urlscan.io logo urlscan.io
SecurityTrails logo

securityaffairs.co Open in urlscan Pro
217.160.0.146  Public Scan

Go To Rescan Add Verdict Report
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Submission: On March 20 via manual from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 32 IPs in 7 countries across 21 domains to perform 210 HTTP transactions. The main IP is 217.160.0.146, located in Germany and belongs to ONEANDONE-AS Brauerstrasse 48, DE. The main domain is securityaffairs.co.
This is the only time securityaffairs.co was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 47 217.160.0.146 8560 (ONEANDONE...)
5 216.58.206.10 15169 (GOOGLE)
1 94.31.29.16 54104 (AS-STACKPATH)
1 2.16.186.27 20940 (AKAMAI-ASN1)
1 23.67.137.77 20940 (AKAMAI-ASN1)
13 192.0.77.2 2635 (AUTOMATTIC)
29 104.90.192.189 16625 (AKAMAI-AS)
1 192.0.73.2 2635 (AUTOMATTIC)
1 185.60.216.19 32934 (FACEBOOK)
1 192.0.77.32 2635 (AUTOMATTIC)
3 216.58.206.14 15169 (GOOGLE)
2 192.0.76.3 2635 (AUTOMATTIC)
1 3 52.57.39.144 16509 (AMAZON-02)
3 172.217.16.174 15169 (GOOGLE)
8 172.217.17.67 15169 (GOOGLE)
2 2.21.246.49 20940 (AKAMAI-ASN1)
1 7 173.241.240.220 36089 (OPENX-AS1)
9 216.58.206.2 15169 (GOOGLE)
8 2.16.186.113 20940 (AKAMAI-ASN1)
24 54.86.56.206 14618 (AMAZON-AES)
3 172.217.22.98 15169 (GOOGLE)
12 172.217.16.162 15169 (GOOGLE)
1 185.60.216.35 32934 (FACEBOOK)
6 216.58.206.1 15169 (GOOGLE)
3 2.16.186.67 20940 (AKAMAI-ASN1)
3 54.241.182.29 16509 (AMAZON-02)
3 54.177.132.126 16509 (AMAZON-02)
3 52.8.72.42 16509 (AMAZON-02)
4 52.86.242.184 14618 (AMAZON-AES)
1 172.217.16.164 15169 (GOOGLE)
1 3 173.241.240.212 36089 (OPENX-AS1)
210 32
47    217.160.0.146 (Germany)

ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE)
PTR: 217-160-0-146.elastic-ssl.ui-r.com
securityaffairs.co
5    216.58.206.10 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra16s20-in-f10.1e100.net
fonts.googleapis.com
1    94.31.29.16 (United Kingdom)

ASN54104 (AS-STACKPATH - netDNA, US)
PTR: 94.31.29.16.IPYX-077437-ZYO.above.net
maxcdn.bootstrapcdn.com
1    2.16.186.27 (European Union)

ASN20940 (AKAMAI-ASN1, US)
PTR: a2-16-186-27.deploy.akamaitechnologies.com
w.sharethis.com
1    23.67.137.77 (Amsterdam, Netherlands)

ASN20940 (AKAMAI-ASN1, US)
PTR: a23-67-137-77.deploy.static.akamaitechnologies.com
platform-api.sharethis.com
13    192.0.77.2 (San Francisco, United States)

ASN2635 (AUTOMATTIC - Automattic, Inc, US)
PTR: i0.wp.com
i2.wp.com
i1.wp.com
i0.wp.com
29    104.90.192.189 (Amsterdam, Netherlands)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a104-90-192-189.deploy.static.akamaitechnologies.com
contextual.media.net
adservetx.media.net
opt-east.media.net
opt.media.net
1    192.0.73.2 (San Francisco, United States)

ASN2635 (AUTOMATTIC - Automattic, Inc, US)
0.gravatar.com
1    185.60.216.19 (Ireland)

ASN32934 (FACEBOOK - Facebook, Inc., US)
connect.facebook.net
1    192.0.77.32 (San Francisco, United States)

ASN2635 (AUTOMATTIC - Automattic, Inc, US)
PTR: wordpress.com
s0.wp.com
3    216.58.206.14 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra16s20-in-f14.1e100.net
apis.google.com
2    192.0.76.3 (San Francisco, United States)

ASN2635 (AUTOMATTIC - Automattic, Inc, US)
stats.wp.com
pixel.wp.com
3    52.57.39.144 (Frankfurt, Germany)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-57-39-144.eu-central-1.compute.amazonaws.com
l.sharethis.com
3    172.217.16.174 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra15s11-in-f174.1e100.net
www.google-analytics.com
8    172.217.17.67 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: ams16s30-in-f3.1e100.net
fonts.gstatic.com
2    2.21.246.49 (Austria)

ASN20940 (AKAMAI-ASN1, US)
pxlclnmdecom-a.akamaihd.net
h.mnet-ad.net
7    173.241.240.220 (New York, United States)

ASN36089 (OPENX-AS1 - OPENX TECHNOLOGIES, INC., US)
PTR: ox-173-241-240-220.xa.dc.openx.org
medianet-d.openx.net
9    216.58.206.2 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra16s20-in-f2.1e100.net
www.googletagservices.com
pagead2.googlesyndication.com
8    2.16.186.113 (European Union)

ASN20940 (AKAMAI-ASN1, US)
PTR: a2-16-186-113.deploy.akamaitechnologies.com
qsearch.media.net
24    54.86.56.206 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-54-86-56-206.compute-1.amazonaws.com
dt.clnmde.com
3    172.217.22.98 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra15s18-in-f2.1e100.net
adservice.google.com
12    172.217.16.162 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra15s11-in-f162.1e100.net
securepubads.g.doubleclick.net
1    185.60.216.35 (Ireland)

ASN32934 (FACEBOOK - Facebook, Inc., US)
www.facebook.com
6    216.58.206.1 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra16s20-in-f1.1e100.net
tpc.googlesyndication.com
3    2.16.186.67 (European Union)

ASN20940 (AKAMAI-ASN1, US)
PTR: a2-16-186-67.deploy.akamaitechnologies.com
qsearch-a.akamaihd.net
3    54.241.182.29 (San Jose, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-54-241-182-29.us-west-1.compute.amazonaws.com
navvy.media.net
3    54.177.132.126 (San Jose, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-54-177-132-126.us-west-1.compute.amazonaws.com
c.ad-srv.co
3    52.8.72.42 (San Jose, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-8-72-42.us-west-1.compute.amazonaws.com
c.adyield.co
4    52.86.242.184 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-52-86-242-184.compute-1.amazonaws.com
dt.clnmde.com
1    172.217.16.164 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra15s11-in-f164.1e100.net
google-analytics.com
3    173.241.240.212 (New York, United States)

ASN36089 (OPENX-AS1 - OPENX TECHNOLOGIES, INC., US)
PTR: ox-173-241-240-212.xa.dc.openx.org
us-ads.openx.net
Domain Requested by
47 securityaffairs.co 1 redirects securityaffairs.co
tpc.googlesyndication.com
28 dt.clnmde.com pxlclnmdecom-a.akamaihd.net
securityaffairs.co
24 contextual.media.net securityaffairs.co
contextual.media.net
tpc.googlesyndication.com
12 securepubads.g.doubleclick.net www.googletagservices.com
securepubads.g.doubleclick.net
securityaffairs.co
8 qsearch.media.net securityaffairs.co
contextual.media.net
8 fonts.gstatic.com securityaffairs.co
pxlclnmdecom-a.akamaihd.net
apis.google.com
7 medianet-d.openx.net 1 redirects securityaffairs.co
medianet-d.openx.net
6 pagead2.googlesyndication.com securepubads.g.doubleclick.net
securityaffairs.co
6 tpc.googlesyndication.com securepubads.g.doubleclick.net
6 i2.wp.com securityaffairs.co
5 fonts.googleapis.com securityaffairs.co
4 i1.wp.com securityaffairs.co
3 us-ads.openx.net 1 redirects contextual.media.net
securityaffairs.co
3 c.adyield.co securityaffairs.co
contextual.media.net
3 c.ad-srv.co securityaffairs.co
contextual.media.net
3 navvy.media.net contextual.media.net
3 qsearch-a.akamaihd.net securityaffairs.co
3 opt-east.media.net securityaffairs.co
3 adservice.google.com www.googletagservices.com
3 www.googletagservices.com securityaffairs.co
3 www.google-analytics.com securityaffairs.co
3 l.sharethis.com 1 redirects securityaffairs.co
3 apis.google.com securityaffairs.co
apis.google.com
3 i0.wp.com securityaffairs.co
1 google-analytics.com securityaffairs.co
1 pixel.wp.com securityaffairs.co
1 opt.media.net securityaffairs.co
1 www.facebook.com securityaffairs.co
1 h.mnet-ad.net securityaffairs.co
1 adservetx.media.net contextual.media.net
1 pxlclnmdecom-a.akamaihd.net contextual.media.net
1 stats.wp.com securityaffairs.co
1 s0.wp.com securityaffairs.co
1 connect.facebook.net securityaffairs.co
1 0.gravatar.com securityaffairs.co
1 platform-api.sharethis.com securityaffairs.co
1 w.sharethis.com securityaffairs.co
1 maxcdn.bootstrapcdn.com securityaffairs.co
210 38
Subject Issuer Validity Valid

This page contains 17 frames:

Primary Page: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Frame ID: EB71BB8012974EA2388A186F3E4CE027
Requests: 147 HTTP requests in this frame

Frame: http://medianet-d.openx.net/w/1.0/jstag?oxns=mNCM
Frame ID: 78BC6C4C194785B262D6DFBAFB68BED4
Requests: 2 HTTP requests in this frame

Frame: http://www.googletagservices.com/tag/js/gpt.js
Frame ID: 2A967EED911B65E94EAF10F8F045DE56
Requests: 7 HTTP requests in this frame

Frame: http://contextual.media.net/mediamain.html?&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=762221962&pid=8PO5M70HK&size=300x250&cpnet=yVb1sHm-0KIh29BOFTjjrEBbIZGw_v2fXpyZXRW3WVE%3D&cme=FCIgUes4lP8jgFeZgNKmic0rL2-LujhG_F35HOVEMPXoyy-2ZV1jLvon8EUh3DY_9_LIOYRvjrgdsPnTFZGmUkpm--mFnhHqLts4iOKhK47Be1FBgDho4ST02hqPkNFHw83atFSbNK8%3D%7C%7CNDHRnZ9Gz3KXlI-i9OnZqQ%3D%3D%7C5gDUJdTGiJzedmq9hanWYg%3D%3D%7CN7fu2vKt8_s%3D%7CwQKqVZNVxsiGNthX_x6E7c3ZldeNVrJ-RbaPXw1kck92gsm6AvIigX3MW3pWhxL8NxEf4sQpuUQFR149KyILolnB78-c2gzt%7CsRBSg3CPSiQ%3D%7C&cc=DE&bf=0&vif=1&nse=3&bid=210870&vi=1521560353868058059&lw=1&ugd=4&ib=0&ourl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F70299%2Fmalware%2Frottensys-botnet.html&osrc=metatag&katbid=-2&nb=1
Frame ID: 412165EA69595000FDA800F434F2AE78
Requests: 1 HTTP requests in this frame

Frame: http://medianet-d.openx.net/w/1.0/jstag?oxns=mNCM
Frame ID: D1D8C1C208911FEF5908B3953C7E941B
Requests: 2 HTTP requests in this frame

Frame: http://www.googletagservices.com/tag/js/gpt.js
Frame ID: E19EB7BB5E16B6748468C50CF1A49207
Requests: 7 HTTP requests in this frame

Frame: http://contextual.media.net/mediamain.html?&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=184323154&pid=8PO5M70HK&size=300x250&cpnet=yVb1sHm-0KIh29BOFTjjrHvHwrQGlpByWaOO1vn303s%3D&cme=yINvVCFxqLMbSqDgxM-acxgbv-13pHyD4y-MDQGBFdYUXQ-wXrJy0CPtTuDt0RSSxaoVDeZ3XY07KQMY9eHzta_iCBriuV7UZ-_IHi2pj1EhY9RBBPiQi5dCn9e6EzY48y5LXNPAQ9E%3D%7C%7CNDHRnZ9Gz3KXlI-i9OnZqQ%3D%3D%7C5gDUJdTGiJzedmq9hanWYg%3D%3D%7CN7fu2vKt8_s%3D%7CwQKqVZNVxsiGNthX_x6E7c3ZldeNVrJ-RbaPXw1kck92gsm6AvIigX3MW3pWhxL8NxEf4sQpuUQFR149KyILolnB78-c2gzt%7CsRBSg3CPSiQ%3D%7C&cc=DE&bf=0&vif=1&nse=3&bid=210870&vi=1521560354418830645&lw=1&ugd=4&ib=0&ourl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F70299%2Fmalware%2Frottensys-botnet.html&osrc=metatag&katid=800384229&katbid=-14&nb=1
Frame ID: 6E374C8E895A92957B4CFEBB713F115A
Requests: 1 HTTP requests in this frame

Frame: http://contextual.media.net/__media__/js/util/nrr.js?v=79
Frame ID: 4DDF886DA577D47D71DE826A571CE2CC
Requests: 7 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/pagead/js/r20180312/r20110914/activeview/osd_listener.js
Frame ID: 4CE7CA71FC5C71E8D0870A2C3C7EC663
Requests: 3 HTTP requests in this frame

Frame: http://medianet-d.openx.net/w/1.0/jstag?oxns=mNCM
Frame ID: 689F8BA9F8BCFF451D29D279299990E
Requests: 2 HTTP requests in this frame

Frame: http://www.googletagservices.com/tag/js/gpt.js
Frame ID: 1A92E80D2232FC8F370DC61F11FB8F6C
Requests: 7 HTTP requests in this frame

Frame: http://contextual.media.net/__media__/js/util/nrr.js?v=79
Frame ID: 84A1152D82210B965F25AB6F9A156182
Requests: 6 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/pagead/js/r20180312/r20110914/activeview/osd_listener.js
Frame ID: C831884F3EFCE6013CF19E4EFFFDF14C
Requests: 3 HTTP requests in this frame

Frame: http://contextual.media.net/mediamain.html?&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=639665355&pid=8PO5M70HK&size=300x600&cpnet=yVb1sHm-0KIh29BOFTjjrOMbY3Wy7OSYfNFL7sC0vVY%3D&cme=sj8jUgUthZgb1dk55FlquHTZZWJ5h3uCyeWPMZuARP06ymyV8xaf7IGyrTEw9Mqe0VEgnOI2lfgsjpp_kIry7BcGTHhLQPB8su0CxyMmpe-aZep7AcFhefS-26SA-aelKUhC-QRXHFM%3D%7C%7CNDHRnZ9Gz3KXlI-i9OnZqQ%3D%3D%7C5gDUJdTGiJzedmq9hanWYg%3D%3D%7CN7fu2vKt8_s%3D%7CwQKqVZNVxsiGNthX_x6E7c3ZldeNVrJ-RbaPXw1kck92gsm6AvIigX3MW3pWhxL8NxEf4sQpuUQFR149KyILolnB78-c2gzt%7CsRBSg3CPSiQ%3D%7C&cc=DE&bf=0&vif=1&nse=3&bid=210870&vi=1521560356379511616&lw=1&ugd=4&ib=0&ourl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F70299%2Fmalware%2Frottensys-botnet.html&osrc=metatag&katid=800543883&katbid=-14&nb=1
Frame ID: C64477CFDD036F3292E045F8734F9C5F
Requests: 1 HTTP requests in this frame

Frame: http://contextual.media.net/__media__/js/util/nrr.js?v=79
Frame ID: 5E05857211F3D24BECEB8EFB48B2FFC0
Requests: 6 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/pagead/js/r20180312/r20110914/activeview/osd_listener.js
Frame ID: 9341DDDADD93444818198CF51750CC12
Requests: 3 HTTP requests in this frame

Frame: http://us-ads.openx.net/w/1.0/jstag
Frame ID: F5780AF98E2151355C2ABD493DD3C099
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • html /<link[^>]+s\d+\.wp\.com/i
Overall confidence: 100%
Detected patterns
  • html /<link[^>]+s\d+\.wp\.com/i
Overall confidence: 100%
Detected patterns
  • env /^mejs$/i
Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
Overall confidence: 100%
Detected patterns
  • html /<!-- This site is optimized with the Yoast/i
Overall confidence: 100%
Detected patterns
  • script /\/\/connect\.facebook\.net\/[^\/]*\/[a-z]*\.js/i
Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|(analytics))\.js/i
  • env /^gaGlobal$/i
Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i
Overall confidence: 100%
Detected patterns
  • env /^twemoji$/i
Overall confidence: 100%
Detected patterns
  • env /^jQuery$/i

Page Statistics

210
Requests

0 %
HTTPS

0 %
IPv6

21
Domains

38
Subdomains

32
IPs

7
Countries

2010 kB
Transfer

4320 kB
Size

6
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 42
  • http://connect.facebook.net/en_US/sdk.js HTTP 307
  • https://connect.facebook.net/en_US/sdk.js
Request Chain 69
  • http://l.sharethis.com/pview?event=pview&version=st_insights.js&lang=en&fpc=6f69f6a-16244107bc9-3f35429d-1&sessionID=1521560353737.61219&hostname=securityaffairs.co&location=%2Fwordpress%2F70299%2Fmalware%2Frottensys-botnet.html&product=simpleshare&publisher=4d48b7c5-0ae3-43d4-bfbe-3ff8c17a8ae6&st_optout=false&url=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F70299%2Fmalware%2Frottensys-botnet.html&sharURL=&buttonType=ERROR&destination=ERROR&source=ERROR&title=The%20RottenSys%20botnet%20is%20already%20composed%20of%20nearly%205%20million%20Android%20devicesSecurity%20Affairs&ts1521560353737.0=&sop=false HTTP 301
  • http://l.sharethis.com/sc?cm=CvQGBlqxKyEAAAARSLAHAw%3D%3D&uid=true&url=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F70299%2Fmalware%2Frottensys-botnet.html
Request Chain 95
  • http://medianet-d.openx.net/w/1.0/acj?ai=be377f37-02be-487d-99d2-2c61d8eb7c49&o=7015295044&callback=OX_mNCM_7015295044&ju=http%3A//securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html&jr=&auid=538672510&dims=1600x1200&adxy=0%2C0&res=1600x1200x24&plg=pm&ch=UTF-8&tz=0&ws=0x0&ifr=1&tws=1600x1200 HTTP 302
  • http://medianet-d.openx.net/w/1.0/acj?cc=1&ai=be377f37-02be-487d-99d2-2c61d8eb7c49&o=7015295044&callback=OX_mNCM_7015295044&ju=http%3A//securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html&jr=&auid=538672510&dims=1600x1200&adxy=0%2C0&res=1600x1200x24&plg=pm&ch=UTF-8&tz=0&ws=0x0&ifr=1&tws=1600x1200
Request Chain 175
  • http://securityaffairs.co/wordpress?ga_action=googleanalytics_get_script HTTP 301
  • http://securityaffairs.co/wordpress/?ga_action=googleanalytics_get_script
Request Chain 203
  • http://us-ads.openx.net/w/1.0/acj?ai=5a4021d3-c664-4d60-837c-8eb455d890e0&o=1929314863&callback=OX_1929314863&ju=http%3A//securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html&jr=&auid=537253288&dims=1600x1200&adxy=0%2C0&res=1600x1200x24&plg=pm&ch=UTF-8&tz=0&ws=0x0&ifr=1&tws=1600x1200 HTTP 302
  • http://us-ads.openx.net/w/1.0/acj?cc=1&ai=5a4021d3-c664-4d60-837c-8eb455d890e0&o=1929314863&callback=OX_1929314863&ju=http%3A//securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html&jr=&auid=537253288&dims=1600x1200&adxy=0%2C0&res=1600x1200x24&plg=pm&ch=UTF-8&tz=0&ws=0x0&ifr=1&tws=1600x1200

210 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request Cookie set rottensys-botnet.html
securityaffairs.co/wordpress/70299/malware/ 		67 KB
18 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
217.160.0.146 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
217-160-0-146.elastic-ssl.ui-r.com
Software
Apache / PHP/5.6.34
Resource Hash
1159649e0b1405aa5be707ac5b43ad9ba0edf8b80420934e8b2f1ba956fea7fe

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
securityaffairs.co
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Cache-Control
no-cache
Connection
keep-alive
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:10 GMT
Content-Encoding
gzip
Server
Apache
X-Powered-By
PHP/5.6.34
X-Pingback
http://securityaffairs.co/wordpress/xmlrpc.php
Content-Type
text/html; charset=UTF-8
Connection
keep-alive
Transfer-Encoding
chunked
Set-Cookie
wfvt_2796755358=5ab12b1f25a70; expires=Tue, 20-Mar-2018 16:09:11 GMT; Max-Age=1800; path=/; httponly
Link
<http://securityaffairs.co/wordpress/wp-json/>; rel="https://api.w.org/", <http://securityaffairs.co/wordpress/?p=70299>; rel=shortlink
Keep-Alive
timeout=15
cli-style.css
securityaffairs.co/wordpress/wp-content/plugins/cookie-law-info/css/ 		2 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://securityaffairs.co/wordpress/wp-content/plugins/cookie-law-info/css/cli-style.css?ver=1.5.3
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
217.160.0.146 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
217-160-0-146.elastic-ssl.ui-r.com
Software
Apache /
Resource Hash
6f51bc9ebf7850acad4c4f8599c06ec74ee3749b7f4e5d38d29fb8aa1fbf1424

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
securityaffairs.co
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Cookie
wfvt_2796755358=5ab12b1f25a70
Connection
keep-alive
Cache-Control
no-cache
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:12 GMT
Last-Modified
Wed, 16 Dec 2015 06:30:06 GMT
Server
Apache
ETag
"97a-526fe09789780"
Content-Type
text/css
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=15
Content-Length
2426
style.css
securityaffairs.co/wordpress/wp-content/plugins/facebook-button-plugin/css/ 		3 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://securityaffairs.co/wordpress/wp-content/plugins/facebook-button-plugin/css/style.css?ver=dc488b3cf402a36ed8529f3196db2a8a
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
217.160.0.146 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
217-160-0-146.elastic-ssl.ui-r.com
Software
Apache /
Resource Hash
562487753256f10cc9e7bec2c59b54c5b6e564f9c72036675f14088415032775

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
securityaffairs.co
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Cookie
wfvt_2796755358=5ab12b1f25a70
Connection
keep-alive
Cache-Control
no-cache
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:12 GMT
Last-Modified
Tue, 13 Mar 2018 06:43:04 GMT
Server
Apache
ETag
"bc0-56745920b278a"
Content-Type
text/css
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=15
Content-Length
3008
css
fonts.googleapis.com/ 		430 B
811 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://fonts.googleapis.com/css?family=Indie+Flower&ver=dc488b3cf402a36ed8529f3196db2a8a
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
216.58.206.10 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s20-in-f10.1e100.net
Software
ESF /
Resource Hash
d6453e4ef533b200e04bb79efd3225c1f8e9fac71ece2ef7f7b9c7d8b4b7b73c
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:12 GMT
Content-Encoding
gzip
Last-Modified
Tue, 20 Mar 2018 15:39:12 GMT
Server
ESF
X-Frame-Options
SAMEORIGIN
Content-Type
text/css; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
private, max-age=86400, stale-while-revalidate=604800
Transfer-Encoding
chunked
Timing-Allow-Origin
*
Link
<http://fonts.gstatic.com>; rel=preconnect; crossorigin
X-XSS-Protection
1; mode=block
Expires
Tue, 20 Mar 2018 15:39:12 GMT
font-awesome.min.css
maxcdn.bootstrapcdn.com/font-awesome/4.3.0/css/ 		23 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://maxcdn.bootstrapcdn.com/font-awesome/4.3.0/css/font-awesome.min.css?ver=dc488b3cf402a36ed8529f3196db2a8a
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
94.31.29.16 , United Kingdom, ASN54104 (AS-STACKPATH - netDNA, US),
Reverse DNS
94.31.29.16.IPYX-077437-ZYO.above.net
Software
NetDNA-cache/2.2 /
Resource Hash
541ac58217a8ade1a5e292a65a0661dc9db7a49ae13654943817a4fbc6761afd

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:12 GMT
Content-Encoding
gzip
Last-Modified
Sat, 17 Feb 2018 21:46:17 GMT
Server
NetDNA-cache/2.2
Connection
keep-alive
ETag
W/"04425bbdc6243fc6e54bf8984fe50330"
Vary
Accept-Encoding
X-Cache
HIT
Content-Type
text/css; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=31104000
Transfer-Encoding
chunked
X-Hello-Human
Say hello back! @getBootstrapCDN on Twitter
Expires
Fri, 15 Mar 2019 15:39:12 GMT
custom.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/jqueryui/ 		19 KB
20 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/jqueryui/custom.css?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
217.160.0.146 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
217-160-0-146.elastic-ssl.ui-r.com
Software
Apache /
Resource Hash
e89bbc7723c5114f9cf138c6019bbca4e4f5e13f6b9febaa38c92c4c3584a964

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
securityaffairs.co
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Cookie
wfvt_2796755358=5ab12b1f25a70
Connection
keep-alive
Cache-Control
no-cache
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:12 GMT
Last-Modified
Wed, 16 Dec 2015 13:54:59 GMT
Server
Apache
ETag
"4d92-52704407f72c0"
Content-Type
text/css
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=15
Content-Length
19858
tipsy.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/ 		539 B
799 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/tipsy.css?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
217.160.0.146 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
217-160-0-146.elastic-ssl.ui-r.com
Software
Apache /
Resource Hash
8d732b3483eb44546a848a82cc9d6a584c81860aae7255f7ac589dcb3f130535

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
securityaffairs.co
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Cookie
wfvt_2796755358=5ab12b1f25a70
Connection
keep-alive
Cache-Control
no-cache
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:12 GMT
Last-Modified
Wed, 16 Dec 2015 06:58:04 GMT
Server
Apache
ETag
"21b-526fe6d7cd700"
Content-Type
text/css
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=15
Content-Length
539
flexslider.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/flexslider/ 		6 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/flexslider/flexslider.css?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
217.160.0.146 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
217-160-0-146.elastic-ssl.ui-r.com
Software
Apache /
Resource Hash
759949fb0ffaa47eb3755d704adfee7be3ab4fd3d3fa2f37381ca6ea8b9506b1

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
securityaffairs.co
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Cookie
wfvt_2796755358=5ab12b1f25a70
Connection
keep-alive
Cache-Control
no-cache
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:12 GMT
Last-Modified
Wed, 16 Dec 2015 13:55:09 GMT
Server
Apache
ETag
"1851-5270441180940"
Content-Type
text/css
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=15
Content-Length
6225
mediaelementplayer-legacy.min.css
securityaffairs.co/wordpress/wp-includes/js/mediaelement/ 		11 KB
11 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://securityaffairs.co/wordpress/wp-includes/js/mediaelement/mediaelementplayer-legacy.min.css?ver=4.2.6-78496d1
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
217.160.0.146 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
217-160-0-146.elastic-ssl.ui-r.com
Software
Apache /
Resource Hash
ffa31f5802b20d64a10c71ad93394c1e2b4b16f33e2f479d8274fd02ce0a594f

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
securityaffairs.co
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Cookie
wfvt_2796755358=5ab12b1f25a70
Connection
keep-alive
Cache-Control
no-cache
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:12 GMT
Last-Modified
Thu, 16 Nov 2017 13:57:00 GMT
Server
Apache
ETag
"2be0-55e19fe77c80f"
Content-Type
text/css
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=15
Content-Length
11232
animation.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/ 		2 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/animation.css?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
217.160.0.146 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
217-160-0-146.elastic-ssl.ui-r.com
Software
Apache /
Resource Hash
2333802e4a0c86b4cc4c71b376fc0aedc3b03039bfc777d96105f82231215732

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
securityaffairs.co
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Cookie
wfvt_2796755358=5ab12b1f25a70
Connection
keep-alive
Cache-Control
no-cache
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:12 GMT
Last-Modified
Wed, 16 Dec 2015 06:58:02 GMT
Server
Apache
ETag
"6b4-526fe6d5e5280"
Content-Type
text/css
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=15
Content-Length
1716
font-awesome.min.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/ 		17 KB
18 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/font-awesome.min.css?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
217.160.0.146 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
217-160-0-146.elastic-ssl.ui-r.com
Software
Apache /
Resource Hash
b12c1cd811f54d11bfdcb5e235e73934a8b8a7a85eafb8529117f9a5bb64ccf8

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
securityaffairs.co
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Cookie
wfvt_2796755358=5ab12b1f25a70
Connection
keep-alive
Cache-Control
no-cache
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:12 GMT
Last-Modified
Wed, 16 Dec 2015 06:58:02 GMT
Server
Apache
ETag
"4574-526fe6d5e5280"
Content-Type
text/css
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=15
Content-Length
17780
swipebox.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/ 		4 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/swipebox.css?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
217.160.0.146 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
217-160-0-146.elastic-ssl.ui-r.com
Software
Apache /
Resource Hash
9a47abcc220084cd32dd51bd76f84ff7839e2dbf1a132fb970e8a1437f03726b

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
securityaffairs.co
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Cookie
wfvt_2796755358=5ab12b1f25a70
Connection
keep-alive
Cache-Control
no-cache
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:12 GMT
Last-Modified
Wed, 16 Dec 2015 06:58:18 GMT
Server
Apache
ETag
"118d-526fe6e527680"
Content-Type
text/css
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=15
Content-Length
4493
jquery.circliful.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/ 		334 B
594 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/jquery.circliful.css?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
217.160.0.146 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
217-160-0-146.elastic-ssl.ui-r.com
Software
Apache /
Resource Hash
7478123ab457a28ecf9df78f2832fbdbefc205eaef0930b4f6666903e756be46

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
securityaffairs.co
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Cookie
wfvt_2796755358=5ab12b1f25a70
Connection
keep-alive
Cache-Control
no-cache
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:12 GMT
Last-Modified
Wed, 16 Dec 2015 06:58:02 GMT
Server
Apache
ETag
"14e-526fe6d5e5280"
Content-Type
text/css
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=15
Content-Length
334
screen.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/ 		110 KB
110 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/screen.css?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
217.160.0.146 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
217-160-0-146.elastic-ssl.ui-r.com
Software
Apache /
Resource Hash
13b61826fde5b78966364a0bfe1f2309da1f0ccd75923528a5014978b7276742

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
securityaffairs.co
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Cookie
wfvt_2796755358=5ab12b1f25a70
Connection
keep-alive
Cache-Control
no-cache
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:12 GMT
Last-Modified
Wed, 16 Dec 2015 06:58:04 GMT
Server
Apache
ETag
"1b844-526fe6d7cd700"
Content-Type
text/css
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=15
Content-Length
112708
custom-css.php
securityaffairs.co/wordpress/wp-content/themes/rigel_old/templates/ 		12 KB
12 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://securityaffairs.co/wordpress/wp-content/themes/rigel_old/templates/custom-css.php?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
217.160.0.146 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
217-160-0-146.elastic-ssl.ui-r.com
Software
Apache / PHP/5.6.34
Resource Hash
18d61b5ee68a57bd7a4733f776f9f8aa5c353e7f35a420881523b6edbf7c6b19

