urlscan.io logo urlscan.io
SecurityTrails logo

blog.reasonsecurity.com Open in urlscan Pro
192.0.78.215  Public Scan

Go To Rescan Add Verdict Report
URL: https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
Submission: On October 16 via api from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 20 IPs in 4 countries across 14 domains to perform 89 HTTP transactions. The main IP is 192.0.78.215, located in San Francisco, United States and belongs to AUTOMATTIC - Automattic, Inc, US. The main domain is blog.reasonsecurity.com.
TLS certificate: Issued by Let's Encrypt Authority X3 on August 22nd 2019. Valid for: 3 months.
This is the only time blog.reasonsecurity.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
18 192.0.78.215 2635 (AUTOMATTIC)
22 192.0.77.37 2635 (AUTOMATTIC)
2 2a00:1450:400... 15169 (GOOGLE)
3 192.0.77.32 2635 (AUTOMATTIC)
3 2a04:fa87:fff... 2635 (AUTOMATTIC)
2 192.0.76.3 2635 (AUTOMATTIC)
1 2a00:1450:400... 15169 (GOOGLE)
3 95.100.67.47 16625 (AKAMAI-AS)
11 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 192.0.78.33 2635 (AUTOMATTIC)
5 2606:2800:234... 15133 (EDGECAST)
3 2a03:2880:f02... 32934 (FACEBOOK)
2 2a00:1450:400... 15169 (GOOGLE)
2 2606:4700:30:... 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
4 2a03:2880:f12... 32934 (FACEBOOK)
1 104.244.42.8 13414 (TWITTER)
4 2600:9000:20e... 16509 (AMAZON-02)
89 20
18    192.0.78.215 (San Francisco, United States)

ASN2635 (AUTOMATTIC - Automattic, Inc, US)
blog.reasonsecurity.com
22    192.0.77.37 (San Francisco, United States)

ASN2635 (AUTOMATTIC - Automattic, Inc, US)
PTR: wordpress.com
c0.wp.com
2    2a00:1450:4001:821::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
fonts.googleapis.com
3    192.0.77.32 (San Francisco, United States)

ASN2635 (AUTOMATTIC - Automattic, Inc, US)
PTR: wordpress.com
s0.wp.com
widgets.wp.com
3    2a04:fa87:fffe::c000:4902 (Ireland)

ASN2635 (AUTOMATTIC - Automattic, Inc, US)
secure.gravatar.com
2    192.0.76.3 (San Francisco, United States)

ASN2635 (AUTOMATTIC - Automattic, Inc, US)
stats.wp.com
pixel.wp.com
1    2a00:1450:4001:81e::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
fonts.googleapis.com
3    95.100.67.47 (Ascension Island)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a95-100-67-47.deploy.static.akamaitechnologies.com
use.typekit.net
p.typekit.net
11    2a00:1450:4001:806::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
fonts.gstatic.com
1    2a00:1450:4001:814::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
www.googletagmanager.com
1    192.0.78.33 (San Francisco, United States)

ASN2635 (AUTOMATTIC - Automattic, Inc, US)
jetpack.wordpress.com
5    2606:2800:234:59:254c:406:2366:268c (United States)

ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US)
platform.twitter.com
3    2a03:2880:f02d:12:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK - Facebook, Inc., US)
connect.facebook.net
staticxx.facebook.com
2    2a00:1450:4001:815::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
www.google-analytics.com
2    2606:4700:30::681f:4fd3 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
cdn.popt.in
display.popt.in
1    2a00:1450:4001:81b::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
ajax.googleapis.com
4    2a03:2880:f12d:83:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK - Facebook, Inc., US)
www.facebook.com
1    104.244.42.8 (United States)

ASN13414 (TWITTER - Twitter Inc., US)
syndication.twitter.com
4    2600:9000:20eb:4a00:b:8c20:bf40:21 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
d3lopmpcew67el.cloudfront.net
Domain Requested by
22 c0.wp.com blog.reasonsecurity.com
18 blog.reasonsecurity.com blog.reasonsecurity.com
11 fonts.gstatic.com blog.reasonsecurity.com
5 platform.twitter.com blog.reasonsecurity.com
platform.twitter.com
c0.wp.com
4 d3lopmpcew67el.cloudfront.net ajax.googleapis.com
4 www.facebook.com connect.facebook.net
c0.wp.com
3 secure.gravatar.com blog.reasonsecurity.com
c0.wp.com
3 fonts.googleapis.com blog.reasonsecurity.com
2 widgets.wp.com blog.reasonsecurity.com
c0.wp.com
2 www.google-analytics.com www.googletagmanager.com
blog.reasonsecurity.com
2 connect.facebook.net blog.reasonsecurity.com
connect.facebook.net
2 use.typekit.net blog.reasonsecurity.com
use.typekit.net
1 syndication.twitter.com blog.reasonsecurity.com
1 p.typekit.net blog.reasonsecurity.com
1 pixel.wp.com blog.reasonsecurity.com
1 display.popt.in ajax.googleapis.com
1 ajax.googleapis.com cdn.popt.in
1 staticxx.facebook.com connect.facebook.net
1 cdn.popt.in www.googletagmanager.com
1 jetpack.wordpress.com blog.reasonsecurity.com
1 www.googletagmanager.com blog.reasonsecurity.com
1 stats.wp.com blog.reasonsecurity.com
1 s0.wp.com blog.reasonsecurity.com
89 23
Subject Issuer Validity Valid
tls.automattic.com
Let's Encrypt Authority X3		 2019-08-22 -
2019-11-20		 3 months crt.sh
*.wp.com
Go Daddy Secure Certificate Authority - G2		 2018-04-10 -
2020-05-11		 2 years crt.sh
*.googleapis.com
GTS CA 1O1		 2019-09-17 -
2019-12-10		 3 months crt.sh
*.gravatar.com
COMODO RSA Domain Validation Secure Server CA		 2018-09-06 -
2020-09-05		 2 years crt.sh
*.typekit.net
DigiCert SHA2 Secure Server CA		 2018-07-20 -
2020-01-03		 a year crt.sh
*.google.com
GTS CA 1O1		 2019-09-17 -
2019-12-10		 3 months crt.sh
*.google-analytics.com
GTS CA 1O1		 2019-09-17 -
2019-12-10		 3 months crt.sh
*.wordpress.com
COMODO RSA Domain Validation Secure Server CA		 2018-09-06 -
2020-09-05		 2 years crt.sh
*.twimg.com
DigiCert SHA2 High Assurance Server CA		 2018-11-19 -
2019-11-27		 a year crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2019-09-22 -
2019-12-20		 3 months crt.sh
sni116475.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2		 2019-09-11 -
2020-03-19		 6 months crt.sh
syndication.twitter.com
DigiCert SHA2 High Assurance Server CA		 2019-04-09 -
2020-04-01		 a year crt.sh
*.cloudfront.net
DigiCert Global CA G2		 2019-07-17 -
2020-07-05		 a year crt.sh

This page contains 12 frames:

Primary Page: https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
Frame ID: 69227F07C5566EF2B8792AD3729327A0
Requests: 80 HTTP requests in this frame

Frame: https://jetpack.wordpress.com/jetpack-comment/?blogid=85224909&postid=1969&comment_registration=0&require_name_email=1&stc_enabled=1&stb_enabled=1&show_avatars=1&avatar_default=identicon&greeting=Leave+a+Reply&greeting_reply=Leave+a+Reply+to+%25s&color_scheme=light&lang=en_US&jetpack_version=7.8&show_cookie_consent=10&has_cookie_consent=0&token_key=%3Bnormal%3B&sig=1c46eecda3c4340f5df92ad19a60780d7ba2e734
Frame ID: 37576209FBC0D45894A4B45DFF05B0B3
Requests: 1 HTTP requests in this frame

Frame: https://staticxx.facebook.com/connect/xd_arbiter.php?version=44
Frame ID: 2127586B72E8E7D0028915D0FA3803D8
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/v2.3/plugins/share_button.php?app_id=249643311490&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fconnect%2Fxd_arbiter.php%3Fversion%3D44%23cb%3Df9de19684b983%26domain%3Dblog.reasonsecurity.com%26origin%3Dhttps%253A%252F%252Fblog.reasonsecurity.com%252Ff2aded51d404e2%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Fblog.reasonsecurity.com%2F2019%2F10%2F15%2Fthreat-analysis-report-save-yourself-malware%2F&layout=button_count&locale=en_US&sdk=joey
Frame ID: 1CC709EE88904C79F51EC04A6EB67313
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/v2.3/plugins/page.php?app_id=249643311490&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fconnect%2Fxd_arbiter.php%3Fversion%3D44%23cb%3Df221378fb07cbe%26domain%3Dblog.reasonsecurity.com%26origin%3Dhttps%253A%252F%252Fblog.reasonsecurity.com%252Ff2aded51d404e2%26relation%3Dparent.parent&container_width=300&height=1200&hide_cover=false&href=https%3A%2F%2Fwww.facebook.com%2Fpages%2FReason-Core-Security%2F792262430823085&locale=en_US&sdk=joey&show_facepile=true&show_posts=true&width=300
Frame ID: AF29A1698F5CC72FFFE8B5C5970BC7FB
Requests: 1 HTTP requests in this frame

Frame: https://widgets.wp.com/likes/master.html?ver=201942
Frame ID: 2504B8227A2F4347358EBB526F2AFBE3
Requests: 1 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.e3a0e1b01ae601b6c9cf798a93ab7e69.html?origin=https%3A%2F%2Fblog.reasonsecurity.com
Frame ID: 9F4A4CD3D6C0483F6F441308F01DEA34
Requests: 1 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/tweet_button.e3a0e1b01ae601b6c9cf798a93ab7e69.en.html
Frame ID: 1F1BA9C7B96D1ABBA2EB7D7427500146
Requests: 1 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/tweet_button.e3a0e1b01ae601b6c9cf798a93ab7e69.en.html
Frame ID: 56F160EA13C078A1B245329E44892DEB
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/v2.3/plugins/share_button.php?app_id=249643311490&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fconnect%2Fxd_arbiter.php%3Fversion%3D44%23cb%3Df9de19684b983%26domain%3Dblog.reasonsecurity.com%26origin%3Dhttps%253A%252F%252Fblog.reasonsecurity.com%252Ff2aded51d404e2%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Fblog.reasonsecurity.com%2F2019%2F10%2F15%2Fthreat-analysis-report-save-yourself-malware%2F&layout=button_count&locale=en_US&sdk=joey
Frame ID: C706323AB8AF47FEDB78F78487DDC5EC
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/v2.3/plugins/page.php?app_id=249643311490&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fconnect%2Fxd_arbiter.php%3Fversion%3D44%23cb%3Df2710e338961f%26domain%3Dblog.reasonsecurity.com%26origin%3Dhttps%253A%252F%252Fblog.reasonsecurity.com%252Ff2aded51d404e2%26relation%3Dparent.parent&container_width=0&height=1200&hide_cover=false&href=https%3A%2F%2Fwww.facebook.com%2Fpages%2FReason-Core-Security%2F792262430823085&locale=en_US&sdk=joey&show_facepile=true&show_posts=true&width=300
Frame ID: 8A8CACCCD9B7989FC76F8438008726D7
Requests: 1 HTTP requests in this frame

Frame: https://widgets.wp.com/likes/
Frame ID: 97CB0B75714E38B4A958031A31182F1C
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
  • html /<link[^>]+s\d+\.wp\.com/i
  • script /\/wp-(?:content|includes)\//i
  • headers link /rel="https:\/\/api\.w\.org\/"/i
Overall confidence: 100%
Detected patterns
  • html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
  • html /<link[^>]+s\d+\.wp\.com/i
  • script /\/wp-(?:content|includes)\//i
  • headers link /rel="https:\/\/api\.w\.org\/"/i
Overall confidence: 100%
Detected patterns
  • html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
  • html /<link[^>]+s\d+\.wp\.com/i
  • script /\/wp-(?:content|includes)\//i
  • headers link /rel="https:\/\/api\.w\.org\/"/i
Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i
Overall confidence: 100%
Detected patterns
  • script /\/\/connect\.facebook\.net\/[^\/]*\/[a-z]*\.js/i
Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i
Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i
Overall confidence: 100%
Detected patterns
  • script /\/\/platform\.twitter\.com\/widgets\.js/i

Page Statistics

89
Requests

100 %
HTTPS

63 %
IPv6

14
Domains

23
Subdomains

20
IPs

4
Countries

770 kB
Transfer

1814 kB
Size

6
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

89 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/ 		70 KB
16 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.215 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
e591c1904166ec31851a8f101da7a018e9fa9206ce8d9a08c42178a9eb80642b
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

:method
GET
:authority
blog.reasonsecurity.com
:scheme
https
:path
/2019/10/15/threat-analysis-report-save-yourself-malware/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
navigate
sec-fetch-user
?1
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
none
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1

