research.checkpoint.com Open in urlscan Pro
2606:4700::6812:a560  Public Scan

18 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

76 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/	87 KB 25 KB	240ms 199ms	Document text/html	2606:4700::6812:a560 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:a560 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / WP Engine Resource Hash cd57227f76677b55ef5886f905606da5a4ede7e448a54358fc9a3951b34c9d14 Security Headers Name Value X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :method GET :authority research.checkpoint.com :scheme https :path /2020/exploring-qbots-latest-attack-methods/ pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 200 date Fri, 25 Sep 2020 14:06:00 GMT content-type text/html; charset=UTF-8 set-cookie __cfduid=dada98ea7e8f930d3daa84873bd629b0b1601042760; expires=Sun, 25-Oct-20 14:06:00 GMT; path=/; domain=.research.checkpoint.com; HttpOnly; SameSite=Lax vary Accept-Encoding Accept-Encoding Accept-Encoding,Cookie x-pingback //research.checkpoint.com/xmlrpc.php link <https://research.checkpoint.com/?p=23991>; rel=shortlink x-powered-by WP Engine x-cacheable SHORT cache-control max-age=600, must-revalidate x-cache HIT: 2 x-cache-group normal x-frame-options SAMEORIGIN x-xss-protection 1; mode=block cf-cache-status DYNAMIC cf-request-id 05672eda1b0000d70d75195200000001 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" server cloudflare cf-ray 5d854da358d5d70d-FRA content-encoding gzip
GET H2	200	style.min.css research.checkpoint.com/wp-includes/css/dist/block-library/	53 KB 8 KB	31ms 25ms	Stylesheet text/css	2606:4700::6812:a560 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://research.checkpoint.com/wp-includes/css/dist/block-library/style.min.css?ver=5.5.1 Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:a560 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8c626f0f9b5c109539b256b73e72c02b300a184f46b4535c2eb86599215c78af Request headers Referer https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 25 Sep 2020 14:06:00 GMT content-encoding gzip cf-cache-status HIT last-modified Wed, 02 Sep 2020 18:08:56 GMT server cloudflare age 1970871 status 200 etag W/"5f4fdfb8-d293" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding, Accept-Encoding, Accept-Encoding content-type text/css access-control-allow-origin * cache-control public, max-age=31536000 cf-ray 5d854da4bb9cd70d-FRA cf-request-id 05672edaee0000d70d751a5200000001
GET H2	200	style.css research.checkpoint.com/wp-content/themes/research/	18 KB 4 KB	46ms 41ms	Stylesheet text/css	2606:4700::6812:a560 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://research.checkpoint.com/wp-content/themes/research/style.css?ver=1.25 Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:a560 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b8d2f6e6753c9cd547601314a13ee8539629c6a85b0e9c50f5cc462cf42d60b3 Request headers Referer https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 25 Sep 2020 14:06:00 GMT content-encoding gzip cf-cache-status HIT last-modified Tue, 14 Jan 2020 00:19:03 GMT server cloudflare age 14301296 status 200 etag W/"5e1d08f7-48d7" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding, Accept-Encoding, Accept-Encoding content-type text/css access-control-allow-origin * cache-control public, max-age=30, s-maxage=2592000 cf-ray 5d854da4bb9ed70d-FRA cf-request-id 05672edaee0000d70d751a6200000001
GET H2	200	bootstrap.min.css research.checkpoint.com/wp-content/themes/research/css/	137 KB 21 KB	54ms 48ms	Stylesheet text/css	2606:4700::6812:a560 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://research.checkpoint.com/wp-content/themes/research/css/bootstrap.min.css?ver=4.1 Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:a560 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 34959e43e6ecf368807a84f92ad9aa6e2dcd5f0c5c1e57da55e8f3248d9d9255 Request headers Referer https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 25 Sep 2020 14:06:00 GMT content-encoding gzip cf-cache-status HIT last-modified Thu, 07 Nov 2019 22:27:49 GMT server cloudflare age 1413061 status 200 etag W/"5dc49a65-22485" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding, Accept-Encoding, Accept-Encoding content-type text/css access-control-allow-origin * cache-control public, max-age=31536000 cf-ray 5d854da4bba0d70d-FRA cf-request-id 05672edaee0000d70d751a7200000001
GET H2	200	flickity.min.css research.checkpoint.com/wp-content/themes/research/css/	2 KB 755 B	36ms 32ms	Stylesheet text/css	2606:4700::6812:a560 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://research.checkpoint.com/wp-content/themes/research/css/flickity.min.css?ver=1.1 Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:a560 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a8da941d8a446516c824ebc9fb77b42e6b92c6deed1daed266bd821ed27bc516 Request headers Referer https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 25 Sep 2020 14:06:00 GMT content-encoding gzip cf-cache-status HIT last-modified Thu, 07 Nov 2019 22:27:48 GMT server cloudflare age 12104873 status 200 etag W/"5dc49a64-71d" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding, Accept-Encoding, Accept-Encoding content-type text/css access-control-allow-origin * cache-control public, max-age=30, s-maxage=2592000 cf-ray 5d854da4bba1d70d-FRA cf-request-id 05672edaef0000d70d751a8200000001
GET H2	200	all.css use.fontawesome.com/releases/v5.6.3/css/	52 KB 13 KB	167ms 54ms	Stylesheet text/css	23.111.9.35 HIGHWINDS2
General Check archive.org Show headers Download Go to Full URL https://use.fontawesome.com/releases/v5.6.3/css/all.css?ver=5.6.3 Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 23.111.9.35 Phoenix, United States, ASN33438 (HIGHWINDS2, US), Reverse DNS Software NetDNA-cache/2.2 / Resource Hash 481a0574246e281316ffa0e15399bf5388bb81ae550ce0401a0353b6bb2d1e5a Request headers Referer https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 25 Sep 2020 14:06:00 GMT content-encoding gzip last-modified Thu, 20 Dec 2018 17:45:13 GMT server NetDNA-cache/2.2 status 200 etag W/"dc93d584e41f8417f6b7163320d34329" vary Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding access-control-allow-methods GET content-type text/css access-control-allow-origin * access-control-max-age 3000 cache-control max-age=31556926 x-cache HIT
GET H2	200	enlighterjs.min.css research.checkpoint.com/wp-content/plugins/enlighter/cache/	78 KB 9 KB	28ms 24ms	Stylesheet text/css	2606:4700::6812:a560 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://research.checkpoint.com/wp-content/plugins/enlighter/cache/enlighterjs.min.css?ver=3eTrCxHgMwTEyuj Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:a560 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6048e330c0f362be46b20de45d35a5ace57a04be04a29da10448d6949f6f69ce Request headers Referer https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 25 Sep 2020 14:06:00 GMT content-encoding gzip cf-cache-status HIT last-modified Wed, 26 Aug 2020 21:34:33 GMT server cloudflare age 1413062 status 200 etag W/"5f46d569-13686" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding, Accept-Encoding, Accept-Encoding content-type text/css access-control-allow-origin * cache-control public, max-age=31536000 cf-ray 5d854da4bba2d70d-FRA cf-request-id 05672edaef0000d70d751a9200000001
GET H2	200	jquery-3.4.0.min.js Show response code.jquery.com/	86 KB 30 KB	6534ms 27ms	Script application/javascript	2001:4de0:ac19::1:b:3b HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.4.0.min.js?ver=5.5.1 Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac19::1:b:3b , Netherlands, ASN20446 (HIGHWINDS3, US), Reverse DNS Software nginx / Resource Hash 0497a8d2a9bde7db8c0466fae73e347a3258192811ed1108e3e096d5f34ac0e8 Request headers Referer https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 25 Sep 2020 14:06:06 GMT content-encoding gzip last-modified Wed, 10 Apr 2019 19:56:14 GMT server nginx status 200 etag W/"5cae4a5e-15857" vary Accept-Encoding x-hw 1601042766.dop211.fr8.t,1601042766.cds286.fr8.hn,1601042766.cds051.fr8.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 30632
GET H2	200	bootstrap.bundle.min.js Show response research.checkpoint.com/wp-content/themes/research/js/lib/	66 KB 19 KB	28ms 24ms	Script application/javascript	2606:4700::6812:a560 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://research.checkpoint.com/wp-content/themes/research/js/lib/bootstrap.bundle.min.js?ver=4.1 Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:a560 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash bb3d017273ed487674d9766d8401cf458228596adcc0c3a6024f44ae715090db Request headers Referer https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 25 Sep 2020 14:06:00 GMT content-encoding gzip cf-cache-status HIT last-modified Thu, 07 Nov 2019 22:27:48 GMT server cloudflare age 12472994 status 200 etag W/"5dc49a64-1089e" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding, Accept-Encoding, Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control public, max-age=30, s-maxage=2592000 cf-ray 5d854da4bba4d70d-FRA cf-request-id 05672edaef0000d70d751ab200000001
