blog.qualys.com Open in urlscan Pro
35.230.125.173 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://blog.qualys.com/vulnerabilities-threat-research/2023/01/03/bit=
Effective URL:
https://blog.qualys.com/vulnerabilities-threat-research/2023/01/03/bitrat-now-sharing-sensitive-bank-data-as-a-lure
Submission: On November 16 via api (November 16th 2023, 12:26:12 am UTC) from IN — Scanned from DE

Summary HTTP 73 Redirects Links 77 Behaviour Indicators

Summary

This website contacted 26 IPs in 4 countries across 23 domains to perform 73 HTTP transactions. The main IP is 35.230.125.173, located in The Dalles, United States and belongs to GOOGLE-CLOUD-PLATFORM, US. The main domain is blog.qualys.com. The Cisco Umbrella rank of the primary domain is 861092.
TLS certificate: Issued by R3 on September 26th 2023. Valid for: 3 months.

This is the only time blog.qualys.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 5	35.230.125.173 35.230.125.173	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
23	2600:9000:206... 2600:9000:206f:8e00:15:c281:3500:93a1	16509 (AMAZON-02) (AMAZON-02)
7	2606:4700::68... 2606:4700::6811:180e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	143.204.215.33 143.204.215.33	16509 (AMAZON-02) (AMAZON-02)
6	18.245.78.109 18.245.78.109	16509 (AMAZON-02) (AMAZON-02)
2	2a04:fa87:fff... 2a04:fa87:fffe::c000:4902	2635 (AUTOMATTIC) (AUTOMATTIC)
2	192.0.76.3 192.0.76.3	2635 (AUTOMATTIC) (AUTOMATTIC)
1	2606:4700:10:... 2606:4700:10::6816:3768	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:809::200a	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:830::2008	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:830::200e	15169 (GOOGLE) (GOOGLE)
2	2a02:26f0:480... 2a02:26f0:480:f::213:7ec6	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	23.192.243.198 23.192.243.198	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2606:4700:7::... 2606:4700:7::a29f:8716	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	34.96.102.137 34.96.102.137	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	2a00:1450:400... 2a00:1450:4001:811::2003	15169 (GOOGLE) (GOOGLE)
1	104.237.62.212 104.237.62.212	18450 (WEBNX) (WEBNX)
1	2001:4860:480... 2001:4860:4802:32::36	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c00::9d	15169 (GOOGLE) (GOOGLE)
4 5	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	192.28.147.68 192.28.147.68	15224 (OMNITURE) (OMNITURE)
1	2a00:1450:400... 2a00:1450:4001:806::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:82b::2003	15169 (GOOGLE) (GOOGLE)
1	2606:4700:440... 2606:4700:4400::ac40:9a92	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	52.209.3.106 52.209.3.106	16509 (AMAZON-02) (AMAZON-02)
73	26

5 35.230.125.173 (The Dalles, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 173.125.230.35.bc.googleusercontent.com

blog.qualys.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

23 2600:9000:206f:8e00:15:c281:3500:93a1 (United States)

ASN16509 (AMAZON-02, US)

ik.imagekit.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2606:4700::6811:180e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 143.204.215.33 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-215-33.fra53.r.cloudfront.net

static.cloud.coveo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 18.245.78.109 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-245-78-109.fra60.r.cloudfront.net

d1uyme8f6ss6qi.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a04:fa87:fffe::c000:4902 (Ireland)

ASN2635 (AUTOMATTIC, US)

secure.gravatar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 192.0.76.3 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)

stats.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:10::6816:3768 (United States)

ASN13335 (CLOUDFLARENET, US)

rum-static.pingdom.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:809::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:830::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:830::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:480:f::213:7ec6 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.192.243.198 (Düsseldorf, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-192-243-198.deploy.static.akamaitechnologies.com

munchkin.marketo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:7::a29f:8716 (United States)

ASN13335 (CLOUDFLARENET, US)

js.maxmind.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.96.102.137 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 137.102.96.34.bc.googleusercontent.com

dev.visualwebsiteoptimizer.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:811::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.237.62.212 (El Segundo, United States)

ASN18450 (WEBNX, US)
PTR: api.ipify.org

api.ipify.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)

region1.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c00::9d (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2620:1ec:21::14 (United States) 4 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.28.147.68 (United States)

ASN15224 (OMNITURE, US)

797-eni-742.mktoresp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:806::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82b::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::ac40:9a92 (United States)

ASN13335 (CLOUDFLARENET, US)

geoip-js.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.209.3.106 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-209-3-106.eu-west-1.compute.amazonaws.com

rum-collector-2.pingdom.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
23	imagekit.io ik.imagekit.io — Cisco Umbrella Rank: 22793	577 KB
7	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 223	94 KB
6	linkedin.com 4 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 377 www.linkedin.com — Cisco Umbrella Rank: 629 px4.ads.linkedin.com — Cisco Umbrella Rank: 6003	5 KB
6	cloudfront.net d1uyme8f6ss6qi.cloudfront.net	186 KB
5	qualys.com 1 redirects blog.qualys.com — Cisco Umbrella Rank: 861092	27 KB
4	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 27 region1.google-analytics.com — Cisco Umbrella Rank: 2462	21 KB
4	coveo.com static.cloud.coveo.com — Cisco Umbrella Rank: 8670	292 KB
2	visualwebsiteoptimizer.com dev.visualwebsiteoptimizer.com — Cisco Umbrella Rank: 2958	2 KB
2	marketo.net munchkin.marketo.net — Cisco Umbrella Rank: 3497	7 KB
2	licdn.com snap.licdn.com — Cisco Umbrella Rank: 778	19 KB
2	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 35	174 KB
2	pingdom.net rum-static.pingdom.net — Cisco Umbrella Rank: 6067 rum-collector-2.pingdom.net — Cisco Umbrella Rank: 5420	3 KB
2	wp.com stats.wp.com — Cisco Umbrella Rank: 2855 pixel.wp.com — Cisco Umbrella Rank: 2799	3 KB
2	gravatar.com secure.gravatar.com — Cisco Umbrella Rank: 2178	88 KB
1	geoip-js.com geoip-js.com — Cisco Umbrella Rank: 14707	959 B
1	google.de www.google.de — Cisco Umbrella Rank: 6862	408 B
1	google.com www.google.com — Cisco Umbrella Rank: 2	408 B
1	mktoresp.com 797-eni-742.mktoresp.com — Cisco Umbrella Rank: 509569	318 B
1	doubleclick.net stats.g.doubleclick.net — Cisco Umbrella Rank: 78	349 B
1	ipify.org api.ipify.org — Cisco Umbrella Rank: 3028	213 B
1	gstatic.com fonts.gstatic.com	24 KB
1	maxmind.com js.maxmind.com — Cisco Umbrella Rank: 27085	1 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 31	837 B
73	23

	Domain	Requested by
23	ik.imagekit.io	blog.qualys.com ik.imagekit.io
7	cdnjs.cloudflare.com	blog.qualys.com
6	d1uyme8f6ss6qi.cloudfront.net	blog.qualys.com ik.imagekit.io
5	blog.qualys.com	1 redirects cdnjs.cloudflare.com ik.imagekit.io
4	px.ads.linkedin.com	3 redirects snap.licdn.com
4	static.cloud.coveo.com	blog.qualys.com static.cloud.coveo.com
3	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com blog.qualys.com
2	dev.visualwebsiteoptimizer.com	blog.qualys.com
2	munchkin.marketo.net	www.googletagmanager.com munchkin.marketo.net
2	snap.licdn.com	www.googletagmanager.com snap.licdn.com
2	www.googletagmanager.com	blog.qualys.com www.googletagmanager.com
2	secure.gravatar.com	blog.qualys.com
1	rum-collector-2.pingdom.net	rum-static.pingdom.net
1	geoip-js.com	js.maxmind.com
1	www.google.de	blog.qualys.com
1	www.google.com	blog.qualys.com
1	797-eni-742.mktoresp.com	munchkin.marketo.net
1	px4.ads.linkedin.com	blog.qualys.com
1	www.linkedin.com	1 redirects
1	stats.g.doubleclick.net	www.google-analytics.com
1	region1.google-analytics.com	www.googletagmanager.com
1	api.ipify.org	blog.qualys.com
1	fonts.gstatic.com	fonts.googleapis.com
1	pixel.wp.com	blog.qualys.com
1	js.maxmind.com	www.googletagmanager.com
1	fonts.googleapis.com	static.cloud.coveo.com
1	rum-static.pingdom.net	blog.qualys.com
1	stats.wp.com	blog.qualys.com
73	28

This site contains links to these domains. Also see Links.

Domain
success.qualys.com
qualys-secure.force.com
www.qualys.com
community.qualys.com
www.cancilleria.gov.co
ik.imagekit.io
www.linkedin.com
www.facebook.com
twitter.com
discussions.qualys.com
www.youtube.com
vimeo.com
store.qualys.com
notifications.qualys.com

Subject Issuer	Validity	Valid
blog.qualys.com R3	`2023-09-26` - `2023-12-25`	3 months	crt.sh
*.imagekit.io Amazon RSA 2048 M01	`2023-02-22` - `2024-03-22`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-07-03` - `2024-07-02`	a year	crt.sh
*.cloud.coveo.com Amazon RSA 2048 M02	`2023-04-26` - `2024-05-24`	a year	crt.sh
*.cloudfront.net Amazon RSA 2048 M01	`2023-10-10` - `2024-09-19`	a year	crt.sh
*.gravatar.com Sectigo ECC Domain Validation Secure Server CA	`2022-11-23` - `2023-12-24`	a year	crt.sh
*.wp.com Sectigo ECC Domain Validation Secure Server CA	`2022-11-14` - `2023-12-15`	a year	crt.sh
pingdom.net Cloudflare Inc ECC CA-3	`2023-10-14` - `2024-10-13`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2023-02-01` - `2024-01-31`	a year	crt.sh
*.marketo.net DigiCert TLS RSA SHA256 2020 CA1	`2023-02-06` - `2024-02-05`	a year	crt.sh
*.visualwebsiteoptimizer.com Starfield Secure Certificate Authority - G2	`2023-07-06` - `2024-07-06`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
*.ipify.org Sectigo RSA Domain Validation Secure Server CA	`2023-02-07` - `2024-02-18`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-10-16` - `2024-01-08`	3 months	crt.sh
*.mktoresp.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-09-07` - `2024-10-07`	a year	crt.sh
www.google.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
www.google.de GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
www.linkedin.com DigiCert SHA2 Secure Server CA	`2023-11-03` - `2024-05-03`	6 months	crt.sh
*.pingdom.net Amazon RSA 2048 M03	`2023-11-06` - `2024-12-03`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://blog.qualys.com/vulnerabilities-threat-research/2023/01/03/bitrat-now-sharing-sensitive-bank-data-as-a-lure
Frame ID: 0FBF9FB899E996A87799456F2DB2A045
Requests: 73 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

BitRAT Now Sharing Sensitive Bank Data as a Lure | Qualys Security BlogSearchLoadingTwitterLinkedInFacebookYouTubeVimeo

Page URL History Show full URLs

https://blog.qualys.com/vulnerabilities-threat-research/2023/01/03/bit= HTTP 301
https://blog.qualys.com/vulnerabilities-threat-research/2023/01/03/bitrat-now-sharing-sensitive-bank... Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Highlight.js (Miscellaneous) Expand

Overall confidence: 100%
Detected patterns

/(?:([\d.])+/)?highlight(?:\.min)?\.js

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Marketo (Marketing Automation) Expand

Overall confidence: 100%
Detected patterns

munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js

Underscore.js (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

underscore.*\.js(?:\?ver=([\d.]+))?

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

73
Requests

99 %
HTTPS

62 %
IPv6

23
Domains

28
Subdomains

26
IPs

4
Countries

1520 kB
Transfer

3914 kB
Size

16
Cookies

77 Outgoing links

These are links going to different origins than the main page.

URL: https://success.qualys.com/discussions/s/
Title: Discussions

Search URL Search Domain Scan URL

URL: https://qualys-secure.force.com/discussions/s/
Title: BROWSE BY TOPIC

Search URL Search Domain Scan URL

URL: https://qualys-secure.force.com/discussions/s/topic/0TO2L000000HIRIWA4/asset-management
Title: Global IT Asset Management

Search URL Search Domain Scan URL

URL: https://qualys-secure.force.com/discussions/s/topic/0TO2L000000HIRwWAO/it-security
Title: IT Security

Search URL Search Domain Scan URL

URL: https://qualys-secure.force.com/discussions/s/topic/0TO2L000000HIS1WAO/compliance
Title: Compliance

Search URL Search Domain Scan URL

URL: https://qualys-secure.force.com/discussions/s/topic/0TO2L000000HIRnWAO/cloud-container
Title: Cloud & Container Security

Search URL Search Domain Scan URL

URL: https://qualys-secure.force.com/discussions/s/topic/0TO2L000000HISCWA4/web-app-security
Title: Web App Security

Search URL Search Domain Scan URL

URL: https://qualys-secure.force.com/discussions/s/topic/0TO2L000000HIRfWAO/certificate-security
Title: Certificate Security & SSL Labs

Search URL Search Domain Scan URL

URL: https://qualys-secure.force.com/discussions/s/topic/0TO2L000000HIR8WAO/developer
Title: Developer API

Search URL Search Domain Scan URL

URL: https://qualys-secure.force.com/discussions/s/topic/0TO2L000000HIRAWA4/qualys-cloud-platform
Title: Cloud Platform

Search URL Search Domain Scan URL

URL: https://qualys-secure.force.com/discussions/s/#start-a-discussion
Title: Start a discussion

Search URL Search Domain Scan URL

URL: https://www.qualys.com/training/
Title: Training

Search URL Search Domain Scan URL

URL: https://www.qualys.com/documentation/
Title: Docs

Search URL Search Domain Scan URL

URL: https://success.qualys.com/customersupport/
Title: Support

Search URL Search Domain Scan URL

URL: https://community.qualys.com/
Title: Community

Search URL Search Domain Scan URL

URL: https://www.cancilleria.gov.co/tramites_servicios/tramites_exterior/cedula_ciudadania
Title: Columbian national ID

Search URL Search Domain Scan URL

URL: https://ik.imagekit.io/qualys/wp-content/uploads/2023/01/Fig.1.png

Search URL Search Domain Scan URL

URL: https://ik.imagekit.io/qualys/wp-content/uploads/2023/01/Fig.2.png

Search URL Search Domain Scan URL

URL: https://ik.imagekit.io/qualys/wp-content/uploads/2023/01/Fig.3.png

Search URL Search Domain Scan URL

URL: https://ik.imagekit.io/qualys/wp-content/uploads/2023/01/Fig.4.png

Search URL Search Domain Scan URL

URL: https://ik.imagekit.io/qualys/wp-content/uploads/2023/01/Fig.5.png

Search URL Search Domain Scan URL

URL: https://ik.imagekit.io/qualys/wp-content/uploads/2023/01/Fig.6.png

Search URL Search Domain Scan URL

URL: https://ik.imagekit.io/qualys/wp-content/uploads/2023/01/Fig.8.png

Search URL Search Domain Scan URL

URL: https://ik.imagekit.io/qualys/wp-content/uploads/2023/01/Fig.9.png

Search URL Search Domain Scan URL

URL: https://www.qualys.com/apps/endpoint-detection-response/
Title: Qualys Multi-Vector Endpoint Detection and Response

