ae827f556d5b037fe43632370d+gzip"
Last-Modified: Tue, 01 Sep 2020 17:58:17 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (fcn/4187)
Vary: Accept-Encoding
X-Cache: HIT
x-tw-cdn: VZ
Content-Length: 5825

GET
H/1.1 200
OK horizon_tweet.890a062bcacdb49527deac08bf9879da.js Show response
platform.twitter.com/js/ 6 KB
3 KB 8ms
8ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/js/horizon_tweet.890a062bcacdb49527deac08bf9879da.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (fcn/40F9) /
Resource Hash: 23b775e4e3b5b93742dad8a1bbfacb2ffc3271a15dbfc6d3ded21d713f2c3489

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 24 Sep 2020 14:00:06 GMT
Content-Encoding: gzip
Last-Modified: Tue, 01 Sep 2020 17:58:08 GMT
Server: ECS (fcn/40F9)
Age: 748793
Etag: "8069bf9882ddc98f8144708faf345f30+gzip"
Vary: Accept-Encoding
x-tw-cdn: VZ
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000
X-Cache: HIT
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Content-Length: 2197

GET
H2 200 default Show response
www.blogger.com/feeds/3986785863650565253/posts/ 2 MB
219 KB 1565ms
1565ms Script
text/javascript 2a00:1450:4001:81f::2009
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.blogger.com/feeds/3986785863650565253/posts/default?alt=json&v=2&dynamicviews=1&orderby=published&max-results=25&published-max=2018-07-29T18%3A00%3A00.002Z&rewriteforssl=true&callback=jQuery112509335208543837514_1600956002522&_=1600956002525

Requested by

Host: www.blogblog.com
URL: https://www.blogblog.com/dynamicviews/de918fe7fca9ee54/js/thirdparty/jquery.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::2009 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

a821b63c30408f4ba17664477f4060f5f73bdcb5c9cfa5d660873143795c46d6

Security Headers

Name	Value
Content-Security-Policy	script-src 'self' .google.com .google-analytics.com 'unsafe-inline' 'unsafe-eval' .gstatic.com .googlesyndication.com .blogger.com .googleapis.com uds.googleusercontent.com https://s.ytimg.com https://i18n-cloud.appspot.com www-onepick-opensocial.googleusercontent.com www-bloggervideo-opensocial.googleusercontent.com www-blogger-opensocial.googleusercontent.com https://www.blogblog.com; report-uri /cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: script-src 'self' *.google.com *.google-analytics.com 'unsafe-inline' 'unsafe-eval' *.gstatic.com *.googlesyndication.com *.blogger.com *.googleapis.com uds.googleusercontent.com https://s.ytimg.com https://i18n-cloud.appspot.com www-onepick-opensocial.googleusercontent.com www-bloggervideo-opensocial.googleusercontent.com www-blogger-opensocial.googleusercontent.com https://www.blogblog.com; report-uri /cspreport
content-encoding: gzip
etag: W/"D0MERH05fyp7ImA9XxZTF0o."
access-control-allow-origin: *
p3p: CP="This is not a P3P policy! See https://www.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info."
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 1; mode=block
last-modified: Tue, 22 Sep 2020 11:50:05 GMT
server: GSE
x-frame-options: SAMEORIGIN
date: Thu, 24 Sep 2020 14:00:07 GMT
vary: Accept, X-GData-Authorization, GData-Version
content-type: text/javascript; charset=UTF-8
gdata-version: 2.0
cache-control: private, max-age=0, must-revalidate, no-transform
x-content-type-options: nosniff
expires: Thu, 24 Sep 2020 14:00:07 GMT

GET
H/1.1 200
OK index.html
platform.twitter.com/embed/ Frame 462D 0
0 8ms
6ms Document
text/html 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/embed/index.html?dnt=false&embedId=twitter-widget-0&frame=false&hideCard=false&hideThread=false&id=1252303608747565057&lang=en&origin=https%3A%2F%2Fwww.vkremez.com%2F2020%2F04%2Flets-learn-trickbot-bazarbackdoor.html&theme=light&widgetsVersion=219d021%3A1598982042171&width=550px
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (fcn/40FC) /
Resource Hash

Request headers

Host: platform.twitter.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Age: 292
Cache-Control: public, max-age=1800
Content-Type: text/html; charset=utf-8
Date: Thu, 24 Sep 2020 14:00:06 GMT
Etag: "462a23b15781d788fb9d65f4cb1fe44d"
Last-Modified: Wed, 09 Sep 2020 20:24:51 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (fcn/40FC)
X-Cache: HIT
x-tw-cdn: VZ
Content-Length: 577

GET
H3-Q050 200 default Show response
www.blogger.com/feeds/3986785863650565253/6114194039930120721/comments/ 2 KB
1010 B 357ms
356ms Script
text/javascript 2a00:1450:4001:81f::2009
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.blogger.com/feeds/3986785863650565253/6114194039930120721/comments/default?alt=json&v=2&dynamicviews=1&orderby=published&reverse=false&max-results=50&rewriteforssl=true&callback=jQuery112509335208543837514_1600956002526&_=1600956002527

Requested by

Host: www.blogblog.com
URL: https://www.blogblog.com/dynamicviews/de918fe7fca9ee54/js/thirdparty/jquery.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81f::2009 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

