www.bleepingcomputer.com Open in urlscan Pro
104.20.60.209  Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 48

• https://cd.connatix.com/connatix.playspace.js HTTP 302
• https://cds.connatix.com/p/228932/connatix.playspace.dc.js?tier=1

Request Chain 66

• https://apis.google.com/u/0/se/0/_/+1/fastbutton?usegapi=1&count=false&size=small&hl=en-GB&origin=https%3A%2F%2Fwww.bleepingcomputer.com&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F237440%2Ftrojanwin32tdss-win32crytor-virus-removal%2F&gsrc=3p&ic=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.de.IpWeeLsup8c.O%2Fd%3D1%2Frs%3DAHpOoo-7vGeOZpyfcbeljIbxyJzXpK39XA%2Fm%3D__features__ HTTP 301
• https://developers.google.com/ HTTP 302
• https://developers.google.com/?hl=de

115 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/	229 KB 45 KB	1471ms 1370ms	Document text/html	104.20.60.209 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.20.60.209 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 78bb17afcf1c5d185df57088bba030d7b3e7be3d567e65fc972106e6de46ae55 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; X-Frame-Options SAMEORIGIN Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers cache-control no-cache, no-store, must-revalidate, max-age=0 cf-cache-status DYNAMIC cf-ray 79c44a78a9873a52-FRA content-encoding br content-security-policy upgrade-insecure-requests; content-type text/html;charset=ISO-8859-1 date Mon, 20 Feb 2023 03:52:42 GMT expires Sun, 19 Feb 2023 03:52:42 GMT pragma no-cache server cloudflare vary Accept-Encoding,User-Agent x-frame-options SAMEORIGIN
GET H2	200	prettify.css www.bleepingcomputer.com/forums/public/style_css/	1 KB 600 B	49ms 48ms	Stylesheet text/css	104.20.60.209 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepingcomputer.com/forums/public/style_css/prettify.css?ipbv=27abb701147009d4a8a9411a195be634 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.20.60.209 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash bfd753d445592a633d4e3b8f74fe6e4ca85ab95a1f0b2fc00f11afeaaeed8194 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; X-Frame-Options SAMEORIGIN Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:52:42 GMT content-security-policy upgrade-insecure-requests; content-encoding br cf-cache-status HIT cf-bgj minify last-modified Wed, 29 May 2013 16:10:52 GMT server cloudflare age 1933 cf-polished origSize=2207 etag W/"89f-4dddda0323b00-gzip" vary Accept-Encoding,User-Agent x-frame-options SAMEORIGIN content-type text/css cache-control max-age=18000 cf-ray 79c44a8158653a52-FRA
GET H2	200	prototype.js Show response www.bleepingcomputer.com/forums/public/js/3rd_party/	134 KB 36 KB	67ms 66ms	Script application/javascript	104.20.60.209 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepingcomputer.com/forums/public/js/3rd_party/prototype.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.20.60.209 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c2a0ed3ea5aebdf80781e96b0e677656f9db72ea592b679299953852fef84b02 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; X-Frame-Options SAMEORIGIN Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:52:42 GMT content-security-policy upgrade-insecure-requests; content-encoding br cf-cache-status HIT cf-bgj minify last-modified Wed, 29 May 2013 16:10:44 GMT server cloudflare age 3306 cf-polished origSize=180829 etag W/"2c25d-4dddd9fb82900-gzip" vary Accept-Encoding,User-Agent x-frame-options SAMEORIGIN content-type application/javascript cache-control max-age=18000 cf-ray 79c44a81586b3a52-FRA
GET H2	200	ipb.js Show response www.bleepingcomputer.com/forums/public/js/	81 KB 21 KB	59ms 59ms	Script application/javascript	104.20.60.209 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepingcomputer.com/forums/public/js/ipb.js?ipbv=27abb701147009d4a8a9411a195be634&load=quickpm,hovercard,sharelinks,topic,like Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.20.60.209 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d813e6becda7ebe8b6bf1a54e7b83aa2a2551dc41bf4f07877834984a293958e Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; X-Frame-Options SAMEORIGIN Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:52:42 GMT content-security-policy upgrade-insecure-requests; content-encoding br cf-cache-status HIT cf-bgj minify last-modified Sun, 15 Nov 2020 20:33:38 GMT server cloudflare age 1933 cf-polished origSize=128896 etag W/"1f780-5b42b2d2db890-gzip" vary Accept-Encoding,User-Agent x-frame-options SAMEORIGIN content-type application/javascript cache-control max-age=18000 cf-ray 79c44a81586c3a52-FRA
GET H2	200	scriptaculous-cache.js Show response www.bleepingcomputer.com/forums/public/js/3rd_party/scriptaculous/	55 KB 14 KB	54ms 53ms	Script application/javascript	104.20.60.209 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepingcomputer.com/forums/public/js/3rd_party/scriptaculous/scriptaculous-cache.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.20.60.209 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2a10fb2699752353ba3f55bdb022589d690843ebbbf9f3b80789f2a57010475e Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; X-Frame-Options SAMEORIGIN Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:52:42 GMT content-security-policy upgrade-insecure-requests; content-encoding br cf-cache-status HIT cf-bgj minify last-modified Mon, 16 Nov 2020 16:14:01 GMT server cloudflare age 1933 cf-polished origSize=79650 etag W/"13722-5b43baa8f0d38-gzip" vary Accept-Encoding,User-Agent x-frame-options SAMEORIGIN content-type application/javascript cache-control max-age=18000 cf-ray 79c44a81586d3a52-FRA
GET H2	200	ipb.lang.js Show response www.bleepingcomputer.com/forums/cache/lang_cache/1/	28 KB 8 KB	50ms 50ms	Script application/javascript	104.20.60.209 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepingcomputer.com/forums/cache/lang_cache/1/ipb.lang.js?nck=4b93cd7f1f76df9c2c1783aae5cc39b1 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.20.60.209 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d88cb5d257b60d6a83577ae57ca7d69545f3dfb1ac545201b3b6cd1b0fc35557 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; X-Frame-Options SAMEORIGIN Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:52:42 GMT content-security-policy upgrade-insecure-requests; content-encoding br cf-cache-status HIT cf-bgj minify last-modified Mon, 05 Sep 2022 22:17:47 GMT server cloudflare age 1932 cf-polished origSize=30126 etag W/"75ae-5e7f5731b35ba-gzip" vary Accept-Encoding,User-Agent x-frame-options SAMEORIGIN content-type application/javascript cache-control max-age=18000 cf-ray 79c44a81586e3a52-FRA
GET H2	200	qc-consent.js Show response www.bleepstatic.com/js/qc-consent/	2 KB 2 KB	154ms 46ms	Script text/javascript	172.67.75.139 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/js/qc-consent/qc-consent.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.67.75.139 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 28d4e8c1043164607dcdeb358e2a08c9565fe286ceeeabea79e67f8c680187e7 Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:52:42 GMT content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 1643181 cf-polished origSize=3904 cf-bgj minify last-modified Mon, 05 Oct 2020 20:38:13 GMT server cloudflare etag W/"2345400546" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WCgsGRzVzL3wjr5tYdVrCtwqtaLt7VsvXlg66%2BoOiJ7B1u8Ii7Kc6SBQ0I6hiRVZFi%2F6BzryqtInNQjxLsJORy%2FMqm8umv0KGkOg6qeqXVrSwuORyk%2BKTMveGXG%2BG4HOd0zPzGM%3D"}],"group":"cf-nel","max_age":604800} content-type text/javascript access-control-allow-origin * cache-control max-age=3024000 cf-ray 79c44a827f643a79-FRA expires Wed, 08 Mar 2023 03:26:21 GMT
GET H2	200	js Show response www.googletagmanager.com/gtag/	113 KB 44 KB	138ms 48ms	Script application/javascript	2a00:1450:4001:828::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=UA-91740-1 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 9454689c1f49423a7064a1e35263af4017297944575e35a07a68d18c2cf44a46 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:52:42 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true cross-origin-resource-policy cross-origin access-control-allow-headers Cache-Control content-length 45141 x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 expires Mon, 20 Feb 2023 03:52:42 GMT
GET H2	200	twitter.png www.bleepingcomputer.com/forums/public/style_images/master/loginmethods/	575 B 676 B	64ms 55ms	Image image/png	104.20.60.209 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepingcomputer.com/forums/public/style_images/master/loginmethods/twitter.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.20.60.209 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash abe9d30276e3d66a71219ad2b0ed5a9663020a5c534557dd0f5c8ba71da4ebd4 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; X-Frame-Options SAMEORIGIN Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:52:42 GMT content-security-policy upgrade-insecure-requests; cf-cache-status HIT age 1641007 cf-polished status=not_needed content-length 575 cf-bgj imgq:85,h2pri last-modified Mon, 03 May 2010 23:34:02 GMT server cloudflare etag "23f-485b90722ae80" vary User-Agent, Accept-Encoding x-frame-options SAMEORIGIN content-type image/png cache-control max-age=2592000 accept-ranges bytes cf-ray 79c44a82a9613a52-FRA expires Fri, 03 Mar 2023 04:02:35 GMT
GET H2	200	forum-logo.png www.bleepstatic.com/logo/	5 KB 5 KB	55ms 45ms	Image image/webp	172.67.75.139 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/logo/forum-logo.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.67.75.139 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 9e5a1148e6ba00dec0218671857bc04820e1a4628a6de00a659ece715a6ed2f6 Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:52:42 GMT cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 898553 cf-polished origFmt=png, origSize=9361 content-disposition inline; filename="forum-logo.webp" content-length 4656 cf-bgj imgq:85,h2pri last-modified Fri, 26 Nov 2010 18:53:37 GMT server cloudflare vary Accept report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VYlAy2G8OgjioO%2FnOFcVUUxepbSKVU1RkYWATi0Oxr29P5kpgeZutvsMp6KrrfPLGSfD%2FXfzc1KSUVsSQ1zaiFi%2FLix6Iy9c8LBKeE5SNyvoLogJ%2FVm2%2F2Z1QoO13pyjMtcDWdg%3D"}],"group":"cf-nel","max_age":604800} content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 79c44a82afa03a79-FRA expires Sat, 11 Mar 2023 18:16:49 GMT
GET H2	200	useropts_arrow.png www.bleepingcomputer.com/forums/public/style_images/master/	81 B 192 B	67ms 58ms	Image image/png	104.20.60.209 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepingcomputer.com/forums/public/style_images/master/useropts_arrow.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.20.60.209 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c7451690fed2a104bf6ff86e5ab0b3a7d8393d26a859a4bad6ba81b1d7aa339d Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; X-Frame-Options SAMEORIGIN Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:52:42 GMT content-security-policy upgrade-insecure-requests; cf-cache-status HIT age 1641007 cf-polished origSize=129, status=vary_header_present content-length 81 cf-bgj imgq:85,h2pri last-modified Mon, 03 May 2010 23:34:02 GMT server cloudflare etag "81-485b90722ae80" vary User-Agent, Accept-Encoding x-frame-options SAMEORIGIN content-type image/png cache-control max-age=2592000 accept-ranges bytes cf-ray 79c44a82a9643a52-FRA expires Fri, 03 Mar 2023 04:02:35 GMT
GET H2	200	default_large.png www.bleepingcomputer.com/forums/public/style_images/master/profile/	2 KB 3 KB	61ms 52ms	Image image/png	104.20.60.209 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepingcomputer.com/forums/public/style_images/master/profile/default_large.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.20.60.209 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8f7ad438c88cd0653af6066d4c148e00824961112a865f9611e258b9f3cc0981 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; X-Frame-Options SAMEORIGIN Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:52:42 GMT content-security-policy upgrade-insecure-requests; cf-cache-status HIT age 1642172 cf-polished origSize=2589, status=vary_header_present content-length 2456 cf-bgj imgq:85,h2pri last-modified Wed, 09 Mar 2011 20:59:50 GMT server cloudflare etag "a1d-49e13027a9d80" vary User-Agent, Accept-Encoding x-frame-options SAMEORIGIN content-type image/png cache-control max-age=2592000 accept-ranges bytes cf-ray 79c44a82a9653a52-FRA expires Fri, 03 Mar 2023 03:43:10 GMT
GET H2	200	icon_share.png www.bleepingcomputer.com/forums/public/style_images/master/	188 B 353 B	68ms 59ms	Image image/png	104.20.60.209 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepingcomputer.com/forums/public/style_images/master/icon_share.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.20.60.209 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d1832b7da0292ab076dfe046f8b1c2d5fcfd1bfb5628b7e21a3754a20308aa57 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; X-Frame-Options SAMEORIGIN Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:52:42 GMT content-security-policy upgrade-insecure-requests; cf-cache-status HIT age 1636827 cf-polished origSize=1201, status=vary_header_present content-length 188 cf-bgj imgq:85,h2pri last-modified Fri, 12 Oct 2012 09:31:38 GMT server cloudflare etag "4b1-4cbd95ac45280" vary User-Agent, Accept-Encoding x-frame-options SAMEORIGIN content-type image/png cache-control max-age=2592000 accept-ranges bytes cf-ray 79c44a82a9673a52-FRA expires Fri, 03 Mar 2023 05:12:15 GMT
GET H2	200	ips.quickpm.js Show response www.bleepingcomputer.com/forums/public/js/	5 KB 2 KB	52ms 51ms	Script application/javascript	104.20.60.209 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepingcomputer.com/forums/public/js/ips.quickpm.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/forums/public/js/ipb.js?ipbv=27abb701147009d4a8a9411a195be634&load=quickpm,hovercard,sharelinks,topic,like Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.20.60.209 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f34544ddb27241b3eccb8e06d7447230005e8718b463a30d9dd83d1e8bada1a1 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; X-Frame-Options SAMEORIGIN Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:52:42 GMT content-security-policy upgrade-insecure-requests; content-encoding br cf-cache-status HIT cf-bgj minify last-modified Wed, 29 May 2013 16:10:52 GMT server cloudflare age 1931 cf-polished origSize=7306 etag W/"1c8a-4dddda0323b00-gzip" vary Accept-Encoding,User-Agent x-frame-options SAMEORIGIN content-type application/javascript cache-control max-age=18000 cf-ray 79c44a8229073a52-FRA