GET H2	200	flickity.pkgd.min.js Show response research.checkpoint.com/wp-content/themes/research/js/lib/	54 KB 14 KB	33ms 29ms	Script application/javascript	2606:4700::6812:a560 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://research.checkpoint.com/wp-content/themes/research/js/lib/flickity.pkgd.min.js?ver=1.0.1 Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:a560 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash fe2df9f6df4b4a8d7174d259f563b8d9e28e4c03f8f4092fd9db6044e0e64c32 Request headers Referer https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 25 Sep 2020 14:06:00 GMT content-encoding gzip cf-cache-status HIT last-modified Thu, 07 Nov 2019 22:27:48 GMT server cloudflare age 13340796 status 200 etag W/"5dc49a64-d7c9" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding, Accept-Encoding, Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000 cf-ray 5d854da4bba8d70d-FRA cf-request-id 05672edaef0000d70d751ac200000001
GET H2	200	single-post.js Show response research.checkpoint.com/wp-content/themes/research/js/	422 B 369 B	31ms 28ms	Script application/javascript	2606:4700::6812:a560 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://research.checkpoint.com/wp-content/themes/research/js/single-post.js?ver=1.0.4 Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:a560 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7f5bd223eafa1c6d1aff21c91c6bfb825f7f36830d97eef41c432681ed671f85 Request headers Referer https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 25 Sep 2020 14:06:00 GMT content-encoding gzip cf-cache-status HIT last-modified Tue, 14 Jan 2020 00:00:05 GMT server cloudflare age 807261 status 200 etag W/"5e1d0485-1a6" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding, Accept-Encoding, Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000 cf-ray 5d854da4bbaad70d-FRA cf-request-id 05672edaef0000d70d751ad200000001
GET H2	200	inc-header.js Show response research.checkpoint.com/wp-content/themes/research/header/	1 KB 561 B	30ms 26ms	Script application/javascript	2606:4700::6812:a560 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://research.checkpoint.com/wp-content/themes/research/header/inc-header.js?v=1.1 Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:a560 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ae3754c54a0880a98a94c423d3e67f39b5b6f3c63516dafa33866e3e74c9f97d Request headers Referer https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 25 Sep 2020 14:06:00 GMT content-encoding gzip cf-cache-status HIT last-modified Thu, 07 Nov 2019 22:27:48 GMT server cloudflare age 13804580 status 200 etag W/"5dc49a64-47a" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding, Accept-Encoding, Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control public, max-age=30, s-maxage=2592000 cf-ray 5d854da4bbabd70d-FRA cf-request-id 05672edaef0000d70d751ae200000001
GET H2	200	style.css research.checkpoint.com/wp-content/themes/research/header/	9 KB 2 KB	30ms 27ms	Stylesheet text/css	2606:4700::6812:a560 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://research.checkpoint.com/wp-content/themes/research/header/style.css Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:a560 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0fe8bcbcd24ab838fbbd773001253fc0353956e81c5ba9c8e23951ebdbae305a Request headers Referer https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 25 Sep 2020 14:06:00 GMT content-encoding gzip cf-cache-status HIT last-modified Thu, 07 Nov 2019 22:27:48 GMT server cloudflare age 8539774 status 200 etag W/"5dc49a64-25cb" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding, Accept-Encoding, Accept-Encoding content-type text/css access-control-allow-origin * cache-control public, max-age=31536000 cf-ray 5d854da4bba3d70d-FRA cf-request-id 05672edaef0000d70d751aa200000001
GET H2	200	css fonts.googleapis.com/	2 KB 657 B	17ms 14ms	Stylesheet text/css	2a00:1450:4001:802::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Roboto Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 3d63b9ae0f8cccb888886d453950046c6925e5bb4e2a9096d5ad1d2f14d573a6 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff status 200 alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Fri, 25 Sep 2020 13:52:06 GMT server ESF date Fri, 25 Sep 2020 14:06:00 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Fri, 25 Sep 2020 14:06:00 GMT
GET H/1.1	200 OK	facebook.gif sc1.checkpoint.com/sc1/inc/html/images/social/	1 KB 2 KB	213ms 46ms	Image image/gif	184.31.86.129 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://sc1.checkpoint.com/sc1/inc/html/images/social/facebook.gif Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 184.31.86.129 , Netherlands, ASN20940 (AKAMAI-ASN1, EU), Reverse DNS a184-31-86-129.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash 791d8c8cb135d3d53915096e999d3857b6ee16966c20a019f38699f09f6aa2ff Request headers Referer https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Fri, 25 Sep 2020 14:06:00 GMT Last-Modified Mon, 25 Sep 2017 18:13:31 GMT Server AkamaiNetStorage ETag "7eb7015574801089503dd7095e1d4313:1506366539" Content-Type image/gif Cache-Control max-age=604800 Connection keep-alive Accept-Ranges bytes Content-Length 1254
GET H/1.1	200 OK	google-plus.gif sc1.checkpoint.com/sc1/inc/html/images/social/	2 KB 2 KB	40ms 40ms	Image image/gif	184.31.86.129 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://sc1.checkpoint.com/sc1/inc/html/images/social/google-plus.gif Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 184.31.86.129 , Netherlands, ASN20940 (AKAMAI-ASN1, EU), Reverse DNS a184-31-86-129.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash 1998582382fbf956231d65be84b76e08c0c86e5ced8a99c703bdec416d876d76 Request headers Referer https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Fri, 25 Sep 2020 14:06:00 GMT Last-Modified Mon, 25 Sep 2017 18:13:31 GMT Server AkamaiNetStorage ETag "eedd0b2cde10b6b1930d57a10c6d0422:1506366539" Content-Type image/gif Cache-Control max-age=604800 Connection keep-alive Accept-Ranges bytes Content-Length 1653
GET H/1.1	200 OK	linkedin.gif sc1.checkpoint.com/sc1/inc/html/images/social/	1 KB 2 KB	41ms 40ms	Image image/gif	184.31.86.129 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://sc1.checkpoint.com/sc1/inc/html/images/social/linkedin.gif Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 184.31.86.129 , Netherlands, ASN20940 (AKAMAI-ASN1, EU), Reverse DNS a184-31-86-129.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash a22d6b8782097b7cd9588ab582e119bfd6290278275661e9d0f96b2baec0cb8e Request headers Referer https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Fri, 25 Sep 2020 14:06:00 GMT Last-Modified Mon, 25 Sep 2017 18:13:31 GMT Server AkamaiNetStorage ETag "6789b034de6591b26bbd9b5fa6b451ca:1506366539" Content-Type image/gif Cache-Control max-age=604800 Connection keep-alive Accept-Ranges bytes Content-Length 1416
GET H/1.1	200 OK	email.gif sc1.checkpoint.com/sc1/inc/html/images/social/	1 KB 2 KB	44ms 44ms	Image image/gif	184.31.86.129 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://sc1.checkpoint.com/sc1/inc/html/images/social/email.gif Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 184.31.86.129 , Netherlands, ASN20940 (AKAMAI-ASN1, EU), Reverse DNS a184-31-86-129.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash 3643b2c826a615065303aa44b8f463eb854d77934f5f25dc1f74f60d4698f9f0 Request headers Referer https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Fri, 25 Sep 2020 14:06:00 GMT Last-Modified Mon, 25 Sep 2017 18:13:31 GMT Server AkamaiNetStorage ETag "15f1e1004accdbc019365e658249f334:1506366539" Content-Type image/gif Cache-Control max-age=604800 Connection keep-alive Accept-Ranges bytes Content-Length 1407
GET H/1.1	200 OK	rss.gif sc1.checkpoint.com/sc1/inc/html/images/social/	2 KB 2 KB	49ms 48ms	Image image/gif	184.31.86.129 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://sc1.checkpoint.com/sc1/inc/html/images/social/rss.gif Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 184.31.86.129 , Netherlands, ASN20940 (AKAMAI-ASN1, EU), Reverse DNS a184-31-86-129.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash b7cfb1c9430d90b22b3f4497543a4cfef719dc40a3cce130cad766171abe8bbe Request headers Referer https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Fri, 25 Sep 2020 14:06:01 GMT Last-Modified Mon, 25 Sep 2017 18:13:31 GMT Server AkamaiNetStorage ETag "8cc18e3677ea53cc679e33e82bf9497a:1506366539" Content-Type image/gif Cache-Control max-age=604800 Connection keep-alive Accept-Ranges bytes Content-Length 1620
GET H/1.1	200 OK	twitter.gif sc1.checkpoint.com/sc1/inc/html/images/social/	2 KB 2 KB	45ms 44ms	Image image/gif	184.31.86.129 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://sc1.checkpoint.com/sc1/inc/html/images/social/twitter.gif Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 184.31.86.129 , Netherlands, ASN20940 (AKAMAI-ASN1, EU), Reverse DNS a184-31-86-129.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash a59bba774218f207179b30aa8bbd21bad0f7355a52321e08138bd77a308c27d5 Request headers Referer https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Fri, 25 Sep 2020 14:06:01 GMT Last-Modified Mon, 25 Sep 2017 18:13:31 GMT Server AkamaiNetStorage ETag "6b05f4fc9522afa0cdbeb1a2c0bccc2c:1506366539" Content-Type image/gif Cache-Control max-age=604800 Connection keep-alive Accept-Ranges bytes Content-Length 1608