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
securityaffairs.co
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Cookie
wfvt_2796755358=5ab12b1f25a70
Connection
keep-alive
Cache-Control
no-cache
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:12 GMT
Server
Apache
Connection
keep-alive
X-Powered-By
PHP/5.6.34
Transfer-Encoding
chunked
Keep-Alive
timeout=15
Content-Type
text/css; charset: UTF-8;charset=UTF-8
css
fonts.googleapis.com/ 		10 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://fonts.googleapis.com/css?family=Roboto+Condensed%3A400italic%2C700italic%2C400%2C700&subset=latin%2Ccyrillic-ext%2Cgreek-ext%2Cgreek%2Ccyrillic%2Clatin-ext%2Cvietnamese&ver=dc488b3cf402a36ed8529f3196db2a8a
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
216.58.206.10 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s20-in-f10.1e100.net
Software
ESF /
Resource Hash
cab944a462b37f84a06e26dc28c9d68818410763a2cd2d606d66c1d7eae7a906
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:12 GMT
Content-Encoding
gzip
Last-Modified
Tue, 20 Mar 2018 15:39:12 GMT
Server
ESF
X-Frame-Options
SAMEORIGIN
Content-Type
text/css; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
private, max-age=86400, stale-while-revalidate=604800
Transfer-Encoding
chunked
Timing-Allow-Origin
*
Link
<http://fonts.gstatic.com>; rel=preconnect; crossorigin
X-XSS-Protection
1; mode=block
Expires
Tue, 20 Mar 2018 15:39:12 GMT
css
fonts.googleapis.com/ 		3 KB
1019 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://fonts.googleapis.com/css?family=Lato%3A400%2C700%2C400italic%2C700italic&ver=dc488b3cf402a36ed8529f3196db2a8a
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
216.58.206.10 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s20-in-f10.1e100.net
Software
ESF /
Resource Hash
02e9b97056be5d76b813d92b67aac7d714f69536fe8af92a94d1dcbda8d0ad29
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:12 GMT
Content-Encoding
gzip
Last-Modified
Tue, 20 Mar 2018 15:39:12 GMT
Server
ESF
X-Frame-Options
SAMEORIGIN
Content-Type
text/css; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
private, max-age=86400, stale-while-revalidate=604800
Transfer-Encoding
chunked
Timing-Allow-Origin
*
Link
<http://fonts.gstatic.com>; rel=preconnect; crossorigin
X-XSS-Protection
1; mode=block
Expires
Tue, 20 Mar 2018 15:39:12 GMT
css
fonts.googleapis.com/ 		5 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://fonts.googleapis.com/css?family=Playfair+Display%3A400%2C700%2C400italic&subset=latin%2Ccyrillic-ext%2Cgreek-ext%2Ccyrillic&ver=dc488b3cf402a36ed8529f3196db2a8a
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
216.58.206.10 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s20-in-f10.1e100.net
Software
ESF /
Resource Hash
66752d0563d35538a04b5ab58b05cebb936b9335470b6a211c2718234cae77c2
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:12 GMT
Content-Encoding
gzip
Last-Modified
Tue, 20 Mar 2018 15:39:12 GMT
Server
ESF
X-Frame-Options
SAMEORIGIN
Content-Type
text/css; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
private, max-age=86400, stale-while-revalidate=604800
Transfer-Encoding
chunked
Timing-Allow-Origin
*
Link
<http://fonts.gstatic.com>; rel=preconnect; crossorigin
X-XSS-Protection
1; mode=block
Expires
Tue, 20 Mar 2018 15:39:12 GMT
css
fonts.googleapis.com/ 		3 KB
1021 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://fonts.googleapis.com/css?family=Oswald%3A400%2C700%2C400italic&subset=latin%2Ccyrillic-ext%2Cgreek-ext%2Ccyrillic&ver=dc488b3cf402a36ed8529f3196db2a8a
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
216.58.206.10 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s20-in-f10.1e100.net
Software
ESF /
Resource Hash
9253b2bc7ff479992bd37d1d951c8ce67695c6031345fe7fb21d9866bb7f93ae
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:12 GMT
Content-Encoding
gzip
Last-Modified
Tue, 20 Mar 2018 15:39:12 GMT
Server
ESF
X-Frame-Options
SAMEORIGIN
Content-Type
text/css; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
private, max-age=86400, stale-while-revalidate=604800
Transfer-Encoding
chunked
Timing-Allow-Origin
*
Link
<http://fonts.gstatic.com>; rel=preconnect; crossorigin
X-XSS-Protection
1; mode=block
Expires
Tue, 20 Mar 2018 15:39:12 GMT
grid.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/ 		49 KB
50 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/grid.css?ver=dc488b3cf402a36ed8529f3196db2a8a
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
217.160.0.146 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
217-160-0-146.elastic-ssl.ui-r.com
Software
Apache /
Resource Hash
00d534b6d1d7adf2faa7861ce9557403c3c08304e2791fd4301029b0e142c286

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
securityaffairs.co
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Cookie
wfvt_2796755358=5ab12b1f25a70
Connection
keep-alive
Cache-Control
no-cache
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:12 GMT
Last-Modified
Wed, 16 Dec 2015 06:58:03 GMT
Server
Apache
ETag
"c5f2-526fe6d6d94c0"
Content-Type
text/css
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=15
Content-Length
50674
form-basic.css
securityaffairs.co/wordpress/wp-content/plugins/mailchimp-for-wp/assets/css/ 		3 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://securityaffairs.co/wordpress/wp-content/plugins/mailchimp-for-wp/assets/css/form-basic.css?ver=4.2
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
217.160.0.146 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
217-160-0-146.elastic-ssl.ui-r.com
Software
Apache /
Resource Hash
e533fb7de77474066905d811094257f4e166b6849e7ae584c2ef44ced9c80433

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
securityaffairs.co
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Cookie
wfvt_2796755358=5ab12b1f25a70
Connection
keep-alive
Cache-Control
no-cache
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:12 GMT
Last-Modified
Mon, 05 Mar 2018 23:58:19 GMT
Server
Apache
ETag
"d42-566b319aaee8c"
Content-Type
text/css
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=15
Content-Length
3394
jquery.js
securityaffairs.co/wordpress/wp-includes/js/jquery/ 		95 KB
95 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery.js?ver=1.12.4
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
217.160.0.146 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
217-160-0-146.elastic-ssl.ui-r.com
Software
Apache /
Resource Hash
fc48d1d80ece71a79a7b39877f4104d49d3da6c3665cf6dc203000fb7df4447e

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
securityaffairs.co
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
*/*
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Cookie
wfvt_2796755358=5ab12b1f25a70
Connection
keep-alive
Cache-Control
no-cache
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:12 GMT
Last-Modified
Tue, 21 Jun 2016 17:49:20 GMT
Server
Apache
ETag
"17ba0-535cd70c3c800"
Content-Type
application/javascript
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=15
Content-Length
97184
jquery-migrate.js
securityaffairs.co/wordpress/wp-includes/js/jquery/ 		23 KB
23 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
217.160.0.146 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
217-160-0-146.elastic-ssl.ui-r.com
Software
Apache /
Resource Hash
c68a880944aa03082e88bbe6c7df7747ee45f506fa777e76fb41709a0ba5a935

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
securityaffairs.co
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
*/*
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Cookie
wfvt_2796755358=5ab12b1f25a70
Connection
keep-alive
Cache-Control
no-cache
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:13 GMT
Last-Modified
Tue, 21 Jun 2016 17:49:20 GMT
Server
Apache
ETag
"5bc9-535cd70c3c800"
Content-Type
application/javascript
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=15
Content-Length
23497
cookielawinfo.js
securityaffairs.co/wordpress/wp-content/plugins/cookie-law-info/js/ 		6 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://securityaffairs.co/wordpress/wp-content/plugins/cookie-law-info/js/cookielawinfo.js?ver=1.5.3
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
217.160.0.146 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
217-160-0-146.elastic-ssl.ui-r.com
Software
Apache /
Resource Hash
1b516cb95ddf27703d0b1cfddab9c97fa9b2696644718dd1b4376c39dca93767

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
securityaffairs.co
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
*/*
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Cookie
wfvt_2796755358=5ab12b1f25a70
Connection
keep-alive
Cache-Control
no-cache
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:13 GMT
Last-Modified
Wed, 16 Dec 2015 06:30:09 GMT
Server
Apache
ETag
"16ae-526fe09a65e40"
Content-Type
application/javascript
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=15
Content-Length
5806
script.js
securityaffairs.co/wordpress/wp-content/plugins/facebook-button-plugin/js/ 		462 B
736 B 		Script
General
Check archive.org
Download Go to
Full URL
http://securityaffairs.co/wordpress/wp-content/plugins/facebook-button-plugin/js/script.js?ver=dc488b3cf402a36ed8529f3196db2a8a
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
217.160.0.146 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
217-160-0-146.elastic-ssl.ui-r.com
Software
Apache /
Resource Hash
a8f961f7ae2f3245e8383f659d264eb56983adb23a399b23a62fa951734d0768

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
securityaffairs.co
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
*/*
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Cookie
wfvt_2796755358=5ab12b1f25a70
Connection
keep-alive
Cache-Control
no-cache
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:13 GMT
Last-Modified
Tue, 13 Mar 2018 06:43:04 GMT
Server
Apache
ETag
"1ce-56745920b46ca"
Content-Type
application/javascript
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=15
Content-Length
462
st_insights.js
w.sharethis.com/button/ 		21 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://w.sharethis.com/button/st_insights.js?publisher=4d48b7c5-0ae3-43d4-bfbe-3ff8c17a8ae6&product=simpleshare
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
2.16.186.27 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-186-27.deploy.akamaitechnologies.com
Software
nginx/1.12.2 /
Resource Hash
9756bb2e61f42b57e4409a60a2b376ad5eea5f0276c6159ba957973f9210d2f1

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:12 GMT
Content-Encoding
gzip
Server
nginx/1.12.2
ETag
W/"5aaad08e-53d5"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=259200
Connection
keep-alive
Content-Length
6053
Expires
Fri, 23 Mar 2018 15:36:35 GMT
sharethis.js
platform-api.sharethis.com/js/ 		150 KB
53 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://platform-api.sharethis.com/js/sharethis.js
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
23.67.137.77 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-67-137-77.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
6ce3e202dbc8399999cf2d612b00fe92933870d7372174b9043db85d63afe70b

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:12 GMT
Content-Encoding
gzip
ETag
W/"25653-K+gnfOi5aF+TH/+07emEQg"
Vary
Accept-Encoding
Access-Control-Allow-Methods
DELETE, GET, HEAD, OPTIONS, POST, PUT
Content-Type
text/javascript; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=3600
Connection
keep-alive
Access-Control-Allow-Headers
Origin, X-Requested-With, Content-Type, Accept
Content-Length
53445
logo_SecurityAffairs.png
securityaffairs.co/wordpress/wp-content/uploads/2015/12/ 		44 KB
44 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://securityaffairs.co/wordpress/wp-content/uploads/2015/12/logo_SecurityAffairs.png
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
217.160.0.146 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
217-160-0-146.elastic-ssl.ui-r.com
Software
Apache /
Resource Hash
00f28fdb987ce0f9edc935ffe381123a2e1f79fcc0f55759a7bb4a83b4a88584

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
securityaffairs.co
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Cookie
wfvt_2796755358=5ab12b1f25a70; __unam=6f69f6a-16244107bc9-3f35429d-1
Connection
keep-alive
Cache-Control
no-cache
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:13 GMT
Last-Modified
Wed, 16 Dec 2015 17:30:42 GMT
Server
Apache
ETag
"b0e9-5270743f5f480"
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=15
Content-Length
45289
standard-facebook-ico.png
i2.wp.com/securityaffairs.co/wordpress/wp-content/plugins/facebook-button-plugin/images/ 		768 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i2.wp.com/securityaffairs.co/wordpress/wp-content/plugins/facebook-button-plugin/images/standard-facebook-ico.png
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
SPDY
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i0.wp.com
Software
nginx /
Resource Hash
372b3aaa8c5955cd5361423f1893f65961c33ec2c87370643438169f0196c06f
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

x-nc
HIT fra 17
date
Tue, 20 Mar 2018 15:39:13 GMT
x-content-type-options
nosniff
x-bytes-saved
12
last-modified
Fri, 23 Feb 2018 13:33:51 GMT
server
nginx
etag
"4d879b1e82413644"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<http://securityaffairs.co/wordpress/wp-content/plugins/facebook-button-plugin/images/standard-facebook-ico.png>; rel="canonical"
content-length
768
expires
Mon, 24 Feb 2020 01:33:51 GMT
RottenSys-chart.png
i2.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2018/03/ 		12 KB
13 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i2.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2018/03/RottenSys-chart.png?w=747
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
SPDY
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i0.wp.com
Software
nginx /
Resource Hash
c59b9753598e273fd99fcc3a1e4b56a9537b629d0c714f3d4f347cfa1214804d
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

x-nc
HIT fra 17
date
Tue, 20 Mar 2018 15:39:13 GMT
x-content-type-options
nosniff
last-modified
Thu, 15 Mar 2018 14:03:01 GMT
server
nginx
etag
"ebda416c0f65cc9f"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<http://securityaffairs.co/wordpress/wp-content/uploads/2018/03/RottenSys-chart.png>; rel="canonical"
content-length
12728
expires
Sun, 15 Mar 2020 02:03:01 GMT
RottenSys-chart-2.png
i1.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2018/03/ 		11 KB
11 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i1.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2018/03/RottenSys-chart-2.png?w=543
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
SPDY
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i0.wp.com
Software
nginx /
Resource Hash
018cfd18a78eaf5ecdc40d0c3fa3380db81f38d118ecd0432b6803bef23f65bc
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

x-nc
HIT fra 17
date
Tue, 20 Mar 2018 15:39:13 GMT
x-content-type-options
nosniff
last-modified
Thu, 15 Mar 2018 14:03:01 GMT
server
nginx
etag
"657b8751123fad2e"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<http://securityaffairs.co/wordpress/wp-content/uploads/2018/03/RottenSys-chart-2.png>; rel="canonical"
content-length
11112
expires
Sun, 15 Mar 2020 02:03:01 GMT
nmedianet.js
contextual.media.net/ 		109 KB
38 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://contextual.media.net/nmedianet.js?cid=8CU5BD6EW
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
104.90.192.189 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-90-192-189.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
9814def2079b6eb77cf4d12001d7fd7e48032d8e1add430ac20033bba091c08e

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Mar 2018 15:39:13 GMT
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
X-MNET-H
E
Content-Type
text/javascript; charset=utf-8
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
38538
Expires
Tue, 20 Mar 2018 15:39:13 GMT
twitter.png
i2.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i2.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/twitter.png
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
SPDY
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i0.wp.com
Software
nginx /
Resource Hash
b980a05e2b73c6bbf5536e4281a084f6718548214c496f599f7ef427a49cc327
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

x-nc
HIT fra 21
date
Tue, 20 Mar 2018 15:39:13 GMT
x-content-type-options
nosniff
last-modified
Thu, 22 Jun 2017 02:20:33 GMT
server
nginx
etag
"688ea5f9b2572e18"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<http://securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/twitter.png>; rel="canonical"
content-length
1420
expires
Sat, 22 Jun 2019 14:20:33 GMT
google.png
i0.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i0.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/google.png
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
SPDY
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i0.wp.com
Software
nginx /
Resource Hash
ab313de30e88839debcbd24c24054cf91123244d263a16a9aa3864a50befaf92
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

x-nc
HIT fra 20
date
Tue, 20 Mar 2018 15:39:13 GMT
x-content-type-options
nosniff
last-modified
Thu, 22 Jun 2017 02:20:28 GMT
server
nginx
etag
"6c9fb433d80d4dee"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<http://securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/google.png>; rel="canonical"
content-length
1596
expires
Sat, 22 Jun 2019 14:20:28 GMT
facebook.png
i1.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i1.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/facebook.png
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
SPDY
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i0.wp.com
Software
nginx /
Resource Hash
7fceadfed55064d3f3d49652e0817c49b2c78de5b6d9280b0477b5b653858bca
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

x-nc
HIT fra 16
date
Tue, 20 Mar 2018 15:39:13 GMT
x-content-type-options
nosniff
last-modified
Thu, 22 Jun 2017 02:20:28 GMT
server
nginx
etag
"7d761bcfe7276283"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<http://securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/facebook.png>; rel="canonical"
content-length
1110
expires
Sat, 22 Jun 2019 14:20:28 GMT
linkedin.png
i2.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i2.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/linkedin.png
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
SPDY
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i0.wp.com
Software
nginx /
Resource Hash
0bffe6a234d4da5672bb56597c0c60df3bfb0fb0899bde4be2241c1a27ed005e
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

x-nc
HIT fra 21
date
Tue, 20 Mar 2018 15:39:13 GMT
x-content-type-options
nosniff
last-modified
Thu, 22 Jun 2017 02:20:33 GMT
server
nginx
etag
"d216aca9c063f83b"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<http://securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/linkedin.png>; rel="canonical"
content-length
1432
expires
Sat, 22 Jun 2019 14:20:33 GMT
pinterest.png
i0.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i0.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/pinterest.png
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
SPDY
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i0.wp.com
Software
nginx /
Resource Hash
639b4509780048ed50d9f5cd861010522112bcf8c9c2d26f5ddec78c7e739a5b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

x-nc
HIT fra 20
date
Tue, 20 Mar 2018 15:39:13 GMT
x-content-type-options
nosniff
last-modified
Thu, 22 Jun 2017 02:20:29 GMT
server
nginx
etag
"a92e879388897fbc"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<http://securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/pinterest.png>; rel="canonical"
content-length
1750
expires
Sat, 22 Jun 2019 14:20:29 GMT
reddit.png
i1.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i1.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/reddit.png
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
SPDY
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i0.wp.com
Software
nginx /
Resource Hash
d8c69f17ea9a0ab3fd3c929d5582527da38ac63d5b64fd8e9d4e63832b3a0cce
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

x-nc
HIT fra 16
date
Tue, 20 Mar 2018 15:39:13 GMT
x-content-type-options
nosniff
last-modified
Sat, 10 Jun 2017 08:59:05 GMT
server
nginx
etag
"6b11edb7413f4c41"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<http://securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/reddit.png>; rel="canonical"
content-length
1828
expires
Mon, 10 Jun 2019 20:59:05 GMT
email.png
i1.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i1.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/email.png
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
SPDY
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i0.wp.com
Software
nginx /
Resource Hash
4359fc4ebbddf4ab9e93191dedb6c19e6aa2d1531157cc3016796781f39615dc
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

x-nc
HIT fra 16
date
Tue, 20 Mar 2018 15:39:13 GMT
x-content-type-options
nosniff
last-modified
Mon, 12 Jun 2017 20:00:45 GMT
server
nginx
etag
"79668cf7f067af23"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<http://securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/email.png>; rel="canonical"
content-length
1272
expires
Thu, 13 Jun 2019 08:00:45 GMT
stumbleupon.png
i2.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i2.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/stumbleupon.png
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
SPDY
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i0.wp.com
Software
nginx /
Resource Hash
c66614f9b335585b0cb4cc77e3a0ba22a358e6d0e234ec4d9f9f89fa3848fdc5
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

x-nc
HIT fra 20
date
Tue, 20 Mar 2018 15:39:13 GMT
x-content-type-options
nosniff
last-modified
Thu, 22 Jun 2017 02:20:33 GMT
server
nginx
etag
"c58ef8a2420b9457"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<http://securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/stumbleupon.png>; rel="canonical"
content-length
1520
expires
Sat, 22 Jun 2019 14:20:33 GMT
f00db26378ef7df7c440a8ee60ead62b
0.gravatar.com/avatar/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://0.gravatar.com/avatar/f00db26378ef7df7c440a8ee60ead62b?s=60&d=mm&r=g
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
192.0.73.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
643a860832456b5a74825b79d625434b5c4c2a344b8f9bef3614b327bea52646

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

X-nc
HIT fra 3
Date
Tue, 20 Mar 2018 15:39:13 GMT
Last-Modified
Wed, 11 Jan 1984 08:00:00 GMT
Server
nginx
Source-Age
164994
Content-Type
image/jpeg
Access-Control-Allow-Origin
*
Cache-Control
max-age=300
Content-Disposition
inline; filename="f00db26378ef7df7c440a8ee60ead62b.png"
Connection
keep-alive
Accept-Ranges
bytes
Link
<https://www.gravatar.com/avatar/f00db26378ef7df7c440a8ee60ead62b?s=60&d=mm&r=g>; rel="canonical"
Content-Length
1186
Expires
Tue, 20 Mar 2018 15:44:13 GMT
telegram.jpg
securityaffairs.co/wordpress/wp-content/uploads/2016/08/ 		25 KB
25 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://securityaffairs.co/wordpress/wp-content/uploads/2016/08/telegram.jpg
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
217.160.0.146 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
217-160-0-146.elastic-ssl.ui-r.com
Software
Apache /
Resource Hash
abae7907ec871ff169333a353a830e2834440b42645b84a4c1ab228223cc6131

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
securityaffairs.co
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Cookie
wfvt_2796755358=5ab12b1f25a70; __unam=6f69f6a-16244107bc9-3f35429d-1
Connection
keep-alive
Cache-Control
no-cache
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:13 GMT
Last-Modified
Wed, 03 Aug 2016 21:40:53 GMT
Server
Apache
ETag
"6462-53931b0074340"
Content-Type
image/jpeg
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=15
Content-Length
25698
Uber-Self-Driving-Car-accident-2.jpg
securityaffairs.co/wordpress/wp-content/uploads/2018/03/ 		33 KB
33 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://securityaffairs.co/wordpress/wp-content/uploads/2018/03/Uber-Self-Driving-Car-accident-2.jpg
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
217.160.0.146 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
217-160-0-146.elastic-ssl.ui-r.com
Software
Apache /
Resource Hash
1fd97d1ad27c851bf7515fa9c9e0770d7035a310a3f5bbdbddc5c76a85090a59

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
securityaffairs.co
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Cookie
wfvt_2796755358=5ab12b1f25a70; __unam=6f69f6a-16244107bc9-3f35429d-1
Connection
keep-alive
Cache-Control
no-cache
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:14 GMT
Last-Modified
Tue, 20 Mar 2018 11:43:45 GMT
Server
Apache
ETag
"83ee-567d69646e33f"
Content-Type
image/jpeg
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=15
Content-Length
33774
sdk.js
connect.facebook.net/en_US/
Redirect Chain
  • http://connect.facebook.net/en_US/sdk.js
  • https://connect.facebook.net/en_US/sdk.js
213 KB
66 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/sdk.js
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
SPDY
Server
185.60.216.19 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
7ff1ab2a9fbac7e387401473e291672fed8e4462c74b3bfd369ab34a47fed202
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
content-md5
9wgvjVxy/H+AtDNTZhjfxg==
status
200
content-length
67223
x-xss-protection
0
x-fb-debug
5HXW8YDab8IdY6lIds+n/Pw73gT7h7Dp+mmzLU2NCueBepXNsJ0Kc22Rjy03ptyPANmOPE47W067+LOSGBd/GA==
x-fb-content-md5
b275f53406592d3462eb2ab34f3dd6bc
x-frame-options
DENY
date
Tue, 20 Mar 2018 15:39:14 GMT
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
access-control-expose-headers
X-FB-Content-MD5
cache-control
public,max-age=1200,stale-while-revalidate=3600
etag
"f3f11d345689c29fa03ce25450ea134b"
timing-allow-origin
*
expires
Tue, 20 Mar 2018 15:50:22 GMT

Redirect headers

Location
https://connect.facebook.net/en_US/sdk.js#xfbml=1&version=v2.6
Non-Authoritative-Reason
HSTS
twemoji.js
securityaffairs.co/wordpress/wp-includes/js/ 		25 KB
25 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://securityaffairs.co/wordpress/wp-includes/js/twemoji.js?ver=dc488b3cf402a36ed8529f3196db2a8a
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
217.160.0.146 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
217-160-0-146.elastic-ssl.ui-r.com
Software
Apache /
Resource Hash
464db2eecec0133fa595131850ae7478d8bc7359a5299a59985f1a42e389f187

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
securityaffairs.co
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
*/*
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Cookie
wfvt_2796755358=5ab12b1f25a70; __unam=6f69f6a-16244107bc9-3f35429d-1
Connection
keep-alive
Cache-Control
no-cache
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:14 GMT
Last-Modified
Mon, 05 Feb 2018 20:49:27 GMT
Server
Apache
ETag
"6394-5647d32ab4432"
Content-Type
application/javascript
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=15
Content-Length
25492
wp-emoji.js
securityaffairs.co/wordpress/wp-includes/js/ 		7 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://securityaffairs.co/wordpress/wp-includes/js/wp-emoji.js?ver=dc488b3cf402a36ed8529f3196db2a8a
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
217.160.0.146 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
217-160-0-146.elastic-ssl.ui-r.com
Software
Apache /
Resource Hash
d80a9fbd9c4a76d5d7c6b14e635088b322863f7a78f61508df1e77342669e0ec

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
securityaffairs.co
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
*/*
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Cookie
wfvt_2796755358=5ab12b1f25a70; __unam=6f69f6a-16244107bc9-3f35429d-1
Connection
keep-alive
Cache-Control
no-cache
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:13 GMT
Last-Modified
Wed, 17 Aug 2016 14:03:19 GMT
Server
Apache
ETag
"1a68-53a44ed6bb7c0"
Content-Type
application/javascript
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=15
Content-Length
6760
Digging-The-Deep-Web.png
i2.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2018/03/ 		6 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i2.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2018/03/Digging-The-Deep-Web.png?resize=236%2C300
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
SPDY
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i0.wp.com
Software
nginx /
Resource Hash
69e652101a2c4d8040d6f6082b20b858fc8b7840339ca067d64499f2e9b22a9b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

x-nc
HIT fra 20
date
Tue, 20 Mar 2018 15:39:13 GMT
x-content-type-options
nosniff
x-bytes-saved
49467
last-modified
Sun, 18 Mar 2018 21:02:15 GMT
server
nginx
etag
"64b96d212b84fe07"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<http://securityaffairs.co/wordpress/wp-content/uploads/2018/03/Digging-The-Deep-Web.png>; rel="canonical"
content-length
6390
expires
Wed, 18 Mar 2020 09:02:15 GMT
infosec16.png
securityaffairs.co/images/ 		55 KB
55 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://securityaffairs.co/images/infosec16.png
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
217.160.0.146 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
217-160-0-146.elastic-ssl.ui-r.com
Software
Apache /
Resource Hash
d242e05b27b8d6ace3bfc206e9ab79ee073cd07647ffeb3c257b8abb61ae9cb4

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
securityaffairs.co
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Cookie
wfvt_2796755358=5ab12b1f25a70; __unam=6f69f6a-16244107bc9-3f35429d-1
Connection
keep-alive
Cache-Control
no-cache
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:13 GMT
Last-Modified
Sat, 11 Jun 2016 08:36:11 GMT
Server
Apache
ETag
"dc63-534fc8c2214c0"
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=15
Content-Length
56419
paganini.jpg
securityaffairs.co/images/ 		64 KB
65 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://securityaffairs.co/images/paganini.jpg
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
217.160.0.146 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
217-160-0-146.elastic-ssl.ui-r.com
Software
Apache /
Resource Hash
abf0a396ecd082fb921175db8d4bc820ac383082eb4f8a566f4cee5aaa786808

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
securityaffairs.co
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Cookie
wfvt_2796755358=5ab12b1f25a70; __unam=6f69f6a-16244107bc9-3f35429d-1
Connection
keep-alive
Cache-Control
no-cache
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:13 GMT
Last-Modified
Wed, 16 Dec 2015 01:06:12 GMT
Server
Apache
ETag
"10128-526f9831d4900"
Content-Type
image/jpeg
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=15
Content-Length
65832
02_red.png
securityaffairs.co/images/ 		84 KB
84 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://securityaffairs.co/images/02_red.png
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
217.160.0.146 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
217-160-0-146.elastic-ssl.ui-r.com
Software
Apache /
Resource Hash
8b63cfc4750823ed439e52bb326ff1e25a0ab07846da5c1b956c82ddb9474a1f

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
securityaffairs.co
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Cookie
wfvt_2796755358=5ab12b1f25a70; __unam=6f69f6a-16244107bc9-3f35429d-1
Connection
keep-alive
Cache-Control
no-cache
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:14 GMT
Last-Modified
Wed, 16 Dec 2015 01:06:11 GMT
Server
Apache
ETag
"14ebf-526f9830e06c0"
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=15
Content-Length
85695
VPN-hotspot-shield-ip_leak.png
i0.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2018/03/ 		6 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i0.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2018/03/VPN-hotspot-shield-ip_leak.png?resize=300%2C300
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
SPDY
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i0.wp.com
Software
nginx /
Resource Hash
ff51d0f7e159b0235a222f81ca24f2082c8ea226995de3b8f01fe7bfc2bf2ea2
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

x-nc
HIT fra 17
date
Tue, 20 Mar 2018 15:39:13 GMT
x-content-type-options
nosniff
x-bytes-saved
11104
last-modified
Thu, 15 Mar 2018 12:41:39 GMT
server
nginx
etag
"801d2a2aa7881e5e"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<http://securityaffairs.co/wordpress/wp-content/uploads/2018/03/VPN-hotspot-shield-ip_leak.png>; rel="canonical"
content-length
6022
expires
Sun, 15 Mar 2020 00:41:39 GMT
ssba.css
securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/css/ 		105 KB
105 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/css/ssba.css?ver=dc488b3cf402a36ed8529f3196db2a8a
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
217.160.0.146 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
217-160-0-146.elastic-ssl.ui-r.com
Software
Apache /
Resource Hash
606438e847fe03016f9b522edc743ae201910c9583ad332d94ae4e3504ceb27e

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
securityaffairs.co
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Cookie
wfvt_2796755358=5ab12b1f25a70
Connection
keep-alive
Cache-Control
no-cache
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:12 GMT
Last-Modified
Mon, 19 Mar 2018 22:51:23 GMT
Server
Apache
ETag
"1a468-567cbcc1b300e"
Content-Type
text/css
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=15
Content-Length
107624
photon.js
securityaffairs.co/wordpress/wp-content/plugins/jetpack/modules/photon/ 		1 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://securityaffairs.co/wordpress/wp-content/plugins/jetpack/modules/photon/photon.js?ver=20130122
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
217.160.0.146 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
217-160-0-146.elastic-ssl.ui-r.com
Software
Apache /
Resource Hash
87879846a54fe4a250a2a9808103f1ed6943af45e4cbb7f067c44da57c61b3d4

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
securityaffairs.co
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
*/*
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Cookie
wfvt_2796755358=5ab12b1f25a70
Connection
keep-alive
Cache-Control
no-cache
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:13 GMT
Last-Modified
Tue, 06 Mar 2018 22:52:41 GMT
Server
Apache
ETag
"562-566c64ccc30e5"
Content-Type
application/javascript
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=15
Content-Length
1378
jquery.adrotate.clicktracker.js
securityaffairs.co/wordpress/wp-content/plugins/adrotate/library/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://securityaffairs.co/wordpress/wp-content/plugins/adrotate/library/jquery.adrotate.clicktracker.js
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
217.160.0.146 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
217-160-0-146.elastic-ssl.ui-r.com
Software
Apache /
Resource Hash
2f64b025cec8c93dcb01fe88f0e79c134bc0a6c751787360153865dfa9f3a962

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
securityaffairs.co
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
*/*
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Cookie
wfvt_2796755358=5ab12b1f25a70
Connection
keep-alive
Cache-Control
no-cache
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:13 GMT
Last-Modified
Tue, 13 Mar 2018 06:43:02 GMT
Server
Apache
ETag
"40b-5674591f1f261"
Content-Type
application/javascript
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=15
Content-Length
1035
devicepx-jetpack.js
s0.wp.com/wp-content/js/ 		10 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/wp-content/js/devicepx-jetpack.js?ver=201812
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
SPDY
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
f32d41f2099a0be20e6b57c5e0d1b71c079d3e1345827b0f5c5b97c6e5e3f78d

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

x-nc
HIT fra 32
date
Tue, 20 Mar 2018 15:39:13 GMT
content-encoding
gzip
server
nginx
etag
W/"5867460b-52b6"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=31536000
x-ac
4.fra _dfw
expires
Sun, 17 Mar 2019 16:50:07 GMT
ssba.js
securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/js/ 		2 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/js/ssba.js?ver=dc488b3cf402a36ed8529f3196db2a8a
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
217.160.0.146 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
217-160-0-146.elastic-ssl.ui-r.com
Software
Apache /
Resource Hash
76a18f5f0637e0d73ce1afece898ce8b0fa75bb6b1c1990ae4a7ac6b083045ce

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
securityaffairs.co
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
*/*
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Cookie
wfvt_2796755358=5ab12b1f25a70
Connection
keep-alive
Cache-Control
no-cache
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:13 GMT
Last-Modified
Mon, 19 Mar 2018 22:51:23 GMT
Server
Apache
ETag
"792-567cbcc1b8dce"
Content-Type
application/javascript
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=15
Content-Length
1938
hint.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/ 		987 B
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/hint.js?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
217.160.0.146 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
217-160-0-146.elastic-ssl.ui-r.com
Software
Apache /
Resource Hash
d99ea9db1da8549489666d36c9e3fb717842550eed1554e96860af8d30c3b008

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
securityaffairs.co
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
*/*
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Cookie
wfvt_2796755358=5ab12b1f25a70
Connection
keep-alive
Cache-Control
no-cache
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:13 GMT
Last-Modified
Wed, 16 Dec 2015 06:58:17 GMT
Server
Apache
ETag
"3db-526fe6e433440"
Content-Type
application/javascript
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=15
Content-Length
987
jquery.tipsy.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/ 		4 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/jquery.tipsy.js?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
217.160.0.146 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
217-160-0-146.elastic-ssl.ui-r.com
Software
Apache /
Resource Hash
0e53466218d7ff174e0a083ecce89b1c090c67ccbe55775eddca03e930ff9e35

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
securityaffairs.co
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
*/*
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Cookie
wfvt_2796755358=5ab12b1f25a70
Connection
keep-alive
Cache-Control
no-cache
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:13 GMT
Last-Modified
Wed, 16 Dec 2015 06:58:17 GMT
Server
Apache
ETag
"1113-526fe6e433440"
Content-Type
application/javascript
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=15
Content-Length
4371
jquery.easing.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/ 		8 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/jquery.easing.js?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
217.160.0.146 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
217-160-0-146.elastic-ssl.ui-r.com
Software
Apache /
Resource Hash
0757f7ff6e5f6a581922a5e2d42c5e0cf7475d880885a9802e8bdd5e4188dd34