GET H2	200	ips.hovercard.js Show response www.bleepingcomputer.com/forums/public/js/	7 KB 2 KB	56ms 55ms	Script application/javascript	104.20.60.209 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepingcomputer.com/forums/public/js/ips.hovercard.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/forums/public/js/ipb.js?ipbv=27abb701147009d4a8a9411a195be634&load=quickpm,hovercard,sharelinks,topic,like Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.20.60.209 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 3e3b8f6c06d2d74cc294ee6439e67b08890587be0081249a158469ace2eaeaaf Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; X-Frame-Options SAMEORIGIN Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:52:42 GMT content-security-policy upgrade-insecure-requests; content-encoding br cf-cache-status HIT cf-bgj minify last-modified Wed, 29 May 2013 16:10:52 GMT server cloudflare age 1930 cf-polished origSize=12576 etag W/"3120-4dddda0323b00-gzip" vary Accept-Encoding,User-Agent x-frame-options SAMEORIGIN content-type application/javascript cache-control max-age=18000 cf-ray 79c44a8229083a52-FRA
GET H2	200	ips.sharelinks.js Show response www.bleepingcomputer.com/forums/public/js/	4 KB 1 KB	57ms 56ms	Script application/javascript	104.20.60.209 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepingcomputer.com/forums/public/js/ips.sharelinks.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/forums/public/js/ipb.js?ipbv=27abb701147009d4a8a9411a195be634&load=quickpm,hovercard,sharelinks,topic,like Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.20.60.209 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0f1e90548e911e24dedcb2ca0ffee6847a49a8648e9c615bcd0582bb7c7993fd Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; X-Frame-Options SAMEORIGIN Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:52:42 GMT content-security-policy upgrade-insecure-requests; content-encoding br cf-cache-status HIT cf-bgj minify last-modified Wed, 29 May 2013 16:10:44 GMT server cloudflare age 1930 cf-polished origSize=5869 etag W/"16ed-4dddd9fb82900-gzip" vary Accept-Encoding,User-Agent x-frame-options SAMEORIGIN content-type application/javascript cache-control max-age=18000 cf-ray 79c44a82290a3a52-FRA
GET H2	200	ips.topic.js Show response www.bleepingcomputer.com/forums/public/js/	28 KB 7 KB	51ms 50ms	Script application/javascript	104.20.60.209 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepingcomputer.com/forums/public/js/ips.topic.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/forums/public/js/ipb.js?ipbv=27abb701147009d4a8a9411a195be634&load=quickpm,hovercard,sharelinks,topic,like Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.20.60.209 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a51f645170637f10f3eba218020318af3fff3ad8e7087db87ef607896f19a940 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; X-Frame-Options SAMEORIGIN Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:52:42 GMT content-security-policy upgrade-insecure-requests; content-encoding br cf-cache-status HIT cf-bgj minify last-modified Tue, 29 Dec 2015 18:39:43 GMT server cloudflare age 1930 cf-polished origSize=45653 etag W/"b255-5280dbeb879c0-gzip" vary Accept-Encoding,User-Agent x-frame-options SAMEORIGIN content-type application/javascript cache-control max-age=18000 cf-ray 79c44a82290c3a52-FRA
GET H2	200	ips.like.js Show response www.bleepingcomputer.com/forums/public/js/	4 KB 1 KB	56ms 55ms	Script application/javascript	104.20.60.209 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepingcomputer.com/forums/public/js/ips.like.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/forums/public/js/ipb.js?ipbv=27abb701147009d4a8a9411a195be634&load=quickpm,hovercard,sharelinks,topic,like Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.20.60.209 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash bf50c94253085740a5cce42e9c14f7b897cfc384303b38a5d9d7a0ab8ea5160f Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; X-Frame-Options SAMEORIGIN Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:52:42 GMT content-security-policy upgrade-insecure-requests; content-encoding br cf-cache-status HIT cf-bgj minify last-modified Wed, 29 May 2013 16:10:44 GMT server cloudflare age 1929 cf-polished origSize=6287 etag W/"188f-4dddd9fb82900-gzip" vary Accept-Encoding,User-Agent x-frame-options SAMEORIGIN content-type application/javascript cache-control max-age=18000 cf-ray 79c44a82290d3a52-FRA
GET H2	200	post_top.png www.bleepstatic.com/skin_images/bc/	226 B 608 B	56ms 47ms	Image image/webp	172.67.75.139 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/skin_images/bc/post_top.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.67.75.139 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash efc6361ebe5a559578c83bf197d5407b7f6bf44f74d35c4ee8eb22c810fb34a7 Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:52:42 GMT cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 286607 cf-polished origFmt=png, origSize=3076 content-disposition inline; filename="post_top.webp" content-length 226 cf-bgj imgq:85,h2pri last-modified Wed, 09 Jun 2010 03:08:32 GMT server cloudflare vary Accept report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=G3SB28MjvpBhwLyfA4OA1udSDu9Z61qDZmkSuToWi%2F6c6x5%2BGvPXpaLFQtVPRx%2FtGzdzZSFVmXfgT2x%2FN7v7AJnLZKTAdS4COT0ljlCLjUgSeOJZiZQ6aNmEHjuVTy13VeCn2hg%3D"}],"group":"cf-nel","max_age":604800} content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 79c44a82afa23a79-FRA expires Sat, 18 Mar 2023 20:15:54 GMT
GET H2	200	bot.jpg www.bleepstatic.com/images/site/forum/bots/	934 B 1 KB	64ms 56ms	Image image/webp	172.67.75.139 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/site/forum/bots/bot.jpg Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.67.75.139 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 63e2dfceaeeb7e8b933fa7fe96048fac66ad3fab6ab270b8e4a28ce02c1b73ab Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:52:42 GMT cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 1636825 cf-polished qual=85, origFmt=jpeg, origSize=1566 content-disposition inline; filename="bot.webp" content-length 934 cf-bgj imgq:85,h2pri last-modified Tue, 20 Oct 2009 04:08:57 GMT server cloudflare vary Accept report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=i4ZIH0l48RsWbyeMkll9df3S%2B71cOgoXaJM7uufIgCMgmt7kVvNx9QvS9LX3Jt8mvmcb%2BObd4i57S4M1hmvPzoo7wHr0s94%2FywCb%2B3%2B4A3%2FcMmBKGNw7Q1eYCU4Ern5AeYoyiJ4%3D"}],"group":"cf-nel","max_age":604800} content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 79c44a82afa43a79-FRA expires Fri, 03 Mar 2023 05:12:16 GMT
GET H2	200	av-26513.jpg www.bleepingcomputer.com/forums/uploads/	2 KB 2 KB	61ms 53ms	Image image/jpeg	104.20.60.209 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepingcomputer.com/forums/uploads/av-26513.jpg?_r=0 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.20.60.209 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d3d701e73f87f16dc3da39be50983234515272e594189cdb092f4826e2602638 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; X-Frame-Options SAMEORIGIN Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:52:42 GMT content-security-policy upgrade-insecure-requests; cf-cache-status HIT age 1635442 cf-polished degrade=85, origSize=3130, status=vary_header_present content-length 2225 cf-bgj imgq:85,h2pri last-modified Thu, 08 Sep 2005 19:07:06 GMT server cloudflare etag "c3a-400475df72a80" vary User-Agent, Accept-Encoding x-frame-options SAMEORIGIN content-type image/jpeg cache-control max-age=2592000 accept-ranges bytes cf-ray 79c44a82a9683a52-FRA expires Fri, 03 Mar 2023 05:35:20 GMT
GET H2	200	kO7xOZh.gif i.imgur.com/	3 KB 3 KB	160ms 47ms	Image image/gif	199.232.16.193 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://i.imgur.com/kO7xOZh.gif Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 199.232.16.193 Vienna, Austria, ASN54113 (FASTLY, US), Reverse DNS Software cat factory 1.0 / Resource Hash 608501196c0571ec771c62b340f68dbcd57d10b119d7c4fe87cca2ed81a79e2a Security Headers Name Value Strict-Transport-Security max-age=300 X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:52:42 GMT strict-transport-security max-age=300 x-content-type-options nosniff age 1701386 x-cache HIT, HIT content-length 3078 x-served-by cache-iad-kcgs7200073-IAD, cache-vie6344-VIE last-modified Thu, 01 Dec 2016 18:42:01 GMT server cat factory 1.0 x-timer S1676865163.770264,VS0,VE1 etag "c7ab4b049bf557e389fff83e16b8a451" access-control-allow-methods GET, OPTIONS content-type image/gif access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes x-cache-hits 644, 1
GET H2	200	38WxTfO.gif i.imgur.com/	1 KB 2 KB	159ms 46ms	Image image/gif	199.232.16.193 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://i.imgur.com/38WxTfO.gif Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 199.232.16.193 Vienna, Austria, ASN54113 (FASTLY, US), Reverse DNS Software cat factory 1.0 / Resource Hash 154f3a9ed4f3ac0059fc18337f3cb4d28103f349b3e256458f6a39b23d3c092b Security Headers Name Value Strict-Transport-Security max-age=300 X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:52:42 GMT strict-transport-security max-age=300 x-content-type-options nosniff age 2917541 x-cache HIT, HIT content-length 1491 x-served-by cache-iad-kcgs7200106-IAD, cache-vie6344-VIE last-modified Fri, 09 Dec 2016 11:33:28 GMT server cat factory 1.0 x-timer S1676865163.770251,VS0,VE1 etag "74f7d23b80fa48165e56fd6193e83ae3" access-control-allow-methods GET, OPTIONS content-type image/gif access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes x-cache-hits 1408, 1
GET H2	200	twitter.png www.bleepingcomputer.com/forums/public/style_extra/sharelinks/	575 B 738 B	60ms 52ms	Image image/png	104.20.60.209 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepingcomputer.com/forums/public/style_extra/sharelinks/twitter.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.20.60.209 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash abe9d30276e3d66a71219ad2b0ed5a9663020a5c534557dd0f5c8ba71da4ebd4 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; X-Frame-Options SAMEORIGIN Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:52:42 GMT content-security-policy upgrade-insecure-requests; cf-cache-status HIT age 1642933 cf-polished status=not_needed content-length 575 cf-bgj imgq:85,h2pri last-modified Fri, 30 Apr 2010 22:16:02 GMT server cloudflare etag "23f-4857b96a96c80" vary User-Agent, Accept-Encoding x-frame-options SAMEORIGIN content-type image/png cache-control max-age=2592000 accept-ranges bytes cf-ray 79c44a82a9693a52-FRA expires Fri, 03 Mar 2023 03:30:29 GMT
GET H2	200	plusone.js Show response apis.google.com/js/	54 KB 21 KB	242ms 90ms	Script text/javascript	2a00:1450:400d:807::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://apis.google.com/js/plusone.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400d:807::200e , Ireland, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash cb904999bf7cbddd750a0f2f54519406f23d7ce80ccd314ae048473714370804 Security Headers Name Value Content-Security-Policy require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers content-security-policy require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team content-encoding gzip x-content-type-options nosniff date Mon, 20 Feb 2023 03:52:42 GMT cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 20951 x-xss-protection 0 server sffe cross-origin-opener-policy same-origin; report-to="gapi-team" etag "af4438b8f8bc2ef6" vary Accept-Encoding report-to {"group":"gapi-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gapi-team"}]} content-type text/javascript access-control-allow-origin * cache-control private, max-age=1800, stale-while-revalidate=1800 accept-ranges bytes timing-allow-origin * expires Mon, 20 Feb 2023 03:52:42 GMT
GET H2	200	digg.png www.bleepingcomputer.com/forums/public/style_extra/sharelinks/	357 B 499 B	60ms 54ms	Image image/png	104.20.60.209 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepingcomputer.com/forums/public/style_extra/sharelinks/digg.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.20.60.209 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f33585b10bb5487bd6c92f53018de62cb147ab48b829334b7f97437015aae557 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; X-Frame-Options SAMEORIGIN Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:52:42 GMT content-security-policy upgrade-insecure-requests; cf-cache-status HIT age 1641007 cf-polished origSize=431, status=vary_header_present content-length 357 cf-bgj imgq:85,h2pri last-modified Fri, 30 Apr 2010 22:16:02 GMT server cloudflare etag "1af-4857b96a96c80" vary User-Agent, Accept-Encoding x-frame-options SAMEORIGIN content-type image/png cache-control max-age=2592000 accept-ranges bytes cf-ray 79c44a82a96a3a52-FRA expires Fri, 03 Mar 2023 04:02:35 GMT
GET H2	200	delicious.png www.bleepingcomputer.com/forums/public/style_extra/sharelinks/	305 B 447 B	93ms 86ms	Image image/png	104.20.60.209 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepingcomputer.com/forums/public/style_extra/sharelinks/delicious.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.20.60.209 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 4b9f912b0e7a50c12745f52ec2848dce5b779369999c6d35e6c297c713ce53d3 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; X-Frame-Options SAMEORIGIN Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:52:42 GMT content-security-policy upgrade-insecure-requests; cf-cache-status HIT age 1641008 cf-polished origSize=308, status=vary_header_present content-length 305 cf-bgj imgq:85,h2pri last-modified Fri, 30 Apr 2010 22:16:02 GMT server cloudflare etag "134-4857b96a96c80" vary User-Agent, Accept-Encoding x-frame-options SAMEORIGIN content-type image/png cache-control max-age=2592000 accept-ranges bytes cf-ray 79c44a82d9983a52-FRA expires Fri, 03 Mar 2023 04:02:34 GMT
GET H2	200	reddit.png www.bleepingcomputer.com/forums/public/style_extra/sharelinks/	611 B 805 B	93ms 87ms	Image image/png	104.20.60.209 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepingcomputer.com/forums/public/style_extra/sharelinks/reddit.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.20.60.209 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 9019adc6ec44d2cd4f38c97b8319b0ae8da8f03b3bd646d4f86707f23f8935a0 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; X-Frame-Options SAMEORIGIN Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:52:42 GMT content-security-policy upgrade-insecure-requests; cf-cache-status HIT age 1641007 cf-polished origSize=614, status=vary_header_present content-length 611 cf-bgj imgq:85,h2pri last-modified Fri, 30 Apr 2010 22:16:02 GMT server cloudflare etag "266-4857b96a96c80" vary User-Agent, Accept-Encoding x-frame-options SAMEORIGIN content-type image/png cache-control max-age=2592000 accept-ranges bytes cf-ray 79c44a82d9993a52-FRA expires Fri, 03 Mar 2023 04:02:35 GMT