Response headers

status
200
server
nginx
date
Wed, 16 Oct 2019 13:42:29 GMT
content-type
text/html; charset=UTF-8
strict-transport-security
max-age=86400
vary
Accept-Encoding Cookie
x-pingback
https://blog.reasonsecurity.com/xmlrpc.php
link
<https://blog.reasonsecurity.com/wp-json/>; rel="https://api.w.org/" <https://wp.me/p5LATj-vL>; rel=shortlink
last-modified
Wed, 16 Oct 2019 13:42:29 GMT
cache-control
max-age=300, must-revalidate
x-nananana
Batcache
content-encoding
gzip
x-ac
3.fra _atomic_dca
webfont.js
blog.reasonsecurity.com/wp-content/mu-plugins/wpcomsh/vendor/automattic/custom-fonts/js/ 		12 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.reasonsecurity.com/wp-content/mu-plugins/wpcomsh/vendor/automattic/custom-fonts/js/webfont.js
Requested by
Host: blog.reasonsecurity.com
URL: https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.215 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
2711b037e078e306e59765e9fc22d9f86867eb26af8c6af72d864a1c52bed8ac
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 13:42:29 GMT
content-encoding
gzip
last-modified
Mon, 12 Jun 2017 21:39:47 GMT
server
nginx
etag
W/"593f0a23-30cd"
vary
Accept-Encoding
strict-transport-security
max-age=86400
content-type
application/x-javascript
status
200
cache-control
max-age=604800
x-ac
3.fra _atomic_dca
expires
Wed, 23 Oct 2019 13:42:29 GMT
wp-emoji-release.min.js
blog.reasonsecurity.com/wp-includes/js/ 		14 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.reasonsecurity.com/wp-includes/js/wp-emoji-release.min.js?ver=5.2.4
Requested by
Host: blog.reasonsecurity.com
URL: https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.215 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
f4799ef2939b8377cf33f07b07b6d90a4a245adbf1c6eaf47ee3b0fcefcc07fe
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 13:42:29 GMT
content-encoding
gzip
last-modified
Mon, 08 Apr 2019 05:22:51 GMT
server
nginx
etag
W/"5caadaab-3610"
vary
Accept-Encoding
strict-transport-security
max-age=86400
content-type
application/x-javascript
status
200
cache-control
max-age=315360000
x-ac
3.fra _atomic_dca
expires
Thu, 31 Dec 2037 23:55:55 GMT
style.min.css
c0.wp.com/c/5.2.4/wp-includes/css/dist/block-library/ 		29 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://c0.wp.com/c/5.2.4/wp-includes/css/dist/block-library/style.min.css
Requested by
Host: blog.reasonsecurity.com
URL: https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
4b8fe5c3d0e5ef7a6582185cbf5c535b5d369c8df1da98c03ed69833e55f474d
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT fra 1
date
Wed, 16 Oct 2019 13:42:29 GMT
content-encoding
br
last-modified
Mon, 22 Apr 2019 12:40:04 GMT
server
nginx
vary
Accept-Encoding
content-type
text/css
status
200
cache-control
max-age=31536000
strict-transport-security
max-age=15552000
expires
Thu, 15 Oct 2020 13:42:29 GMT
blocks.css
blog.reasonsecurity.com/wp-content/themes/canard/ 		8 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://blog.reasonsecurity.com/wp-content/themes/canard/blocks.css?ver=5.2.4
Requested by
Host: blog.reasonsecurity.com
URL: https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.215 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
6c7b085684080f8fb117b6a8979d0b42907891f186b532cf88048b0adc1b976f
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 13:42:29 GMT
content-encoding
gzip
last-modified
Sat, 30 Mar 2019 02:05:04 GMT
server
nginx
etag
W/"5c9eced0-1ea4"
vary
Accept-Encoding
strict-transport-security
max-age=86400
content-type
text/css
status
200
cache-control
max-age=315360000
x-ac
3.fra _atomic_dca
expires
Thu, 31 Dec 2037 23:55:55 GMT
genericons.css
c0.wp.com/p/jetpack/7.8/_inc/genericons/genericons/ 		28 KB
16 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://c0.wp.com/p/jetpack/7.8/_inc/genericons/genericons/genericons.css
Requested by
Host: blog.reasonsecurity.com
URL: https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
4ed10d0d64bb1515397e8666a63f484d640dbc5678fa62574e077b7aef1c3af2
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT fra 1
date
Wed, 16 Oct 2019 13:42:29 GMT
content-encoding
br
last-modified
Wed, 13 Jan 2016 23:09:07 GMT
server
nginx
vary
Accept-Encoding
content-type
text/css
status
200
cache-control
max-age=31536000
strict-transport-security
max-age=15552000
expires
Thu, 15 Oct 2020 13:42:29 GMT
css
fonts.googleapis.com/ 		12 KB
950 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=PT+Serif%3A400%2C700%2C400italic%2C700italic%7CPlayfair+Display%3A400%2C700%2C400italic%2C700italic&subset=cyrillic%2Clatin%2Clatin-ext&ver=5.2.4
Requested by
Host: blog.reasonsecurity.com
URL: https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:821::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
ESF /
Resource Hash
fd0aad6bd18e1db3bff4bb5d5de61b13fd0acfab1a80b5546dbbfc5d06508bfd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
Origin
https://blog.reasonsecurity.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Wed, 16 Oct 2019 13:42:29 GMT
server
ESF
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
status
200
date
Wed, 16 Oct 2019 13:42:29 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
x-xss-protection
0
expires
Wed, 16 Oct 2019 13:42:29 GMT
css
fonts.googleapis.com/ 		5 KB
1002 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Lato%3A400%2C700%2C400italic%2C700italic%7CInconsolata%3A400%2C700&subset=latin%2Clatin-ext&ver=5.2.4
Requested by
Host: blog.reasonsecurity.com
URL: https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:821::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
ESF /
Resource Hash
7998d10344ff2754217b6323952a2fe790bd2e0cbe13b5ce72d12e1efe7a1df9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
Origin
https://blog.reasonsecurity.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Wed, 16 Oct 2019 13:42:29 GMT
server
ESF
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
status
200
date
Wed, 16 Oct 2019 13:42:29 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
x-xss-protection
0
expires
Wed, 16 Oct 2019 13:42:29 GMT
style.css
blog.reasonsecurity.com/wp-content/themes/canard/ 		83 KB
14 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://blog.reasonsecurity.com/wp-content/themes/canard/style.css?ver=5.2.4
Requested by
Host: blog.reasonsecurity.com
URL: https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.215 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
f0703e3b30d945384dea1e389adcc181922cd0a620cceabbde8df433145097af
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 13:42:29 GMT
content-encoding
gzip
last-modified
Sat, 30 Mar 2019 02:05:04 GMT
server
nginx
etag
W/"5c9eced0-14d7b"
vary
Accept-Encoding
strict-transport-security
max-age=86400
content-type
text/css
status
200
cache-control
max-age=315360000
x-ac
3.fra _atomic_dca
expires
Thu, 31 Dec 2037 23:55:55 GMT
style-wpcom.css
blog.reasonsecurity.com/wp-content/themes/canard/inc/ 		14 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://blog.reasonsecurity.com/wp-content/themes/canard/inc/style-wpcom.css?ver=5.2.4
Requested by
Host: blog.reasonsecurity.com
URL: https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.215 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
807e31e5fb001364a2a8e25dae7afa66324fbe958a7af895ebcab011c33e26d5
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 13:42:29 GMT
content-encoding
gzip
last-modified
Sat, 30 Mar 2019 02:05:04 GMT
server
nginx
etag
W/"5c9eced0-3960"
vary
Accept-Encoding
strict-transport-security
max-age=86400
content-type
text/css
status
200
cache-control
max-age=315360000
x-ac
3.fra _atomic_dca
expires
Thu, 31 Dec 2037 23:55:55 GMT
style.css
c0.wp.com/p/jetpack/7.8/modules/widgets/facebook-likebox/ 		48 B
108 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://c0.wp.com/p/jetpack/7.8/modules/widgets/facebook-likebox/style.css
Requested by
Host: blog.reasonsecurity.com
URL: https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
9fbd3c2713beacc2285bd418877d4a36273244eabf9df9f488bbd6f5ec2c467d
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT fra 1
date
Wed, 16 Oct 2019 13:42:29 GMT
last-modified
Mon, 06 Jul 2015 18:16:56 GMT
server
nginx
strict-transport-security
max-age=15552000
content-type
text/css
status
200
cache-control
max-age=31536000
accept-ranges
bytes
content-length
48
expires
Thu, 15 Oct 2020 13:42:29 GMT
social-logos.min.css
c0.wp.com/p/jetpack/7.8/_inc/social-logos/ 		26 KB
18 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://c0.wp.com/p/jetpack/7.8/_inc/social-logos/social-logos.min.css
Requested by
Host: blog.reasonsecurity.com
URL: https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
2e1ced1bd0736a56a0c44fd7b3bf8134850398ecddd52a0f5e6e437c5d527999
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT fra 1
date
Wed, 16 Oct 2019 13:42:29 GMT
content-encoding
br
last-modified
Wed, 27 Jun 2018 01:03:44 GMT
server
nginx
vary
Accept-Encoding
content-type
text/css
status
200
cache-control
max-age=31536000
strict-transport-security
max-age=15552000
expires
Thu, 15 Oct 2020 13:42:29 GMT
jetpack.css
c0.wp.com/p/jetpack/7.8/css/ 		70 KB
12 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://c0.wp.com/p/jetpack/7.8/css/jetpack.css
Requested by
Host: blog.reasonsecurity.com
URL: https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
b42989a0f2a1fb6d69e72c4f548ef2e73c4d3089d53649f5ed75e45c7b91cffb
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT fra 1
date
Wed, 16 Oct 2019 13:42:29 GMT
content-encoding
br
last-modified
Tue, 06 Aug 2019 12:48:34 GMT
server
nginx
vary
Accept-Encoding
content-type
text/css
status
200
cache-control
max-age=31536000
strict-transport-security
max-age=15552000
expires
Thu, 15 Oct 2020 13:42:29 GMT
jquery.js
c0.wp.com/c/5.2.4/wp-includes/js/jquery/ 		95 KB
32 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c0.wp.com/c/5.2.4/wp-includes/js/jquery/jquery.js
Requested by
Host: blog.reasonsecurity.com
URL: https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT fra 1
date
Wed, 16 Oct 2019 13:42:29 GMT
content-encoding
br
last-modified
Fri, 17 May 2019 17:08:53 GMT
server
nginx
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=31536000
strict-transport-security
max-age=15552000
expires
Thu, 15 Oct 2020 13:42:29 GMT
jquery-migrate.min.js
c0.wp.com/c/5.2.4/wp-includes/js/jquery/ 		10 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c0.wp.com/c/5.2.4/wp-includes/js/jquery/jquery-migrate.min.js
Requested by
Host: blog.reasonsecurity.com
URL: https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT fra 1
date
Wed, 16 Oct 2019 13:42:29 GMT
content-encoding
br
last-modified
Fri, 20 May 2016 06:11:28 GMT
server
nginx
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=31536000
strict-transport-security
max-age=15552000
expires
Thu, 15 Oct 2020 13:42:29 GMT
gtm4wp-form-move-tracker.js
blog.reasonsecurity.com/wp-content/plugins/duracelltomi-google-tag-manager/js/ 		1 KB
466 B 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.reasonsecurity.com/wp-content/plugins/duracelltomi-google-tag-manager/js/gtm4wp-form-move-tracker.js?ver=1.10.1
Requested by
Host: blog.reasonsecurity.com
URL: https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.215 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
bc71c403dc6113c8597e111a99d6a6a197dd2f2355402f8392ca4812dca57d3d
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 13:42:29 GMT
content-encoding
gzip
last-modified
Mon, 12 Aug 2019 19:24:34 GMT
server
nginx
etag
W/"5d51bcf2-5cf"
vary
Accept-Encoding
strict-transport-security
max-age=86400
content-type
application/x-javascript
status
200
cache-control
max-age=315360000
x-ac
3.fra _atomic_dca
expires
Thu, 31 Dec 2037 23:55:55 GMT
postmessage.min.js
c0.wp.com/p/jetpack/7.8/_inc/build/ 		9 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c0.wp.com/p/jetpack/7.8/_inc/build/postmessage.min.js
Requested by
Host: blog.reasonsecurity.com
URL: https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
96cae96a73c65ceed190aa0b4a9a86f0233798e9a17f27ca57855f4f79ebf678
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT fra 1
date
Wed, 16 Oct 2019 13:42:29 GMT
content-encoding
br
last-modified
Wed, 01 May 2019 01:21:49 GMT
server
nginx
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=31536000
strict-transport-security
max-age=15552000
expires
Thu, 15 Oct 2020 13:42:29 GMT
jquery.jetpack-resize.min.js
c0.wp.com/p/jetpack/7.8/_inc/build/ 		3 KB
1022 B 		Script
General
Check archive.org
Download Go to
Full URL
https://c0.wp.com/p/jetpack/7.8/_inc/build/jquery.jetpack-resize.min.js
Requested by
Host: blog.reasonsecurity.com
URL: https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
265c34f4c62e6423e270cecb0c422b735dfb0f18cea04c2ac343b6f22106661e
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT fra 1
date
Wed, 16 Oct 2019 13:42:29 GMT
content-encoding
br
last-modified
Wed, 01 May 2019 01:21:49 GMT
server
nginx
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=31536000
strict-transport-security
max-age=15552000
expires
Thu, 15 Oct 2020 13:42:29 GMT
/
blog.reasonsecurity.com/ 		4 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://blog.reasonsecurity.com/?custom-css=025c19eb2b
Requested by
Host: blog.reasonsecurity.com
URL: https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.215 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
1c208125e545ad905cf6da32cf989d9c4271bab30c09575dc6485f31c89002b8
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nananana
Batcache
date
Wed, 16 Oct 2019 13:42:29 GMT
content-encoding
gzip
last-modified
Wed, 16 Oct 2019 13:42:00 GMT
server
nginx
vary
Accept-Encoding, Cookie
strict-transport-security
max-age=86400
content-type
text/css;charset=utf-8
status
200
cache-control
max-age=271, must-revalidate
x-ac
3.fra _atomic_dca
expires
Thu, 15 Oct 2020 13:42:00 GMT
cropped-reason-logo3x.png
blog.reasonsecurity.com/wp-content/uploads/2018/11/ 		8 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.reasonsecurity.com/wp-content/uploads/2018/11/cropped-reason-logo3x.png
Requested by
Host: blog.reasonsecurity.com
URL: https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.215 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
1ea6f40ec8dae2c9282b638b3e19fcd587aada518a6ed717fb870700f7122c87
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 13:42:29 GMT
x-ac
3.fra _atomic_dca
last-modified
Mon, 26 Nov 2018 13:00:23 GMT
server
nginx
status
200
etag
"5bfbee67-2076"
strict-transport-security
max-age=86400
access-control-allow-methods
GET, HEAD
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=604800
accept-ranges
bytes
content-length
8310
expires
Wed, 23 Oct 2019 13:42:29 GMT
orange-small.png
blog.reasonsecurity.com/wp-content/plugins/jetpack/images/rss/ 		652 B
721 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.reasonsecurity.com/wp-content/plugins/jetpack/images/rss/orange-small.png
Requested by
Host: blog.reasonsecurity.com
URL: https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.215 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
1450a1533a0cf3b0c5a889245ce6fb75ba12be8f87360df08cbc34b087af1cc2
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 13:42:29 GMT
x-ac
3.fra _atomic_dca
last-modified
Tue, 06 Sep 2016 01:14:10 GMT
server
nginx
etag
"57ce1862-28c"
strict-transport-security
max-age=86400
content-type
image/png
status
200
cache-control
max-age=604800
accept-ranges
bytes
content-length
652
expires
Wed, 23 Oct 2019 13:42:29 GMT
wp-polyfill.min.js
c0.wp.com/c/5.2.4/wp-includes/js/dist/vendor/ 		94 KB
31 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c0.wp.com/c/5.2.4/wp-includes/js/dist/vendor/wp-polyfill.min.js
Requested by
Host: blog.reasonsecurity.com
URL: https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
e4c68f0b34a79813171f4674c1d17411378987dccdfa9b1d67ae3582a7b8010a
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT fra 1
date
Wed, 16 Oct 2019 13:42:29 GMT
content-encoding
br
last-modified
Thu, 07 Feb 2019 06:28:03 GMT
server
nginx
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=31536000
strict-transport-security
max-age=15552000
expires
Thu, 15 Oct 2020 13:42:29 GMT
dom-ready.min.js
c0.wp.com/c/5.2.4/wp-includes/js/dist/ 		1 KB
565 B 		Script
General
Check archive.org
Download Go to
Full URL
https://c0.wp.com/c/5.2.4/wp-includes/js/dist/dom-ready.min.js
Requested by
Host: blog.reasonsecurity.com
URL: https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
c204ed0bcb4aad749f3f2afb5f8dd316bd5327f6c303dcd70ecafdfde3a6b7fe
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT fra 1
date
Wed, 16 Oct 2019 13:42:29 GMT
content-encoding
br
last-modified
Thu, 21 Mar 2019 12:48:00 GMT
server
nginx
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=31536000
strict-transport-security
max-age=15552000
expires
Thu, 15 Oct 2020 13:42:29 GMT
photon.min.js
c0.wp.com/p/jetpack/7.8/_inc/build/photon/ 		661 B
393 B 		Script
General
Check archive.org
Download Go to
Full URL
https://c0.wp.com/p/jetpack/7.8/_inc/build/photon/photon.min.js
Requested by
Host: blog.reasonsecurity.com
URL: https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
1e588dccca85e2bc6502337ac3c4009b0672b08f1e5847d5d5a0fe3d5d475ab5
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT fra 1
date
Wed, 16 Oct 2019 13:42:29 GMT
content-encoding
br
last-modified
Tue, 24 Sep 2019 13:09:34 GMT
server
nginx
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=31536000
strict-transport-security
max-age=15552000
expires
Thu, 15 Oct 2020 13:42:29 GMT
devicepx-jetpack.js
s0.wp.com/wp-content/js/ 		10 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/wp-content/js/devicepx-jetpack.js?ver=201942
Requested by
Host: blog.reasonsecurity.com
URL: https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
f32d41f2099a0be20e6b57c5e0d1b71c079d3e1345827b0f5c5b97c6e5e3f78d