GET H/1.1	200 OK	check-point-research-logo.gif sc1.checkpoint.com/sc1/inc/html/images/	3 KB 3 KB	78ms 78ms	Image image/gif	184.31.86.129 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://sc1.checkpoint.com/sc1/inc/html/images/check-point-research-logo.gif Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 184.31.86.129 , Netherlands, ASN20940 (AKAMAI-ASN1, EU), Reverse DNS a184-31-86-129.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash b1fd89254c5a1e26226d533849c501ce8d17f47d4271e907f0084d7a25f1f242 Request headers Referer https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Fri, 25 Sep 2020 14:06:01 GMT Last-Modified Mon, 09 Jul 2018 21:15:16 GMT Server AkamaiNetStorage ETag "c425f4400a5c9dfbaecb24275f494931:1531172224" Content-Type image/gif Cache-Control max-age=604800 Connection keep-alive Accept-Ranges bytes Content-Length 2901
GET H2	200	under-attack.gif research.checkpoint.com/wp-content/themes/research/img/lib/	2 KB 2 KB	33ms 33ms	Image image/gif	2606:4700::6812:a560 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://research.checkpoint.com/wp-content/themes/research/img/lib/under-attack.gif Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:a560 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash fab08b60fa81a228f3dd0eb7678669844a4de6a1fd68683a28df73007fd74efa Request headers Referer https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 25 Sep 2020 14:06:01 GMT cf-cache-status HIT age 12200239 status 200 content-length 1666 cf-request-id 05672edddf0000d70d751eb200000001 last-modified Thu, 07 Nov 2019 22:27:48 GMT server cloudflare etag "5dc49a64-682" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/gif access-control-allow-origin * cache-control public, max-age=30, s-maxage=2592000 accept-ranges bytes cf-ray 5d854da96da2d70d-FRA
GET H2	200	gtm.js Show response www.googletagmanager.com/	211 KB 59 KB	27ms 27ms	Script application/javascript	2a00:1450:4001:81a::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-5JCRGP Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash fc1f96901182ea96c603be80d8eb0cfc33f70be077c32d5a8ea0f4163219d9b0 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Referer https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 25 Sep 2020 14:06:01 GMT content-encoding br vary Accept-Encoding status 200 alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 60337 x-xss-protection 0 last-modified Fri, 25 Sep 2020 12:00:00 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Fri, 25 Sep 2020 14:06:01 GMT
GET H2	200	email-decode.min.js Show response research.checkpoint.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/	1 KB 816 B	8ms 8ms	Script application/javascript	2606:4700::6812:a560 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://research.checkpoint.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:a560 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8 Security Headers Name Value X-Frame-Options SAMEORIGIN Request headers Referer https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 25 Sep 2020 14:06:00 GMT content-encoding gzip vary Accept-Encoding last-modified Mon, 14 Sep 2020 19:48:52 GMT server cloudflare etag W/"5f5fc924-4d7" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-frame-options SAMEORIGIN content-type application/javascript status 200 cache-control max-age=172800, public cf-ray 5d854da5ce47d70d-FRA cf-request-id 05672edb9c0000d70d751c3200000001 expires Sun, 27 Sep 2020 14:06:00 GMT
GET H2	200	sharethis.js Show response platform-api.sharethis.com/js/	98 KB 31 KB	19ms 18ms	Script text/javascript	2600:9000:206e:200:1c:8a07:5e80:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://platform-api.sharethis.com/js/sharethis.js Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:206e:200:1c:8a07:5e80:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software / Resource Hash ec4344adc742b2fbf294aeb340c91f1119885d17d96912e7163d2eec59a1ab69 Request headers Referer https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 25 Sep 2020 13:56:29 GMT content-encoding gzip age 571 etag W/"1867f-xSYf4UVSCF6CF7Uc3P7bbVwijO0" vary Accept-Encoding x-cache Hit from cloudfront content-type text/javascript; charset=utf-8 status 200 edge-control cache-maxage=60m,downstream-ttl=60m cache-control max-age=600, public x-amz-cf-pop VIE50-C1 x-amz-cf-id vz61At7AjGfnequKk9bO8Eo6Llb3hdSe2pyDs29HdpeWG2tAB4Na8A== via 1.1 108e63109879954f4e720db50559f788.cloudfront.net (CloudFront)
GET H2	200	CfP_1021x580_A.jpg research.checkpoint.com/wp-content/uploads/2018/11/	132 KB 132 KB	22ms 21ms	Image image/jpeg	2606:4700::6812:a560 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://research.checkpoint.com/wp-content/uploads/2018/11/CfP_1021x580_A.jpg Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:a560 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 9a6f22e2d9bba0601021ffb3fb8e484336fdd3041f6675f900ffc8c320091f06 Request headers Referer https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 25 Sep 2020 14:06:01 GMT cf-cache-status HIT age 13803291 status 200 content-length 134980 cf-request-id 05672ede2e0000d70d751f4200000001 last-modified Thu, 07 Nov 2019 22:27:41 GMT server cloudflare etag "5dc49a5d-20f44" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/jpeg access-control-allow-origin * cache-control public, max-age=30, s-maxage=2592000 accept-ranges bytes cf-ray 5d854da9eecbd70d-FRA cf-bgj h2pri
GET H2	200	enlighterjs.min.js Show response research.checkpoint.com/wp-content/plugins/enlighter/cache/	57 KB 17 KB	25ms 25ms	Script application/javascript	2606:4700::6812:a560 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://research.checkpoint.com/wp-content/plugins/enlighter/cache/enlighterjs.min.js?ver=3eTrCxHgMwTEyuj Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:a560 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7e0c4a1ed3d232553d98c82ea0e04cee8975d0a67df819e161f96e7c32179e8c Request headers Referer https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 25 Sep 2020 14:06:00 GMT content-encoding gzip cf-cache-status HIT last-modified Wed, 26 Aug 2020 21:34:33 GMT server cloudflare age 2561090 status 200 etag W/"5f46d569-e33f" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding, Accept-Encoding, Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000 cf-ray 5d854da5feb2d70d-FRA cf-request-id 05672edbbe0000d70d751c8200000001
GET H2	200	OneSignalSDK.js Show response cdn.onesignal.com/sdks/	8 KB 3 KB	34ms 18ms	Script application/javascript	2606:4700::6812:e234 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.onesignal.com/sdks/OneSignalSDK.js?ver=5.5.1 Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 2606:4700::6812:e234 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ffb110318b55e8d7acaeaa7816d495e33a5000643327241099565537973ed051 Request headers Referer https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 25 Sep 2020 14:06:01 GMT content-encoding gzip cf-cache-status HIT server cloudflare age 3026 etag W/"af07e3bccd7885748057bb532c526ac5" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/javascript status 200 cache-control public, max-age=259200 cf-ray 5d854daa3bf2d729-FRA cf-request-id 05672ede5e0000d7291b332200000001 expires Mon, 28 Sep 2020 14:06:01 GMT
GET H2	200	analytics.js Show response www.google-analytics.com/	45 KB 18 KB	30ms 30ms	Script text/javascript	2a00:1450:4001:821::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-5JCRGP Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:821::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 60863e86aa7743d1ac841da7f473a05cd57fba81d661cef658e385437f80d5ef Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff last-modified Wed, 09 Sep 2020 01:50:37 GMT server Golfe2 age 3021 date Fri, 25 Sep 2020 13:15:40 GMT vary Accept-Encoding content-type text/javascript status 200 cache-control public, max-age=7200 alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 18650 expires Fri, 25 Sep 2020 15:15:40 GMT
POST H2	200	collect Show response stats.g.doubleclick.net/j/	4 B 92 B	15ms 14ms	XHR text/plain	2a00:1450:400c:c0c::9b GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j86&tid=UA-194688-3&cid=1322209687.1601042761&jid=681987464&gjid=119464963&_gid=1277638121.1601042761&_u=YGBAgEABAAAAAE~&z=865987128 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400c:c0c::9b Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type text/plain Response headers pragma no-cache strict-transport-security max-age=10886400; includeSubDomains; preload x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 date Fri, 25 Sep 2020 14:06:01 GMT status 200 content-type text/plain access-control-allow-origin https://research.checkpoint.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 4 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	200	collect www.google-analytics.com/	35 B 119 B	6ms 6ms	Image image/gif	2a00:1450:4001:821::200e GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google-analytics.com/collect?v=1&_v=j86&a=787778904&t=pageview&_s=1&dl=https%3A%2F%2Fresearch.checkpoint.com%2F2020%2Fexploring-qbots-latest-attack-methods%2F&ul=en-us&de=UTF-8&dt=An%20Old%20Bot%C3%A2%C2%80%C2%99s%20Nasty%20New%20Tricks%3A%20Exploring%20Qbot%27s%20Latest%20Attack%20Methods%20-%20Check%20Point%20Research&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YGBAgEAB~&jid=681987464&gjid=119464963&cid=1322209687.1601042761&tid=UA-194688-3&_gid=1277638121.1601042761&gtm=2wg9g15JCRGP&z=952573344 Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:821::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Thu, 24 Sep 2020 17:46:10 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 age 73191 status 200 content-type image/gif access-control-allow-origin * cache-control no-cache, no-store, must-revalidate alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 35 expires Mon, 01 Jan 1990 00:00:00 GMT