GET H2	200	stumble.png www.bleepingcomputer.com/forums/public/style_extra/sharelinks/	458 B 571 B	99ms 93ms	Image image/png	104.20.60.209 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepingcomputer.com/forums/public/style_extra/sharelinks/stumble.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.20.60.209 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0e2a136c594c939d55752e9abb70e6cc550b10bc3bc350c0d46d23d5947c20d1 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; X-Frame-Options SAMEORIGIN Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:52:42 GMT content-security-policy upgrade-insecure-requests; cf-cache-status HIT age 1641007 cf-polished origSize=519, status=vary_header_present content-length 458 cf-bgj imgq:85,h2pri last-modified Fri, 30 Apr 2010 22:16:02 GMT server cloudflare etag "207-4857b96a96c80" vary User-Agent, Accept-Encoding x-frame-options SAMEORIGIN content-type image/png cache-control max-age=2592000 accept-ranges bytes cf-ray 79c44a82d99a3a52-FRA expires Fri, 03 Mar 2023 04:02:35 GMT
GET H2	200	email.png www.bleepingcomputer.com/forums/public/style_extra/sharelinks/	481 B 632 B	94ms 88ms	Image image/png	104.20.60.209 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepingcomputer.com/forums/public/style_extra/sharelinks/email.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.20.60.209 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 453d30f69cc2a6f3013254a0faed039d49cf9c5b004d5482fb5365e99702c149 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; X-Frame-Options SAMEORIGIN Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:52:42 GMT content-security-policy upgrade-insecure-requests; cf-cache-status HIT age 1641007 cf-polished origSize=530, status=vary_header_present content-length 481 cf-bgj imgq:85,h2pri last-modified Thu, 04 Feb 2010 11:47:46 GMT server cloudflare etag "212-47ec4e74b3c80" vary User-Agent, Accept-Encoding x-frame-options SAMEORIGIN content-type image/png cache-control max-age=2592000 accept-ranges bytes cf-ray 79c44a82d99b3a52-FRA expires Fri, 03 Mar 2023 04:02:35 GMT
GET H2	200	print.png www.bleepingcomputer.com/forums/public/style_extra/sharelinks/	268 B 429 B	97ms 92ms	Image image/png	104.20.60.209 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepingcomputer.com/forums/public/style_extra/sharelinks/print.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.20.60.209 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6aeb9f7542993c71c548ac254766824ef86c68f0d6fa13f293bd016b9cfc9dc6 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; X-Frame-Options SAMEORIGIN Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:52:42 GMT content-security-policy upgrade-insecure-requests; cf-cache-status HIT age 1641007 cf-polished origSize=409, status=vary_header_present content-length 268 cf-bgj imgq:85,h2pri last-modified Fri, 30 Apr 2010 22:16:02 GMT server cloudflare etag "199-4857b96a96c80" vary User-Agent, Accept-Encoding x-frame-options SAMEORIGIN content-type image/png cache-control max-age=2592000 accept-ranges bytes cf-ray 79c44a82d99c3a52-FRA expires Fri, 03 Mar 2023 04:02:35 GMT
GET H2	200	download.png www.bleepingcomputer.com/forums/public/style_extra/sharelinks/	646 B 751 B	91ms 85ms	Image image/png	104.20.60.209 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepingcomputer.com/forums/public/style_extra/sharelinks/download.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.20.60.209 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 386f87a6e6fcb89c6b046f988d18def949d1cc1f6a9fa4177858aa11da7a5bda Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; X-Frame-Options SAMEORIGIN Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:52:42 GMT content-security-policy upgrade-insecure-requests; cf-cache-status HIT age 1641007 cf-polished status=not_needed content-length 646 cf-bgj imgq:85,h2pri last-modified Fri, 12 Feb 2010 14:33:56 GMT server cloudflare etag "286-47f6828485d00" vary User-Agent, Accept-Encoding x-frame-options SAMEORIGIN content-type image/png cache-control max-age=2592000 accept-ranges bytes cf-ray 79c44a82d99d3a52-FRA expires Fri, 03 Mar 2023 04:02:35 GMT
GET H2	200	prettify.js Show response www.bleepingcomputer.com/forums/public/js/3rd_party/prettify/	14 KB 7 KB	61ms 50ms	Script application/javascript	104.20.60.209 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepingcomputer.com/forums/public/js/3rd_party/prettify/prettify.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.20.60.209 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b937537ed7f13e70dc6a69b6e9b308237cd369e11fa2a2b97a24d97d8487673e Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; X-Frame-Options SAMEORIGIN Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:52:42 GMT content-security-policy upgrade-insecure-requests; content-encoding br cf-cache-status HIT cf-bgj minify last-modified Wed, 29 May 2013 16:10:52 GMT server cloudflare age 1932 cf-polished origSize=14551 etag W/"38d7-4dddda0323b00-gzip" vary Accept-Encoding,User-Agent x-frame-options SAMEORIGIN content-type application/javascript cache-control max-age=18000 cf-ray 79c44a82995c3a52-FRA
GET H2	200	lang-sql.js Show response www.bleepingcomputer.com/forums/public/js/3rd_party/prettify/	2 KB 1 KB	61ms 51ms	Script application/javascript	104.20.60.209 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepingcomputer.com/forums/public/js/3rd_party/prettify/lang-sql.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.20.60.209 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 770cb6f8747e90dad261e049dfa5cf42e622dac61bcbc86ecb0a8c134228eb91 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; X-Frame-Options SAMEORIGIN Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:52:42 GMT content-security-policy upgrade-insecure-requests; content-encoding br cf-cache-status HIT cf-bgj minify last-modified Wed, 29 May 2013 16:10:52 GMT server cloudflare age 1931 cf-polished origSize=1802 etag W/"70a-4dddda0323b00-gzip" vary Accept-Encoding,User-Agent x-frame-options SAMEORIGIN content-type application/javascript cache-control max-age=18000 cf-ray 79c44a82995e3a52-FRA
GET H2	200	top.png www.bleepingcomputer.com/forums/public/style_images/master/	145 B 280 B	91ms 86ms	Image image/png	104.20.60.209 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepingcomputer.com/forums/public/style_images/master/top.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.20.60.209 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash db311c11353d5628e6e28d260bca9b8935b23440964d7c6bc4914edcda08472a Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; X-Frame-Options SAMEORIGIN Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:52:42 GMT content-security-policy upgrade-insecure-requests; cf-cache-status HIT age 1641007 cf-polished origSize=207, status=vary_header_present content-length 145 cf-bgj imgq:85,h2pri last-modified Thu, 09 Jun 2011 17:25:44 GMT server cloudflare etag "cf-4a54abe32b600" vary User-Agent, Accept-Encoding x-frame-options SAMEORIGIN content-type image/png cache-control max-age=2592000 accept-ranges bytes cf-ray 79c44a82d99e3a52-FRA expires Fri, 03 Mar 2023 04:02:35 GMT
GET H2	200	feed.png www.bleepingcomputer.com/forums/public/style_images/master/	680 B 776 B	94ms 89ms	Image image/png	104.20.60.209 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepingcomputer.com/forums/public/style_images/master/feed.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.20.60.209 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 9320021507b35e189d2190eea673cbc21f7d368f6ecbfb5dc89d773a28cd015d Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; X-Frame-Options SAMEORIGIN Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:52:42 GMT content-security-policy upgrade-insecure-requests; cf-cache-status HIT age 1641007 cf-polished status=not_needed content-length 680 cf-bgj imgq:85,h2pri last-modified Mon, 03 May 2010 23:34:02 GMT server cloudflare etag "2a8-485b90722ae80" vary User-Agent, Accept-Encoding x-frame-options SAMEORIGIN content-type image/png cache-control max-age=2592000 accept-ranges bytes cf-ray 79c44a82d99f3a52-FRA expires Fri, 03 Mar 2023 04:02:35 GMT
GET H2	200	lightbox.js Show response www.bleepingcomputer.com/forums/public/js/3rd_party/	9 KB 3 KB	59ms 49ms	Script application/javascript	104.20.60.209 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepingcomputer.com/forums/public/js/3rd_party/lightbox.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.20.60.209 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 9faebe5bdb9528f36d1ec5713865681bf10c7c0d1fa1b8224fc57982f45ed788 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; X-Frame-Options SAMEORIGIN Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:52:42 GMT content-security-policy upgrade-insecure-requests; content-encoding br cf-cache-status HIT cf-bgj minify last-modified Sun, 15 Nov 2020 22:30:01 GMT server cloudflare age 1931 cf-polished origSize=10227 etag W/"27f3-5b42ccd71fd03-gzip" vary Accept-Encoding,User-Agent x-frame-options SAMEORIGIN content-type application/javascript cache-control max-age=18000 cf-ray 79c44a82995f3a52-FRA
GET H2	200	3687X620620.skimlinks.js Show response s.skimresources.com/js/	42 KB 15 KB	233ms 43ms	Script application/octet-stream	151.139.128.10 STACKPATH-CDN
General Check archive.org Show headers Download Go to Full URL https://s.skimresources.com/js/3687X620620.skimlinks.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US), Reverse DNS map3.hwcdn.net Software AmazonS3 / Resource Hash ce7b1a6c719ed715da6b5676b1acf024fe02fc472e68368e32fe95b24bbba57e Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:52:42 GMT content-encoding gzip last-modified Tue, 30 Aug 2022 08:57:51 GMT server AmazonS3 x-amz-request-id 4WB7DMB8MC545H1S etag "d99452f324ec29acc54a97eee1386ff6" x-hw 1676865162.cds053.fr8.hn,1676865162.cds331.fr8.c content-type application/octet-stream cache-control max-age=3600 accept-ranges bytes content-length 15550 x-amz-id-2 KmkntnGZHyA7bDYfQApl3hQ/ZgoIU5zR65SdnoMWfWtDXVBdv7HciJ6c6JYO36Bhfb4AEI9HQc8=
GET H2	200	vaafb692b2aea4879b33c060e79fe94621666317369993 Show response static.cloudflareinsights.com/beacon.min.js/	17 KB 6 KB	172ms 67ms	Script text/javascript	2606:4700::6810:3965 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://static.cloudflareinsights.com/beacon.min.js/vaafb692b2aea4879b33c060e79fe94621666317369993 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:3965 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0f48c5678ce459a596423b0e55344e7ad8eb3d3b1b27c54cd76a9d4cee7dd6c3 Request headers Referer https://www.bleepingcomputer.com/ Origin https://www.bleepingcomputer.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:52:42 GMT content-encoding gzip last-modified Fri, 21 Oct 2022 01:56:09 GMT server cloudflare etag W/2022.10.1 vary Accept-Encoding content-type text/javascript;charset=UTF-8 access-control-allow-origin * cache-control public, max-age=86400 cross-origin-resource-policy cross-origin cf-ray 79c44a834a1c697f-FRA
GET H2	200	pubfig.min.js Show response a.pub.network/bleepingcomputer-com/	107 KB 38 KB	152ms 51ms	Script application/javascript	2606:4700::6812:15ce CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://a.pub.network/bleepingcomputer-com/pubfig.min.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:15ce , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 9a0d51cfff55d3eba59cfdb81c47e167903738a5529bd7d56d767af8846f71f8 Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:52:42 GMT content-encoding gzip cf-cache-status HIT age 445636 x-guploader-uploadid ADPycdvUc-8RftBDl337eZ6SaZFdor2r2cgXVAUpnZ9U_kcrzjaflx_CEOwubhIHgwU57b3LiXifr7l0ak14liL-16le1Q x-goog-storage-class MULTI_REGIONAL x-goog-metageneration 1 x-goog-stored-content-encoding identity last-modified Mon, 13 Feb 2023 19:58:11 GMT server cloudflare etag W/"18d4d63d39bb1a49aa692a718d0dec53" vary Accept-Encoding x-goog-generation 1676318291480089 content-type application/javascript access-control-allow-origin * x-goog-hash crc32c=0b5Yrw==, md5=GNTWPTm7GkmqaSpxjQ3sUw== access-control-expose-headers * cache-control public, max-age=1800 x-goog-stored-content-length 109605 cf-ray 79c44a83380cbbc5-FRA expires Mon, 20 Feb 2023 04:22:42 GMT
GET H2	200	fab.js Show response ecdn.analysis.fi/static/js/	4 KB 2 KB	916ms 299ms	Script application/javascript	18.64.8.118 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://ecdn.analysis.fi/static/js/fab.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.64.8.118 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-64-8-118.icn57.r.cloudfront.net Software Apache/2.4.54 (Debian) / Resource Hash d8a34aeacc4054bd4e119e538c7eb4956421014f48a9b603d3f9314a7435b5a6 Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:25:30 GMT content-encoding gzip via 1.1 1c2dddf38b53f960ce106f4047c232e4.cloudfront.net (CloudFront) x-amz-cf-pop ICN57-P2 age 1633 x-cache Hit from cloudfront content-length 1696 last-modified Thu, 16 Feb 2023 16:12:34 GMT server Apache/2.4.54 (Debian) etag "1090-5f4d376ebe080-gzip" vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control max-age=1800, public accept-ranges bytes x-amz-cf-id tM-23VpSdn3IcCvVYwWZs7XBvPOunioWvkDDAxRj4hM_Z6ko7gjFrg==
GET H/1.1	200 OK	fi_client.js Show response ecdn.firstimpression.io/	350 KB 92 KB	162ms 51ms	Script application/javascript	13.32.110.7 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://ecdn.firstimpression.io/fi_client.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 13.32.110.7 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-32-110-7.vie50.r.cloudfront.net Software Apache/2.4.54 (Debian) / PHP/8.2.0 Resource Hash f0994f22e90b7d1e2da551344ed73e86496a5725cb41e50045cf47fb05448857 Security Headers Name Value X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers Date Mon, 20 Feb 2023 03:18:57 GMT Content-Encoding br Via 1.1 f886f6227d3373aee9b545641306fb68.cloudfront.net (CloudFront) X-Amz-Cf-Pop VIE50-C2 Age 2025 X-Powered-By PHP/8.2.0 Transfer-Encoding chunked X-Cache Hit from cloudfront Connection keep-alive X-XSS-Protection 0 Last-Modified Mon,20 Feb 2023 03:18:57 UTC Server Apache/2.4.54 (Debian) ETag W/"9c5686c163991384b4e42fc441bd4fb2" Vary Accept-Encoding Content-Type application/javascript Access-Control-Allow-Origin * Cache-Control max-age=1800 X-Amz-Cf-Id o9ly4FpmqIXJNd7Y5K2xKDQ_nquhngbHMz4irLEmv-rB35mi1TbYMg==
GET H2	200	ipb_print.css www.bleepingcomputer.com/forums/public/style_css/css_7/	3 KB 1 KB	98ms 94ms	Stylesheet text/css	104.20.60.209 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepingcomputer.com/forums/public/style_css/css_7/ipb_print.css Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.20.60.209 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash cbd8236978dd3f165bc49566f78c460e3937e552df38787439c1ef2797c4c709 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; X-Frame-Options SAMEORIGIN Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:52:42 GMT content-security-policy upgrade-insecure-requests; content-encoding br cf-cache-status HIT cf-bgj minify last-modified Wed, 14 Dec 2022 03:24:28 GMT server cloudflare age 1927 cf-polished origSize=3158 etag W/"c56-5efc1463265b4-gzip" vary Accept-Encoding,User-Agent x-frame-options SAMEORIGIN content-type text/css cache-control max-age=18000 cf-ray 79c44a82d9a53a52-FRA