Search URL Search Domain Scan URL

URL: https://www.qualys.com/company/newsroom/news-releases/usa/qualys-launches-external-attack-surface-management-easm/
Title: Qualys External Attack Surface Management

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fblog.qualys.com%2Fvulnerabilities-threat-research%2F2023%2F01%2F03%2Fbitrat-now-sharing-sensitive-bank-data-as-a-lure

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fblog.qualys.com%2Fvulnerabilities-threat-research%2F2023%2F01%2F03%2Fbitrat-now-sharing-sensitive-bank-data-as-a-lure

Search URL Search Domain Scan URL

URL: https://twitter.com/share?url=https%3A%2F%2Fblog.qualys.com%2Fvulnerabilities-threat-research%2F2023%2F01%2F03%2Fbitrat-now-sharing-sensitive-bank-data-as-a-lure&text=BitRAT%20Now%20Sharing%20Sensitive%20Bank%20Data%20as%20a%20Lure&via=qualys

Search URL Search Domain Scan URL

URL: https://discussions.qualys.com/discussion/create!input.jspa
Title: Start a discussion

Search URL Search Domain Scan URL

URL: https://twitter.com/qualys
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/qualys
Title: LinkedIn

Search URL Search Domain Scan URL

URL: https://www.facebook.com/qualys
Title: Facebook

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/QualysGuard
Title: YouTube

Search URL Search Domain Scan URL

URL: https://vimeo.com/qualys
Title: Vimeo

Search URL Search Domain Scan URL

URL: https://www.qualys.com/
Title: Qualys.com

Search URL Search Domain Scan URL

URL: https://www.qualys.com/community-edition/
Title: Qualys Community Edition

Search URL Search Domain Scan URL

URL: https://store.qualys.com/
Title: Qualys Merchandise Store

Search URL Search Domain Scan URL

URL: https://community.qualys.com/vulnerability-management/
Title: Vulnerability Management

Search URL Search Domain Scan URL

URL: https://community.qualys.com/policy-compliance/
Title: Policy Compliance

Search URL Search Domain Scan URL

URL: https://community.qualys.com/pci-compliance/
Title: PCI Compliance

Search URL Search Domain Scan URL

URL: https://community.qualys.com/web-app-scanning/
Title: Web App Scanning

Search URL Search Domain Scan URL

URL: https://community.qualys.com/web-app-firewall/
Title: Web App Firewall

Search URL Search Domain Scan URL

URL: https://community.qualys.com/continuous-monitoring/
Title: Continuous Monitoring

Search URL Search Domain Scan URL

URL: https://community.qualys.com/security-assessment-questionnaire/
Title: Security Assessment Questionnaire

Search URL Search Domain Scan URL

URL: https://community.qualys.com/threat-protection/
Title: Threat Protection

Search URL Search Domain Scan URL

URL: https://community.qualys.com/asset-inventory/
Title: Asset Inventory

Search URL Search Domain Scan URL

URL: https://community.qualys.com/asset-view/
Title: AssetView

Search URL Search Domain Scan URL

URL: https://community.qualys.com/cmdb-sync/
Title: CMDB Sync

Search URL Search Domain Scan URL

URL: https://community.qualys.com/endpoint-detection-response/
Title: Endpoint Detection & Response

Search URL Search Domain Scan URL

URL: https://community.qualys.com/security-configuration-assessment/
Title: Security Configuration Assessment

Search URL Search Domain Scan URL

URL: https://community.qualys.com/file-integrity-monitoring/
Title: File Integrity Monitoring

Search URL Search Domain Scan URL

URL: https://community.qualys.com/cloud-inventory/
Title: Cloud Inventory

Search URL Search Domain Scan URL

URL: https://community.qualys.com/certificate-inventory/
Title: Certificate Inventory

Search URL Search Domain Scan URL

URL: https://community.qualys.com/container-security/
Title: Container Security

Search URL Search Domain Scan URL

URL: https://community.qualys.com/cloud-security-assessment/
Title: Cloud Security Assessment

Search URL Search Domain Scan URL

URL: https://community.qualys.com/certificate-assessment/
Title: Certificate Assessment

Search URL Search Domain Scan URL

URL: https://community.qualys.com/out-of-band-configuration-assessment/
Title: Out-of-band Configuration Assessment

Search URL Search Domain Scan URL

URL: https://community.qualys.com/patch-management/
Title: Patch Management

Search URL Search Domain Scan URL

URL: https://community.qualys.com/api/
Title: Developer API

Search URL Search Domain Scan URL

URL: https://community.qualys.com/cloud-agent/
Title: Cloud Agent

Search URL Search Domain Scan URL

URL: https://community.qualys.com/reporting/
Title: Dashboards & Reporting

Search URL Search Domain Scan URL

URL: https://discussions.qualys.com/
Title: All discussions

Search URL Search Domain Scan URL

URL: https://discussions.qualys.com/community/asset-inventory
Title: Global IT Asset Management

Search URL Search Domain Scan URL

URL: https://discussions.qualys.com/community/vulnerability-management
Title: IT Security

Search URL Search Domain Scan URL

URL: https://discussions.qualys.com/community/policy-compliance
Title: Compliance

Search URL Search Domain Scan URL

URL: https://discussions.qualys.com/community/cloud-security
Title: Cloud & Container Security

Search URL Search Domain Scan URL

URL: https://discussions.qualys.com/community/web-application-scanning
Title: Web App Security

Search URL Search Domain Scan URL

URL: https://discussions.qualys.com/community/ssllabs
Title: Certificate Security & SSL Labs

Search URL Search Domain Scan URL

URL: https://discussions.qualys.com/community/developer
Title: Developer API

Search URL Search Domain Scan URL

URL: https://notifications.qualys.com/
Title: Release Notifications

Search URL Search Domain Scan URL

URL: https://www.qualys.com/training/#self-paced
Title: Certified Courses

Search URL Search Domain Scan URL

URL: https://www.qualys.com/training/#video-library
Title: Video Library

Search URL Search Domain Scan URL

URL: https://www.qualys.com/training/#instructor-led
Title: Instructor-led Training

Search URL Search Domain Scan URL

URL: https://www.qualys.com/documentation/release-notes/
Title: Release Notes

Search URL Search Domain Scan URL

URL: https://qualys-secure.force.com/customer/s/
Title: Support Portal

Search URL Search Domain Scan URL

URL: https://www.qualys.com/company/privacy/
Title: Privacy Policy

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://blog.qualys.com/vulnerabilities-threat-research/2023/01/03/bit= HTTP 301
https://blog.qualys.com/vulnerabilities-threat-research/2023/01/03/bitrat-now-sharing-sensitive-bank-data-as-a-lure Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 64

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3605201&time=1700094367196&url=https%3A%2F%2Fblog.qualys.com%2Fvulnerabilities-threat-research%2F2023%2F01%2F03%2Fbitrat-now-sharing-sensitive-bank-data-as-a-lure HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3605201&time=1700094367196&url=https%3A%2F%2Fblog.qualys.com%2Fvulnerabilities-threat-research%2F2023%2F01%2F03%2Fbitrat-now-sharing-sensitive-bank-data-as-a-lure&cookiesTest=true HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D3605201%26time%3D1700094367196%26url%3Dhttps%253A%252F%252Fblog.qualys.com%252Fvulnerabilities-threat-research%252F2023%252F01%252F03%252Fbitrat-now-sharing-sensitive-bank-data-as-a-lure%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3605201&time=1700094367196&url=https%3A%2F%2Fblog.qualys.com%2Fvulnerabilities-threat-research%2F2023%2F01%2F03%2Fbitrat-now-sharing-sensitive-bank-data-as-a-lure&cookiesTest=true&liSync=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3605201&time=1700094367196&url=https%3A%2F%2Fblog.qualys.com%2Fvulnerabilities-threat-research%2F2023%2F01%2F03%2Fbitrat-now-sharing-sensitive-bank-data-as-a-lure&cookiesTest=true&liSync=true&e_ipv6=AQKaa6SshXpZnwAAAYvVhVg_C9HjbWLZDqR22v7oCiF80Xjpu-iiBU2Zjh8tc7hDV0muv1_dDG72Gi4VAmKcb-dAUACq

73 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request bitrat-now-sharing-sensitive-bank-data-as-a-lure Show response
blog.qualys.com/vulnerabilities-threat-research/2023/01/03/
Redirect Chain

https://blog.qualys.com/vulnerabilities-threat-research/2023/01/03/bit=
https://blog.qualys.com/vulnerabilities-threat-research/2023/01/03/bitrat-now-sharing-sensitive-bank-data-as-a-lure

93 KB
22 KB

213ms
213ms

Document
text/html

35.230.125.173
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.qualys.com/vulnerabilities-threat-research/2023/01/03/bitrat-now-sharing-sensitive-bank-data-as-a-lure

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

35.230.125.173 The Dalles, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

173.125.230.35.bc.googleusercontent.com

Software

nginx / WP Engine

Resource Hash

22e8c97d6543113640eec7153c98ddd328fb34d5d2730a0ec707f5e5d2d08e2b

Security Headers

Name	Value
Content-Security-Policy	block-all-mixed-content; frame-ancestors 'self' qualys.com *.qualys.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: max-age=14400, must-revalidate
content-encoding: br
content-security-policy: block-all-mixed-content; frame-ancestors 'self' qualys.com *.qualys.com;
content-type: text/html; charset=UTF-8
date: Thu, 16 Nov 2023 00:26:06 GMT
link: <https://blog.qualys.com/wp-json/>; rel="https://api.w.org/" <https://blog.qualys.com/wp-json/wp/v2/posts/32313>; rel="alternate"; type="application/json" <https://blog.qualys.com/?p=32313>; rel=shortlink
permissions-policy: autoplay=(), camera=(), document-domain=(), encrypted-media=(), fullscreen=(), geolocation=(), microphone=(), midi=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), sync-xhr=(), usb=(), xr-spatial-tracking=()
referrer-policy: no-referrer, strict-origin-when-cross-origin
server: nginx
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Accept-Encoding Accept-Encoding Accept-Encoding Accept-Encoding,Cookie
x-cache: HIT: 2
x-cache-group: normal
x-cacheable: YES:14400.000
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-powered-by: WP Engine
x-xss-protection: 1; mode=block

Redirect headers

cache-control: max-age=600, must-revalidate
content-length: 0
content-security-policy: block-all-mixed-content; frame-ancestors 'self' qualys.com *.qualys.com;
content-type: text/html; charset=UTF-8
date: Thu, 16 Nov 2023 00:26:05 GMT
expires: Wed, 11 Jan 1984 05:00:00 GMT
location: https://blog.qualys.com/vulnerabilities-threat-research/2023/01/03/bitrat-now-sharing-sensitive-bank-data-as-a-lure
permissions-policy: autoplay=(), camera=(), document-domain=(), encrypted-media=(), fullscreen=(), geolocation=(), microphone=(), midi=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), sync-xhr=(), usb=(), xr-spatial-tracking=()
referrer-policy: no-referrer, strict-origin-when-cross-origin
server: nginx
strict-transport-security: max-age=15778476
x-cache: MISS
x-cache-group: normal
x-cacheable: non200
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-powered-by: WP Engine
x-redirect-by: WordPress
x-xss-protection: 1; mode=block

GET
H2 200 style.min.css
ik.imagekit.io/qualys/wp-includes/css/dist/block-library/ 102 KB
13 KB 78ms
17ms Stylesheet
text/css 2600:9000:206f:8e00:15:c281:3500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ik.imagekit.io/qualys/wp-includes/css/dist/block-library/style.min.css?ver=6.3.2
Requested by: Host: blog.qualys.com
URL: https://blog.qualys.com/vulnerabilities-threat-research/2023/01/03/bitrat-now-sharing-sensitive-bank-data-as-a-lure
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:8e00:15:c281:3500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 67447c3656caad630373253691f3e8f64467eafd6e7305c9b0e98111b0b41694

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.qualys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 02:04:26 GMT
content-encoding: br
via: 1.1 715791ebe4663055c84208b8a58b2b80.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
age: 166900
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
x-request-id: 8b510b3c-7d69-4ad5-b116-74efc2fed901
last-modified: Wed, 19 Jul 2023 11:13:55 GMT
etag: W/"64b7c573-19824"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, s-maxage=15552000, max-age=15552000, must-revalidate
x-server: ImageKit.io
timing-allow-origin: *
access-control-allow-headers: *
x-amz-cf-id: x2QyWBOFWBPXTiZ-GJJc2bxnLNTRFPVtWXW3HjB3Y6a_dZ0oSxuZvA==

GET
H2 200 view.css
ik.imagekit.io/qualys/wp-content/plugins/jetpack/jetpack_vendor/automattic/jetpack-videopress/build/block-editor/blocks/video/ 602 B
1 KB 77ms
16ms Stylesheet
text/css 2600:9000:206f:8e00:15:c281:3500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ik.imagekit.io/qualys/wp-content/plugins/jetpack/jetpack_vendor/automattic/jetpack-videopress/build/block-editor/blocks/video/view.css?minify=false&ver=34ae973733627b74a14e
Requested by: Host: blog.qualys.com
URL: https://blog.qualys.com/vulnerabilities-threat-research/2023/01/03/bitrat-now-sharing-sensitive-bank-data-as-a-lure
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:8e00:15:c281:3500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: d749579e51cf490ba27a6782bcfe07c52e44ffa8e3fbb4db7a4dded9d0d9ef29

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.qualys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Sat, 04 Nov 2023 22:10:47 GMT
via: 1.1 715791ebe4663055c84208b8a58b2b80.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
age: 958519
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 602
x-request-id: ef4f771c-a2f3-49a8-877a-4eae93e07afe
last-modified: Fri, 09 Jun 2023 07:24:07 GMT
etag: "6482d397-25a"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, s-maxage=15552000, max-age=15552000, must-revalidate
x-server: ImageKit.io
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: *
x-amz-cf-id: w-1nld_4QV9xf0LH0ntfN_iyrHONFVGa0fTR4WMhj3YDfl24Gwz8tQ==

GET
H2 200 mediaelementplayer-legacy.min.css
ik.imagekit.io/qualys/wp-includes/js/mediaelement/ 11 KB
3 KB 76ms
16ms Stylesheet
text/css 2600:9000:206f:8e00:15:c281:3500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ik.imagekit.io/qualys/wp-includes/js/mediaelement/mediaelementplayer-legacy.min.css?ver=4.2.17
Requested by: Host: blog.qualys.com
URL: https://blog.qualys.com/vulnerabilities-threat-research/2023/01/03/bitrat-now-sharing-sensitive-bank-data-as-a-lure
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:8e00:15:c281:3500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: b7908a015a567ec2363011df2475368dbff34360e9da3fdff50604d6395fb646

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.qualys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 01 Aug 2023 08:07:43 GMT
content-encoding: br
via: 1.1 715791ebe4663055c84208b8a58b2b80.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
age: 9217103
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
x-request-id: 566e0754-0d9b-4865-93df-8368f298d536
last-modified: Tue, 29 Sep 2020 15:53:06 GMT
etag: W/"5f735862-2bf8"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, s-maxage=15552000, max-age=15552000, must-revalidate
x-server: ImageKit.io
timing-allow-origin: *
access-control-allow-headers: *
x-amz-cf-id: nLv3eq8w3S0I_870tR6_FUGo3lfSkEgcdiSlL8p4tNejex-vTe-Mqg==