GET H2	200	ga-audiences www.google.com/ads/	42 B 106 B	52ms 52ms	Image image/gif	2a00:1450:4001:824::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j86&tid=UA-194688-3&cid=1322209687.1601042761&jid=681987464&_u=YGBAgEABAAAAAE~&z=343762754 Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:824::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Fri, 25 Sep 2020 14:06:01 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control no-cache, no-store, must-revalidate content-type image/gif alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ga-audiences www.google.de/ads/	42 B 106 B	36ms 35ms	Image image/gif	2a00:1450:4001:808::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j86&tid=UA-194688-3&cid=1322209687.1601042761&jid=681987464&_u=YGBAgEABAAAAAE~&z=343762754 Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Fri, 25 Sep 2020 14:06:01 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control no-cache, no-store, must-revalidate content-type image/gif alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	search-icon.gif sc1.checkpoint.com/sc1/inc/html/images/	2 KB 2 KB	67ms 67ms	Image image/gif	184.31.86.129 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://sc1.checkpoint.com/sc1/inc/html/images/search-icon.gif Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/wp-content/themes/research/header/style.css Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 184.31.86.129 , Netherlands, ASN20940 (AKAMAI-ASN1, EU), Reverse DNS a184-31-86-129.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash 953d6908ab55929254e46c77e5c751a6e2df7ab84430f134edc3bb62d8f7d32f Request headers Referer https://research.checkpoint.com/wp-content/themes/research/header/style.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Fri, 25 Sep 2020 14:06:07 GMT Last-Modified Mon, 25 Sep 2017 18:13:31 GMT Server AkamaiNetStorage ETag "2e1aa25e7e77e6a393fd38efb413370f:1506366539" Content-Type image/gif Cache-Control max-age=604800 Connection keep-alive Accept-Ranges bytes Content-Length 1755
GET H2	200	34CA47_6_0.woff2 research.checkpoint.com/wp-content/themes/research/fonts/	58 KB 59 KB	35ms 34ms	Font font/woff2	2606:4700::6812:a560 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://research.checkpoint.com/wp-content/themes/research/fonts/34CA47_6_0.woff2 Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/wp-content/themes/research/style.css?ver=1.25 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:a560 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0fc686423c26cb1030032fd7e4f2dd664c4b08517a8990c0b46269dd4e01910b Request headers Origin https://research.checkpoint.com Referer https://research.checkpoint.com/wp-content/themes/research/style.css?ver=1.25 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 25 Sep 2020 14:06:07 GMT cf-cache-status HIT age 12200245 status 200 content-length 59536 cf-request-id 05672ef4b30000d70d753d7200000001 last-modified Thu, 07 Nov 2019 22:27:48 GMT server cloudflare etag "5dc49a64-e890" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type font/woff2 access-control-allow-origin * cache-control public, max-age=30, s-maxage=2592000 accept-ranges bytes cf-ray 5d854dcdeb8bd70d-FRA
GET H2	200	Appstore_1021x580.jpg research.checkpoint.com/wp-content/uploads/2020/07/	942 KB 943 KB	65ms 64ms	Image image/jpeg	2606:4700::6812:a560 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://research.checkpoint.com/wp-content/uploads/2020/07/Appstore_1021x580.jpg Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:a560 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dc2a0f3c9ad540379a306261e607930f48c639d2745ec6a2ecf7647d2fca8452 Request headers Referer https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 25 Sep 2020 14:06:07 GMT cf-cache-status HIT age 2520420 status 200 content-length 964508 cf-request-id 05672ef5c10000d70d753ea200000001 last-modified Thu, 20 Aug 2020 07:54:08 GMT server cloudflare etag "5f3e2c20-eb79c" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes cf-ray 5d854dcf9f8ad70d-FRA cf-bgj h2pri
GET H2	200	figure1-victim-statistics.png research.checkpoint.com/wp-content/uploads/2020/07/	63 KB 63 KB	45ms 43ms	Image image/png	2606:4700::6812:a560 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://research.checkpoint.com/wp-content/uploads/2020/07/figure1-victim-statistics.png Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:a560 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 43de29c385e310edc43504d3acd72626dd65fd79fd351736a95cc428d738926c Request headers Referer https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 25 Sep 2020 14:06:07 GMT cf-cache-status HIT age 387631 status 200 content-length 64442 cf-request-id 05672ef5c10000d70d753eb200000001 last-modified Tue, 21 Jul 2020 09:39:06 GMT server cloudflare etag "5f16b7ba-fbba" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes cf-ray 5d854dcf9f8cd70d-FRA
GET H2	200	figure2-organization-type.png research.checkpoint.com/wp-content/uploads/2020/07/	40 KB 40 KB	31ms 30ms	Image image/png	2606:4700::6812:a560 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://research.checkpoint.com/wp-content/uploads/2020/07/figure2-organization-type.png Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:a560 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 872497971c04a367e334be30c30f66ae2692080c005dc9e8243d49ea72d28055 Request headers Referer https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 25 Sep 2020 14:06:07 GMT cf-cache-status HIT age 387631 status 200 content-length 40756 cf-request-id 05672ef5c10000d70d753ec200000001 last-modified Tue, 21 Jul 2020 09:39:06 GMT server cloudflare etag "5f16b7ba-9f34" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes cf-ray 5d854dcf9f91d70d-FRA
GET H2	200	figure3-infection-chain.png research.checkpoint.com/wp-content/uploads/2020/07/	46 KB 46 KB	24ms 23ms	Image image/png	2606:4700::6812:a560 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://research.checkpoint.com/wp-content/uploads/2020/07/figure3-infection-chain.png Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:a560 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c9cb743fbc48e771b5935e15cdff480979210dab59dfedac94e83fe472fd8ae9 Request headers Referer https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 25 Sep 2020 14:06:07 GMT cf-cache-status HIT age 387631 status 200 content-length 47095 cf-request-id 05672ef5c10000d70d753ed200000001 last-modified Tue, 21 Jul 2020 09:39:07 GMT server cloudflare etag "5f16b7bb-b7f7" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes cf-ray 5d854dcf9f96d70d-FRA
GET H2	200	figure4-email-chain-1024x808.png research.checkpoint.com/wp-content/uploads/2020/07/	64 KB 64 KB	22ms 21ms	Image image/png	2606:4700::6812:a560 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://research.checkpoint.com/wp-content/uploads/2020/07/figure4-email-chain-1024x808.png Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:a560 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 54524cb11ea99a4c4544a85532d4e85c358387331c10fa034b644c1cbb1a4dc6 Request headers Referer https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 25 Sep 2020 14:06:07 GMT cf-cache-status HIT age 387631 status 200 content-length 65069 cf-request-id 05672ef5c10000d70d753ee200000001 last-modified Tue, 21 Jul 2020 09:39:07 GMT server cloudflare etag "5f16b7bb-fe2d" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes cf-ray 5d854dcf9f98d70d-FRA
GET H2	200	5a3031770f16c70012a3c297.js Show response buttons-config.sharethis.com/js/	525 B 872 B	472ms 472ms	Script text/javascript	2600:9000:206e:7800:c:abe:f440:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://buttons-config.sharethis.com/js/5a3031770f16c70012a3c297.js Requested by Host: platform-api.sharethis.com URL: https://platform-api.sharethis.com/js/sharethis.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:206e:7800:c:abe:f440:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash eee6d8fe37122ba1538560131fe5c95f9a4b6c45e2059076a7a92513fcb12f20 Request headers Referer https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 25 Sep 2020 14:06:08 GMT via 1.1 3a65445020a52e9a185051db037167bb.cloudfront.net (CloudFront) last-modified Tue, 12 Dec 2017 19:43:54 GMT server AmazonS3 x-amz-cf-pop VIE50-C1 etag "29c30155cdf2eaa96943948b94d537b6" x-cache Miss from cloudfront content-type text/javascript status 200 cache-control max-age=60,public accept-ranges bytes content-length 525 x-amz-cf-id AWs90GHZhOtN0kMe7rA_ElwM31ZF4EAq56eUOQb6LS6zVNVgLJKvJA==