GET H2	200	user_navigation.png www.bleepingcomputer.com/forums/public/style_images/master/	189 B 324 B	96ms 92ms	Image image/png	104.20.60.209 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepingcomputer.com/forums/public/style_images/master/user_navigation.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.20.60.209 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 3e6274abac1820c8bd99f826cf35a60aeaa56b962500486acc5665f98005031e Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; X-Frame-Options SAMEORIGIN Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:52:42 GMT content-security-policy upgrade-insecure-requests; cf-cache-status HIT age 1641007 cf-polished origSize=282, status=vary_header_present content-length 189 cf-bgj imgq:85,h2pri last-modified Tue, 01 Mar 2011 13:54:08 GMT server cloudflare etag "11a-49d6c2153a000" vary User-Agent, Accept-Encoding x-frame-options SAMEORIGIN content-type image/png cache-control max-age=2592000 accept-ranges bytes cf-ray 79c44a82d9a13a52-FRA expires Fri, 03 Mar 2023 04:02:35 GMT
GET H2	200	advanced_search.png www.bleepingcomputer.com/forums/public/style_images/master/	261 B 433 B	91ms 87ms	Image image/png	104.20.60.209 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepingcomputer.com/forums/public/style_images/master/advanced_search.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.20.60.209 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 14dcce7abfc690cecd57a737a8af6fd712c2b7fec668b772d9f014f6ded77ef8 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; X-Frame-Options SAMEORIGIN Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:52:42 GMT content-security-policy upgrade-insecure-requests; cf-cache-status HIT age 1641007 cf-polished origSize=293, status=vary_header_present content-length 261 cf-bgj imgq:85,h2pri last-modified Mon, 03 May 2010 23:34:02 GMT server cloudflare etag "125-485b90722ae80" vary User-Agent, Accept-Encoding x-frame-options SAMEORIGIN content-type image/png cache-control max-age=2592000 accept-ranges bytes cf-ray 79c44a82d9a23a52-FRA expires Fri, 03 Mar 2023 04:02:35 GMT
GET H2	200	search_icon.png www.bleepingcomputer.com/forums/public/style_images/master/	202 B 314 B	93ms 90ms	Image image/png	104.20.60.209 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepingcomputer.com/forums/public/style_images/master/search_icon.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.20.60.209 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 51f20d95dad9ea1473e4f877b5f7a7d8bcd589f1f989b8875ffddd83ae716a21 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; X-Frame-Options SAMEORIGIN Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:52:42 GMT content-security-policy upgrade-insecure-requests; cf-cache-status HIT age 1641007 cf-polished origSize=223, status=vary_header_present content-length 202 cf-bgj imgq:85,h2pri last-modified Mon, 03 May 2010 23:34:02 GMT server cloudflare etag "df-485b90722ae80" vary User-Agent, Accept-Encoding x-frame-options SAMEORIGIN content-type image/png cache-control max-age=2592000 accept-ranges bytes cf-ray 79c44a82d9a33a52-FRA expires Fri, 03 Mar 2023 04:02:35 GMT
GET H2	200	icon_quicknav.png www.bleepingcomputer.com/forums/public/style_images/master/	489 B 608 B	91ms 88ms	Image image/png	104.20.60.209 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepingcomputer.com/forums/public/style_images/master/icon_quicknav.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.20.60.209 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d1731db9016f326daff11d0045c86fd068ec9e72cc4c6ec56a7c856a3a3d28c7 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; X-Frame-Options SAMEORIGIN Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:52:42 GMT content-security-policy upgrade-insecure-requests; cf-cache-status HIT age 1641007 cf-polished status=not_needed content-length 489 cf-bgj imgq:85,h2pri last-modified Fri, 01 Jul 2011 10:17:42 GMT server cloudflare etag "1e9-4a6ff53f0bd80" vary User-Agent, Accept-Encoding x-frame-options SAMEORIGIN content-type image/png cache-control max-age=2592000 accept-ranges bytes cf-ray 79c44a82d9a43a52-FRA expires Fri, 03 Mar 2023 04:02:35 GMT
GET H2	200	maintitle.png www.bleepingcomputer.com/forums/public/style_images/master/	192 B 304 B	67ms 67ms	Image image/png	104.20.60.209 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepingcomputer.com/forums/public/style_images/master/maintitle.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.20.60.209 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 85a2c5bd701224851deca6029998517a35d091922217a90241fd0c7f244e8f11 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; X-Frame-Options SAMEORIGIN Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:52:42 GMT content-security-policy upgrade-insecure-requests; cf-cache-status HIT age 1641007 cf-polished origSize=295, status=vary_header_present content-length 192 cf-bgj imgq:85,h2pri last-modified Tue, 01 Mar 2011 13:54:08 GMT server cloudflare etag "127-49d6c2153a000" vary User-Agent, Accept-Encoding x-frame-options SAMEORIGIN content-type image/png cache-control max-age=2592000 accept-ranges bytes cf-ray 79c44a82e9a63a52-FRA expires Fri, 03 Mar 2023 04:02:35 GMT
GET H2	200	icon_warning.png www.bleepingcomputer.com/forums/public/style_images/master/	268 B 433 B	63ms 63ms	Image image/png	104.20.60.209 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepingcomputer.com/forums/public/style_images/master/icon_warning.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.20.60.209 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5028e223096a25034d4d95863f89374a4b205e86354c5e4461e00272e7fab4d9 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; X-Frame-Options SAMEORIGIN Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:52:42 GMT content-security-policy upgrade-insecure-requests; cf-cache-status HIT age 1636822 cf-polished origSize=408, status=vary_header_present content-length 268 cf-bgj imgq:85,h2pri last-modified Wed, 20 Apr 2011 21:00:34 GMT server cloudflare etag "198-4a15fea6fc080" vary User-Agent, Accept-Encoding x-frame-options SAMEORIGIN content-type image/png cache-control max-age=2592000 accept-ranges bytes cf-ray 79c44a82e9a73a52-FRA expires Fri, 03 Mar 2023 05:12:20 GMT
GET H2	200	connatix.playspace.dc.js Show response cds.connatix.com/p/228932/ Frame C663 Redirect Chain https://cd.connatix.com/connatix.playspace.js https://cds.connatix.com/p/228932/connatix.playspace.dc.js?tier=1	1018 KB 265 KB	170ms 40ms	Script application/javascript	151.101.2.137 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cds.connatix.com/p/228932/connatix.playspace.dc.js?tier=1 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ Protocol H2 Server 151.101.2.137 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash ae438c03c431044dfef35800bfcb66ab37f4255f4a586ab7fb7fea17c5ea5718 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:52:43 GMT content-encoding br last-modified Fri, 17 Feb 2023 08:48:07 GMT age 240423 etag "b5904976ea4df741a2693a58ca49933b" vary Accept-Encoding access-control-max-age 86400 content-type application/javascript access-control-allow-origin * cache-control public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600 accept-ranges bytes content-length 271122 Redirect headers date Mon, 20 Feb 2023 03:52:42 GMT cf-cache-status DYNAMIC server cloudflare surrogate-control no-cache, no-store, must-revalidate, max-age=0 vary Accept-Encoding location https://cds.connatix.com/p/228932/connatix.playspace.dc.js?tier=1 cache-control no-cache, no-store, must-revalidate, max-age=0 cf-ray 79c44a839c7a3a57-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 0
GET H2	200	choice.js Show response quantcast.mgr.consensu.org/choice/sktb670LZWvFX/www.bleepingcomputer.com/	5 KB 2 KB	190ms 42ms	Script application/javascript	2600:9000:211e:d800:9:46dc:4700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://quantcast.mgr.consensu.org/choice/sktb670LZWvFX/www.bleepingcomputer.com/choice.js Requested by Host: www.bleepstatic.com URL: https://www.bleepstatic.com/js/qc-consent/qc-consent.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:211e:d800:9:46dc:4700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash a5ad4fb0d40625889969083053d32ab1191e66c11bb4aebfde2643954c0f5673 Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:52:42 GMT content-encoding br via 1.1 aff6ac5c98fa897349204752e5877c80.cloudfront.net (CloudFront) last-modified Wed, 10 Feb 2021 21:51:23 GMT server AmazonS3 x-amz-cf-pop FRA56-C2 age 43 x-amz-server-side-encryption AES256 etag W/"2a272bfedaf02360b78846550b427698" vary Access-Control-Request-Headers,Access-Control-Request-Method,Origin,Accept-Encoding x-cache Hit from cloudfront content-type application/javascript cache-control max-age=3600 cross-origin-resource-policy cross-origin x-amz-cf-id q115NbuzJh_TEzl9EW0sz172DHAL8CgAvoFgXOejH8lD6SxebtPDag==
GET H2	200	all.js Show response connect.facebook.net/en_US/	3 KB 2 KB	177ms 43ms	Script application/x-javascript	2a03:2880:f02d:12:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/en_US/all.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash e733fc01ac39decc07d5bc1e6759af80d3bf8e2a49fef44bf1f76f8db40b36e8 Security Headers Name Value Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers strict-transport-security max-age=31536000; preload; includeSubDomains content-encoding gzip x-content-type-options nosniff date Mon, 20 Feb 2023 03:52:42 GMT content-md5 iGVMH0a73rn+exfRZaO35A== document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 1687 x-fb-rlafr 0 x-fb-debug T5DMVW4CC+ExBi4qN3OWS0rY0YpeWd3huZ83LO2JlsnCe5onum8w5TiMSl8m6b3T1Q36p16LP9v4PAuGBdq3kQ== cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" x-fb-trip-id 917726464 x-fb-content-md5 ba45410f41d2d1b967e1a62da7083921 cross-origin-opener-policy same-origin-allow-popups etag "d30f3321e891c97e50648ab58b31e56c" vary Accept-Encoding report-to {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"} content-type application/x-javascript; charset=utf-8 access-control-allow-origin * access-control-expose-headers X-FB-Content-MD5 cache-control public,max-age=1200,stale-while-revalidate=3600 x-frame-options DENY timing-allow-origin * expires Mon, 20 Feb 2023 04:00:14 GMT
GET H2	200	js Show response www.googletagmanager.com/gtag/	222 KB 77 KB	54ms 54ms	Script application/javascript	2a00:1450:4001:828::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=G-GD465VRQLD&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=UA-91740-1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash c19b5d253902b4e4dc41d61636392c51f7991a244e081dc77c51d3513d60778a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:52:42 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true cross-origin-resource-policy cross-origin access-control-allow-headers Cache-Control content-length 79205 x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 expires Mon, 20 Feb 2023 03:52:42 GMT
GET H2	200	analytics.js Show response www.google-analytics.com/	49 KB 20 KB	180ms 52ms	Script text/javascript	2a00:1450:400d:80a::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=UA-91740-1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400d:80a::200e , Ireland, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff date Mon, 20 Feb 2023 03:12:06 GMT last-modified Tue, 10 Jan 2023 21:29:14 GMT server Golfe2 age 2436 vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 20085 expires Mon, 20 Feb 2023 05:12:06 GMT
GET H2	200	v2ovfnqHYOcUmGamrGBr8rqaaCGpavHQYMp3MjKMQWnQ_R4uaawJOf451Yw Show response functionalfeather.com/	57 KB 21 KB	212ms 53ms	Script text/javascript	2600:1901:0:7416::1 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://functionalfeather.com/v2ovfnqHYOcUmGamrGBr8rqaaCGpavHQYMp3MjKMQWnQ_R4uaawJOf451Yw Requested by Host: a.pub.network URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1901:0:7416::1 Kansas City, United States, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash b965a23c833aeadb8340342ac55fa8a95a5f10a157a0a662689698bd9299a986 Security Headers Name Value Strict-Transport-Security max-age=15724800; preload Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers strict-transport-security max-age=15724800; preload content-encoding br via 1.1 google date Mon, 20 Feb 2023 03:52:43 GMT x-datacenter gce-europe-west1 etag "92c1a3ce9f7781a60531c18c26c328bc97dead12544d7b43fd305ed668c55c8f" x-buildname hoothoot vary Accept-Encoding, Accept-Language x-hostname fen-hoothoot-europe-west1-spot-t1x3 content-type text/javascript; charset=utf-8 cache-control private, must-revalidate, max-age=21600 x-buildnumber 764540114 timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
GET H2	200	init Show response d.pub.network/v2/	72 KB 7 KB	254ms 157ms	Fetch application/json	34.160.110.8 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://d.pub.network/v2/init?siteId=535&env=PROD Requested by Host: a.pub.network URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.160.110.8 Kansas City, United States, ASN15169 (GOOGLE, US), Reverse DNS 8.110.160.34.bc.googleusercontent.com Software / Resource Hash f7ebcc431b4b336d8fd6ccfd0e8731283c9eadade7fec149a3f99aee2ba43d00 Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:52:43 GMT content-encoding gzip via 1.1 google vary Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Accept-Encoding, User-Agent content-type application/json access-control-allow-origin https://www.bleepingcomputer.com access-control-allow-credentials true alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
GET H2	200	favicon.ico ad.doubleclick.net/	1 KB 571 B	227ms 52ms	Image image/x-icon	142.250.180.198 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.180.198 , United States, ASN15169 (GOOGLE, US), Reverse DNS bud02s33-in-f6.1e100.net Software sffe / Resource Hash d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Sun, 19 Feb 2023 17:11:25 GMT content-encoding gzip x-content-type-options nosniff age 38478 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 104 x-xss-protection 0 last-modified Tue, 08 May 2012 13:08:06 GMT server sffe vary Accept-Encoding report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type image/x-icon access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Mon, 20 Feb 2023 17:11:25 GMT
GET H2	200	achoice.svg widgets.outbrain.com/images/widgetIcons/	990 B 1 KB	233ms 48ms	Image image/svg+xml	2.18.37.67 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://widgets.outbrain.com/images/widgetIcons/achoice.svg Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2.18.37.67 Vienna, Austria, ASN16625 (AKAMAI-AS, US), Reverse DNS a2-18-37-67.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash 9ba56f5ffa579747efde1d2a429b325a9fb7220d30f4268e4a44ecbe4a9bf034 Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers expires Wed, 22 Mar 2023 03:52:43 GMT date Mon, 20 Feb 2023 03:52:43 GMT last-modified Tue, 10 Jan 2023 16:40:08 GMT server AkamaiNetStorage etag "5ab8e16b5f46213840bcd403e349419c:1673369393.880194" access-control-allow-methods GET,POST content-type image/svg+xml access-control-allow-origin * cache-control max-age=2592000 access-control-allow-credentials false accept-ranges bytes timing-allow-origin *, * content-length 990 access-control-request-headers X-OB-STG,X-OB-PRD