GET
H2 200 wp-mediaelement.min.css
ik.imagekit.io/qualys/wp-includes/js/mediaelement/ 4 KB
1 KB 78ms
18ms Stylesheet
text/css 2600:9000:206f:8e00:15:c281:3500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ik.imagekit.io/qualys/wp-includes/js/mediaelement/wp-mediaelement.min.css?ver=6.3.2
Requested by: Host: blog.qualys.com
URL: https://blog.qualys.com/vulnerabilities-threat-research/2023/01/03/bitrat-now-sharing-sensitive-bank-data-as-a-lure
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:8e00:15:c281:3500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 2e10d353ff038c2cad3492fc17801af3e6ef2669c9e9713bdb78b1dcb104c4fe

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.qualys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 02:04:26 GMT
content-encoding: br
via: 1.1 715791ebe4663055c84208b8a58b2b80.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
age: 166900
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
x-request-id: 706abdc7-d24a-40bd-904d-d62be7f52c03
last-modified: Fri, 07 Jun 2019 20:45:02 GMT
etag: W/"5cfaccce-105a"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, s-maxage=15552000, max-age=15552000, must-revalidate
x-server: ImageKit.io
timing-allow-origin: *
access-control-allow-headers: *
x-amz-cf-id: MWmcN_Xq5yDDk3dp8WdQ99s8QW2MrK2abJLflE9WSwgr5opn5dpZwA==

GET
H2 200 shared.css
ik.imagekit.io/qualys/wp-content/themes/qualys2020/style/ 38 KB
8 KB 79ms
18ms Stylesheet
text/css 2600:9000:206f:8e00:15:c281:3500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ik.imagekit.io/qualys/wp-content/themes/qualys2020/style/shared.css?ver=1.0.3
Requested by: Host: blog.qualys.com
URL: https://blog.qualys.com/vulnerabilities-threat-research/2023/01/03/bitrat-now-sharing-sensitive-bank-data-as-a-lure
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:8e00:15:c281:3500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 4f01f464784675724c19ca066b543991619ff78d482649bd3dc0fafa6043d0d4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.qualys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Thu, 14 Sep 2023 09:16:30 GMT
content-encoding: br
via: 1.1 715791ebe4663055c84208b8a58b2b80.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
age: 5411376
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
x-request-id: f81ef016-991d-40c9-99d2-873899d941cb
last-modified: Thu, 14 Sep 2023 09:14:36 GMT
etag: W/"6502cefc-9780"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, s-maxage=15552000, max-age=15552000, must-revalidate
x-server: ImageKit.io
timing-allow-origin: *
access-control-allow-headers: *
x-amz-cf-id: etotyoKlWosmFjefnTPLJchQpWhtEZhU6BtANY2yDdfWJ1002Lj9bQ==

GET
H2 200 shared-min-30em.css
ik.imagekit.io/qualys/wp-content/themes/qualys2020/style/ 5 KB
2 KB 80ms
20ms Stylesheet
text/css 2600:9000:206f:8e00:15:c281:3500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ik.imagekit.io/qualys/wp-content/themes/qualys2020/style/shared-min-30em.css?ver=1.0.3
Requested by: Host: blog.qualys.com
URL: https://blog.qualys.com/vulnerabilities-threat-research/2023/01/03/bitrat-now-sharing-sensitive-bank-data-as-a-lure
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:8e00:15:c281:3500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 1cf1bcb212b66062127da65a7a85342fcdbfe284bd74cc96e35209556f76769a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.qualys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 08:34:25 GMT
content-encoding: br
via: 1.1 715791ebe4663055c84208b8a58b2b80.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
age: 2649101
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
x-request-id: 2d0318ad-86c6-4354-9da0-dc894b5e7c75
last-modified: Fri, 16 Dec 2022 15:30:52 GMT
etag: W/"639c8f2c-1305"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, s-maxage=15552000, max-age=15552000, must-revalidate
x-server: ImageKit.io
timing-allow-origin: *
access-control-allow-headers: *
x-amz-cf-id: 7XiR5jnY5vER6H0B_yK8YKMulAG6YErs3CV8iGmldjnI8Ue2pf7l7Q==

GET
H2 200 shared-min-60em.css
ik.imagekit.io/qualys/wp-content/themes/qualys2020/style/ 6 KB
2 KB 68ms
7ms Stylesheet
text/css 2600:9000:206f:8e00:15:c281:3500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ik.imagekit.io/qualys/wp-content/themes/qualys2020/style/shared-min-60em.css?ver=1.0.3
Requested by: Host: blog.qualys.com
URL: https://blog.qualys.com/vulnerabilities-threat-research/2023/01/03/bitrat-now-sharing-sensitive-bank-data-as-a-lure
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:8e00:15:c281:3500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 946baf7f039ba4158ad187a34782c658438b011bd9eb2118207c76119783ce8c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.qualys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Sat, 16 Sep 2023 00:26:37 GMT
content-encoding: br
via: 1.1 715791ebe4663055c84208b8a58b2b80.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
age: 5270369
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
x-request-id: 771ee73f-8a4b-450b-b994-b02ce76422c9
last-modified: Tue, 17 Jan 2023 11:15:15 GMT
etag: W/"63c68343-16f9"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, s-maxage=15552000, max-age=15552000, must-revalidate
x-server: ImageKit.io
timing-allow-origin: *
access-control-allow-headers: *
x-amz-cf-id: MnXOYbMGIjCL4ospkBo_vMM7saTVZoBCZUCUs-RaHXrJ6sBPKzVYwA==

GET
H2 200 style.css
ik.imagekit.io/qualys/wp-content/themes/qualys2020/ 18 KB
5 KB 79ms
19ms Stylesheet
text/css 2600:9000:206f:8e00:15:c281:3500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ik.imagekit.io/qualys/wp-content/themes/qualys2020/style.css?ver=1.0.3
Requested by: Host: blog.qualys.com
URL: https://blog.qualys.com/vulnerabilities-threat-research/2023/01/03/bitrat-now-sharing-sensitive-bank-data-as-a-lure
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:8e00:15:c281:3500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 5336157caf4b27e42cd746c6456e011920efd49106e32ff60d9ce2e73c378dcf

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.qualys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 08:34:25 GMT
content-encoding: br
via: 1.1 715791ebe4663055c84208b8a58b2b80.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
age: 2649101
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
x-request-id: ca25bd89-b7f7-44bb-9260-2375fdb12792
last-modified: Tue, 04 Apr 2023 00:55:58 GMT
etag: W/"642b759e-4626"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, s-maxage=15552000, max-age=15552000, must-revalidate
x-server: ImageKit.io
timing-allow-origin: *
access-control-allow-headers: *
x-amz-cf-id: mEdq-Ni0qN5Qg_t5bBIKotdEc4um4Sn_wXbfYkP2F7G8ZkzPe2jwCQ==

GET
H2 200 a11y-dark.min.css
cdnjs.cloudflare.com/ajax/libs/highlight.js/11.6.0/styles/ 1 KB
1 KB 37ms
14ms Stylesheet
text/css 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.6.0/styles/a11y-dark.min.css?ver=6.3.2

Requested by

Host: blog.qualys.com
URL: https://blog.qualys.com/vulnerabilities-threat-research/2023/01/03/bitrat-now-sharing-sensitive-bank-data-as-a-lure

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cb30e0c12d8ad8be9c0c517226ba4ffa88802ce495dada60b6f7494075a8a133

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.qualys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Thu, 16 Nov 2023 00:26:06 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 591641
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 419
last-modified: Wed, 13 Jul 2022 16:35:15 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "62cef443-1a3"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WMtKvDr%2BSN5OySUyDm2o3BPr0VuYhFubA2vsMC8bKL36YGqk5xKOQrcaStn%2Fo%2BeMNYphCyVEfIu3P3uz3Z4tP5%2BOZdPwxOAJOjjUB%2FfM04ip41skXOnMYWB0YHNr%2FLRU4eNYi%2FaPVIypKLtRWlJLuzeL"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 826b99bea88b68fd-FRA
expires: Tue, 05 Nov 2024 00:26:06 GMT

GET
H2 200 CoveoFullSearch.min.css
static.cloud.coveo.com/searchui/v2.10085/2/css/ 405 KB
48 KB 38ms
9ms Stylesheet
text/css 143.204.215.33
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.cloud.coveo.com/searchui/v2.10085/2/css/CoveoFullSearch.min.css?ver=6.3.2
Requested by: Host: blog.qualys.com
URL: https://blog.qualys.com/vulnerabilities-threat-research/2023/01/03/bitrat-now-sharing-sensitive-bank-data-as-a-lure
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.215.33 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-215-33.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 54e678962b5b2154b58a43e79ae4a609b9b9edceba3a9f8a49d03d1a6de72032

Request headers

Referer: https://blog.qualys.com/
Origin: https://blog.qualys.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

x-amz-version-id: _Lx2w0b0nFRCPsgu_x90ygffLDny.8ZL
content-encoding: gzip
via: 1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
date: Thu, 16 Nov 2023 00:19:10 GMT
age: 417
x-amz-cf-pop: FRA53-C1
x-cache: Hit from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
x-amz-replication-status: COMPLETED
last-modified: Wed, 05 May 2021 21:45:28 GMT
server: AmazonS3
etag: W/"feab9a70bd0294a98dba1318ec6e7647"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=86400;
x-amz-cf-id: NlkS4ABdFmFhgDVNcP64EYao3k6SfsqmDFNxbKVuwiaDC-khwofs2w==

GET
H2 200 jquery.fancybox.min.css
cdnjs.cloudflare.com/ajax/libs/fancybox/3.5.7/ 12 KB
3 KB 37ms
15ms Stylesheet
text/css 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/fancybox/3.5.7/jquery.fancybox.min.css?ver=6.3.2

Requested by

Host: blog.qualys.com
URL: https://blog.qualys.com/vulnerabilities-threat-research/2023/01/03/bitrat-now-sharing-sensitive-bank-data-as-a-lure

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5736e3eec0c34bfc288854b7b8d2a8f1e22e9e2e7dae3c8d1ad5dfb2d4734ad0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.qualys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Thu, 16 Nov 2023 00:26:06 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 246757
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 2695
last-modified: Mon, 04 May 2020 16:10:00 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03e58-31fb"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pBAjwf2VIU9I%2Foo7TL5K1OeN1w6SjV5bxtrF2VVa1upP3fb3prAPjy0gIP1LUytq2dY9o3JpEYgromIlVYdZLEBHSU7hgPbd42%2FlLxqkHaJBA0vm29RDiIs8Tvfqet1TTQXrCEacuJlPPHfDcawmuBLY"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 826b99bea88c68fd-FRA
expires: Tue, 05 Nov 2024 00:26:06 GMT

GET
H2 200 jetpack.css
ik.imagekit.io/qualys/wp-content/plugins/jetpack/css/ 97 KB
17 KB 68ms
9ms Stylesheet
text/css 2600:9000:206f:8e00:15:c281:3500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ik.imagekit.io/qualys/wp-content/plugins/jetpack/css/jetpack.css?ver=12.2
Requested by: Host: blog.qualys.com
URL: https://blog.qualys.com/vulnerabilities-threat-research/2023/01/03/bitrat-now-sharing-sensitive-bank-data-as-a-lure
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:8e00:15:c281:3500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 4f74c10c6691aef6faebcb39fe94d3210bcf732a898850be83930aa592bda587

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.qualys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Sat, 16 Sep 2023 00:26:37 GMT
content-encoding: br
via: 1.1 715791ebe4663055c84208b8a58b2b80.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
age: 5270369
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
x-request-id: 5ef16c0c-22de-4131-8e30-7e92d8209488
last-modified: Fri, 09 Jun 2023 07:24:06 GMT
etag: W/"6482d396-1823c"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, s-maxage=15552000, max-age=15552000, must-revalidate
x-server: ImageKit.io
timing-allow-origin: *
access-control-allow-headers: *
x-amz-cf-id: YgkYBO1rmVs1X_hzVRgkYYo6BeWmRY3cMnAUAyltfAefSJHm9tJrUg==

GET
H2 200 related-posts.min.js Show response
ik.imagekit.io/qualys/wp-content/plugins/jetpack/_inc/build/related-posts/ 6 KB
2 KB 91ms
32ms Script
application/javascript 2600:9000:206f:8e00:15:c281:3500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ik.imagekit.io/qualys/wp-content/plugins/jetpack/_inc/build/related-posts/related-posts.min.js?ver=20211209
Requested by: Host: blog.qualys.com
URL: https://blog.qualys.com/vulnerabilities-threat-research/2023/01/03/bitrat-now-sharing-sensitive-bank-data-as-a-lure
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:8e00:15:c281:3500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: fe66ac5df69c78be7dfcf75943079129dbf24a254e89febc5a7e916d40de43bc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.qualys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Sat, 16 Sep 2023 00:26:37 GMT
content-encoding: br
via: 1.1 715791ebe4663055c84208b8a58b2b80.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
age: 5270369
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
x-request-id: 030b9c47-01fe-401c-87fa-9d69895973ff
last-modified: Fri, 09 Jun 2023 07:24:07 GMT
etag: W/"6482d397-160c"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, s-maxage=15552000, max-age=15552000, must-revalidate
x-server: ImageKit.io
timing-allow-origin: *
access-control-allow-headers: *
x-amz-cf-id: aNOiwSsLLUCfG497c84jwD8arpPacdVAs2qmKUt0os4FrCfqGGWSWw==

GET
H2 200 codemirror.min.js Show response
ik.imagekit.io/qualys/wp-includes/js/codemirror/ 572 KB
167 KB 79ms
20ms Script
application/javascript 2600:9000:206f:8e00:15:c281:3500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ik.imagekit.io/qualys/wp-includes/js/codemirror/codemirror.min.js?ver=5.29.1-alpha-ee20357
Requested by: Host: blog.qualys.com
URL: https://blog.qualys.com/vulnerabilities-threat-research/2023/01/03/bitrat-now-sharing-sensitive-bank-data-as-a-lure
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:8e00:15:c281:3500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: d61712eb28c66f9db763087ac7278a53e91ac6ecba4b52e8e4f19125d859a8b8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.qualys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Thu, 14 Sep 2023 06:26:01 GMT
content-encoding: br
via: 1.1 715791ebe4663055c84208b8a58b2b80.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
age: 5421605
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
x-request-id: 06f1ca9c-8556-48a8-bffc-ae9cbf9d868c
last-modified: Wed, 13 Sep 2017 06:08:47 GMT
etag: W/"59b8cb6f-8eec6"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, s-maxage=15552000, max-age=15552000, must-revalidate
x-server: ImageKit.io
timing-allow-origin: *
access-control-allow-headers: *
x-amz-cf-id: 20vAxmCCjq024icaNEWcIFB4ksLKdCHuQEZpK64DFK-cYx-72pFSfg==

GET
H2 404 link-arrow-left.svg
d1uyme8f6ss6qi.cloudfront.net/image/icon/ 0
0 55ms
8ms Image
text/html 18.245.78.109
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d1uyme8f6ss6qi.cloudfront.net/image/icon/link-arrow-left.svg
Requested by: Host: blog.qualys.com
URL: https://blog.qualys.com/vulnerabilities-threat-research/2023/01/03/bitrat-now-sharing-sensitive-bank-data-as-a-lure
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.245.78.109 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-245-78-109.fra60.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.qualys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