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT fra 2
date
Wed, 16 Oct 2019 13:42:29 GMT
content-encoding
gzip
server
nginx
etag
W/"58674312-52b6"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=31536000
x-ac
4.fra _dfw
expires
Sun, 11 Oct 2020 23:12:40 GMT
gprofiles.js
secure.gravatar.com/js/ 		20 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://secure.gravatar.com/js/gprofiles.js?ver=2019Octaa
Requested by
Host: blog.reasonsecurity.com
URL: https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
9c42615b9f87888a452f177c5ea19899fb8a835b8f6d0b458824e6c332a0adce

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 13:42:29 GMT
content-encoding
gzip
last-modified
Thu, 23 Aug 2018 15:01:14 GMT
server
nginx
etag
W/"5b7ecc3a-50bc"
content-type
application/x-javascript
status
200
cache-control
max-age=604800
expires
Wed, 23 Oct 2019 13:42:29 GMT
wpgroho.js
c0.wp.com/p/jetpack/7.8/modules/ 		1 KB
496 B 		Script
General
Check archive.org
Download Go to
Full URL
https://c0.wp.com/p/jetpack/7.8/modules/wpgroho.js
Requested by
Host: blog.reasonsecurity.com
URL: https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
c1cfa5c2bce904bfc524754a954d2e062c703777ab704134dc5f619dca1e40af
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT fra 1
date
Wed, 16 Oct 2019 13:42:29 GMT
content-encoding
br
last-modified
Thu, 04 Apr 2019 21:15:29 GMT
server
nginx
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=31536000
strict-transport-security
max-age=15552000
expires
Thu, 15 Oct 2020 13:42:29 GMT
navigation.js
blog.reasonsecurity.com/wp-content/themes/canard/js/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.reasonsecurity.com/wp-content/themes/canard/js/navigation.js?ver=20150507
Requested by
Host: blog.reasonsecurity.com
URL: https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.215 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
f894c2869399d0d7797c8d525b23411bfd79c18b1f5aa0515503e0ecf5d1f4eb
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 13:42:29 GMT
content-encoding
gzip
last-modified
Sat, 30 Mar 2019 02:05:04 GMT
server
nginx
etag
W/"5c9eced0-b98"
vary
Accept-Encoding
strict-transport-security
max-age=86400
content-type
application/x-javascript
status
200
cache-control
max-age=315360000
x-ac
3.fra _atomic_dca
expires
Thu, 31 Dec 2037 23:55:55 GMT
featured-content.js
blog.reasonsecurity.com/wp-content/themes/canard/js/ 		623 B
364 B 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.reasonsecurity.com/wp-content/themes/canard/js/featured-content.js?ver=20150507
Requested by
Host: blog.reasonsecurity.com
URL: https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.215 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
355f2031a5aec18709225437df181c8c3fee4fd25269083890b1c621f2d3edda
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 13:42:29 GMT
content-encoding
gzip
last-modified
Sat, 30 Mar 2019 02:05:04 GMT
server
nginx
etag
W/"5c9eced0-26f"
vary
Accept-Encoding
strict-transport-security
max-age=86400
content-type
application/x-javascript
status
200
cache-control
max-age=315360000
x-ac
3.fra _atomic_dca
expires
Thu, 31 Dec 2037 23:55:55 GMT
header.js
blog.reasonsecurity.com/wp-content/themes/canard/js/ 		201 B
250 B 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.reasonsecurity.com/wp-content/themes/canard/js/header.js?ver=20150908
Requested by
Host: blog.reasonsecurity.com
URL: https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.215 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
274146c532cb5c18b7d5e35a7cddebe14425fec96010a582232be292c123e7b9
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 13:42:29 GMT
x-ac
3.fra _atomic_dca
last-modified
Sat, 30 Mar 2019 02:05:04 GMT
server
nginx
etag
"5c9eced0-c9"
strict-transport-security
max-age=86400
content-type
application/x-javascript
status
200
cache-control
max-age=315360000
accept-ranges
bytes
content-length
201
expires
Thu, 31 Dec 2037 23:55:55 GMT
search.js
blog.reasonsecurity.com/wp-content/themes/canard/js/ 		1 KB
572 B 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.reasonsecurity.com/wp-content/themes/canard/js/search.js?ver=20150507
Requested by
Host: blog.reasonsecurity.com
URL: https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.215 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
17076feddaacd52d85e994fdfde6f77c2ba32967022da0bb27624b2f85ca2ca0
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 13:42:29 GMT
content-encoding
gzip
last-modified
Sat, 30 Mar 2019 02:05:04 GMT
server
nginx
etag
W/"5c9eced0-5dd"
vary
Accept-Encoding
strict-transport-security
max-age=86400
content-type
application/x-javascript
status
200
cache-control
max-age=315360000
x-ac
3.fra _atomic_dca
expires
Thu, 31 Dec 2037 23:55:55 GMT
single.js
blog.reasonsecurity.com/wp-content/themes/canard/js/ 		1 KB
688 B 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.reasonsecurity.com/wp-content/themes/canard/js/single.js?ver=20150507
Requested by
Host: blog.reasonsecurity.com
URL: https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.215 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
2abeba52ea029b38a97e7e95a6569af6957ce79f91a3683993ea4fb1dc46ac45
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 13:42:29 GMT
content-encoding
gzip
last-modified
Sat, 30 Mar 2019 02:05:04 GMT
server
nginx
etag
W/"5c9eced0-5d1"
vary
Accept-Encoding
strict-transport-security
max-age=86400
content-type
application/x-javascript
status
200
cache-control
max-age=315360000
x-ac
3.fra _atomic_dca
expires
Thu, 31 Dec 2037 23:55:55 GMT
sidebar.js
blog.reasonsecurity.com/wp-content/themes/canard/js/ 		832 B
363 B 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.reasonsecurity.com/wp-content/themes/canard/js/sidebar.js?ver=20150429
Requested by
Host: blog.reasonsecurity.com
URL: https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.215 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
c104e6c684652c9222e7d69d97b87d3064d1057528944479da4839e51e9e9d30
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 13:42:29 GMT
content-encoding
gzip
last-modified
Sat, 30 Mar 2019 02:05:04 GMT
server
nginx
etag
W/"5c9eced0-340"
vary
Accept-Encoding
strict-transport-security
max-age=86400
content-type
application/x-javascript
status
200
cache-control
max-age=315360000
x-ac
3.fra _atomic_dca
expires
Thu, 31 Dec 2037 23:55:55 GMT
skip-link-focus-fix.js
blog.reasonsecurity.com/wp-content/themes/canard/js/ 		751 B
423 B 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.reasonsecurity.com/wp-content/themes/canard/js/skip-link-focus-fix.js?ver=20130115
Requested by
Host: blog.reasonsecurity.com
URL: https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.215 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
5a1a3a3f0ef52a304cde50940ee607a2ebb008b76fa4cf49721b6e5cc07c350a
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 13:42:29 GMT
content-encoding
gzip
last-modified
Sat, 30 Mar 2019 02:05:04 GMT
server
nginx
etag
W/"5c9eced0-2ef"
vary
Accept-Encoding
strict-transport-security
max-age=86400
content-type
application/x-javascript
status
200
cache-control
max-age=315360000
x-ac
3.fra _atomic_dca
expires
Thu, 31 Dec 2037 23:55:55 GMT
comment-reply.min.js
c0.wp.com/c/5.2.4/wp-includes/js/ 		2 KB
1023 B 		Script
General
Check archive.org
Download Go to
Full URL
https://c0.wp.com/c/5.2.4/wp-includes/js/comment-reply.min.js
Requested by
Host: blog.reasonsecurity.com
URL: https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
31cb76c05cbf5d71466f93078e8ba0f6e39cd92d0acc86d385b8cf2899963695
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT fra 1
date
Wed, 16 Oct 2019 13:42:29 GMT
content-encoding
br
last-modified
Tue, 05 Mar 2019 01:52:51 GMT
server
nginx
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=31536000
strict-transport-security
max-age=15552000
expires
Thu, 15 Oct 2020 13:42:29 GMT
facebook-embed.min.js
c0.wp.com/p/jetpack/7.8/_inc/build/ 		622 B
368 B 		Script
General
Check archive.org
Download Go to
Full URL
https://c0.wp.com/p/jetpack/7.8/_inc/build/facebook-embed.min.js
Requested by
Host: blog.reasonsecurity.com
URL: https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
70e6c7d7718e715de38eb98c94c68be796dcbc6f4dc71d467362675529d24746
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT fra 1
date
Wed, 16 Oct 2019 13:42:29 GMT
content-encoding
br
last-modified
Wed, 01 May 2019 01:21:49 GMT
server
nginx
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=31536000
strict-transport-security
max-age=15552000
expires
Thu, 15 Oct 2020 13:42:29 GMT
lazy-images.min.js
c0.wp.com/p/jetpack/7.8/_inc/build/lazy-images/js/ 		9 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c0.wp.com/p/jetpack/7.8/_inc/build/lazy-images/js/lazy-images.min.js
Requested by
Host: blog.reasonsecurity.com
URL: https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
4c2d889ee46270fb2ae51c5ef8804efb7f03b4d5f2ab24a9fdd7a6400f75ea6c
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT fra 1
date
Wed, 16 Oct 2019 13:42:29 GMT
content-encoding
br
last-modified
Fri, 21 Jun 2019 10:15:39 GMT
server
nginx
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=31536000
strict-transport-security
max-age=15552000
expires
Thu, 15 Oct 2020 13:42:29 GMT
queuehandler.min.js
c0.wp.com/p/jetpack/7.8/_inc/build/likes/ 		6 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c0.wp.com/p/jetpack/7.8/_inc/build/likes/queuehandler.min.js
Requested by
Host: blog.reasonsecurity.com
URL: https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
ed9451e768c2d762d3d158e05ebed9bd87cdbf6aeb885b3c55e25e8c909ec6da
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT fra 1
date
Wed, 16 Oct 2019 13:42:29 GMT
content-encoding
br
last-modified
Wed, 01 May 2019 01:21:49 GMT
server
nginx
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=31536000
strict-transport-security
max-age=15552000
expires
Thu, 15 Oct 2020 13:42:29 GMT
wp-embed.min.js
c0.wp.com/c/5.2.4/wp-includes/js/ 		1 KB
690 B 		Script
General
Check archive.org
Download Go to
Full URL
https://c0.wp.com/c/5.2.4/wp-includes/js/wp-embed.min.js
Requested by
Host: blog.reasonsecurity.com
URL: https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
2152557cac69e2bd7d6debef5037a9f554f9209cc305b8141b3329acb10c42b7
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT fra 1
date
Wed, 16 Oct 2019 13:42:29 GMT
content-encoding
br
last-modified
Thu, 30 Aug 2018 12:40:26 GMT
server
nginx
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=31536000
strict-transport-security
max-age=15552000
expires
Thu, 15 Oct 2020 13:42:29 GMT
spin.min.js
c0.wp.com/p/jetpack/7.8/_inc/build/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c0.wp.com/p/jetpack/7.8/_inc/build/spin.min.js
Requested by
Host: blog.reasonsecurity.com
URL: https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
a5307da44321773c9f46b34d756dcbd6cd427238e5cbad91cd2cf151513ec283
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT fra 1
date
Wed, 16 Oct 2019 13:42:29 GMT
content-encoding
br
last-modified
Wed, 01 May 2019 01:21:49 GMT
server
nginx
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=31536000
strict-transport-security
max-age=15552000
expires
Thu, 15 Oct 2020 13:42:29 GMT
jquery.spin.min.js
c0.wp.com/p/jetpack/7.8/_inc/build/ 		2 KB
657 B 		Script
General
Check archive.org
Download Go to
Full URL
https://c0.wp.com/p/jetpack/7.8/_inc/build/jquery.spin.min.js
Requested by
Host: blog.reasonsecurity.com
URL: https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
36ad0edaf88cb19e7cbdae22470c1f124f02fd5673bf6144c0a7a9f0a8fef987
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT fra 1
date
Wed, 16 Oct 2019 13:42:29 GMT
content-encoding
br
last-modified
Wed, 01 May 2019 01:21:49 GMT
server
nginx
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=31536000
strict-transport-security
max-age=15552000
expires
Thu, 15 Oct 2020 13:42:29 GMT
jetpack-carousel.min.js
c0.wp.com/p/jetpack/7.8/_inc/build/carousel/ 		27 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c0.wp.com/p/jetpack/7.8/_inc/build/carousel/jetpack-carousel.min.js
Requested by
Host: blog.reasonsecurity.com
URL: https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
22be3963ed695d5e0ab1ebf21af1d6008bbc4874deee8b7125f3f0f6d6edc460
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT fra 1
date
Wed, 16 Oct 2019 13:42:29 GMT
content-encoding
br
last-modified
Tue, 27 Aug 2019 13:22:22 GMT
server
nginx
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=31536000
strict-transport-security
max-age=15552000
expires
Thu, 15 Oct 2020 13:42:29 GMT
form.js
blog.reasonsecurity.com/wp-content/plugins/akismet/_inc/ 		700 B
394 B 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.reasonsecurity.com/wp-content/plugins/akismet/_inc/form.js?ver=4.1.2
Requested by
Host: blog.reasonsecurity.com
URL: https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.215 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
0515cbd1f8aee97e1c8e0d1d015ca96c86def13e90d2e73bf813072ccc23d531
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 13:42:29 GMT
content-encoding
gzip
last-modified
Wed, 02 Jul 2014 21:14:30 GMT
server
nginx
etag
W/"53b47636-2bc"
vary
Accept-Encoding
strict-transport-security
max-age=86400
content-type
application/x-javascript
status
200
cache-control
max-age=315360000
x-ac
3.fra _atomic_dca
expires
Thu, 31 Dec 2037 23:55:55 GMT
sharing.min.js
c0.wp.com/p/jetpack/7.8/_inc/build/sharedaddy/ 		8 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c0.wp.com/p/jetpack/7.8/_inc/build/sharedaddy/sharing.min.js
Requested by
Host: blog.reasonsecurity.com
URL: https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
1e99034e4b75a1fb7ba372a3a950fa19ff4688d8561479b1a34dfcbde83ff3d8
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT fra 1
date
Wed, 16 Oct 2019 13:42:29 GMT
content-encoding
br
last-modified
Tue, 27 Aug 2019 13:22:22 GMT
server
nginx
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=31536000
strict-transport-security
max-age=15552000
expires
Thu, 15 Oct 2020 13:42:29 GMT
e-201942.js
stats.wp.com/ 		9 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://stats.wp.com/e-201942.js
Requested by
Host: blog.reasonsecurity.com
URL: https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
0ebbc7fba9a50d36ef5422345f624431710db4528f25749d1d438c2c10bb69f2