43d56f74ff0e7a7482cdf2acfad5eb4536c3abccb123790c84ff7c9d4bc6cf18

Security Headers

Name	Value
Content-Security-Policy	script-src 'self' .google.com .google-analytics.com 'unsafe-inline' 'unsafe-eval' .gstatic.com .googlesyndication.com .blogger.com .googleapis.com uds.googleusercontent.com https://s.ytimg.com https://i18n-cloud.appspot.com www-onepick-opensocial.googleusercontent.com www-bloggervideo-opensocial.googleusercontent.com www-blogger-opensocial.googleusercontent.com https://www.blogblog.com; report-uri /cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: script-src 'self' *.google.com *.google-analytics.com 'unsafe-inline' 'unsafe-eval' *.gstatic.com *.googlesyndication.com *.blogger.com *.googleapis.com uds.googleusercontent.com https://s.ytimg.com https://i18n-cloud.appspot.com www-onepick-opensocial.googleusercontent.com www-bloggervideo-opensocial.googleusercontent.com www-blogger-opensocial.googleusercontent.com https://www.blogblog.com; report-uri /cspreport
content-encoding: gzip
etag: W/"CU8BRnY4cSp7ImA9XB5UF08."
access-control-allow-origin: *
p3p: CP="This is not a P3P policy! See https://www.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info."
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 880
x-xss-protection: 1; mode=block
last-modified: Fri, 24 Apr 2020 10:24:17 GMT
server: GSE
x-frame-options: SAMEORIGIN
date: Thu, 24 Sep 2020 14:00:08 GMT
vary: Accept, X-GData-Authorization, GData-Version
content-type: text/javascript; charset=UTF-8
gdata-version: 2.0
cache-control: private, max-age=0, must-revalidate, no-transform
x-content-type-options: nosniff
expires: Thu, 24 Sep 2020 14:00:08 GMT

GET
H2 200 default Show response
www.blogger.com/feeds/3986785863650565253/6114194039930120721/comments/ 2 KB
1 KB 357ms
353ms Script
text/javascript 2a00:1450:4001:81f::2009
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: www.blogblog.com
URL: https://www.blogblog.com/dynamicviews/de918fe7fca9ee54/js/thirdparty/jquery.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::2009 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

4b9d15622183e036ef20de29c23338817077e220a7f85bd24c574cc5202b8f8d

Security Headers

Name	Value
Content-Security-Policy	script-src 'self' .google.com .google-analytics.com 'unsafe-inline' 'unsafe-eval' .gstatic.com .googlesyndication.com .blogger.com .googleapis.com uds.googleusercontent.com https://s.ytimg.com https://i18n-cloud.appspot.com www-onepick-opensocial.googleusercontent.com www-bloggervideo-opensocial.googleusercontent.com www-blogger-opensocial.googleusercontent.com https://www.blogblog.com; report-uri /cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: script-src 'self' *.google.com *.google-analytics.com 'unsafe-inline' 'unsafe-eval' *.gstatic.com *.googlesyndication.com *.blogger.com *.googleapis.com uds.googleusercontent.com https://s.ytimg.com https://i18n-cloud.appspot.com www-onepick-opensocial.googleusercontent.com www-bloggervideo-opensocial.googleusercontent.com www-blogger-opensocial.googleusercontent.com https://www.blogblog.com; report-uri /cspreport
content-encoding: gzip
etag: W/"CU8BRnY4cSp7ImA9XB5UF08."
access-control-allow-origin: *
p3p: CP="This is not a P3P policy! See https://www.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info."
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 880
x-xss-protection: 1; mode=block
last-modified: Fri, 24 Apr 2020 10:24:17 GMT
server: GSE
x-frame-options: SAMEORIGIN
date: Thu, 24 Sep 2020 14:00:08 GMT
vary: Accept, X-GData-Authorization, GData-Version
content-type: text/javascript; charset=UTF-8
gdata-version: 2.0
cache-control: private, max-age=0, must-revalidate, no-transform
x-content-type-options: nosniff
expires: Thu, 24 Sep 2020 14:00:08 GMT

GET
DATA 200
OK truncated
/ 847 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1c5c2bf1131bd8f1578c106a85ef6394aae3192314ed6bab5f8fabc2b0be3495

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/gif

GET
H2 200 Screen%2BShot%2B2018-07-16%2Bat%2B03.25.42.png
2.bp.blogspot.com/-f4Sj9uOIEW8/W0xYno2IYqI/AAAAAAAAG8Q/trx0J_kbvmsb7SjLdIpP9Sg-JVWyghuxQCLcBGAs/s30-p/ 2 KB
2 KB 8ms
8ms Image
image/png 2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://2.bp.blogspot.com/-f4Sj9uOIEW8/W0xYno2IYqI/AAAAAAAAG8Q/trx0J_kbvmsb7SjLdIpP9Sg-JVWyghuxQCLcBGAs/s30-p/Screen%2BShot%2B2018-07-16%2Bat%2B03.25.42.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

649900d3905b9f2e7b125937917a96a473c0f3215cb51808d744bca68b081691

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 12:11:09 GMT
x-content-type-options: nosniff
age: 6540
status: 200
content-disposition: inline;filename="Screen Shot 2018-07-16 at 03.25.42.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1639
x-xss-protection: 0
server: fife
etag: "v1bc5"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sat, 12 Sep 2020 11:10:41 GMT

GET
H2 200 Screen%2BShot%2B2018-04-13%2Bat%2B10.33.03.png
2.bp.blogspot.com/-fydaerkDxjQ/WtDLm-RpkOI/AAAAAAAAG28/nTUrc-tHQOMjZOQ0W5JPcpNLQf_15u6QwCLcBGAs/s30-p/ 1 KB
1 KB 10ms
10ms Image
image/png 2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://2.bp.blogspot.com/-fydaerkDxjQ/WtDLm-RpkOI/AAAAAAAAG28/nTUrc-tHQOMjZOQ0W5JPcpNLQf_15u6QwCLcBGAs/s30-p/Screen%2BShot%2B2018-04-13%2Bat%2B10.33.03.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

3c2314a555c78ee37c995eaa1b964e1e889bb23bb32dc86b4d9fa4f0af0a3d0f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 12:11:09 GMT
x-content-type-options: nosniff
age: 6540
status: 200
content-disposition: inline;filename="Screen Shot 2018-04-13 at 10.33.03.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1185
x-xss-protection: 0
server: fife
etag: "v1b70"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sat, 19 Sep 2020 15:02:36 GMT

GET
H2 200 Screen%2BShot%2B2018-04-08%2Bat%2B15.39.55.png
4.bp.blogspot.com/-lfpI23_lx5A/Wsp4iOyl24I/AAAAAAAAG1M/gQPrA4N06YoFjQVitVCosujP5qBs8tulACLcBGAs/s30-p/ 1 KB
1 KB 8ms
8ms Image
image/png 2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://4.bp.blogspot.com/-lfpI23_lx5A/Wsp4iOyl24I/AAAAAAAAG1M/gQPrA4N06YoFjQVitVCosujP5qBs8tulACLcBGAs/s30-p/Screen%2BShot%2B2018-04-08%2Bat%2B15.39.55.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