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
securityaffairs.co
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
*/*
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Cookie
wfvt_2796755358=5ab12b1f25a70
Connection
keep-alive
Cache-Control
no-cache
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:13 GMT
Last-Modified
Wed, 16 Dec 2015 06:58:17 GMT
Server
Apache
ETag
"1fa1-526fe6e433440"
Content-Type
application/javascript
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=15
Content-Length
8097
browser.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/ 		3 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/browser.js?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
217.160.0.146 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
217-160-0-146.elastic-ssl.ui-r.com
Software
Apache /
Resource Hash
1aaab3c3d6f974416ae34893cebe3a544aea17931439b2449ec392061d11ec82

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
securityaffairs.co
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
*/*
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Cookie
wfvt_2796755358=5ab12b1f25a70
Connection
keep-alive
Cache-Control
no-cache
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:13 GMT
Last-Modified
Wed, 16 Dec 2015 06:58:16 GMT
Server
Apache
ETag
"a36-526fe6e33f200"
Content-Type
application/javascript
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=15
Content-Length
2614
jquery.flexslider-min.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/flexslider/ 		21 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/flexslider/jquery.flexslider-min.js?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
217.160.0.146 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
217-160-0-146.elastic-ssl.ui-r.com
Software
Apache /
Resource Hash
45185c8f6cd2f9b42e3a02b78af40edc7d61328fac3167a0490c9c69bbecaaa6

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
securityaffairs.co
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
*/*
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Cookie
wfvt_2796755358=5ab12b1f25a70
Connection
keep-alive
Cache-Control
no-cache
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:13 GMT
Last-Modified
Wed, 16 Dec 2015 13:55:10 GMT
Server
Apache
ETag
"53ae-5270441274b80"
Content-Type
application/javascript
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=15
Content-Length
21422
waypoints.min.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/ 		8 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/waypoints.min.js?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
217.160.0.146 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
217-160-0-146.elastic-ssl.ui-r.com
Software
Apache /
Resource Hash
a0fded691aed767f851011cd3185b928619298a21a0fbdad4808a9e88b490833

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
securityaffairs.co
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
*/*
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Cookie
wfvt_2796755358=5ab12b1f25a70
Connection
keep-alive
Cache-Control
no-cache
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:13 GMT
Last-Modified
Wed, 16 Dec 2015 06:58:18 GMT
Server
Apache
ETag
"1f6c-526fe6e527680"
Content-Type
application/javascript
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=15
Content-Length
8044
mediaelement-and-player.min.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/mediaelement/ 		69 KB
70 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/mediaelement/mediaelement-and-player.min.js?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
217.160.0.146 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
217-160-0-146.elastic-ssl.ui-r.com
Software
Apache /
Resource Hash
f0c6d2d27de284102b03e30cd74be808801ec53ca49f30b4d15620ee84ea39f5

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
securityaffairs.co
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
*/*
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Cookie
wfvt_2796755358=5ab12b1f25a70
Connection
keep-alive
Cache-Control
no-cache
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:13 GMT
Last-Modified
Wed, 16 Dec 2015 13:55:14 GMT
Server
Apache
ETag
"11571-5270441645480"
Content-Type
application/javascript
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=15
Content-Length
71025
jquery.swipebox.min.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/ 		11 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/jquery.swipebox.min.js?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
217.160.0.146 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
217-160-0-146.elastic-ssl.ui-r.com
Software
Apache /
Resource Hash
2199990352edbb7ec586e01d26e2f6a7010a2fce1517711019b614dcec353ba3

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
securityaffairs.co
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
*/*
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Cookie
wfvt_2796755358=5ab12b1f25a70
Connection
keep-alive
Cache-Control
no-cache
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:13 GMT
Last-Modified
Wed, 16 Dec 2015 06:58:17 GMT
Server
Apache
ETag
"2a67-526fe6e433440"
Content-Type
application/javascript
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=15
Content-Length
10855
jquery.circliful.min.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/ 		3 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/jquery.circliful.min.js?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
217.160.0.146 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
217-160-0-146.elastic-ssl.ui-r.com
Software
Apache /
Resource Hash
1832a6ee34745b08b1fcae42c24468086358b43071d7679a738951aa7dc243ea

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
securityaffairs.co
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
*/*
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Cookie
wfvt_2796755358=5ab12b1f25a70
Connection
keep-alive
Cache-Control
no-cache
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:13 GMT
Last-Modified
Wed, 16 Dec 2015 06:58:17 GMT
Server
Apache
ETag
"c18-526fe6e433440"
Content-Type
application/javascript
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=15
Content-Length
3096
jquery.smarticker.min.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/ 		13 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/jquery.smarticker.min.js?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
217.160.0.146 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
217-160-0-146.elastic-ssl.ui-r.com
Software
Apache /
Resource Hash
5525d57ced576560de8777ea78e4bc0c9d55396c0b668a7563b354de9c165aee

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
securityaffairs.co
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
*/*
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Cookie
wfvt_2796755358=5ab12b1f25a70
Connection
keep-alive
Cache-Control
no-cache
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:13 GMT
Last-Modified
Wed, 16 Dec 2015 06:58:17 GMT
Server
Apache
ETag
"3225-526fe6e433440"
Content-Type
application/javascript
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=15
Content-Length
12837
custom.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/ 		12 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/custom.js?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
217.160.0.146 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
217-160-0-146.elastic-ssl.ui-r.com
Software
Apache /
Resource Hash
0c27a9c1aee9eacb73655f930a6bbf9ec721006695e5c38405296081cdbcb878

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
securityaffairs.co
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
*/*
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Cookie
wfvt_2796755358=5ab12b1f25a70
Connection
keep-alive
Cache-Control
no-cache
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:13 GMT
Last-Modified
Wed, 16 Dec 2015 06:58:16 GMT
Server
Apache
ETag
"31d4-526fe6e33f200"
Content-Type
application/javascript
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=15
Content-Length
12756
wp-embed.js
securityaffairs.co/wordpress/wp-includes/js/ 		3 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://securityaffairs.co/wordpress/wp-includes/js/wp-embed.js?ver=dc488b3cf402a36ed8529f3196db2a8a
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
217.160.0.146 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
217-160-0-146.elastic-ssl.ui-r.com
Software
Apache /
Resource Hash
336383f7ac92ebfd27fa47a1380a49a64b47d1b763f34909f464e826d738e10a

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
securityaffairs.co
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
*/*
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Cookie
wfvt_2796755358=5ab12b1f25a70
Connection
keep-alive
Cache-Control
no-cache
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:13 GMT
Last-Modified
Thu, 16 Nov 2017 13:57:00 GMT
Server
Apache
ETag
"c45-55e19fe79bc0f"
Content-Type
application/javascript
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=15
Content-Length
3141
plusone.js
apis.google.com/js/ 		43 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://apis.google.com/js/plusone.js
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
SPDY
Server
216.58.206.14 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s20-in-f14.1e100.net
Software
ESF /
Resource Hash
30ace6a9999ef90eaad3df0a3a23b2bb688ec0461865ea56f2d58a780c800daa
Security Headers
Name Value
Content-Security-Policy script-src 'unsafe-inline' 'unsafe-eval' 'self' https://*.gstatic.com https://www.google-analytics.com https://pagead2.googleadservices.com https://pagead2.googlesyndication.com https://tpc.googlesyndication.com https://s.ytimg.com https://www.youtube.com;report-uri /_/cspreport/es_oz_20180318.16_p0
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

content-security-policy
script-src 'unsafe-inline' 'unsafe-eval' 'self' https://*.gstatic.com https://www.google-analytics.com https://pagead2.googleadservices.com https://pagead2.googlesyndication.com https://tpc.googlesyndication.com https://s.ytimg.com https://www.youtube.com;report-uri /_/cspreport/es_oz_20180318.16_p0
content-encoding
gzip
x-content-type-options
nosniff
p3p
CP="This is not a P3P policy! See g.co/p3phelp for more info."
status
200
alt-svc
hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="41,39,35"
x-xss-protection
1; mode=block
x-ua-compatible
IE=edge, chrome=1
server
ESF
x-frame-options
SAMEORIGIN
date
Tue, 20 Mar 2018 15:39:13 GMT
strict-transport-security
max-age=31536000
content-type
application/javascript; charset=utf-8
cache-control
private, max-age=1800, stale-while-revalidate=1800
etag
"81b618add6ed8e90dd0b7fc32a9c094d"
timing-allow-origin
*
expires
Tue, 20 Mar 2018 15:39:13 GMT
e-201812.js
stats.wp.com/ 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://stats.wp.com/e-201812.js
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
SPDY
Server
192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
aea0c8ddd84132838fcee935f9d827ec5f7ba116e443b25db7a5bcc944cbe914

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date
Tue, 20 Mar 2018 15:39:13 GMT
content-encoding
gzip
server
nginx
etag
W/"5a0c8e17-3298"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=31536000
expires
Sun, 17 Mar 2019 09:56:06 GMT
sc
l.sharethis.com/
Redirect Chain
  • http://l.sharethis.com/pview?event=pview&version=st_insights.js&lang=en&fpc=6f69f6a-16244107bc9-3f35429d-1&sessionID=1521560353737.61219&hostname=securityaffairs.co&location=%2Fwordpress%2F70299%2F...
  • http://l.sharethis.com/sc?cm=CvQGBlqxKyEAAAARSLAHAw%3D%3D&uid=true&url=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F70299%2Fmalware%2Frottensys-botnet.html
0
-1 B 		XHR
General
Check archive.org
Download Go to
Full URL
http://l.sharethis.com/sc?cm=CvQGBlqxKyEAAAARSLAHAw%3D%3D&uid=true&url=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F70299%2Fmalware%2Frottensys-botnet.html
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
52.57.39.144 Frankfurt, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-57-39-144.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:13 GMT
Access-Control-Allow-Origin
http://securityaffairs.co
Access-Control-Max-Age
1728000
P3p
policyref="/w3c/p3p.xml", CP="ALL DSP COR CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM"
Location
/sc?cm=CvQGBlqxKyEAAAARSLAHAw%3D%3D&uid=true&url=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F70299%2Fmalware%2Frottensys-botnet.html
Access-Control-Expose-Headers
stid
Cache-Control
no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Access-Control-Allow-Headers
*
Content-Length
177
Stid
CvQGBlqxKyEAAAARSLAHAw==

Redirect headers

Date
Tue, 20 Mar 2018 15:39:13 GMT
Access-Control-Allow-Origin
http://securityaffairs.co
Access-Control-Max-Age
1728000
P3p
policyref="/w3c/p3p.xml", CP="ALL DSP COR CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM"
Location
/sc?cm=CvQGBlqxKyEAAAARSLAHAw%3D%3D&uid=true&url=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F70299%2Fmalware%2Frottensys-botnet.html
Access-Control-Expose-Headers
stid
Cache-Control
no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Access-Control-Allow-Headers
*
Content-Length
177
Stid
CvQGBlqxKyEAAAARSLAHAw==
analytics.js
www.google-analytics.com/ 		35 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
SPDY
Server
172.217.16.174 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f174.1e100.net
Software
Golfe2 /
Resource Hash
f8ef655ef916e39713ede9c6db56d7ca5618bd82cf5ac991dcd013f05e0fdfc7
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 13 Nov 2017 20:19:12 GMT
server
Golfe2
age
2711
date
Tue, 20 Mar 2018 14:54:02 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
timing-allow-origin
*
alt-svc
hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="41,39,35"
content-length
14597
expires
Tue, 20 Mar 2018 16:54:02 GMT
TK3hWkUHHAIjg75-ohoTus9CAZek1w.woff2
fonts.gstatic.com/s/oswald/v16/ 		9 KB
10 KB 		Font
General
Check archive.org
Download Go to
Full URL
http://fonts.gstatic.com/s/oswald/v16/TK3hWkUHHAIjg75-ohoTus9CAZek1w.woff2
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
172.217.17.67 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
ams16s30-in-f3.1e100.net
Software
sffe /
Resource Hash
19e1c4c97917724cacf9f2e3c544ed0925a14ef28a79565b7bae38fc70ac82f2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Referer
http://fonts.googleapis.com/css?family=Oswald%3A400%2C700%2C400italic&subset=latin%2Ccyrillic-ext%2Cgreek-ext%2Ccyrillic&ver=dc488b3cf402a36ed8529f3196db2a8a
Origin
http://securityaffairs.co

Response headers

Date
Thu, 08 Feb 2018 20:33:28 GMT
X-Content-Type-Options
nosniff
Last-Modified
Tue, 07 Nov 2017 15:19:11 GMT
Server
sffe
Age
3438345
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes
Timing-Allow-Origin
*
Content-Length
9644
X-XSS-Protection
1; mode=block
Expires
Fri, 08 Feb 2019 20:33:28 GMT
S6uyw4BMUTPHjx4wXiWtFCc.woff2
fonts.gstatic.com/s/lato/v14/ 		14 KB
14 KB 		Font
General
Check archive.org
Download Go to
Full URL
http://fonts.gstatic.com/s/lato/v14/S6uyw4BMUTPHjx4wXiWtFCc.woff2
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
172.217.17.67 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
ams16s30-in-f3.1e100.net
Software
sffe /
Resource Hash
52726fb580d6bffc46615863ddbf4c319524b5a68fb484be2972bdad4fd0310d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Referer
http://fonts.googleapis.com/css?family=Lato%3A400%2C700%2C400italic%2C700italic&ver=dc488b3cf402a36ed8529f3196db2a8a
Origin
http://securityaffairs.co

Response headers

Date
Thu, 08 Feb 2018 18:49:59 GMT
X-Content-Type-Options
nosniff
Last-Modified
Wed, 11 Oct 2017 18:23:20 GMT
Server
sffe
Age
3444554
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes
Timing-Allow-Origin
*
Content-Length
13944
X-XSS-Protection
1; mode=block
Expires
Fri, 08 Feb 2019 18:49:59 GMT
fontawesome-webfont.woff
securityaffairs.co/wordpress/wp-content/themes/rigel_old/fonts/ 		43 KB
44 KB 		Font
General
Check archive.org
Download Go to
Full URL
http://securityaffairs.co/wordpress/wp-content/themes/rigel_old/fonts/fontawesome-webfont.woff?v=4.0.3
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
217.160.0.146 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
217-160-0-146.elastic-ssl.ui-r.com
Software
Apache /
Resource Hash
0fd28fece9ebd606b8b071460ebd3fc2ed7bc7a66ef91c8834f11dfacab4a849

Request headers

Pragma
no-cache
Origin
http://securityaffairs.co
Accept-Encoding
gzip, deflate
Host
securityaffairs.co
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
*/*
Referer
http://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/font-awesome.min.css?ver=1.4.1
Cookie
wfvt_2796755358=5ab12b1f25a70; __unam=6f69f6a-16244107bc9-3f35429d-1
Connection
keep-alive
Cache-Control
no-cache
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Referer
http://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/font-awesome.min.css?ver=1.4.1
Origin
http://securityaffairs.co

Response headers

Date
Tue, 20 Mar 2018 15:39:13 GMT
Last-Modified
Wed, 16 Dec 2015 06:58:09 GMT
Server
Apache
ETag
"ad90-526fe6dc92240"
Content-Type
application/font-woff
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=15
Content-Length
44432
TK3iWkUHHAIjg752GT8Gl-1PKw.woff2
fonts.gstatic.com/s/oswald/v16/ 		9 KB
9 KB 		Font
General
Check archive.org
Download Go to
Full URL
http://fonts.gstatic.com/s/oswald/v16/TK3iWkUHHAIjg752GT8Gl-1PKw.woff2
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
172.217.17.67 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
ams16s30-in-f3.1e100.net
Software
sffe /
Resource Hash
a26fd52082f9c6c191e6f75ca86d82544f74ec979da9c64406a89bea6247a9e9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Referer
http://fonts.googleapis.com/css?family=Oswald%3A400%2C700%2C400italic&subset=latin%2Ccyrillic-ext%2Cgreek-ext%2Ccyrillic&ver=dc488b3cf402a36ed8529f3196db2a8a
Origin
http://securityaffairs.co

Response headers

Date
Thu, 08 Feb 2018 20:33:28 GMT
X-Content-Type-Options
nosniff
Last-Modified
Tue, 07 Nov 2017 15:18:49 GMT
Server
sffe
Age
3438345
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes
Timing-Allow-Origin
*
Content-Length
9324
X-XSS-Protection
1; mode=block
Expires
Fri, 08 Feb 2019 20:33:28 GMT
nuFiD-vYSZviVYUb_rj3ij__anPXDTzYgEM86xQ.woff2
fonts.gstatic.com/s/playfairdisplay/v13/ 		16 KB
17 KB 		Font
General
Check archive.org
Download Go to
Full URL
http://fonts.gstatic.com/s/playfairdisplay/v13/nuFiD-vYSZviVYUb_rj3ij__anPXDTzYgEM86xQ.woff2
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
172.217.17.67 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
ams16s30-in-f3.1e100.net
Software
sffe /
Resource Hash
d1a301f4dd52945b5cf0f0c018af9779de11a70d82c26edb17139756af5a16d5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Referer
http://fonts.googleapis.com/css?family=Playfair+Display%3A400%2C700%2C400italic&subset=latin%2Ccyrillic-ext%2Cgreek-ext%2Ccyrillic&ver=dc488b3cf402a36ed8529f3196db2a8a
Origin
http://securityaffairs.co

Response headers

Date
Thu, 08 Feb 2018 19:08:00 GMT
X-Content-Type-Options
nosniff
Last-Modified
Tue, 07 Nov 2017 15:20:15 GMT
Server
sffe
Age
3443473
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes
Timing-Allow-Origin
*
Content-Length
16652
X-XSS-Protection
1; mode=block
Expires
Fri, 08 Feb 2019 19:08:00 GMT
S6u8w4BMUTPHjxsAXC-qNiXg7Q.woff2
fonts.gstatic.com/s/lato/v14/ 		14 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
http://fonts.gstatic.com/s/lato/v14/S6u8w4BMUTPHjxsAXC-qNiXg7Q.woff2
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
172.217.17.67 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
ams16s30-in-f3.1e100.net
Software
sffe /
Resource Hash
155ef7601d4af029d8b6f3efa4ed4984748ea0a36c85f038f129ffdc6fb83b66
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Referer
http://fonts.googleapis.com/css?family=Lato%3A400%2C700%2C400italic%2C700italic&ver=dc488b3cf402a36ed8529f3196db2a8a
Origin
http://securityaffairs.co

Response headers

Date
Thu, 08 Feb 2018 23:35:00 GMT
X-Content-Type-Options
nosniff
Last-Modified
Wed, 11 Oct 2017 18:23:01 GMT
Server
sffe
Age
3427453
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes
Timing-Allow-Origin
*
Content-Length
14824
X-XSS-Protection
1; mode=block
Expires
Fri, 08 Feb 2019 23:35:00 GMT
S6u9w4BMUTPHh6UVSwiPGQ3q5d0.woff2
fonts.gstatic.com/s/lato/v14/ 		14 KB
14 KB 		Font
General
Check archive.org
Download Go to
Full URL
http://fonts.gstatic.com/s/lato/v14/S6u9w4BMUTPHh6UVSwiPGQ3q5d0.woff2
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
172.217.17.67 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
ams16s30-in-f3.1e100.net
Software
sffe /
Resource Hash
a3b3c4f67bf2b44294215e2be76f12794e6b142edec201e199c93c38739f2bfc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Referer
http://fonts.googleapis.com/css?family=Lato%3A400%2C700%2C400italic%2C700italic&ver=dc488b3cf402a36ed8529f3196db2a8a
Origin
http://securityaffairs.co

Response headers

Date
Thu, 08 Feb 2018 18:49:59 GMT
X-Content-Type-Options
nosniff
Last-Modified
Wed, 11 Oct 2017 18:24:00 GMT
Server
sffe
Age
3444554
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes
Timing-Allow-Origin
*
Content-Length
14076
X-XSS-Protection
1; mode=block
Expires
Fri, 08 Feb 2019 18:49:59 GMT
browserfp.min.js
pxlclnmdecom-a.akamaihd.net/javascripts/ 		83 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://pxlclnmdecom-a.akamaihd.net/javascripts/browserfp.min.js?templateId=3
Requested by
Host: contextual.media.net
URL: http://contextual.media.net/nmedianet.js?cid=8CU5BD6EW
Protocol
HTTP/1.1
Server
2.21.246.49 , Austria, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
/ Express
Resource Hash
36c7530a7bd3067500991d747aec8bb348245375fadd3c62ce47e877551e04dd

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:14 GMT
Content-Encoding
gzip
X-Powered-By
Express
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET,PUT,POST,DELETE,OPTIONS
Content-Type
text/javascript; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=1800
Connection
keep-alive
Access-Control-Allow-Headers
Origin, X-Requested-With, Content-Type, Accept, Bafp-Eg, Bafp-Ec, Bafp-Eg-T, Bafp-Ec-T
Content-Length
26645
Expires
Tue, 20 Mar 2018 16:09:14 GMT
jstag
medianet-d.openx.net/w/1.0/ Frame 78BC 		63 KB
22 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://medianet-d.openx.net/w/1.0/jstag?oxns=mNCM
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
173.241.240.220 New York, United States, ASN36089 (OPENX-AS1 - OPENX TECHNOLOGIES, INC., US),
Reverse DNS
ox-173-241-240-220.xa.dc.openx.org
Software
OXGW/15.0.0 /
Resource Hash
a5fa6e1ad7a4121ebd2c5625f83e6e0883c32e2c1ffbf35bc2743f12717c4313

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:14 GMT
Content-Encoding
gzip
Server
OXGW/15.0.0
Vary
Accept-Encoding
P3P
CP="CUR ADM OUR NOR STA NID"
Cache-Control
max-age=3600
Content-Type
text/javascript
Content-Length
22366
Expires
Tue, 20 Mar 2018 16:39:14 GMT
rtbspub
contextual.media.net/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://contextual.media.net/rtbspub?&prid=8PRHGG6T9&cid=8CU5BD6EW&crid=762221962&size=300x250&rp=0.90&vi=1521560353868058059&ugd=4&requrl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F70299%2Fmalware%2Frottensys-botnet.html&useAppData=0&hlt=1&tr=0.8352152951749423
Requested by
Host: contextual.media.net
URL: http://contextual.media.net/nmedianet.js?cid=8CU5BD6EW
Protocol
HTTP/1.1
Server
104.90.192.189 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-90-192-189.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
7dda926d3d8e49c55355f139738fb7046f3beb45420f7c5f108c888aa7fc26bf

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Mar 2018 15:39:14 GMT
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
Content-Type
text/javascript
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
756
X-MNET-HL2
E
Expires
Tue, 20 Mar 2018 15:39:14 GMT
fcmdynet.js
contextual.media.net/ 		33 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://contextual.media.net/fcmdynet.js?&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=762221962&size=300x250&cc=DE&wsip=2886780940&vif=1&requrl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F70299%2Fmalware%2Frottensys-botnet.html&nse=3&vi=1521560353868058059&lw=1&ugd=4&re=1&ourl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F70299%2Fmalware%2Frottensys-botnet.html&osrc=metatag&hlt=1&dfp=1&rtbs=1
Requested by
Host: contextual.media.net
URL: http://contextual.media.net/nmedianet.js?cid=8CU5BD6EW
Protocol
HTTP/1.1
Server
104.90.192.189 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-90-192-189.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
4ebfc8a4d1b994a574fd6a0e1bb67f17bd8ada120792586b6b25a00a995eb03d

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

Date
Tue, 20 Mar 2018 15:39:14 GMT
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
P3P
CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
Cache-Control
max-age=300
Connection
keep-alive
Content-Type
text/javascript;charset=UTF-8
Content-Length
12667
X-MNET-HL2
E
Expires
Tue, 20 Mar 2018 15:44:14 GMT
gpt.js
www.googletagservices.com/tag/js/ Frame 2A96 		11 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://www.googletagservices.com/tag/js/gpt.js
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s20-in-f2.1e100.net
Software
sffe /
Resource Hash
b3125d3c4f7dfa6652acea2cf7845db41eb5531788f0743c8e08122fb4df1b2b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:14 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Server
sffe
ETag
"3 / 438 of 1000 / last-modified: 1521490906"
Vary
Accept-Encoding
Content-Type
text/javascript
Cache-Control
private, max-age=900, stale-while-revalidate=3600
Timing-Allow-Origin
*
Content-Length
4922
X-XSS-Protection
1; mode=block
Expires
Tue, 20 Mar 2018 15:39:14 GMT
videoAds.js
adservetx.media.net/ 		6 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://adservetx.media.net/videoAds.js?cid=8CU5BD6EW&crid=126440378&dn=securityaffairs.co
Requested by
Host: contextual.media.net
URL: http://contextual.media.net/nmedianet.js?cid=8CU5BD6EW
Protocol
HTTP/1.1
Server
104.90.192.189 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-90-192-189.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
b9b000e237865c5af89426052f9b7f1ed078a04d64ad0646a9a5aedc3581c6e2

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:14 GMT
Content-Encoding
gzip
Server
nginx
Vary
Accept-Encoding
Content-Type
text/javascript
Cache-Control
max-age=300
Connection
keep-alive
Content-Length
2701
Expires
Tue, 20 Mar 2018 15:44:14 GMT
px.gif
contextual.media.net/ 		43 B
324 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://contextual.media.net/px.gif?ch=1&rn=1
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
104.90.192.189 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-90-192-189.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
8ac1703c1c34b2be426deda409d39258f82fae17f13e645f377f337a954aedde

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:14 GMT
Last-Modified
Wed, 19 Jul 2017 10:11:12 GMT
Server
Apache
Content-Type
image/gif
Cache-Control
max-age=1209600
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Tue, 03 Apr 2018 15:39:14 GMT
px.gif
h.mnet-ad.net/ 		43 B
322 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://h.mnet-ad.net/px.gif?ch=2&rn=1
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
2.21.246.49 , Austria, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
Apache /
Resource Hash
8ac1703c1c34b2be426deda409d39258f82fae17f13e645f377f337a954aedde

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:14 GMT
Last-Modified
Wed, 19 Jul 2017 10:11:12 GMT
Server
Apache
Content-Type
image/gif
Cache-Control
max-age=72245
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 21 Mar 2018 11:43:19 GMT
bping.php
qsearch.media.net/ 		35 B
280 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://qsearch.media.net/bping.php?&prid=8PRHGG6T9&cid=8CU5BD6EW&crid=762221962&vi=1521560353868058059&ugd=4&lf=6&requrl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F70299%2Fmalware%2Frottensys-botnet.html&cc=DE&sc=HE&lper=100&wsip=2886780940&r=1521560353978&vgd_sbSup=1&vgd_nvLogging=0&hvsid=00001521560353873024994892789957
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
2.16.186.113 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-186-113.deploy.akamaitechnologies.com
Software
Apache /
Resource Hash
0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Mar 2018 15:39:14 GMT
Server
Apache
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
35
Expires
Tue, 20 Mar 2018 15:39:14 GMT
sc
l.sharethis.com/ 		80 B
495 B 		XHR
General
Check archive.org
Download Go to
Full URL
http://l.sharethis.com/sc?cm=CvQGBlqxKyEAAAARSLAHAw%3D%3D&uid=true&url=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F70299%2Fmalware%2Frottensys-botnet.html
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
52.57.39.144 Frankfurt, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-57-39-144.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
736760c50b3462fa190e833ca8d26d2d2e1c6f995ed631d155ad24546bbf2e9f

Request headers

X-DevTools-Emulate-Network-Conditions-Client-Id
EB71BB8012974EA2388A186F3E4CE027
Origin
http://securityaffairs.co
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:14 GMT
Access-Control-Max-Age
1728000
Content-Type
application/json
Access-Control-Allow-Origin
http://securityaffairs.co
Access-Control-Expose-Headers
stid
Cache-Control
no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Stid
CvQGBlqxKyEAAAARSLAHAw==
Access-Control-Allow-Headers
*
Content-Length
80
collect
www.google-analytics.com/r/ 		35 B
101 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/r/collect?v=1&_v=j66&a=1308341093&t=pageview&_s=1&dl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F70299%2Fmalware%2Frottensys-botnet.html&ul=en-us&de=UTF-8&dt=The%20RottenSys%20botnet%20is%20already%20composed%20of%20nearly%205%20million%20Android%20devicesSecurity%20Affairs&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=IEBAAEAB~&jid=1593308017&gjid=1210860918&cid=1364216025.1521560354&tid=UA-59069958-1&_gid=1082374052.1521560354&_r=1&z=1777085691
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
SPDY
Server
172.217.16.174 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f174.1e100.net
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Mar 2018 15:39:14 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
status
200
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
alt-svc
hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="41,39,35"
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
log
qsearch.media.net/ 		35 B
312 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://qsearch.media.net/log?logid=kfk&evtid=videoerror&cid=8CU5BD6EW&crid=null&dn=securityaffairs.co&REASON=33&ACTION=0&visitorId=DefVid&dc=1&adtagId=126440378&bidder_id=99999&biddertagid=99999&bsr=Chrome_63&dt=desktop&os=MAC&id=00000152156035427300841450602394&purl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F70299%2Fmalware%2Frottensys-botnet.html
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
2.16.186.113 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-186-113.deploy.akamaitechnologies.com
Software
Apache /
Resource Hash
0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Mar 2018 15:39:14 GMT
Server
Apache
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
35
Expires
Tue, 20 Mar 2018 15:39:14 GMT
ptmdP
dt.clnmde.com/ 		7 B
437 B 		Other
General
Check archive.org
Download Go to
Full URL
http://dt.clnmde.com/ptmdP
Requested by
Host: pxlclnmdecom-a.akamaihd.net
URL: http://pxlclnmdecom-a.akamaihd.net/javascripts/browserfp.min.js?templateId=3
Protocol
HTTP/1.1
Server
54.86.56.206 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-86-56-206.compute-1.amazonaws.com
Software
/ Express
Resource Hash
aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27

Request headers

Cache-Control
max-age=0
Origin
http://securityaffairs.co
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Date
Tue, 20 Mar 2018 15:39:14 GMT
X-Powered-By
Express
ETag
W/"7-Jgyp3YpFd/wAt71YECmAdg"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET,PUT,POST,DELETE,OPTIONS
Content-Type
text/html; charset=utf-8
Access-Control-Allow-Origin
*
Connection
keep-alive
Access-Control-Allow-Headers
Origin, X-Requested-With, Content-Type, Accept, Bafp-Eg, Bafp-Ec, Bafp-Eg-T, Bafp-Ec-T
Content-Length
7
cet.js
dt.clnmde.com/ 		2 B
432 B 		XHR
General
Check archive.org
Download Go to
Full URL
http://dt.clnmde.com/cet.js?identifier=bafp
Requested by
Host: pxlclnmdecom-a.akamaihd.net
URL: http://pxlclnmdecom-a.akamaihd.net/javascripts/browserfp.min.js?templateId=3
Protocol
HTTP/1.1
Server
54.86.56.206 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-86-56-206.compute-1.amazonaws.com
Software
/ Express
Resource Hash
20ef0f0c8d0eea98772412cea9b3b92612e3e53cb5e59152b5703165f56e8a53

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Origin
http://securityaffairs.co

Response headers

Date
Tue, 20 Mar 2018 15:39:14 GMT
X-Powered-By
Express
ETag
W/"2-1M0Nq89MqiKtkvq0CETHhg"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET,PUT,POST,DELETE,OPTIONS
Content-Type
text/html; charset=utf-8
Access-Control-Allow-Origin
*
Connection
keep-alive
Access-Control-Allow-Headers
Origin, X-Requested-With, Content-Type, Accept, Bafp-Eg, Bafp-Ec, Bafp-Eg-T, Bafp-Ec-T
Content-Length
2
cec.js
dt.clnmde.com/ 		2 B
432 B 		XHR
General
Check archive.org
Download Go to
Full URL
http://dt.clnmde.com/cec.js?identifier=bafp
Requested by
Host: pxlclnmdecom-a.akamaihd.net
URL: http://pxlclnmdecom-a.akamaihd.net/javascripts/browserfp.min.js?templateId=3
Protocol
HTTP/1.1
Server
54.86.56.206 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-86-56-206.compute-1.amazonaws.com
Software
/ Express
Resource Hash
20ef0f0c8d0eea98772412cea9b3b92612e3e53cb5e59152b5703165f56e8a53

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Origin
http://securityaffairs.co

Response headers

Date
Tue, 20 Mar 2018 15:39:14 GMT
X-Powered-By
Express
ETag
W/"2-1M0Nq89MqiKtkvq0CETHhg"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET,PUT,POST,DELETE,OPTIONS
Content-Type
text/html; charset=utf-8
Access-Control-Allow-Origin
*
Connection
keep-alive
Access-Control-Allow-Headers
Origin, X-Requested-With, Content-Type, Accept, Bafp-Eg, Bafp-Ec, Bafp-Eg-T, Bafp-Ec-T
Content-Length
2
cenw.js
dt.clnmde.com/ 		36 B
468 B 		XHR
General
Check archive.org
Download Go to
Full URL
http://dt.clnmde.com/cenw.js?identifier=bafp
Requested by
Host: pxlclnmdecom-a.akamaihd.net
URL: http://pxlclnmdecom-a.akamaihd.net/javascripts/browserfp.min.js?templateId=3
Protocol
HTTP/1.1
Server
54.86.56.206 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-86-56-206.compute-1.amazonaws.com
Software
/ Express
Resource Hash
313c219bfa85a95e056ba2aa046c848e737e3a2c93c20853dcebf2c0b97f9bfc