GET
H2 200 a5da0efab1b59e29fb9828966a05e5a0
secure.gravatar.com/avatar/ 25 KB
26 KB 27ms
6ms Image
image/png 2a04:fa87:fffe::c000:4902
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.gravatar.com/avatar/a5da0efab1b59e29fb9828966a05e5a0?s=110&d=mm&r=g
Requested by: Host: blog.qualys.com
URL: https://blog.qualys.com/vulnerabilities-threat-research/2023/01/03/bitrat-now-sharing-sensitive-bank-data-as-a-lure
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e8ceb4c940636888085c672ce04127bde618b31a0cc6e84b88ce45de880f4d49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.qualys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Thu, 16 Nov 2023 00:26:06 GMT
last-modified: Tue, 08 Feb 2022 10:36:18 GMT
server: nginx
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=300
content-disposition: inline; filename="a5da0efab1b59e29fb9828966a05e5a0.png"
accept-ranges: bytes
link: <https://www.gravatar.com/avatar/a5da0efab1b59e29fb9828966a05e5a0?s=110&d=mm&r=g>; rel="canonical"
content-length: 25836
alt-svc: h3=":443"; ma=86400
expires: Thu, 16 Nov 2023 00:31:06 GMT

GET
H2 200 a5da0efab1b59e29fb9828966a05e5a0
secure.gravatar.com/avatar/ 61 KB
62 KB 32ms
12ms Image
image/png 2a04:fa87:fffe::c000:4902
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.gravatar.com/avatar/a5da0efab1b59e29fb9828966a05e5a0?s=180&d=mm&r=g
Requested by: Host: blog.qualys.com
URL: https://blog.qualys.com/vulnerabilities-threat-research/2023/01/03/bitrat-now-sharing-sensitive-bank-data-as-a-lure
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: daa89579701492af907726862177f5d2169eb6c42a937510c5d4e5be20f60b7a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.qualys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Thu, 16 Nov 2023 00:26:06 GMT
last-modified: Tue, 08 Feb 2022 10:36:18 GMT
server: nginx
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=300
content-disposition: inline; filename="a5da0efab1b59e29fb9828966a05e5a0.png"
accept-ranges: bytes
link: <https://www.gravatar.com/avatar/a5da0efab1b59e29fb9828966a05e5a0?s=180&d=mm&r=g>; rel="canonical"
content-length: 62944
alt-svc: h3=":443"; ma=86400
expires: Thu, 16 Nov 2023 00:31:06 GMT

GET
H2 200 shariff.min.css
ik.imagekit.io/qualys/wp-content/plugins/shariff/css/ 7 KB
2 KB 23ms
22ms Stylesheet
text/css 2600:9000:206f:8e00:15:c281:3500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ik.imagekit.io/qualys/wp-content/plugins/shariff/css/shariff.min.css?ver=4.6.9
Requested by: Host: blog.qualys.com
URL: https://blog.qualys.com/vulnerabilities-threat-research/2023/01/03/bitrat-now-sharing-sensitive-bank-data-as-a-lure
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:8e00:15:c281:3500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 0cdaa2c316f414a77bcc5a930e9dcd7668619faac80d6a424a35c8a81d29d1fb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.qualys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Sat, 16 Sep 2023 00:26:37 GMT
content-encoding: br
via: 1.1 715791ebe4663055c84208b8a58b2b80.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
age: 5270369
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
x-request-id: 3a11b976-8df3-416d-858f-b706ce25c084
last-modified: Tue, 17 Jan 2023 14:41:23 GMT
etag: W/"63c6b393-1d97"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, s-maxage=15552000, max-age=15552000, must-revalidate
x-server: ImageKit.io
timing-allow-origin: *
access-control-allow-headers: *
x-amz-cf-id: wO_n0Jp7Yb-l1ghuBDQVSIDR3TwYPUag5guEAgWKYxnWSHAmy7zL6Q==

GET
H3 200 jquery.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/ 87 KB
28 KB 23ms
13ms Script
application/javascript 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/jquery.min.js

Requested by

Host: blog.qualys.com
URL: https://blog.qualys.com/vulnerabilities-threat-research/2023/01/03/bitrat-now-sharing-sensitive-bank-data-as-a-lure

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer
Origin: https://blog.qualys.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Thu, 16 Nov 2023 00:26:06 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 339173
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 27958
last-modified: Mon, 04 May 2020 23:01:39 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb09ed3-15d84"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wYFX3KoQJtzHGh16%2FkKDI2E5zV%2F4yM71sBfK%2BuBJZwoaA82gZJHiQwGrqfI1TmEqlLPoZviTpIDoM1PLYz1n%2BJUOZ1NpHnh%2BzssJgDin3Lt%2B4bMKJ3maF%2BxDrxtwkjvou%2BWMXwHKVgThFGgbsTLebl3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 826b99bed8b48fe6-FRA
expires: Tue, 05 Nov 2024 00:26:06 GMT

GET
H3 200 jquery-migrate.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery-migrate/3.3.2/ 11 KB
4 KB 15ms
15ms Script
application/javascript 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery-migrate/3.3.2/jquery-migrate.min.js

Requested by

Host: blog.qualys.com
URL: https://blog.qualys.com/vulnerabilities-threat-research/2023/01/03/bitrat-now-sharing-sensitive-bank-data-as-a-lure

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

106fcd8d723eda7d92a26893a439ccef998e5fc68ad228253607143d801e8cd8

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer
Origin: https://blog.qualys.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Thu, 16 Nov 2023 00:26:06 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 499663
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 3718
last-modified: Wed, 18 Nov 2020 00:51:42 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5fb4701e-2c03"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5IcOxDNwutDcqTsM7bSSKSx3ziLkIJqG0fHGn6k15TfOcJvGuApD48Zo6ZXUL5WcDKbvTjpbtdxDyOqwb32q93EVde%2Fp8PKmwL0i%2FaXwZplyjRKFwSXVZOvry69SoWIGgRS4AHoQ53AjaIjtrTv4Uhf5"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 826b99bf08cc8fe6-FRA
expires: Tue, 05 Nov 2024 00:26:06 GMT

GET
H3 200 underscore.min.js Show response
ik.imagekit.io/qualys/wp-includes/js/ 18 KB
7 KB 16ms
14ms Script
application/javascript 2600:9000:206f:8e00:15:c281:3500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ik.imagekit.io/qualys/wp-includes/js/underscore.min.js?ver=1.13.4
Requested by: Host: blog.qualys.com
URL: https://blog.qualys.com/vulnerabilities-threat-research/2023/01/03/bitrat-now-sharing-sensitive-bank-data-as-a-lure
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:9000:206f:8e00:15:c281:3500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 726b820e44f6ab90ad991d30a4bf26d3a5d71493cbcd1fb1efd0d14e89b9df2a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.qualys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 01 Aug 2023 08:07:48 GMT
content-encoding: br
via: 1.1 35a6ad9a7597ea2f4dacbdb5dc66a66c.cloudfront.net (CloudFront)
age: 9217098
x-amz-cf-pop: FRA56-C1
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
x-request-id: d9fcc1b4-883f-4dda-ae66-320ab91a0004
last-modified: Tue, 27 Sep 2022 15:18:25 GMT
etag: W/"63331441-4991"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, s-maxage=15552000, max-age=15552000, must-revalidate
x-server: ImageKit.io
timing-allow-origin: *
access-control-allow-headers: *
x-amz-cf-id: R57IAf3aq-OYCJWWPg47N4nzpddiNNNMoqba-EhhF7_fjrEdy_Daog==

GET
H2 200 highlight.min.js Show response
cdnjs.cloudflare.com/ajax/libs/highlight.js/11.6.0/ 118 KB
35 KB 16ms
12ms Script
application/javascript 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.6.0/highlight.min.js

Requested by

Host: blog.qualys.com
URL: https://blog.qualys.com/vulnerabilities-threat-research/2023/01/03/bitrat-now-sharing-sensitive-bank-data-as-a-lure

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e2fda3419c4ae8f6d911e676c65db38a8bfa347324b01160065c6d3195586d09

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.qualys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Thu, 16 Nov 2023 00:26:06 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 145287
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 35539
last-modified: Wed, 13 Jul 2022 16:35:15 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "62cef443-8ad3"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=f8K5UIiGuQP0z2yaoQjydSJdPE3PfAN3f1SzEGBAOejDfQ7CyqnjUB8zOVZQWL2TyEwTmH72E0uoriq7u1gAbyswS4skC5hBqQN5%2FBzYXIG26yrZwm83F9Xjw3jFBcMptsiNyV1QupCrTpDbvCJnhuqb"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 826b99bf38c868fd-FRA
expires: Tue, 05 Nov 2024 00:26:06 GMT

GET
H3 200 noframework.waypoints.min.js Show response
cdnjs.cloudflare.com/ajax/libs/waypoints/4.0.1/ 10 KB
3 KB 17ms
16ms Script
application/javascript 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/waypoints/4.0.1/noframework.waypoints.min.js

Requested by

Host: blog.qualys.com
URL: https://blog.qualys.com/vulnerabilities-threat-research/2023/01/03/bitrat-now-sharing-sensitive-bank-data-as-a-lure

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5c9bac96e8ccddc1b34591a24a2fca352764e7cb8e44efe69ab11036356d6f99

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.qualys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Thu, 16 Nov 2023 00:26:06 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 1289963
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 2750
last-modified: Mon, 04 May 2020 16:17:51 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb0402f-282b"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CbWTwgw%2Flkjq1Lf3UkLOmOg4fUnjpk6cuBVycfSfGfPZM0K8MYf5w6ADkI3MBNByZEWairvZ644fIl%2Fo24j9aV%2Bf5SihDGWjipR4R33ny0DNM6sE7oFEggDW6a%2FecJpZot8BQbdssBRxq4L1smCX5Tai"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 826b99bf6d3418ff-FRA
expires: Tue, 05 Nov 2024 00:26:06 GMT

GET
H3 200 script.js Show response
ik.imagekit.io/qualys/wp-content/themes/qualys2020/script/ 14 KB
4 KB 10ms
8ms Script
application/javascript 2600:9000:206f:8e00:15:c281:3500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ik.imagekit.io/qualys/wp-content/themes/qualys2020/script/script.js?ver=1.0.3
Requested by: Host: blog.qualys.com
URL: https://blog.qualys.com/vulnerabilities-threat-research/2023/01/03/bitrat-now-sharing-sensitive-bank-data-as-a-lure
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:9000:206f:8e00:15:c281:3500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 91b7632508bd4c9d5fa60c8430bd760190935c072feb2227c0cf3521bfdb9d24

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.qualys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 08:34:25 GMT
content-encoding: br
via: 1.1 35a6ad9a7597ea2f4dacbdb5dc66a66c.cloudfront.net (CloudFront)
age: 2649101
x-amz-cf-pop: FRA56-C1
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
x-request-id: a1f0d4f6-fed7-4fa2-8b0c-3e0e152fd05b
last-modified: Mon, 13 Feb 2023 06:58:59 GMT
etag: W/"63e9dfb3-3659"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, s-maxage=15552000, max-age=15552000, must-revalidate
x-server: ImageKit.io
timing-allow-origin: *
access-control-allow-headers: *
x-amz-cf-id: 1q7GZ5gZGKFiNX86p-9UvSfX5Q6hYSsJ5dNvIBEAkV-IuJedVinjpQ==

GET
H3 200 comment-reply.min.js Show response
ik.imagekit.io/qualys/wp-includes/js/ 3 KB
2 KB 12ms
10ms Script
application/javascript 2600:9000:206f:8e00:15:c281:3500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ik.imagekit.io/qualys/wp-includes/js/comment-reply.min.js?ver=6.3.2
Requested by: Host: blog.qualys.com
URL: https://blog.qualys.com/vulnerabilities-threat-research/2023/01/03/bitrat-now-sharing-sensitive-bank-data-as-a-lure
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:9000:206f:8e00:15:c281:3500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e174a58a503ab84b3d1b9de12fd3895788204485170f1289e445f7b5b98ec789

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.qualys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 02:04:26 GMT
content-encoding: br
via: 1.1 35a6ad9a7597ea2f4dacbdb5dc66a66c.cloudfront.net (CloudFront)
age: 166900
x-amz-cf-pop: FRA56-C1
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
x-request-id: 1d7360fd-2063-4ffe-9678-d9a0e3f6c8a3
last-modified: Fri, 08 Apr 2022 20:07:18 GMT
etag: W/"625095f6-ba5"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, s-maxage=15552000, max-age=15552000, must-revalidate
x-server: ImageKit.io
timing-allow-origin: *
access-control-allow-headers: *
x-amz-cf-id: 9Z_s0Shn6B7IL4B2QEK0uIiNWvT45CjbSKPq54W6TYEl-z2q3XSZ-A==

GET
H2 200 CoveoJsSearch.Lazy.min.js Show response
static.cloud.coveo.com/searchui/v2.10085/2/js/ 802 KB
223 KB 11ms
8ms Script
application/javascript 143.204.215.33
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.cloud.coveo.com/searchui/v2.10085/2/js/CoveoJsSearch.Lazy.min.js
Requested by: Host: blog.qualys.com
URL: https://blog.qualys.com/vulnerabilities-threat-research/2023/01/03/bitrat-now-sharing-sensitive-bank-data-as-a-lure
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.215.33 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-215-33.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 1e8c04b727387aafa93f41a94bd4ddf35ccc842a9706da67d471d45a7d721145

Request headers

Referer: https://blog.qualys.com/
Origin: https://blog.qualys.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

x-amz-version-id: cPgQD6G5.IQGkLVs3h4I7RD7CXivsMzE
content-encoding: gzip
via: 1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
date: Thu, 16 Nov 2023 00:26:04 GMT
age: 86
x-amz-cf-pop: FRA53-C1
x-cache: Hit from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
x-amz-replication-status: COMPLETED
last-modified: Wed, 05 May 2021 21:45:32 GMT
server: AmazonS3
etag: W/"94af72b64202017562a248983494a941"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=86400;
x-amz-cf-id: SmkBYuMiYoXXctv3hWF9J3DJz4JIcHRj055vLxD_-erv4xqYvk_8Dw==

GET
H3 200 coveo.js Show response
ik.imagekit.io/qualys/wp-content/themes/qualys2020/script/ 913 B
1 KB 13ms
11ms Script
application/javascript 2600:9000:206f:8e00:15:c281:3500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ik.imagekit.io/qualys/wp-content/themes/qualys2020/script/coveo.js
Requested by: Host: blog.qualys.com
URL: https://blog.qualys.com/vulnerabilities-threat-research/2023/01/03/bitrat-now-sharing-sensitive-bank-data-as-a-lure
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:9000:206f:8e00:15:c281:3500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 8acc85a425552781bfcb3cc21f375b7a6bd04b196aa295c9e9ba0d94192a72d6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.qualys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Sat, 04 Nov 2023 22:10:49 GMT
via: 1.1 35a6ad9a7597ea2f4dacbdb5dc66a66c.cloudfront.net (CloudFront)
age: 958517
x-amz-cf-pop: FRA56-C1
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 913
x-request-id: ad30fc22-d88c-44af-875a-1e6f276fe5fd
last-modified: Tue, 30 Jun 2020 21:43:06 GMT
etag: "5efbb1ea-391"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, s-maxage=15552000, max-age=15552000, must-revalidate
x-server: ImageKit.io
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: *
x-amz-cf-id: vhDg2Ka0HWRa3lzWgJPJbyI-_t_KL8Ck-lCSgNrW1LWRT7gCRkkgcw==

GET
H3 200 jquery.fancybox.min.js Show response
cdnjs.cloudflare.com/ajax/libs/fancybox/3.5.7/ 67 KB
19 KB 17ms
15ms Script
application/javascript 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/fancybox/3.5.7/jquery.fancybox.min.js