POST H2	204	collect region1.google-analytics.com/g/	0 260 B	135ms 47ms	Ping text/plain	2001:4860:4802:34::36 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://region1.google-analytics.com/g/collect?v=2&tid=G-GD465VRQLD&gtm=45je32f0&_p=1183500458&cid=1640359557.1676865163&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1676865162&sct=1&seg=0&dl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F237440%2Ftrojanwin32tdss-win32crytor-virus-removal%2F&dt=TrojanWin32.TDSS%20%26%20Win32Crytor%20Virus%20Removal%20-%20Am%20I%20infected%3F%20What%20do%20I%20do%3F&en=page_view&_fv=1&_nsi=1&_ss=1 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-GD465VRQLD&l=dataLayer&cx=c Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers pragma no-cache date Mon, 20 Feb 2023 03:52:43 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.bleepingcomputer.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	cb=gapi.loaded_0 Show response apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.de.IpWeeLsup8c.O/m=plusone/rt=j/sv=1/d=1/ed=1/rs=AHpOoo-7vGeOZpyfcbeljIbxyJzXpK39XA/	149 KB 52 KB	53ms 52ms	Script text/javascript	2a00:1450:400d:807::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.de.IpWeeLsup8c.O/m=plusone/rt=j/sv=1/d=1/ed=1/rs=AHpOoo-7vGeOZpyfcbeljIbxyJzXpK39XA/cb=gapi.loaded_0?le=scs Requested by Host: apis.google.com URL: https://apis.google.com/js/plusone.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400d:807::200e , Ireland, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 6dc8ffd9d39dbef9d844b419a77a558e803c928a6dd234963126cec84671c541 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Thu, 16 Feb 2023 13:57:49 GMT content-encoding gzip x-content-type-options nosniff age 309293 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 52547 x-xss-protection 0 last-modified Sat, 07 Jan 2023 15:19:07 GMT server sffe cross-origin-opener-policy same-origin; report-to="social-frontend-mpm-access" vary Accept-Encoding report-to {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} content-type text/javascript; charset=UTF-8 cache-control public, max-age=31536000 accept-ranges bytes expires Fri, 16 Feb 2024 13:57:49 GMT
POST H2	200	/ Show response r.skimresources.com/api/	204 B 399 B	181ms 50ms	XHR application/json	35.190.59.101 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://r.skimresources.com/api/ Requested by Host: s.skimresources.com URL: https://s.skimresources.com/js/3687X620620.skimlinks.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 35.190.59.101 Kansas City, United States, ASN15169 (GOOGLE, US), Reverse DNS 101.59.190.35.bc.googleusercontent.com Software openresty/1.19.9.1 / Resource Hash 42de0ad43b86f97897dd7c2b1c6f335b6706e1947eceddcd55e6306a5f76f902 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers Referer https://www.bleepingcomputer.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Content-type application/x-www-form-urlencoded Response headers date Mon, 20 Feb 2023 03:52:43 GMT strict-transport-security max-age=31536000 x-content-type-options nosniff content-encoding gzip server openresty/1.19.9.1 via 1.1 google vary Accept-Encoding content-type application/json access-control-allow-origin https://www.bleepingcomputer.com access-control-allow-credentials true alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
GET H2	206	robots.txt t.skimresources.com/api/v2/ Frame D248	0 134 B	202ms 48ms	Image text/plain	35.201.67.47 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://t.skimresources.com/api/v2/robots.txt?__skimjs_preflight__please_ignore__=true&rnd=0.7594212670448994 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 35.201.67.47 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 47.67.201.35.bc.googleusercontent.com Software Python/3.10 aiohttp/3.8.3 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:52:43 GMT via 1.1 google server Python/3.10 aiohttp/3.8.3 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 content-type text/plain charset=UTF-8
GET H2	200	px.gif p.skimresources.com/	43 B 276 B	215ms 48ms	Image image/gif	35.190.91.160 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://p.skimresources.com/px.gif?ch=1&rn=5.786228198295851 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 35.190.91.160 Kansas City, United States, ASN15169 (GOOGLE, US), Reverse DNS 160.91.190.35.bc.googleusercontent.com Software Skimlinks Pixel 1.0 / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers p3p policyref="http://skimlinks.com/w3c/p3p.xml", CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT" date Mon, 20 Feb 2023 03:52:43 GMT via 1.1 google server Skimlinks Pixel 1.0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 43 content-type image/gif
GET H2	200	px.gif p.skimresources.com/	43 B 102 B	195ms 48ms	Image image/gif	35.190.91.160 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://p.skimresources.com/px.gif?ch=2&rn=5.786228198295851 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 35.190.91.160 Kansas City, United States, ASN15169 (GOOGLE, US), Reverse DNS 160.91.190.35.bc.googleusercontent.com Software Skimlinks Pixel 1.0 / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers p3p policyref="http://skimlinks.com/w3c/p3p.xml", CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT" date Mon, 20 Feb 2023 03:52:43 GMT via 1.1 google server Skimlinks Pixel 1.0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 43 content-type image/gif
GET H2	200	loading.gif www.bleepingcomputer.com/forums/public/style_images/master/lightbox/	2 KB 2 KB	57ms 51ms	Image image/gif	104.20.60.209 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepingcomputer.com/forums/public/style_images/master/lightbox/loading.gif Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.20.60.209 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 61da0a4638505960ec52709b7df80d92683c56e13042079daf5f082fc9548d5e Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; X-Frame-Options SAMEORIGIN Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:52:43 GMT content-security-policy upgrade-insecure-requests; cf-cache-status HIT age 1641007 cf-polished origSize=2767, status=vary_header_present content-length 1588 cf-bgj imgq:85,h2pri last-modified Thu, 18 Dec 2008 14:27:04 GMT server cloudflare etag "acf-45e52fc88de00" vary User-Agent, Accept-Encoding x-frame-options SAMEORIGIN content-type image/gif cache-control max-age=2592000 accept-ranges bytes cf-ray 79c44a84bb553a52-FRA expires Fri, 03 Mar 2023 04:02:36 GMT
GET H2	200	closelabel.gif www.bleepingcomputer.com/forums/public/style_images/master/lightbox/	471 B 665 B	57ms 52ms	Image image/gif	104.20.60.209 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepingcomputer.com/forums/public/style_images/master/lightbox/closelabel.gif Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.20.60.209 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 3e89beb7d66ef7d5e58dfcefd22a51e1a8ae452a49bc20d020418cf2b6c666d0 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; X-Frame-Options SAMEORIGIN Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:52:43 GMT content-security-policy upgrade-insecure-requests; cf-cache-status HIT age 1641007 cf-polished origSize=483, status=vary_header_present content-length 471 cf-bgj imgq:85,h2pri last-modified Mon, 03 May 2010 23:34:02 GMT server cloudflare etag "1e3-485b90722ae80" vary User-Agent, Accept-Encoding x-frame-options SAMEORIGIN content-type image/gif cache-control max-age=2592000 accept-ranges bytes cf-ray 79c44a84bb563a52-FRA expires Fri, 03 Mar 2023 04:02:36 GMT
GET H2	200	cb=gapi.loaded_1 Show response apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.de.IpWeeLsup8c.O/m=auth/exm=plusone/rt=j/sv=1/d=1/ed=1/rs=AHpOoo-7vGeOZpyfcbeljIbxyJzXpK39XA/	103 KB 36 KB	53ms 52ms	Script text/javascript	2a00:1450:400d:807::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.de.IpWeeLsup8c.O/m=auth/exm=plusone/rt=j/sv=1/d=1/ed=1/rs=AHpOoo-7vGeOZpyfcbeljIbxyJzXpK39XA/cb=gapi.loaded_1?le=scs Requested by Host: apis.google.com URL: https://apis.google.com/js/plusone.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400d:807::200e , Ireland, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 4bb583a1b90126dc181540982bf1661d202c72abdce2c8b42d7c656b680461f8 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Fri, 17 Feb 2023 07:25:02 GMT content-encoding gzip x-content-type-options nosniff age 246461 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 36639 x-xss-protection 0 last-modified Sat, 07 Jan 2023 15:19:07 GMT server sffe cross-origin-opener-policy same-origin; report-to="social-frontend-mpm-access" vary Accept-Encoding report-to {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} content-type text/javascript; charset=UTF-8 cache-control public, max-age=31536000 accept-ranges bytes expires Sat, 17 Feb 2024 07:25:02 GMT
GET		/ developers.google.com/ Frame 2400 Redirect Chain https://apis.google.com/u/0/se/0/_/+1/fastbutton?usegapi=1&count=false&size=small&hl=en-GB&origin=https%3A%2F%2Fwww.bleepingcomputer.com&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F23... https://developers.google.com/ https://developers.google.com/?hl=de	0 0
GET H2	200	quant.js Show response secure.quantserve.com/	22 KB 9 KB	207ms 44ms	Script application/javascript	2620:116:800d:21:de2e:c7b3:55c0:d5a0 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://secure.quantserve.com/quant.js Requested by Host: quantcast.mgr.consensu.org URL: https://quantcast.mgr.consensu.org/choice/sktb670LZWvFX/www.bleepingcomputer.com/choice.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:116:800d:21:de2e:c7b3:55c0:d5a0 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software / Resource Hash 80b722bb38fe1d1910fcbe62ce22abe0ce5b9689e49f869a7b050d2ba3be5393 Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:52:43 GMT content-encoding gzip etag "nKU5ibguwDn/EkwRTn3C4Q==" vary Accept-Encoding content-type application/javascript cache-control private, max-age=604800 accept-ranges bytes expires Mon, 27 Feb 2023 03:52:43 GMT
GET H2	200	cmp2.js Show response quantcast.mgr.consensu.org/tcfv2/23/	266 KB 72 KB	47ms 46ms	Script text/javascript	2600:9000:211e:d800:9:46dc:4700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://quantcast.mgr.consensu.org/tcfv2/23/cmp2.js?referer=www.bleepingcomputer.com Requested by Host: quantcast.mgr.consensu.org URL: https://quantcast.mgr.consensu.org/choice/sktb670LZWvFX/www.bleepingcomputer.com/choice.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:211e:d800:9:46dc:4700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 7baadf42bdd7151de787de3b98f1c65f55cc2b3d34d4fbe90a0e490756dd3a1b Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Sat, 18 Feb 2023 13:57:31 GMT content-encoding gzip via 1.1 aff6ac5c98fa897349204752e5877c80.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-C2 age 136513 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront last-modified Fri, 18 Dec 2020 15:09:37 GMT server AmazonS3 etag W/"1d55b13d85c9837da884d1e8594cc025" access-control-max-age 86400 access-control-allow-methods GET content-type text/javascript;charset=UTF-8 access-control-allow-origin * cache-control max-age=172800 x-amz-meta-qc-ineu True vary Accept-Encoding x-amz-cf-id aPC-hLtyNzftH15MU5FxiIpLA0HdeljtBGArACVufyG2NW3ED2j-KQ==
GET H3	200	all.js Show response connect.facebook.net/en_US/	308 KB 86 KB	86ms 41ms	Script application/x-javascript	2a03:2880:f02d:12:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/en_US/all.js?hash=9e32ea81e807c3b1c951e15550495abb Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/all.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash b701b16a0651c9e87112229bf5bd062cccb110e071db4fde0c7848d559c3c8fb Security Headers Name Value Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY Request headers Referer https://www.bleepingcomputer.com/ Origin https://www.bleepingcomputer.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers strict-transport-security max-age=31536000; preload; includeSubDomains content-encoding gzip x-content-type-options nosniff date Mon, 20 Feb 2023 03:52:43 GMT content-md5 JoMCvNQaWQ+5Ldf+K9rYWg== document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 88340 x-fb-rlafr 0 x-fb-debug zC5npxQHH59XqwZvF+USUPa9cFY6vfA3uvmC9th0qoPCC3/aZHkTT70ut+70DRsX8PnQhrEpEuqTjn9RyWVvsg== cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" x-fb-content-md5 9f59f297e1fb0e8d0f50ab4dc832798a cross-origin-opener-policy same-origin-allow-popups etag "de897474e699c4a1dbc8a52c685edc6b" vary Accept-Encoding report-to {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"} content-type application/x-javascript; charset=utf-8 access-control-allow-origin * access-control-expose-headers X-FB-Content-MD5 cache-control public,max-age=31536000,stale-while-revalidate=3600,immutable x-frame-options DENY timing-allow-origin * priority u=3,i expires Tue, 20 Feb 2024 02:45:05 GMT
POST H2	200	collect Show response www.google-analytics.com/j/	1 B 212 B	73ms 72ms	XHR text/plain	2a00:1450:400d:80a::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j99&a=1183500458&t=pageview&_s=1&dl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F237440%2Ftrojanwin32tdss-win32crytor-virus-removal%2F&ul=en-us&de=windows-1252&dt=TrojanWin32.TDSS%20%26%20Win32Crytor%20Virus%20Removal%20-%20Am%20I%20infected%3F%20What%20do%20I%20do%3F&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAUABAAAAACAAI~&jid=186252035&gjid=1265158195&cid=1640359557.1676865163&tid=UA-91740-1&_gid=1404043924.1676865163&_r=1&gtm=457e32f0&z=2102891393 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400d:80a::200e , Ireland, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.bleepingcomputer.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Mon, 20 Feb 2023 03:52:43 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.bleepingcomputer.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 1 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	skeleton.js Show response static.adsafeprotected.com/	17 B 465 B	159ms 40ms	Script application/javascript	2600:9000:214f:6400:8:48e:53c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://static.adsafeprotected.com/skeleton.js?bannnerid=862490_advertisement_ Requested by Host: functionalfeather.com URL: https://functionalfeather.com/v2ovfnqHYOcUmGamrGBr8rqaaCGpavHQYMp3MjKMQWnQ_R4uaawJOf451Yw Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:214f:6400:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash bdeed1e1c0751610c8f3dc2a5c78c93f841c366b36a7f7a54f5e6752c2656c05 Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Fri, 01 Jul 2022 02:01:00 GMT x-amz-version-id nylqTweorRThFHMBJSrf_fHcWx3KVKN3 via 1.1 6080b2713e502211e152f21f5c59c5a6.cloudfront.net (CloudFront) x-amz-cf-pop FRA53-C1 age 20224304 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-amz-replication-status COMPLETED content-length 17 last-modified Mon, 17 Aug 2020 23:54:35 GMT server AmazonS3 etag "53fab767ecbd3bf07990b10246befbd4" content-type application/javascript cache-control max-age=315360000 accept-ranges bytes x-amz-cf-id NKCpZ32mRJpRV4WgsKalD50jQP25A6oZB-OVR9q4ItwoQHy8mg-5Kw==