4aaf228ccea0266ab752855d33240266d89fd483fb62eaf52d5558d417253be3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 13:06:00 GMT
x-content-type-options: nosniff
age: 3249
status: 200
content-disposition: inline;filename="Screen Shot 2018-04-08 at 15.39.55.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1323
x-xss-protection: 0
server: fife
etag: "v1b54"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sat, 19 Sep 2020 14:20:43 GMT

GET
H2 200 Screen%2BShot%2B2018-04-02%2Bat%2B20.12.26.png
1.bp.blogspot.com/-gHyFzq2539g/WsMaurFcTpI/AAAAAAAAGng/qXt_Yx_5nAwgn6P0jlJDg6iqvgKdoYGEACLcBGAs/s30-p/ 1 KB
2 KB 11ms
11ms Image
image/png 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1.bp.blogspot.com/-gHyFzq2539g/WsMaurFcTpI/AAAAAAAAGng/qXt_Yx_5nAwgn6P0jlJDg6iqvgKdoYGEACLcBGAs/s30-p/Screen%2BShot%2B2018-04-02%2Bat%2B20.12.26.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

6f8f758d328fe50ec2ccd54786226624818171dff319ddecfd14a429d1d806a4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 10:11:33 GMT
x-content-type-options: nosniff
age: 13716
status: 200
content-disposition: inline;filename="Screen Shot 2018-04-02 at 20.12.26.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1402
x-xss-protection: 0
server: fife
etag: "v1a79"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Thu, 24 Sep 2020 05:21:15 GMT

GET
H3-Q050 200 Screen%2BShot%2B2018-04-02%2Bat%2B00.36.11.png
2.bp.blogspot.com/-1wrjX5wm6T0/WsG8GhGrlyI/AAAAAAAAGlQ/kJd1N5o4R1oQSI9RJu54MyyD25GzaIwNQCLcBGAs/s30-p/ 2 KB
2 KB 86ms
23ms Image
image/png 2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://2.bp.blogspot.com/-1wrjX5wm6T0/WsG8GhGrlyI/AAAAAAAAGlQ/kJd1N5o4R1oQSI9RJu54MyyD25GzaIwNQCLcBGAs/s30-p/Screen%2BShot%2B2018-04-02%2Bat%2B00.36.11.png

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

de4774067968f00ffcf4b72574b39f54cd766f1f956d7c21f0d815931f78fc5d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 12:11:09 GMT
x-content-type-options: nosniff
age: 6540
status: 200
content-disposition: inline;filename="Screen Shot 2018-04-02 at 00.36.11.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1770
x-xss-protection: 0
server: fife
etag: "v1a55"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sat, 19 Sep 2020 15:02:36 GMT

GET
H2 200 Screen%2BShot%2B2018-03-30%2Bat%2B00.28.41.png
3.bp.blogspot.com/-TEP_sQqpw_c/Wr3Oh1lfdqI/AAAAAAAAGks/LZ4S28w59akkRVZb9G7BUnaGwxSTCoqPACLcBGAs/s30-p/ 1 KB
1 KB 24ms
5ms Image
image/png 2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://3.bp.blogspot.com/-TEP_sQqpw_c/Wr3Oh1lfdqI/AAAAAAAAGks/LZ4S28w59akkRVZb9G7BUnaGwxSTCoqPACLcBGAs/s30-p/Screen%2BShot%2B2018-03-30%2Bat%2B00.28.41.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

c425fc1d4bf6757927986974d71a777e077a47537471db8c29e52e469f71e876

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 12:11:09 GMT
x-content-type-options: nosniff
age: 6540
status: 200
content-disposition: inline;filename="Screen Shot 2018-03-30 at 00.28.41.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1205
x-xss-protection: 0
server: fife
etag: "v1a4c"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sat, 19 Sep 2020 15:02:36 GMT

GET
H3-Q050 200 Screen%2BShot%2B2018-03-29%2Bat%2B19.12.08.png
1.bp.blogspot.com/-sx8TAnhDE3A/Wr2zhYAE3JI/AAAAAAAAGkc/wdI-Dd6QiksPWOfk_7CvHNPkWth-ZPh_gCLcBGAs/s30-p/ 1 KB
2 KB 22ms
6ms Image
image/png 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1.bp.blogspot.com/-sx8TAnhDE3A/Wr2zhYAE3JI/AAAAAAAAGkc/wdI-Dd6QiksPWOfk_7CvHNPkWth-ZPh_gCLcBGAs/s30-p/Screen%2BShot%2B2018-03-29%2Bat%2B19.12.08.png

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

800cdca40b909aa85f1e0b5202e6c36a6317b4e43ef14dbce97f8b1174f95549

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 10:11:33 GMT
x-content-type-options: nosniff
age: 13716
status: 200
content-disposition: inline;filename="Screen Shot 2018-03-29 at 19.12.08.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1483
x-xss-protection: 0
server: fife
etag: "v1a48"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Thu, 24 Sep 2020 05:21:15 GMT

GET
H3-Q050 200 pic1.PNG
1.bp.blogspot.com/-ZuYVjcQj1qI/Wo4ddDb8JwI/AAAAAAAAGg4/Nsow2nw76r0L_y6egj4R4phoNTJh0FuggCLcBGAs/s30-p/ 907 B
965 B 39ms
22ms Image
image/png 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1.bp.blogspot.com/-ZuYVjcQj1qI/Wo4ddDb8JwI/AAAAAAAAGg4/Nsow2nw76r0L_y6egj4R4phoNTJh0FuggCLcBGAs/s30-p/pic1.PNG

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

b5a2ce54ddde57451e063e3db3e24ced1f67992231a23397f7b194a2fdaeb613

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 10:11:33 GMT
x-content-type-options: nosniff
age: 13716
status: 200
content-disposition: inline;filename="pic1.PNG"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 907
x-xss-protection: 0
server: fife
etag: "v1a0f"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Thu, 24 Sep 2020 05:21:15 GMT