GET H/1.1	200 OK	6si.min.js Show response j.6sc.co/	15 KB 7 KB	147ms 70ms	Script application/javascript	104.83.108.204 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://j.6sc.co/6si.min.js Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.83.108.204 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-83-108-204.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash 779651bc146d489786b9b4ab590d2784547448e4b85cf1bb9036b31e404d1a37 Request headers Referer https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Fri, 25 Sep 2020 14:06:07 GMT Content-Encoding gzip Last-Modified Thu, 24 Sep 2020 22:09:24 GMT Server nginx/1.14.0 (Ubuntu) ETag "5f6d1914-3a6c" Vary Accept-Encoding Access-Control-Allow-Methods GET,POST Content-Type application/javascript Access-Control-Allow-Origin Access-Control-Max-Age 86400 Access-Control-Allow-Credentials true Connection keep-alive Accept-Ranges bytes Access-Control-Allow-Headers * Content-Length 6116
GET H2	200	portal-v2.html c.sharethis.mgr.consensu.org/ Frame B1A9	0 0	18ms 18ms	Document text/html	2600:9000:206e:a400:c:a9b7:ddc0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://c.sharethis.mgr.consensu.org/portal-v2.html Requested by Host: platform-api.sharethis.com URL: https://platform-api.sharethis.com/js/sharethis.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:206e:a400:c:a9b7:ddc0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software / Resource Hash Request headers :method GET :authority c.sharethis.mgr.consensu.org :scheme https :path /portal-v2.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ Response headers status 200 content-type text/html; charset=utf-8 accept-ranges bytes content-encoding gzip last-modified Wed, 26 Aug 2020 05:25:30 GMT date Fri, 25 Sep 2020 13:48:45 GMT cache-control max-age=3600, public etag W/"83a-174293a7110" vary Accept-Encoding x-cache Hit from cloudfront via 1.1 f1a23d3ef0f9fd221ae2e300de878916.cloudfront.net (CloudFront) x-amz-cf-pop VIE50-C1 x-amz-cf-id Ow9zDHjYNw9DlaRjs9J2PMUMg7-gRHvM9rWgucX9kBHi0D-YeJaE1A== age 1042
GET H/1.1	200 OK	/ Show response c.6sc.co/	47 B 379 B	170ms 54ms	XHR text/plain	104.108.67.47 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://c.6sc.co/ Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.108.67.47 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-108-67-47.deploy.static.akamaitechnologies.com Software / Resource Hash 4d3490f5070842f74e20b18155c57aa7f9beda2fafbfd8f8c53a80190cf74029 Request headers Referer https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Fri, 25 Sep 2020 14:06:07 GMT Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type text/plain Access-Control-Allow-Origin https://research.checkpoint.com Access-Control-Allow-Credentials true Connection keep-alive Access-Control-Allow-Headers * Content-Length 47
GET H/1.1	200 OK	getuidj Show response secure.adnxs.com/	11 B 715 B	72ms 72ms	XHR application/json	37.252.172.38 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://secure.adnxs.com/getuidj Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 37.252.172.38 , Ascension Island, ASN29990 (ASN-APPNEX, US), Reverse DNS 690.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net Software nginx/1.17.9 / Resource Hash 31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Pragma no-cache Date Fri, 25 Sep 2020 14:06:07 GMT X-Proxy-Origin 185.156.175.107; 185.156.175.107; 690.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.172.133:80 AN-X-Request-Uuid 66b345e7-87a6-417c-9d23-3845679bba78 Server nginx/1.17.9 P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://research.checkpoint.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json; charset=utf-8 Content-Length 11 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
GET H2	200	twitter.svg platform-cdn.sharethis.com/img/	731 B 1 KB	21ms 19ms	Image image/svg+xml	2600:9000:206e:6600:1d:85c3:6640:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://platform-cdn.sharethis.com/img/twitter.svg Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:206e:6600:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 7c93346d4f681a0be90d1dfc19346382a4700f1810f41caa54415688dee1777f Request headers Referer https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-amz-server-side-encryption AES256 date Mon, 14 Sep 2020 08:31:37 GMT via 1.1 08fee972d33a4bc475aad82a2fc199cc.cloudfront.net (CloudFront) last-modified Thu, 10 Oct 2019 01:20:13 GMT server AmazonS3 age 970471 etag "0af2fb38987598376c99e21af17ade45" x-cache Hit from cloudfront content-type image/svg+xml status 200 cache-control public, max-age=2592000 x-amz-cf-pop VIE50-C1 accept-ranges bytes content-length 731 x-amz-cf-id mAaSLFiEhIKm9gq6zmkAH2AJkON7Dvn1ErIV9HYyh-vJuihg-QcbDQ==
GET H2	200	whatsapp.svg platform-cdn.sharethis.com/img/	832 B 1 KB	63ms 61ms	Image image/svg+xml	2600:9000:206e:6600:1d:85c3:6640:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://platform-cdn.sharethis.com/img/whatsapp.svg Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:206e:6600:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 847eb36b4dc4b05f94052dcd98077319e74d882334a106bb9ca451ba211c9c2c Request headers Referer https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-amz-server-side-encryption AES256 date Mon, 14 Sep 2020 06:14:36 GMT via 1.1 08fee972d33a4bc475aad82a2fc199cc.cloudfront.net (CloudFront) last-modified Thu, 10 Oct 2019 01:20:13 GMT server AmazonS3 age 978692 etag "afe7fc60ed757db39a88d2950fce69c9" x-cache Hit from cloudfront content-type image/svg+xml status 200 cache-control public, max-age=2592000 x-amz-cf-pop VIE50-C1 accept-ranges bytes content-length 832 x-amz-cf-id xPlwKTbb92okm7tgq7aci-CllOqVBRBvv66KoHp__qd4W85BWE34FA==
GET H2	200	facebook.svg platform-cdn.sharethis.com/img/	301 B 679 B	63ms 61ms	Image image/svg+xml	2600:9000:206e:6600:1d:85c3:6640:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://platform-cdn.sharethis.com/img/facebook.svg Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:206e:6600:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 768d97ec0916217ae82c70aeda3a61b9b0dab344edc4a3240a4f7cd94af00307 Request headers Referer https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-amz-server-side-encryption AES256 date Mon, 14 Sep 2020 08:11:47 GMT via 1.1 08fee972d33a4bc475aad82a2fc199cc.cloudfront.net (CloudFront) last-modified Thu, 10 Oct 2019 01:20:12 GMT server AmazonS3 age 971661 etag "c6e9be45643e197ce1db1d7e24a99adc" x-cache Hit from cloudfront content-type image/svg+xml status 200 cache-control public, max-age=2592000 x-amz-cf-pop VIE50-C1 accept-ranges bytes content-length 301 x-amz-cf-id 9x_1AkEyAeROmq1RFDMcbSum8MLEYF77RyQCiF6n8Dd3X4CvSb9CzQ==
GET H2	200	linkedin.svg platform-cdn.sharethis.com/img/	456 B 834 B	63ms 61ms	Image image/svg+xml	2600:9000:206e:6600:1d:85c3:6640:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://platform-cdn.sharethis.com/img/linkedin.svg Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:206e:6600:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash cb8c2b19fd9b56c41db14bd71b5c0616c1ba4e99b08c8e75084cf695f74b7120 Request headers Referer https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-amz-server-side-encryption AES256 date Mon, 14 Sep 2020 06:56:18 GMT via 1.1 08fee972d33a4bc475aad82a2fc199cc.cloudfront.net (CloudFront) last-modified Thu, 10 Oct 2019 01:20:12 GMT server AmazonS3 age 976190 etag "fa43b4ede18498b114fc7185993f6da7" x-cache Hit from cloudfront content-type image/svg+xml status 200 cache-control public, max-age=2592000 x-amz-cf-pop VIE50-C1 accept-ranges bytes content-length 456 x-amz-cf-id kXt-LVYEz2BLtW7QQTcJ7utJo9xcVDuFs6d5e8VFttrZ9Z7gD0AwWg==
GET H2	200	email.svg platform-cdn.sharethis.com/img/	343 B 721 B	63ms 61ms	Image image/svg+xml	2600:9000:206e:6600:1d:85c3:6640:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://platform-cdn.sharethis.com/img/email.svg Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:206e:6600:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 5f5012132c752db2433e17712d91ef8689f1bc95167b2720e23224c2ae62e009 Request headers Referer https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-amz-server-side-encryption AES256 date Mon, 14 Sep 2020 08:01:30 GMT via 1.1 08fee972d33a4bc475aad82a2fc199cc.cloudfront.net (CloudFront) last-modified Thu, 10 Oct 2019 01:20:12 GMT server AmazonS3 age 972278 etag "5977437466e857c7ddcadda6f6d88c2a" x-cache Hit from cloudfront content-type image/svg+xml status 200 cache-control public, max-age=2592000 x-amz-cf-pop VIE50-C1 accept-ranges bytes content-length 343 x-amz-cf-id 8uUV3RMCGQnlLjkMQ2mtCojiDB0fodTRPPq411BVG6ysQX51eqgZNw==
GET H2	200	pinterest.svg platform-cdn.sharethis.com/img/	771 B 1 KB	64ms 62ms	Image image/svg+xml	2600:9000:206e:6600:1d:85c3:6640:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://platform-cdn.sharethis.com/img/pinterest.svg Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:206e:6600:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash efc737b4f58cfe73a9bd0e57d7570365701381da31e628b269e7217a0ce3359d Request headers Referer https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-amz-server-side-encryption AES256 date Mon, 14 Sep 2020 07:55:38 GMT via 1.1 08fee972d33a4bc475aad82a2fc199cc.cloudfront.net (CloudFront) last-modified Thu, 10 Oct 2019 01:20:13 GMT server AmazonS3 age 972629 etag "2b10a062e719c64b686e2e8fcdc216dc" x-cache Hit from cloudfront content-type image/svg+xml status 200 cache-control public, max-age=2592000 x-amz-cf-pop VIE50-C1 accept-ranges bytes content-length 771 x-amz-cf-id ujBmk2uq_ddqcM3eV0EwpyZBEIgHjrXaS1YUAT6M-n1AxBAv4j1C-A==