GET H2	200	postmessageRelay Show response accounts.google.com/o/oauth2/ Frame 72C9	566 B 808 B	179ms 89ms	Document text/html	2a00:1450:4001:811::200d GOOGLE
General Check archive.org Show headers Download Go to Full URL https://accounts.google.com/o/oauth2/postmessageRelay?parent=https%3A%2F%2Fwww.bleepingcomputer.com&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.de.IpWeeLsup8c.O%2Fd%3D1%2Frs%3DAHpOoo-7vGeOZpyfcbeljIbxyJzXpK39XA%2Fm%3D__features__ Requested by Host: apis.google.com URL: https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.de.IpWeeLsup8c.O/m=auth/exm=plusone/rt=j/sv=1/d=1/ed=1/rs=AHpOoo-7vGeOZpyfcbeljIbxyJzXpK39XA/cb=gapi.loaded_1?le=scs Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:811::200d Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 7208490affcd5c6af7e507693f00e5dc00afbf8bf1156859eee5176504b0befa Security Headers Name Value Content-Security-Policy require-trusted-types-for 'script';report-uri /o/cspreport script-src 'report-sample' 'nonce-TmjFvuCl-pna3rb3K3RVWg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /o/cspreport X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 cache-control no-cache, no-store, max-age=0, must-revalidate content-encoding gzip content-security-policy require-trusted-types-for 'script';report-uri /o/cspreport script-src 'report-sample' 'nonce-TmjFvuCl-pna3rb3K3RVWg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /o/cspreport content-type text/html; charset=utf-8 date Mon, 20 Feb 2023 03:52:43 GMT expires Mon, 01 Jan 1990 00:00:00 GMT pragma no-cache server ESF x-content-type-options nosniff x-xss-protection 0
GET H2	200	google-atp-list.json Show response quantcast.mgr.consensu.org/tcfv2/	151 KB 36 KB	129ms 47ms	XHR application/json	2600:9000:211e:d800:9:46dc:4700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://quantcast.mgr.consensu.org/tcfv2/google-atp-list.json Requested by Host: quantcast.mgr.consensu.org URL: https://quantcast.mgr.consensu.org/tcfv2/23/cmp2.js?referer=www.bleepingcomputer.com Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:211e:d800:9:46dc:4700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 31d1a8b234ef7e3fcd967fe38bb63298be8faf869e0dcd5352c330ed5c18964b Request headers Accept application/json, text/plain, */* Referer https://www.bleepingcomputer.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:03:33 GMT content-encoding br via 1.1 0a4e8f7c3d348e526848328c55dd452a.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-C2 age 2951 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront last-modified Mon, 20 Feb 2023 03:03:30 GMT server AmazonS3 etag W/"1dbfd79d4ea7f69c0c42a2f6065532e7" access-control-max-age 3000 access-control-allow-methods GET content-type application/json access-control-allow-origin * cache-control max-age=172800 access-control-allow-credentials true vary Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method x-amz-cf-id X5po4OaBOWC1NkQ6m8QDhPVsziHToxRk3JByoSTaODAoL5mVFOAVUg==
GET H/1.1	200 OK	spc_fi.php Show response cdn.firstimpression.io/delivery/	39 KB 8 KB	223ms 105ms	XHR application/json	99.86.4.77 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.firstimpression.io/delivery/spc_fi.php?id=5971&url=%2Fforums%2Ft%2F237440%2Ftrojanwin32tdss-win32crytor-virus-removal%2F&charset=windows-1252&ch=3&ref=www.bleepingcomputer.com&viewerId=null&referer=&_firid=37334723 Requested by Host: ecdn.firstimpression.io URL: https://ecdn.firstimpression.io/fi_client.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 99.86.4.77 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-99-86-4-77.fra6.r.cloudfront.net Software Apache/2.4.38 (Debian) / Resource Hash 94483907b3a257e025a43477d02475371d52803f7fefba1cdde3c82689dec952 Request headers Accept application/json, text/javascript, */*; q=0.01 Referer https://www.bleepingcomputer.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers Date Mon, 20 Feb 2023 03:52:43 GMT Content-Encoding gzip Via 1.1 1b412557b82dda96e078541f9ee8dfb2.cloudfront.net (CloudFront) X-Amz-Cf-Pop FRA6-C1 X-Cache Miss from cloudfront P3P CP="CUR ADM OUR NOR STA NID" Connection keep-alive Content-Length 7690 Pragma no-cache Server Apache/2.4.38 (Debian) Vary Accept-Encoding Content-Type application/json; charset=windows-1252 Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-cache, no-store, must-revalidate Access-Control-Allow-Credentials true X-Amz-Cf-Id SuW6BajuBNswUYZejT7zIEvOBiKOFD6INiHyz_rVjAPIhYpOoJuD6A== Expires 0
POST H2	200	page Show response t.skimresources.com/api/v2/	22 B 88 B	59ms 59ms	XHR application/javascript	35.201.67.47 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://t.skimresources.com/api/v2/page Requested by Host: s.skimresources.com URL: https://s.skimresources.com/js/3687X620620.skimlinks.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 35.201.67.47 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 47.67.201.35.bc.googleusercontent.com Software Python/3.10 aiohttp/3.8.3 / Resource Hash fcc83a5b6aef86420c1ad553167106df96bd0ff4192ffe52b1647599948edbcf Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.bleepingcomputer.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Content-type text/plain Response headers pragma no-cache date Mon, 20 Feb 2023 03:52:43 GMT via 1.1 google x-content-type-options nosniff server Python/3.10 aiohttp/3.8.3 access-control-allow-methods GET, POST, OPTIONS content-type text/plain; charset=utf-8, application/javascript access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache, must-revalidate access-control-allow-credentials true access-control-allow-headers Origin, Accept, Content-Type, X-Requested-With, X-CSRF-Token content-length 22 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
POST H2	200	link Show response t.skimresources.com/api/v2/	22 B 372 B	54ms 54ms	XHR application/javascript	35.201.67.47 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://t.skimresources.com/api/v2/link Requested by Host: s.skimresources.com URL: https://s.skimresources.com/js/3687X620620.skimlinks.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 35.201.67.47 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 47.67.201.35.bc.googleusercontent.com Software Python/3.10 aiohttp/3.8.3 / Resource Hash fcc83a5b6aef86420c1ad553167106df96bd0ff4192ffe52b1647599948edbcf Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.bleepingcomputer.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Content-type text/plain Response headers pragma no-cache date Mon, 20 Feb 2023 03:52:43 GMT via 1.1 google x-content-type-options nosniff server Python/3.10 aiohttp/3.8.3 access-control-allow-methods GET, POST, OPTIONS content-type text/plain; charset=utf-8, application/javascript access-control-allow-origin https://www.bleepingcomputer.com warning 299 - "Deprecated API" cache-control no-store, no-cache, must-revalidate access-control-allow-credentials true access-control-allow-headers Origin, Accept, Content-Type, X-Requested-With, X-CSRF-Token content-length 22 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
POST H3	200	api Show response ls.skimresources.com/	2 B 22 B	98ms 55ms	XHR application/json	34.120.117.212 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://ls.skimresources.com/api Requested by Host: s.skimresources.com URL: https://s.skimresources.com/js/3687X620620.skimlinks.js Protocol H3 Security QUIC, , AES_128_GCM Server 34.120.117.212 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 212.117.120.34.bc.googleusercontent.com Software Python/3.8 aiohttp/3.7.4.post0 / Resource Hash 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.bleepingcomputer.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Content-type application/json Response headers pragma no-cache date Mon, 20 Feb 2023 03:52:43 GMT via 1.1 google x-content-type-options nosniff server Python/3.8 aiohttp/3.7.4.post0 access-control-allow-methods GET, POST, OPTIONS content-type application/json; charset=utf-8 access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache, must-revalidate access-control-allow-credentials true access-control-allow-headers Origin, Accept, Content-Type, X-Requested-With, X-CSRF-Token content-length 2 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
OPTIONS H2	206	api ls.skimresources.com/ Frame	0 0	165ms 49ms	Preflight text/plain	34.120.117.212 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://ls.skimresources.com/api Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.120.117.212 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 212.117.120.34.bc.googleusercontent.com Software Python/3.8 aiohttp/3.7.4.post0 / Resource Hash Request headers Accept */* Access-Control-Request-Headers content-type Access-Control-Request-Method POST Origin https://www.bleepingcomputer.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers Origin, Accept, Content-Type, X-Requested-With, X-CSRF-Token access-control-allow-methods GET, POST, OPTIONS access-control-allow-origin https://www.bleepingcomputer.com access-control-max-age 1728000 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 content-type text/plain charset=UTF-8 date Mon, 20 Feb 2023 03:52:43 GMT server Python/3.8 aiohttp/3.7.4.post0 via 1.1 google
GET H2	200	status www.facebook.com/x/oauth/	0 0	204ms 76ms	Fetch text/plain	2a03:2880:f12d:83:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://www.facebook.com/x/oauth/status?client_id=942111685863795&input_token&origin=1&redirect_uri=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F237440%2Ftrojanwin32tdss-win32crytor-virus-removal%2F&sdk=joey&wants_cookie_data=false Requested by Host: a.pub.network URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=15552000; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers strict-transport-security max-age=15552000; preload date Mon, 20 Feb 2023 03:52:43 GMT x-content-type-options nosniff document-policy force-load-at-top alt-svc h3=":443"; ma=86400 content-length 0 x-fb-rlafr 0 pragma no-cache x-fb-debug OaeQo6tsXx5RGWb/R4iMXdmj6HxfPz2AZ2lx21FfeZZRWnbS+VQRBBEpw5slkeLa3qLLxR52A4HxBxkLfBp1zQ== cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" fb-s unknown report-to {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]} content-type text/plain; charset=UTF-8 access-control-allow-origin https://www.bleepingcomputer.com origin-agent-cluster ?0 access-control-expose-headers fb-s cache-control private, no-cache, no-store, must-revalidate access-control-allow-credentials true priority u=3,i expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	rules-p-sktb670LZWvFX.js Show response rules.quantcount.com/	160 B 618 B	1814ms 1118ms	Script application/javascript	2600:9000:23e4:ae00:6:44e3:f8c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://rules.quantcount.com/rules-p-sktb670LZWvFX.js Requested by Host: secure.quantserve.com URL: https://secure.quantserve.com/quant.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:23e4:ae00:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 115a72ca4f52bab4c4aa5d3eb029d9a019cf875c6d28614609b237f5f7930c32 Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:52:45 GMT via 1.1 702d274aeab676890c1a399c8e170886.cloudfront.net (CloudFront) x-amz-cf-pop ICN57-P2 x-amz-server-side-encryption AES256 x-cache Miss from cloudfront cross-origin-resource-policy cross-origin content-length 160 last-modified Fri, 14 Oct 2022 00:56:35 GMT server AmazonS3 etag "c0299120345dd407ae331dfa6faf0bec" access-control-allow-methods GET content-type application/javascript access-control-allow-origin * cache-control max-age=3600 accept-ranges bytes x-amz-cf-id Nmt6r3tnmSOqy7RMSl2Q9SnYYXIIpvZSB7UbwGTKzAvgWbNiWXRzEA==
POST H2	204	cspreport accounts.google.com/o/ Frame 72C9	0 250 B	54ms 51ms	Other text/html	2a00:1450:4001:811::200d GOOGLE
General Check archive.org Show headers Download Go to Full URL https://accounts.google.com/o/cspreport Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:811::200d Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Content-Security-Policy script-src 'report-sample' 'nonce-JcBkKg3n9gfSm9PmIlgZLA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /o/cspreport, require-trusted-types-for 'script';report-uri /o/cspreport X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://accounts.google.com/o/oauth2/postmessageRelay?parent=https%3A%2F%2Fwww.bleepingcomputer.com&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.de.IpWeeLsup8c.O%2Fd%3D1%2Frs%3DAHpOoo-7vGeOZpyfcbeljIbxyJzXpK39XA%2Fm%3D__features__ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Content-Type application/csp-report Response headers pragma no-cache date Mon, 20 Feb 2023 03:52:43 GMT content-security-policy script-src 'report-sample' 'nonce-JcBkKg3n9gfSm9PmIlgZLA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /o/cspreport, require-trusted-types-for 'script';report-uri /o/cspreport x-content-type-options nosniff server ESF x-frame-options SAMEORIGIN content-type text/html; charset=utf-8 cache-control no-cache, no-store, max-age=0, must-revalidate cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 x-xss-protection 0 expires Mon, 01 Jan 1990 00:00:00 GMT
GET H2	200	1832714284-postmessagerelay.js Show response ssl.gstatic.com/accounts/o/ Frame 72C9	10 KB 5 KB	143ms 40ms	Script text/javascript	2a00:1450:4001:801::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ssl.gstatic.com/accounts/o/1832714284-postmessagerelay.js Requested by Host: accounts.google.com URL: https://accounts.google.com/o/oauth2/postmessageRelay?parent=https%3A%2F%2Fwww.bleepingcomputer.com&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.de.IpWeeLsup8c.O%2Fd%3D1%2Frs%3DAHpOoo-7vGeOZpyfcbeljIbxyJzXpK39XA%2Fm%3D__features__ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 0d173137e6d7fab67e8e696fea473731e28fed08d552de686256d0d9dfa21275 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://accounts.google.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Sun, 19 Feb 2023 12:32:35 GMT content-encoding gzip x-content-type-options nosniff age 55208 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/federated-signon-mpm-access cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 4294 x-xss-protection 0 last-modified Thu, 16 Feb 2023 21:11:06 GMT server sffe cross-origin-opener-policy same-origin; report-to="federated-signon-mpm-access" vary Accept-Encoding report-to {"group":"federated-signon-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/federated-signon-mpm-access"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes expires Mon, 19 Feb 2024 12:32:35 GMT