Requested by

Host: blog.qualys.com
URL: https://blog.qualys.com/vulnerabilities-threat-research/2023/01/03/bitrat-now-sharing-sensitive-bank-data-as-a-lure

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cadda460ccb4c3c01bb45f3d5976f63f5adf8dc3ff1d31cb4fbd3ded4f18e5bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.qualys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Thu, 16 Nov 2023 00:26:06 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 619054
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 19249
last-modified: Mon, 04 May 2020 16:10:00 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03e58-10a9d"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qlIR53wV95yxXgpN7FXQDrrkQFMDmFmD8z%2Bs7RzRzXTz40lLHe07qQdS%2FVfyFjOUyIxNr%2FYIAqnvxL%2F0AmVcspmfSgYhFNlrDKb7APEfm3Ucrd2o99BsnXXt1f%2BmVV6oFb4cKXFIifiUGu%2BQGDRst3Ig"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 826b99bf6d3a18ff-FRA
expires: Tue, 05 Nov 2024 00:26:06 GMT

GET
H2 200 e-202346.js Show response
stats.wp.com/ 7 KB
3 KB 41ms
7ms Script
application/javascript 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.wp.com/e-202346.js
Requested by: Host: blog.qualys.com
URL: https://blog.qualys.com/vulnerabilities-threat-research/2023/01/03/bitrat-now-sharing-sensitive-bank-data-as-a-lure
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ca7752fb33cf3a98c0f29bc4eec563112025da4109a0dcc69dabf5f861751258

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.qualys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

x-minify-cache: hit
x-nc: HIT hhn
date: Thu, 16 Nov 2023 00:26:06 GMT
content-encoding: br
server: nginx
x-minify: t
etag: W/13576-1695421998473.3982
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
expires: Mon, 11 Nov 2024 12:17:15 GMT

GET
H3 200 jetpack-carousel.min.js Show response
ik.imagekit.io/qualys/wp-content/plugins/jetpack/_inc/build/carousel/ 24 KB
7 KB 12ms
10ms Script
application/javascript 2600:9000:206f:8e00:15:c281:3500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ik.imagekit.io/qualys/wp-content/plugins/jetpack/_inc/build/carousel/jetpack-carousel.min.js?ver=12.2
Requested by: Host: blog.qualys.com
URL: https://blog.qualys.com/vulnerabilities-threat-research/2023/01/03/bitrat-now-sharing-sensitive-bank-data-as-a-lure
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:9000:206f:8e00:15:c281:3500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 0200bc38d986631f9cc4680084d7d263ccf17fa4a3c627b26ff347e0cfcf1d47

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.qualys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 08:34:25 GMT
content-encoding: br
via: 1.1 35a6ad9a7597ea2f4dacbdb5dc66a66c.cloudfront.net (CloudFront)
age: 2649101
x-amz-cf-pop: FRA56-C1
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
x-request-id: 959794ad-463c-4fbf-bfc0-ed46adde1d4b
last-modified: Fri, 09 Jun 2023 07:24:07 GMT
etag: W/"6482d397-5e2d"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, s-maxage=15552000, max-age=15552000, must-revalidate
x-server: ImageKit.io
timing-allow-origin: *
access-control-allow-headers: *
x-amz-cf-id: GchhNp3nPpfiiYgxxaawLSoACHu0ScEE6ZvQjcz97nsse1K3WM3psw==

GET
H3 200 akismet-frontend.js Show response
ik.imagekit.io/qualys/wp-content/plugins/akismet/_inc/ 10 KB
3 KB 13ms
12ms Script
application/javascript 2600:9000:206f:8e00:15:c281:3500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ik.imagekit.io/qualys/wp-content/plugins/akismet/_inc/akismet-frontend.js?ver=1686295423
Requested by: Host: blog.qualys.com
URL: https://blog.qualys.com/vulnerabilities-threat-research/2023/01/03/bitrat-now-sharing-sensitive-bank-data-as-a-lure
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:9000:206f:8e00:15:c281:3500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 5734f1b66dcb622529d435aba20990813d43553f949bc0813719b4e7d1252527

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.qualys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Mon, 09 Oct 2023 00:18:33 GMT
content-encoding: br
via: 1.1 35a6ad9a7597ea2f4dacbdb5dc66a66c.cloudfront.net (CloudFront)
age: 3283653
x-amz-cf-pop: FRA56-C1
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
x-request-id: 0e58b160-45f8-4a25-b60d-892bfa5ed400
last-modified: Fri, 09 Jun 2023 07:23:43 GMT
etag: W/"6482d37f-29ed"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, s-maxage=15552000, max-age=15552000, must-revalidate
x-server: ImageKit.io
timing-allow-origin: *
access-control-allow-headers: *
x-amz-cf-id: fXkXtV-YJ0Wmi-IJLXM41ZWwEqL5OHMo8F36wEHpu8_neb236RxLMg==

GET
H2 200 prum.min.js Show response
rum-static.pingdom.net/ 6 KB
3 KB 64ms
17ms Script
application/javascript 2606:4700:10::6816:3768
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://rum-static.pingdom.net/prum.min.js
Requested by: Host: blog.qualys.com
URL: https://blog.qualys.com/vulnerabilities-threat-research/2023/01/03/bitrat-now-sharing-sensitive-bank-data-as-a-lure
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3768 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1d5cfe14d65accc4bd1df0d7c3bb65be70d0f4e94a5f9d40465343a2807548ae

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.qualys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Thu, 16 Nov 2023 00:26:06 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Fri, 14 Oct 2022 06:22:29 GMT
server: cloudflare
age: 3471
etag: W/"63490025-1849"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=43200
cf-ray: 826b99bfbb7f4dc3-FRA

GET
H2 200 css
fonts.googleapis.com/ 2 KB
837 B 47ms
23ms Stylesheet
text/css 2a00:1450:4001:809::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Lato:300,400,700

Requested by

Host: static.cloud.coveo.com
URL: https://static.cloud.coveo.com/searchui/v2.10085/2/css/CoveoFullSearch.min.css?ver=6.3.2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

4ea2880bbb5055eb6493499d243a86911663924955d78ac35d672a5a0e9995ae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://static.cloud.coveo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 16 Nov 2023 00:26:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 15 Nov 2023 23:09:19 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 16 Nov 2023 00:26:06 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 249 KB
84 KB 77ms
28ms Script
application/javascript 2a00:1450:4001:830::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-W7DWPS

Requested by

Host: blog.qualys.com
URL: https://blog.qualys.com/vulnerabilities-threat-research/2023/01/03/bitrat-now-sharing-sensitive-bank-data-as-a-lure

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d2c5106cd0f3e4a43f2a4cba1838341edba34ec32cdbc5ea14496a381a0f7049

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.qualys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Thu, 16 Nov 2023 00:26:06 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 85877
x-xss-protection: 0
last-modified: Thu, 16 Nov 2023 00:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 16 Nov 2023 00:26:06 GMT

GET
H3 200 zoom-icon.svg
ik.imagekit.io/qualys/wp-content/themes/qualys2020/image/ 713 B
1 KB 12ms
10ms Image
image/svg+xml 2600:9000:206f:8e00:15:c281:3500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ik.imagekit.io/qualys/wp-content/themes/qualys2020/image/zoom-icon.svg
Requested by: Host: ik.imagekit.io
URL: https://ik.imagekit.io/qualys/wp-content/themes/qualys2020/style.css?ver=1.0.3
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:9000:206f:8e00:15:c281:3500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: c396302d723c104daaec67ce091daf21cbfe63a1f4d514528ba6df0929c33cf7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ik.imagekit.io/qualys/wp-content/themes/qualys2020/style.css?ver=1.0.3
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Mon, 11 Sep 2023 10:41:41 GMT
via: 1.1 dd09b3b5f5b8dc626e1ba6804a73af40.cloudfront.net (CloudFront), 1.1 35a6ad9a7597ea2f4dacbdb5dc66a66c.cloudfront.net (CloudFront)
age: 5665465
x-amz-cf-pop: FRA56-C1
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 713
x-request-id: 2fff2dbc-4c88-4e0d-8fbc-8c964c14de2b
last-modified: Mon, 10 Apr 2023 22:21:17 GMT
etag: "3cc9d1027f30d839c311711a3b94dc5e"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, s-maxage=15552000, max-age=15552000, must-revalidate
x-server: ImageKit.io
timing-allow-origin: *
access-control-allow-headers: *
x-amz-cf-id: qpnPUpG1KHkrIz0Y4FDdMNox663fFaCA8x9lPbZ6WMTkt6BPCFtMZg==

GET
H2 200 gotham-book.woff2
d1uyme8f6ss6qi.cloudfront.net/font/ 40 KB
41 KB 34ms
10ms Font
font/woff2 18.245.78.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://d1uyme8f6ss6qi.cloudfront.net/font/gotham-book.woff2

Requested by

Host: ik.imagekit.io
URL: https://ik.imagekit.io/qualys/wp-content/themes/qualys2020/style/shared.css?ver=1.0.3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.78.109 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-78-109.fra60.r.cloudfront.net

Software

Apache /

Resource Hash

3309103ad665897d5aaaaf67fe4a5af8d493491481ab773db70d2f3d42b32b0a

Security Headers

Name	Value
Content-Security-Policy	block-all-mixed-content; frame-ancestors 'self' qualys.com *.qualys.com;
Strict-Transport-Security	max-age=63113904
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ik.imagekit.io/
Origin: https://blog.qualys.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

content-security-policy: block-all-mixed-content; frame-ancestors 'self' qualys.com *.qualys.com;
strict-transport-security: max-age=63113904
x-content-type-options: nosniff
date: Wed, 15 Nov 2023 08:12:14 GMT
via: 1.1 6e4ed2b1996ce238462d61d3bfff667a.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 58431
content-security-policy-report-only: default-src https: data: 'unsafe-inline' 'unsafe-eval'; report-uri https://qualys.report-uri.com/r/d/csp/reportOnly
x-cache: Hit from cloudfront
content-length: 40776
q: 61
x-xss-protection: 1; mode=block
referrer-policy: no-referrer, strict-origin-when-cross-origin
last-modified: Mon, 12 Dec 2022 08:53:49 GMT
server: Apache
etag: "9f48-5ef9da44d8140"
x-frame-options: SAMEORIGIN
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=86400
accept-ranges: bytes
x-amz-cf-id: vcX4fiQ67hST3v6RDrUNIcSCwNS4vFdRuvbRuZFAMFxK6t58xyhaNA==
expires: Thu, 16 Nov 2023 08:12:14 GMT

GET
H2 200 gotham-medium.woff2
d1uyme8f6ss6qi.cloudfront.net/font/ 40 KB
41 KB 39ms
15ms Font
font/woff2 18.245.78.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://d1uyme8f6ss6qi.cloudfront.net/font/gotham-medium.woff2

Requested by

Host: ik.imagekit.io
URL: https://ik.imagekit.io/qualys/wp-content/themes/qualys2020/style/shared.css?ver=1.0.3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.78.109 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-78-109.fra60.r.cloudfront.net

Software

Apache /

Resource Hash

0af4cea7d0b9eeb9f28897580823c4e59d5a53d8da4f2b3a282e8313b95a2375

Security Headers

Name	Value
Content-Security-Policy	block-all-mixed-content; frame-ancestors 'self' qualys.com *.qualys.com;
Strict-Transport-Security	max-age=63113904
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ik.imagekit.io/
Origin: https://blog.qualys.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

content-security-policy: block-all-mixed-content; frame-ancestors 'self' qualys.com *.qualys.com;
strict-transport-security: max-age=63113904
x-content-type-options: nosniff
date: Wed, 15 Nov 2023 08:43:01 GMT
via: 1.1 6e4ed2b1996ce238462d61d3bfff667a.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 56598
content-security-policy-report-only: default-src https: data: 'unsafe-inline' 'unsafe-eval'; report-uri https://qualys.report-uri.com/r/d/csp/reportOnly
x-cache: Hit from cloudfront
content-length: 40704
q: 62
x-xss-protection: 1; mode=block
referrer-policy: no-referrer, strict-origin-when-cross-origin
last-modified: Mon, 12 Dec 2022 08:53:51 GMT
server: Apache
etag: "9f00-5ef9da46c05c0"
x-frame-options: SAMEORIGIN
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=86400
accept-ranges: bytes
x-amz-cf-id: yPuxiCzfDcDUQ89gyNsBEJth8tdqtrc3MSV0RKazR-G8Ume_dlhYlA==
expires: Thu, 16 Nov 2023 08:42:48 GMT

GET
H2 200 gotham-light.woff2
d1uyme8f6ss6qi.cloudfront.net/font/ 39 KB
40 KB 33ms
9ms Font
font/woff2 18.245.78.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://d1uyme8f6ss6qi.cloudfront.net/font/gotham-light.woff2

Requested by

Host: ik.imagekit.io
URL: https://ik.imagekit.io/qualys/wp-content/themes/qualys2020/style/shared.css?ver=1.0.3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.78.109 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-78-109.fra60.r.cloudfront.net

Software

Apache /

Resource Hash

7313da4a164ef6d375d0919efb4592a24d585f6936ea7a54e7923e6695bd0ea4

Security Headers

Name	Value
Content-Security-Policy	block-all-mixed-content; frame-ancestors 'self' qualys.com *.qualys.com;
Strict-Transport-Security	max-age=63113904
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ik.imagekit.io/
Origin: https://blog.qualys.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

content-security-policy: block-all-mixed-content; frame-ancestors 'self' qualys.com *.qualys.com;
strict-transport-security: max-age=63113904
x-content-type-options: nosniff
date: Wed, 15 Nov 2023 08:12:15 GMT
via: 1.1 6e4ed2b1996ce238462d61d3bfff667a.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 58431
content-security-policy-report-only: default-src https: data: 'unsafe-inline' 'unsafe-eval'; report-uri https://qualys.report-uri.com/r/d/csp/reportOnly
x-cache: Hit from cloudfront
content-length: 39880
q: 61
x-xss-protection: 1; mode=block
referrer-policy: no-referrer, strict-origin-when-cross-origin
last-modified: Mon, 12 Dec 2022 08:53:50 GMT
server: Apache
etag: "9bc8-5ef9da45cc380"
x-frame-options: SAMEORIGIN
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=86400
accept-ranges: bytes
x-amz-cf-id: HTMXpb4k6JilkOCc1z0xjd3lakTTpTwmCibtw-65S-lwKIxV7QTvfw==
expires: Thu, 16 Nov 2023 08:12:15 GMT

GET
H2 200 caecilia-lt-pro-55-roman.woff2
d1uyme8f6ss6qi.cloudfront.net/font/ 31 KB
32 KB 32ms
9ms Font
font/woff2 18.245.78.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://d1uyme8f6ss6qi.cloudfront.net/font/caecilia-lt-pro-55-roman.woff2

Requested by

Host: ik.imagekit.io
URL: https://ik.imagekit.io/qualys/wp-content/themes/qualys2020/style/shared.css?ver=1.0.3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.78.109 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-78-109.fra60.r.cloudfront.net