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 13:42:29 GMT
content-encoding
gzip
server
nginx
etag
W/"5c6340e3-350a"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=31536000
expires
Mon, 12 Oct 2020 05:11:10 GMT
css
fonts.googleapis.com/ 		10 KB
853 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Source+Sans+Pro:r,i,b,bi&subset=latin,latin-ext
Requested by
Host: blog.reasonsecurity.com
URL: https://blog.reasonsecurity.com/wp-content/mu-plugins/wpcomsh/vendor/automattic/custom-fonts/js/webfont.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
ESF /
Resource Hash
de2083cb77cdec9f77b6b61d0c8b7a0ce5ce6423915e9d5a767ad9a1c583319e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Wed, 16 Oct 2019 13:42:29 GMT
server
ESF
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
status
200
date
Wed, 16 Oct 2019 13:42:29 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
x-xss-protection
0
expires
Wed, 16 Oct 2019 13:42:29 GMT
ogf1pww.js
use.typekit.net/ 		18 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://use.typekit.net/ogf1pww.js
Requested by
Host: blog.reasonsecurity.com
URL: https://blog.reasonsecurity.com/wp-content/mu-plugins/wpcomsh/vendor/automattic/custom-fonts/js/webfont.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.100.67.47 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-100-67-47.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
5f6e4b810b35bb95a2cc266c68fccb06d499c811f2b54912073dfaacbaeb0d63
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains;
content-encoding
gzip
server
nginx
status
200
date
Wed, 16 Oct 2019 13:42:29 GMT
vary
Accept-Encoding
content-type
text/javascript;charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=600, stale-while-revalidate=604800
timing-allow-origin
*
content-length
7350
6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7lujVj9w.woff2
fonts.gstatic.com/s/sourcesanspro/v13/ 		13 KB
13 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/sourcesanspro/v13/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7lujVj9w.woff2
Requested by
Host: blog.reasonsecurity.com
URL: https://blog.reasonsecurity.com/wp-content/mu-plugins/wpcomsh/vendor/automattic/custom-fonts/js/webfont.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
ecf76895be1cf9e8b3edb254030e9c9c1d8f3c2efc1f9dc7e04ceff29eccae9c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://fonts.googleapis.com/css?family=Source+Sans+Pro:r,i,b,bi&subset=latin,latin-ext
Origin
https://blog.reasonsecurity.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 10 Oct 2019 01:03:41 GMT
x-content-type-options
nosniff
last-modified
Tue, 23 Jul 2019 03:46:19 GMT
server
sffe
age
563928
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
13324
x-xss-protection
0
expires
Fri, 09 Oct 2020 01:03:41 GMT
6xK1dSBYKcSV-LCoeQqfX1RYOo3qPZ7nsDJB9cme.woff2
fonts.gstatic.com/s/sourcesanspro/v13/ 		12 KB
12 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/sourcesanspro/v13/6xK1dSBYKcSV-LCoeQqfX1RYOo3qPZ7nsDJB9cme.woff2
Requested by
Host: blog.reasonsecurity.com
URL: https://blog.reasonsecurity.com/wp-content/mu-plugins/wpcomsh/vendor/automattic/custom-fonts/js/webfont.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
7cc2c8a7bd96173ee2a862c122630ab8d45ad0676ad2ad60fc55307763782230
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://fonts.googleapis.com/css?family=Source+Sans+Pro:r,i,b,bi&subset=latin,latin-ext
Origin
https://blog.reasonsecurity.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 09 Oct 2019 12:45:24 GMT
x-content-type-options
nosniff
last-modified
Tue, 23 Jul 2019 03:46:00 GMT
server
sffe
age
608225
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
12656
x-xss-protection
0
expires
Thu, 08 Oct 2020 12:45:24 GMT
6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu3cOWxw.woff2
fonts.gstatic.com/s/sourcesanspro/v13/ 		13 KB
13 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/sourcesanspro/v13/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu3cOWxw.woff2
Requested by
Host: blog.reasonsecurity.com
URL: https://blog.reasonsecurity.com/wp-content/mu-plugins/wpcomsh/vendor/automattic/custom-fonts/js/webfont.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
487f2e9da2ff0740755a5ef01dc15a2888b89537795895203a831b13b199d8bb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://fonts.googleapis.com/css?family=Source+Sans+Pro:r,i,b,bi&subset=latin,latin-ext
Origin
https://blog.reasonsecurity.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 11 Oct 2019 07:27:12 GMT
x-content-type-options
nosniff
last-modified
Tue, 23 Jul 2019 03:46:17 GMT
server
sffe
age
454517
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
12976
x-xss-protection
0
expires
Sat, 10 Oct 2020 07:27:12 GMT
6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZclSds18S0xR41.woff2
fonts.gstatic.com/s/sourcesanspro/v13/ 		12 KB
12 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/sourcesanspro/v13/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZclSds18S0xR41.woff2
Requested by
Host: blog.reasonsecurity.com
URL: https://blog.reasonsecurity.com/wp-content/mu-plugins/wpcomsh/vendor/automattic/custom-fonts/js/webfont.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
b90bddaa859eeeff46ee20815774c407611aeb85de431d919cb8e50f18a4d693
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://fonts.googleapis.com/css?family=Source+Sans+Pro:r,i,b,bi&subset=latin,latin-ext
Origin
https://blog.reasonsecurity.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 10 Oct 2019 01:03:31 GMT
x-content-type-options
nosniff
last-modified
Tue, 23 Jul 2019 03:46:18 GMT
server
sffe
age
563938
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
12628
x-xss-protection
0
expires
Fri, 09 Oct 2020 01:03:31 GMT
gtm.js
www.googletagmanager.com/ 		53 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-P9WJTQH
Requested by
Host: blog.reasonsecurity.com
URL: https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:814::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
bd654352c61fd97f536666810741005feb472468382971e9cfaa349d37c0eba2
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 13:42:29 GMT
content-encoding
br
last-modified
Wed, 16 Oct 2019 12:00:00 GMT
server
Google Tag Manager
access-control-allow-headers
Cache-Control
status
200
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
http://www.googletagmanager.com
cache-control
private, max-age=900
access-control-allow-credentials
true
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
20458
x-xss-protection
0
expires
Wed, 16 Oct 2019 13:42:29 GMT
/
jetpack.wordpress.com/jetpack-comment/ Frame 3757 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://jetpack.wordpress.com/jetpack-comment/?blogid=85224909&postid=1969&comment_registration=0&require_name_email=1&stc_enabled=1&stb_enabled=1&show_avatars=1&avatar_default=identicon&greeting=Leave+a+Reply&greeting_reply=Leave+a+Reply+to+%25s&color_scheme=light&lang=en_US&jetpack_version=7.8&show_cookie_consent=10&has_cookie_consent=0&token_key=%3Bnormal%3B&sig=1c46eecda3c4340f5df92ad19a60780d7ba2e734
Requested by
Host: blog.reasonsecurity.com
URL: https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.33 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

:method
GET
:authority
jetpack.wordpress.com
:scheme
https
:path
/jetpack-comment/?blogid=85224909&postid=1969&comment_registration=0&require_name_email=1&stc_enabled=1&stb_enabled=1&show_avatars=1&avatar_default=identicon&greeting=Leave+a+Reply&greeting_reply=Leave+a+Reply+to+%25s&color_scheme=light&lang=en_US&jetpack_version=7.8&show_cookie_consent=10&has_cookie_consent=0&token_key=%3Bnormal%3B&sig=1c46eecda3c4340f5df92ad19a60780d7ba2e734
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/