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Origin
http://securityaffairs.co

Response headers

Date
Tue, 20 Mar 2018 15:39:14 GMT
X-Powered-By
Express
ETag
W/"24-HyVIzZj/PKH4r/OH9AECtg"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET,PUT,POST,DELETE,OPTIONS
Content-Type
text/html; charset=utf-8
Access-Control-Allow-Origin
*
Connection
keep-alive
Access-Control-Allow-Headers
Origin, X-Requested-With, Content-Type, Accept, Bafp-Eg, Bafp-Ec, Bafp-Eg-T, Bafp-Ec-T
Content-Length
36
beacon_img
dt.clnmde.com/ 		70 B
446 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://dt.clnmde.com/beacon_img?ti=3&x=1521560354285
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
54.86.56.206 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-86-56-206.compute-1.amazonaws.com
Software
/ Express
Resource Hash
c414cd0e204de974f73753c7e28d7638e7b3691bb8b1a2bab6b25bb7fed7ce77

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:14 GMT
X-Powered-By
Express
Transfer-Encoding
chunked
Access-Control-Allow-Methods
GET,PUT,POST,DELETE,OPTIONS
Content-Type
image/gif
Access-Control-Allow-Origin
*
Connection
keep-alive
Access-Control-Allow-Headers
Origin, X-Requested-With, Content-Type, Accept, Bafp-Eg, Bafp-Ec, Bafp-Eg-T, Bafp-Ec-T
acj
medianet-d.openx.net/w/1.0/ Frame 78BC
Redirect Chain
  • http://medianet-d.openx.net/w/1.0/acj?ai=be377f37-02be-487d-99d2-2c61d8eb7c49&o=7015295044&callback=OX_mNCM_7015295044&ju=http%3A//securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html&j...
  • http://medianet-d.openx.net/w/1.0/acj?cc=1&ai=be377f37-02be-487d-99d2-2c61d8eb7c49&o=7015295044&callback=OX_mNCM_7015295044&ju=http%3A//securityaffairs.co/wordpress/70299/malware/rottensys-botnet.h...
362 B
751 B 		Script
General
Check archive.org
Download Go to
Full URL
http://medianet-d.openx.net/w/1.0/acj?cc=1&ai=be377f37-02be-487d-99d2-2c61d8eb7c49&o=7015295044&callback=OX_mNCM_7015295044&ju=http%3A//securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html&jr=&auid=538672510&dims=1600x1200&adxy=0%2C0&res=1600x1200x24&plg=pm&ch=UTF-8&tz=0&ws=0x0&ifr=1&tws=1600x1200
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
173.241.240.220 New York, United States, ASN36089 (OPENX-AS1 - OPENX TECHNOLOGIES, INC., US),
Reverse DNS
ox-173-241-240-220.xa.dc.openx.org
Software
OXGW/15.0.0 /
Resource Hash
ff1797154ee7426f3b00269114eb7074444e2c782d3063bdd2fccc76059375bf

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Mar 2018 15:39:14 GMT
Content-Encoding
gzip
Server
OXGW/15.0.0
Vary
Accept
P3P
CP="CUR ADM OUR NOR STA NID"
Cache-Control
private, max-age=0, no-cache
Transfer-Encoding
chunked
Content-Type
application/json
Expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Location
http://medianet-d.openx.net/w/1.0/acj?cc=1&ai=be377f37-02be-487d-99d2-2c61d8eb7c49&o=7015295044&callback=OX_mNCM_7015295044&ju=http%3A//securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html&jr=&auid=538672510&dims=1600x1200&adxy=0%2C0&res=1600x1200x24&plg=pm&ch=UTF-8&tz=0&ws=0x0&ifr=1&tws=1600x1200
Date
Tue, 20 Mar 2018 15:39:14 GMT
Server
OXGW/15.0.0
Timing-Allow-Origin
*
Content-Length
0
P3P
CP="CUR ADM OUR NOR STA NID"
integrator.js
adservice.google.com/adsid/ Frame 2A96 		111 B
607 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=securityaffairs.co
Requested by
Host: www.googletagservices.com
URL: http://www.googletagservices.com/tag/js/gpt.js
Protocol
SPDY
Server
172.217.22.98 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s18-in-f2.1e100.net
Software
cafe /
Resource Hash
207461e411e1ff6d6c5b0dd702d26031adb86de86ed3f571baa5a6fc498fc4b6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 20 Mar 2018 15:39:14 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="41,39,35"
content-length
105
x-xss-protection
1; mode=block
pubads_impl_188.js
securepubads.g.doubleclick.net/gpt/ Frame 2A96 		183 KB
65 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_188.js
Requested by
Host: www.googletagservices.com
URL: http://www.googletagservices.com/tag/js/gpt.js
Protocol
SPDY
Server
172.217.16.162 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f162.1e100.net
Software
sffe /
Resource Hash
855538077b6944e6a4300454d027510188c642643017949aaa8aa58652096f3d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date
Tue, 20 Mar 2018 15:39:14 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 15 Mar 2018 19:35:31 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="41,39,35"
content-length
65992
x-xss-protection
1; mode=block
expires
Tue, 20 Mar 2018 15:39:14 GMT
kbb.php
contextual.media.net/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://contextual.media.net/kbb.php?cme=FCIgUes4lP8jgFeZgNKmic0rL2-LujhG_F35HOVEMPXoyy-2ZV1jLvon8EUh3DY_9_LIOYRvjrgdsPnTFZGmUkpm--mFnhHqLts4iOKhK47Be1FBgDho4ST02hqPkNFHw83atFSbNK8%3D%7C%7CNDHRnZ9Gz3KXlI-i9OnZqQ%3D%3D%7C5gDUJdTGiJzedmq9hanWYg%3D%3D%7CN7fu2vKt8_s%3D%7CwQKqVZNVxsiGNthX_x6E7c3ZldeNVrJ-RbaPXw1kck92gsm6AvIigX3MW3pWhxL8NxEf4sQpuUQFR149KyILolnB78-c2gzt%7CsRBSg3CPSiQ%3D%7C&srp=ZPL-DvhZL6tgmKrUtO99v1m1jGIaBP3UQzvhFqmHrZ26Uq_-84s4pKDauc3HElwQ&klp=zTyC6LpypM9HjtD4VdyNbNsKvMEX5j05fH51RjvfxIFmex5mcyrn-T3Z1aMy8gMwa08iM3NNZMAjkFVUQR_Rm0vq13hoy95bcwvTVnt4utsKw62FHTttBXQv9aFN0pPuKIB3lRc9DNXC2SuwdUXM0ig1_E2uL6qiGqtV2_e27HNVmVBTTJ4SXcawUtJHwPsSA1JbjaBZVqyAeNqgaAFKbNfqhxiZlxCBEWtHE0rkV8z7pUZFonpSSduw_hcX7Od4yWqH_a7dio4n2QHrFLjx5rKUnbWRB8LeSgJUInuoz_9gq40x1XpiaGZfQ1nnF2iY-jcZ65ARhZk%3D&nse=3&bid=210870&cb=resultPageUtil.kwdRandmzn[%271521560353868058059%27]
Requested by
Host: contextual.media.net
URL: http://contextual.media.net/fcmdynet.js?&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=762221962&size=300x250&cc=DE&wsip=2886780940&vif=1&requrl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F70299%2Fmalware%2Frottensys-botnet.html&nse=3&vi=1521560353868058059&lw=1&ugd=4&re=1&ourl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F70299%2Fmalware%2Frottensys-botnet.html&osrc=metatag&hlt=1&dfp=1&rtbs=1
Protocol
HTTP/1.1
Server
104.90.192.189 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-90-192-189.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
1873838ce2201dbf71eebca918ba4a74518a6a9bddba5ef3d0ead7438c571bf0

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Mar 2018 15:39:15 GMT
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
Content-Type
text/javascript; charset=utf-8
X-MNET-KBB
E2
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
749
Expires
Tue, 20 Mar 2018 15:39:15 GMT
nrr.js
contextual.media.net/__media__/js/util/ 		56 KB
19 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://contextual.media.net/__media__/js/util/nrr.js?v=79
Requested by
Host: contextual.media.net
URL: http://contextual.media.net/fcmdynet.js?&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=762221962&size=300x250&cc=DE&wsip=2886780940&vif=1&requrl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F70299%2Fmalware%2Frottensys-botnet.html&nse=3&vi=1521560353868058059&lw=1&ugd=4&re=1&ourl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F70299%2Fmalware%2Frottensys-botnet.html&osrc=metatag&hlt=1&dfp=1&rtbs=1
Protocol
HTTP/1.1
Server
104.90.192.189 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-90-192-189.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
9869bf998d9dee691349d634a714bf20d6bde49c9d5160eb1cf103f76c4738e5

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:14 GMT
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=1209600
Connection
keep-alive
Content-Length
19030
Expires
Tue, 03 Apr 2018 15:39:14 GMT
mediamain.html
contextual.media.net/ Frame 4121 		47 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://contextual.media.net/mediamain.html?&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=762221962&pid=8PO5M70HK&size=300x250&cpnet=yVb1sHm-0KIh29BOFTjjrEBbIZGw_v2fXpyZXRW3WVE%3D&cme=FCIgUes4lP8jgFeZgNKmic0rL2-LujhG_F35HOVEMPXoyy-2ZV1jLvon8EUh3DY_9_LIOYRvjrgdsPnTFZGmUkpm--mFnhHqLts4iOKhK47Be1FBgDho4ST02hqPkNFHw83atFSbNK8%3D%7C%7CNDHRnZ9Gz3KXlI-i9OnZqQ%3D%3D%7C5gDUJdTGiJzedmq9hanWYg%3D%3D%7CN7fu2vKt8_s%3D%7CwQKqVZNVxsiGNthX_x6E7c3ZldeNVrJ-RbaPXw1kck92gsm6AvIigX3MW3pWhxL8NxEf4sQpuUQFR149KyILolnB78-c2gzt%7CsRBSg3CPSiQ%3D%7C&cc=DE&bf=0&vif=1&nse=3&bid=210870&vi=1521560353868058059&lw=1&ugd=4&ib=0&ourl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F70299%2Fmalware%2Frottensys-botnet.html&osrc=metatag&katbid=-2&nb=1
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
104.90.192.189 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-90-192-189.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
9b61e177f50bb90a24554c909f0e1ecef284283d3cee4b99379dab211ca3e189

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:14 GMT
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
Content-Type
text/javascript
Cache-Control
max-age=300
X-MNET-HL3
E
Connection
keep-alive
Content-Length
12585
Expires
Tue, 20 Mar 2018 15:44:14 GMT
S6u_w4BMUTPHjxsI5wq_Gwftx9897g.woff2
fonts.gstatic.com/s/lato/v14/ 		14 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
http://fonts.gstatic.com/s/lato/v14/S6u_w4BMUTPHjxsI5wq_Gwftx9897g.woff2
Requested by
Host: pxlclnmdecom-a.akamaihd.net
URL: http://pxlclnmdecom-a.akamaihd.net/javascripts/browserfp.min.js?templateId=3
Protocol
HTTP/1.1
Server
172.217.17.67 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
ams16s30-in-f3.1e100.net
Software
sffe /
Resource Hash
7fc6b71fecae57ad350ffe89e9059442916fa401c3d3441e8aeb4c20d7a34ec3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Referer
http://fonts.googleapis.com/css?family=Lato%3A400%2C700%2C400italic%2C700italic&ver=dc488b3cf402a36ed8529f3196db2a8a
Origin
http://securityaffairs.co

Response headers

Date
Fri, 09 Feb 2018 00:01:15 GMT
X-Content-Type-Options
nosniff
Last-Modified
Wed, 11 Oct 2017 18:24:07 GMT
Server
sffe
Age
3425879
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes
Timing-Allow-Origin
*
Content-Length
14812
X-XSS-Protection
1; mode=block
Expires
Sat, 09 Feb 2019 00:01:15 GMT
nmedianet.js
contextual.media.net/ 		109 KB
38 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://contextual.media.net/nmedianet.js?cid=8CU5BD6EW
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
104.90.192.189 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-90-192-189.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
bfe6c3c6e8c38610223dbeae0821e5afec8c5b114d7828268609a88c43c5770c

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Mar 2018 15:39:14 GMT
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
X-MNET-H
E
Content-Type
text/javascript; charset=utf-8
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
38552
Expires
Tue, 20 Mar 2018 15:39:14 GMT
cet.js
dt.clnmde.com/ 		2 B
432 B 		XHR
General
Check archive.org
Download Go to
Full URL
http://dt.clnmde.com/cet.js?identifier=bafp
Requested by
Host: pxlclnmdecom-a.akamaihd.net
URL: http://pxlclnmdecom-a.akamaihd.net/javascripts/browserfp.min.js?templateId=3
Protocol
HTTP/1.1
Server
54.86.56.206 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-86-56-206.compute-1.amazonaws.com
Software
/ Express
Resource Hash
20ef0f0c8d0eea98772412cea9b3b92612e3e53cb5e59152b5703165f56e8a53

Request headers

Access-Control-Request-Method
GET
Origin
http://securityaffairs.co
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Access-Control-Request-Headers
bafp-eg

Response headers

Date
Tue, 20 Mar 2018 15:39:14 GMT
ETag
W/"2-1M0Nq89MqiKtkvq0CETHhg"
X-Powered-By
Express
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET,PUT,POST,DELETE,OPTIONS
Content-Type
text/html; charset=utf-8
Access-Control-Allow-Origin
*
Connection
keep-alive
Access-Control-Allow-Headers
Origin, X-Requested-With, Content-Type, Accept, Bafp-Eg, Bafp-Ec, Bafp-Eg-T, Bafp-Ec-T
Content-Length
2
cec.js
dt.clnmde.com/ 		2 B
432 B 		XHR
General
Check archive.org
Download Go to
Full URL
http://dt.clnmde.com/cec.js?identifier=bafp
Requested by
Host: pxlclnmdecom-a.akamaihd.net
URL: http://pxlclnmdecom-a.akamaihd.net/javascripts/browserfp.min.js?templateId=3
Protocol
HTTP/1.1
Server
54.86.56.206 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-86-56-206.compute-1.amazonaws.com
Software
/ Express
Resource Hash
20ef0f0c8d0eea98772412cea9b3b92612e3e53cb5e59152b5703165f56e8a53

Request headers

Access-Control-Request-Method
GET
Origin
http://securityaffairs.co
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Access-Control-Request-Headers
bafp-ec

Response headers

Date
Tue, 20 Mar 2018 15:39:14 GMT
ETag
W/"2-1M0Nq89MqiKtkvq0CETHhg"
X-Powered-By
Express
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET,PUT,POST,DELETE,OPTIONS
Content-Type
text/html; charset=utf-8
Access-Control-Allow-Origin
*
Connection
keep-alive
Access-Control-Allow-Headers
Origin, X-Requested-With, Content-Type, Accept, Bafp-Eg, Bafp-Ec, Bafp-Eg-T, Bafp-Ec-T
Content-Length
2
/
www.facebook.com/impression.php/f1056a930a914/ 		43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/impression.php/f1056a930a914/?lid=115&payload=%7B%22source%22%3A%22jssdk%22%7D
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
SPDY
Server
185.60.216.35 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Content-Security-Policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' fbstatic-a.akamaihd.net fbcdn-static-b-a.akamaihd.net *.atlassolutions.com blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* *.akamaihd.net wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* *.atlassolutions.com attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

content-security-policy
default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' fbstatic-a.akamaihd.net fbcdn-static-b-a.akamaihd.net *.atlassolutions.com blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* *.akamaihd.net wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* *.atlassolutions.com attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
content-encoding
gzip
x-content-type-options
nosniff
status
200
vary
Origin, Accept-Encoding
x-xss-protection
0
pragma
no-cache
x-fb-debug
z3utPDqoA9St19e9pwUANUippPIRwbrGU14r8ATxxl9oFVyF21A/ImoBDGL6QqH3kDszRNuCR7JaA/hBaotzbA==
date
Tue, 20 Mar 2018 15:39:14 GMT
expect-ct
max-age=10, report-uri="http://reports.fb.com/expectct/"
strict-transport-security
max-age=15552000; preload
access-control-allow-methods
OPTIONS
content-type
image/gif
access-control-allow-origin
https://www.facebook.com
access-control-expose-headers
X-FB-Debug, X-Loader-Length
cache-control
private, no-cache, no-store, must-revalidate
access-control-allow-credentials
true
expires
Sat, 01 Jan 2000 00:00:00 GMT
ptmd
dt.clnmde.com/ 		70 B
446 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://dt.clnmde.com/ptmd?t=152156035435931124477280_N4IgtgniBcDasEYA0BmATABiQNk0taALAOz6ECcxAulUiAO4COMstIAxgE5gAOLIxXAQTlcAfQDmPAC5iEINgEMANtJgBWDFhCKAJst0xtAZ2mLpAV2MsUbAF6KYyEDwkwQANxB0ApgDsvaBdvEAkAC3cEdTQo7AwUdUIE8hQEBCISYjQADgwQ6WsghEI0clziQlx1dWyQj0KQbAA6DCaY7BCVGBQ6ADN2GABaZx9HIJSAI1109gxBtHYUcmGEH2zBqZ9ewd6siexiH2xo7ENfaQBLJ2jY+MS6UzdoEwBrd1xyIgwRYk15B5e9DURRu6jiCUIYg+Xx+fxCPgufCKhGybXUCCahHUaMIIWMylMkVB4MSOWIIWUvScdHYVlkF0MQWyAGEAKrqABCABFsABRADqIQkA2gURiYLumixdEYPicAF8gA
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
54.86.56.206 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-86-56-206.compute-1.amazonaws.com
Software
/ Express
Resource Hash
c414cd0e204de974f73753c7e28d7638e7b3691bb8b1a2bab6b25bb7fed7ce77

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:15 GMT
X-Powered-By
Express
Transfer-Encoding
chunked
Access-Control-Allow-Methods
GET,PUT,POST,DELETE,OPTIONS
Content-Type
image/gif
Access-Control-Allow-Origin
*
Connection
keep-alive
Access-Control-Allow-Headers
Origin, X-Requested-With, Content-Type, Accept, Bafp-Eg, Bafp-Ec, Bafp-Eg-T, Bafp-Ec-T
jstag
medianet-d.openx.net/w/1.0/ Frame D1D8 		63 KB
0 		Script
General
Check archive.org
Download Go to
Full URL
http://medianet-d.openx.net/w/1.0/jstag?oxns=mNCM
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
173.241.240.220 New York, United States, ASN36089 (OPENX-AS1 - OPENX TECHNOLOGIES, INC., US),
Reverse DNS
ox-173-241-240-220.xa.dc.openx.org
Software
OXGW/15.0.0 /
Resource Hash
a5fa6e1ad7a4121ebd2c5625f83e6e0883c32e2c1ffbf35bc2743f12717c4313

Request headers

Response headers

Date
Tue, 20 Mar 2018 15:39:14 GMT
Content-Encoding
gzip
Server
OXGW/15.0.0
Vary
Accept-Encoding
P3P
CP="CUR ADM OUR NOR STA NID"
Cache-Control
max-age=3600
Content-Type
text/javascript
Content-Length
22366
Expires
Tue, 20 Mar 2018 16:39:14 GMT
rtbspub
contextual.media.net/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://contextual.media.net/rtbspub?&prid=8PRHGG6T9&cid=8CU5BD6EW&crid=184323154&size=300x250&rp=0.50&vi=1521560354418830645&ugd=4&requrl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F70299%2Fmalware%2Frottensys-botnet.html&useAppData=0&hlt=1&tr=0.4486403737159712
Requested by
Host: contextual.media.net
URL: http://contextual.media.net/nmedianet.js?cid=8CU5BD6EW
Protocol
HTTP/1.1
Server
104.90.192.189 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-90-192-189.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
505cdec32ce9430d2a392dde4062152fbf7a2ee5b59d435babdd5baa8d4ad26b

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Mar 2018 15:39:15 GMT
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
Content-Type
text/javascript
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
712
X-MNET-HL2
E
Expires
Tue, 20 Mar 2018 15:39:15 GMT
fcmdynet.js
contextual.media.net/ 		33 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://contextual.media.net/fcmdynet.js?&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=184323154&size=300x250&cc=DE&wsip=2886780940&vif=1&requrl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F70299%2Fmalware%2Frottensys-botnet.html&nse=3&vi=1521560354418830645&lw=1&ugd=4&re=1&ourl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F70299%2Fmalware%2Frottensys-botnet.html&osrc=metatag&hlt=1&dfp=1&rtbs=1
Requested by
Host: contextual.media.net
URL: http://contextual.media.net/nmedianet.js?cid=8CU5BD6EW
Protocol
HTTP/1.1
Server
104.90.192.189 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-90-192-189.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
1e6bdd2f9845ad83539914bc8cdc7ddf80cbe48ef70f3cc5722e5c6cebd3c8f7

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

Date
Tue, 20 Mar 2018 15:39:15 GMT
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
Content-Type
text/javascript;charset=UTF-8
Cache-Control
max-age=300
Connection
keep-alive
Content-Length
12725
X-MNET-HL2
E
Expires
Tue, 20 Mar 2018 15:44:15 GMT
gpt.js
www.googletagservices.com/tag/js/ Frame E19E 		11 KB
0 		Script
General
Check archive.org
Download Go to
Full URL
http://www.googletagservices.com/tag/js/gpt.js
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s20-in-f2.1e100.net
Software
sffe /
Resource Hash
b3125d3c4f7dfa6652acea2cf7845db41eb5531788f0743c8e08122fb4df1b2b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Response headers

Date
Tue, 20 Mar 2018 15:39:14 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Server
sffe
ETag
"3 / 438 of 1000 / last-modified: 1521490906"
Vary
Accept-Encoding
Content-Type
text/javascript
Cache-Control
private, max-age=900, stale-while-revalidate=3600
Timing-Allow-Origin
*
Content-Length
4922
X-XSS-Protection
1; mode=block
Expires
Tue, 20 Mar 2018 15:39:14 GMT
bping.php
qsearch.media.net/ 		35 B
280 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://qsearch.media.net/bping.php?&prid=8PRHGG6T9&cid=8CU5BD6EW&crid=184323154&vi=1521560354418830645&ugd=4&lf=6&requrl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F70299%2Fmalware%2Frottensys-botnet.html&cc=DE&sc=HE&vsid=1645619548927803&lper=100&wsip=2886780940&r=1521560355267&vgd_sbSup=1&vgd_nvLogging=0&hvsid=00001521560355252024994892789617
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
2.16.186.113 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-186-113.deploy.akamaitechnologies.com
Software
Apache /
Resource Hash
0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Mar 2018 15:39:15 GMT
Server
Apache
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
35
Expires
Tue, 20 Mar 2018 15:39:15 GMT
cec.js
dt.clnmde.com/ 		36 B
551 B 		XHR
General
Check archive.org
Download Go to
Full URL
http://dt.clnmde.com/cec.js?identifier=bafp
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
54.86.56.206 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-86-56-206.compute-1.amazonaws.com
Software
/ Express
Resource Hash
313c219bfa85a95e056ba2aa046c848e737e3a2c93c20853dcebf2c0b97f9bfc

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Origin
http://securityaffairs.co
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Bafp-Ec
d80150c0-2c54-11e8-83a1-ad5ce60cc7d2

Response headers

Date
Tue, 20 Mar 2018 15:39:15 GMT
X-Powered-By
Express
ETag
W/"24-HyVIzZj/PKH4r/OH9AECtg"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET,PUT,POST,DELETE,OPTIONS
Content-Type
text/html; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
private, max-age=630720000
Connection
keep-alive
Access-Control-Allow-Headers
Origin, X-Requested-With, Content-Type, Accept, Bafp-Eg, Bafp-Ec, Bafp-Eg-T, Bafp-Ec-T
Content-Length
36
Expires
Tue, 31 Dec 2030 23:30:45 GMT
cet.js
dt.clnmde.com/ 		36 B
475 B 		XHR
General
Check archive.org
Download Go to
Full URL
http://dt.clnmde.com/cet.js?identifier=bafp
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
54.86.56.206 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-86-56-206.compute-1.amazonaws.com
Software
/ Express
Resource Hash
313c219bfa85a95e056ba2aa046c848e737e3a2c93c20853dcebf2c0b97f9bfc

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Origin
http://securityaffairs.co
Bafp-Eg
d80150c0-2c54-11e8-83a1-ad5ce60cc7d2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:15 GMT
X-Powered-By
Express
Etag
d80150c0-2c54-11e8-83a1-ad5ce60cc7d2
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET,PUT,POST,DELETE,OPTIONS
Content-Type
text/html; charset=utf-8
Access-Control-Allow-Origin
*
Connection
keep-alive
Access-Control-Allow-Headers
Origin, X-Requested-With, Content-Type, Accept, Bafp-Eg, Bafp-Ec, Bafp-Eg-T, Bafp-Ec-T
Content-Length
36
ptmd
dt.clnmde.com/ 		70 B
446 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://dt.clnmde.com/ptmd?t=152156035435931124477280_N4IgxmAWDWIFwG0QHYBsAmTBGAnBkANCFgBwAsAzOhVgKxkgC6RAtgJ7wIJYFUAMBDAMxlkBdGRzJGzEAGcALgEMFAVzmcysgF5L4PEAAcA5vBAA3QiACmAO0twjV45DN10dVHwr0fOGlgSosjoJHxWChqOWGToOGHIZBi0tCRW5lEgqAB0fNkeqFZKADbwFEQAZmDwALQG1nqO-gBGACaBYHw16GAUOHVY1iQ1bdYVNRUhzajI1qi06KitVtYKAJb6C57e9ESKpnAC8rCOGDgSfLjItJdWctAA7gpuW7RePmQA+mcXVzdYKzWhjcZBI+VoWGyZFo4IYe2KiheHjeO1iJGQVmKFX0RDA6gUnzWy0cJAAwgBVWgAIQAIqgAKIAdWc1Tg7m2PhSfCOAEdrPoAL5AA
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
54.86.56.206 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-86-56-206.compute-1.amazonaws.com
Software
/ Express
Resource Hash
c414cd0e204de974f73753c7e28d7638e7b3691bb8b1a2bab6b25bb7fed7ce77

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:15 GMT
X-Powered-By
Express
Transfer-Encoding
chunked
Access-Control-Allow-Methods
GET,PUT,POST,DELETE,OPTIONS
Content-Type
image/gif
Access-Control-Allow-Origin
*
Connection
keep-alive
Access-Control-Allow-Headers
Origin, X-Requested-With, Content-Type, Accept, Bafp-Eg, Bafp-Ec, Bafp-Eg-T, Bafp-Ec-T
ptmd
dt.clnmde.com/ 		70 B
446 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://dt.clnmde.com/ptmd?t=152156035435931124477280_N4IglgbiBcAMB0BWANCAzgFwIYYK5pgG0BGATgF1UAvLGY1ABwHMYQpUBTAOymhAZComAC1bFEAJnEA2WAGZEAFgWk5xYhMWKA7NokAOWIJAYCfYoomlD2xdImJE+4xDMhp8BFOnGsAGxg5VAAzAGMYAFp6EA5aPlUAIwATDVDYCIlQuVIo4g59COSOYIjgvQTpbQ5pSWkk4w4MMDpJGXklVEwWOE6Aa1Z7Uk1YMm1EEeM0XoB3DDFWxFkFRQB9QeHR8eIGsAFzRX14B2J4RUQjpUm-THmpRfbLfW1jP2C6VFD8DBWwer59ADCAFVEAAhAAi0gAogB1YxMcLQcR3JaORDEaSoACOHDoAF8gA
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
54.86.56.206 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-86-56-206.compute-1.amazonaws.com
Software
/ Express
Resource Hash
c414cd0e204de974f73753c7e28d7638e7b3691bb8b1a2bab6b25bb7fed7ce77

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:15 GMT
X-Powered-By
Express
Transfer-Encoding
chunked
Access-Control-Allow-Methods
GET,PUT,POST,DELETE,OPTIONS
Content-Type
image/gif
Access-Control-Allow-Origin
*
Connection
keep-alive
Access-Control-Allow-Headers
Origin, X-Requested-With, Content-Type, Accept, Bafp-Eg, Bafp-Ec, Bafp-Eg-T, Bafp-Ec-T
cet.js
dt.clnmde.com/ 		2 B
432 B 		XHR
General
Check archive.org
Download Go to
Full URL
http://dt.clnmde.com/cet.js?identifier=bafp
Requested by
Host: pxlclnmdecom-a.akamaihd.net
URL: http://pxlclnmdecom-a.akamaihd.net/javascripts/browserfp.min.js?templateId=3
Protocol
HTTP/1.1
Server
54.86.56.206 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-86-56-206.compute-1.amazonaws.com
Software
/ Express
Resource Hash
20ef0f0c8d0eea98772412cea9b3b92612e3e53cb5e59152b5703165f56e8a53

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Origin
http://securityaffairs.co

Response headers

Date
Tue, 20 Mar 2018 15:39:15 GMT
X-Powered-By
Express
ETag
W/"2-1M0Nq89MqiKtkvq0CETHhg"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET,PUT,POST,DELETE,OPTIONS
Content-Type
text/html; charset=utf-8
Access-Control-Allow-Origin
*
Connection
keep-alive
Access-Control-Allow-Headers
Origin, X-Requested-With, Content-Type, Accept, Bafp-Eg, Bafp-Ec, Bafp-Eg-T, Bafp-Ec-T
Content-Length
2
cec.js
dt.clnmde.com/ 		2 B
432 B 		XHR
General
Check archive.org
Download Go to
Full URL
http://dt.clnmde.com/cec.js?identifier=bafp
Requested by
Host: pxlclnmdecom-a.akamaihd.net
URL: http://pxlclnmdecom-a.akamaihd.net/javascripts/browserfp.min.js?templateId=3
Protocol
HTTP/1.1
Server
54.86.56.206 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-86-56-206.compute-1.amazonaws.com
Software
/ Express
Resource Hash
20ef0f0c8d0eea98772412cea9b3b92612e3e53cb5e59152b5703165f56e8a53

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Origin
http://securityaffairs.co

Response headers

Date
Tue, 20 Mar 2018 15:39:15 GMT
X-Powered-By
Express
ETag
W/"2-1M0Nq89MqiKtkvq0CETHhg"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET,PUT,POST,DELETE,OPTIONS
Content-Type
text/html; charset=utf-8
Access-Control-Allow-Origin
*
Connection
keep-alive
Access-Control-Allow-Headers
Origin, X-Requested-With, Content-Type, Accept, Bafp-Eg, Bafp-Ec, Bafp-Eg-T, Bafp-Ec-T
Content-Length
2
ptmd
dt.clnmde.com/ 		70 B
446 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://dt.clnmde.com/ptmd?t=152156035435931124477280_N4Ig1ghiBcICYA4AMBGArEgxkgtAJkzQBYcUUBTBHBAZghRwjjU3IDYtMB2OPEAGnAAjGCkGYAbjBDAAOiADO5BQoCWAewB2AfQUAXdQCcIAc3Lzo8xKgzZ8hEmUrU6DJi3aceeef3mZ1dTBVcm04CD0ICytkdCxcAmJSCipaekZmVg5Mbl55AF8BRUi9AFcFGABtAE4AXUEALyhoMRAABxNpKUFyTSlYNqKTAAtpdDx0DhpiaeqaMjwiIi4uPGQivQrYFCI8auQuIjY8NDQEIoktkDYAOiQbibYiiAAbGBpBADNMGFIe5pAcyEcBQBASmBo1WSzmB5E+OE+qyEbC47DQeDYcCK5D0qlE6MmSGmREE+k60CQpLA0mO1UWqGqXAwKCKCjAAHc9GMCWgpsRtLT6ShGczsapBtsiAgHmgUDciGgZURWS99NyJryicQ1lwii9PqJxOU9NpVFjYAgAMIAVTQACEACJsACiAHUhj8Wjy+ad5oIAI7kUT5IA
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
54.86.56.206 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-86-56-206.compute-1.amazonaws.com
Software
/ Express
Resource Hash
c414cd0e204de974f73753c7e28d7638e7b3691bb8b1a2bab6b25bb7fed7ce77