GET H2	200	sharethis.svg platform-cdn.sharethis.com/img/	514 B 892 B	32ms 26ms	Image image/svg+xml	2600:9000:206e:6600:1d:85c3:6640:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://platform-cdn.sharethis.com/img/sharethis.svg Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:206e:6600:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 9a83c65bdd0ff9488af9d25720686457ea7295c9c44f9f1d285a0c9ec89bab99 Request headers Referer https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-amz-server-side-encryption AES256 date Mon, 14 Sep 2020 06:33:27 GMT via 1.1 08fee972d33a4bc475aad82a2fc199cc.cloudfront.net (CloudFront) last-modified Thu, 10 Oct 2019 01:20:13 GMT server AmazonS3 age 977561 etag "deecdaa377907db5cc1722fc831670a1" x-cache Hit from cloudfront content-type image/svg+xml status 200 cache-control public, max-age=2592000 x-amz-cf-pop VIE50-C1 accept-ranges bytes content-length 514 x-amz-cf-id mYtJJjYKLv_P6nQzOIm7_bNu-l-wSnw9WQFmXNSgUufZtT08X2hPyA==
GET H2	200	reddit.svg platform-cdn.sharethis.com/img/	910 B 1 KB	35ms 29ms	Image image/svg+xml	2600:9000:206e:6600:1d:85c3:6640:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://platform-cdn.sharethis.com/img/reddit.svg Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:206e:6600:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash dadbb59b37bfea4c78c6e15c8cbb96dfba84526e43a0767dc244fd062a841aba Request headers Referer https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-amz-server-side-encryption AES256 date Mon, 14 Sep 2020 07:53:26 GMT via 1.1 08fee972d33a4bc475aad82a2fc199cc.cloudfront.net (CloudFront) last-modified Thu, 10 Oct 2019 01:20:13 GMT server AmazonS3 age 972762 etag "78d796ca648d8a5e665b48ed0217c56a" x-cache Hit from cloudfront content-type image/svg+xml status 200 cache-control public, max-age=2592000 x-amz-cf-pop VIE50-C1 accept-ranges bytes content-length 910 x-amz-cf-id 0XyIGMT5tqEFSpbSaBxXzJMkHPi9VW4cjrUiO-sOmMCWX6TtklAYLQ==
GET H2	200	arrow_left.svg platform-cdn.sharethis.com/img/	565 B 943 B	33ms 30ms	Image image/svg+xml	2600:9000:206e:6600:1d:85c3:6640:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://platform-cdn.sharethis.com/img/arrow_left.svg Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:206e:6600:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 5c833b1818762f1e134fbb158447fb0b92f2b018b15aa36f2e2405213f830d38 Request headers Referer https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-amz-server-side-encryption AES256 date Mon, 14 Sep 2020 07:05:59 GMT via 1.1 08fee972d33a4bc475aad82a2fc199cc.cloudfront.net (CloudFront) last-modified Thu, 10 Oct 2019 01:20:12 GMT server AmazonS3 age 975609 etag "b55d8d2b9321e381a3c38a4bddb74037" x-cache Hit from cloudfront content-type image/svg+xml status 200 cache-control public, max-age=2592000 x-amz-cf-pop VIE50-C1 accept-ranges bytes content-length 565 x-amz-cf-id Ookxz06UGCH2s51BHFnXFDGfSQ6V2CUhbc_0ryP9xA-BvgiTaP5AqA==
GET H2	200	arrow_right.svg platform-cdn.sharethis.com/img/	565 B 942 B	33ms 30ms	Image image/svg+xml	2600:9000:206e:6600:1d:85c3:6640:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://platform-cdn.sharethis.com/img/arrow_right.svg Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:206e:6600:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 1bae747c7fd090f56608956a97c870391e1c43f89d24d5766129b75628985c1e Request headers Referer https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-amz-server-side-encryption AES256 date Mon, 14 Sep 2020 06:44:03 GMT via 1.1 08fee972d33a4bc475aad82a2fc199cc.cloudfront.net (CloudFront) last-modified Thu, 10 Oct 2019 01:20:12 GMT server AmazonS3 age 976925 etag "9928d025bd5792b718ee0a185f62e67c" x-cache Hit from cloudfront content-type image/svg+xml status 200 cache-control public, max-age=2592000 x-amz-cf-pop VIE50-C1 accept-ranges bytes content-length 565 x-amz-cf-id 1VpUrk2Tp65P2PlmeM6Ylm_KBaRwmT6NQf6YKdjPW1FUD2JoWgExSw==
GET H/1.1	204 No Content	pview Show response l.sharethis.com/	0 345 B	62ms 61ms	XHR text/plain	18.195.28.127 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://l.sharethis.com/pview?event=pview&hostname=research.checkpoint.com&location=%2F2020%2Fexploring-qbots-latest-attack-methods%2F&product=sticky-share-buttons&url=https%3A%2F%2Fresearch.checkpoint.com%2F2020%2Fexploring-qbots-latest-attack-methods%2F&source=sharethis.js&fcmp=false&fcmpv2=false&has_segmentio=false&title=An%20Old%20Bot%E2%80%99s%20Nasty%20New%20Tricks%3A%20Exploring%20Qbot%27s%20Latest%20Attack%20Methods%20-%20Check%20Point%20Research&cms=unknown&publisher=5a3031770f16c70012a3c297&sop=true&bsamesite=true&consentDomain=.consensu.org&gdpr_domain=.consensu.org&gdpr_domain_v1=.consensu.org&version=st_sop.js&lang=en&description=Research%20By%3A%20Alex%20Ilgayev%20Introduction%20The%20notorious%20banking%20trojan%20Qbot%20has%20been%20in%20business%20for%20more%20than%20a%20decade.%20The%20malware%2C%20which%20has%20also%20been%20dubbed%20Qakbot%20and%20Pinkslipbot%2C%20was%20discovered%20in%202008%20and%20is%20known%20for%20collecting%20browsing%20data%20and%20stealing%20banking%20credentials%20and%20other%20financial%20information%20from%20victims.%20It%20is%20highly%20structured%2C%20multi-layered%2C...%20Click%20to%20Read%20More Requested by Host: platform-api.sharethis.com URL: https://platform-api.sharethis.com/js/sharethis.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.195.28.127 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-195-28-127.eu-central-1.compute.amazonaws.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Fri, 25 Sep 2020 14:06:07 GMT Access-Control-Max-Age 1728000 Access-Control-Allow-Origin https://research.checkpoint.com Access-Control-Expose-Headers stid Cache-Control no-cache, no-store, must-revalidate Access-Control-Allow-Credentials true Connection keep-alive Access-Control-Allow-Headers *
GET H/1.1	200 OK	img.gif b.6sc.co/	43 B 774 B	412ms 338ms	Image image/gif	104.83.108.204 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/img.gif?token=af1e717890f3605d16fc823643e05b8c&svisitor=&visitor=e0fab097-5bd6-422b-8195-8a7f40665cd0&session=edaf5f7c-e8cd-4ce0-882a-97a097d9dfd3&event=a_pageload&q=%7B%7D&isIframe=false&m=%7B%22description%22%3A%22Latest%20Research%20by%20our%20Team%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22An%20Old%20Bot%E2%80%99s%20Nasty%20New%20Tricks%3A%20Exploring%20Qbot%27s%20Latest%20Attack%20Methods%20-%20Check%20Point%20Research%22%7D&cb=42767893&r=&thirdParty=%7B%7D&pageURL=https%3A%2F%2Fresearch.checkpoint.com%2F2020%2Fexploring-qbots-latest-attack-methods%2F Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.83.108.204 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-83-108-204.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Fri, 25 Sep 2020 14:06:08 GMT X-Content-Type-Options nosniff Connection keep-alive Content-Length 43 Pragma no-cache Last-Modified Fri, 21 Feb 2020 18:51:25 GMT Server nginx/1.14.0 (Ubuntu) ETag "5e5026ad-2b" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type image/gif Access-Control-Allow-Origin Cache-Control private, no-cache, no-cache=Set-Cookie, proxy-revalidate Access-Control-Allow-Credentials true Accept-Ranges bytes Access-Control-Allow-Headers * Expires Wed, 19 Apr 2000 11:43:00 GMT
GET H2	200	details Show response epsilon.6sense.com/v1/company/	558 B 549 B	108ms 39ms	XHR application/json	52.58.3.107 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://epsilon.6sense.com/v1/company/details Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.58.3.107 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-58-3-107.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash 2dcfdecf6545eb7c28d03c97a776bed88a137ec513a9c23139b73f54657e657d Request headers Authorization Token 87c67a7c5a9e9b4dd1824f6727ed4e43fadadde4 Referer https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 25 Sep 2020 14:06:08 GMT content-encoding gzip server nginx/1.16.0 status 200 vary Accept-Encoding content-type application/json access-control-allow-origin https://research.checkpoint.com access-control-allow-credentials true content-length 355
OPTIONS H2	200	details epsilon.6sense.com/v1/company/ Frame	0 0	117ms 36ms	Other	52.58.3.107 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://epsilon.6sense.com/v1/company/details Protocol H2 Server 52.58.3.107 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-58-3-107.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash Request headers Accept */* Access-Control-Request-Method GET Access-Control-Request-Headers authorization Origin https://research.checkpoint.com Sec-Fetch-Mode cors Response headers status 200 date Fri, 25 Sep 2020 14:06:08 GMT server nginx/1.16.0 access-control-allow-origin https://research.checkpoint.com access-control-allow-credentials true access-control-max-age 1800 access-control-allow-methods OPTIONS,GET access-control-allow-headers authorization