Software

Apache /

Resource Hash

0ff098e4f46d0ce132a4b5b2aeb46511fabc66902b69c27b7f0f1e0101e85e19

Security Headers

Name	Value
Content-Security-Policy	block-all-mixed-content; frame-ancestors 'self' qualys.com *.qualys.com;
Strict-Transport-Security	max-age=63113904
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ik.imagekit.io/
Origin: https://blog.qualys.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Wed, 15 Nov 2023 06:54:39 GMT
content-security-policy: block-all-mixed-content; frame-ancestors 'self' qualys.com *.qualys.com;
x-content-type-options: nosniff
strict-transport-security: max-age=63113904
via: 1.1 6e4ed2b1996ce238462d61d3bfff667a.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 63087
content-security-policy-report-only: default-src https: data: 'unsafe-inline' 'unsafe-eval'; report-uri https://qualys.report-uri.com/r/d/csp/reportOnly
x-cache: Hit from cloudfront
content-length: 32168
q: 63
x-xss-protection: 1; mode=block
referrer-policy: no-referrer, strict-origin-when-cross-origin
last-modified: Tue, 07 Dec 2021 06:01:49 GMT
server: Apache
etag: "7da8-5d2881be60d40"
x-frame-options: SAMEORIGIN
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=86400
accept-ranges: bytes
x-amz-cf-id: uMj_gx5AEpPIxYzsnMyNM73H3KSB06HODWh_TGI2CdQlJjex04zzHA==
expires: Thu, 16 Nov 2023 06:54:39 GMT

GET
H2 200 caecilia-lt-pro-76-bold-italic.woff2
d1uyme8f6ss6qi.cloudfront.net/font/ 32 KB
33 KB 29ms
8ms Font
font/woff2 18.245.78.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://d1uyme8f6ss6qi.cloudfront.net/font/caecilia-lt-pro-76-bold-italic.woff2

Requested by

Host: ik.imagekit.io
URL: https://ik.imagekit.io/qualys/wp-content/themes/qualys2020/style/shared.css?ver=1.0.3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.78.109 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-78-109.fra60.r.cloudfront.net

Software

Apache /

Resource Hash

45556b0961111a978c99204ba48a1dccaf91b65a962cbb0dbb8cf7b4977b5099

Security Headers

Name	Value
Content-Security-Policy	block-all-mixed-content; frame-ancestors 'self' qualys.com *.qualys.com;
Strict-Transport-Security	max-age=63113904
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ik.imagekit.io/
Origin: https://blog.qualys.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Wed, 15 Nov 2023 07:15:19 GMT
content-security-policy: block-all-mixed-content; frame-ancestors 'self' qualys.com *.qualys.com;
x-content-type-options: nosniff
strict-transport-security: max-age=63113904
via: 1.1 6e4ed2b1996ce238462d61d3bfff667a.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 61847
content-security-policy-report-only: default-src https: data: 'unsafe-inline' 'unsafe-eval'; report-uri https://qualys.report-uri.com/r/d/csp/reportOnly
x-cache: Hit from cloudfront
content-length: 33176
q: 63
x-xss-protection: 1; mode=block
referrer-policy: no-referrer, strict-origin-when-cross-origin
last-modified: Tue, 07 Dec 2021 06:01:49 GMT
server: Apache
etag: "8198-5d2881be60d40"
x-frame-options: SAMEORIGIN
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=86400
accept-ranges: bytes
x-amz-cf-id: XE_i8hCCfUYBX9YrwPwyO5hC8f2atvCnWXyn-jpnc_voNDuFZqyVqg==
expires: Thu, 16 Nov 2023 07:15:19 GMT

GET
H3 200 Fig.1.png
ik.imagekit.io/qualys/wp-content/uploads/2023/01/ 69 KB
69 KB 15ms
14ms Image
image/webp 2600:9000:206f:8e00:15:c281:3500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ik.imagekit.io/qualys/wp-content/uploads/2023/01/Fig.1.png
Requested by: Host: blog.qualys.com
URL: https://blog.qualys.com/vulnerabilities-threat-research/2023/01/03/bitrat-now-sharing-sensitive-bank-data-as-a-lure
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:9000:206f:8e00:15:c281:3500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 404bd2dfffb845dd50a8654351f77c4d8789b6ca45a6adaabac40a624a300f8e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.qualys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Thu, 16 Nov 2023 00:24:40 GMT
via: 1.1 6b85d8725dd6471c3db1f65d4096afc4.cloudfront.net (CloudFront), 1.1 35a6ad9a7597ea2f4dacbdb5dc66a66c.cloudfront.net (CloudFront)
age: 86
x-amz-cf-pop: FRA56-C1
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 70662
x-request-id: 3b631ae8-9b9e-4310-b5ff-4c635a38ef2d
last-modified: Tue, 26 Sep 2023 01:51:51 GMT
etag: "c8927d5d8a9709fdb839da5aa8550e9d"
vary: Accept
access-control-allow-methods: GET
content-type: image/webp
access-control-allow-origin: *
cache-control: public, s-maxage=15552000, max-age=15552000, must-revalidate
x-server: ImageKit.io
timing-allow-origin: *
access-control-allow-headers: *
x-amz-cf-id: VSb59VHt0FsYhRqYQ2GpNASPfj843y8bo7_Ir07B2OzcngGwzg6IlQ==

GET
H3 200 Fig.2.png
ik.imagekit.io/qualys/wp-content/uploads/2023/01/ 40 KB
41 KB 14ms
11ms Image
image/png 2600:9000:206f:8e00:15:c281:3500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ik.imagekit.io/qualys/wp-content/uploads/2023/01/Fig.2.png
Requested by: Host: blog.qualys.com
URL: https://blog.qualys.com/vulnerabilities-threat-research/2023/01/03/bitrat-now-sharing-sensitive-bank-data-as-a-lure
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:9000:206f:8e00:15:c281:3500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 0bcd1094a0d8c4a92d8bdd534808901e64201425928908db5b0964fb76125d14

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.qualys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 08:39:29 GMT
via: 1.1 a2eae5bb517678c9d6b43a2731b4462e.cloudfront.net (CloudFront), 1.1 35a6ad9a7597ea2f4dacbdb5dc66a66c.cloudfront.net (CloudFront)
age: 143197
x-amz-cf-pop: FRA56-C1
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 41186
x-request-id: 0260f1ce-6ed8-4598-ac3c-40ca21292dc3
last-modified: Thu, 28 Sep 2023 13:12:43 GMT
etag: "a82aac8929abc264fd75cf09f1fb6093"
vary: Accept
access-control-allow-methods: GET
content-type: image/png
access-control-allow-origin: *
cache-control: public, s-maxage=15552000, max-age=15552000, must-revalidate
x-server: ImageKit.io
timing-allow-origin: *
access-control-allow-headers: *
x-amz-cf-id: L0BkaGlX-JByJTCq7br9BRPqQ969Awr1wMQBH5Aq_r3_tqTZjwqIOQ==

GET
H3 200 Fig.3.png
ik.imagekit.io/qualys/wp-content/uploads/2023/01/ 75 KB
75 KB 11ms
7ms Image
image/png 2600:9000:206f:8e00:15:c281:3500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ik.imagekit.io/qualys/wp-content/uploads/2023/01/Fig.3.png
Requested by: Host: blog.qualys.com
URL: https://blog.qualys.com/vulnerabilities-threat-research/2023/01/03/bitrat-now-sharing-sensitive-bank-data-as-a-lure
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:9000:206f:8e00:15:c281:3500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e7aae1b0b12b68958dded270bb1ec482d90168ff8c253e963af70f05288bd74a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.qualys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 08:39:33 GMT
via: 1.1 e016ea20838aeed1d878a5244c9e2552.cloudfront.net (CloudFront), 1.1 35a6ad9a7597ea2f4dacbdb5dc66a66c.cloudfront.net (CloudFront)
age: 143193
x-amz-cf-pop: FRA56-C1
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 76422
x-request-id: 314e3a94-fd85-45d3-bfda-d08528e358a3
last-modified: Sat, 30 Sep 2023 17:39:03 GMT
etag: "0187ab2a04ed02b1f586069a33531383"
vary: Accept
access-control-allow-methods: GET
content-type: image/png
access-control-allow-origin: *
cache-control: public, s-maxage=15552000, max-age=15552000, must-revalidate
x-server: ImageKit.io
timing-allow-origin: *
access-control-allow-headers: *
x-amz-cf-id: gvzFfCjcSyFCBqxdLKu8sMCxzaL2pf9oJeLe2RTpk-zyGZrlddaykg==

GET
H3 200 Fig.4.png
ik.imagekit.io/qualys/wp-content/uploads/2023/01/ 142 KB
142 KB 14ms
11ms Image
image/webp 2600:9000:206f:8e00:15:c281:3500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ik.imagekit.io/qualys/wp-content/uploads/2023/01/Fig.4.png
Requested by: Host: blog.qualys.com
URL: https://blog.qualys.com/vulnerabilities-threat-research/2023/01/03/bitrat-now-sharing-sensitive-bank-data-as-a-lure
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:9000:206f:8e00:15:c281:3500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: cac678b284e21891b5de49e8f65f7f91de645ac3f297fac37b922c0f0715b3f6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.qualys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 08:39:39 GMT
via: 1.1 61c90c70feca5f532bf48bc0dc85d516.cloudfront.net (CloudFront), 1.1 35a6ad9a7597ea2f4dacbdb5dc66a66c.cloudfront.net (CloudFront)
age: 143186
x-amz-cf-pop: FRA56-C1
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 145148
x-request-id: 2e8813bc-824e-4cf9-8410-02c64d889634
last-modified: Mon, 25 Sep 2023 12:56:03 GMT
etag: "2c1143ea53e04e864da2c35fe72edebb"
vary: Accept
access-control-allow-methods: GET
content-type: image/webp
access-control-allow-origin: *
cache-control: public, s-maxage=15552000, max-age=15552000, must-revalidate
x-server: ImageKit.io
timing-allow-origin: *
access-control-allow-headers: *
x-amz-cf-id: AtoHYi1S0UEvCfnN-W7P5QYpmO5pm05dF1012Ua3Flue1m5x5lnePQ==

POST
H2 200 admin-ajax.php Show response
blog.qualys.com/wp-admin/ 1 KB
1 KB 207ms
207ms XHR
text/html 35.230.125.173
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.qualys.com/wp-admin/admin-ajax.php

Requested by

Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/jquery.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

35.230.125.173 The Dalles, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

173.125.230.35.bc.googleusercontent.com

Software

nginx / WP Engine

Resource Hash

0e29efc0a83b101298ba80eeac53e1b3a9a30641cbe700c0b4bda8df6d83f57f

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://blog.qualys.com/vulnerabilities-threat-research/2023/01/03/bitrat-now-sharing-sensitive-bank-data-as-a-lure
X-Requested-With: XMLHttpRequest
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

date: Thu, 16 Nov 2023 00:26:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-powered-by: WP Engine
content-length: 697
referrer-policy: strict-origin-when-cross-origin
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
access-control-allow-origin: https://blog.qualys.com
cache-control: no-cache, must-revalidate, max-age=0
access-control-allow-credentials: true
x-robots-tag: noindex
expires: Wed, 11 Jan 1984 05:00:00 GMT

POST
H2 200 admin-ajax.php Show response
blog.qualys.com/wp-admin/ 1020 B
983 B 274ms
273ms XHR
text/html 35.230.125.173
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.qualys.com/wp-admin/admin-ajax.php

Requested by

Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/jquery.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

35.230.125.173 The Dalles, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

173.125.230.35.bc.googleusercontent.com

Software

nginx / WP Engine

Resource Hash

a008f90701130011191c15103780ae40c2c3c56f13fb131cc3e75da3b0ff020d

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://blog.qualys.com/vulnerabilities-threat-research/2023/01/03/bitrat-now-sharing-sensitive-bank-data-as-a-lure
X-Requested-With: XMLHttpRequest
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

date: Thu, 16 Nov 2023 00:26:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-powered-by: WP Engine
content-length: 568
referrer-policy: strict-origin-when-cross-origin
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
access-control-allow-origin: https://blog.qualys.com
cache-control: no-cache, must-revalidate, max-age=0
access-control-allow-credentials: true
x-robots-tag: noindex
expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 268 KB
89 KB 26ms
20ms Script
application/javascript 2a00:1450:4001:830::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-3RJMG209BM&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-W7DWPS

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

47a02580d2862e4edee6133d3abf2ac9b9b1f719d6ef071f0169843a098e5d9d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.qualys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Thu, 16 Nov 2023 00:26:06 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 91437
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Thu, 16 Nov 2023 00:26:06 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 34ms
6ms Script
text/javascript 2a00:1450:4001:830::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-W7DWPS

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.qualys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 15 Nov 2023 23:49:41 GMT
last-modified: Mon, 12 Jun 2023 18:23:07 GMT
server: Golfe2
age: 2185
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Thu, 16 Nov 2023 01:49:41 GMT

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 12 KB
4 KB 42ms
7ms Script
application/javascript 2a02:26f0:480:f::213:7ec6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-W7DWPS

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:480:f::213:7ec6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

f88f89a0cead9c36ddbe19508f32f64bd91e94e92b6006dd575e8d0deb317d7f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.qualys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Thu, 16 Nov 2023 00:26:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 15 Nov 2023 09:07:27 GMT
x-cdn: AKAM
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
cache-control: max-age=31217
accept-ranges: bytes
content-length: 3840

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/ 1 KB
1 KB 45ms
9ms Script
application/x-javascript 23.192.243.198
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/munchkin.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-W7DWPS
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.192.243.198 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-192-243-198.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.qualys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

Date: Thu, 16 Nov 2023 00:26:06 GMT
Content-Encoding: gzip
Last-Modified: Fri, 17 Mar 2023 01:24:48 GMT
Server: AkamaiNetStorage
ETag: "cb731cc5c2bd9f31d6bfeb19f3c8b1ff:1679016288.730763"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Content-Type: application/x-javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 729

GET
H2 200 geoip2.js Show response
js.maxmind.com/js/apis/geoip2/v2.1/ 3 KB
1 KB 60ms
20ms Script
application/javascript 2606:4700:7::a29f:8716
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.maxmind.com/js/apis/geoip2/v2.1/geoip2.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-W7DWPS
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:7::a29f:8716 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 94a96a4fc313fe6dfba290ed6bc0e802eaab40810e59032a06f6774553b1c6ae

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.qualys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Thu, 16 Nov 2023 00:26:06 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Wed, 15 Nov 2023 23:57:35 GMT
server: cloudflare
age: 1711
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=14400
cf-ray: 826b99c14d306928-FRA
expires: Thu, 16 Nov 2023 04:26:06 GMT

GET
H2 200 j.php Show response
dev.visualwebsiteoptimizer.com/ 3 KB
2 KB 63ms
16ms Script
application/javascript 34.96.102.137
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/j.php?a=590650&u=https%3A%2F%2Fblog.qualys.com%2Fvulnerabilities-threat-research%2F2023%2F01%2F03%2Fbitrat-now-sharing-sensitive-bank-data-as-a-lure&f=1&r=0.6709672527748536
Requested by: Host: blog.qualys.com
URL: https://blog.qualys.com/vulnerabilities-threat-research/2023/01/03/bitrat-now-sharing-sensitive-bank-data-as-a-lure
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 137.102.96.34.bc.googleusercontent.com
Software: gfra1 /
Resource Hash: d38fa2a8399e987e12fa61db86bae5d353658dbe6014c713bc16788a90be5cb1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.qualys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Thu, 16 Nov 2023 00:26:06 GMT
content-encoding: gzip
via: 1.1 google
server: gfra1
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=0, no-cache, must-revalidate
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H2 200 g.gif
pixel.wp.com/ 50 B
153 B 15ms
6ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?v=ext&blog=105655880&post=32313&tz=-8&srv=blog.qualys.com&j=1%3A12.2&host=blog.qualys.com&ref=&fcp=1496&rand=0.35089353116580213
Requested by: Host: blog.qualys.com
URL: https://blog.qualys.com/vulnerabilities-threat-research/2023/01/03/bitrat-now-sharing-sensitive-bank-data-as-a-lure
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.qualys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

access-control-allow-origin: *
date: Thu, 16 Nov 2023 00:26:06 GMT
cache-control: no-cache
server: nginx
content-length: 50
content-type: image/gif