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:15 GMT
X-Powered-By
Express
Transfer-Encoding
chunked
Access-Control-Allow-Methods
GET,PUT,POST,DELETE,OPTIONS
Content-Type
image/gif
Access-Control-Allow-Origin
*
Connection
keep-alive
Access-Control-Allow-Headers
Origin, X-Requested-With, Content-Type, Accept, Bafp-Eg, Bafp-Ec, Bafp-Eg-T, Bafp-Ec-T
ads
securepubads.g.doubleclick.net/gampad/ Frame 2A96 		2 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&correlator=1790691248066774&output=json_html&callback=googletag.impl.pubads.callbackProxy1&impl=fif&adsid=NT&eid=21061261%2C21061149%2C21061242%2C21061568&sc=0&sfv=1-0-17&iu=%2F45361917%2F8CU5BD6EW-762221962-300x250_inside_post&sz=300x250&scp=crid%3D762221962%26mnet_segment%3D0.90%26mnet_variant%3D0%26pub_domain%3Dsecurityaffairs.co%26mnet_cc%3DDE%26mnet_ref_ybn%3D1&eri=4&cookie_enabled=1&lmt=1521560355&dt=1521560355670&ea=0&frm=23&biw=1585&bih=1200&isw=300&ish=250&oid=3&adx=320&ady=2247&adk=3177995050&gut=v2&ifi=1&ifk=652960182&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&nhd=1&iag=3&url=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F70299%2Fmalware%2Frottensys-botnet.html&top=securityaffairs.co&dssz=4&icsg=34&std=0&vrg=188&vis=1&scr_x=0&scr_y=0&ga_vid=1364216025.1521560354&ga_sid=1521560356&ga_hid=920629934
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_188.js
Protocol
SPDY
Server
172.217.16.162 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f162.1e100.net
Software
cafe /
Resource Hash
6de94eed26d5412d87b7b2e72e2d2f0e3aea38903c3f975d77323ac98314e32b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date
Tue, 20 Mar 2018 15:39:16 GMT
content-encoding
gzip
x-content-type-options
nosniff
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="41,39,35"
content-length
1395
x-xss-protection
1; mode=block
google-lineitem-id
731778557
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
33134140517
content-type
text/javascript; charset=UTF-8
cache-control
no-cache, must-revalidate
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
pubads_impl_rendering_188.js
securepubads.g.doubleclick.net/gpt/ Frame 2A96 		41 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_188.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_188.js
Protocol
SPDY
Server
172.217.16.162 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f162.1e100.net
Software
sffe /
Resource Hash
a6ae50acb2000fab66cfd21243ebe3e48bcda59331a4b39100cd9152407ce757
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date
Tue, 20 Mar 2018 15:39:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 15 Mar 2018 19:35:31 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="41,39,35"
content-length
14686
x-xss-protection
1; mode=block
expires
Tue, 20 Mar 2018 15:39:15 GMT
container.html
tpc.googlesyndication.com/safeframe/1-0-17/html/ Frame 2A96 		0
0 		Other
General
Check archive.org
Download Go to
Full URL
http://tpc.googlesyndication.com/safeframe/1-0-17/html/container.html?n=1
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_188.js
Protocol
HTTP/1.1
Server
216.58.206.1 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s20-in-f1.1e100.net
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Purpose
prefetch
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Wed, 28 Feb 2018 18:53:28 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Tue, 27 Feb 2018 14:43:12 GMT
Server
sffe
Age
1716347
Vary
Accept-Encoding
Content-Type
text/html
Cache-Control
public, immutable, max-age=31536000
Accept-Ranges
bytes
Timing-Allow-Origin
*
Content-Length
1451
X-XSS-Protection
1; mode=block
Expires
Thu, 28 Feb 2019 18:53:28 GMT
ptmd
dt.clnmde.com/ 		70 B
446 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://dt.clnmde.com/ptmd?t=152156035435931124477280_N4IgpgHiBcIAwgDQgM4GMD2MQEYCsATPgGxwDMeALAPrEECcBlcO9A7Hi0qpgGYw5k6DABds+InlIUadRs1YcW1ABwAjAnBVs1OOATT0wZMHl68wAExxoclNiqvqH3YSP7RBPUZfGES5FS0DEws7Jw41AQAhjhsvGphvNEqKuS8aGhsxNGUZGxoxI4EBBSumCKWHl5gANbR2JZpaATEZHAAtAZUHTg4YCodqfSDphqWbDFklpYIyHVqAshoAG4o2MAAOqhgKCgAlhgAdtQoIhgATtEA5mDb0NtNcC1tnd2Uvf2Dw6N445PRaazbaIbaYDC1fZgaiWaIiaL3R7NVrtLpoHp9AZDFQjDpjAgTKYzODbAC+rnhIgArutoABtUoAXWQAC8Gp5kAAHa7YFbcMBHPmwTnca4ACz8kmkVAo9DIfSY9kmaW4IlpuEoDDSbEodDweBU3DW2GIADo4KaiMRuNEADYwMjIDIwXrzdkgOVqawGN5oMj0T5Yr1gXgdXiTNTENhgYiEYi+eYifYCfxSQKUIQiHnQOBCWomkIKcJcPMAdzEsAkARkwXkYSUOH5+xFlcoKkteBwpsoeA7lFctrOkurVAI2m4tuqyxpImo+18sBUAGEAKp4ABCABFiABRADqorQKalgTwk0dIAAjmABKSgA
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
54.86.56.206 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-86-56-206.compute-1.amazonaws.com
Software
/ Express
Resource Hash
c414cd0e204de974f73753c7e28d7638e7b3691bb8b1a2bab6b25bb7fed7ce77

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:15 GMT
X-Powered-By
Express
Transfer-Encoding
chunked
Access-Control-Allow-Methods
GET,PUT,POST,DELETE,OPTIONS
Content-Type
image/gif
Access-Control-Allow-Origin
*
Connection
keep-alive
Access-Control-Allow-Headers
Origin, X-Requested-With, Content-Type, Accept, Bafp-Eg, Bafp-Ec, Bafp-Eg-T, Bafp-Ec-T
acj
medianet-d.openx.net/w/1.0/ Frame D1D8 		362 B
752 B 		Script
General
Check archive.org
Download Go to
Full URL
http://medianet-d.openx.net/w/1.0/acj?ai=be377f37-02be-487d-99d2-2c61d8eb7c49&o=3632603093&callback=OX_mNCM_3632603093&ju=http%3A//securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html&jr=&auid=538672497&dims=1600x1200&adxy=0%2C0&res=1600x1200x24&plg=pm&ch=UTF-8&tz=0&ws=0x0&ifr=1&tws=1600x1200&si=7942194415&nl=85&ul=303
Requested by
Host: medianet-d.openx.net
URL: http://medianet-d.openx.net/w/1.0/jstag?oxns=mNCM
Protocol
HTTP/1.1
Server
173.241.240.220 New York, United States, ASN36089 (OPENX-AS1 - OPENX TECHNOLOGIES, INC., US),
Reverse DNS
ox-173-241-240-220.xa.dc.openx.org
Software
OXGW/15.0.0 /
Resource Hash
25bc27bc2bca833ca72b130bd70a7a3139337edc9b3ccae76e5b0a9ccfedbddc

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Mar 2018 15:39:15 GMT
Content-Encoding
gzip
Server
OXGW/15.0.0
Vary
Accept
P3P
CP="CUR ADM OUR NOR STA NID"
Cache-Control
private, max-age=0, no-cache
Transfer-Encoding
chunked
Content-Type
application/json
Expires
Mon, 26 Jul 1997 05:00:00 GMT
integrator.js
adservice.google.com/adsid/ Frame E19E 		111 B
172 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=securityaffairs.co
Requested by
Host: www.googletagservices.com
URL: http://www.googletagservices.com/tag/js/gpt.js
Protocol
SPDY
Server
172.217.22.98 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s18-in-f2.1e100.net
Software
cafe /
Resource Hash
207461e411e1ff6d6c5b0dd702d26031adb86de86ed3f571baa5a6fc498fc4b6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 20 Mar 2018 15:39:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="41,39,35"
content-length
105
x-xss-protection
1; mode=block
pubads_impl_188.js
securepubads.g.doubleclick.net/gpt/ Frame E19E 		183 KB
0 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_188.js
Requested by
Host: www.googletagservices.com
URL: http://www.googletagservices.com/tag/js/gpt.js
Protocol
SPDY
Server
172.217.16.162 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f162.1e100.net
Software
sffe /
Resource Hash
855538077b6944e6a4300454d027510188c642643017949aaa8aa58652096f3d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Response headers

date
Tue, 20 Mar 2018 15:39:14 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 15 Mar 2018 19:35:31 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="41,39,35"
content-length
65992
x-xss-protection
1; mode=block
expires
Tue, 20 Mar 2018 15:39:14 GMT
ptmd
dt.clnmde.com/ 		70 B
446 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://dt.clnmde.com/ptmd?t=152156035435931124477280_N4IgpghgNiBcDaBdANOCAHO8QEYAsAHAHQBMArDkXmUTgOwAMIq+x5l1pZeIKIAzgBcIggK78sOAnwBeEODlToA5nBAA3ZuAB2m2CEyplACzU4yJcwDYGAZm72AnLZw4SePHTokCTVIIl9fBJHXzo8K3IyAi11QJArIgZSHCstaDhbVAAzAGM4AFpFNDVnACMAEzdchgKSXNtHIpwwAgLKsGyC7O8yqzowKwsrCq0wQQBLBQtrO25UIVVYBgWAazVIx3cGHEc6Mh2tflWAd0EzGbIbezwAfU3t3f3D1DAJzCDCLg4ach4FqBCC6WK5zPA+OhaKDZBSoXLiQS3CajfQEADCAFUyAAhAAiVgAogB1LTKfKwcwg65kMiORwrEAARzACgAvkA
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
54.86.56.206 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-86-56-206.compute-1.amazonaws.com
Software
/ Express
Resource Hash
c414cd0e204de974f73753c7e28d7638e7b3691bb8b1a2bab6b25bb7fed7ce77

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:16 GMT
X-Powered-By
Express
Transfer-Encoding
chunked
Access-Control-Allow-Methods
GET,PUT,POST,DELETE,OPTIONS
Content-Type
image/gif
Access-Control-Allow-Origin
*
Connection
keep-alive
Access-Control-Allow-Headers
Origin, X-Requested-With, Content-Type, Accept, Bafp-Eg, Bafp-Ec, Bafp-Eg-T, Bafp-Ec-T
kbb.php
contextual.media.net/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://contextual.media.net/kbb.php?cme=yINvVCFxqLMbSqDgxM-acxgbv-13pHyD4y-MDQGBFdYUXQ-wXrJy0CPtTuDt0RSSxaoVDeZ3XY07KQMY9eHzta_iCBriuV7UZ-_IHi2pj1EhY9RBBPiQi5dCn9e6EzY48y5LXNPAQ9E%3D%7C%7CNDHRnZ9Gz3KXlI-i9OnZqQ%3D%3D%7C5gDUJdTGiJzedmq9hanWYg%3D%3D%7CN7fu2vKt8_s%3D%7CwQKqVZNVxsiGNthX_x6E7c3ZldeNVrJ-RbaPXw1kck92gsm6AvIigX3MW3pWhxL8NxEf4sQpuUQFR149KyILolnB78-c2gzt%7CsRBSg3CPSiQ%3D%7C&srp=ZPL-DvhZL6tgmKrUtO99v1m1jGIaBP3UQzvhFqmHrZ26Uq_-84s4pKDauc3HElwQ&klp=KhXY8Cg8FbUKCHd3h5-e_mSKJDta7JPTZr3bNUuIpIZY81Rn164XnbJ2ZUgAcSjd0NpMy64uX8DvMNO-D3t1K3HTaqdo7wX5_p-gRKDtKseA0DqzQjn4pvOezaq-coUIcHOxsY_rbn0hCgFId7pnh_-DpE-DpayZbf5rxbUZ6OtuLMQAi7gr8HP9_Ysk9EXrDnrDrDtNFdSyOGVM5Cuuj42KhaCy0u2j4FGba-yyBUjSwbIPHTUo_3LNgBHNRK5Ig1h6pCuYDN4jXjnoOeYdHkOmHmOy4F6Nz1jb3epnjovj39mryavaYMZK9oM6n-VZGk92Ed7FZK0%3D&nse=3&bid=210870&cb=resultPageUtil.kwdRandmzn[%271521560354418830645%27]
Requested by
Host: contextual.media.net
URL: http://contextual.media.net/fcmdynet.js?&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=184323154&size=300x250&cc=DE&wsip=2886780940&vif=1&requrl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F70299%2Fmalware%2Frottensys-botnet.html&nse=3&vi=1521560354418830645&lw=1&ugd=4&re=1&ourl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F70299%2Fmalware%2Frottensys-botnet.html&osrc=metatag&hlt=1&dfp=1&rtbs=1
Protocol
HTTP/1.1
Server
104.90.192.189 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-90-192-189.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
982421ce4236bc3b2be7cc5c11d09c5a95e61548fabf22c8b98680019c08f578

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Mar 2018 15:39:16 GMT
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
Content-Type
text/javascript; charset=utf-8
X-MNET-KBB
E2
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
734
Expires
Tue, 20 Mar 2018 15:39:16 GMT
mediamain.html
contextual.media.net/ Frame 6E37 		48 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://contextual.media.net/mediamain.html?&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=184323154&pid=8PO5M70HK&size=300x250&cpnet=yVb1sHm-0KIh29BOFTjjrHvHwrQGlpByWaOO1vn303s%3D&cme=yINvVCFxqLMbSqDgxM-acxgbv-13pHyD4y-MDQGBFdYUXQ-wXrJy0CPtTuDt0RSSxaoVDeZ3XY07KQMY9eHzta_iCBriuV7UZ-_IHi2pj1EhY9RBBPiQi5dCn9e6EzY48y5LXNPAQ9E%3D%7C%7CNDHRnZ9Gz3KXlI-i9OnZqQ%3D%3D%7C5gDUJdTGiJzedmq9hanWYg%3D%3D%7CN7fu2vKt8_s%3D%7CwQKqVZNVxsiGNthX_x6E7c3ZldeNVrJ-RbaPXw1kck92gsm6AvIigX3MW3pWhxL8NxEf4sQpuUQFR149KyILolnB78-c2gzt%7CsRBSg3CPSiQ%3D%7C&cc=DE&bf=0&vif=1&nse=3&bid=210870&vi=1521560354418830645&lw=1&ugd=4&ib=0&ourl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F70299%2Fmalware%2Frottensys-botnet.html&osrc=metatag&katid=800384229&katbid=-14&nb=1
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
104.90.192.189 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-90-192-189.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
18edeb310355e52f33047c7e4ddfd39b61cd6d09fff02edac49a2a2878f6c9cb

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:16 GMT
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
Content-Type
text/javascript
Cache-Control
max-age=300
X-MNET-HL3
E
Connection
keep-alive
Content-Length
12676
Expires
Tue, 20 Mar 2018 15:44:16 GMT
nmedianet.js
contextual.media.net/ 		109 KB
38 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://contextual.media.net/nmedianet.js?cid=8CU5BD6EW
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
104.90.192.189 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-90-192-189.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
af3661ba51edf3da65414119d0b8042aee9cf1312c39b8652070b6ae3de24cee

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Mar 2018 15:39:16 GMT
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
X-MNET-H
E
Content-Type
text/javascript; charset=utf-8
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
38558
Expires
Tue, 20 Mar 2018 15:39:16 GMT
ads
securepubads.g.doubleclick.net/gampad/ Frame E19E 		2 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&correlator=1310800520731846&output=json_html&callback=googletag.impl.pubads.callbackProxy1&impl=fif&adsid=NT&eid=21061149%2C21061242%2C21061568&sc=0&sfv=1-0-17&iu=%2F45361917%2F8CU5BD6EW-184323154-Single_post_ads&sz=300x250&scp=crid%3D184323154%26mnet_segment%3D0.67%26mnet_variant%3D15%26pub_domain%3Dsecurityaffairs.co%26mnet_cc%3DDE%26mnet_ref_ybn%3D1&eri=4&cookie_enabled=1&lmt=1521560356&dt=1521560356376&ea=0&frm=23&biw=1585&bih=1200&isw=300&ish=250&oid=2&adx=973&ady=433&adk=2598375999&gut=v2&ifi=1&ifk=652960182&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&nhd=1&iag=3&url=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F70299%2Fmalware%2Frottensys-botnet.html&top=securityaffairs.co&dssz=4&icsg=34&std=0&vrg=188&vis=1&scr_x=0&scr_y=0&ga_vid=1364216025.1521560354&ga_sid=1521560356&ga_hid=198358741
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_188.js
Protocol
SPDY
Server
172.217.16.162 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f162.1e100.net
Software
cafe /
Resource Hash
00fc25d330bf8ee768abd4872c06d1d37733118224a872988368a58758f05082
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Origin
http://securityaffairs.co

Response headers

date
Tue, 20 Mar 2018 15:39:16 GMT
content-encoding
gzip
x-content-type-options
nosniff
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="41,39,35"
content-length
1402
x-xss-protection
1; mode=block
google-lineitem-id
731772917
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
33134142677
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
http://securityaffairs.co
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
pubads_impl_rendering_188.js
securepubads.g.doubleclick.net/gpt/ Frame E19E 		41 KB
0 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_188.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_188.js
Protocol
SPDY
Server
172.217.16.162 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f162.1e100.net
Software
sffe /
Resource Hash
a6ae50acb2000fab66cfd21243ebe3e48bcda59331a4b39100cd9152407ce757
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Response headers

date
Tue, 20 Mar 2018 15:39:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 15 Mar 2018 19:35:31 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="41,39,35"
content-length
14686
x-xss-protection
1; mode=block
expires
Tue, 20 Mar 2018 15:39:15 GMT
container.html
tpc.googlesyndication.com/safeframe/1-0-17/html/ Frame E19E 		0
0 		Other
General
Check archive.org
Download Go to
Full URL
http://tpc.googlesyndication.com/safeframe/1-0-17/html/container.html?n=1
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_188.js
Protocol
HTTP/1.1
Server
216.58.206.1 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s20-in-f1.1e100.net
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Purpose
prefetch
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Wed, 28 Feb 2018 18:53:28 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Tue, 27 Feb 2018 14:43:12 GMT
Server
sffe
Age
1716348
Vary
Accept-Encoding
Content-Type
text/html
Cache-Control
public, immutable, max-age=31536000
Accept-Ranges
bytes
Timing-Allow-Origin
*
Content-Length
1451
X-XSS-Protection
1; mode=block
Expires
Thu, 28 Feb 2019 18:53:28 GMT
nrr.js
contextual.media.net/__media__/js/util/ Frame 4DDF 		56 KB
0 		Script
General
Check archive.org
Download Go to
Full URL
http://contextual.media.net/__media__/js/util/nrr.js?v=79
Requested by
Host: contextual.media.net
URL: http://contextual.media.net/nmedianet.js?cid=8CU5BD6EW
Protocol
HTTP/1.1
Server
104.90.192.189 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-90-192-189.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
9869bf998d9dee691349d634a714bf20d6bde49c9d5160eb1cf103f76c4738e5

Request headers

Response headers

Date
Tue, 20 Mar 2018 15:39:14 GMT
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=1209600
Connection
keep-alive
Content-Length
19030
Expires
Tue, 03 Apr 2018 15:39:14 GMT
11354_d2e9c37e359ed9ee8ba98baecc5834b2.png
contextual.media.net/__media__/images/800000006/ Frame 4DDF 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://contextual.media.net/__media__/images/800000006/11354_d2e9c37e359ed9ee8ba98baecc5834b2.png
Requested by
Host: contextual.media.net
URL: http://contextual.media.net/__media__/js/util/nrr.js?v=79
Protocol
HTTP/1.1
Server
104.90.192.189 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-90-192-189.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
0a6b90b75ea7a7ffcf626ab21af202818e7f820e487ba05c122e68c4702a843d

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:16 GMT
Last-Modified
Mon, 12 Feb 2018 11:51:32 GMT
Server
Apache
Content-Type
image/png
Cache-Control
max-age=1209600
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
2049
Expires
Tue, 03 Apr 2018 15:39:16 GMT
bullet1.woff
contextual.media.net/__media__/fonts/bullet1/ Frame 4DDF 		2 KB
2 KB 		Font
General
Check archive.org
Download Go to
Full URL
http://contextual.media.net/__media__/fonts/bullet1/bullet1.woff
Requested by
Host: contextual.media.net
URL: http://contextual.media.net/__media__/js/util/nrr.js?v=79
Protocol
HTTP/1.1
Server
104.90.192.189 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-90-192-189.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
d9ac862518df3efb07d7cecda391ab683489cf26fa04d62e179ba60869dd69bb

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Origin
http://securityaffairs.co

Response headers

Date
Tue, 20 Mar 2018 15:39:16 GMT
Last-Modified
Mon, 16 May 2016 10:39:41 GMT
Server
Apache
Content-Type
application/font-woff
Access-Control-Allow-Origin
*
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1792
osd_listener.js
tpc.googlesyndication.com/pagead/js/r20180312/r20110914/activeview/ Frame 4CE7 		71 KB
26 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20180312/r20110914/activeview/osd_listener.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_188.js
Protocol
SPDY
Server
216.58.206.1 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s20-in-f1.1e100.net
Software
cafe /
Resource Hash
5ca0636ee5ba9229b08ea875292b99b035d0794fa922a5f1eeab0ff4ed766ec0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date
Mon, 12 Mar 2018 13:21:37 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
699459
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="41,39,35"
content-length
26437
x-xss-protection
1; mode=block
server
cafe
etag
5447488165261728430
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Mon, 26 Mar 2018 13:21:37 GMT
osd.js
pagead2.googlesyndication.com/pagead/ Frame 2A96 		75 KB
76 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://pagead2.googlesyndication.com/pagead/osd.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_188.js
Protocol
HTTP/1.1
Server
216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s20-in-f2.1e100.net
Software
cafe /
Resource Hash
74a78cea892f43d01c7573729c200c97dfebe5835476364435e411d0a674e28a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Timing-Allow-Origin
*
Date
Tue, 20 Mar 2018 15:11:27 GMT
X-Content-Type-Options
nosniff
Server
cafe
Age
1669
ETag
13992280071806881209
P3P
policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Cache-Control
public, max-age=3600
Content-Disposition
attachment; filename="f.txt"
Content-Type
text/javascript; charset=ISO-8859-1
Content-Length
76885
X-XSS-Protection
1; mode=block
Expires
Tue, 20 Mar 2018 16:11:27 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 4CE7 		0
295 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstZ8sF6UenBf9ItAYm4qMqA7tufiGX-n49Aa3j0wTyq09bd9qPxUq1M9_JnA164wbse0UMUWq3ytSeGO0gq1u9B7V7c0sDoBvrq1iOCYZHjOuVlka3ebUK2fusO05oHr6-_EWHK99JE1yKrnFRhufg0V9XnZ5X0XtZhS8kFSw2yPSGYUb2m8Ym4mHp0OFPEzoY8aFV7jYM25qHW4HodRR4m3gkoiVeztFbpXmtO7pYod_mDru0bHY_G0Ph4ezBqAvz-yXDqj4uLDn_Mc-dVmBpUmZ5x2aceuA&sig=Cg0ArKJSzOoJ51c8VMKQEAE&urlfix=1&adurl=
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
SPDY
Server
172.217.16.162 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f162.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 20 Mar 2018 15:39:16 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
private
content-type
text/html; charset=UTF-8
alt-svc
hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="41,39,35"
content-length
0
x-xss-protection
1; mode=block
expires
Tue, 20 Mar 2018 15:39:16 GMT
pixel
opt-east.media.net/rtbs/ 		43 B
287 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://opt-east.media.net/rtbs/pixel?key=9%3A%3A20180320%3A%3A15%3A%3ADE%3A%3A10.6.3.2_7017&value=90&bid=9&country=DE&cid=8CU5BD6EW&crid=762221962&domain=securityaffairs.co&size=300x250&buyerid=null
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
104.90.192.189 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-90-192-189.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Mar 2018 15:39:16 GMT
Server
nginx
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
43
Expires
Tue, 20 Mar 2018 15:39:16 GMT
exchangenotify
opt.media.net/ybnca/ 		43 B
287 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://opt.media.net/ybnca/exchangenotify?aid=null&domain=securityaffairs.co&price=0.9&cgid=17608&cid=88855&rid=2243185&url=&cc=DE&td=&lid=&t=1521560354081
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
104.90.192.189 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-90-192-189.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Mar 2018 15:39:16 GMT
Server
nginx
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
43
Expires
Tue, 20 Mar 2018 15:39:16 GMT
log
qsearch-a.akamaihd.net/ 		35 B
312 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://qsearch-a.akamaihd.net/log?logid=kfk&evtid=rtbstl&url=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F70299%2Fmalware%2Frottensys-botnet.html&domain=securityaffairs.co&size=300x250&ext_user_id=0&iid=0&auction_id=b449f6d07068405e9aa3f3582ee6acb8&ip=148.251.45.254&crid=762221962&b4b=1.01&b9b=0.9&bc=0.9&rtbW=9&app_dis=0&cc=DE&rc=HE&bname=&bid_type=-1&bmlevel=0&mnet_segment=0.90&cmw=9&dfp=1&source=2&dt=4
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
2.16.186.67 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-186-67.deploy.akamaitechnologies.com
Software
Apache /
Resource Hash
0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Mar 2018 15:39:16 GMT
Server
Apache
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
35
Expires
Tue, 20 Mar 2018 15:39:16 GMT
ptmd
dt.clnmde.com/ 		70 B
446 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://dt.clnmde.com/ptmd?t=152156035435931124477280_N4IgtgniBcDasEYA0BmATABiQNk0taALAOz6ECcxAukrGqnrlgSWZVTSAO4COMsnAMYAnMAAd+IYrgIJyuAPoBzMQBcFCEEiky0cxWACGASwB2CtCE6GANqphYQhgCY3nD7QGdVh1QFdPfhROAC9DGGQQMSUYEAA3LRAAU1ME6CjEpQALWIQAVj087AwUPMJS8hQEBCISYjQADgxE1UD0hEI0cibiQlw8vIbEuLaQbAA6DHG9bETbGBRtADNBGABaSKTw9MqAI2cawQw1tEEUcg2EJIa1-aSltaX63exiJOwC7HdtJNVjCIK+WKpUIXlUMWgjk8AGtYrhyEQMHJiHkkYkYVx7O1AUUSmUFPDEcjUZofsYJO1CA1pnkEONCHkaYR0TZvLkccCyo1iIkbEsItpBAF1MZ3OkGgBhACqeQAQgARbAAUQA6plVtB8oVOdhsBRtDwkhEAL5AA
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
54.86.56.206 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-86-56-206.compute-1.amazonaws.com
Software
/ Express
Resource Hash
c414cd0e204de974f73753c7e28d7638e7b3691bb8b1a2bab6b25bb7fed7ce77

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:16 GMT
X-Powered-By
Express
Transfer-Encoding
chunked
Access-Control-Allow-Methods
GET,PUT,POST,DELETE,OPTIONS
Content-Type
image/gif
Access-Control-Allow-Origin
*
Connection
keep-alive
Access-Control-Allow-Headers
Origin, X-Requested-With, Content-Type, Accept, Bafp-Eg, Bafp-Ec, Bafp-Eg-T, Bafp-Ec-T
ptmd
dt.clnmde.com/ 		70 B
446 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://dt.clnmde.com/ptmd?t=152156035435931124477280_N4IgtgniBcDasEYA0BmATABiQNk0taALAOz6ECcxAukrGqnrlgSWZTbCkpVwmsV0Iou2ABwoqNEAHcAjjFhSAxgCcwABwUhiuAgnK4A+gHN1AF0MIQSbbrT6jYAIYBLAHaG01kAlFC0KAgArIQm5oYoIFJOADZmMFggTgAmMckJNgDOZk5mAK6ZChI2AF5OMMgg6sYwIABu3gCmbg3QVd7GABa1wfZB2BgoIUPkgXyEJMRoohjeZoVtCIRo5DPEhLhBQaLedQsg2AB0GIf22N6xMFwgAGZKMAC0lY3lbaMARsl8ShgPaEoochPBCNUQPT6NG4PG5Td7YYiNbBBNDYdI2RpmFwVZHBAZDQhZMw1aCJTIAa1quHIRAw+mIQVp3nJ0niixx-UGIUMVJpdIZVnRLk0i0IolOQQQh0IQXFhCZMWyPXZeJC02I3hiNwqNiUBQsLnSbVEAGEAKpBABCABFsABRADqHXu0F6uM52A99BAskaFQAvkA
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
54.86.56.206 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-86-56-206.compute-1.amazonaws.com
Software
/ Express
Resource Hash
c414cd0e204de974f73753c7e28d7638e7b3691bb8b1a2bab6b25bb7fed7ce77

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:16 GMT
X-Powered-By
Express
Transfer-Encoding
chunked
Access-Control-Allow-Methods
GET,PUT,POST,DELETE,OPTIONS
Content-Type
image/gif
Access-Control-Allow-Origin
*
Connection
keep-alive
Access-Control-Allow-Headers
Origin, X-Requested-With, Content-Type, Accept, Bafp-Eg, Bafp-Ec, Bafp-Eg-T, Bafp-Ec-T
bql.php
qsearch.media.net/ Frame 4DDF 		15 B
355 B 		Script
General
Check archive.org
Download Go to
Full URL
http://qsearch.media.net/bql.php?v=1&hvsid=00001521560353873024994892789957&geo=50.12|8.68&lper=100&bdrid=9&fp=EIMN-ehR7Pps_CSyS_Yzo-2i1OixKc5bW9c2mufwmM6qC9U44Q2KYLa-R5LaAmGWV8HtW4vcj2SgWYmMUI9AYws1HqGHMwGtYeJ5lrHG6-3pxc46ofGI0zW4FDhuQGp29K_xrFOTxuw%3D&lpid=&tsid=1&ksu=112&q=&prv=&type=&ps=&cme=mglV8PLGT-XQhRlc2_xrJ6mVb2gOA5zkGL4KL8244s4V17GGsdGx6gPqz_d-a-WxXa7-WcKgG2COcqIzIiU1UEp0CkCqwC9hmeY6herVUzKemo8u4F-pJutUYcdzkz7J7bPOZWmpCWy3VvuMyXwIWPJ8NHCA6kf1_B9LMhFk0r-ujyAyWjs-Oy3Rz_Y18vnq6yIZe5li53VXeQ_WLbpmog%3D%3D%7C%7CNDHRnZ9Gz3KXlI-i9OnZqQ%3D%3D%7C5gDUJdTGiJzedmq9hanWYg%3D%3D%7CN7fu2vKt8_s%3D%7CwQKqVZNVxsiGNthX_x6E7c3ZldeNVrJ-RbaPXw1kck92gsm6AvIigX3MW3pWhxL8NxEf4sQpuUQFR149KyILolnB78-c2gzt%7CsRBSg3CPSiQ%3D%7CQ17RdJBhJoHRDqnP2wneM1rxkOFIR2-_KbOvqUh8RACShrAzGEmTzuRLnvKjI_N_BgnauRLzs_WJWKpdcsnQ7QWnu4LfS2W9dl9r8ukgpl8BV7G7EqSflsrwDqo1ngfe6rLZvVTpEVljAn13aA3L0u41_8UUjiCvewe5Hntg-EcjTtY0IW4G6A%3D%3D%7C&hint=&td=&cc=DE&wsip=2886958209&bca=0&ugd=4&&rc=0&fdkt=262&kwd[]=Must%20Have%20Android%20Apps&kwt[]=262&kbc[]=38481&kwp[]=1&kid[]=276697959&kbc2[]=rpc%3D0.15&ktd[]=274911592448&kwd[]=10%20Best%20Android%20Phones&kwt[]=262&kbc[]=38481&kwp[]=2&kid[]=294211106&kbc2[]=rpc%3D0.08&ktd[]=274911592448&kwd[]=2018%20Upcoming%20Android%20Phones&kwt[]=262&kbc[]=38481&kwp[]=3&kid[]=326811187&kbc2[]=rpc%3D0.03&ktd[]=274894815232&kwd[]=Android%20Phone%20Price%20Lists&kwt[]=262&kbc[]=38481&kwp[]=4&kid[]=321841506&kbc2[]=rpc%3D0.01&ktd[]=824667406336&kwd[]=Refurbished%20Smart%20Phones&kwt[]=262&kbc[]=143282&kwp[]=5&kid[]=148290072&kbc2[]=38481%7C%7C%7C%7Crpc%3D0.24&ktd[]=274911793152&rand=1521560356545&cid=8CU5BD6EW&vwid=1521560353868058059&vi=1521560353868058059&l3ch=1&slnkp=no&bdrct=0.9&rt=301&tdAdd[]=rtbsd%3D10&tdAdd[]=ib=0&matchstring=&dytm=1521560354688&rtbsd=10&kbbq=%26sde%3D1%26adepth%3D1%26ddepth%3D1%26asn%3D24940&tdAdd[]=%7C%40%7Csde%3D1%7C%40%7Cadepth%3D1%7C%40%7Cddepth%3D1%7C%40%7CopenxEnabled%3Dtrue&verid=111299&hvsid=00001521560353873024994892789957&upk=1521560354.27618&sttm=1521560353872&=&vgd_bdata=bb%3D0%7C%7Cbtd%3D655360%7C%7Cfbb%3D0%7C%7Curl_l%3D3%7C%7Cbid%3D1.01%7C%7Cdevice_l%3D2%7C%7Cvariant%3D0&vgd_refimp=0&tdAdd[]=%7C%40%7Cabp%3A3%3A2&tdAdd[]=%7C%40%7Cabp%3A3%3A2&tdAdd[]=%7C%40%7Cabp%3A3%3A2&tdAdd[]=%7C%40%7Cabp%3A3%3A2&tdAdd[]=%7C%40%7Cabp%3A3%3A2&matm=1521560356564&vsid=1645619548927803&lktgd=18&lkpgd=MN%3D9%7C%7CKSE%3D1521560354975%7C%7CPTD2%3D0%7C%7CCI%3D804%7C%7CPTD%3D17592193384960%7C%7CMI%3D804%7C%7CHID%3D2%7C%7CKTGD%3D18%7C%7CAN%3D6%7C%7Cerpm%3D-1.0%7C%7CSID%3D14%7C%7CSI%3D801%7C%7CUUID%3Duuid_s8_2_1521560354_103496689%7C%7CMPTD%3D744&abpl=2&tdAdd[]=nw%3DNone&tdAdd[]=nwType%3DNone&tdAdd[]=asnum%3D24940&tdAdd[]=proxy%3DNone&tdAdd[]=comp%3DNone&vgd_ckkr=1&vgd_ckadt=13&vgd_sc=HE&vgd_katbid=-2&vgd_kals=base&vgd_kalog=SID%3D12%7C%7CMPTD%3D704%7C%7CTPTD%3D4%7C%7CCI%3D804%7C%7CUUID%3Duuid_s12_nc1c_1_1521560354_528345327%7C%7CMI%3D804%7C%7CSI%3D801%7C%7CHID%3D1&vgd_kasts=tstype%3DBASE_BAG%7C%7C&vgd_altbql=sb&vgd_clsKb=2&vgd_pdtid=1&vgd_refcnf=%7B%22a2y%22%3A%7B%22afterLoadSecs%22%3A30%2C%22afterViewSecs%22%3A10%2C%22percentTraffic%22%3A50%7D%7D&vgd_sbSup=1&vgd_ourl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F70299%2Fmalware%2Frottensys-botnet.html&vgd_osrc=metatag&oRurl=http%3A%2F%2Fcdn3ncal.media.net%2Fmediamain.html%3F%26esi%3D1%26%26cid%3D8CU5BD6EW%26cpcd%3DRlAcVccC-RdUYIl-LjF9ag%253D%253D%26crid%3D762221962%26pid%3D8PO5M70HK%26size%3D300x250%26cpnet%3DyVb1sHm-0KIh29BOFTjjrEBbIZGw_v2fXpyZXRW3WVE%253D%26cme%3DFCIgUes4lP8jgFeZgNKmic0rL2-LujhG_F35HOVEMPXoyy-2ZV1jLvon8EUh3DY_9_LIOYRvjrgdsPnTFZGmUkpm--mFnhHqLts4iOKhK47Be1FBgDho4ST02hqPkNFHw83atFSbNK8%253D%257C%257CNDHRnZ9Gz3KXlI-i9OnZqQ%253D%253D%257C5gDUJdTGiJzedmq9hanWYg%253D%253D%257CN7fu2vKt8_s%253D%257CwQKqVZNVxsiGNthX_x6E7c3ZldeNVrJ-RbaPXw1kck92gsm6AvIigX3MW3pWhxL8NxEf4sQpuUQFR149KyILolnB78-c2gzt%257CsRBSg3CPSiQ%253D%257C%26cc%3DDE%26bf%3D0%26vif%3D1%26nse%3D3%26bid%3D210870%26vi%3D1521558915738213809%26lw%3D1%26ugd%3D4%26ib%3D0%26ourl%3Dhttp%253A%252F%252Fsecurityaffairs.co%252Fwordpress%252F70299%252Fmalware%252Frottensys-botnet.html%26osrc%3Dmetatag%26katbid%3D-2%26nb%3D1%26chost%3Dcontextual.media.net%26fvips%3D0%26vpf%3D000%26ap%3D0%26pf%3D0%26isOffice%3D0&tdAdd[]=uiparams%3D%3Brend_w%3A300%3Brend_h%3A250%3Bwin_w%3A1600%3Bwin_h%3A1200%3Bscr_h%3A1200%3Bscr_w%3A1600%3Bx_pos%3A320%3By_pos%3A2247%3Bkwd_scnt%3A5
Requested by
Host: contextual.media.net
URL: http://contextual.media.net/__media__/js/util/nrr.js?v=79
Protocol
HTTP/1.1
Server
2.16.186.113 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-186-113.deploy.akamaitechnologies.com
Software
Apache /
Resource Hash
c787e9dd6dc8ea3c935f5f0f30e3b9e4a3e066b4619bb244f569883f8e318a24