Response headers

status
200
server
nginx
date
Wed, 16 Oct 2019 13:42:29 GMT
content-type
text/html; charset=UTF-8
vary
Accept-Encoding
x-hacker
If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.
content-encoding
gzip
x-ac
4.fra _dfw
strict-transport-security
max-age=15552000
truncated
/ 		42 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/gif
EJRSQgYoZZY2vCFuvAnt66qSVyvVp8NA.woff2
fonts.gstatic.com/s/ptserif/v11/ 		13 KB
13 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/ptserif/v11/EJRSQgYoZZY2vCFuvAnt66qSVyvVp8NA.woff2
Requested by
Host: blog.reasonsecurity.com
URL: https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
a75a7bf10f415b7c91f0b959177f3f1779e78cbf735601e41fb982c2b1cf4be2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://fonts.googleapis.com/css?family=PT+Serif%3A400%2C700%2C400italic%2C700italic%7CPlayfair+Display%3A400%2C700%2C400italic%2C700italic&subset=cyrillic%2Clatin%2Clatin-ext&ver=5.2.4
Origin
https://blog.reasonsecurity.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 09 Oct 2019 21:52:41 GMT
x-content-type-options
nosniff
last-modified
Mon, 22 Jul 2019 19:24:48 GMT
server
sffe
age
575388
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
13372
x-xss-protection
0
expires
Thu, 08 Oct 2020 21:52:41 GMT
nuFlD-vYSZviVYUb_rj3ij__anPXBYf9lW4e5j5hNKc.woff2
fonts.gstatic.com/s/playfairdisplay/v15/ 		18 KB
18 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/playfairdisplay/v15/nuFlD-vYSZviVYUb_rj3ij__anPXBYf9lW4e5j5hNKc.woff2
Requested by
Host: blog.reasonsecurity.com
URL: https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
ce421cefeba1fd14f39e9baf36f62453dfd1a947bdcb76fc1995ab2b4013b3ad
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://fonts.googleapis.com/css?family=PT+Serif%3A400%2C700%2C400italic%2C700italic%7CPlayfair+Display%3A400%2C700%2C400italic%2C700italic&subset=cyrillic%2Clatin%2Clatin-ext&ver=5.2.4
Origin
https://blog.reasonsecurity.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 11 Oct 2019 03:51:54 GMT
x-content-type-options
nosniff
last-modified
Mon, 22 Jul 2019 19:25:20 GMT
server
sffe
age
467435
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
18436
x-xss-protection
0
expires
Sat, 10 Oct 2020 03:51:54 GMT
S6u9w4BMUTPHh6UVSwiPGQ3q5d0.woff2
fonts.gstatic.com/s/lato/v16/ 		14 KB
14 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/lato/v16/S6u9w4BMUTPHh6UVSwiPGQ3q5d0.woff2
Requested by
Host: blog.reasonsecurity.com
URL: https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
9baad10e85c5be8d5697086479983b6b477197103bf8f0f11817b1bdfb9a7451
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://fonts.googleapis.com/css?family=Lato%3A400%2C700%2C400italic%2C700italic%7CInconsolata%3A400%2C700&subset=latin%2Clatin-ext&ver=5.2.4
Origin
https://blog.reasonsecurity.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 11 Oct 2019 07:22:39 GMT
x-content-type-options
nosniff
last-modified
Tue, 23 Jul 2019 03:45:54 GMT
server
sffe
age
454790
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
14176
x-xss-protection
0
expires
Sat, 10 Oct 2020 07:22:39 GMT
S6uyw4BMUTPHjx4wXiWtFCc.woff2
fonts.gstatic.com/s/lato/v16/ 		14 KB
14 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/lato/v16/S6uyw4BMUTPHjx4wXiWtFCc.woff2
Requested by
Host: blog.reasonsecurity.com
URL: https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
036d841b132c14046e26d8f2da1bc634c6ad34885ed1295660694a91c98933a6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://fonts.googleapis.com/css?family=Lato%3A400%2C700%2C400italic%2C700italic%7CInconsolata%3A400%2C700&subset=latin%2Clatin-ext&ver=5.2.4
Origin
https://blog.reasonsecurity.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 11 Oct 2019 15:38:49 GMT
x-content-type-options
nosniff
last-modified
Tue, 23 Jul 2019 03:45:55 GMT
server
sffe
age
425020
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
14044
x-xss-protection
0
expires
Sat, 10 Oct 2020 15:38:49 GMT
EJRVQgYoZZY2vCFuvAFWzr-_dSb_.woff2
fonts.gstatic.com/s/ptserif/v11/ 		13 KB
13 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/ptserif/v11/EJRVQgYoZZY2vCFuvAFWzr-_dSb_.woff2
Requested by
Host: blog.reasonsecurity.com
URL: https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
6d6cd55572e8be7aa03c122e0ef98bf72d91a2caa2dddfe3c7c5b50f67d2bd07
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://fonts.googleapis.com/css?family=PT+Serif%3A400%2C700%2C400italic%2C700italic%7CPlayfair+Display%3A400%2C700%2C400italic%2C700italic&subset=cyrillic%2Clatin%2Clatin-ext&ver=5.2.4
Origin
https://blog.reasonsecurity.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 11 Oct 2019 09:59:15 GMT
x-content-type-options
nosniff
last-modified
Mon, 22 Jul 2019 19:23:27 GMT
server
sffe
age
445394
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
13280
x-xss-protection
0
expires
Sat, 10 Oct 2020 09:59:15 GMT
truncated
/ 		14 KB
14 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
970a3fa15876d16dcc0fd70eb7c9ab44d733108b3ddca1a449edd0356c1b79a7

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Origin
https://blog.reasonsecurity.com

Response headers

Content-Type
application/x-font-woff;charset=utf-8
widgets.js
platform.twitter.com/ 		95 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/widgets.js
Requested by
Host: blog.reasonsecurity.com
URL: https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (fcn/418A) /
Resource Hash
90476f48e0b8a9f9c5c11fd16f13fc6a8772fe281d12c8e63153a6f948cdd348

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 13:42:30 GMT
Content-Encoding
gzip
Last-Modified
Wed, 02 Oct 2019 20:25:42 GMT
Server
ECS (fcn/418A)
Etag
"1d8d0709ed691e2bc0472dbfc17c8abd+gzip"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Access-Control-Max-Age
3000
Cache-Control
public, max-age=1800
X-Cache
HIT
Content-Type
application/javascript; charset=utf-8
Content-Length
28700
sdk.js
connect.facebook.net/en_US/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/sdk.js
Requested by
Host: blog.reasonsecurity.com
URL: https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
ade772bfff1536353b5e2066dbd77cb756e588b4f45d97d5b8871efefb0b9d4e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
content-md5
KiRqEI1rxCDD49WyGr5ScQ==
status
200
content-length
1780
etag
"57ce0431c02943647d9bff5751d992f0"
x-fb-debug
YPU2D/Unp795bMoGQqBX0OgC94zEnydoK8mvWxD+S7qiZwRBLiOIoLm8P+pqnuL7uZjPJmzea5PuruwL2UIHdA==
x-fb-trip-id
136226023
x-fb-content-md5
e29f0b8538b80c5481b7c9d38dc6494d
x-frame-options
DENY
date
Wed, 16 Oct 2019 13:42:29 GMT
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
X-FB-Content-MD5
cache-control
public,max-age=1200,stale-while-revalidate=3600
timing-allow-origin
*
expires
Wed, 16 Oct 2019 13:57:18 GMT
EJRQQgYoZZY2vCFuvAFT9gaQZynfoOFC-I0.woff2
fonts.gstatic.com/s/ptserif/v11/ 		14 KB
14 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/ptserif/v11/EJRQQgYoZZY2vCFuvAFT9gaQZynfoOFC-I0.woff2
Requested by
Host: blog.reasonsecurity.com
URL: https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
3fc454bd834310f44cb73b3378d6c265b59b1e0065e6e7f77f25d7449bcb95b2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://fonts.googleapis.com/css?family=PT+Serif%3A400%2C700%2C400italic%2C700italic%7CPlayfair+Display%3A400%2C700%2C400italic%2C700italic&subset=cyrillic%2Clatin%2Clatin-ext&ver=5.2.4
Origin
https://blog.reasonsecurity.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 14 Oct 2019 14:42:20 GMT
x-content-type-options
nosniff
last-modified
Mon, 22 Jul 2019 19:22:45 GMT
server
sffe
age
169209
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
14016
x-xss-protection
0
expires
Tue, 13 Oct 2020 14:42:20 GMT
EJRTQgYoZZY2vCFuvAFT_r21cgT9rcs.woff2
fonts.gstatic.com/s/ptserif/v11/ 		14 KB
14 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/ptserif/v11/EJRTQgYoZZY2vCFuvAFT_r21cgT9rcs.woff2
Requested by
Host: blog.reasonsecurity.com
URL: https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
d3b9ac60281114eb252c949187818336066886576d5fc78f31cc8c4c2d94531f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://fonts.googleapis.com/css?family=PT+Serif%3A400%2C700%2C400italic%2C700italic%7CPlayfair+Display%3A400%2C700%2C400italic%2C700italic&subset=cyrillic%2Clatin%2Clatin-ext&ver=5.2.4
Origin
https://blog.reasonsecurity.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 09 Oct 2019 21:56:26 GMT
x-content-type-options
nosniff
last-modified
Mon, 22 Jul 2019 19:24:32 GMT
server
sffe
age
575163
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
14020
x-xss-protection
0
expires
Thu, 08 Oct 2020 21:56:26 GMT
sdk.js
connect.facebook.net/en_US/ 		194 KB
58 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/sdk.js?hash=2c93217db987a2d85c29d46b6bb1d193&ua=modern_es6
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
6ec51f37e85696c857c6a9357dd8c4c1802eccdb2b601ef1bcf3c4bf3ba77060
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Sec-Fetch-Mode
cors
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
Origin
https://blog.reasonsecurity.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
content-md5
tjcFGNZL+F1B0lWf4zjlGg==
status
200
content-length
59080
etag
"1c65ac03bf66941db47b5d673f8a31d1"
x-fb-debug
zW9yZJMqVdhZINeTMFr8jZaM34lC4ecR3Kaaze9IvAJQaUehsizS4nAVuTlwToGV+ibDlBeFn717Gx/7yxRriw==
x-fb-trip-id
136226023
x-fb-content-md5
749bb012f544919b4459770f89de66ef
x-frame-options
DENY
date
Wed, 16 Oct 2019 13:42:29 GMT
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
X-FB-Content-MD5
cache-control
public,max-age=31536000,stale-while-revalidate=3600,immutable
timing-allow-origin
*
expires
Thu, 15 Oct 2020 12:25:54 GMT
analytics.js
www.google-analytics.com/ 		43 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-P9WJTQH
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:815::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 19 Aug 2019 17:22:41 GMT
server
Golfe2
age
6499
date
Wed, 16 Oct 2019 11:54:10 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
17803
expires
Wed, 16 Oct 2019 13:54:10 GMT
pixel.js
cdn.popt.in/ 		145 KB
26 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.popt.in/pixel.js?id=a252df1aa5cae
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-P9WJTQH
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::681f:4fd3 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
f43390f54ad15411ce1690209a8655bafea9db77e1621eb9aed24924c7cfef63

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 13:42:29 GMT
via
1.1 7b574fc6db5d0840d90b97dd76cc56ec.cloudfront.net (CloudFront)
cf-cache-status
HIT
age
2617
x-cache
Hit from cloudfront
status
200
content-encoding
br
x-amz-version-id
0YYD2P5D68T_pXwv5Gt0_fu6ZvNpP1gq
last-modified
Tue, 15 Oct 2019 13:17:44 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
x-amz-cf-pop
VIE50-C1
cf-ray
526a74d3ff1259dc-VIE
x-amz-cf-id
XQvTyDiIzGfOGEjntPB8mSDH-7nIf7j8bFk-6s2WOkhqS5FvTCxHPw==
xd_arbiter.php
staticxx.facebook.com/connect/ Frame 2127 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://staticxx.facebook.com/connect/xd_arbiter.php?version=44
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js?hash=2c93217db987a2d85c29d46b6bb1d193&ua=modern_es6
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
staticxx.facebook.com
:scheme
https
:path
/connect/xd_arbiter.php?version=44
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/

Response headers

status
200
content-encoding
br
content-type
text/html; charset=utf-8
strict-transport-security
max-age=15552000; preload
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
expires
Thu, 15 Oct 2020 07:49:29 GMT
cache-control
public,max-age=31536000,immutable
x-fb-debug
JX+QPMawCZOIVsrJAmAKO8SJfnRK/7Hfyi2O+j3HfsBwB7RfBj7fDc21qNPp0nCMJu46Xvv71kt8B203URrc4Q==
content-length
11593
x-fb-trip-id
136226023
date
Wed, 16 Oct 2019 13:42:29 GMT
collect
www.google-analytics.com/r/ 		35 B
111 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/r/collect?v=1&_v=j79&a=526513161&t=pageview&_s=1&dl=https%3A%2F%2Fblog.reasonsecurity.com%2F2019%2F10%2F15%2Fthreat-analysis-report-save-yourself-malware%2F&ul=en-us&de=UTF-8&dt=Threat%20Analysis%20Report%3A%20Save%20Yourself%20Malware%20%E2%80%93%20Blog%3A%20Reason%20Cyber%20Security%20%E2%80%93%20antivirus%20software&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=YEBAAEAB~&jid=1625095818&gjid=1807705895&cid=800566133.1571233350&tid=UA-128871879-3&_gid=880377514.1571233350&_r=1&gtm=2wga21P9WJTQH&z=77068703
Requested by
Host: blog.reasonsecurity.com
URL: https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:815::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 16 Oct 2019 13:42:29 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
status
200
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/2.2.4/ 		84 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
Requested by
Host: cdn.popt.in
URL: https://cdn.popt.in/pixel.js?id=a252df1aa5cae
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 11 Oct 2019 16:01:03 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
423686
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
30028
x-xss-protection
0
last-modified
Tue, 20 Dec 2016 18:17:03 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 10 Oct 2020 16:01:03 GMT
share_button.php
www.facebook.com/v2.3/plugins/ Frame 1CC7 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://www.facebook.com/v2.3/plugins/share_button.php?app_id=249643311490&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fconnect%2Fxd_arbiter.php%3Fversion%3D44%23cb%3Df9de19684b983%26domain%3Dblog.reasonsecurity.com%26origin%3Dhttps%253A%252F%252Fblog.reasonsecurity.com%252Ff2aded51d404e2%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Fblog.reasonsecurity.com%2F2019%2F10%2F15%2Fthreat-analysis-report-save-yourself-malware%2F&layout=button_count&locale=en_US&sdk=joey
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js?hash=2c93217db987a2d85c29d46b6bb1d193&ua=modern_es6
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
www.facebook.com
:scheme
https
:path
/v2.3/plugins/share_button.php?app_id=249643311490&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fconnect%2Fxd_arbiter.php%3Fversion%3D44%23cb%3Df9de19684b983%26domain%3Dblog.reasonsecurity.com%26origin%3Dhttps%253A%252F%252Fblog.reasonsecurity.com%252Ff2aded51d404e2%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Fblog.reasonsecurity.com%2F2019%2F10%2F15%2Fthreat-analysis-report-save-yourself-malware%2F&layout=button_count&locale=en_US&sdk=joey
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/