GET
H2 200 bitrat-now-sharing-sensitive-bank-data-as-a-lure Show response
blog.qualys.com/vulnerabilities-threat-research/2023/01/03/ 3 KB
2 KB 187ms
187ms XHR
application/json 35.230.125.173
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.qualys.com/vulnerabilities-threat-research/2023/01/03/bitrat-now-sharing-sensitive-bank-data-as-a-lure?relatedposts=1

Requested by

Host: ik.imagekit.io
URL: https://ik.imagekit.io/qualys/wp-content/plugins/jetpack/_inc/build/related-posts/related-posts.min.js?ver=20211209

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

35.230.125.173 The Dalles, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

173.125.230.35.bc.googleusercontent.com

Software

nginx / WP Engine

Resource Hash

4cefe7ea58d10566730d51baae85fa56b4a665fd496bcc590dfe5bd607f866a1

Security Headers

Name	Value
Content-Security-Policy	block-all-mixed-content; frame-ancestors 'self' qualys.com *.qualys.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://blog.qualys.com/vulnerabilities-threat-research/2023/01/03/bitrat-now-sharing-sensitive-bank-data-as-a-lure
x-requested-with: XMLHttpRequest
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Thu, 16 Nov 2023 00:26:06 GMT
content-security-policy: block-all-mixed-content; frame-ancestors 'self' qualys.com *.qualys.com;
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-cacheable: YES:14400.000
x-cache-group: normal
content-encoding: gzip
x-powered-by: WP Engine
x-cache: HIT: 1
x-xss-protection: 1; mode=block
referrer-policy: no-referrer, strict-origin-when-cross-origin
server: nginx
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding,Cookie
x-frame-options: SAMEORIGIN
content-type: application/json; charset=utf-8
cache-control: max-age=14400, must-revalidate
permissions-policy: autoplay=(), camera=(), document-domain=(), encrypted-media=(), fullscreen=(), geolocation=(), microphone=(), midi=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), sync-xhr=(), usb=(), xr-spatial-tracking=()

GET
H2 200 Omnibox.min__536a793e673a2ce5ba2d.js Show response
static.cloud.coveo.com/searchui/v2.10085/2/js/ 92 KB
21 KB 23ms
8ms Script
application/javascript 143.204.215.33
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.cloud.coveo.com/searchui/v2.10085/2/js/Omnibox.min__536a793e673a2ce5ba2d.js
Requested by: Host: static.cloud.coveo.com
URL: https://static.cloud.coveo.com/searchui/v2.10085/2/js/CoveoJsSearch.Lazy.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.215.33 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-215-33.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 8b1e32772312128e3420a2f2c6abccfefe79f241d6e235c2c7e30c93d6fdefd1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.qualys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

x-amz-version-id: nm.6fu5dEJEKZkhH_DMODyYMknpPa4ol
content-encoding: gzip
via: 1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
date: Wed, 15 Nov 2023 23:55:45 GMT
age: 3244
x-amz-cf-pop: FRA53-C1
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Wed, 05 May 2021 21:45:33 GMT
server: AmazonS3
etag: W/"51e8084128d70e7cb42c11eac6dd962f"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=86400;
x-amz-cf-id: If01rwMIbJ2IjeYcdsNEqIe_LcQ5T3T4mvNYgHaxP-IzTFVveO6UeA==

GET
H2 200 SearchButton.min__536a793e673a2ce5ba2d.js Show response
static.cloud.coveo.com/searchui/v2.10085/2/js/ 2 KB
1 KB 24ms
9ms Script
application/javascript 143.204.215.33
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.cloud.coveo.com/searchui/v2.10085/2/js/SearchButton.min__536a793e673a2ce5ba2d.js
Requested by: Host: static.cloud.coveo.com
URL: https://static.cloud.coveo.com/searchui/v2.10085/2/js/CoveoJsSearch.Lazy.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.215.33 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-215-33.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: ce42fb0288bdffd7a0b964869275dc51058a21656e4bffa58707d2c50585c830

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.qualys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

x-amz-version-id: a4_aBYq8kx7nlRITpidMLVXshQFstXjC
content-encoding: gzip
via: 1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
date: Wed, 15 Nov 2023 23:55:45 GMT
age: 3244
x-amz-cf-pop: FRA53-C1
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Wed, 05 May 2021 21:45:34 GMT
server: AmazonS3
etag: W/"7ca8b6c22c8b81360fddeffd0295ee92"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=86400;
x-amz-cf-id: xYjOfuYQYH5mGMk3RV_1PZx3Ukz74OmHiR_Rbe7hO_lAeWNVetgYiA==

GET
H2 200 S6uyw4BMUTPHjx4wXg.woff2
fonts.gstatic.com/s/lato/v24/ 23 KB
24 KB 30ms
7ms Font
font/woff2 2a00:1450:4001:811::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v24/S6uyw4BMUTPHjx4wXg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato:300,400,700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://blog.qualys.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 21:16:36 GMT
x-content-type-options: nosniff
age: 97771
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23580
x-xss-protection: 0
last-modified: Tue, 02 May 2023 15:17:22 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 13 Nov 2024 21:16:36 GMT

GET
H2 200 insight.beta.min.js Show response
snap.licdn.com/li.lms-analytics/ 42 KB
15 KB 7ms
7ms Script
application/javascript 2a02:26f0:480:f::213:7ec6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.beta.min.js

Requested by

Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:480:f::213:7ec6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

84a33f0ee395abbee2ed85fe075f213a7836ff2023795ce8e4d4184fc6cbbd7f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.qualys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Thu, 16 Nov 2023 00:26:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 15 Nov 2023 09:07:28 GMT
x-cdn: AKAM
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
cache-control: max-age=31382
accept-ranges: bytes
content-length: 15605

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/163/ 11 KB
5 KB 10ms
10ms Script
application/x-javascript 23.192.243.198
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/163/munchkin.js
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.192.243.198 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-192-243-198.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.qualys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

Date: Thu, 16 Nov 2023 00:26:07 GMT
Content-Encoding: gzip
Last-Modified: Fri, 06 Jan 2023 02:26:40 GMT
Server: AkamaiNetStorage
ETag: "ea7826f34518d7c2295738f39c7640fa:1672972000.238769"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Content-Type: application/x-javascript
Cache-Control: max-age=8640000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4741
Expires: Sat, 24 Feb 2024 00:26:07 GMT

GET
H/1.1 200
OK / Show response
api.ipify.org/ 39 B
213 B 499ms
158ms Script
application/javascript 104.237.62.212
WEBNX

General

Check archive.org

Show headers Download Go to

Full URL: https://api.ipify.org/?format=jsonp&callback=ipifyCallback
Requested by: Host: blog.qualys.com
URL: https://blog.qualys.com/vulnerabilities-threat-research/2023/01/03/bitrat-now-sharing-sensitive-bank-data-as-a-lure
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 104.237.62.212 El Segundo, United States, ASN18450 (WEBNX, US),
Reverse DNS: api.ipify.org
Software: nginx/1.25.2 /
Resource Hash: 4874fbe97e6da4c43738ded5cc79e5e90012ccef5ba5cabeaa1a4391738f26a7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.qualys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

Date: Thu, 16 Nov 2023 00:26:07 GMT
Server: nginx/1.25.2
Connection: keep-alive
Content-Length: 39
Vary: Origin
Content-Type: application/javascript

GET
H2 200 v.gif
dev.visualwebsiteoptimizer.com/ 35 B
151 B 99ms
99ms Image
image/gif 34.96.102.137
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dev.visualwebsiteoptimizer.com/v.gif?cd=0&a=590650&d=blog.qualys.com&u=DD299F31ED763E8969388A6250F9520B4&h=94b56904a1ce7b6a09f0c088fcd31346&t=false

Requested by

Host: blog.qualys.com
URL: https://blog.qualys.com/vulnerabilities-threat-research/2023/01/03/bitrat-now-sharing-sensitive-bank-data-as-a-lure

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

137.102.96.34.bc.googleusercontent.com

Software

gnv2c /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.qualys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Thu, 16 Nov 2023 00:26:06 GMT
via: 1.1 google
x-content-type-options: nosniff
server: gnv2c
content-type: image/gif
cache-control: public, max-age=43200
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35

POST
H2 200 collect Show response
www.google-analytics.com/j/ 4 B
209 B 14ms
13ms XHR
text/plain 2a00:1450:4001:830::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1109357002&t=pageview&_s=1&dl=https%3A%2F%2Fblog.qualys.com%2Fvulnerabilities-threat-research%2F2023%2F01%2F03%2Fbitrat-now-sharing-sensitive-bank-data-as-a-lure&ul=en-us&de=UTF-8&dt=BitRAT%20Now%20Sharing%20Sensitive%20Bank%20Data%20as%20a%20Lure%20%7C%20Qualys%20Security%20Blog&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEABAAAAACAAI~&jid=757912937&gjid=578318490&cid=1961273024.1700094367&tid=UA-5639091-1&_gid=1405542961.1700094367&_r=1&_slc=1&gtm=45He3b81n71W7DWPSv6737890&cd4=1&cd5=(not%20set)&cd6=1664&cd7=1152&cd8=4%3A3%20Traditional%20television%20%26%20computer%20monitor%20standard%2C%20iPad&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&z=1291484979

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.qualys.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 16 Nov 2023 00:26:07 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://blog.qualys.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
region1.google-analytics.com/g/ 0
254 B 36ms
14ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-3RJMG209BM&gtm=45je3b81v9101423851z86737890&_p=1700094366624&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cid=1961273024.1700094367&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1700094367&sct=1&seg=0&dl=https%3A%2F%2Fblog.qualys.com%2Fvulnerabilities-threat-research%2F2023%2F01%2F03%2Fbitrat-now-sharing-sensitive-bank-data-as-a-lure&dt=BitRAT%20Now%20Sharing%20Sensitive%20Bank%20Data%20as%20a%20Lure%20%7C%20Qualys%20Security%20Blog&en=page_view&_fv=1&_ss=1&tfd=1972
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-3RJMG209BM&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.qualys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 16 Nov 2023 00:26:07 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://blog.qualys.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
349 B 78ms
26ms XHR
text/plain 2a00:1450:400c:c00::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-5639091-1&cid=1961273024.1700094367&jid=757912937&gjid=578318490&_gid=1405542961.1700094367&_u=YEBAAEAAAAAAACAAI~&z=1028048996

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c00::9d Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.qualys.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Thu, 16 Nov 2023 00:26:07 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://blog.qualys.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3605201&time=1700094367196&url=https%3A%2F%2Fblog.qualys.com%2Fvulnerabilities-threat-research%2F2023%2F01%2F03%2Fbitrat-now-sharing-sensitive-ban...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3605201&time=1700094367196&url=https%3A%2F%2Fblog.qualys.com%2Fvulnerabilities-threat-research%2F2023%2F01%2F03%2Fbitrat-now-sharing-sensitive-ban...
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D3605201%26time%3D1700094367196%26url%3Dhttps%253A%252F%252Fblog.qualys.com%252Fvu...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3605201&time=1700094367196&url=https%3A%2F%2Fblog.qualys.com%2Fvulnerabilities-threat-research%2F2023%2F01%2F03%2Fbitrat-now-sharing-sensitive-ban...
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3605201&time=1700094367196&url=https%3A%2F%2Fblog.qualys.com%2Fvulnerabilities-threat-research%2F2023%2F01%2F03%2Fbitrat-now-sharing-sensitive-ba...

0
264 B

179ms
150ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3605201&time=1700094367196&url=https%3A%2F%2Fblog.qualys.com%2Fvulnerabilities-threat-research%2F2023%2F01%2F03%2Fbitrat-now-sharing-sensitive-bank-data-as-a-lure&cookiesTest=true&liSync=true&e_ipv6=AQKaa6SshXpZnwAAAYvVhVg_C9HjbWLZDqR22v7oCiF80Xjpu-iiBU2Zjh8tc7hDV0muv1_dDG72Gi4VAmKcb-dAUACq
Requested by: Host: blog.qualys.com
URL: https://blog.qualys.com/vulnerabilities-threat-research/2023/01/03/bitrat-now-sharing-sensitive-bank-data-as-a-lure
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.qualys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Thu, 16 Nov 2023 00:26:07 GMT
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: 3B4846A1AB6346ADBC904A4913D4A92D Ref B: FRAEDGE1922 Ref C: 2023-11-16T00:26:07Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-type: application/javascript
x-li-fabric: prod-ltx1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYKOhDjY6bKpgo8t/WMsQ==

Redirect headers

date: Thu, 16 Nov 2023 00:26:07 GMT
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: 9937C9E06AB1425B9310A3C4673A76D4 Ref B: DUS30EDGE0715 Ref C: 2023-11-16T00:26:07Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-ltx1
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3605201&time=1700094367196&url=https%3A%2F%2Fblog.qualys.com%2Fvulnerabilities-threat-research%2F2023%2F01%2F03%2Fbitrat-now-sharing-sensitive-bank-data-as-a-lure&cookiesTest=true&liSync=true&e_ipv6=AQKaa6SshXpZnwAAAYvVhVg_C9HjbWLZDqR22v7oCiF80Xjpu-iiBU2Zjh8tc7hDV0muv1_dDG72Gi4VAmKcb-dAUACq
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYKOhDgntc79WSbYx7tWQ==

POST
H/1.1 200
OK visitWebPage
797-eni-742.mktoresp.com/webevents/ 2 B
318 B 1124ms
168ms Ping
text/plain 192.28.147.68
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL: https://797-eni-742.mktoresp.com/webevents/visitWebPage?_mchNc=1700094367200&_mchCn=&_mchId=797-ENI-742&_mchTk=_mch-qualys.com-1700094367199-38264&_mchHo=blog.qualys.com&_mchPo=&_mchRu=%2Fvulnerabilities-threat-research%2F2023%2F01%2F03%2Fbitrat-now-sharing-sensitive-bank-data-as-a-lure&_mchPc=https%3A&_mchVr=163&_mchEcid=&_mchHa=&_mchRe=&_mchQp=
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/163/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.28.147.68 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software: nginx/1.20.1 /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.qualys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

Date: Thu, 16 Nov 2023 00:26:08 GMT
Content-Encoding: gzip
Server: nginx/1.20.1
Transfer-Encoding: chunked
Content-Type: text/plain; charset=UTF-8
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Request-Id: 2ed974cf-26a2-4369-8fb9-31c11f3e3086

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
408 B 42ms
20ms Image
image/gif 2a00:1450:4001:806::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-5639091-1&cid=1961273024.1700094367&jid=757912937&_u=YEBAAEAAAAAAACAAI~&z=906574930

Requested by

Host: blog.qualys.com
URL: https://blog.qualys.com/vulnerabilities-threat-research/2023/01/03/bitrat-now-sharing-sensitive-bank-data-as-a-lure

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.qualys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 16 Nov 2023 00:26:07 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
408 B 39ms
18ms Image
image/gif 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-5639091-1&cid=1961273024.1700094367&jid=757912937&_u=YEBAAEAAAAAAACAAI~&z=906574930

Requested by

Host: blog.qualys.com
URL: https://blog.qualys.com/vulnerabilities-threat-research/2023/01/03/bitrat-now-sharing-sensitive-bank-data-as-a-lure