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Mar 2018 15:39:16 GMT
Server
Apache
ntCoent-Length
15
Vary
Accept-Encoding
Content-Type
text/javascript;charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
15
Expires
Tue, 20 Mar 2018 15:39:16 GMT
log
navvy.media.net/ Frame 4DDF 		807 B
1 KB 		Other
General
Check archive.org
Download Go to
Full URL
http://navvy.media.net/log
Requested by
Host: contextual.media.net
URL: http://contextual.media.net/__media__/js/util/nrr.js?v=79
Protocol
HTTP/1.1
Server
54.241.182.29 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-241-182-29.us-west-1.compute.amazonaws.com
Software
Jetty(9.4.7.v20170914) /
Resource Hash
0a4c16b7f5c1b1ecefc9ffb4fcf1b457f9282d0863fa61d4dd32ad98dafa9a60

Request headers

Cache-Control
max-age=0
Origin
http://securityaffairs.co
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Pragma
no-cache
Date
Tue, 20 Mar 2018 15:39:16 GMT
Server
Jetty(9.4.7.v20170914)
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
max-age=0, no-cache,no-store
Connection
keep-alive
Content-Length
807
Expires
Tue, 20 Mar 2018 15:39:16 GMT
pixel
c.ad-srv.co/ Frame 4DDF 		0
127 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://c.ad-srv.co/pixel
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
54.177.132.126 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-177-132-126.us-west-1.compute.amazonaws.com
Software
Varnish /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:16 GMT
Server
Varnish
Connection
keep-alive
X-Varnish
885180243
pixel
c.adyield.co/ Frame 4DDF 		0
126 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://c.adyield.co/pixel
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
52.8.72.42 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-8-72-42.us-west-1.compute.amazonaws.com
Software
Varnish /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:16 GMT
Server
Varnish
Connection
keep-alive
X-Varnish
59584467
ptmd
dt.clnmde.com/ 		70 B
446 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://dt.clnmde.com/ptmd?t=152156035435931124477280_N4IglgbiBcBMA0IDOAXAhigrkmBtAjAJwC6iAXmjPogA4DmMIUiApgHZTQg0iJ0AWjfAFZYIgGwAGAMzCALLMLT8+WHLkB2DbAAck3iBQ4u+ObEJ6Nc8bGHCdBiMZDiAdJNdjxBtABsY0ogAZgDGMAC01CAslFxKAEYAJqohkuGwIdKEkfgsOuFJLEHhQdrx4hos4qLiiQYsKGBUohIy8oioDNCSHQDWjDaEapJEGsIjBki9AO4oQi3CUrJyAPqDw6Pj+PVgPCZyOp7C+K5ywkdyk76o82KLbWY6Gga+QVSIIdgoK2B1XDoAYQAqsIAEIAEXEAFEAOoGOhhaAiO5LRbiQhRACOLCoAF8gA
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
52.86.242.184 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-52-86-242-184.compute-1.amazonaws.com
Software
/ Express
Resource Hash
c414cd0e204de974f73753c7e28d7638e7b3691bb8b1a2bab6b25bb7fed7ce77

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:16 GMT
X-Powered-By
Express
Transfer-Encoding
chunked
Access-Control-Allow-Methods
GET,PUT,POST,DELETE,OPTIONS
Content-Type
image/gif
Access-Control-Allow-Origin
*
Connection
keep-alive
Access-Control-Allow-Headers
Origin, X-Requested-With, Content-Type, Accept, Bafp-Eg, Bafp-Ec, Bafp-Eg-T, Bafp-Ec-T
jstag
medianet-d.openx.net/w/1.0/ Frame 689F 		63 KB
0 		Script
General
Check archive.org
Download Go to
Full URL
http://medianet-d.openx.net/w/1.0/jstag?oxns=mNCM
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
173.241.240.220 New York, United States, ASN36089 (OPENX-AS1 - OPENX TECHNOLOGIES, INC., US),
Reverse DNS
ox-173-241-240-220.xa.dc.openx.org
Software
OXGW/15.0.0 /
Resource Hash
a5fa6e1ad7a4121ebd2c5625f83e6e0883c32e2c1ffbf35bc2743f12717c4313

Request headers

Response headers

Date
Tue, 20 Mar 2018 15:39:14 GMT
Content-Encoding
gzip
Server
OXGW/15.0.0
Vary
Accept-Encoding
P3P
CP="CUR ADM OUR NOR STA NID"
Cache-Control
max-age=3600
Content-Type
text/javascript
Content-Length
22366
Expires
Tue, 20 Mar 2018 16:39:14 GMT
rtbspub
contextual.media.net/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://contextual.media.net/rtbspub?&prid=8PRHGG6T9&cid=8CU5BD6EW&crid=639665355&size=300x600&rp=0.54&vi=1521560356379511616&ugd=4&requrl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F70299%2Fmalware%2Frottensys-botnet.html&useAppData=0&hlt=1&tr=0.16339423825692845
Requested by
Host: contextual.media.net
URL: http://contextual.media.net/nmedianet.js?cid=8CU5BD6EW
Protocol
HTTP/1.1
Server
104.90.192.189 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-90-192-189.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
3e88266cc04e60bb9777d4207222df85dbc99bf1d18538c622dd6fffc17a21a9

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Mar 2018 15:39:16 GMT
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
Content-Type
text/javascript
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
714
X-MNET-HL2
E
Expires
Tue, 20 Mar 2018 15:39:16 GMT
fcmdynet.js
contextual.media.net/ 		33 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://contextual.media.net/fcmdynet.js?&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=639665355&size=300x600&cc=DE&wsip=2886781337&vif=1&requrl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F70299%2Fmalware%2Frottensys-botnet.html&nse=3&vi=1521560356379511616&lw=1&ugd=4&re=1&ourl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F70299%2Fmalware%2Frottensys-botnet.html&osrc=metatag&hlt=1&dfp=1&rtbs=1
Requested by
Host: contextual.media.net
URL: http://contextual.media.net/nmedianet.js?cid=8CU5BD6EW
Protocol
HTTP/1.1
Server
104.90.192.189 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-90-192-189.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
8e1e9a0b5aeb0d5918ce5ba15e51b17fcbebae531b4d0dcc07655ccd04b6858c

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

Date
Tue, 20 Mar 2018 15:39:16 GMT
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
Content-Type
text/javascript;charset=UTF-8
Cache-Control
max-age=300
Connection
keep-alive
Content-Length
12695
X-MNET-HL2
E
Expires
Tue, 20 Mar 2018 15:44:16 GMT
gpt.js
www.googletagservices.com/tag/js/ Frame 1A92 		11 KB
0 		Script
General
Check archive.org
Download Go to
Full URL
http://www.googletagservices.com/tag/js/gpt.js
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s20-in-f2.1e100.net
Software
sffe /
Resource Hash
b3125d3c4f7dfa6652acea2cf7845db41eb5531788f0743c8e08122fb4df1b2b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Response headers

Date
Tue, 20 Mar 2018 15:39:14 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Server
sffe
ETag
"3 / 438 of 1000 / last-modified: 1521490906"
Vary
Accept-Encoding
Content-Type
text/javascript
Cache-Control
private, max-age=900, stale-while-revalidate=3600
Timing-Allow-Origin
*
Content-Length
4922
X-XSS-Protection
1; mode=block
Expires
Tue, 20 Mar 2018 15:39:14 GMT
bping.php
qsearch.media.net/ 		35 B
280 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://qsearch.media.net/bping.php?&prid=8PRHGG6T9&cid=8CU5BD6EW&crid=639665355&vi=1521560356379511616&ugd=4&lf=6&requrl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F70299%2Fmalware%2Frottensys-botnet.html&cc=DE&sc=HE&vsid=1645619548927803&lper=100&wsip=2886781337&r=1521560356747&vgd_sbSup=1&vgd_nvLogging=0&hvsid=00001521560356735024994892787740
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
2.16.186.113 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-186-113.deploy.akamaitechnologies.com
Software
Apache /
Resource Hash
0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Mar 2018 15:39:16 GMT
Server
Apache
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
35
Expires
Tue, 20 Mar 2018 15:39:16 GMT
nrr.js
contextual.media.net/__media__/js/util/ Frame 84A1 		56 KB
0 		Script
General
Check archive.org
Download Go to
Full URL
http://contextual.media.net/__media__/js/util/nrr.js?v=79
Requested by
Host: contextual.media.net
URL: http://contextual.media.net/nmedianet.js?cid=8CU5BD6EW
Protocol
HTTP/1.1
Server
104.90.192.189 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-90-192-189.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
9869bf998d9dee691349d634a714bf20d6bde49c9d5160eb1cf103f76c4738e5

Request headers

Response headers

Date
Tue, 20 Mar 2018 15:39:14 GMT
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=1209600
Connection
keep-alive
Content-Length
19030
Expires
Tue, 03 Apr 2018 15:39:14 GMT
10124_505bb4db55aaa1165fa3b242bf39701b.png
contextual.media.net/__media__/images/800000006/ Frame 84A1 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://contextual.media.net/__media__/images/800000006/10124_505bb4db55aaa1165fa3b242bf39701b.png
Requested by
Host: contextual.media.net
URL: http://contextual.media.net/__media__/js/util/nrr.js?v=79
Protocol
HTTP/1.1
Server
104.90.192.189 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-90-192-189.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
1e9a9ba24042f2effe58a5d585f70a7bc4b917e60ddcb9a780ad03817a78381f

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:17 GMT
Last-Modified
Tue, 03 Oct 2017 12:52:51 GMT
Server
Apache
Content-Type
image/png
Cache-Control
max-age=1209600
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
4097
Expires
Tue, 03 Apr 2018 15:39:17 GMT
osd_listener.js
tpc.googlesyndication.com/pagead/js/r20180312/r20110914/activeview/ Frame C831 		71 KB
0 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20180312/r20110914/activeview/osd_listener.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_188.js
Protocol
SPDY
Server
216.58.206.1 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s20-in-f1.1e100.net
Software
cafe /
Resource Hash
5ca0636ee5ba9229b08ea875292b99b035d0794fa922a5f1eeab0ff4ed766ec0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Response headers

date
Mon, 12 Mar 2018 13:21:37 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
699459
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="41,39,35"
content-length
26437
x-xss-protection
1; mode=block
server
cafe
etag
5447488165261728430
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Mon, 26 Mar 2018 13:21:37 GMT
osd.js
pagead2.googlesyndication.com/pagead/ Frame E19E 		75 KB
0 		Script
General
Check archive.org
Download Go to
Full URL
http://pagead2.googlesyndication.com/pagead/osd.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_188.js
Protocol
HTTP/1.1
Server
216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s20-in-f2.1e100.net
Software
cafe /
Resource Hash
74a78cea892f43d01c7573729c200c97dfebe5835476364435e411d0a674e28a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Response headers

Date
Tue, 20 Mar 2018 15:11:27 GMT
X-Content-Type-Options
nosniff
Content-Type
text/javascript; charset=ISO-8859-1
Server
cafe
Age
1669
ETag
13992280071806881209
P3P
policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Cache-Control
public, max-age=3600
Content-Disposition
attachment; filename="f.txt"
Timing-Allow-Origin
*
Content-Length
76885
X-XSS-Protection
1; mode=block
Expires
Tue, 20 Mar 2018 16:11:27 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame C831 		0
47 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsslMc8Nu_0z9Z4gXN-PeU_Adx3y87VwURYx1U6Xc6V6SZpGHfRdAO6mIFEuqPcJ_nO_1IlBGkzFRmpSUWaZuE3jL77A3IG5mve4LEBp_ARPepIsIOEZdb7Kmzmeym6IOwjrSR62cj4fFdL7lw8prpENs1A4uFS0FB8-ebvpd2eeeHroyi7UhrVH2QWFKnfHVE1Czkd-itOtDEAKXIojIc41OGYPEFO4setiDL_EUukW-nMgvxRNkHcPxGh1JJa7tfnACxyUO9axFhpaG1vR4xopJ9G1&sig=Cg0ArKJSzOYbKjsLH8nYEAE&urlfix=1&adurl=
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
SPDY
Server
172.217.16.162 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f162.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 20 Mar 2018 15:39:17 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
private
content-type
text/html; charset=UTF-8
alt-svc
hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="41,39,35"
content-length
0
x-xss-protection
1; mode=block
pixel
opt-east.media.net/rtbs/ 		43 B
287 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://opt-east.media.net/rtbs/pixel?key=4%3A%3A20180320%3A%3A15%3A%3ADE%3A%3A10.6.3.5_7017&value=67&bid=4&country=DE&cid=8CU5BD6EW&crid=184323154&domain=securityaffairs.co&size=300x250&buyerid=null
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
104.90.192.189 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-90-192-189.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Mar 2018 15:39:17 GMT
Server
nginx
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
43
Expires
Tue, 20 Mar 2018 15:39:17 GMT
log
qsearch-a.akamaihd.net/ 		35 B
312 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://qsearch-a.akamaihd.net/log?logid=kfk&evtid=rtbstl&url=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F70299%2Fmalware%2Frottensys-botnet.html&domain=securityaffairs.co&size=300x250&ext_user_id=0&iid=0&auction_id=e37a33b573624064b57baa2443191037&ip=148.251.45.254&crid=184323154&b4b=0.67&b9b=0.54&bc=0.67&rtbW=4&app_dis=0&cc=DE&rc=HE&bname=&bid_type=-1&bmlevel=0&mnet_segment=0.67&cmw=4&subBdr=15&dfp=1&source=2&dt=4
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
2.16.186.67 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-186-67.deploy.akamaitechnologies.com
Software
Apache /
Resource Hash
0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Mar 2018 15:39:17 GMT
Server
Apache
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
35
Expires
Tue, 20 Mar 2018 15:39:17 GMT
acj
medianet-d.openx.net/w/1.0/ Frame 689F 		362 B
752 B 		Script
General
Check archive.org
Download Go to
Full URL
http://medianet-d.openx.net/w/1.0/acj?ai=be377f37-02be-487d-99d2-2c61d8eb7c49&o=1982129013&callback=OX_mNCM_1982129013&ju=http%3A//securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html&jr=&auid=538672509&dims=1600x1200&adxy=0%2C0&res=1600x1200x24&plg=pm&ch=UTF-8&tz=0&ws=0x0&ifr=1&tws=1600x1200&si=7942194415&nl=85%2C141&ul=303%2C357
Requested by
Host: medianet-d.openx.net
URL: http://medianet-d.openx.net/w/1.0/jstag?oxns=mNCM
Protocol
HTTP/1.1
Server
173.241.240.220 New York, United States, ASN36089 (OPENX-AS1 - OPENX TECHNOLOGIES, INC., US),
Reverse DNS
ox-173-241-240-220.xa.dc.openx.org
Software
OXGW/15.0.0 /
Resource Hash
43a486b93bf80d5f153ccb73b4964f8ce8fe339a3b7b9bb6e10727043a521aac

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Mar 2018 15:39:17 GMT
Content-Encoding
gzip
Server
OXGW/15.0.0
Vary
Accept
P3P
CP="CUR ADM OUR NOR STA NID"
Cache-Control
private, max-age=0, no-cache
Transfer-Encoding
chunked
Content-Type
application/json
Expires
Mon, 26 Jul 1997 05:00:00 GMT
integrator.js
adservice.google.com/adsid/ Frame 1A92 		111 B
172 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=securityaffairs.co
Requested by
Host: www.googletagservices.com
URL: http://www.googletagservices.com/tag/js/gpt.js
Protocol
SPDY
Server
172.217.22.98 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s18-in-f2.1e100.net
Software
cafe /
Resource Hash
207461e411e1ff6d6c5b0dd702d26031adb86de86ed3f571baa5a6fc498fc4b6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 20 Mar 2018 15:39:17 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="41,39,35"
content-length
105
x-xss-protection
1; mode=block
pubads_impl_188.js
securepubads.g.doubleclick.net/gpt/ Frame 1A92 		183 KB
0 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_188.js
Requested by
Host: www.googletagservices.com
URL: http://www.googletagservices.com/tag/js/gpt.js
Protocol
SPDY
Server
172.217.16.162 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f162.1e100.net
Software
sffe /
Resource Hash
855538077b6944e6a4300454d027510188c642643017949aaa8aa58652096f3d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Response headers

date
Tue, 20 Mar 2018 15:39:14 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 15 Mar 2018 19:35:31 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="41,39,35"
content-length
65992
x-xss-protection
1; mode=block
expires
Tue, 20 Mar 2018 15:39:14 GMT
bql.php
qsearch.media.net/ Frame 84A1 		15 B
355 B 		Script
General
Check archive.org
Download Go to
Full URL
http://qsearch.media.net/bql.php?v=1&hvsid=00001521560355252024994892789617&geo=50.12|8.68&lper=100&bdrid=4&subBdr=15&fp=EIMN-ehR7Pps_CSyS_Yzo-2i1OixKc5bW9c2mufwmM6qC9U44Q2KYEIDdjWR4BeuBjr0-YRhLV7Y9GmiZA_caz41PjZjv5Wvlchxg1w8FtRs0LpG_5eStcbzvK41PleC_vD3FlHvHMI%3D&lpid=&tsid=1&ksu=112&q=&prv=&type=&ps=&cme=R4efub_uiyDVEUKWDmjVIgjs_Km_ffIl7yX_rKll6_LpoGSL2dAYOVdELOecNLKbAA3NM-pT3o1bEnJbrjME2kDxw1rygIICqP9vM2KoEyf0A0fVXrHJN3x0B7NoD5l7thzMUTONPe72lgyyFteHUcjO_7gaQ-srWmv6MGuev8XsZOkleZJv2q4TGPqg-yQ8SX3xRrnEhKS2Dx0xwku4c-ZJCT3hRtJk%7C%7CNDHRnZ9Gz3KXlI-i9OnZqQ%3D%3D%7C5gDUJdTGiJzedmq9hanWYg%3D%3D%7CN7fu2vKt8_s%3D%7CwQKqVZNVxsiGNthX_x6E7c3ZldeNVrJ-RbaPXw1kck92gsm6AvIigX3MW3pWhxL8NxEf4sQpuUQFR149KyILolnB78-c2gzt%7CsRBSg3CPSiQ%3D%7CLnyh8D94mbAZoWIAqgp9BD2NVXdDfVRgyZxqXC3JYwyHG1Q9ruzWT8ipu2bk66f2GiJpV7z0yDYW3lGGLuM-pQHFtNE134nWa-q_rS0NEGVv-9yNjfBT8kvCK7hzX6uyGdpwComtfPiIKOPL0owXwWj18hNFxBroF-5bUOlAlZ4VKXmNuXuQrA%3D%3D%7C&hint=&td=&cc=DE&wsip=2886958209&bca=0&ugd=4&&rc=0&fdkt=262&kwd[]=Must%20Have%20Android%20Apps&kwt[]=262&kbc[]=38481&kwp[]=1&kid[]=276697959&kbc2[]=rpc%3D0.15&ktd[]=274911592448&kwd[]=10%20Best%20Android%20Phones&kwt[]=262&kbc[]=38481&kwp[]=2&kid[]=294211106&kbc2[]=rpc%3D0.08&ktd[]=274911592448&kwd[]=2018%20Upcoming%20Android%20Phones&kwt[]=262&kbc[]=38481&kwp[]=3&kid[]=326811187&kbc2[]=rpc%3D0.03&ktd[]=274894815232&kwd[]=Android%20Phone%20Price%20Lists&kwt[]=262&kbc[]=38481&kwp[]=4&kid[]=321841506&kbc2[]=rpc%3D0.01&ktd[]=824667406336&kwd[]=Smartphone%20Price%20Comparison&kwt[]=262&kbc[]=143282&kwp[]=5&kid[]=159451961&kbc2[]=rpc%3D1.64&ktd[]=274911592448&rand=1521560356971&cid=8CU5BD6EW&vwid=1521560354418830645&vi=1521560354418830645&l3ch=0&slnkp=no&bdrct=0.67&rt=717&tdAdd[]=rtbsd%3D10&tdAdd[]=ib=0&matchstring=&dytm=1521560356111&rtbsd=10&npgv=1&kbbq=%26sde%3D1%26adepth%3D1%26ddepth%3D0%26asn%3D24940&tdAdd[]=%7C%40%7Csde%3D1%7C%40%7Cadepth%3D1%7C%40%7Cddepth%3D0%7C%40%7CopenxEnabled%3Dtrue&verid=111299&hvsid=00001521560355252024994892789617&upk=1521560354.27618&sttm=1521560355252&=&vgd_bdata=bb%3D0%7C%7Cbtd%3D655360%7C%7Cfbb%3D0%7C%7Curl_l%3D3%7C%7Cbid%3D0.67%7C%7Cdevice_l%3D2%7C%7Cvariant%3D1&vgd_refimp=0&tdAdd[]=%7C%40%7Cabp%3A3%3A2&tdAdd[]=%7C%40%7Cabp%3A3%3A2&tdAdd[]=%7C%40%7Cabp%3A3%3A2&tdAdd[]=%7C%40%7Cabp%3A3%3A2&tdAdd[]=%7C%40%7Cabp%3A3%3A2&matm=1521560357006&vsid=1645619548927803&lktgd=18&lkpgd=MPTD%3D488%7C%7CPTD%3D8796100362752%7C%7CSI%3D801%7C%7CMI%3D804%7C%7CAN%3D6%7C%7CPTD2%3D0%7C%7CUUID%3Duuid_s8_7_1521560356_829950021%7C%7CMN%3D9%7C%7Cerpm%3D-1.0%7C%7CSID%3D14%7C%7CHID%3D7%7C%7CKSE%3D1521560356332%7C%7CKTGD%3D18%7C%7CCI%3D801&abpl=2&tdAdd[]=nw%3DNone&tdAdd[]=nwType%3DNone&tdAdd[]=asnum%3D24940&tdAdd[]=proxy%3DNone&tdAdd[]=comp%3DNone&vgd_ckkr=1&vgd_ckadt=28&vgd_sc=HE&vgd_katid=800384229&vgd_katbid=-14&vgd_kals=ttype%3D2&vgd_kalog=MI%3D804%7C%7CHID%3D2%7C%7CUUID%3Duuid_s12_nc1c_2_1521560355_535024729%7C%7CSID%3D12%7C%7CTPTD%3D132%7C%7CMPTD%3D704%7C%7CCI%3D804%7C%7CSI%3D801&vgd_kasts=tstype%3DBANDIT_LIMITED_EXPLOITATION_BAG%7C%7C&vgd_altbql=sb&vgd_clsKb=2&vgd_pdtid=1&vgd_refcnf=%7B%22a2y%22%3A%7B%22afterLoadSecs%22%3A30%2C%22afterViewSecs%22%3A10%2C%22percentTraffic%22%3A50%7D%7D&vgd_sbSup=1&vgd_ourl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F70299%2Fmalware%2Frottensys-botnet.html&vgd_osrc=metatag&oRurl=http%3A%2F%2Fcdn3ncal.media.net%2Fmediamain.html%3F%26esi%3D1%26%26cid%3D8CU5BD6EW%26cpcd%3DRlAcVccC-RdUYIl-LjF9ag%253D%253D%26crid%3D184323154%26pid%3D8PO5M70HK%26size%3D300x250%26cpnet%3DyVb1sHm-0KIh29BOFTjjrHvHwrQGlpByWaOO1vn303s%253D%26cme%3DyINvVCFxqLMbSqDgxM-acxgbv-13pHyD4y-MDQGBFdYUXQ-wXrJy0CPtTuDt0RSSxaoVDeZ3XY07KQMY9eHzta_iCBriuV7UZ-_IHi2pj1EhY9RBBPiQi5dCn9e6EzY48y5LXNPAQ9E%253D%257C%257CNDHRnZ9Gz3KXlI-i9OnZqQ%253D%253D%257C5gDUJdTGiJzedmq9hanWYg%253D%253D%257CN7fu2vKt8_s%253D%257CwQKqVZNVxsiGNthX_x6E7c3ZldeNVrJ-RbaPXw1kck92gsm6AvIigX3MW3pWhxL8NxEf4sQpuUQFR149KyILolnB78-c2gzt%257CsRBSg3CPSiQ%253D%257C%26cc%3DDE%26bf%3D0%26vif%3D1%26nse%3D3%26bid%3D210870%26vi%3D1521560354418830645%26lw%3D1%26ugd%3D4%26ib%3D0%26ourl%3Dhttp%253A%252F%252Fsecurityaffairs.co%252Fwordpress%252F70299%252Fmalware%252Frottensys-botnet.html%26osrc%3Dmetatag%26katid%3D800384229%26katbid%3D-14%26nb%3D1%26chost%3Dcontextual.media.net%26fvips%3D0%26vpf%3D000%26ap%3D0%26pf%3D0%26isOffice%3D0&tdAdd[]=uiparams%3D%3Brend_w%3A300%3Brend_h%3A250%3Bwin_w%3A1600%3Bwin_h%3A1200%3Bscr_h%3A1200%3Bscr_w%3A1600%3Bx_pos%3A973%3By_pos%3A433%3Bkwd_scnt%3A5
Requested by
Host: contextual.media.net
URL: http://contextual.media.net/__media__/js/util/nrr.js?v=79
Protocol
HTTP/1.1
Server
2.16.186.113 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-186-113.deploy.akamaitechnologies.com
Software
Apache /
Resource Hash
c787e9dd6dc8ea3c935f5f0f30e3b9e4a3e066b4619bb244f569883f8e318a24

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Mar 2018 15:39:17 GMT
Server
Apache
ntCoent-Length
15
Vary
Accept-Encoding
Content-Type
text/javascript;charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
15
Expires
Tue, 20 Mar 2018 15:39:17 GMT
log
navvy.media.net/ Frame 84A1 		807 B
1 KB 		Other
General
Check archive.org
Download Go to
Full URL
http://navvy.media.net/log
Requested by
Host: contextual.media.net
URL: http://contextual.media.net/__media__/js/util/nrr.js?v=79
Protocol
HTTP/1.1
Server
54.241.182.29 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-241-182-29.us-west-1.compute.amazonaws.com
Software
Jetty(9.4.7.v20170914) /
Resource Hash
0a4c16b7f5c1b1ecefc9ffb4fcf1b457f9282d0863fa61d4dd32ad98dafa9a60

Request headers

Cache-Control
max-age=0
Origin
http://securityaffairs.co
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Pragma
no-cache
Date
Tue, 20 Mar 2018 15:39:17 GMT
Server
Jetty(9.4.7.v20170914)
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
max-age=0, no-cache,no-store
Connection
keep-alive
Content-Length
807
Expires
Tue, 20 Mar 2018 15:39:17 GMT
pixel
c.ad-srv.co/ Frame 84A1 		0
127 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://c.ad-srv.co/pixel
Requested by
Host: contextual.media.net
URL: http://contextual.media.net/__media__/js/util/nrr.js?v=79
Protocol
HTTP/1.1
Server
54.177.132.126 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-177-132-126.us-west-1.compute.amazonaws.com
Software
Varnish /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:17 GMT
Server
Varnish
Connection
keep-alive
X-Varnish
886040073
pixel
c.adyield.co/ Frame 84A1 		0
127 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://c.adyield.co/pixel
Requested by
Host: contextual.media.net
URL: http://contextual.media.net/__media__/js/util/nrr.js?v=79
Protocol
HTTP/1.1
Server
52.8.72.42 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-8-72-42.us-west-1.compute.amazonaws.com
Software
Varnish /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:17 GMT
Server
Varnish
Connection
keep-alive
X-Varnish
885742932
ptmd
dt.clnmde.com/ 		70 B
446 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://dt.clnmde.com/ptmd?t=152156035435931124477280_N4IgxmAWDWIFwG0QHYBsAmTBGAnBkANCFgBwAsAzOhVgKxmEioV6q0W20gC6RAtgE94CBFgJUADAQxTMZZAXRkcyXgnTj0UmYqUKlKtRQIrjWdMmOVjqEhW68QAZwAuAQxcBXJ8LKOAXm7wYiAADgDm8CAAbowApgB2sXBhjOGQUXTodKgSHJS0ODTmZPLI6CQSjC4+KVhk6DiVyGQYnCSM0bVMAHQSPdmojG4ANvDGIABmYPAAtCFxQSlFAEYAJuZgErPoYCzzWHEks+txk7OT5SuoyHFs6Khr8S4AlsG02bS5+USukXBSZywFIYHBKCS4ZC0CGMJzQADuLkyHxyeXoAH1QeDIdCsPEXqFMmQSANaFgemRaKSGL8Rq5kZ9vvQKshGCNJsEiGBvC50S8nikSABhACqtAAQgARVAAUQA6mkZnAsqiOOUKkQAI5xYIAXyAA
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
52.86.242.184 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-52-86-242-184.compute-1.amazonaws.com
Software
/ Express
Resource Hash
c414cd0e204de974f73753c7e28d7638e7b3691bb8b1a2bab6b25bb7fed7ce77