GET H3	200	rpc:shindig_random.js Show response apis.google.com/js/ Frame 72C9	17 KB 7 KB	86ms 85ms	Script text/javascript	2a00:1450:400d:807::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://apis.google.com/js/rpc:shindig_random.js?onload=init Requested by Host: accounts.google.com URL: https://accounts.google.com/o/oauth2/postmessageRelay?parent=https%3A%2F%2Fwww.bleepingcomputer.com&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.de.IpWeeLsup8c.O%2Fd%3D1%2Frs%3DAHpOoo-7vGeOZpyfcbeljIbxyJzXpK39XA%2Fm%3D__features__ Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:400d:807::200e , Ireland, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 9d0bf7277e409d17e299ed4df57ebfae207ab38314961dcb1dac2e41868b3cb6 Security Headers Name Value Content-Security-Policy require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://accounts.google.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers content-security-policy require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team content-encoding gzip x-content-type-options nosniff date Mon, 20 Feb 2023 03:52:43 GMT cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 6899 x-xss-protection 0 server sffe cross-origin-opener-policy same-origin; report-to="gapi-team" etag "b92117da8a268e67" vary Accept-Encoding report-to {"group":"gapi-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gapi-team"}]} content-type text/javascript access-control-allow-origin * cache-control private, max-age=1800, stale-while-revalidate=1800 accept-ranges bytes timing-allow-origin * expires Mon, 20 Feb 2023 03:52:43 GMT
POST H3	200	v2kacSVo3k82KjpEadZkFdzPP_ix0Id8qyRaXsUA_6rn3A3_IJZC_VVaSuVsoQb9SC-MclW5EBZU Show response functionalfeather.com/	206 B 233 B	145ms 58ms	Fetch application/json	2600:1901:0:7416::1 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://functionalfeather.com/v2kacSVo3k82KjpEadZkFdzPP_ix0Id8qyRaXsUA_6rn3A3_IJZC_VVaSuVsoQb9SC-MclW5EBZU Requested by Host: a.pub.network URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js Protocol H3 Security QUIC, , AES_128_GCM Server 2600:1901:0:7416::1 Kansas City, United States, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash a63490071094ab70fa037aed5428e7e051b1c0d2a2e1e8b3be3609d3596b7816 Security Headers Name Value Strict-Transport-Security max-age=15724800; preload Request headers Referer https://www.bleepingcomputer.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers strict-transport-security max-age=15724800; preload date Mon, 20 Feb 2023 03:52:43 GMT via 1.1 google x-buildnumber 764540114 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 206 x-datacenter gce-europe-west1 x-buildname hoothoot vary Accept-Encoding, Origin access-control-allow-methods POST, OPTIONS content-type application/json; charset=utf-8 access-control-allow-origin https://www.bleepingcomputer.com x-hostname fen-hoothoot-europe-west1-spot-t1x3 cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true timing-allow-origin * access-control-allow-headers DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Cookie expires Mon, 20 Feb 2023 03:52:42 GMT
GET H2	200	cmp-list.json Show response test.quantcast.mgr.consensu.org/GVL-v2/	10 KB 3 KB	174ms 40ms	XHR application/json	2600:9000:211e:7a00:3:a4cd:8380:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://test.quantcast.mgr.consensu.org/GVL-v2/cmp-list.json Requested by Host: quantcast.mgr.consensu.org URL: https://quantcast.mgr.consensu.org/tcfv2/23/cmp2.js?referer=www.bleepingcomputer.com Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:211e:7a00:3:a4cd:8380:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash ffcb781ed80a91db9503ff9d2b971d8a55e3b1062610d0e7373c2964577f846b Request headers Accept application/json, text/plain, */* Referer https://www.bleepingcomputer.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:00:44 GMT x-amz-version-id OSqPlQh2dAesboanu.zH8HBJO.QXo2z_ content-encoding br via 1.1 93b0598b43d63761f1a129690721f888.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-C2 age 3120 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront last-modified Mon, 13 Feb 2023 19:52:29 GMT server AmazonS3 etag W/"12f623cd633f13b89439f79baf7b3f72" access-control-max-age 86400 access-control-allow-methods GET content-type application/json access-control-allow-origin * cache-control max-age=172800 vary Accept-Encoding x-amz-cf-id jxSkBnlvS56ty_xrrhsEmJ3CnpsZBl5GloqabhShBC9Gqn9BtgWhsw==
GET H2	200	hls.7a479ee5958b6acc066e.js cds.connatix.com/p/228932/ Frame C663	0 52 KB	40ms 40ms	Other application/javascript	151.101.2.137 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cds.connatix.com/p/228932/hls.7a479ee5958b6acc066e.js Requested by Host: cd.connatix.com URL: https://cd.connatix.com/connatix.playspace.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.2.137 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:52:43 GMT content-encoding br last-modified Fri, 17 Feb 2023 08:48:08 GMT age 240427 etag "e94710357fb7a14d356628bd4f8814ee" vary Accept-Encoding access-control-max-age 86400 content-type application/javascript access-control-allow-origin * cache-control public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600 accept-ranges bytes content-length 53226
GET H2	200	connatix.playspace.css cds.connatix.com/p/228932/	111 KB 18 KB	43ms 42ms	Stylesheet text/css	151.101.2.137 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cds.connatix.com/p/228932/connatix.playspace.css Requested by Host: cd.connatix.com URL: https://cd.connatix.com/connatix.playspace.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.2.137 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash e31585780105dd160b13fb35dab22c23ebd35a7acc7685bab549153f9282b741 Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:52:43 GMT content-encoding br last-modified Fri, 17 Feb 2023 08:48:07 GMT age 240428 etag "9662be01c1eb1cbe2dc5e26f6a719d74" vary Accept-Encoding access-control-max-age 86400 content-type text/css access-control-allow-origin * cache-control public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600 accept-ranges bytes content-length 18331
POST H2	200	story Show response capi.connatix.com/core/ Frame C663	2 KB 2 KB	214ms 172ms	XHR application/x-protobuf	104.18.23.41 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://capi.connatix.com/core/story?v=228932 Requested by Host: cd.connatix.com URL: https://cd.connatix.com/connatix.playspace.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.23.41 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0b56ab2fae29ee44232a1971828698529c60c527cee30f035a6c2ce3e6bb7314 Request headers Referer accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Content-Type multipart/form-data Response headers date Mon, 20 Feb 2023 03:52:43 GMT content-encoding br cf-cache-status DYNAMIC server cloudflare vary Accept-Encoding content-type application/x-protobuf access-control-allow-origin https://www.bleepingcomputer.com cache-control no-cache, no-store, must-revalidate, max-age=0 access-control-allow-credentials true cf-ray 79c44a87bf763a57-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H3	200	cb=gapi.loaded_0 Show response apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.de.IpWeeLsup8c.O/m=rpc,shindig_random/rt=j/sv=1/d=1/ed=1/rs=AHpOoo-7vGeOZpyfcbeljIbxyJzXpK39XA/ Frame 72C9	57 KB 20 KB	53ms 53ms	Script text/javascript	2a00:1450:400d:807::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.de.IpWeeLsup8c.O/m=rpc,shindig_random/rt=j/sv=1/d=1/ed=1/rs=AHpOoo-7vGeOZpyfcbeljIbxyJzXpK39XA/cb=gapi.loaded_0?le=scs Requested by Host: apis.google.com URL: https://apis.google.com/js/rpc:shindig_random.js?onload=init Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:400d:807::200e , Ireland, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 7dfbe5278d2bbc1aacaec98d45b6232fc6880a5fc593240e95c880615e230103 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://accounts.google.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Wed, 15 Feb 2023 16:50:10 GMT content-encoding gzip x-content-type-options nosniff age 385353 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 20513 x-xss-protection 0 last-modified Sat, 07 Jan 2023 15:19:07 GMT server sffe cross-origin-opener-policy same-origin; report-to="social-frontend-mpm-access" vary Accept-Encoding report-to {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} content-type text/javascript; charset=UTF-8 cache-control public, max-age=31536000 accept-ranges bytes expires Thu, 15 Feb 2024 16:50:10 GMT
POST H3	200	v2xie7TKTCuNWQlxg7Zjb4PQRt59HHuDQjyAsKA63uDzZLbV_ByNEltNFEH70LS30PCsYL52oHmU Show response functionalfeather.com/	3 B 27 B	52ms 51ms	Fetch application/json	2600:1901:0:7416::1 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://functionalfeather.com/v2xie7TKTCuNWQlxg7Zjb4PQRt59HHuDQjyAsKA63uDzZLbV_ByNEltNFEH70LS30PCsYL52oHmU Requested by Host: a.pub.network URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js Protocol H3 Security QUIC, , AES_128_GCM Server 2600:1901:0:7416::1 Kansas City, United States, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356 Security Headers Name Value Strict-Transport-Security max-age=15724800; preload Request headers Referer https://www.bleepingcomputer.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers strict-transport-security max-age=15724800; preload date Mon, 20 Feb 2023 03:52:43 GMT via 1.1 google x-buildnumber 764540114 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 3 x-datacenter gce-europe-west1 x-buildname hoothoot vary Accept-Encoding, Origin access-control-allow-methods POST, OPTIONS content-type application/json; charset=utf-8 access-control-allow-origin https://www.bleepingcomputer.com x-hostname fen-hoothoot-europe-west1-spot-t1x3 access-control-allow-credentials true timing-allow-origin * access-control-allow-headers DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Cookie
GET H2	200	vendor-list.json Show response quantcast.mgr.consensu.org/GVL-v2/	402 KB 49 KB	45ms 45ms	XHR application/json	2600:9000:211e:d800:9:46dc:4700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://quantcast.mgr.consensu.org/GVL-v2/vendor-list.json Requested by Host: quantcast.mgr.consensu.org URL: https://quantcast.mgr.consensu.org/tcfv2/23/cmp2.js?referer=www.bleepingcomputer.com Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:211e:d800:9:46dc:4700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash b27c8a1639bc37025ef701a441414ddf9fbb5332931f0205288f2b5c733c403c Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:00:39 GMT content-encoding br via 1.1 0a4e8f7c3d348e526848328c55dd452a.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-C2 age 3125 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront last-modified Mon, 20 Feb 2023 03:00:33 GMT server AmazonS3 etag W/"e19a0fb453bd356ed878730abcaf57cf" access-control-max-age 3000 access-control-allow-methods GET content-type application/json access-control-allow-origin * cache-control max-age=172800 access-control-allow-credentials true vary Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method x-amz-cf-id 24WQnpo_mUdUhqvTGYYYabhTe0FzwD-1zV2qfL754OytagMZZmHd0A==
GET H2	200	cmp2ui-en.js Show response quantcast.mgr.consensu.org/tcfv2/23/	469 KB 134 KB	45ms 45ms	Script text/javascript	2600:9000:211e:d800:9:46dc:4700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://quantcast.mgr.consensu.org/tcfv2/23/cmp2ui-en.js Requested by Host: quantcast.mgr.consensu.org URL: https://quantcast.mgr.consensu.org/tcfv2/23/cmp2.js?referer=www.bleepingcomputer.com Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:211e:d800:9:46dc:4700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 587e2e7350886d6b5fd31e385638ffe5cf3331c82260e8fe76523f99cda27a42 Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Sat, 18 Feb 2023 07:27:16 GMT content-encoding gzip via 1.1 aff6ac5c98fa897349204752e5877c80.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-C2 age 159927 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront cross-origin-resource-policy cross-origin last-modified Fri, 18 Dec 2020 15:09:43 GMT server AmazonS3 etag W/"b999c652510fc4edd897a1d667aaee33" access-control-max-age 604800 access-control-allow-methods GET content-type text/javascript;charset=UTF-8 access-control-allow-origin * cache-control max-age=172800 vary Accept-Encoding x-amz-cf-id w6FSo1saugqPFd0vBB_knLPIpnPDrOaZISlsoka3x_eQ8skDz1Babg==
GET H2	200	insights.bin Show response ins.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/34141d1c-8e1c-4163-956b-3a1d96ee092b/ Frame C663	540 B 586 B	156ms 39ms	XHR application/octet-stream	151.101.194.137 FASTLY
General Check archive.org Show headers Download Go to Full URL https://ins.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/34141d1c-8e1c-4163-956b-3a1d96ee092b/insights.bin Requested by Host: cd.connatix.com URL: https://cd.connatix.com/connatix.playspace.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.194.137 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash d3737f304cd94dee8f484b01d8b41b673e332eb277f16c419f7c78884e6389f0 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:52:43 GMT content-encoding gzip last-modified Mon, 20 Feb 2023 01:53:42 GMT age 7048 etag "4d8894150518bfcaabafdb6f4103046e" x-amz-server-side-encryption AES256 vary Accept-Encoding access-control-max-age 86400 content-type application/octet-stream access-control-allow-origin * cache-control public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600 accept-ranges bytes content-length 322
GET H2	200	insights.bin Show response ins.connatix.com/6fe297765686fc3c019b1ee2054992c2/ Frame C663	324 B 396 B	258ms 143ms	XHR application/octet-stream	151.101.194.137 FASTLY
General Check archive.org Show headers Download Go to Full URL https://ins.connatix.com/6fe297765686fc3c019b1ee2054992c2/insights.bin Requested by Host: cd.connatix.com URL: https://cd.connatix.com/connatix.playspace.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.194.137 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 348a919935c8b7e80fd74aced5a0c95f49edfafda59dc230b201800c3101008d Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:52:43 GMT content-encoding gzip last-modified Wed, 25 Jan 2023 08:47:39 GMT age 302427 etag "304146970cadb4577559a4ea51acf4ca" x-amz-server-side-encryption AES256 vary Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding access-control-allow-methods GET, HEAD content-type application/octet-stream access-control-max-age 86400 access-control-allow-origin * cache-control public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600 accept-ranges bytes content-length 210
GET H2	200	/ Show response audit-tcfv2.quantcast.mgr.consensu.org/	2 B 101 B	176ms 40ms	XHR text/plain	3.66.113.29 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://audit-tcfv2.quantcast.mgr.consensu.org/?log=%7B%22accountId%22%3A%22sktb670LZWvFX%22%2C%22domain%22%3A%22www.bleepingcomputer.com%22%2C%22publisher%22%3A%22BleepingComputer%22%2C%22cmpId%22%3A10%2C%22cmpVersion%22%3A%222.23%22%2C%22displayType%22%3A%22tcfui%3Amandatory%22%2C%22configurationHashCode%22%3A%22QejiQDikjMDrMVyfjnFdmQ%22%2C%22clientTimestamp%22%3A1676865163690%2C%22operationType%22%3A%22init%22%2C%22sessionId%22%3A%22GDPR-8ow5csee7g2y1oo8ik30%22%7D Requested by Host: quantcast.mgr.consensu.org URL: https://quantcast.mgr.consensu.org/tcfv2/23/cmp2ui-en.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.66.113.29 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-66-113-29.eu-central-1.compute.amazonaws.com Software / Resource Hash 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3 Request headers Accept application/json, text/plain, */* Referer https://www.bleepingcomputer.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers access-control-allow-origin * date Mon, 20 Feb 2023 03:52:43 GMT content-length 2 content-type text/plain; charset=utf-8