Response headers

status
200
cache-control
private, no-cache, no-store, must-revalidate
expires
Sat, 01 Jan 2000 00:00:00 GMT
pragma
no-cache
strict-transport-security
max-age=15552000; preload
content-encoding
br
timing-allow-origin
*
content-security-policy
default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
vary
Accept-Encoding
x-content-type-options
nosniff
facebook-api-version
v2.10
x-xss-protection
0
content-type
text/html; charset="utf-8"
x-fb-debug
neEuLGugTcmZp2/aZk/q1Ro1+KgI0GrVsQDwwWxyFfJcoDMoYhUlNbpyZoFW7w+LM9m+WA6qZbrRplqBLncuGg==
date
Wed, 16 Oct 2019 13:42:29 GMT
page.php
www.facebook.com/v2.3/plugins/ Frame AF29 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://www.facebook.com/v2.3/plugins/page.php?app_id=249643311490&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fconnect%2Fxd_arbiter.php%3Fversion%3D44%23cb%3Df221378fb07cbe%26domain%3Dblog.reasonsecurity.com%26origin%3Dhttps%253A%252F%252Fblog.reasonsecurity.com%252Ff2aded51d404e2%26relation%3Dparent.parent&container_width=300&height=1200&hide_cover=false&href=https%3A%2F%2Fwww.facebook.com%2Fpages%2FReason-Core-Security%2F792262430823085&locale=en_US&sdk=joey&show_facepile=true&show_posts=true&width=300
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js?hash=2c93217db987a2d85c29d46b6bb1d193&ua=modern_es6
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
www.facebook.com
:scheme
https
:path
/v2.3/plugins/page.php?app_id=249643311490&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fconnect%2Fxd_arbiter.php%3Fversion%3D44%23cb%3Df221378fb07cbe%26domain%3Dblog.reasonsecurity.com%26origin%3Dhttps%253A%252F%252Fblog.reasonsecurity.com%252Ff2aded51d404e2%26relation%3Dparent.parent&container_width=300&height=1200&hide_cover=false&href=https%3A%2F%2Fwww.facebook.com%2Fpages%2FReason-Core-Security%2F792262430823085&locale=en_US&sdk=joey&show_facepile=true&show_posts=true&width=300
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/

Response headers

status
200
cache-control
private, no-cache, no-store, must-revalidate
expires
Sat, 01 Jan 2000 00:00:00 GMT
pragma
no-cache
strict-transport-security
max-age=15552000; preload
content-encoding
br
timing-allow-origin
*
content-security-policy
default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
vary
Accept-Encoding
x-content-type-options
nosniff
facebook-api-version
v2.10
x-xss-protection
0
content-type
text/html; charset="utf-8"
x-fb-debug
jyioOX+EAUZg2R4N1LyELZs04WQWM1DAbpwh5i70Ijd/NX+D/ucoIIT9VfMiUbc986odOlCBGXzyhh2t6xyGRw==
date
Wed, 16 Oct 2019 13:42:30 GMT
a252df1aa5cae
display.popt.in/APIRequest/ 		1 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://display.popt.in/APIRequest/a252df1aa5cae?domain=https%3A%2F%2Fblog.reasonsecurity.com%2F2019%2F10%2F15%2Fthreat-analysis-report-save-yourself-malware%2F&referrer=&cookies=+poptin_old_user%3Dtrue+poptin_user_id%3D0.4kvunqbmc7s+poptin_referrer%3D+poptin_new_user%3Dtrue+poptin_viewed_session%3Dfalse&triggers=&cc=false&if_mobile=false&page_title=Threat+Analysis+Report%3A+Save+Yourself+Malware+%E2%80%93+Blog%3A+Reason+Cyber+Security+%E2%80%93+antivirus+software&origin_landing_page=https%3A%2F%2Fblog.reasonsecurity.com%2F2019%2F10%2F15%2Fthreat-analysis-report-save-yourself-malware%2F
Requested by
Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::681f:4fd3 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b35d826d929ec151697514cd4cb87a079589741867639051236b8a382e658ad2

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Wed, 16 Oct 2019 13:42:30 GMT
content-encoding
br
cf-cache-status
DYNAMIC
server
cloudflare
status
200
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
cache-control
no-cache
access-control-allow-credentials
true
cf-ray
526a74d4be18cbc8-VIE
access-control-allow-headers
Origin, Content-Type
l
use.typekit.net/af/333a5f/0000000000000000000132db/27/ 		22 KB
22 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://use.typekit.net/af/333a5f/0000000000000000000132db/27/l?subset_id=2&fvd=n1&v=3
Requested by
Host: use.typekit.net
URL: https://use.typekit.net/ogf1pww.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.100.67.47 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-100-67-47.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
7fb6f61a4321cc230f63a0388084753316e3a70ab90ecbf208c2c7a136f97320

Request headers

Sec-Fetch-Mode
cors
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
Origin
https://blog.reasonsecurity.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 13:42:29 GMT
server
nginx
etag
"c38a4b128d0c014d8acbfdaf0d3a859888cec37d"
status
200
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
timing-allow-origin
*
content-length
22228
master.html
widgets.wp.com/likes/ Frame 2504 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://widgets.wp.com/likes/master.html?ver=201942
Requested by
Host: blog.reasonsecurity.com
URL: https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash

Request headers

:method
GET
:authority
widgets.wp.com
:scheme
https
:path
/likes/master.html?ver=201942
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/

Response headers

status
200
server
nginx
date
Wed, 16 Oct 2019 13:42:29 GMT
content-type
text/html
last-modified
Thu, 21 Mar 2019 13:37:08 GMT
vary
Accept-Encoding
etag
W/"5c939384-84e"
content-encoding
gzip
x-ac
4.fra _dfw
x-nc
HIT fra 2
hovercard.min.css
secure.gravatar.com/dist/css/ 		7 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://secure.gravatar.com/dist/css/hovercard.min.css?ver=2019Octaa
Requested by
Host: c0.wp.com
URL: https://c0.wp.com/c/5.2.4/wp-includes/js/jquery/jquery.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
7b5e32cb325e9aaef357a421cd16ddf6d6ddb70fec74b6c35a73eccc6817664c

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 13:42:29 GMT
content-encoding
gzip
last-modified
Thu, 22 Mar 2018 09:46:04 GMT
server
nginx
etag
W/"5ab37b5c-1a2e"
content-type
text/css
status
200
cache-control
max-age=604800
expires
Wed, 23 Oct 2019 13:42:29 GMT
services.min.css
secure.gravatar.com/dist/css/ 		3 KB
564 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://secure.gravatar.com/dist/css/services.min.css?ver=2019Octaa
Requested by
Host: c0.wp.com
URL: https://c0.wp.com/c/5.2.4/wp-includes/js/jquery/jquery.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
e9fc9b1878db1b13b973252b048d19a17abb34a8da464a552c6d401728ed1e86

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 13:42:29 GMT
content-encoding
gzip
last-modified
Thu, 22 Mar 2018 09:46:04 GMT
server
nginx
etag
W/"5ab37b5c-a54"
content-type
text/css
status
200
cache-control
max-age=604800
expires
Wed, 23 Oct 2019 13:42:29 GMT
widget_iframe.e3a0e1b01ae601b6c9cf798a93ab7e69.html
platform.twitter.com/widgets/ Frame 9F4A 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/widgets/widget_iframe.e3a0e1b01ae601b6c9cf798a93ab7e69.html?origin=https%3A%2F%2Fblog.reasonsecurity.com
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (fcn/419C) /
Resource Hash

Request headers

Host
platform.twitter.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
cross-site
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/

Response headers

Content-Encoding
gzip
Access-Control-Allow-Methods
GET
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
Content-Type
text/html; charset=utf-8
Date
Wed, 16 Oct 2019 13:42:29 GMT
Etag
"7d3f6ed140174a20e7c8be261a70a863+gzip"
Last-Modified
Wed, 02 Oct 2019 20:21:47 GMT
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server
ECS (fcn/419C)
Vary
Accept-Encoding
X-Cache
HIT
Content-Length
5816
g.gif
pixel.wp.com/ 		50 B
92 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.wp.com/g.gif?v=ext&j=1%3A7.8&blog=85224909&post=1969&tz=0&srv=blog.reasonsecurity.com&host=blog.reasonsecurity.com&ref=&fcp=879&rand=0.4343068176860927
Requested by
Host: blog.reasonsecurity.com
URL: https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
200
date
Wed, 16 Oct 2019 13:42:29 GMT
cache-control
no-cache
server
nginx
content-length
50
content-type
image/gif
p.gif
p.typekit.net/ 		35 B
201 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://p.typekit.net/p.gif?s=1&k=ogf1pww&ht=tk&h=blog.reasonsecurity.com&f=10298&a=418219&js=1.19.2&app=typekit&e=js&_=1571233349890
Requested by
Host: blog.reasonsecurity.com
URL: https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.100.67.47 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-100-67-47.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
9b9265c69a5cc295d1ab0d04e0273b3677db1a6216ce2ccf4efc8c277ed84b39

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 13:42:29 GMT
last-modified
Mon, 04 Feb 2019 21:28:53 GMT
server
nginx
etag
"5c58ae95-23"
status
200
content-type
image/gif
access-control-allow-origin
*
cache-control
max-age=604800
accept-ranges
bytes
content-length
35
expires
Mon, 19 Aug 2019 11:43:27 GMT
button.d941c9a422e2e3faf474b82a1f39e936.js
platform.twitter.com/js/ 		7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/js/button.d941c9a422e2e3faf474b82a1f39e936.js
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (fcn/40D4) /
Resource Hash
a05cb65ecfe9bb5ef6968b5cc9099d50cd8401c1aa73df4c214fee47018c4d12

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 13:42:16 GMT
Content-Encoding
gzip
Last-Modified
Wed, 02 Oct 2019 20:21:39 GMT
Server
ECS (fcn/40D4)
Etag
"89c7a09d87bdc0f1b87105d8f841b83e+gzip"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
X-Cache
HIT
Content-Type
application/javascript; charset=utf-8
Content-Length
2296
tweet_button.e3a0e1b01ae601b6c9cf798a93ab7e69.en.html
platform.twitter.com/widgets/ Frame 1F1B 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/widgets/tweet_button.e3a0e1b01ae601b6c9cf798a93ab7e69.en.html
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (fcn/40E9) /
Resource Hash

Request headers

Host
platform.twitter.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
cross-site
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/

Response headers

Content-Encoding
gzip
Access-Control-Allow-Methods
GET
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
Content-Type
text/html; charset=utf-8
Date
Wed, 16 Oct 2019 13:42:29 GMT
Etag
"8833bacdfba50183c7498773301909d4+gzip"
Last-Modified
Wed, 02 Oct 2019 20:21:44 GMT
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server
ECS (fcn/40E9)
Vary
Accept-Encoding
X-Cache
HIT
Content-Length
12257
jot
syndication.twitter.com/i/ 		43 B
338 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://syndication.twitter.com/i/jot?l=%7B%22widget_origin%22%3A%22https%3A%2F%2Fblog.reasonsecurity.com%2F2019%2F10%2F15%2Fthreat-analysis-report-save-yourself-malware%2F%22%2C%22widget_frame%22%3Afalse%2C%22language%22%3A%22en%22%2C%22message%22%3A%22m%3Anocount%3A%22%2C%22_category_%22%3A%22tfw_client_event%22%2C%22triggered_on%22%3A1571233350098%2C%22dnt%22%3Afalse%2C%22client_version%22%3A%22708eecd%3A1570046592825%22%2C%22format_version%22%3A1%2C%22event_namespace%22%3A%7B%22client%22%3A%22tfw%22%2C%22page%22%3A%22button%22%2C%22section%22%3A%22share%22%2C%22action%22%3A%22impression%22%7D%7D
Requested by
Host: blog.reasonsecurity.com
URL: https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.42.8 , United States, ASN13414 (TWITTER - Twitter Inc., US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 13:42:30 GMT
content-encoding
gzip
x-content-type-options
nosniff
status
200, 200 OK
x-twitter-response-tags
BouncerCompliant
content-length
65
x-xss-protection
0
x-response-time
127
pragma
no-cache
last-modified
Wed, 16 Oct 2019 13:42:30 GMT
server
tsa_o
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=631138519
content-type
image/gif;charset=utf-8
cache-control
no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash
7be72cdd54cdabe7858e54cfa9e52b4e
x-transaction
0005e376007bb829
expires
Tue, 31 Mar 1981 05:00:00 GMT
tweet_button.e3a0e1b01ae601b6c9cf798a93ab7e69.en.html
platform.twitter.com/widgets/ Frame 56F1 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/widgets/tweet_button.e3a0e1b01ae601b6c9cf798a93ab7e69.en.html
Requested by
Host: c0.wp.com
URL: https://c0.wp.com/c/5.2.4/wp-includes/js/jquery/jquery.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (fcn/4191) /
Resource Hash

Request headers

Host
platform.twitter.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
cross-site
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/

Response headers

Content-Encoding
gzip
Access-Control-Allow-Methods
GET
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
Content-Type
text/html; charset=utf-8
Date
Wed, 16 Oct 2019 13:42:30 GMT
Etag
"8833bacdfba50183c7498773301909d4+gzip"
Last-Modified
Wed, 02 Oct 2019 20:21:44 GMT
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server
ECS (fcn/4191)
Vary
Accept-Encoding
X-Cache
HIT
Content-Length
12257
share_button.php
www.facebook.com/v2.3/plugins/ Frame C706 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://www.facebook.com/v2.3/plugins/share_button.php?app_id=249643311490&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fconnect%2Fxd_arbiter.php%3Fversion%3D44%23cb%3Df9de19684b983%26domain%3Dblog.reasonsecurity.com%26origin%3Dhttps%253A%252F%252Fblog.reasonsecurity.com%252Ff2aded51d404e2%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Fblog.reasonsecurity.com%2F2019%2F10%2F15%2Fthreat-analysis-report-save-yourself-malware%2F&layout=button_count&locale=en_US&sdk=joey
Requested by
Host: c0.wp.com
URL: https://c0.wp.com/c/5.2.4/wp-includes/js/jquery/jquery.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
www.facebook.com
:scheme
https
:path
/v2.3/plugins/share_button.php?app_id=249643311490&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fconnect%2Fxd_arbiter.php%3Fversion%3D44%23cb%3Df9de19684b983%26domain%3Dblog.reasonsecurity.com%26origin%3Dhttps%253A%252F%252Fblog.reasonsecurity.com%252Ff2aded51d404e2%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Fblog.reasonsecurity.com%2F2019%2F10%2F15%2Fthreat-analysis-report-save-yourself-malware%2F&layout=button_count&locale=en_US&sdk=joey
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/