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:17 GMT
X-Powered-By
Express
Transfer-Encoding
chunked
Access-Control-Allow-Methods
GET,PUT,POST,DELETE,OPTIONS
Content-Type
image/gif
Access-Control-Allow-Origin
*
Connection
keep-alive
Access-Control-Allow-Headers
Origin, X-Requested-With, Content-Type, Accept, Bafp-Eg, Bafp-Ec, Bafp-Eg-T, Bafp-Ec-T
kbb.php
contextual.media.net/ 		52 B
357 B 		Script
General
Check archive.org
Download Go to
Full URL
http://contextual.media.net/kbb.php?cme=sj8jUgUthZgb1dk55FlquHTZZWJ5h3uCyeWPMZuARP06ymyV8xaf7IGyrTEw9Mqe0VEgnOI2lfgsjpp_kIry7BcGTHhLQPB8su0CxyMmpe-aZep7AcFhefS-26SA-aelKUhC-QRXHFM%3D%7C%7CNDHRnZ9Gz3KXlI-i9OnZqQ%3D%3D%7C5gDUJdTGiJzedmq9hanWYg%3D%3D%7CN7fu2vKt8_s%3D%7CwQKqVZNVxsiGNthX_x6E7c3ZldeNVrJ-RbaPXw1kck92gsm6AvIigX3MW3pWhxL8NxEf4sQpuUQFR149KyILolnB78-c2gzt%7CsRBSg3CPSiQ%3D%7C&srp=ZPL-DvhZL6tgmKrUtO99v1m1jGIaBP3UQzvhFqmHrZ26Uq_-84s4pKDauc3HElwQ&klp=TmBQhs8wsoiWC4h20QMcOhNF-a8ExngTyu2fvWyurCb5o1ZORRl9KAa_f8PYvSzulxX9Lsig06bI_f0ItfdX3etNmOSowfQSmCTdrSd2Z--WsCe8IBVygoaxxKdZDxqNdJWCmUK_Ck8GZ0wNxtjntNiJVFcPU7an9XByMEHcI9CwOVtGaSEtcNAcUozt5HOyPkjcBBFe0G1NPtOpaNrXsoPjLKDypNlvUTKHA_a1aFLRHy-KgsLdksTL8axLKy5-rFQFAXe1ssHAS3CtEQ-v__Kbj-e1TuEXgDZdAu3x6ukMsoeednCa5F3sbobeJ97zHi55VOIdEIM%3D&nse=3&bid=210870&cb=resultPageUtil.kwdRandmzn[%271521560356379511616%27]
Requested by
Host: contextual.media.net
URL: http://contextual.media.net/fcmdynet.js?&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=639665355&size=300x600&cc=DE&wsip=2886781337&vif=1&requrl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F70299%2Fmalware%2Frottensys-botnet.html&nse=3&vi=1521560356379511616&lw=1&ugd=4&re=1&ourl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F70299%2Fmalware%2Frottensys-botnet.html&osrc=metatag&hlt=1&dfp=1&rtbs=1
Protocol
HTTP/1.1
Server
104.90.192.189 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-90-192-189.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
6caaf7466d192f0ca133767eef8d61dc2df413af12320419c1ecb390b73e4405

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Mar 2018 15:39:17 GMT
Server
Apache
Vary
Accept-Encoding
Content-Type
text/javascript; charset=utf-8
X-MNET-KBB
E2
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
52
Expires
Tue, 20 Mar 2018 15:39:17 GMT
mediamain.html
contextual.media.net/ Frame C644 		49 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://contextual.media.net/mediamain.html?&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=639665355&pid=8PO5M70HK&size=300x600&cpnet=yVb1sHm-0KIh29BOFTjjrOMbY3Wy7OSYfNFL7sC0vVY%3D&cme=sj8jUgUthZgb1dk55FlquHTZZWJ5h3uCyeWPMZuARP06ymyV8xaf7IGyrTEw9Mqe0VEgnOI2lfgsjpp_kIry7BcGTHhLQPB8su0CxyMmpe-aZep7AcFhefS-26SA-aelKUhC-QRXHFM%3D%7C%7CNDHRnZ9Gz3KXlI-i9OnZqQ%3D%3D%7C5gDUJdTGiJzedmq9hanWYg%3D%3D%7CN7fu2vKt8_s%3D%7CwQKqVZNVxsiGNthX_x6E7c3ZldeNVrJ-RbaPXw1kck92gsm6AvIigX3MW3pWhxL8NxEf4sQpuUQFR149KyILolnB78-c2gzt%7CsRBSg3CPSiQ%3D%7C&cc=DE&bf=0&vif=1&nse=3&bid=210870&vi=1521560356379511616&lw=1&ugd=4&ib=0&ourl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F70299%2Fmalware%2Frottensys-botnet.html&osrc=metatag&katid=800543883&katbid=-14&nb=1
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
104.90.192.189 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-90-192-189.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
35d53611abbe21d6580bb091ca4bb9b117fd12a48e0b551be3d17774c68ff9c9

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:17 GMT
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
Content-Type
text/javascript
Cache-Control
max-age=300
X-MNET-HL3
E
Connection
keep-alive
Content-Length
12672
Expires
Tue, 20 Mar 2018 15:44:17 GMT
overlay.png
securityaffairs.co/wordpress/wp-content/plugins/cookie-law-info/images/ 		135 B
395 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://securityaffairs.co/wordpress/wp-content/plugins/cookie-law-info/images/overlay.png
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/js/r20180312/r20110914/activeview/osd_listener.js
Protocol
HTTP/1.1
Server
217.160.0.146 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
217-160-0-146.elastic-ssl.ui-r.com
Software
Apache /
Resource Hash
4b456e49e6c017d53be594d467c4508368dbe32ea0fd52a4b0718d5dc1862d51

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
securityaffairs.co
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://securityaffairs.co/wordpress/wp-content/plugins/cookie-law-info/css/cli-style.css?ver=1.5.3
Connection
keep-alive
Cache-Control
no-cache
Referer
http://securityaffairs.co/wordpress/wp-content/plugins/cookie-law-info/css/cli-style.css?ver=1.5.3
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:17 GMT
Last-Modified
Wed, 16 Dec 2015 06:30:08 GMT
Server
Apache
ETag
"87-526fe09971c00"
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=15
Content-Length
135
m8JVjfNVeKWVnh3QMuKkFcZVaUuH99GUDg.woff2
fonts.gstatic.com/s/indieflower/v9/ 		19 KB
19 KB 		Font
General
Check archive.org
Download Go to
Full URL
http://fonts.gstatic.com/s/indieflower/v9/m8JVjfNVeKWVnh3QMuKkFcZVaUuH99GUDg.woff2
Requested by
Host: apis.google.com
URL: https://apis.google.com/js/plusone.js
Protocol
HTTP/1.1
Server
172.217.17.67 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
ams16s30-in-f3.1e100.net
Software
sffe /
Resource Hash
5fe76b89002b51ecfbcfe67c4eaf99b7ab108168d099dda0d2a40398b06051f8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Referer
http://fonts.googleapis.com/css?family=Indie+Flower&ver=dc488b3cf402a36ed8529f3196db2a8a
Origin
http://securityaffairs.co

Response headers

Date
Fri, 09 Feb 2018 00:00:12 GMT
X-Content-Type-Options
nosniff
Last-Modified
Wed, 11 Oct 2017 18:26:32 GMT
Server
sffe
Age
3425945
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes
Timing-Allow-Origin
*
Content-Length
18960
X-XSS-Protection
1; mode=block
Expires
Sat, 09 Feb 2019 00:00:12 GMT
cb=gapi.loaded_0
apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.EvHJPRq_MPI.O/m=plusone/rt=j/sv=1/d=1/ed=1/am=AQE/rs=AGLTcCNSMPEjiLoXugZWrB38evRsajWMig/ 		130 KB
45 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.EvHJPRq_MPI.O/m=plusone/rt=j/sv=1/d=1/ed=1/am=AQE/rs=AGLTcCNSMPEjiLoXugZWrB38evRsajWMig/cb=gapi.loaded_0
Requested by
Host: apis.google.com
URL: https://apis.google.com/js/plusone.js
Protocol
SPDY
Server
216.58.206.14 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s20-in-f14.1e100.net
Software
sffe /
Resource Hash
84cf7b58bf9470a372894d186bbd7e1ccac05b5baa84a7d0be44158f4981effc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date
Mon, 19 Mar 2018 17:44:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Sun, 18 Mar 2018 15:32:06 GMT
server
sffe
age
78868
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
status
200
cache-control
public, immutable, max-age=31536000
accept-ranges
bytes
alt-svc
hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="41,39,35"
content-length
46380
x-xss-protection
1; mode=block
expires
Tue, 19 Mar 2019 17:44:49 GMT
cb=gapi.loaded_1
apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.EvHJPRq_MPI.O/m=auth/exm=plusone/rt=j/sv=1/d=1/ed=1/am=AQE/rs=AGLTcCNSMPEjiLoXugZWrB38evRsajWMig/ 		100 KB
35 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.EvHJPRq_MPI.O/m=auth/exm=plusone/rt=j/sv=1/d=1/ed=1/am=AQE/rs=AGLTcCNSMPEjiLoXugZWrB38evRsajWMig/cb=gapi.loaded_1
Requested by
Host: apis.google.com
URL: https://apis.google.com/js/plusone.js
Protocol
SPDY
Server
216.58.206.14 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s20-in-f14.1e100.net
Software
sffe /
Resource Hash
8e5cd0149eff438710d9e98c6834de800d2a0164440937d415f41abfce954e6f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date
Mon, 19 Mar 2018 17:45:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Sun, 18 Mar 2018 15:32:06 GMT
server
sffe
age
78857
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
status
200
cache-control
public, immutable, max-age=31536000
accept-ranges
bytes
alt-svc
hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="41,39,35"
content-length
35385
x-xss-protection
1; mode=block
expires
Tue, 19 Mar 2019 17:45:00 GMT
/
securityaffairs.co/wordpress/
Redirect Chain
  • http://securityaffairs.co/wordpress?ga_action=googleanalytics_get_script
  • http://securityaffairs.co/wordpress/?ga_action=googleanalytics_get_script
569 B
591 B 		XHR
General
Check archive.org
Download Go to
Full URL
http://securityaffairs.co/wordpress/?ga_action=googleanalytics_get_script
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
217.160.0.146 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
217-160-0-146.elastic-ssl.ui-r.com
Software
Apache / PHP/5.6.34
Resource Hash
b68659ff00e064d9afb54423ec69597994c1a141433f2ba1d58a2307c7a8dbea

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
securityaffairs.co
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
*/*
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
X-Requested-With
XMLHttpRequest
Cookie
OX_mNCM_net_latency=266; OX_mNCM_user_latency=634
Connection
keep-alive
Cache-Control
no-cache
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:17 GMT
Content-Encoding
gzip
Server
Apache
X-Powered-By
PHP/5.6.34
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
Connection
keep-alive
Keep-Alive
timeout=15

Redirect headers

Location
http://securityaffairs.co/wordpress/?ga_action=googleanalytics_get_script
Date
Tue, 20 Mar 2018 15:39:17 GMT
Server
Apache
Connection
keep-alive
Keep-Alive
timeout=15
Content-Length
281
Content-Type
text/html; charset=iso-8859-1
ptmd
dt.clnmde.com/ 		70 B
446 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://dt.clnmde.com/ptmd?t=152156035435931124477280_N4IgtgniBcDasEYA0BmATABiQNk0taALAOz6ECcxAukrGqnrlgSWZTbCkpVwmsV0Iou2ABwoOhbgKR8ZQkeKo0QAdwCOMWCoDGAJzAAHLSGK4CCcrgD6Ac0MAXawhBJT5tJZtgAhgEsAO2s0VxAEUSE0FAQAVkI7R2sUUPDI6LjrX0DrQhAVHwAbBxgsEB8AEwLykrd7YugQUIBnBx8HAFcmrQk3AC8fGGQQQ1sYEAA3UIBTAMmG41qACzHYzxjsDBQ4rfJovkISYjRRDFCHLoaEQjRyE+JCXBiY0VDxi5BsADoMT89sUMKMC4IAAZjoYABaIZTAYNXYAI3KfB0GAhaB0KHIUIQU1EEMRUxBEJBR3h2GIU2wMTQ2GqbimDj8g2psQ2WykIBao2gpSaAGsxrhyEQMJZiDFRc0+ap6mEWetNhkhSKxRKXPS-MZLoRRL8YghPoQYnrcm4mgUWit5Wy4sdiKECiDBm4dJ0nH5qg1RABhACqMQAQgARbAAUQA6qFbODoKtWYqzKIhuopoMAL5AA
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
52.86.242.184 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-52-86-242-184.compute-1.amazonaws.com
Software
/ Express
Resource Hash
c414cd0e204de974f73753c7e28d7638e7b3691bb8b1a2bab6b25bb7fed7ce77

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:17 GMT
X-Powered-By
Express
Transfer-Encoding
chunked
Access-Control-Allow-Methods
GET,PUT,POST,DELETE,OPTIONS
Content-Type
image/gif
Access-Control-Allow-Origin
*
Connection
keep-alive
Access-Control-Allow-Headers
Origin, X-Requested-With, Content-Type, Accept, Bafp-Eg, Bafp-Ec, Bafp-Eg-T, Bafp-Ec-T
ptmd
dt.clnmde.com/ 		70 B
446 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://dt.clnmde.com/ptmd?t=152156035435931124477280_N4IgtgniBcDasEYA0BmATABiQNk0taALAOz6ECcxAukrGqnrlgSWZTbCkpVwmsV0Iou2ABwoOhbgKR8ZQkeI4BWab35c0w5GnIoEVGiADuARxiwjAYwBOYAA4WQxXAQTlcAfQDm9gC6eCCBIzq5o7l5gAIYAlgB2nmjBIAiiQloIyoQ+-p4oyanp+lme0fGehMnYKB7YyijKyjkByiBGUQA2fjBYIFEAJh39PSG+3dAgyQDOflF+AK5TFhIhAF5RMMgg9t4wIABuyQCmcYcTjqMAFnuZ4crYGA1CynoIfIQkxGiiGMl+SxMEIRdD9iIRcI1RMl9gCQNgAHQYeHhbDJTowLggABmVhgAFotkcNhM9AAjfp8KwYPFoKw1AkII6iPHko5YvFYr6k7DEI51NDYYYhI5+GKbZR3B5PEIzXbQXpTADWe1w5CIGHcxGUGumiuM4xSEsyUpKqvVmu1QWFMUcgMIomRygQ8MIykdlRlHRmNyN90eWW+xGSHSxmxCVkWARiwwmogAwgBVZQAIQAItgAKIAdWS3lx0Fuxv9LjSIVMR02AF8gA
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
54.86.56.206 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-86-56-206.compute-1.amazonaws.com
Software
/ Express
Resource Hash
c414cd0e204de974f73753c7e28d7638e7b3691bb8b1a2bab6b25bb7fed7ce77

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:17 GMT
X-Powered-By
Express
Transfer-Encoding
chunked
Access-Control-Allow-Methods
GET,PUT,POST,DELETE,OPTIONS
Content-Type
image/gif
Access-Control-Allow-Origin
*
Connection
keep-alive
Access-Control-Allow-Headers
Origin, X-Requested-With, Content-Type, Accept, Bafp-Eg, Bafp-Ec, Bafp-Eg-T, Bafp-Ec-T
ads
securepubads.g.doubleclick.net/gampad/ Frame 1A92 		2 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&correlator=3281269956983231&output=json_html&callback=googletag.impl.pubads.callbackProxy1&impl=fif&adsid=NT&eid=21061149%2C21061242&sc=0&sfv=1-0-17&iu=%2F45361917%2F8CU5BD6EW-639665355-Skyscraper_post_yahoo_300_x_600&sz=300x600&scp=crid%3D639665355%26mnet_segment%3D0.67%26mnet_variant%3D15%26pub_domain%3Dsecurityaffairs.co%26mnet_cc%3DDE%26mnet_ref_ybn%3D1&eri=4&cookie_enabled=1&lmt=1521560357&dt=1521560357756&ea=0&frm=23&biw=1585&bih=1200&isw=300&ish=600&oid=3&adx=973&ady=2331&adk=2891760302&gut=v2&ifi=1&ifk=652515859&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&nhd=1&iag=3&url=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F70299%2Fmalware%2Frottensys-botnet.html&top=securityaffairs.co&dssz=4&icsg=34&std=0&vrg=188&vis=1&scr_x=0&scr_y=0&ga_vid=1412049842.1521560358&ga_sid=1521560358&ga_hid=1048861826
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_188.js
Protocol
SPDY
Server
172.217.16.162 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f162.1e100.net
Software
cafe /
Resource Hash
859999ff4ae2fc2a72555fc968f13bf2c9fcbe6c1190726ae82d14bdbdc89c72
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Origin
http://securityaffairs.co

Response headers

date
Tue, 20 Mar 2018 15:39:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="41,39,35"
content-length
1420
x-xss-protection
1; mode=block
google-lineitem-id
731772917
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
35793382277
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
http://securityaffairs.co
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
pubads_impl_rendering_188.js
securepubads.g.doubleclick.net/gpt/ Frame 1A92 		41 KB
0 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_188.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_188.js
Protocol
SPDY
Server
172.217.16.162 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f162.1e100.net
Software
sffe /
Resource Hash
a6ae50acb2000fab66cfd21243ebe3e48bcda59331a4b39100cd9152407ce757
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Response headers

date
Tue, 20 Mar 2018 15:39:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 15 Mar 2018 19:35:31 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="41,39,35"
content-length
14686
x-xss-protection
1; mode=block
expires
Tue, 20 Mar 2018 15:39:15 GMT
container.html
tpc.googlesyndication.com/safeframe/1-0-17/html/ Frame 1A92 		0
0 		Other
General
Check archive.org
Download Go to
Full URL
http://tpc.googlesyndication.com/safeframe/1-0-17/html/container.html?n=1
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_188.js
Protocol
HTTP/1.1
Server
216.58.206.1 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s20-in-f1.1e100.net
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Purpose
prefetch
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Wed, 28 Feb 2018 18:53:28 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Tue, 27 Feb 2018 14:43:12 GMT
Server
sffe
Age
1716349
Vary
Accept-Encoding
Content-Type
text/html
Cache-Control
public, immutable, max-age=31536000
Accept-Ranges
bytes
Timing-Allow-Origin
*
Content-Length
1451
X-XSS-Protection
1; mode=block
Expires
Thu, 28 Feb 2019 18:53:28 GMT
g.gif
pixel.wp.com/ 		50 B
215 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://pixel.wp.com/g.gif?v=ext&j=1%3A5.9&blog=29506073&post=70299&tz=0&srv=securityaffairs.co&host=securityaffairs.co&ref=&rand=0.5050438325173698
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:17 GMT
Cache-Control
no-cache
Server
nginx
Connection
keep-alive
Content-Length
50
Content-Type
image/gif
activeview
pagead2.googlesyndication.com/pcs/ Frame 4CE7 		42 B
550 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssk0Se4wR0zmxoRbZlEw4g_Ig0B0KD0UC000yJPIcQKNDUXzViqnJf7Chnvg5rnhDMJCq7uGY8p2XlRPgGqllYDwCUQVJq5y74&sig=Cg0ArKJSzLpZnNgwJWbqEAE&id=osdim&ti=1&r=z&adk=3177995050&tt=746&bs=1585,1200&mtos=0,0,0,0,0&tos=0,0,0,0,0&p=0,0,0,0&inapp=0&bcn=1&mcvt=0&rs=3&ht=0&mc=0&lte=-1&bas=0&bac=0&bos=1600,1200&ps=1585,4397&ss=1600,1200&pt=3&deb=1-1-1-5-4-51-1-2&tvt=723&is=300,250&op=1&iframe_loc=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F70299%2Fmalware%2Frottensys-botnet.html&avms=geo&uc=1&tgt=BODY&cl=1&cec=5&clc=0&cac=0&cd=0x0&v=r20180312
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
SPDY
Server
216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s20-in-f2.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Mar 2018 15:39:17 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
status
200
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
content-type
image/gif
alt-svc
hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="41,39,35"
content-length
42
x-xss-protection
1; mode=block
expires
Fri, 01 Jan 1990 00:00:00 GMT
activeview
pagead2.googlesyndication.com/pcs/ Frame C831 		42 B
110 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsv7AZC5KgnaR5HZNrQDh0QqCS1MB0KhnIppXR8mzU8WTUvfmu9BYfkITWFC2DimFC1jV8PGIZJE5TZ8vZr9KmrIzdlIUysQrC0&sig=Cg0ArKJSzFhyG6WLfOZ9EAE&id=osdim&ti=1&r=z&adk=2598375999&tt=703&bs=1585,1200&mtos=0,0,0,0,0&tos=0,0,0,0,0&p=0,0,0,0&inapp=0&bcn=1&mcvt=0&rs=3&ht=0&mc=0&lte=-1&bas=0&bac=0&bos=1600,1200&ps=1585,4397&ss=1600,1200&pt=3&deb=1-1-1-5-4-24-1-2&tvt=682&is=300,250&op=1&iframe_loc=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F70299%2Fmalware%2Frottensys-botnet.html&avms=geo&uc=1&tgt=BODY&cl=1&cec=5&clc=0&cac=0&cd=0x0&v=r20180312
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
SPDY
Server
216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s20-in-f2.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Mar 2018 15:39:17 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
status
200
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
content-type
image/gif
alt-svc
hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="41,39,35"
content-length
42
x-xss-protection
1; mode=block
expires
Fri, 01 Jan 1990 00:00:00 GMT
bqi.php
qsearch.media.net/ 		15 B
15 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://qsearch.media.net/bqi.php?&lf=3&prid=8PRHGG6T9&cid=8CU5BD6EW&crid=184323154&pid=8PO5M70HK&vi=1521560354418830645&hvsid=00001521560355252024994892789617&bdrid=4&subBdr=15&ugd=4&cme=yINvVCFxqLMbSqDgxM-acxgbv-13pHyD4y-MDQGBFdYUXQ-wXrJy0CPtTuDt0RSSxaoVDeZ3XY07KQMY9eHzta_iCBriuV7UZ-_IHi2pj1EhY9RBBPiQi5dCn9e6EzY48y5LXNPAQ9E%3D%7C%7CNDHRnZ9Gz3KXlI-i9OnZqQ%3D%3D%7C5gDUJdTGiJzedmq9hanWYg%3D%3D%7CN7fu2vKt8_s%3D%7CwQKqVZNVxsiGNthX_x6E7c3ZldeNVrJ-RbaPXw1kck92gsm6AvIigX3MW3pWhxL8NxEf4sQpuUQFR149KyILolnB78-c2gzt%7CsRBSg3CPSiQ%3D%7C&cc=DE&sc=HE&requrl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F70299%2Fmalware%2Frottensys-botnet.html&sttm=1521560355252&upk=1521560354.27618&hvsid=00001521560355252024994892789617&verid=111299&tdAdd[]=%7C%40%7Csde%3D1%7C%40%7Cadepth%3D1%7C%40%7Cddepth%3D0%7C%40%7CopenxEnabled%3Dtrue&kbbq=%26sde%3D1%26adepth%3D1%26ddepth%3D0&npgv=1&rtbsd=10&dytm=1521560356111&clsKb=2&katbid=-14&katid=800384229&kapc=12&kals=ttype%3D2&kata=34f8&kalog=MI%3D804%7C%7CHID%3D2%7C%7CUUID%3Duuid_s12_nc1c_2_1521560355_535024729%7C%7CSID%3D12%7C%7CTPTD%3D132%7C%7CMPTD%3D704%7C%7CCI%3D804%7C%7CSI%3D801&kasts=tstype%3DBANDIT_LIMITED_EXPLOITATION_BAG%7C%7C&matchstring=
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
2.16.186.113 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-186-113.deploy.akamaitechnologies.com
Software
Apache /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Mar 2018 15:39:18 GMT
Server
Apache
ntCoent-Length
15
Vary
Accept-Encoding
Content-Type
text/javascript;charset=UTF-8
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
15
Expires
Tue, 20 Mar 2018 15:39:18 GMT
nrr.js
contextual.media.net/__media__/js/util/ Frame 5E05 		56 KB
19 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://contextual.media.net/__media__/js/util/nrr.js?v=79
Requested by
Host: contextual.media.net
URL: http://contextual.media.net/nmedianet.js?cid=8CU5BD6EW
Protocol
HTTP/1.1
Server
104.90.192.189 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-90-192-189.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
9869bf998d9dee691349d634a714bf20d6bde49c9d5160eb1cf103f76c4738e5

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:18 GMT
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=1209600
Connection
keep-alive
Content-Length
19030
Expires
Tue, 03 Apr 2018 15:39:18 GMT
osd_listener.js
tpc.googlesyndication.com/pagead/js/r20180312/r20110914/activeview/ Frame 9341 		71 KB
0 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20180312/r20110914/activeview/osd_listener.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_188.js
Protocol
SPDY
Server
216.58.206.1 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s20-in-f1.1e100.net
Software
cafe /
Resource Hash
5ca0636ee5ba9229b08ea875292b99b035d0794fa922a5f1eeab0ff4ed766ec0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Response headers

date
Mon, 12 Mar 2018 13:21:37 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
699459
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="41,39,35"
content-length
26437
x-xss-protection
1; mode=block
server
cafe
etag
5447488165261728430
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Mon, 26 Mar 2018 13:21:37 GMT
10613_505bb4db55aaa1165fa3b242bf39701b.png
contextual.media.net/__media__/images/800000006/ Frame 5E05 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://contextual.media.net/__media__/images/800000006/10613_505bb4db55aaa1165fa3b242bf39701b.png
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/js/r20180312/r20110914/activeview/osd_listener.js
Protocol
HTTP/1.1
Server
104.90.192.189 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-90-192-189.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
1e9a9ba24042f2effe58a5d585f70a7bc4b917e60ddcb9a780ad03817a78381f

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:18 GMT
Last-Modified
Wed, 01 Nov 2017 07:45:12 GMT
Server
Apache
Content-Type
image/png
Cache-Control
max-age=1209600
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
4097
Expires
Tue, 03 Apr 2018 15:39:18 GMT
osd.js
pagead2.googlesyndication.com/pagead/ Frame 1A92 		75 KB
0 		Script
General
Check archive.org
Download Go to
Full URL
http://pagead2.googlesyndication.com/pagead/osd.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_188.js
Protocol
HTTP/1.1
Server
216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s20-in-f2.1e100.net
Software
cafe /
Resource Hash
74a78cea892f43d01c7573729c200c97dfebe5835476364435e411d0a674e28a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Response headers

Date
Tue, 20 Mar 2018 15:11:27 GMT
X-Content-Type-Options
nosniff
Content-Type
text/javascript; charset=ISO-8859-1
Server
cafe
Age
1669
ETag
13992280071806881209
P3P
policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Cache-Control
public, max-age=3600
Content-Disposition
attachment; filename="f.txt"
Timing-Allow-Origin
*
Content-Length
76885
X-XSS-Protection
1; mode=block
Expires
Tue, 20 Mar 2018 16:11:27 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 9341 		0
268 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsupPswig1pueXc1Ud2kgH88CQGRfmaQrzT7wNnS3tKvneWzm_zcCFpVhZwva7fSgEZaTHFW82aZFzIse6uEtmGUQZru73MACq0iwYOsmvXN-xW24XDNqBFFO4WLYABxIjW9wl_RsjC6C0Hhg_OS2sZ7CiIvcU5sH8t0O7g0u20VzDjLhEggdrSF4Wzu95ylhaxb8K_N3VkOWepxcZKGWYad1XftXcupNXa2JRzLwkbsJaNevVk2A6MNUTenXbKSWYBCA0r1iSNFVpMJgQE_-aePNyodDhTtuq7teh0zX0MB7U3w4NI&sig=Cg0ArKJSzNycCzisAUl2EAE&urlfix=1&adurl=
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
SPDY
Server
172.217.16.162 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f162.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 20 Mar 2018 15:39:18 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
private
content-type
text/html; charset=UTF-8
alt-svc
hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="41,39,35"
content-length
0
x-xss-protection
1; mode=block
expires
Tue, 20 Mar 2018 15:39:18 GMT
pixel
opt-east.media.net/rtbs/ 		43 B
287 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://opt-east.media.net/rtbs/pixel?key=4%3A%3A20180320%3A%3A15%3A%3ADE%3A%3A10.6.3.2_7017&value=67&bid=4&country=DE&cid=8CU5BD6EW&crid=639665355&domain=securityaffairs.co&size=300x600&buyerid=null
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
104.90.192.189 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-90-192-189.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Mar 2018 15:39:18 GMT
Server
nginx
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
43
Expires
Tue, 20 Mar 2018 15:39:18 GMT
log
qsearch-a.akamaihd.net/ 		35 B
312 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://qsearch-a.akamaihd.net/log?logid=kfk&evtid=rtbstl&url=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F70299%2Fmalware%2Frottensys-botnet.html&domain=securityaffairs.co&size=300x600&ext_user_id=0&iid=0&auction_id=450703c88713467f9ab60ff7902bd5ec&ip=148.251.45.254&crid=639665355&b4b=0.67&b9b=0.54&bc=0.67&rtbW=4&app_dis=0&cc=DE&rc=HE&bname=&bid_type=-1&bmlevel=0&mnet_segment=0.67&cmw=4&subBdr=15&dfp=1&source=2&dt=4
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
2.16.186.67 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-186-67.deploy.akamaitechnologies.com
Software
Apache /
Resource Hash
0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Mar 2018 15:39:18 GMT
Server
Apache
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
35
Expires
Tue, 20 Mar 2018 15:39:18 GMT
ptmd
dt.clnmde.com/ 		70 B
446 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://dt.clnmde.com/ptmd?t=152156035435931124477280_N4IgtgniBcDasEYA0BmATABiQNk0taALAOz6ECcxAukrGqnrlgSWZTbCkpVwmsV0Iou2ABwoOhbgKR8ZQkeI4BWab35c0w5GnIoEHbGtkb82-HoM0QAdwCOMWNYDGAJzAAHRyGK4CCclwAfQBzDwAXIIQQJB8-NADgsABDAEsAOyC0GJAEUSEtBGVCUIiglBy8gv1ioJSMoMIc7BRA7GUUZWVSyOVm1ux2zu76zOwQa2SAG3CYLBBkgBMpxbnYsNnoEByAZ3Dk8IBXHccJWIAvZJhkEA8QmBAANxyAU3Tnra91gAsHooTlNgMJ0hMpLHxCCRiGhRBgcuETlsEIRdLDiIRcF1RDlHoiQNgAHQYAkJcaxaYwLggABmzhgAFobi8rls9AAjRZ8ZwYeloZytRkIF6iekcl7U+nU6Fs7DEF7tNDYVaxF7hVLXZQAoEg2J7e7QeY7ADWD1w5CIGACxGUlt2Rpsm1ymqK2tqZotVpt0RVqS8SMIohJygQBMIyiDTV1Uz2f2dgOBxRhxByU2p11izmOkVSqy2ogAwgBVZQAIQAItgAKIAdRyITp0H+LoTok1RhAdhe1wAvkA
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
52.86.242.184 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-52-86-242-184.compute-1.amazonaws.com
Software
/ Express
Resource Hash
c414cd0e204de974f73753c7e28d7638e7b3691bb8b1a2bab6b25bb7fed7ce77