GET
H3-Q050 200 Screen%2BShot%2B2018-01-28%2Bat%2B18.15.49.png
1.bp.blogspot.com/-D6_8GKtyhm4/Wm5xyELI-rI/AAAAAAAAGfY/j9buNZNKAtg89fGmZapkiNm192jlojVQwCLcBGAs/s30-p/ 873 B
953 B 42ms
26ms Image
image/png 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1.bp.blogspot.com/-D6_8GKtyhm4/Wm5xyELI-rI/AAAAAAAAGfY/j9buNZNKAtg89fGmZapkiNm192jlojVQwCLcBGAs/s30-p/Screen%2BShot%2B2018-01-28%2Bat%2B18.15.49.png

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

e1d46ef344e5d9a593b69978ada52e7ffb85d3154389a532daae5036373d55a6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 10:11:33 GMT
x-content-type-options: nosniff
age: 13716
status: 200
content-disposition: inline;filename="Screen Shot 2018-01-28 at 18.15.49.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 873
x-xss-protection: 0
server: fife
etag: "v19f8"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Thu, 24 Sep 2020 05:21:15 GMT

GET
H2 200 Screen%2BShot%2B2018-01-17%2Bat%2B03.11.05.png
3.bp.blogspot.com/-Vm8ikdvuRTw/Wl8Qh1y_jKI/AAAAAAAAGdc/gHOSm6p-RNQjKk-T1u8e5ysEkO8dpQuKQCLcBGAs/s30-p/ 1 KB
1 KB 24ms
6ms Image
image/png 2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://3.bp.blogspot.com/-Vm8ikdvuRTw/Wl8Qh1y_jKI/AAAAAAAAGdc/gHOSm6p-RNQjKk-T1u8e5ysEkO8dpQuKQCLcBGAs/s30-p/Screen%2BShot%2B2018-01-17%2Bat%2B03.11.05.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

6466c0e7a97bb5944c95e0b50c4a78b729a002ebe349cc4c9496079adbafb30c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 12:11:09 GMT
x-content-type-options: nosniff
age: 6540
status: 200
content-disposition: inline;filename="Screen Shot 2018-01-17 at 03.11.05.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1312
x-xss-protection: 0
server: fife
etag: "v19d8"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sat, 19 Sep 2020 15:02:36 GMT

GET
H3-Q050 200 Screen%2BShot%2B2018-01-12%2Bat%2B19.48.29.png
4.bp.blogspot.com/-kAj6qRS1lLE/WllXco3uCZI/AAAAAAAAGcw/NSnuJn7_R7cTpqazXeB7UE4AJSc-QYKWQCLcBGAs/s30-p/ 1 KB
1 KB 73ms
21ms Image
image/png 2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://4.bp.blogspot.com/-kAj6qRS1lLE/WllXco3uCZI/AAAAAAAAGcw/NSnuJn7_R7cTpqazXeB7UE4AJSc-QYKWQCLcBGAs/s30-p/Screen%2BShot%2B2018-01-12%2Bat%2B19.48.29.png

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

ae56a08ad120fa9cbaad5e2d0f29d15ab5995ec798b7fb646926e2b2f1432b88

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 13:06:00 GMT
x-content-type-options: nosniff
age: 3249
status: 200
content-disposition: inline;filename="Screen Shot 2018-01-12 at 19.48.29.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1118
x-xss-protection: 0
server: fife
etag: "v19cd"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sat, 19 Sep 2020 14:20:43 GMT

GET
H3-Q050 200 Screen%2BShot%2B2017-12-27%2Bat%2B05.04.04.png
1.bp.blogspot.com/-GWhFEQzGKcM/WkNxNvb8OwI/AAAAAAAAGbI/_Fa6ks1fqDU4StZhkB2KDIMWVf28EeH0wCLcBGAs/s30-p/ 2 KB
2 KB 32ms
26ms Image
image/png 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1.bp.blogspot.com/-GWhFEQzGKcM/WkNxNvb8OwI/AAAAAAAAGbI/_Fa6ks1fqDU4StZhkB2KDIMWVf28EeH0wCLcBGAs/s30-p/Screen%2BShot%2B2017-12-27%2Bat%2B05.04.04.png

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

5d08e3977ac882cac0b3ba2ca6bc235de70d4fd53b35479b36ec62d2b7962a93

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 10:11:33 GMT
x-content-type-options: nosniff
age: 13716
status: 200
content-disposition: inline;filename="Screen Shot 2017-12-27 at 05.04.04.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1835
x-xss-protection: 0
server: fife
etag: "v19b3"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Thu, 24 Sep 2020 05:21:16 GMT

GET
H2 200 Screen%2BShot%2B2017-12-21%2Bat%2B02.46.03.png
3.bp.blogspot.com/-L01qZql0nDQ/WjtoH0mnN0I/AAAAAAAAGZ8/VSZsd6aaZII3e5_GvzqDMwymidDPuqyEwCLcBGAs/s30-p/ 786 B
908 B 13ms
7ms Image
image/png 2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://3.bp.blogspot.com/-L01qZql0nDQ/WjtoH0mnN0I/AAAAAAAAGZ8/VSZsd6aaZII3e5_GvzqDMwymidDPuqyEwCLcBGAs/s30-p/Screen%2BShot%2B2017-12-21%2Bat%2B02.46.03.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

7e04d6abaf6bb7889fe5fcb79c3a1cc97c067bc798d6ac2dfc2c3852df9e3f37

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 12:11:09 GMT
x-content-type-options: nosniff
age: 6540
status: 200
content-disposition: inline;filename="Screen Shot 2017-12-21 at 02.46.03.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 786
x-xss-protection: 0
server: fife
etag: "v19a3"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sat, 19 Sep 2020 15:02:36 GMT

GET
H3-Q050 200 magniber2.png
1.bp.blogspot.com/-dafMS1R8uHo/WjeFIbPGEGI/AAAAAAAAGYo/pDfMVwtjPesGEjWZcjPO4g8v78cEzetQACLcBGAs/s30-p/ 2 KB
2 KB 32ms
26ms Image
image/png 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1.bp.blogspot.com/-dafMS1R8uHo/WjeFIbPGEGI/AAAAAAAAGYo/pDfMVwtjPesGEjWZcjPO4g8v78cEzetQACLcBGAs/s30-p/magniber2.png