GET H2	200	bleeping-computerlogo-lg.png www.bleepstatic.com/logos/	7 KB 7 KB	45ms 45ms	Image image/webp	172.67.75.139 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/logos/bleeping-computerlogo-lg.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.67.75.139 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 458f04ea2f7e457c7636557b11afb90bd332d541875036e9d17e1ae2d524c03f Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:52:43 GMT cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 278966 cf-polished origFmt=png, origSize=15281 content-disposition inline; filename="bleeping-computerlogo-lg.webp" content-length 6984 cf-bgj imgq:85,h2pri last-modified Wed, 07 Jan 2015 22:52:15 GMT server cloudflare vary Accept report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cJlFPAmFqHhvZbh%2FzKqPwoCifSdG7OVmpElzR4VWjQ%2BDv%2FnpG28%2Fm8ceTu9fYEeDTx0J9cicllWEuEoVL8%2FgMr94QC%2BVXqt%2FFjt7ejR9jgshiwT%2FM3H1hwH%2BFKuMFINcGzMtLwI%3D"}],"group":"cf-nel","max_age":604800} content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 79c44a898de23a79-FRA expires Sat, 18 Mar 2023 22:23:16 GMT
POST		sr capi-tier-1-us-east-2.connatix.com/tr/ Frame C663	0 0
GET H2	200	gpt.js Show response securepubads.g.doubleclick.net/tag/js/	76 KB 26 KB	300ms 103ms	Script text/javascript	2a00:1450:400d:802::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/tag/js/gpt.js Requested by Host: cd.connatix.com URL: https://cd.connatix.com/connatix.playspace.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400d:802::2002 , Ireland, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 852711ee8cd6e8c26f1f29118fa19e029e260980f3db7fd4979a7e070a58f8a2 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:52:44 GMT content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 26544 x-xss-protection 0 server sffe etag "1488 / 877 of 1000 / last-modified: 1676675148" vary Accept-Encoding report-to {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]} content-type text/javascript cache-control private, max-age=900, stale-while-revalidate=3600 timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-gpt-scs" expires Mon, 20 Feb 2023 03:52:44 GMT
GET		ima3.js imasdk.googleapis.com/js/sdkloader/ Frame C663	0 0
GET H2	200	34141d1c-8e1c-4163-956b-3a1d96ee092b.bin Show response vid.connatix.com/pid-067e5169-ece3-4ce8-87ad-c7961b8bb396/d59f5d0c-2087-416a-821c-141798bc501e/ Frame C663	2 KB 986 B	101ms 67ms	XHR application/octet-stream	151.101.194.137 FASTLY
General Check archive.org Show headers Download Go to Full URL https://vid.connatix.com/pid-067e5169-ece3-4ce8-87ad-c7961b8bb396/d59f5d0c-2087-416a-821c-141798bc501e/34141d1c-8e1c-4163-956b-3a1d96ee092b.bin Requested by Host: cd.connatix.com URL: https://cd.connatix.com/connatix.playspace.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.194.137 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 331e609978419f5062478e1a3acc7ab5303dc2342e1c81f9ed5530e559c2408d Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:52:44 GMT content-encoding gzip last-modified Mon, 20 Feb 2023 01:53:16 GMT age 7047 etag "a215373a991f04492eab5c841651fb7c" x-amz-server-side-encryption AES256 vary Accept-Encoding access-control-max-age 86400 content-type application/octet-stream access-control-allow-origin * cache-control public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600 accept-ranges bytes content-length 873
POST		ao capi-tier-1-us-east-2.connatix.com/tr/ Frame C663	0 0
GET		12703 tv.springserve.com/rt/ Frame C663	0 0
POST		ps capi-tier-1-us-east-2.connatix.com/tr/ Frame C663	0 0
GET H2	200	1.png img.connatix.com/pid-067e5169-ece3-4ce8-87ad-c7961b8bb396/067e5169-ece3-4ce8-87ad-c7961b8bb396/	10 KB 10 KB	74ms 40ms	Image image/png	151.101.2.137 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://img.connatix.com/pid-067e5169-ece3-4ce8-87ad-c7961b8bb396/067e5169-ece3-4ce8-87ad-c7961b8bb396/1.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.2.137 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 956035a88a8424f2d36b292231cd4cd7ed705d412b47a7aa929f7b537196c1cb Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:52:44 GMT content-encoding br age 334666 etag "hFXyLna+DTJNsEAHl9VofT9XA3gUCQ1YPkvAuddeFoA" access-control-max-age 86400 content-type image/png fastly-io-info ifsz=11996 idim=794x206 ifmt=png ofsz=9784 odim=794x206 ofmt=png access-control-allow-origin * cache-control max-age=2592000, public fastly-stats io=1 accept-ranges bytes content-length 9610
GET H2	200	e6b64be5-41be-4f15-be3d-dd3f1ae84f90.jpg img.connatix.com/pid-067e5169-ece3-4ce8-87ad-c7961b8bb396/d59f5d0c-2087-416a-821c-141798bc501e/	26 KB 25 KB	82ms 48ms	Image image/jpeg	151.101.2.137 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://img.connatix.com/pid-067e5169-ece3-4ce8-87ad-c7961b8bb396/d59f5d0c-2087-416a-821c-141798bc501e/e6b64be5-41be-4f15-be3d-dd3f1ae84f90.jpg?crop=700:466,smart&width=700&height=466&format=jpeg&quality=60&fit=crop Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.2.137 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 0e4462e194e53d8fb50bd0e55b3fe10f301014499c8ea2d84f52ccf7d181cbfa Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:52:44 GMT content-encoding br age 7092 etag "UD1Arh17xYKab4A7h1e5wIiHcX+cAGoQwIb9l0P0NGM" x-amz-server-side-encryption AES256 access-control-max-age 86400 content-type image/jpeg fastly-io-info ifsz=116968 idim=1600x900 ifmt=jpeg ofsz=26276 odim=700x466 ofmt=jpeg access-control-allow-origin * cache-control max-age=2592000, public fastly-stats io=1 accept-ranges bytes content-length 25858
GET H2	200	e6b64be5-41be-4f15-be3d-dd3f1ae84f90.jpg img.connatix.com/pid-067e5169-ece3-4ce8-87ad-c7961b8bb396/d59f5d0c-2087-416a-821c-141798bc501e/	21 KB 20 KB	72ms 41ms	Image image/jpeg	151.101.2.137 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://img.connatix.com/pid-067e5169-ece3-4ce8-87ad-c7961b8bb396/d59f5d0c-2087-416a-821c-141798bc501e/e6b64be5-41be-4f15-be3d-dd3f1ae84f90.jpg?crop=700:394,smart&width=700&height=394&format=jpeg&quality=60&fit=crop Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.2.137 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 78ef2b808f724693668c2605e75c359e918533fc13b866169165a40460610625 Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:52:44 GMT content-encoding br age 7091 etag "p0qVDtgaQ2O+x2DhqkjTXTzrAHsP8lduhy1Pb5NHG3U" x-amz-server-side-encryption AES256 access-control-max-age 86400 content-type image/jpeg fastly-io-info ifsz=116968 idim=1600x900 ifmt=jpeg ofsz=21194 odim=700x394 ofmt=jpeg access-control-allow-origin * cache-control max-age=2592000, public fastly-stats io=1 accept-ranges bytes content-length 20800
GET H2	200	d4efb9bf-9c59-4336-9e70-326e87287f1d.jpg img.connatix.com/pid-067e5169-ece3-4ce8-87ad-c7961b8bb396/d59f5d0c-2087-416a-821c-141798bc501e/	20 KB 20 KB	77ms 47ms	Image image/jpeg	151.101.2.137 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://img.connatix.com/pid-067e5169-ece3-4ce8-87ad-c7961b8bb396/d59f5d0c-2087-416a-821c-141798bc501e/d4efb9bf-9c59-4336-9e70-326e87287f1d.jpg?crop=700:394,smart&width=700&height=394&format=jpeg&quality=60&fit=crop Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.2.137 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 58a13f17f341a14080fd8704f8ec8838404066c681daeb14e90a25b2635b8999 Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:52:44 GMT content-encoding br age 7091 etag "9CUjrzdwELJu7n9gNV86/5hO/owHdwijQCK670xl3M4" x-amz-server-side-encryption AES256 access-control-max-age 86400 content-type image/jpeg fastly-io-info ifsz=100664 idim=1561x900 ifmt=jpeg ofsz=20547 odim=700x394 ofmt=jpeg access-control-allow-origin * cache-control max-age=2592000, public fastly-stats io=1 accept-ranges bytes content-length 20085
GET H2	200	05fa8857-4b83-46ad-b685-fa58a4142d59.jpg img.connatix.com/pid-067e5169-ece3-4ce8-87ad-c7961b8bb396/d59f5d0c-2087-416a-821c-141798bc501e/	35 KB 34 KB	71ms 41ms	Image image/jpeg	151.101.2.137 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://img.connatix.com/pid-067e5169-ece3-4ce8-87ad-c7961b8bb396/d59f5d0c-2087-416a-821c-141798bc501e/05fa8857-4b83-46ad-b685-fa58a4142d59.jpg?crop=700:394,smart&width=700&height=394&format=jpeg&quality=60&fit=crop Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.2.137 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 44619d9f2078331ffc62d1bc51774eebb9d5faedc657e490f5beae2f7c167715 Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:52:44 GMT content-encoding br age 7092 etag "WfvBtXCmt5rqcYUTv/1LHcqxA5CCeMDNgCcnxPaM0u0" x-amz-server-side-encryption AES256 access-control-max-age 86400 content-type image/jpeg fastly-io-info ifsz=288313 idim=1600x900 ifmt=jpeg ofsz=35514 odim=700x394 ofmt=jpeg access-control-allow-origin * cache-control max-age=2592000, public fastly-stats io=1 accept-ranges bytes content-length 34637
GET H2	200	0ccc7d46-471e-4ba7-94c3-dd2deb92a752.jpg img.connatix.com/pid-067e5169-ece3-4ce8-87ad-c7961b8bb396/d59f5d0c-2087-416a-821c-141798bc501e/	42 KB 42 KB	74ms 45ms	Image image/jpeg	151.101.2.137 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://img.connatix.com/pid-067e5169-ece3-4ce8-87ad-c7961b8bb396/d59f5d0c-2087-416a-821c-141798bc501e/0ccc7d46-471e-4ba7-94c3-dd2deb92a752.jpg?crop=700:394,smart&width=700&height=394&format=jpeg&quality=60&fit=crop Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.2.137 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash a86ea1122961c1ed7458dca80ffd3f567726c71729aeafbf7683cc4013953e6f Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:52:44 GMT content-encoding br age 7092 etag "JSiTmN81T1u6DvDlqnLBn2o+/QNJabJcUwHyN9wlqNM" x-amz-server-side-encryption AES256 access-control-max-age 86400 content-type image/jpeg fastly-io-info ifsz=253183 idim=1600x900 ifmt=jpeg ofsz=43225 odim=700x394 ofmt=jpeg access-control-allow-origin * cache-control max-age=2592000, public fastly-stats io=1 accept-ranges bytes content-length 42780
GET H2	200	831d8da3-92b0-41ce-9532-f6657db292f2.jpg img.connatix.com/pid-067e5169-ece3-4ce8-87ad-c7961b8bb396/d59f5d0c-2087-416a-821c-141798bc501e/	18 KB 18 KB	41ms 40ms	Image image/jpeg	151.101.2.137 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://img.connatix.com/pid-067e5169-ece3-4ce8-87ad-c7961b8bb396/d59f5d0c-2087-416a-821c-141798bc501e/831d8da3-92b0-41ce-9532-f6657db292f2.jpg?crop=700:394,smart&width=700&height=394&format=jpeg&quality=60&fit=crop Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/forums/t/237440/trojanwin32tdss-win32crytor-virus-removal/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.2.137 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 530c79cb9f8679a00250ec3b182252164618dc9dd3d2675e6d569b66384bfb63 Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:52:44 GMT content-encoding br age 7092 etag "Ca/1zSwPIjfvhRKxxqAGom7eI8dYbgrR7C6L/TZMjX8" x-amz-server-side-encryption AES256 access-control-max-age 86400 content-type image/jpeg fastly-io-info ifsz=73462 idim=1600x900 ifmt=jpeg ofsz=18702 odim=700x394 ofmt=jpeg access-control-allow-origin * cache-control max-age=2592000, public fastly-stats io=1 accept-ranges bytes content-length 18250
GET H2	200	prebid7.17.0-6.js Show response cds.connatix.com/p/plugins/	513 KB 139 KB	42ms 42ms	Script application/javascript	151.101.2.137 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cds.connatix.com/p/plugins/prebid7.17.0-6.js Requested by Host: cd.connatix.com URL: https://cd.connatix.com/connatix.playspace.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.2.137 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 37849c48f8290006e74d3fc212cbcfca24c21ca24a80b54ff44809174be83c7c Request headers Referer https://www.bleepingcomputer.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Mon, 20 Feb 2023 03:52:44 GMT content-encoding br last-modified Tue, 10 Jan 2023 09:53:49 GMT age 2223719 etag "65d6aab2a72ea26ce1d7704fb112547a" vary Accept-Encoding access-control-max-age 86400 content-type application/javascript access-control-allow-origin * cache-control public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600 accept-ranges bytes content-length 141685
GET H2	200	pubads_impl_2023021401.js Show response securepubads.g.doubleclick.net/gpt/	383 KB 129 KB	53ms 52ms	Script text/javascript	2a00:1450:400d:802::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023021401.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400d:802::2002 , Ireland, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 3ae88f57f0348d9b11258f88926e791d4dc8dc66b365d8aca36cb731257b7fc0 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Fri, 17 Feb 2023 12:09:54 GMT content-encoding gzip x-content-type-options nosniff age 229370 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 132139 x-xss-protection 0 last-modified Tue, 14 Feb 2023 09:35:40 GMT server sffe vary Accept-Encoding report-to {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]} content-type text/javascript cache-control public, immutable, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-gpt-scs" expires Sat, 17 Feb 2024 12:09:54 GMT
GET H3	200	ppub_config Show response securepubads.g.doubleclick.net/pagead/	709 B 313 B	182ms 76ms	XHR application/json	2a00:1450:400d:802::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=www.bleepingcomputer.com Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:400d:802::2002 , Ireland, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 7bab6c519a6355b42d353d747bae501afe9c53db93dba6b86a032c5b2c76ef6a Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Mon, 20 Feb 2023 03:52:44 GMT content-encoding br x-content-type-options nosniff server cafe content-type application/json; charset=UTF-8 access-control-allow-origin * p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control private, max-age=3600, stale-while-revalidate=3600 cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 288 x-xss-protection 0 expires Mon, 20 Feb 2023 03:52:44 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

developers.google.com

URL

https://developers.google.com/?hl=de

Domain

capi-tier-1-us-east-2.connatix.com

URL

https://capi-tier-1-us-east-2.connatix.com/tr/sr?v=228932

Domain

imasdk.googleapis.com

URL

https://imasdk.googleapis.com/js/sdkloader/ima3.js

Domain

capi-tier-1-us-east-2.connatix.com

URL

https://capi-tier-1-us-east-2.connatix.com/tr/ao?v=228932

Domain

tv.springserve.com

URL

https://tv.springserve.com/rt/12703?w=700&h=394&cb=13a4ae98-52d9-43ac-ba02-792c4691bfb4&url=www.bleepingcomputer.com%2Fforums%2Ft%2F237440%2Ftrojanwin32tdss-win32crytor-virus-removal%2F&us_privacy=&schain=1.0,1!connatix.com,102734,1,,,,

Domain

capi-tier-1-us-east-2.connatix.com

URL

https://capi-tier-1-us-east-2.connatix.com/tr/ps?v=228932