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.qualys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 16 Nov 2023 00:26:07 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 me Show response
geoip-js.com/geoip/v2.1/country/ 759 B
959 B 67ms
35ms XHR
application/vnd.maxmind.com-country+json 2606:4700:4400::ac40:9a92
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://geoip-js.com/geoip/v2.1/country/me?referrer=https%3A%2F%2Fblog.qualys.com

Requested by

Host: js.maxmind.com
URL: https://js.maxmind.com/js/apis/geoip2/v2.1/geoip2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:9a92 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

51b2efaf341c0214cd83daa3362fc752cd8094c58f1e2ecaf0d8c48010e9da57

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.qualys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Thu, 16 Nov 2023 00:26:07 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-cache-status: DYNAMIC
server: cloudflare
content-type: application/vnd.maxmind.com-country+json; charset=UTF-8; version=2.1
access-control-allow-origin: *
cf-ray: 826b99c5dc9d65b6-FRA
content-length: 759

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 7ms
7ms Image
image/gif 2a00:1450:4001:830::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=1109357002&t=event&ni=1&_s=1&dl=https%3A%2F%2Fblog.qualys.com%2Fvulnerabilities-threat-research%2F2023%2F01%2F03%2Fbitrat-now-sharing-sensitive-bank-data-as-a-lure&ul=en-us&de=UTF-8&dt=BitRAT%20Now%20Sharing%20Sensitive%20Bank%20Data%20as%20a%20Lure%20%7C%20Qualys%20Security%20Blog&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=GeoIP&ea=Country%20Identified&el=DE&_u=aEDAAEABAAAAACAAI~&jid=&gjid=&cid=1961273024.1700094367&tid=UA-5639091-1&_gid=1405542961.1700094367&gtm=45He3b81n71W7DWPSv6737890&cd5=1&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&z=1657466537

Requested by

Host: blog.qualys.com
URL: https://blog.qualys.com/vulnerabilities-threat-research/2023/01/03/bitrat-now-sharing-sensitive-bank-data-as-a-lure

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.qualys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 15 Nov 2023 14:49:17 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 34610
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H2 204 / Show response
px.ads.linkedin.com/wa/ 0
197 B 171ms
171ms XHR
text/plain 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/wa/
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.beta.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: *
Referer: https://blog.qualys.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Thu, 16 Nov 2023 00:26:07 GMT
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: 25CBD6254C9F46F1A4908E6BEE5D8019 Ref B: DUS30EDGE0715 Ref C: 2023-11-16T00:26:08Z
linkedin-action: 1
vary: Origin
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-ltx1
access-control-allow-origin: https://blog.qualys.com
x-li-proto: http/2
access-control-allow-credentials: true
x-li-uuid: AAYKOhDluxhRfF6akXorfw==

GET
H/1.1 200
OK beacon.gif Show response
rum-collector-2.pingdom.net/img/ 0
213 B 160ms
28ms XHR
text/plain 52.209.3.106
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rum-collector-2.pingdom.net/img/beacon.gif?id=56a14edeabe53deb7ff24334&sAW=1600&sAH=1200&bIW=1600&bIH=1200&pD=24&dPR=1&or=landscape-primary&nT=0&rC=1&nS=0&cS=798&cE=798&dLE=798&dLS=798&fS=798&hS=-1&rE=798&rS=0&reS=798&resS=1011&resE=1032&uEE=-1&uES=-1&dL=1276&dI=1699&dCLES=1700&dCLEE=1870&dC=2868&lES=2868&lEE=2870&s=nt&title=BitRAT%20Now%20Sharing%20Sensitive%20Bank%20Data%20as%20a%20Lure%20%7C%20Qualys%20Security%20Blog&path=https%3A%2F%2Fblog.qualys.com%2Fvulnerabilities-threat-research%2F2023%2F01%2F03%2Fbitrat-now-sharing-sensitive-bank-data-as-a-lure&ref=&sId=7nrmu8y0&sST=1700094368&sIS=1&rV=0&v=1.4.1
Requested by: Host: rum-static.pingdom.net
URL: https://rum-static.pingdom.net/prum.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.209.3.106 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-209-3-106.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.qualys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Pragma: no-cache
Date: Thu, 16 Nov 2023 00:26:08 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: 0

Verdicts & Comments Add Verdict or Comment

56 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

16 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.qualys.com/	1970-01-20 17:41:18	Name: leadsource Value: 85585
.blog.qualys.com/	1970-01-21 01:01:56	Name: _vwo_uuid_v2 Value: DD299F31ED763E8969388A6250F9520B4\|94b56904a1ce7b6a09f0c088fcd31346
.qualys.com/	1970-01-20 16:16:20	Name: _gid Value: GA1.2.1405542961.1700094367
.qualys.com/	1970-01-20 16:14:54	Name: _gat_UA-5639091-1 Value: 1
.qualys.com/	1970-01-21 01:50:54	Name: _ga Value: GA1.1.1961273024.1700094367
.qualys.com/	1970-01-21 01:50:54	Name: _mkto_trk Value: id:797-ENI-742&token:_mch-qualys.com-1700094367199-38264
.linkedin.com/	1970-01-20 18:24:30	Name: li_sugr Value: df72dab5-12cb-4857-b725-5dd6831dafc6
.linkedin.com/	1970-01-21 01:00:30	Name: bcookie Value: "v=2&a63b8ac2-aa30-4795-8dbe-df9fb3fce190"
.linkedin.com/	1970-01-20 16:16:20	Name: lidc Value: "b=TGST09:s=T:r=T:a=T:p=T:g=2628:u=1:x=1:i=1700094367:t=1700180767:v=2:sig=AQFCnVLI-P-oJmbQpBh_kQDJMap-fQeG"
.linkedin.com/	1970-01-20 16:58:06	Name: UserMatchHistory Value: AQIFUv69LNF6SwAAAYvVhVb6qsnUYoNVyaWt95bDDQzkCXBFWZB90pbNQtvzJyz_L3mcqM__GIQdYg
.linkedin.com/	1970-01-20 16:58:06	Name: AnalyticsSyncHistory Value: AQLfpdXMNKy2_wAAAYvVhVb6i_KzS9IQv2XhIptkdYFv0PL1LnajY8ddhELVHq1pM-EYFVrz01o-eHuthkQPGQ
.blog.qualys.com/	1970-01-21 01:50:54	Name: _ga Value: GA1.3.1961273024.1700094367
.blog.qualys.com/	1970-01-20 16:16:20	Name: _gid Value: GA1.3.1405542961.1700094367
.qualys.com/	1970-01-21 01:50:54	Name: _ga_3RJMG209BM Value: GS1.1.1700094367.1.0.1700094367.0.0.0
.www.linkedin.com/	1970-01-21 01:00:30	Name: bscookie Value: "v=1&20231116002607f1a23574-2248-4853-849b-174daffec3ffAQF5mEz5ZP8Ffzbjdl4dKeRREzjp0ovg"
.linkedin.com/	1970-01-20 20:34:06	Name: li_gc Value: MTswOzE3MDAwOTQzNjc7MjswMjG12lqVjaj9CXMNG0uGk8zhbcHd1Klga+0g/mOEM+ebYQ==

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	warning	Message: Error with Permissions-Policy header: Unrecognized feature: 'document-domain'.
network	error	URL: https://d1uyme8f6ss6qi.cloudfront.net/image/icon/link-arrow-left.svg Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	block-all-mixed-content; frame-ancestors 'self' qualys.com *.qualys.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

797-eni-742.mktoresp.com
api.ipify.org
blog.qualys.com
cdnjs.cloudflare.com
d1uyme8f6ss6qi.cloudfront.net
dev.visualwebsiteoptimizer.com
fonts.googleapis.com
fonts.gstatic.com
geoip-js.com
ik.imagekit.io
js.maxmind.com
munchkin.marketo.net
pixel.wp.com
px.ads.linkedin.com
px4.ads.linkedin.com
region1.google-analytics.com
rum-collector-2.pingdom.net
rum-static.pingdom.net
secure.gravatar.com
snap.licdn.com
static.cloud.coveo.com
stats.g.doubleclick.net
stats.wp.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.linkedin.com
104.237.62.212
13.107.42.14
143.204.215.33
18.245.78.109
192.0.76.3
192.28.147.68
2001:4860:4802:32::36
23.192.243.198
2600:9000:206f:8e00:15:c281:3500:93a1
2606:4700:10::6816:3768
2606:4700:4400::ac40:9a92
2606:4700:7::a29f:8716
2606:4700::6811:180e
2620:1ec:21::14
2a00:1450:4001:806::2004
2a00:1450:4001:809::200a
2a00:1450:4001:811::2003
2a00:1450:4001:82b::2003
2a00:1450:4001:830::2008
2a00:1450:4001:830::200e
2a00:1450:400c:c00::9d
2a02:26f0:480:f::213:7ec6
2a04:fa87:fffe::c000:4902
34.96.102.137
35.230.125.173
52.209.3.106
0200bc38d986631f9cc4680084d7d263ccf17fa4a3c627b26ff347e0cfcf1d47
0af4cea7d0b9eeb9f28897580823c4e59d5a53d8da4f2b3a282e8313b95a2375
0bcd1094a0d8c4a92d8bdd534808901e64201425928908db5b0964fb76125d14
0cdaa2c316f414a77bcc5a930e9dcd7668619faac80d6a424a35c8a81d29d1fb
0e29efc0a83b101298ba80eeac53e1b3a9a30641cbe700c0b4bda8df6d83f57f
0ff098e4f46d0ce132a4b5b2aeb46511fabc66902b69c27b7f0f1e0101e85e19
106fcd8d723eda7d92a26893a439ccef998e5fc68ad228253607143d801e8cd8
1cf1bcb212b66062127da65a7a85342fcdbfe284bd74cc96e35209556f76769a
1d5cfe14d65accc4bd1df0d7c3bb65be70d0f4e94a5f9d40465343a2807548ae
1e8c04b727387aafa93f41a94bd4ddf35ccc842a9706da67d471d45a7d721145
22e8c97d6543113640eec7153c98ddd328fb34d5d2730a0ec707f5e5d2d08e2b
2e10d353ff038c2cad3492fc17801af3e6ef2669c9e9713bdb78b1dcb104c4fe
3309103ad665897d5aaaaf67fe4a5af8d493491481ab773db70d2f3d42b32b0a
404bd2dfffb845dd50a8654351f77c4d8789b6ca45a6adaabac40a624a300f8e
45556b0961111a978c99204ba48a1dccaf91b65a962cbb0dbb8cf7b4977b5099
47a02580d2862e4edee6133d3abf2ac9b9b1f719d6ef071f0169843a098e5d9d
4874fbe97e6da4c43738ded5cc79e5e90012ccef5ba5cabeaa1a4391738f26a7
4cefe7ea58d10566730d51baae85fa56b4a665fd496bcc590dfe5bd607f866a1
4ea2880bbb5055eb6493499d243a86911663924955d78ac35d672a5a0e9995ae
4f01f464784675724c19ca066b543991619ff78d482649bd3dc0fafa6043d0d4
4f74c10c6691aef6faebcb39fe94d3210bcf732a898850be83930aa592bda587
51b2efaf341c0214cd83daa3362fc752cd8094c58f1e2ecaf0d8c48010e9da57
5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4
5336157caf4b27e42cd746c6456e011920efd49106e32ff60d9ce2e73c378dcf
54e678962b5b2154b58a43e79ae4a609b9b9edceba3a9f8a49d03d1a6de72032
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
5734f1b66dcb622529d435aba20990813d43553f949bc0813719b4e7d1252527
5736e3eec0c34bfc288854b7b8d2a8f1e22e9e2e7dae3c8d1ad5dfb2d4734ad0
5c9bac96e8ccddc1b34591a24a2fca352764e7cb8e44efe69ab11036356d6f99
67447c3656caad630373253691f3e8f64467eafd6e7305c9b0e98111b0b41694
68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23
726b820e44f6ab90ad991d30a4bf26d3a5d71493cbcd1fb1efd0d14e89b9df2a
7313da4a164ef6d375d0919efb4592a24d585f6936ea7a54e7923e6695bd0ea4
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84a33f0ee395abbee2ed85fe075f213a7836ff2023795ce8e4d4184fc6cbbd7f
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
8acc85a425552781bfcb3cc21f375b7a6bd04b196aa295c9e9ba0d94192a72d6
8b1e32772312128e3420a2f2c6abccfefe79f241d6e235c2c7e30c93d6fdefd1
918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537
91b7632508bd4c9d5fa60c8430bd760190935c072feb2227c0cf3521bfdb9d24
946baf7f039ba4158ad187a34782c658438b011bd9eb2118207c76119783ce8c
94a96a4fc313fe6dfba290ed6bc0e802eaab40810e59032a06f6774553b1c6ae
a008f90701130011191c15103780ae40c2c3c56f13fb131cc3e75da3b0ff020d
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
b7908a015a567ec2363011df2475368dbff34360e9da3fdff50604d6395fb646
c396302d723c104daaec67ce091daf21cbfe63a1f4d514528ba6df0929c33cf7
ca7752fb33cf3a98c0f29bc4eec563112025da4109a0dcc69dabf5f861751258
cac678b284e21891b5de49e8f65f7f91de645ac3f297fac37b922c0f0715b3f6
cadda460ccb4c3c01bb45f3d5976f63f5adf8dc3ff1d31cb4fbd3ded4f18e5bf
cb30e0c12d8ad8be9c0c517226ba4ffa88802ce495dada60b6f7494075a8a133
ce42fb0288bdffd7a0b964869275dc51058a21656e4bffa58707d2c50585c830
d2c5106cd0f3e4a43f2a4cba1838341edba34ec32cdbc5ea14496a381a0f7049
d38fa2a8399e987e12fa61db86bae5d353658dbe6014c713bc16788a90be5cb1
d61712eb28c66f9db763087ac7278a53e91ac6ecba4b52e8e4f19125d859a8b8
d749579e51cf490ba27a6782bcfe07c52e44ffa8e3fbb4db7a4dded9d0d9ef29
daa89579701492af907726862177f5d2169eb6c42a937510c5d4e5be20f60b7a
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e174a58a503ab84b3d1b9de12fd3895788204485170f1289e445f7b5b98ec789
e2fda3419c4ae8f6d911e676c65db38a8bfa347324b01160065c6d3195586d09
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e7aae1b0b12b68958dded270bb1ec482d90168ff8c253e963af70f05288bd74a
e8ceb4c940636888085c672ce04127bde618b31a0cc6e84b88ce45de880f4d49
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
f88f89a0cead9c36ddbe19508f32f64bd91e94e92b6006dd575e8d0deb317d7f
fe66ac5df69c78be7dfcf75943079129dbf24a254e89febc5a7e916d40de43bc

blog.qualys.com Open in urlscan Pro 35.230.125.173 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

73 Requests

99 %HTTPS

62 %IPv6

23 Domains

28 Subdomains

26 IPs

4 Countries

1520 kBTransfer

3914 kBSize

16 Cookies

77 Outgoing links

Page URL History

Redirected requests

73 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

blog.qualys.com Open in urlscan Pro
35.230.125.173 Public Scan

Screenshot
Live screenshot

Full Image

73
Requests

99 %
HTTPS

62 %
IPv6

23
Domains

28
Subdomains

26
IPs

4
Countries

1520 kB
Transfer

3914 kB
Size

16
Cookies

73 HTTP transactions
0 data transactions