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

d1252f3f1584dd033509867c51515623b05894f4b82a9e3c3da822326eaafc69

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 10:11:33 GMT
x-content-type-options: nosniff
age: 13716
status: 200
content-disposition: inline;filename="magniber2.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1659
x-xss-protection: 0
server: fife
etag: "v198c"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Thu, 24 Sep 2020 05:21:16 GMT

GET
H3-Q050 200 image1.png
4.bp.blogspot.com/-ghOLe4cowlc/WjDvM4V59EI/AAAAAAAAGXk/Kqb-bxKddYcab8UK8q0GMxi1yljr7NxnwCLcBGAs/s30-p/ 2 KB
2 KB 72ms
22ms Image
image/png 2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://4.bp.blogspot.com/-ghOLe4cowlc/WjDvM4V59EI/AAAAAAAAGXk/Kqb-bxKddYcab8UK8q0GMxi1yljr7NxnwCLcBGAs/s30-p/image1.png

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

0e7b4d1180187373e1e81dc52672389f9c4dfb477586cee1caea057fc042ad81

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 13:06:00 GMT
x-content-type-options: nosniff
age: 3249
status: 200
content-disposition: inline;filename="image1.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1543
x-xss-protection: 0
server: fife
etag: "v197a"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sat, 19 Sep 2020 14:20:43 GMT

GET
H3-Q050 200 trick1.png
2.bp.blogspot.com/-srnRcj3vjuI/WhPRX6-2LBI/AAAAAAAAGUU/WB6tRdBK1HA_pM8zY9KCHymaD4-uMEk8ACLcBGAs/s30-p/ 2 KB
2 KB 70ms
21ms Image
image/png 2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://2.bp.blogspot.com/-srnRcj3vjuI/WhPRX6-2LBI/AAAAAAAAGUU/WB6tRdBK1HA_pM8zY9KCHymaD4-uMEk8ACLcBGAs/s30-p/trick1.png

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

987d4cab1c85d764068420e5b35cb34e9d675e26042ba9a6b04f99327f4d3cca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 12:11:09 GMT
x-content-type-options: nosniff
age: 6540
status: 200
content-disposition: inline;filename="trick1.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1647
x-xss-protection: 0
server: fife
etag: "v1949"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sat, 19 Sep 2020 15:02:36 GMT

GET
H2 200 golroted1.png
3.bp.blogspot.com/-FdgC9OaYvNk/WggMA_2tBII/AAAAAAAAGKU/G9-uFOob2n4fR7wtkpJgXcv0UkfQ8N3PACLcBGAs/s30-p/ 1 KB
1 KB 13ms
7ms Image
image/png 2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://3.bp.blogspot.com/-FdgC9OaYvNk/WggMA_2tBII/AAAAAAAAGKU/G9-uFOob2n4fR7wtkpJgXcv0UkfQ8N3PACLcBGAs/s30-p/golroted1.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

a35d7973868226e4830f8b4c535aa94ba6a58bf46ae575d4ccf9931ab4b05af6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 12:11:09 GMT
x-content-type-options: nosniff
age: 6540
status: 200
content-disposition: inline;filename="golroted1.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1271
x-xss-protection: 0
server: fife
etag: "v18a9"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sat, 19 Sep 2020 15:02:36 GMT

GET
H3-Q050 200 Picture1.png
1.bp.blogspot.com/-T8yA4Tz4fnM/Wf7Xebk4RFI/AAAAAAAAGIQ/jICMx8fkjV8pMg6FMoKaOUIcmpLqSLtUgCLcBGAs/s30-p/ 1 KB
1 KB 33ms
27ms Image
image/png 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1.bp.blogspot.com/-T8yA4Tz4fnM/Wf7Xebk4RFI/AAAAAAAAGIQ/jICMx8fkjV8pMg6FMoKaOUIcmpLqSLtUgCLcBGAs/s30-p/Picture1.png

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

e1c8c674a5de7e5de010a6212157bdf0d1973fae8863fc34b883f344098bf04d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 10:11:33 GMT
x-content-type-options: nosniff
age: 13716
status: 200
content-disposition: inline;filename="Picture1.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1437
x-xss-protection: 0
server: fife
etag: "v1885"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Thu, 24 Sep 2020 05:21:16 GMT

GET
H3-Q050 200 Screen%2BShot%2B2017-09-15%2Bat%2B03.50.08.png
3.bp.blogspot.com/-xNKCCshBU6s/WbuH3EWeG9I/AAAAAAAAGDg/M2Ee_WQZBPsLTnSG4mdX9dxKHou_HE9vQCLcBGAs/s30-p/ 2 KB
2 KB 43ms
17ms Image
image/png 2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://3.bp.blogspot.com/-xNKCCshBU6s/WbuH3EWeG9I/AAAAAAAAGDg/M2Ee_WQZBPsLTnSG4mdX9dxKHou_HE9vQCLcBGAs/s30-p/Screen%2BShot%2B2017-09-15%2Bat%2B03.50.08.png

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

651fd27be7dfbf9449b590a95a02c96fe3a8a14b6fb1631db88e1a3f4c7ecd96

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 12:11:09 GMT
x-content-type-options: nosniff
age: 6540
status: 200
content-disposition: inline;filename="Screen Shot 2017-09-15 at 03.50.08.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1717
x-xss-protection: 0
server: fife
etag: "v1839"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sat, 19 Sep 2020 15:02:37 GMT

GET
H3-Q050 200 tricky1.png
2.bp.blogspot.com/-ibtoIfLasAU/WbZOulPWyqI/AAAAAAAAGCM/ZJ0NR26MtCsj_gRsCYUBoMr68AqbLe5RACLcBGAs/s30-p/ 2 KB
2 KB 73ms
20ms Image
image/png 2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://2.bp.blogspot.com/-ibtoIfLasAU/WbZOulPWyqI/AAAAAAAAGCM/ZJ0NR26MtCsj_gRsCYUBoMr68AqbLe5RACLcBGAs/s30-p/tricky1.png