GET H/1.1	200 OK	insight.min.js Show response snap.licdn.com/li.lms-analytics/	965 B 761 B	18ms 17ms	Script application/x-javascript	2a02:26f0:4700:190::25ea AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://snap.licdn.com/li.lms-analytics/insight.min.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-5JCRGP Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:4700:190::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, EU), Reverse DNS Software / Resource Hash f10b9b0c4107ca5a40a5c69b1ac91a8948d84f39893dee6b429cdbdb05887093 Request headers Referer https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Fri, 25 Sep 2020 14:06:08 GMT Content-Encoding gzip Last-Modified Tue, 22 Sep 2020 22:01:48 GMT X-CDN AKAM Vary Accept-Encoding Content-Type application/x-javascript;charset=utf-8 Cache-Control max-age=11359 Connection keep-alive Accept-Ranges bytes Content-Length 448
GET H2	200	7614.js Show response script.crazyegg.com/pages/scripts/0041/	6 KB 2 KB	32ms 14ms	Script text/javascript	2606:4700::6813:9308 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://script.crazyegg.com/pages/scripts/0041/7614.js?444734 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-5JCRGP Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6813:9308 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e0f34cfc2711f9e3362639e33e273d43ccb41347d49a14ad6fe3b1c8fbf0c056 Request headers Referer https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 25 Sep 2020 14:06:08 GMT content-encoding gzip cf-cache-status HIT ce-version 11.1.118 age 158998 cf-polished origSize=5708 status 200 cf-request-id 05672ef9cc0000d6e9551aa200000001 last-modified Wed, 23 Sep 2020 17:56:10 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/javascript access-control-allow-origin * access-control-expose-headers CE-Version cache-control public, max-age=300, s-maxage=1209600 cf-ray 5d854dd619d2d6e9-FRA cf-bgj minify
GET H2	200	uwt.js Show response static.ads-twitter.com/	5 KB 2 KB	109ms 37ms	Script application/javascript	151.101.112.157 FASTLY
General Check archive.org Show headers Download Go to Full URL https://static.ads-twitter.com/uwt.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-5JCRGP Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.112.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 8247f4332667950989fe6bf790f87723343db2ec83d975503e9c5dc13a6eb5dc Request headers Referer https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 25 Sep 2020 14:06:08 GMT content-encoding gzip age 59626 x-cache HIT p3p CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" status 200 content-length 1958 x-served-by cache-hhn4038-HHN last-modified Mon, 10 Aug 2020 18:10:59 GMT x-timer S1601042768.405384,VS0,VE0 etag "a4cc3f907681b24a3efd540acd5d2996+gzip" vary Accept-Encoding,Host content-type application/javascript; charset=utf-8 via 1.1 varnish cache-control no-cache accept-ranges bytes
GET H/1.1	200 OK	munchkin.js Show response munchkin.marketo.net/	1 KB 1 KB	154ms 64ms	Script application/x-javascript	104.111.250.210 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://munchkin.marketo.net/munchkin.js Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.250.210 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-250-210.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash 5cc2628039ee08964a5f46fb8abb1d5e1ec87e1200d12862ef1232bbfed7da55 Request headers Referer https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Fri, 25 Sep 2020 14:06:08 GMT Content-Encoding gzip Last-Modified Wed, 05 Aug 2020 03:11:00 GMT Server AkamaiNetStorage ETag "a67ed8ce0a86706b9f73a86806ce5bd3:1596597060.25158" Vary Accept-Encoding P3P policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR" Connection keep-alive Accept-Ranges bytes Content-Type application/x-javascript Content-Length 752
GET H2	200	fbevents.js Show response connect.facebook.net/en_US/	135 KB 34 KB	6ms 6ms	Script application/x-javascript	2a03:2880:f02d:12:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/en_US/fbevents.js Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 097afea517679d2e0b986d77cb3fe7808026882b52ca074a050e03e7a4a6996b Security Headers Name Value Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Referer https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000; preload; includeSubDomains content-encoding gzip x-content-type-options nosniff status 200 alt-svc h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 content-length 34302 x-xss-protection 0 pragma public x-fb-debug drVMXHNIK76m9tzOl1hK1jGIGZjjxY2oqk/mOPIS4W/L8zT0ZpNPP3mXqCJglHPOtb63puhFuEIsM3NQITba5w== x-fb-trip-id 1460883810 date Fri, 25 Sep 2020 14:06:08 GMT x-frame-options DENY content-type application/x-javascript; charset=utf-8 vary Accept-Encoding cache-control public, max-age=1200 expires Sat, 01 Jan 2000 00:00:00 GMT
GET H/1.1	200 OK	obtp.js Show response amplify.outbrain.com/cp/	6 KB 3 KB	144ms 62ms	Script application/x-javascript	23.210.250.44 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://amplify.outbrain.com/cp/obtp.js Requested by Host: research.checkpoint.com URL: https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.210.250.44 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-210-250-44.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash 3dbe82bc7b6967990c2ac5fc49ccce4f5cda3177a5f1cb9f5ac15810610f4fed Request headers Referer https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Fri, 25 Sep 2020 14:06:08 GMT Content-Encoding gzip Last-Modified Sun, 06 Sep 2020 11:14:30 GMT Server AkamaiNetStorage ETag "70678dbef44ec87a01b0658386ba8cbb:1599390870.727094" Vary Accept-Encoding Content-Type application/x-javascript Cache-Control max-age=1200 Connection keep-alive Accept-Ranges bytes Content-Length 2697 Expires Fri, 25 Sep 2020 14:26:08 GMT
GET H/1.1	200 OK	insight.beta.min.js Show response snap.licdn.com/li.lms-analytics/	4 KB 2 KB	9ms 9ms	Script application/x-javascript	2a02:26f0:4700:190::25ea AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://snap.licdn.com/li.lms-analytics/insight.beta.min.js Requested by Host: snap.licdn.com URL: https://snap.licdn.com/li.lms-analytics/insight.min.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:4700:190::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, EU), Reverse DNS Software / Resource Hash a8431bfe4316cdc20de936e824f735c9478bbc9ce3d3a51c774eca45faff637f Request headers Referer https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Fri, 25 Sep 2020 14:06:08 GMT Content-Encoding gzip Last-Modified Tue, 22 Sep 2020 22:01:48 GMT X-CDN AKAM Vary Accept-Encoding Content-Type application/x-javascript;charset=utf-8 Cache-Control max-age=19923 Connection keep-alive Accept-Ranges bytes Content-Length 1799
GET H2	200	1692853834349189 Show response connect.facebook.net/signals/config/	524 KB 132 KB	7ms 7ms	Script application/x-javascript	2a03:2880:f02d:12:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/1692853834349189?v=2.9.24&r=stable Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 36afd1a2ad9b80221e089f9bc490e172151f8c95d1ae0802883f2d99e905a27c Security Headers Name Value Content-Security-Policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self'; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Referer https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self'; content-encoding gzip x-content-type-options nosniff status 200 alt-svc h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 content-length 134836 x-xss-protection 0 pragma public x-fb-debug xEXeeLMFV/FeKsWCbDrwfeprbx/vkEVyjqmHdn3cTPzgtL0YY9ePvhZAE0gy9kfqrkcvOnCXM2nvbMY6m/jYUQ== x-fb-trip-id 1460883810 x-frame-options DENY date Fri, 25 Sep 2020 14:06:08 GMT strict-transport-security max-age=31536000; preload; includeSubDomains content-type application/x-javascript; charset=utf-8 vary Accept-Encoding cache-control public, max-age=1200 expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	collect px.ads.linkedin.com/	0 63 B	171ms 170ms	Image application/javascript	2a05:f500:11:101::b93f:9005 LINKEDIN
General Check archive.org Show headers Download Go to Show image Full URL https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=51830&time=1601042768345&url=https%3A%2F%2Fresearch.checkpoint.com%2F2020%2Fexploring-qbots-latest-attack-methods%2F Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a05:f500:11:101::b93f:9005 , Ireland, ASN14413 (LINKEDIN, US), Reverse DNS Software Play / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 25 Sep 2020 14:06:08 GMT server Play linkedin-action 1 x-li-fabric prod-lor1 status 200 x-li-proto http/2 x-li-pop prod-tln1 content-type application/javascript content-length 0 x-li-uuid aAcGRuoLOBbgn3bcFSsAAA==
GET H2	200	11.1.118.js Show response script.crazyegg.com/pages/versioned/common-scripts/	99 KB 32 KB	21ms 20ms	Script text/javascript	2606:4700::6813:9308 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://script.crazyegg.com/pages/versioned/common-scripts/11.1.118.js Requested by Host: script.crazyegg.com URL: https://script.crazyegg.com/pages/scripts/0041/7614.js?444734 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6813:9308 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d9417079952dbe5d1b1bc0bf209d04bcf97459ce3c271837b4d9c45a48e3ecfa Request headers Referer https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 25 Sep 2020 14:06:08 GMT content-encoding gzip cf-cache-status HIT age 159089 cf-polished origSize=105320 status 200 cf-request-id 05672ef9de0000d6e9551ad200000001 last-modified Mon, 14 Sep 2020 15:45:13 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/javascript access-control-allow-origin * cache-control public, max-age=31536000, s-maxage=31536000 cf-ray 5d854dd63a15d6e9-FRA cf-bgj minify