Response headers

status
200
cache-control
private, no-cache, no-store, must-revalidate
expires
Sat, 01 Jan 2000 00:00:00 GMT
pragma
no-cache
strict-transport-security
max-age=15552000; preload
content-encoding
br
timing-allow-origin
*
content-security-policy
default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
vary
Accept-Encoding
x-content-type-options
nosniff
facebook-api-version
v2.10
x-xss-protection
0
content-type
text/html; charset="utf-8"
x-fb-debug
NbNfka9Df2/SmJBXXjmn+dQ1Qs4POMRs+m9qDAfrKFxLw+JkUgySb09b8Lh4joTS8E7NxPhnWvfIdrgPKT6DAQ==
date
Wed, 16 Oct 2019 13:42:30 GMT
page.php
www.facebook.com/v2.3/plugins/ Frame 8A8C 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://www.facebook.com/v2.3/plugins/page.php?app_id=249643311490&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fconnect%2Fxd_arbiter.php%3Fversion%3D44%23cb%3Df2710e338961f%26domain%3Dblog.reasonsecurity.com%26origin%3Dhttps%253A%252F%252Fblog.reasonsecurity.com%252Ff2aded51d404e2%26relation%3Dparent.parent&container_width=0&height=1200&hide_cover=false&href=https%3A%2F%2Fwww.facebook.com%2Fpages%2FReason-Core-Security%2F792262430823085&locale=en_US&sdk=joey&show_facepile=true&show_posts=true&width=300
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js?hash=2c93217db987a2d85c29d46b6bb1d193&ua=modern_es6
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
www.facebook.com
:scheme
https
:path
/v2.3/plugins/page.php?app_id=249643311490&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fconnect%2Fxd_arbiter.php%3Fversion%3D44%23cb%3Df2710e338961f%26domain%3Dblog.reasonsecurity.com%26origin%3Dhttps%253A%252F%252Fblog.reasonsecurity.com%252Ff2aded51d404e2%26relation%3Dparent.parent&container_width=0&height=1200&hide_cover=false&href=https%3A%2F%2Fwww.facebook.com%2Fpages%2FReason-Core-Security%2F792262430823085&locale=en_US&sdk=joey&show_facepile=true&show_posts=true&width=300
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/

Response headers

status
200
cache-control
private, no-cache, no-store, must-revalidate
expires
Sat, 01 Jan 2000 00:00:00 GMT
pragma
no-cache
strict-transport-security
max-age=15552000; preload
content-encoding
br
timing-allow-origin
*
content-security-policy
default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
vary
Accept-Encoding
x-content-type-options
nosniff
facebook-api-version
v2.10
x-xss-protection
0
content-type
text/html; charset="utf-8"
x-fb-debug
AIvAuw6BDzl3FJJgrwV0PRn4W5xWYelDBraWEAsMIe8qFTasMmqR10nl1SEWbY4UvfDBKjcSQajdPRIVD94apQ==
date
Wed, 16 Oct 2019 13:42:30 GMT
/
widgets.wp.com/likes/ Frame 97CB 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://widgets.wp.com/likes/
Requested by
Host: c0.wp.com
URL: https://c0.wp.com/c/5.2.4/wp-includes/js/jquery/jquery.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash

Request headers

:method
GET
:authority
widgets.wp.com
:scheme
https
:path
/likes/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/

Response headers

status
200
server
nginx
date
Wed, 16 Oct 2019 13:42:30 GMT
content-type
text/html
content-length
126
last-modified
Sat, 23 Dec 2017 00:24:47 GMT
etag
"5a3da24f-7e"
x-ac
4.fra _dfw
x-nc
HIT fra 2
accept-ranges
bytes
account_cdea13aa402a5_poptin_04b7bb515edde_2019-07-02_22-46-05_version_2.html
d3lopmpcew67el.cloudfront.net/client_a252df1aa5cae/ 		185 KB
137 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://d3lopmpcew67el.cloudfront.net/client_a252df1aa5cae/account_cdea13aa402a5_poptin_04b7bb515edde_2019-07-02_22-46-05_version_2.html
Requested by
Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20eb:4a00:b:8c20:bf40:21 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
62833d619119b5dcecafb014f7ce132fdf3227b0b3640967bf7c9a979e3112e5

Request headers

Accept
*/*
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Wed, 16 Oct 2019 13:42:32 GMT
content-encoding
gzip
last-modified
Tue, 02 Jul 2019 19:59:21 GMT
server
AmazonS3
x-amz-cf-pop
FRA2-C1
status
200
vary
Accept-Encoding
access-control-allow-methods
GET
x-amz-version-id
nfLJrXUQZt2JWwNL3TfzN5iHdvpLWF0A
access-control-allow-origin
*
access-control-max-age
3000
x-cache
Miss from cloudfront
content-type
text/html
x-amz-cf-id
zZWCodvuSj2X_4hVsR03LdcuHGVRCcU3MpCH7VJ3POrR0krcwVsREw==
via
1.1 96283be49fd5bce30b3a0e9559bd2d9e.cloudfront.net (CloudFront)
account_cdea13aa402a5_poptin_8b75c445bfd43_2019-07-21_14-26-47_version_1.html
d3lopmpcew67el.cloudfront.net/client_a252df1aa5cae/ 		26 KB
16 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://d3lopmpcew67el.cloudfront.net/client_a252df1aa5cae/account_cdea13aa402a5_poptin_8b75c445bfd43_2019-07-21_14-26-47_version_1.html
Requested by
Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20eb:4a00:b:8c20:bf40:21 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
7f7728c1dc5b5a7bc97e9570d1409d092a9838160af55be74caa0ef22608036b

Request headers

Accept
*/*
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Wed, 16 Oct 2019 13:42:32 GMT
content-encoding
gzip
last-modified
Sun, 21 Jul 2019 11:27:06 GMT
server
AmazonS3
x-amz-cf-pop
FRA2-C1
status
200
vary
Accept-Encoding
access-control-allow-methods
GET
x-amz-version-id
OBJ._4hsl2mLZiNmSRNVFZB3eWQgRIu6
access-control-allow-origin
*
access-control-max-age
3000
x-cache
Miss from cloudfront
content-type
text/html
x-amz-cf-id
1hRsIeVYUSv656_lF7ZJoyHjghRNHxGZgWLTtY1AYmdU2ou393R0oQ==
via
1.1 96283be49fd5bce30b3a0e9559bd2d9e.cloudfront.net (CloudFront)
account_cdea13aa402a5_poptin_d1c51e59b9aad_2019-07-01_14-08-45_version_3.html
d3lopmpcew67el.cloudfront.net/client_a252df1aa5cae/ 		4 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://d3lopmpcew67el.cloudfront.net/client_a252df1aa5cae/account_cdea13aa402a5_poptin_d1c51e59b9aad_2019-07-01_14-08-45_version_3.html
Requested by
Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20eb:4a00:b:8c20:bf40:21 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
9ff00bf699b8a32464b1fe9c811cf529781f92fe86bd1899bebf8a0a956b1f6b

Request headers

Accept
*/*
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Wed, 16 Oct 2019 13:42:32 GMT
content-encoding
gzip
last-modified
Mon, 01 Jul 2019 12:06:39 GMT
server
AmazonS3
x-amz-cf-pop
FRA2-C1
status
200
vary
Accept-Encoding
access-control-allow-methods
GET
x-amz-version-id
gW7Nt8jo2.d3fl_vXNhv9VoxsZ1Y.27T
access-control-allow-origin
*
access-control-max-age
3000
x-cache
Miss from cloudfront
content-type
text/html
x-amz-cf-id
iuWMQTjBjtWEe6GknCkvuWRsPxrX9sdzdnBa-LKQ0OeCZtgmisg9dw==
via
1.1 96283be49fd5bce30b3a0e9559bd2d9e.cloudfront.net (CloudFront)
account_cdea13aa402a5_poptin_e151d6562fba5_2019-07-14_19-40-01_version_10.html
d3lopmpcew67el.cloudfront.net/client_a252df1aa5cae/ 		46 KB
16 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://d3lopmpcew67el.cloudfront.net/client_a252df1aa5cae/account_cdea13aa402a5_poptin_e151d6562fba5_2019-07-14_19-40-01_version_10.html
Requested by
Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20eb:4a00:b:8c20:bf40:21 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
9a0ed35e909a86face7e3a00933bdbba5a55f5f221a69a40bd58936c64c6f461

Request headers

Accept
*/*
Referer
https://blog.reasonsecurity.com/2019/10/15/threat-analysis-report-save-yourself-malware/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Wed, 16 Oct 2019 13:42:32 GMT
content-encoding
gzip
last-modified
Thu, 25 Jul 2019 13:57:36 GMT
server
AmazonS3
x-amz-cf-pop
FRA2-C1
status
200
vary
Accept-Encoding
access-control-allow-methods
GET
x-amz-version-id
uyhmEeldYctIVjpnnhckx_ioXez58UBN
access-control-allow-origin
*
access-control-max-age
3000
x-cache
Miss from cloudfront
content-type
text/html
x-amz-cf-id
TVHvUGF4jOF_xaXLh6iCqgUDa1j36n43ckEJ18EJEw6ARtP9iuekEA==
via
1.1 96283be49fd5bce30b3a0e9559bd2d9e.cloudfront.net (CloudFront)

Verdicts & Comments Add Verdict or Comment

327 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate object| WebFontConfig string| gtm4wp_datalayer_name object| dataLayer object| _wpemojiSettings object| WebFont object| twemoji object| wp undefined| $ function| jQuery object| NO_JQUERY function| pm object| Jetpack object| dataLayer_content object| core object| __core-js_shared__ function| setImmediate function| clearImmediate object| regeneratorRuntime boolean| _babelPolyfill object| FB object| wpcom_img_zoomer object| detectZoom object| __twttrll object| twttr object| __twttr function| hex_md5 function| b64_md5 function| str_md5 function| hex_hmac_md5 function| b64_hmac_md5 function| str_hmac_md5 function| md5_vm_test function| core_md5 function| md5_cmn function| md5_ff function| md5_gg function| md5_hh function| md5_ii function| core_hmac_md5 function| safe_add function| bit_rol function| str2binl function| binl2str function| binl2hex function| binl2b64 object| Gravatar object| GProfile number| hexcase string| b64pad number| chrsz object| WPGroHo object| google_tag_manager string| GoogleAnalyticsObject function| ga object| google_tag_data object| gaplugins object| gaGlobal object| gaData object| query_string string| api_link string| cdn_server string| env string| css_link string| poptin_il_url string| poptin_com_url undefined| poptin string| html_poptin_x_button string| html_poptin_skip_button string| html_button_note string| html_credit number| screen_width number| screen_height number| litghtbox_poptin_width number| litghtbox_poptin_height number| bar_poptin_width number| bar_poptin_height number| bar_poptin_height_2 number| bar_poptin_height_4 number| bar_poptin_height_5 number| browsing_poptin_width number| browsing_poptin_height number| sside_poptin_width number| sside_poptin_width_2 number| sside_poptin_height number| sside_poptin_width_4 number| sside_poptin_height_4 number| bside_poptin_width number| bside_poptin_height number| fullpage_poptin_width number| fullpage_poptin_height number| fullpage_poptin_width_2 number| fullpage_poptin_height_2 number| mobile_poptin_width number| mobile_poptin_height number| mobile_poptin_width_2 number| mobile_poptin_height_2 number| mobile_poptin_height_4 number| mobile_poptin_height_5 number| social_poptin_height number| social_poptin_width number| social_poptin_height_2 number| social_poptin_width_2 number| social_poptin_height_3 number| social_poptin_width_3 number| social_poptin_height_4 number| social_poptin_width_4 number| embedded_poptin_width_1 number| embedded_poptin_height_1 number| embedded_poptin_width_2 number| embedded_poptin_height_2 number| embedded_poptin_width_3 number| embedded_poptin_height_3 number| embedded_poptin_width_4 number| embedded_poptin_height_4 number| embedded_poptin_width_5 number| embedded_poptin_height_5 number| embedded_poptin_width_6 number| embedded_poptin_height_6 number| embedded_poptin_width_7 number| embedded_poptin_height_7 boolean| responsive_fullpage_height boolean| responsive_fullpage_width object| poptin_size undefined| poptin_position boolean| redirect_flag object| socialProofInterval number| poptin_animation_speed object| country number| showPoptinCount object| field_desing function| jQ224 object| poptins object| all_poptins boolean| ifAndroid boolean| isFirefox boolean| isChrome boolean| isSafari boolean| ifMobile boolean| if_display boolean| if_html_pad string| user_lang boolean| if_freemium object| newScaleTimeout string| skip_en string| skip_he string| facebook_messanger_data_ref object| fr_templates string| url_conversion_query function| showLog number| poptinPageLoaded boolean| poptinStarted object| checkTimeOutArray function| runPoptinNow function| pageLoadCheck boolean| poptinAfterPageLoad function| poptinInit function| setClientId function| getClientId function| poptinDependentFunction function| setReferrer function| displayPoptinOnClick function| closePoptinOnXclick function| onTextClickClose function| initiatePullPoptinsRequestOnClick function| poptin_display function| poptinInitiate function| initiatePullPoptinsRequest function| setGeolocationCookies function| fontDownload function| timerDownload function| downloadJqueryUi function| downloadPoptinBackground function| downloadPoptinTemplateFromS3 function| setPoptinTrigger function| GetIEVersion function| setPoptinStyle function| getAllJsVariables function| poptinJsFilter function| poptinCookiesFilter function| cookiesFilterCheckIfInRoles function| jsFilterCheckIfInRoles function| appendPoptin function| poptinFormValidations function| setPoptin function| ifUserlangIsHe function| setTelForMobile function| setAccessibility function| setAccessibilityThankAfterSubmit function| ifHebrow function| ifScrollVisible function| initializeCloseButtonNote function| setAutoPilot function| setOriginLandingPage function| setPoptinSize function| setPoptinsArray function| setPoptinsOnClickArray function| ifAndroidKeyborad function| clearPoptinCredit function| insertPoptinCredit function| fixHtmlPadding object| poptin_fonts function| getFont function| showPoptin function| injectFacebookPlugin function| pushHtmlDown function| paddingXButton function| cssFix function| setJqueryUiShakeAnimation function| secondPlay function| minutePlay function| hoursPlay function| daysPlay function| poptinTimer function| resetClock function| prefix0 function| initializeClock function| getTimeRemaining function| checkIfTimer function| poptinFormClickSubmit function| ifLinkConversion function| ifSubmitEmptyForm function| onInputKeyDown function| submitPoptin function| poptinConversion function| closePoptin function| removePoptinHtml function| redirectAfterConversion function| poptinRedirectToUrl function| onlyOneQuestionMark function| getPoptinConversionFields function| afterPoptinSubmit function| redirectToPoptin function| handleConversionSuccess function| poptinViewed function| getDataWidthHeight function| getPoptinPosition function| windowResize function| doResizePoptin function| barHtmlPadding function| getReferrer function| getReleventCookie function| getAllCookies function| getWebsiteCookie function| getAutoPilots function| getOriginLandingPage function| deafultCookie function| setOldVisitorCookie function| getEveryVisitSession function| getPoptinViewedSession function| getPoptinNewUser function| setUserId function| getUserId function| getUserCountryCode function| getPoptinPageviews function| setPoptinSession function| setOldUserSession function| setNewUserSession function| setOnceADayCookie function| setPoptinViewedSession function| setClosePoptinOnXCookie function| setOnceAVisit function| getOnceAVisitCookies function| poptinSetCookie function| poptinGetCookie function| resetReleventCookie function| poptinCheckCookie function| poptinDeleteCookie function| getCurrentDate function| monitorError function| showEffect object| PQ function| poptinFacebookMessangerConversion function| PoptinQueue object| jQuery1124027354604418165596 object| addComment object| jpfbembed function| fbAsyncInit function| jetpackLazyImagesModule string| domain string| cookies string| relevent_cookie string| poptin_viewed_session number| once string| ap_triggers string| triggers boolean| country_code string| referrer_url string| page_title string| lp object| jetpackLikesWidgetBatch boolean| jetpackLikesMasterReady number| jetpackLikesLookAhead object| jetpackCommentLikesLoadedWidgets function| JetpackLikesPostMessage function| JetpackLikesBatchHandler function| JetpackLikesMessageListener function| JetpackLikesWidgetQueueHandler function| jetpackLoadLikeWidgetIframe function| jetpackGetUnloadedWidgetsInView function| jetpackIsScrolledIntoView function| jetpackUnloadScrolledOutWidgets function| jetpackWidgetsDelayedExec function| jetpackOnScrollStopped object| Typekit function| Spinner object| jetpackCarouselStrings object| sharing_js_options object| WPCOMSharing undefined| windowOpen object| _stq string| hash number| uniq string| new_css function| st_go function| linktracker_init object| wpcom object| ak_js object| commentForm undefined| replyRowContainer undefined| children object| today number| dd number| mm number| yyyy string| value