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

b079f588738a4e47b7451f7f332b16fbbe60aa435499419a71df278688ad51a2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 12:11:09 GMT
x-content-type-options: nosniff
age: 6540
status: 200
content-disposition: inline;filename="tricky1.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1928
x-xss-protection: 0
server: fife
etag: "v1824"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sat, 19 Sep 2020 15:02:37 GMT

GET
H3-Q050 200 Screen%2BShot%2B2017-08-22%2Bat%2B00.37.01.png
4.bp.blogspot.com/-7uLTgL1bgkU/WZu1E4ZsfEI/AAAAAAAAF_0/3gSMtW08vrMfRNepJJaIGQbg4SRJxKNHACLcBGAs/s30-p/ 1 KB
1 KB 75ms
20ms Image
image/png 2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://4.bp.blogspot.com/-7uLTgL1bgkU/WZu1E4ZsfEI/AAAAAAAAF_0/3gSMtW08vrMfRNepJJaIGQbg4SRJxKNHACLcBGAs/s30-p/Screen%2BShot%2B2017-08-22%2Bat%2B00.37.01.png

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

14a06236a680dc1ea147e0fa0a105cead0d770e6287072da1720dccc19aa40bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 13:06:00 GMT
x-content-type-options: nosniff
age: 3249
status: 200
content-disposition: inline;filename="Screen Shot 2017-08-22 at 00.37.01.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1081
x-xss-protection: 0
server: fife
etag: "v17fe"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sat, 19 Sep 2020 14:20:44 GMT

GET
H3-Q050 200 Screen%2BShot%2B2017-08-15%2Bat%2B01.05.51.png
2.bp.blogspot.com/-wv7Sly9SVRA/WZKk_awIRfI/AAAAAAAAF-M/S5Xnp25K2eYic5AbrsFjiwdubieCiYQuACEwYBhgL/s30-p/ 1 KB
1 KB 73ms
21ms Image
image/png 2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://2.bp.blogspot.com/-wv7Sly9SVRA/WZKk_awIRfI/AAAAAAAAF-M/S5Xnp25K2eYic5AbrsFjiwdubieCiYQuACEwYBhgL/s30-p/Screen%2BShot%2B2017-08-15%2Bat%2B01.05.51.png

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

9c3db9fa3975bf7489a64f3fb8c606119ed03705fc15471b073d54e29df82629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 12:11:09 GMT
x-content-type-options: nosniff
age: 6540
status: 200
content-disposition: inline;filename="Screen Shot 2017-08-15 at 01.05.51.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1429
x-xss-protection: 0
server: fife
etag: "v17e3"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sat, 19 Sep 2020 15:02:37 GMT

GET
H3-Q050 200 Screen%2BShot%2B2017-08-13%2Bat%2B14.48.34.png
1.bp.blogspot.com/--vAXVDNhnn4/WZE2kQY0hJI/AAAAAAAAF8U/fksAHvqVJJskec1GoHQFYCE3TfEqCpALACLcBGAs/s30-p/ 2 KB
2 KB 35ms
28ms Image
image/png 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1.bp.blogspot.com/--vAXVDNhnn4/WZE2kQY0hJI/AAAAAAAAF8U/fksAHvqVJJskec1GoHQFYCE3TfEqCpALACLcBGAs/s30-p/Screen%2BShot%2B2017-08-13%2Bat%2B14.48.34.png

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

a59b19076bba9a965b8023f1983c71c9eabd80a1dee90a5515f59297aed977f9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 10:11:33 GMT
x-content-type-options: nosniff
age: 13716
status: 200
content-disposition: inline;filename="Screen Shot 2017-08-13 at 14.48.34.png"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1542
x-xss-protection: 0
server: fife
etag: "v17c8"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Thu, 24 Sep 2020 05:21:17 GMT

GET comment-iframe.g
www.blogger.com/ Frame 9371 0
0

GET comment-iframe.g
www.blogger.com/ Frame C660 0
0

GET
H3-Q050

200

comment-iframe.g
www.blogger.com/ Frame C660
Redirect Chain

https://www.blogger.com/comment-iframe.g?blogID=3986785863650565253&postID=6114194039930120721
https://accounts.google.com/ServiceLogin?continue=https://www.blogger.com/comment-iframe.g?blogID%3D3986785863650565253%26postID%3D6114194039930120721%26bpli%3D1&followup=https://www.blogger.com/co...
https://www.blogger.com/comment-iframe.g?blogID=3986785863650565253&postID=6114194039930120721&bpli=1

0
0

160ms
159ms

Document
text/html

2a00:1450:4001:81f::2009
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.blogger.com/comment-iframe.g?blogID=3986785863650565253&postID=6114194039930120721&bpli=1

Requested by

Host: www.blogblog.com
URL: https://www.blogblog.com/dynamicviews/de918fe7fca9ee54/js/common.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81f::2009 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'self' .google.com .google-analytics.com 'unsafe-inline' 'unsafe-eval' .gstatic.com .googlesyndication.com .blogger.com .googleapis.com uds.googleusercontent.com https://s.ytimg.com https://i18n-cloud.appspot.com www-onepick-opensocial.googleusercontent.com www-bloggervideo-opensocial.googleusercontent.com www-blogger-opensocial.googleusercontent.com https://www.blogblog.com; report-uri /cspreport
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.blogger.com
:scheme: https
:path: /comment-iframe.g?blogID=3986785863650565253&postID=6114194039930120721&bpli=1
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: about:blank