GET H2	200	/ www.facebook.com/tr/	44 B 259 B	6ms 6ms	Image image/gif	2a03:2880:f12d:83:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=1692853834349189&ev=PageView&dl=https%3A%2F%2Fresearch.checkpoint.com%2F2020%2Fexploring-qbots-latest-attack-methods%2F&rl=&if=false&ts=1601042768382&sw=1600&sh=1200&v=2.9.24&r=stable&ec=0&o=30&fbp=fb.1.1601042768381.562489858&it=1601042768342&coo=false&rqm=GET Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash 10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 25 Sep 2020 14:06:08 GMT last-modified Fri, 21 Dec 2012 00:00:01 GMT server proxygen-bolt strict-transport-security max-age=31536000; includeSubDomains content-type image/gif status 200 cache-control no-cache, must-revalidate, max-age=0 alt-svc h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 content-length 44 expires Fri, 25 Sep 2020 14:06:08 GMT
GET H2	200	adsct Show response analytics.twitter.com/i/	31 B 391 B	168ms 167ms	Script application/javascript	104.244.42.195 TWITTER
General Check archive.org Show headers Download Go to Full URL https://analytics.twitter.com/i/adsct?type=javascript&version=1.1.0&p_id=Twitter&p_user_id=0&txn_id=nxi3o&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fresearch.checkpoint.com%2F2020%2Fexploring-qbots-latest-attack-methods%2F Requested by Host: static.ads-twitter.com URL: https://static.ads-twitter.com/uwt.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 104.244.42.195 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_o / Resource Hash df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf Security Headers Name Value Strict-Transport-Security max-age=631138519 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 25 Sep 2020 14:06:08 GMT content-encoding gzip x-content-type-options nosniff p3p CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" status 200, 200 OK x-twitter-response-tags BouncerCompliant strict-transport-security max-age=631138519 content-length 57 x-xss-protection 0 x-response-time 128 pragma no-cache last-modified Fri, 25 Sep 2020 14:06:08 GMT server tsa_o x-frame-options SAMEORIGIN content-type application/javascript;charset=utf-8 cache-control no-cache, no-store, must-revalidate, pre-check=0, post-check=0 x-connection-hash ef87d2779f87e6609b5ce7523c304b20 x-transaction 00dbe6d900c0738f expires Tue, 31 Mar 1981 05:00:00 GMT
GET H2	200	adsct t.co/i/	43 B 448 B	272ms 167ms	Image image/gif	104.244.42.133 TWITTER
General Check archive.org Show headers Download Go to Show image Full URL https://t.co/i/adsct?type=javascript&version=1.1.0&p_id=Twitter&p_user_id=0&txn_id=nxi3o&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tw_document_href=https%3A%2F%2Fresearch.checkpoint.com%2F2020%2Fexploring-qbots-latest-attack-methods%2F Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 104.244.42.133 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_o / Resource Hash ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957 Security Headers Name Value Strict-Transport-Security max-age=0 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 25 Sep 2020 14:06:08 GMT content-encoding gzip x-content-type-options nosniff status 200, 200 OK x-twitter-response-tags BouncerCompliant content-length 65 x-xss-protection 0 x-response-time 116 pragma no-cache last-modified Fri, 25 Sep 2020 14:06:08 GMT server tsa_o x-frame-options SAMEORIGIN strict-transport-security max-age=0 content-type image/gif;charset=utf-8 cache-control no-cache, no-store, must-revalidate, pre-check=0, post-check=0 x-connection-hash 0cb314416f6ffbd7d45c157e182a2756 x-transaction 0049ca5e001d3978 expires Tue, 31 Mar 1981 05:00:00 GMT
GET H/1.1	200 OK	unifiedPixel tr.outbrain.com/	43 B 275 B	472ms 117ms	Image image/gif	70.42.32.95 INTERNAP-BLK3
General Check archive.org Show headers Download Go to Show image Full URL https://tr.outbrain.com/unifiedPixel?marketerId=007281ee64432ffe21cc9ba8667dd68bed&obApiVersion=1.1&obtpVersion=1.3.1&name=PAGE_VIEW&dl=https%3A%2F%2Fresearch.checkpoint.com%2F2020%2Fexploring-qbots-latest-attack-methods%2F&optOut=false&bust=006997210717217994 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 70.42.32.95 , United States, ASN13789 (INTERNAP-BLK3, US), Reverse DNS ny.outbrain.com Software / Resource Hash 33ca751ed175a163bef530ebdcdbd0a2d15997ccbcbf8d50a6f504e8ffac5a5c Request headers Referer https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Fri, 25 Sep 2020 14:06:08 GMT Cache-Control no-cache Connection close X-TraceId 584cc6811b08052fb39019e4ae689032 content-encoding gzip Content-Length 60 Content-Type image/gif;
GET H/1.1	200 OK	munchkin.js Show response munchkin.marketo.net/159/	11 KB 6 KB	54ms 54ms	Script application/x-javascript	104.111.250.210 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://munchkin.marketo.net/159/munchkin.js Requested by Host: munchkin.marketo.net URL: https://munchkin.marketo.net/munchkin.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.250.210 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-250-210.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash 459e23d23ffe65a86f3a1f67c07edc92e0c69461ff83fbd63764d7b36cac92fc Request headers Referer https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Fri, 25 Sep 2020 14:06:08 GMT Content-Encoding gzip Last-Modified Fri, 08 May 2020 02:24:14 GMT Server AkamaiNetStorage ETag "79274ffc293e4f76fc372b953f780d16:1588904654.430334" Vary Accept-Encoding P3P policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR" Cache-Control max-age=8640000 Connection keep-alive Accept-Ranges bytes Content-Type application/x-javascript Content-Length 4810 Expires Sun, 03 Jan 2021 14:06:08 GMT
GET H/1.1	200 OK	visitWebPage Show response 750-dqh-528.mktoresp.com/webevents/	2 B 311 B	610ms 122ms	XHR text/plain	192.28.144.124 OMNITURE
General Check archive.org Show headers Download Go to Full URL https://750-dqh-528.mktoresp.com/webevents/visitWebPage?_mchNc=1601042768537&_mchCn=&_mchId=750-DQH-528&_mchTk=_mch-checkpoint.com-1601042768536-17246&_mchHo=research.checkpoint.com&_mchPo=&_mchRu=%2F2020%2Fexploring-qbots-latest-attack-methods%2F&_mchPc=https%3A&_mchVr=159&_mchEcid=&_mchHa=&_mchRe=&_mchQp= Requested by Host: munchkin.marketo.net URL: https://munchkin.marketo.net/159/munchkin.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 192.28.144.124 , United States, ASN15224 (OMNITURE, US), Reverse DNS Software nginx / Resource Hash 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3 Request headers Referer https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Fri, 25 Sep 2020 14:06:09 GMT Content-Encoding gzip Server nginx Transfer-Encoding chunked Content-Type text/plain; charset=UTF-8 Access-Control-Allow-Origin * Connection keep-alive X-Request-Id 626e2dfa-b1a6-4ff3-ac12-f5e83cf0ccc0
GET H2	200	/ www.facebook.com/tr/	44 B 100 B	10ms 6ms	Image image/gif	2a03:2880:f12d:83:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=1692853834349189&ev=Microdata&dl=https%3A%2F%2Fresearch.checkpoint.com%2F2020%2Fexploring-qbots-latest-attack-methods%2F&rl=&if=false&ts=1601042768898&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22An%20Old%20Bot%E2%80%99s%20Nasty%20New%20Tricks%3A%20Exploring%20Qbot%27s%20Latest%20Attack%20Methods%20-%20Check%20Point%20Research%22%2C%22meta%3Adescription%22%3A%22Latest%20Research%20by%20our%20Team%22%7D&cd[OpenGraph]=%7B%22og%3Alocale%22%3A%22en_US%22%2C%22og%3Atype%22%3A%22article%22%2C%22og%3Atitle%22%3A%22An%20Old%20Bot%E2%80%99s%20Nasty%20New%20Tricks%3A%20Exploring%20Qbot%27s%20Latest%20Attack%20Methods%20-%20Check%20Point%20Research%22%2C%22og%3Adescription%22%3A%22Research%20By%3A%20Alex%20Ilgayev%20Introduction%20The%20notorious%20banking%20trojan%20Qbot%20has%20been%20in%20business%20for%20more%20than%20a%20decade.%20The%20malware%2C%20which%20has%20also%20been%20dubbed%20Qakbot%20and%20Pinkslipbot%2C%20was%20discovered%20in%202008%20and%20is%20known%20for%20collecting%20browsing%20data%20and%20stealing%20banking%20credentials%20and%20other%20financial%20information%20from%20victims.%20It%20is%20highly%20structured%2C%20multi-layered%2C...%20Click%20to%20Read%20More%22%2C%22og%3Aurl%22%3A%22https%3A%2F%2Fresearch.checkpoint.com%2F2020%2Fexploring-qbots-latest-attack-methods%2F%22%2C%22og%3Asite_name%22%3A%22Check%20Point%20Research%22%2C%22article%3Apublished_time%22%3A%222020-08-27T09%3A57%3A14%2B00%3A00%22%2C%22article%3Amodified_time%22%3A%222020-09-15T12%3A54%3A59%2B00%3A00%22%2C%22og%3Aimage%22%3A%22https%3A%2F%2Fresearch.checkpoint.com%2Fwp-content%2Fuploads%2F2020%2F07%2FAppstore_1021x580.jpg%22%2C%22og%3Aimage%3Awidth%22%3A%221021%22%2C%22og%3Aimage%3Aheight%22%3A%22580%22%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.24&r=stable&ec=1&o=30&fbp=fb.1.1601042768381.562489858&it=1601042768342&coo=false&es=automatic&tm=3&rqm=GET Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash 10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 25 Sep 2020 14:06:08 GMT last-modified Fri, 21 Dec 2012 00:00:01 GMT server proxygen-bolt strict-transport-security max-age=31536000; includeSubDomains content-type image/gif status 200 cache-control no-cache, must-revalidate, max-age=0 alt-svc h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 content-length 44 expires Fri, 25 Sep 2020 14:06:08 GMT