6 Cookies

Domain/Path Name / Value
blog.reasonsecurity.com/ Name: poptin_referrer
Value:
blog.reasonsecurity.com/ Name: poptin_user_id
Value: 0.4kvunqbmc7s
blog.reasonsecurity.com/ Name: poptin_old_user
Value: true
.reasonsecurity.com/ Name: _gat_UA-128871879-3
Value: 1
.reasonsecurity.com/ Name: _gid
Value: GA1.2.880377514.1571233350
.reasonsecurity.com/ Name: _ga
Value: GA1.2.800566133.1571233350

3 Console Messages

Source Level URL
Text
console-api log URL: https://c0.wp.com/c/5.2.4/wp-includes/js/jquery/jquery-migrate.min.js(Line 2)
Message:
JQMIGRATE: Migrate is installed, version 1.4.1
console-api log URL: https://cdn.popt.in/pixel.js?id=a252df1aa5cae(Line 1)
Message:
runPoptinNow
console-api log URL: https://cdn.popt.in/pixel.js?id=a252df1aa5cae(Line 1)
Message:
initiatePullPoptinsRequest()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=86400

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
blog.reasonsecurity.com
c0.wp.com
cdn.popt.in
connect.facebook.net
d3lopmpcew67el.cloudfront.net
display.popt.in
fonts.googleapis.com
fonts.gstatic.com
jetpack.wordpress.com
p.typekit.net
pixel.wp.com
platform.twitter.com
s0.wp.com
secure.gravatar.com
staticxx.facebook.com
stats.wp.com
syndication.twitter.com
use.typekit.net
widgets.wp.com
www.facebook.com
www.google-analytics.com
www.googletagmanager.com
104.244.42.8
192.0.76.3
192.0.77.32
192.0.77.37
192.0.78.215
192.0.78.33
2600:9000:20eb:4a00:b:8c20:bf40:21
2606:2800:234:59:254c:406:2366:268c
2606:4700:30::681f:4fd3
2a00:1450:4001:806::2003
2a00:1450:4001:814::2008
2a00:1450:4001:815::200e
2a00:1450:4001:81b::200a
2a00:1450:4001:81e::200a
2a00:1450:4001:821::200a
2a03:2880:f02d:12:face:b00c:0:3
2a03:2880:f12d:83:face:b00c:0:25de
2a04:fa87:fffe::c000:4902
95.100.67.47
036d841b132c14046e26d8f2da1bc634c6ad34885ed1295660694a91c98933a6
0515cbd1f8aee97e1c8e0d1d015ca96c86def13e90d2e73bf813072ccc23d531
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
0ebbc7fba9a50d36ef5422345f624431710db4528f25749d1d438c2c10bb69f2
1450a1533a0cf3b0c5a889245ce6fb75ba12be8f87360df08cbc34b087af1cc2
17076feddaacd52d85e994fdfde6f77c2ba32967022da0bb27624b2f85ca2ca0
1c208125e545ad905cf6da32cf989d9c4271bab30c09575dc6485f31c89002b8
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df
1e588dccca85e2bc6502337ac3c4009b0672b08f1e5847d5d5a0fe3d5d475ab5
1e99034e4b75a1fb7ba372a3a950fa19ff4688d8561479b1a34dfcbde83ff3d8
1ea6f40ec8dae2c9282b638b3e19fcd587aada518a6ed717fb870700f7122c87
2152557cac69e2bd7d6debef5037a9f554f9209cc305b8141b3329acb10c42b7
22be3963ed695d5e0ab1ebf21af1d6008bbc4874deee8b7125f3f0f6d6edc460
265c34f4c62e6423e270cecb0c422b735dfb0f18cea04c2ac343b6f22106661e
2711b037e078e306e59765e9fc22d9f86867eb26af8c6af72d864a1c52bed8ac
274146c532cb5c18b7d5e35a7cddebe14425fec96010a582232be292c123e7b9
2abeba52ea029b38a97e7e95a6569af6957ce79f91a3683993ea4fb1dc46ac45
2e1ced1bd0736a56a0c44fd7b3bf8134850398ecddd52a0f5e6e437c5d527999
31cb76c05cbf5d71466f93078e8ba0f6e39cd92d0acc86d385b8cf2899963695
355f2031a5aec18709225437df181c8c3fee4fd25269083890b1c621f2d3edda
36ad0edaf88cb19e7cbdae22470c1f124f02fd5673bf6144c0a7a9f0a8fef987
3fc454bd834310f44cb73b3378d6c265b59b1e0065e6e7f77f25d7449bcb95b2
487f2e9da2ff0740755a5ef01dc15a2888b89537795895203a831b13b199d8bb
48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d
4b8fe5c3d0e5ef7a6582185cbf5c535b5d369c8df1da98c03ed69833e55f474d
4c2d889ee46270fb2ae51c5ef8804efb7f03b4d5f2ab24a9fdd7a6400f75ea6c
4ed10d0d64bb1515397e8666a63f484d640dbc5678fa62574e077b7aef1c3af2
5a1a3a3f0ef52a304cde50940ee607a2ebb008b76fa4cf49721b6e5cc07c350a
5f6e4b810b35bb95a2cc266c68fccb06d499c811f2b54912073dfaacbaeb0d63
62833d619119b5dcecafb014f7ce132fdf3227b0b3640967bf7c9a979e3112e5
6c7b085684080f8fb117b6a8979d0b42907891f186b532cf88048b0adc1b976f
6d6cd55572e8be7aa03c122e0ef98bf72d91a2caa2dddfe3c7c5b50f67d2bd07
6ec51f37e85696c857c6a9357dd8c4c1802eccdb2b601ef1bcf3c4bf3ba77060
70e6c7d7718e715de38eb98c94c68be796dcbc6f4dc71d467362675529d24746
7998d10344ff2754217b6323952a2fe790bd2e0cbe13b5ce72d12e1efe7a1df9
7b5e32cb325e9aaef357a421cd16ddf6d6ddb70fec74b6c35a73eccc6817664c
7cc2c8a7bd96173ee2a862c122630ab8d45ad0676ad2ad60fc55307763782230
7f7728c1dc5b5a7bc97e9570d1409d092a9838160af55be74caa0ef22608036b
7fb6f61a4321cc230f63a0388084753316e3a70ab90ecbf208c2c7a136f97320
807e31e5fb001364a2a8e25dae7afa66324fbe958a7af895ebcab011c33e26d5
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
90476f48e0b8a9f9c5c11fd16f13fc6a8772fe281d12c8e63153a6f948cdd348
96cae96a73c65ceed190aa0b4a9a86f0233798e9a17f27ca57855f4f79ebf678
970a3fa15876d16dcc0fd70eb7c9ab44d733108b3ddca1a449edd0356c1b79a7
9a0ed35e909a86face7e3a00933bdbba5a55f5f221a69a40bd58936c64c6f461
9b9265c69a5cc295d1ab0d04e0273b3677db1a6216ce2ccf4efc8c277ed84b39
9baad10e85c5be8d5697086479983b6b477197103bf8f0f11817b1bdfb9a7451
9c42615b9f87888a452f177c5ea19899fb8a835b8f6d0b458824e6c332a0adce
9fbd3c2713beacc2285bd418877d4a36273244eabf9df9f488bbd6f5ec2c467d
9ff00bf699b8a32464b1fe9c811cf529781f92fe86bd1899bebf8a0a956b1f6b
a05cb65ecfe9bb5ef6968b5cc9099d50cd8401c1aa73df4c214fee47018c4d12
a5307da44321773c9f46b34d756dcbd6cd427238e5cbad91cd2cf151513ec283
a75a7bf10f415b7c91f0b959177f3f1779e78cbf735601e41fb982c2b1cf4be2
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ade772bfff1536353b5e2066dbd77cb756e588b4f45d97d5b8871efefb0b9d4e
b35d826d929ec151697514cd4cb87a079589741867639051236b8a382e658ad2
b42989a0f2a1fb6d69e72c4f548ef2e73c4d3089d53649f5ed75e45c7b91cffb
b90bddaa859eeeff46ee20815774c407611aeb85de431d919cb8e50f18a4d693
bc71c403dc6113c8597e111a99d6a6a197dd2f2355402f8392ca4812dca57d3d
bd654352c61fd97f536666810741005feb472468382971e9cfaa349d37c0eba2
c104e6c684652c9222e7d69d97b87d3064d1057528944479da4839e51e9e9d30
c1cfa5c2bce904bfc524754a954d2e062c703777ab704134dc5f619dca1e40af
c204ed0bcb4aad749f3f2afb5f8dd316bd5327f6c303dcd70ecafdfde3a6b7fe
ce421cefeba1fd14f39e9baf36f62453dfd1a947bdcb76fc1995ab2b4013b3ad
d3b9ac60281114eb252c949187818336066886576d5fc78f31cc8c4c2d94531f
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
de2083cb77cdec9f77b6b61d0c8b7a0ce5ce6423915e9d5a767ad9a1c583319e
e4c68f0b34a79813171f4674c1d17411378987dccdfa9b1d67ae3582a7b8010a
e591c1904166ec31851a8f101da7a018e9fa9206ce8d9a08c42178a9eb80642b
e9fc9b1878db1b13b973252b048d19a17abb34a8da464a552c6d401728ed1e86
ecf76895be1cf9e8b3edb254030e9c9c1d8f3c2efc1f9dc7e04ceff29eccae9c
ed9451e768c2d762d3d158e05ebed9bd87cdbf6aeb885b3c55e25e8c909ec6da
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f0703e3b30d945384dea1e389adcc181922cd0a620cceabbde8df433145097af
f32d41f2099a0be20e6b57c5e0d1b71c079d3e1345827b0f5c5b97c6e5e3f78d
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
f43390f54ad15411ce1690209a8655bafea9db77e1621eb9aed24924c7cfef63
f4799ef2939b8377cf33f07b07b6d90a4a245adbf1c6eaf47ee3b0fcefcc07fe
f894c2869399d0d7797c8d525b23411bfd79c18b1f5aa0515503e0ecf5d1f4eb
fd0aad6bd18e1db3bff4bb5d5de61b13fd0acfab1a80b5546dbbfc5d06508bfd