Response headers

status: 200
p3p: CP="This is not a P3P policy! See https://www.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info."
content-security-policy: script-src 'self' *.google.com *.google-analytics.com 'unsafe-inline' 'unsafe-eval' *.gstatic.com *.googlesyndication.com *.blogger.com *.googleapis.com uds.googleusercontent.com https://s.ytimg.com https://i18n-cloud.appspot.com www-onepick-opensocial.googleusercontent.com www-bloggervideo-opensocial.googleusercontent.com www-blogger-opensocial.googleusercontent.com https://www.blogblog.com; report-uri /cspreport
content-type: text/html; charset=UTF-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Thu, 24 Sep 2020 14:00:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 1741
server: GSE
set-cookie: S=blogger=IyD2E4i_fUbWKPlCj-PcqS4ZvThuyctFp9JtIXZ2ZO4; Domain=.blogger.com; Path=/; Secure; HttpOnly; Priority=LOW; SameSite=none
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

status: 302
content-type: text/html; charset=UTF-8
x-frame-options: DENY
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Thu, 24 Sep 2020 14:00:10 GMT
location: https://www.blogger.com/comment-iframe.g?blogID=3986785863650565253&postID=6114194039930120721&bpli=1
strict-transport-security: max-age=31536000; includeSubDomains
content-security-policy: script-src 'report-sample' 'nonce-EAgV8Fk4Zg0XAfC1mCfzqw' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreport
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 241
server: GSE
set-cookie: __Host-GAPS=1:JJBFL1WKJlU5RALR0gfL8_Lgbzqlug:skvBZlGI8CYQUI8G;Path=/;Expires=Sat, 24-Sep-2022 14:00:10 GMT;Secure;HttpOnly;Priority=HIGH
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.blogger.com
URL: https://www.blogger.com/comment-iframe.g?blogID=3986785863650565253&postID=6114194039930120721

Domain: www.blogger.com
URL: https://www.blogger.com/comment-iframe.g?blogID=3986785863650565253&postID=6114194039930120721

Verdicts & Comments Add Verdict or Comment

82 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.vkremez.com/	1970-01-19 12:42:36	Name: _gat Value: 1
.vkremez.com/	1970-01-19 12:44:02	Name: _gid Value: GA1.2.2619915.1600956002
.vkremez.com/	1970-01-20 06:13:48	Name: _ga Value: GA1.2.2108925075.1600956002
.vkremez.com/	1970-01-19 13:25:48	Name: __cfduid Value: d542c33b70ce7fa59ae4214e8572ad0d41600956002

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

1.bp.blogspot.com
2.bp.blogspot.com
3.bp.blogspot.com
4.bp.blogspot.com
accounts.google.com
ajax.cloudflare.com
apis.google.com
platform.twitter.com
stats.g.doubleclick.net
www.blogblog.com
www.blogger.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.vkremez.com
www.blogger.com
2606:2800:234:59:254c:406:2366:268c
2606:4700:3031::681c:153e
2606:4700::6810:a723
2a00:1450:4001:802::200e
2a00:1450:4001:806::2001
2a00:1450:4001:818::2003
2a00:1450:4001:819::2001
2a00:1450:4001:819::2004
2a00:1450:4001:819::200e
2a00:1450:4001:81f::2009
2a00:1450:4001:820::200e
2a00:1450:4001:821::200d
2a00:1450:4001:821::200e
2a00:1450:400c:c0c::9b
2a03:2880:f11c:8183:face:b00c:0:25de
01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
088734158a6c69e32f928ffa72f2e6505312e5a76bca31ff34bbe85ce100e992
0c239d58c774a19f664eb6ab5004a6ae3c449325ee5998ba65f892df4d6a5971
0e7b4d1180187373e1e81dc52672389f9c4dfb477586cee1caea057fc042ad81
10e1b9c2de3504f2345907eef55f57ab8db35cafc72afdec0ac986f45291a8e8
12956acbc65984f465f513dadb036a69899a5320d464ecc44fbdff33d47d402c
1385fe6c7366b4ab71c2806b9d327c837c8b5d74e35aa762200da83feb6113a8
146cf03f372f999168d4ec2a94380976f15f17fbfb08fbffde1c1a5f67438fee
14a06236a680dc1ea147e0fa0a105cead0d770e6287072da1720dccc19aa40bc
1856965de5b049979677f4eb5e149f93464e76d8b4beccc66d1befbcd1c6ff56
1ad705e628a38ac534ff5357e88b0ebe199385bd3afbc6a8a75eeadd9885fd24
1c5c2bf1131bd8f1578c106a85ef6394aae3192314ed6bab5f8fabc2b0be3495
23b775e4e3b5b93742dad8a1bbfacb2ffc3271a15dbfc6d3ded21d713f2c3489
266c8725e6911ff0e2f23572d0ebf1e30c7594e49ea8bed00af914c924fc086a
2dde0068aa6abd942461e9f5a2ce63505faa130295454b6b6bbec371de6fe009
34c6eb5fe76799775f269cf110d2b953f50c439b693e6ef0c9ce52426bb5c2fb
352c0ffe232c95e651a332fc322419fc55330d3c91f7fbf51ff430847ee1623f
38c7b9dfaa94c5bb687b94856b3f667b3fc32558cefc8db2462e428b22f3f272
39e1d583fa516a045854dd31d01795224685f184c7309e649805f961db4c0d4b
3c2314a555c78ee37c995eaa1b964e1e889bb23bb32dc86b4d9fa4f0af0a3d0f
4286fd6f7ca4c6d12f1573d042d24982f0564a0dc35080bf44a560b0845bf4e7
439476ca5fd109c0aeb8e6c55d4cc4e2e772a27a582c49109494f06f40c95cbc
43d56f74ff0e7a7482cdf2acfad5eb4536c3abccb123790c84ff7c9d4bc6cf18
477f12c7e6663b43c795c9dfc11bb8abe246f8fe12ab8336be2968eac0a4bab7
4aaf228ccea0266ab752855d33240266d89fd483fb62eaf52d5558d417253be3
4b9d15622183e036ef20de29c23338817077e220a7f85bd24c574cc5202b8f8d
4f37cc26aefc6f7ac0b0104cd3ab477f9f88d06ce2a05640f78565002fa6902f
5114816a47dc958d23af84763e576b236d08aa1366f10b5ec37d2ba5052b74c0
5754a78fea82bb52d068d3c64de5ab9ae7ed70de719090407bb2ade232a5b7ee
5bad31055fddde526b7b4e43621f46ff190776a7ee57243072f1d7dd1fa702e7
5d08e3977ac882cac0b3ba2ca6bc235de70d4fd53b35479b36ec62d2b7962a93
5d4f00b740c987fdd882682830c76c2ff10b2b8982ae7ac58086758c274fc935
60863e86aa7743d1ac841da7f473a05cd57fba81d661cef658e385437f80d5ef
60f2ee8979a830df28592bdc641f0ec2772430031e7a50b4c7d9592c8a7733ef
6466c0e7a97bb5944c95e0b50c4a78b729a002ebe349cc4c9496079adbafb30c
649900d3905b9f2e7b125937917a96a473c0f3215cb51808d744bca68b081691
651fd27be7dfbf9449b590a95a02c96fe3a8a14b6fb1631db88e1a3f4c7ecd96
672d64bef3ef92e42a5550c13238cc329787222e2874cbabbe4861a136d29dc2
6c0ebe5f6ec903f685e9d02e3d8a7464333c65a83edd639a62d002d17334beda
6d6b2397c0429050dd22ca4322bd54351a88692ff74c0603ac20d9cdfc68a191
6f8f758d328fe50ec2ccd54786226624818171dff319ddecfd14a429d1d806a4
7e04d6abaf6bb7889fe5fcb79c3a1cc97c067bc798d6ac2dfc2c3852df9e3f37
7e41f7333fa9b59a516a5a4f3af346bb24a4c3c8a7bc26551b6fec8d0f6b8555
800cdca40b909aa85f1e0b5202e6c36a6317b4e43ef14dbce97f8b1174f95549
82def3e3ea5794d68c07253d6d5b547985b3bea4227b6942a29fba62fde49a63
83a2e9e77e37f8142be840b51bfe16f27c7d857ca614550e93aa860eb29391a9
83adc88a1264b185cff852951ffdd42d68761f692b9e28951d26fa20eaccf2be
84d8ff0b83ae2d4534af3e612a96a91a1ff9b6281e24e9566b9916417ceb63b9
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
870c88fd51fa56c52989ef0e94f106c46aef8e2036ad694d72cb02a8e307785f
882b7316b4f9053b6debabf8bf1d257950264d501cd30cd2c48972c59a164a8c
987d4cab1c85d764068420e5b35cb34e9d675e26042ba9a6b04f99327f4d3cca
9c3db9fa3975bf7489a64f3fb8c606119ed03705fc15471b073d54e29df82629
a04e5061755422189bf006fd2aaa785ffceae0b9d07c61e9fdc1ca0465faea30
a3526975153401491b2ebe96da9193881276911067fea1859d559fa0af980e0f
a35d7973868226e4830f8b4c535aa94ba6a58bf46ae575d4ccf9931ab4b05af6
a400d73caf87f08fa624b8ac9100a38d076f736bd718cc7131331b35c5e885c2
a59b19076bba9a965b8023f1983c71c9eabd80a1dee90a5515f59297aed977f9
a761b426004caba495cdac2c93ce7dd306c47bc4d7bdc63c4840c3d8182396a9
a821b63c30408f4ba17664477f4060f5f73bdcb5c9cfa5d660873143795c46d6
a97f410f65e2faae69fac5ef8c34a937808d1094960062ded1682d5af3d669ac
ada150b19834590e9b541a6de7bc403dea550444de15d4841fe5ac5afc8281e0
ae56a08ad120fa9cbaad5e2d0f29d15ab5995ec798b7fb646926e2b2f1432b88
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
b079f588738a4e47b7451f7f332b16fbbe60aa435499419a71df278688ad51a2
b08cdbc2d30e656a86b20f8342428d5863f70f4b30135b4f4061f754ce932f5e
b5a2ce54ddde57451e063e3db3e24ced1f67992231a23397f7b194a2fdaeb613
c0d078d779c6d50be940b91eafdc1e0091ee1aef73087fdcddfb7771470b3c59
c425fc1d4bf6757927986974d71a777e077a47537471db8c29e52e469f71e876
c678636b42cce155be48ee783b75a30e2851d08e7f81e5b6279520a24746d917
c89a2cf8bf444df7e11af2befd8c1f20a96c34bee6d13270e7692441843395da
c91afadbe63dd834aac00b49bc715795da58970e7d500c4bd8f50ed713c77880
d1252f3f1584dd033509867c51515623b05894f4b82a9e3c3da822326eaafc69
d310a2a2ad6bcac4068391482c43950cc7e672ad698641309af0c8dbaa673456
d9bf20fa1e29339c8dcbe0df9f1cd23ee01df3ae0877cdc80d08c33a30d41ab4
de4774067968f00ffcf4b72574b39f54cd766f1f956d7c21f0d815931f78fc5d
e0c75a3728746941983a7e3b362dd5df7c2d67dcb49567724fabb15b1ef50947
e1c8c674a5de7e5de010a6212157bdf0d1973fae8863fc34b883f344098bf04d
e1d46ef344e5d9a593b69978ada52e7ffb85d3154389a532daae5036373d55a6
e9c446e0dbaf6509c3f50825b8592884f7bf7d21aaf5b0fddaa98d7b389ecd5b
eba3881542a1ce2068c819ecebaf2f7ba9dbbf2cbde8f68eaa39a832ef66c6c8
eeea76d34a426787eab8f9ddf9209a6188a05f180b961b93f7fb767b908e96d9
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef25f2d6f5aa424f594bbaa63c1f86a634e2b87911e1db695b2a0c2e6927353a
f5b92e0c5428ee48219650011e0bcf48607dd9a390f1b36384fb38087b67f24d
f5fcff76c1da90c0cfa732560a2952a473fc0245c48c443d1df37b1d25fe3834
f749661c02cee9c7aef6745e82a1125d68762c4759dcdbfd163e3f24bde6be57

www.vkremez.com Open in urlscan Pro 2606:4700:3031::681c:153e Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

92 Requests

98 %HTTPS

100 %IPv6

11 Domains

16 Subdomains

15 IPs

4 Countries

1492 kBTransfer

6732 kBSize

4 Cookies

11 Outgoing links

Redirected requests

92 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 7 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.vkremez.com Open in urlscan Pro
2606:4700:3031::681c:153e Public Scan

Screenshot
Live screenshot

Full Image

92
Requests

98 %
HTTPS

100 %
IPv6

11
Domains

16
Subdomains

15
IPs

4
Countries

1492 kB
Transfer

6732 kB
Size

4
Cookies

92 HTTP transactions
7 data transactions