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:18 GMT
X-Powered-By
Express
Transfer-Encoding
chunked
Access-Control-Allow-Methods
GET,PUT,POST,DELETE,OPTIONS
Content-Type
image/gif
Access-Control-Allow-Origin
*
Connection
keep-alive
Access-Control-Allow-Headers
Origin, X-Requested-With, Content-Type, Accept, Bafp-Eg, Bafp-Ec, Bafp-Eg-T, Bafp-Ec-T
bql.php
qsearch.media.net/ Frame 5E05 		15 B
355 B 		Script
General
Check archive.org
Download Go to
Full URL
http://qsearch.media.net/bql.php?v=1&hvsid=00001521560356735024994892787740&geo=50.12|8.68&lper=100&bdrid=4&subBdr=15&fp=EIMN-ehR7Pps_CSyS_Yzo-2i1OixKc5bW9c2mufwmM6qC9U44Q2KYEIDdjWR4BeuD5Ps18NnWvafgTpKi3_6iPPvQmcJJKlwkuSX0rK8Y6hdGQ1ZN9V4dmeOQcZ5iYtm-rmJb6LPSag%3D&lpid=&tsid=18&ksu=112&q=&prv=&type=&ps=&cme=vA3G3R-Q2qSsoNCQ0nzVy-egAzjnXGQ-m4jUNSK5Ww0jKWF_ZwZ401dbeRcPPxCODWUBUgV0YgWudtcmGn2Crd2XaF3epOeb6bzizTcnegN2x25ZW7bKdGxfaX9xIAlWvR_OakWZaGO-w01pyqP13SjwAJ3S8VS9EtlRwLul4YBtsU_JoBzbNQ2bM2qd2h9FN-LNlNLDkJq3I0oqiYCumqhU9LJL9QZ1%7C%7CNDHRnZ9Gz3KXlI-i9OnZqQ%3D%3D%7C5gDUJdTGiJzedmq9hanWYg%3D%3D%7CN7fu2vKt8_s%3D%7CwQKqVZNVxsiGNthX_x6E7c3ZldeNVrJ-RbaPXw1kck92gsm6AvIigX3MW3pWhxL8NxEf4sQpuUQFR149KyILolnB78-c2gzt%7CsRBSg3CPSiQ%3D%7CT2PWNTnbBlWtQDjO_34og0RiygVsON4RfftkQuwHdDe_XWrh5MsyHnvrmg9eHqdQ58QlDEH2x0jmEA-UlELkH2qv4I5E72Jy54l_tqjpYrX10y4ciGkykaxoLjSZQauqM5zJMaLUT98Hx4opUf9G2Nz-fWN1oeQBMcG1gj_CXkt69zwsCd9dWA%3D%3D%7C&hint=&td=&cc=DE&wsip=2886947498&bca=0&ugd=4&&rc=0&fdkt=262&kwd[]=2018%20Upcoming%20Android%20Phones&kwt[]=262&kbc[]=38481&kwp[]=1&kid[]=321809956&kbc2[]=38481%7C%7C%7C%7Crpc%3D0.04&ktd[]=274895015936&kwd[]=Must%20Have%20Android%20Apps&kwt[]=262&kbc[]=38481&kwp[]=2&kid[]=276697959&kbc2[]=38481%7C%7C%7C%7Crpc%3D0.15&ktd[]=274911793152&kwd[]=Android%20Phone%20Price%20Lists&kwt[]=262&kbc[]=38481&kwp[]=3&kid[]=321841506&kbc2[]=38481%7C%7C%7C%7Crpc%3D0.01&ktd[]=824667607040&kwd[]=10%20Best%20Android%20Phones&kwt[]=262&kbc[]=38481&kwp[]=4&kid[]=294211106&kbc2[]=38481%7C%7C%7C%7Crpc%3D0.08&ktd[]=274911793152&kwd[]=Smartphone%20Price%20Comparison&kwt[]=262&kbc[]=143282&kwp[]=5&kid[]=159451961&kbc2[]=38481%7C%7C%7C%7Crpc%3D1.64&ktd[]=274911793152&kwd[]=Refurbished%20Smart%20Phones&kwt[]=262&kbc[]=143282&kwp[]=6&kid[]=148290072&kbc2[]=38481%7C%7C%7C%7Crpc%3D0.24&ktd[]=274911793152&kwd[]=PDA%20Software&kwt[]=262&kbc[]=13538&kwp[]=7&kid[]=21995228&kbc2[]=38481%7C%7C%7C%7Crpc%3D0.07&ktd[]=274895015936&kwd[]=Best%20Tablet%20PCs&kwt[]=262&kbc[]=13538&kwp[]=8&kid[]=3491659&kbc2[]=38481%7C%7C%7C%7Crpc%3D0.19&ktd[]=274911793152&kwd[]=Wireless%20Internet%20Providers&kwt[]=262&kbc[]=13538&kwp[]=9&kid[]=30956977&kbc2[]=38481%7C%7C%7C%7Crpc%3D0.55&ktd[]=274911793152&rand=1521560358450&cid=8CU5BD6EW&vwid=1521560356379511616&vi=1521560356379511616&l3ch=0&slnkp=no&bdrct=0.67&rt=630&tdAdd[]=rtbsd%3D10&tdAdd[]=ib=0&matchstring=&dytm=1521560357266&rtbsd=10&npgv=1&kbbq=%26sde%3D1%26adepth%3D1%26ddepth%3D0%26asn%3D24940&tdAdd[]=%7C%40%7Csde%3D1%7C%40%7Cadepth%3D1%7C%40%7Cddepth%3D0%7C%40%7CopenxEnabled%3Dtrue&verid=111299&hvsid=00001521560356735024994892787740&upk=1521560354.27618&sttm=1521560356735&=&vgd_bdata=bb%3D0%7C%7Cbtd%3D655360%7C%7Cfbb%3D0%7C%7Curl_l%3D3%7C%7Cbid%3D0.67%7C%7Cdevice_l%3D2%7C%7Cvariant%3D1&vgd_refimp=0&tdAdd[]=%7C%40%7Cabp%3A3%3A2&tdAdd[]=%7C%40%7Cabp%3A3%3A2&tdAdd[]=%7C%40%7Cabp%3A3%3A2&tdAdd[]=%7C%40%7Cabp%3A3%3A2&tdAdd[]=%7C%40%7Cabp%3A3%3A2&tdAdd[]=%7C%40%7Cabp%3A3%3A2&tdAdd[]=%7C%40%7Cabp%3A3%3A2&tdAdd[]=%7C%40%7Cabp%3A3%3A2&tdAdd[]=%7C%40%7Cabp%3A3%3A2&matm=1521560358471&abpl=2&tdAdd[]=nw%3DNone&tdAdd[]=nwType%3DNone&tdAdd[]=asnum%3D24940&tdAdd[]=proxy%3DNone&tdAdd[]=comp%3DNone&vgd_ckkr=0&vgd_ckadt=103&vgd_sc=HE&vgd_katid=800543883&vgd_katbid=-14&vgd_kals=ttype%3D2&vgd_kalog=SID%3D11%7C%7CMI%3D804%7C%7CMPTD%3D432%7C%7CHID%3D4%7C%7CCI%3D801%7C%7CTPTD%3D4%7C%7CUUID%3Duuid_s12_nc1b_4_1521558918_273623918%7C%7CSI%3D801&vgd_kasts=tstype%3DBANDIT_LIMITED_EXPLOITATION_BAG%7C%7C&vgd_altbql=sb&vgd_clsKb=2&vgd_pdtid=1&vgd_refcnf=%7B%22a2y%22%3A%7B%22afterLoadSecs%22%3A30%2C%22afterViewSecs%22%3A10%2C%22percentTraffic%22%3A50%7D%7D&vgd_sbSup=1&vgd_ourl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F70299%2Fmalware%2Frottensys-botnet.html&vgd_osrc=metatag&oRurl=http%3A%2F%2Fcdn3ncal.media.net%2Fmediamain.html%3F%26esi%3D1%26%26cid%3D8CU5BD6EW%26cpcd%3DRlAcVccC-RdUYIl-LjF9ag%253D%253D%26crid%3D639665355%26pid%3D8PO5M70HK%26size%3D300x600%26cpnet%3DyVb1sHm-0KIh29BOFTjjrOMbY3Wy7OSYfNFL7sC0vVY%253D%26cme%3Dsj8jUgUthZgb1dk55FlquHTZZWJ5h3uCyeWPMZuARP06ymyV8xaf7IGyrTEw9Mqe0VEgnOI2lfgsjpp_kIry7BcGTHhLQPB8su0CxyMmpe-aZep7AcFhefS-26SA-aelKUhC-QRXHFM%253D%257C%257CNDHRnZ9Gz3KXlI-i9OnZqQ%253D%253D%257C5gDUJdTGiJzedmq9hanWYg%253D%253D%257CN7fu2vKt8_s%253D%257CwQKqVZNVxsiGNthX_x6E7c3ZldeNVrJ-RbaPXw1kck92gsm6AvIigX3MW3pWhxL8NxEf4sQpuUQFR149KyILolnB78-c2gzt%257CsRBSg3CPSiQ%253D%257C%26cc%3DDE%26bf%3D0%26vif%3D1%26nse%3D3%26bid%3D210870%26vi%3D1521560356379511616%26lw%3D1%26ugd%3D4%26ib%3D0%26ourl%3Dhttp%253A%252F%252Fsecurityaffairs.co%252Fwordpress%252F70299%252Fmalware%252Frottensys-botnet.html%26osrc%3Dmetatag%26katid%3D800543883%26katbid%3D-14%26nb%3D1%26chost%3Dcontextual.media.net%26fvips%3D0%26vpf%3D000%26ap%3D0%26pf%3D0%26isOffice%3D0&tdAdd[]=uiparams%3D%3Brend_w%3A300%3Brend_h%3A600%3Bwin_w%3A1600%3Bwin_h%3A1200%3Bscr_h%3A1200%3Bscr_w%3A1600%3Bx_pos%3A973%3By_pos%3A2331%3Bkwd_scnt%3A9
Requested by
Host: contextual.media.net
URL: http://contextual.media.net/__media__/js/util/nrr.js?v=79
Protocol
HTTP/1.1
Server
2.16.186.113 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-186-113.deploy.akamaitechnologies.com
Software
Apache /
Resource Hash
c787e9dd6dc8ea3c935f5f0f30e3b9e4a3e066b4619bb244f569883f8e318a24

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Mar 2018 15:39:18 GMT
Server
Apache
ntCoent-Length
15
Vary
Accept-Encoding
Content-Type
text/javascript;charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
15
Expires
Tue, 20 Mar 2018 15:39:18 GMT
log
navvy.media.net/ Frame 5E05 		807 B
1 KB 		Other
General
Check archive.org
Download Go to
Full URL
http://navvy.media.net/log
Requested by
Host: contextual.media.net
URL: http://contextual.media.net/__media__/js/util/nrr.js?v=79
Protocol
HTTP/1.1
Server
54.241.182.29 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-241-182-29.us-west-1.compute.amazonaws.com
Software
Jetty(9.4.7.v20170914) /
Resource Hash
0a4c16b7f5c1b1ecefc9ffb4fcf1b457f9282d0863fa61d4dd32ad98dafa9a60

Request headers

Cache-Control
max-age=0
Origin
http://securityaffairs.co
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Pragma
no-cache
Date
Tue, 20 Mar 2018 15:39:18 GMT
Server
Jetty(9.4.7.v20170914)
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
max-age=0, no-cache,no-store
Connection
keep-alive
Content-Length
807
Expires
Tue, 20 Mar 2018 15:39:18 GMT
pixel
c.ad-srv.co/ Frame 5E05 		0
127 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://c.ad-srv.co/pixel
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
54.177.132.126 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-177-132-126.us-west-1.compute.amazonaws.com
Software
Varnish /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:18 GMT
Server
Varnish
Connection
keep-alive
X-Varnish
886443295
pixel
c.adyield.co/ Frame 5E05 		0
127 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://c.adyield.co/pixel
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
52.8.72.42 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-8-72-42.us-west-1.compute.amazonaws.com
Software
Varnish /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:18 GMT
Server
Varnish
Connection
keep-alive
X-Varnish
886477318
ptmd
dt.clnmde.com/ 		70 B
446 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://dt.clnmde.com/ptmd?t=152156035435931124477280_N4IglgbiBcAsA0IDOAXAhigrkmBtAjAJwC6iAXmjPogA4DmMIUiApgHZTQg0iJ0AWjfAFYATCIBsABgDMw2HMIz8+UbFgB2DaIAcU3iBQ4u+WKMJ6NsCaOHCdBiMZASAdFNfiJBtABsYMogAZgDGMAC01CAslFxKAEYAJqohUuGiITKEkfgsOuFJLEHhQdrxEhosEmISiQYsKGBUYpKy8oioDNBSHQDWjDaEalJEGsIjBki9AO4oQi3C0nKwAPqDw6Pj+PVgPCawOp7C+K6wwkewk76o8+KLbWY6Gga+QVSIIdgoK2B1XDoAYQAqsIAEIAEQkAFEAOoGOhhaAiO5LezCCyIACOLCoAF8gA
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
54.86.56.206 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-86-56-206.compute-1.amazonaws.com
Software
/ Express
Resource Hash
c414cd0e204de974f73753c7e28d7638e7b3691bb8b1a2bab6b25bb7fed7ce77

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:18 GMT
X-Powered-By
Express
Transfer-Encoding
chunked
Access-Control-Allow-Methods
GET,PUT,POST,DELETE,OPTIONS
Content-Type
image/gif
Access-Control-Allow-Origin
*
Connection
keep-alive
Access-Control-Allow-Headers
Origin, X-Requested-With, Content-Type, Accept, Bafp-Eg, Bafp-Ec, Bafp-Eg-T, Bafp-Ec-T
analytics.js
google-analytics.com/ 		35 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://google-analytics.com/analytics.js
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
SPDY
Server
172.217.16.164 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f164.1e100.net
Software
Golfe2 /
Resource Hash
f8ef655ef916e39713ede9c6db56d7ca5618bd82cf5ac991dcd013f05e0fdfc7
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 13 Nov 2017 20:19:12 GMT
server
Golfe2
age
4008
date
Tue, 20 Mar 2018 14:32:30 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
timing-allow-origin
*
alt-svc
hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="41,39,35"
content-length
14597
expires
Tue, 20 Mar 2018 16:32:30 GMT
collect
www.google-analytics.com/r/ 		35 B
101 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/r/collect?v=1&_v=j66&a=1308341093&t=pageview&_s=2&dl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F70299%2Fmalware%2Frottensys-botnet.html&ul=en-us&de=UTF-8&dt=The%20RottenSys%20botnet%20is%20already%20composed%20of%20nearly%205%20million%20Android%20devicesSecurity%20Affairs&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=KEBAAEAB~&jid=1654077770&gjid=735768044&cid=1364216025.1521560354&tid=UA-59069958-1&_gid=1082374052.1521560354&_r=1&z=1947554653
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
SPDY
Server
172.217.16.174 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f174.1e100.net
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Mar 2018 15:39:18 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
status
200
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
alt-svc
hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="41,39,35"
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
activeview
pagead2.googlesyndication.com/pcs/ Frame 9341 		42 B
110 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuzT2Bh9xrjc6RO5pegk4zhNQD3GM5qFCl-MRB6NdUHIjFyDwql4GBeMDDEpXIQMX6YBLoCtMRJd2ddeupRHt5nNrzqMrV1G1Y&sig=Cg0ArKJSzCek63RY-vxbEAE&id=osdim&ti=1&r=z&adk=2891760302&tt=318&bs=1585,1200&mtos=0,0,0,0,0&tos=0,0,0,0,0&p=0,0,0,0&inapp=0&bcn=1&mcvt=0&rs=3&ht=0&mc=0&lte=-1&bas=0&bac=0&bos=1600,1200&ps=1585,4116&ss=1600,1200&pt=2&deb=1-1-1-4-3-18-1-1&tvt=303&is=300,600&op=1&iframe_loc=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F70299%2Fmalware%2Frottensys-botnet.html&avms=geo&uc=1&tgt=BODY&cl=1&cec=5&clc=0&cac=0&cd=0x0&v=r20180312
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
SPDY
Server
216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s20-in-f2.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Mar 2018 15:39:18 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
status
200
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
content-type
image/gif
alt-svc
hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="41,39,35"
content-length
42
x-xss-protection
1; mode=block
expires
Fri, 01 Jan 1990 00:00:00 GMT
jstag
us-ads.openx.net/w/1.0/ Frame F578 		46 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://us-ads.openx.net/w/1.0/jstag
Requested by
Host: contextual.media.net
URL: http://contextual.media.net/nmedianet.js?cid=8CU5BD6EW
Protocol
HTTP/1.1
Server
173.241.240.212 New York, United States, ASN36089 (OPENX-AS1 - OPENX TECHNOLOGIES, INC., US),
Reverse DNS
ox-173-241-240-212.xa.dc.openx.org
Software
OXGW/15.0.0 /
Resource Hash
fa5b7fb2b246d858b0f8abc0b1fcd0893d57869851de3be301ab384c2a37703a

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:19 GMT
Content-Encoding
gzip
Server
OXGW/15.0.0
Vary
Accept-Encoding
P3P
CP="CUR ADM OUR NOR STA NID"
Cache-Control
max-age=3600
Content-Type
text/javascript
Content-Length
17091
Expires
Tue, 20 Mar 2018 16:39:19 GMT
ptmd
dt.clnmde.com/ 		70 B
446 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://dt.clnmde.com/ptmd?t=152156035435931124477280_N4IgZghiBcDaCMAGA7AZmQFgwTgGyIBo8DDSTyzDcMLbEBdA8CAZxlyYAtOZYAmQn3iNwYGHyYBXSTAAcqbExYAXCMsls4fAKwiAXlGjwmABwDmMEADcQTAKYA7G9BAnbIMzxfxtQ7flRtDEDsVHh4PixkZD5ZRHdlTRB4DD5sOMxcHW1Zdysk3AA6REKhXHcIABsYVCYwAGMYAFpjEDtDEFCAIwATCPrEJr56hRb4O1km3rswJrAYrtxkO1xfXB73O2UASxgfPwCgpWULaEIQFgBrSyzsSMR4bGRtB-crgHdlS32fQ4wAfVu90ez1e9m2bm8GFkpW08EKGG0sIwb0qKm+vl+iECqVkyHclTERiY9Q0yn+2w2LlkAGEAKraABCABFcABRADq7jMjSMmP82O02B8rQAjnY9gBfIA
Protocol
HTTP/1.1
Server
54.86.56.206 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-86-56-206.compute-1.amazonaws.com
Software
/ Express
Resource Hash
c414cd0e204de974f73753c7e28d7638e7b3691bb8b1a2bab6b25bb7fed7ce77

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:19 GMT
X-Powered-By
Express
Transfer-Encoding
chunked
Access-Control-Allow-Methods
GET,PUT,POST,DELETE,OPTIONS
Content-Type
image/gif
Access-Control-Allow-Origin
*
Connection
keep-alive
Access-Control-Allow-Headers
Origin, X-Requested-With, Content-Type, Accept, Bafp-Eg, Bafp-Ec, Bafp-Eg-T, Bafp-Ec-T
acj
us-ads.openx.net/w/1.0/ Frame F578
Redirect Chain
  • http://us-ads.openx.net/w/1.0/acj?ai=5a4021d3-c664-4d60-837c-8eb455d890e0&o=1929314863&callback=OX_1929314863&ju=http%3A//securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html&jr=&auid=5...
  • http://us-ads.openx.net/w/1.0/acj?cc=1&ai=5a4021d3-c664-4d60-837c-8eb455d890e0&o=1929314863&callback=OX_1929314863&ju=http%3A//securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html&jr=&a...
347 B
729 B 		Script
General
Check archive.org
Download Go to
Full URL
http://us-ads.openx.net/w/1.0/acj?cc=1&ai=5a4021d3-c664-4d60-837c-8eb455d890e0&o=1929314863&callback=OX_1929314863&ju=http%3A//securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html&jr=&auid=537253288&dims=1600x1200&adxy=0%2C0&res=1600x1200x24&plg=pm&ch=UTF-8&tz=0&ws=0x0&ifr=1&tws=1600x1200
Requested by
Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
Protocol
HTTP/1.1
Server
173.241.240.212 New York, United States, ASN36089 (OPENX-AS1 - OPENX TECHNOLOGIES, INC., US),
Reverse DNS
ox-173-241-240-212.xa.dc.openx.org
Software
OXGW/15.0.0 /
Resource Hash
557c7be7b51b83e674c81af2ae6f06a5d32860b6937bd1027954985f0c380642

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Mar 2018 15:39:19 GMT
Content-Encoding
gzip
Server
OXGW/15.0.0
Vary
Accept
P3P
CP="CUR ADM OUR NOR STA NID"
Cache-Control
private, max-age=0, no-cache
Transfer-Encoding
chunked
Content-Type
application/json
Expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Location
http://us-ads.openx.net/w/1.0/acj?cc=1&ai=5a4021d3-c664-4d60-837c-8eb455d890e0&o=1929314863&callback=OX_1929314863&ju=http%3A//securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html&jr=&auid=537253288&dims=1600x1200&adxy=0%2C0&res=1600x1200x24&plg=pm&ch=UTF-8&tz=0&ws=0x0&ifr=1&tws=1600x1200
Date
Tue, 20 Mar 2018 15:39:19 GMT
Server
OXGW/15.0.0
Content-Length
0
P3P
CP="CUR ADM OUR NOR STA NID"
ptmd
dt.clnmde.com/ 		70 B
446 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://dt.clnmde.com/ptmd?t=152156035435931124477280_N4IglgbiBcAcA0IDOAXAhigrkmBtAjAJwC6iAXmjPogA4DmMIUiApgHZTQg0iJ0AWjfAFYATCIBsABgDMwgCxzCM-PlHz5Adk2jYU3iBQ4u+eaMJ7N8iaOHDYBiMZASAdFNfiJBtABsYMogAZgDGMAC01CAslFzKAEYAJmohUuGiITKEkfgssOFJLEHhQTrxEposEmISiQYsKGBUYpKyCoioDNBSHQDWjDaE6lJEmsIjBki9AO4oQi3C0nLyAPqDw6Pj+PVgPCbysJ7C+K7ywkfyk76o8+KLbWawmga+QVSIIdgoK2B1XLAAYQAqsIAEIAEQkAFEAOoGOhhaAiO5LGxiBAgACOLCoAF8gA
Protocol
HTTP/1.1
Server
54.86.56.206 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-86-56-206.compute-1.amazonaws.com
Software
/ Express
Resource Hash
c414cd0e204de974f73753c7e28d7638e7b3691bb8b1a2bab6b25bb7fed7ce77

Request headers

Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Tue, 20 Mar 2018 15:39:22 GMT
X-Powered-By
Express
Transfer-Encoding
chunked
Access-Control-Allow-Methods
GET,PUT,POST,DELETE,OPTIONS
Content-Type
image/gif
Access-Control-Allow-Origin
*
Connection
keep-alive
Access-Control-Allow-Headers
Origin, X-Requested-With, Content-Type, Accept, Bafp-Eg, Bafp-Ec, Bafp-Eg-T, Bafp-Ec-T
ptmdP
dt.clnmde.com/ 		7 B
437 B 		Other
General
Check archive.org
Download Go to
Full URL
http://dt.clnmde.com/ptmdP
Requested by
Host: pxlclnmdecom-a.akamaihd.net
URL: http://pxlclnmdecom-a.akamaihd.net/javascripts/browserfp.min.js?templateId=3
Protocol
HTTP/1.1
Server
54.86.56.206 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-86-56-206.compute-1.amazonaws.com
Software
/ Express
Resource Hash
aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27

Request headers

Cache-Control
max-age=0
Origin
http://securityaffairs.co
Referer
http://securityaffairs.co/wordpress/70299/malware/rottensys-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Date
Tue, 20 Mar 2018 15:39:24 GMT
X-Powered-By
Express
ETag
W/"7-Jgyp3YpFd/wAt71YECmAdg"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET,PUT,POST,DELETE,OPTIONS
Content-Type
text/html; charset=utf-8
Access-Control-Allow-Origin
*
Connection
keep-alive
Access-Control-Allow-Headers
Origin, X-Requested-With, Content-Type, Accept, Bafp-Eg, Bafp-Ec, Bafp-Eg-T, Bafp-Ec-T
Content-Length
7

Verdicts & Comments Add Verdict or Comment

98 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| _wpemojiSettings undefined| $ function| jQuery function| cli_show_cookiebar function| l1hs object| jQuery112406789798639435858 object| stlib boolean| tpcCookiesEnableCheckingDone boolean| tpcCookiesEnabledStatus string| stWidgetVersion boolean| opt_out object| stLight boolean| st_showing object| _st undefined| product function| __sharethis__docReady object| __sharethis__ string| GoogleAnalyticsObject function| ga string| medianet_width string| medianet_height string| medianet_crid object| _mN function| setup string| _mN_Idf string| _mN_ctrM number| _mN_ctr object| _mNDetails object| _mN_dy boolean| _mNVideoInjection object| _mNX number| medianetTimer object| wp object| gaplugins object| gaGlobal object| gaData object| twemoji function| _mNRequireX function| _mNDefineX object| rtbsBidA number| eti object| hs string| ea string| cp string| pd object| ad_regex string| adod string| sdod number| templateId object| templateMap object| template object| cmurlKeyList string| sk string| skwt string| esi_ip number| staging function| browserfp object| sppx number| bfObjLdCnt object| _mNL2 object| winScope number| _mN_mc_cnt string| _mN_mc_frameID string| locHash object| resultPageUtil string| iframeURL function| loadL3 object| FB object| _mNExtKwds object| click_object object| wpcom_img_zoomer object| detectZoom object| Main object| BrowserDetect object| mejs function| onYouTubePlayerAPIReady function| onYouTubePlayerReady function| MediaElement function| MediaElementPlayer function| $j function| imagePreview object| gapi object| ___jsl object| _stq function| st_go function| linktracker_init object| wpcom object| osapi object| gadgets object| shindig object| iframer function| ToolbarApi object| iframes function| IframeBase function| Iframe function| IframeProxy function| IframeWindow object| __gapi_jstiming__

6 Cookies

Domain/Path Name / Value
.media.net/ Name: visitor-id
Value: 1645619598927873000V10
.securityaffairs.co/ Name: _gat
Value: 1
securityaffairs.co/ Name: OX_mNCM_user_latency
Value: 634
.securityaffairs.co/ Name: __gads
Value: ID=46cf3d993fa9650b:T=1521560357:S=ALNI_MYCKA1zG1VG3dBhC6MH_6qU2wjdRQ
.google.com/ Name: NID
Value: 126=oL_OZ-TSlCV68EzXAXfHRR9HloTEw-qFgtkBeXfmqDzW7946Fg8uXiV4KKSeYWKY_r6vFGDhMM_wHTk7t3eQVn0DYSX8PIfGbHWFIlG1F84YN8zQhXcKVmGGG373acD5
securityaffairs.co/ Name: OX_mNCM_net_latency
Value: 266

7 Console Messages

Source Level URL
Text
console-api log URL: http://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=1.4.1(Line 23)
Message:
JQMIGRATE: Migrate is installed with logging active, version 1.4.1
console-api warning URL: http://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=1.4.1(Line 45)
Message:
JQMIGRATE: jQuery.fn.load() is deprecated
console-api log URL: http://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=1.4.1(Line 47)
Message:
console.trace
console-api warning URL: http://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=1.4.1(Line 45)
Message:
JQMIGRATE: jQuery.fn.unload() is deprecated
console-api log URL: http://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=1.4.1(Line 47)
Message:
console.trace
console-api log URL: http://securityaffairs.co/wordpress/wp-content/plugins/facebook-button-plugin/js/script.js?ver=dc488b3cf402a36ed8529f3196db2a8a(Line 5)
Message:
1585
console-api log URL: http://securityaffairs.co/wordpress/wp-content/plugins/facebook-button-plugin/js/script.js?ver=dc488b3cf402a36ed8529f3196db2a8a(Line 14)
Message:
2

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

0.gravatar.com
adservetx.media.net
adservice.google.com
apis.google.com
c.ad-srv.co
c.adyield.co
connect.facebook.net
contextual.media.net
dt.clnmde.com
fonts.googleapis.com
fonts.gstatic.com
google-analytics.com
h.mnet-ad.net
i0.wp.com
i1.wp.com
i2.wp.com
l.sharethis.com
maxcdn.bootstrapcdn.com
medianet-d.openx.net
navvy.media.net
opt-east.media.net
opt.media.net
pagead2.googlesyndication.com
pixel.wp.com
platform-api.sharethis.com
pxlclnmdecom-a.akamaihd.net
qsearch-a.akamaihd.net
qsearch.media.net
s0.wp.com
securepubads.g.doubleclick.net
securityaffairs.co
stats.wp.com
tpc.googlesyndication.com
us-ads.openx.net
w.sharethis.com
www.facebook.com
www.google-analytics.com
www.googletagservices.com
104.90.192.189
172.217.16.162
172.217.16.164
172.217.16.174
172.217.17.67
172.217.22.98
173.241.240.212
173.241.240.220
185.60.216.19
185.60.216.35
192.0.73.2
192.0.76.3
192.0.77.2
192.0.77.32
2.16.186.113
2.16.186.27
2.16.186.67
2.21.246.49
216.58.206.1
216.58.206.10
216.58.206.14
216.58.206.2
217.160.0.146
23.67.137.77
52.57.39.144
52.8.72.42
52.86.242.184
54.177.132.126
54.241.182.29
54.86.56.206
94.31.29.16
00d534b6d1d7adf2faa7861ce9557403c3c08304e2791fd4301029b0e142c286
00f28fdb987ce0f9edc935ffe381123a2e1f79fcc0f55759a7bb4a83b4a88584
00fc25d330bf8ee768abd4872c06d1d37733118224a872988368a58758f05082
018cfd18a78eaf5ecdc40d0c3fa3380db81f38d118ecd0432b6803bef23f65bc
02e9b97056be5d76b813d92b67aac7d714f69536fe8af92a94d1dcbda8d0ad29
0757f7ff6e5f6a581922a5e2d42c5e0cf7475d880885a9802e8bdd5e4188dd34
0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9
0a4c16b7f5c1b1ecefc9ffb4fcf1b457f9282d0863fa61d4dd32ad98dafa9a60
0a6b90b75ea7a7ffcf626ab21af202818e7f820e487ba05c122e68c4702a843d
0bffe6a234d4da5672bb56597c0c60df3bfb0fb0899bde4be2241c1a27ed005e
0c27a9c1aee9eacb73655f930a6bbf9ec721006695e5c38405296081cdbcb878
0e53466218d7ff174e0a083ecce89b1c090c67ccbe55775eddca03e930ff9e35
0fd28fece9ebd606b8b071460ebd3fc2ed7bc7a66ef91c8834f11dfacab4a849
1159649e0b1405aa5be707ac5b43ad9ba0edf8b80420934e8b2f1ba956fea7fe
13b61826fde5b78966364a0bfe1f2309da1f0ccd75923528a5014978b7276742
155ef7601d4af029d8b6f3efa4ed4984748ea0a36c85f038f129ffdc6fb83b66
1832a6ee34745b08b1fcae42c24468086358b43071d7679a738951aa7dc243ea
1873838ce2201dbf71eebca918ba4a74518a6a9bddba5ef3d0ead7438c571bf0
18d61b5ee68a57bd7a4733f776f9f8aa5c353e7f35a420881523b6edbf7c6b19
18edeb310355e52f33047c7e4ddfd39b61cd6d09fff02edac49a2a2878f6c9cb
19e1c4c97917724cacf9f2e3c544ed0925a14ef28a79565b7bae38fc70ac82f2
1aaab3c3d6f974416ae34893cebe3a544aea17931439b2449ec392061d11ec82
1b516cb95ddf27703d0b1cfddab9c97fa9b2696644718dd1b4376c39dca93767
1e6bdd2f9845ad83539914bc8cdc7ddf80cbe48ef70f3cc5722e5c6cebd3c8f7
1e9a9ba24042f2effe58a5d585f70a7bc4b917e60ddcb9a780ad03817a78381f
1fd97d1ad27c851bf7515fa9c9e0770d7035a310a3f5bbdbddc5c76a85090a59
207461e411e1ff6d6c5b0dd702d26031adb86de86ed3f571baa5a6fc498fc4b6
20ef0f0c8d0eea98772412cea9b3b92612e3e53cb5e59152b5703165f56e8a53
2199990352edbb7ec586e01d26e2f6a7010a2fce1517711019b614dcec353ba3
2333802e4a0c86b4cc4c71b376fc0aedc3b03039bfc777d96105f82231215732
25bc27bc2bca833ca72b130bd70a7a3139337edc9b3ccae76e5b0a9ccfedbddc
2f64b025cec8c93dcb01fe88f0e79c134bc0a6c751787360153865dfa9f3a962
30ace6a9999ef90eaad3df0a3a23b2bb688ec0461865ea56f2d58a780c800daa
313c219bfa85a95e056ba2aa046c848e737e3a2c93c20853dcebf2c0b97f9bfc
336383f7ac92ebfd27fa47a1380a49a64b47d1b763f34909f464e826d738e10a
35d53611abbe21d6580bb091ca4bb9b117fd12a48e0b551be3d17774c68ff9c9
36c7530a7bd3067500991d747aec8bb348245375fadd3c62ce47e877551e04dd
372b3aaa8c5955cd5361423f1893f65961c33ec2c87370643438169f0196c06f
3e88266cc04e60bb9777d4207222df85dbc99bf1d18538c622dd6fffc17a21a9
4359fc4ebbddf4ab9e93191dedb6c19e6aa2d1531157cc3016796781f39615dc
43a486b93bf80d5f153ccb73b4964f8ce8fe339a3b7b9bb6e10727043a521aac
45185c8f6cd2f9b42e3a02b78af40edc7d61328fac3167a0490c9c69bbecaaa6
464db2eecec0133fa595131850ae7478d8bc7359a5299a59985f1a42e389f187
4b456e49e6c017d53be594d467c4508368dbe32ea0fd52a4b0718d5dc1862d51
4ebfc8a4d1b994a574fd6a0e1bb67f17bd8ada120792586b6b25a00a995eb03d
505cdec32ce9430d2a392dde4062152fbf7a2ee5b59d435babdd5baa8d4ad26b
52726fb580d6bffc46615863ddbf4c319524b5a68fb484be2972bdad4fd0310d
541ac58217a8ade1a5e292a65a0661dc9db7a49ae13654943817a4fbc6761afd
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
5525d57ced576560de8777ea78e4bc0c9d55396c0b668a7563b354de9c165aee
557c7be7b51b83e674c81af2ae6f06a5d32860b6937bd1027954985f0c380642
562487753256f10cc9e7bec2c59b54c5b6e564f9c72036675f14088415032775
5ca0636ee5ba9229b08ea875292b99b035d0794fa922a5f1eeab0ff4ed766ec0
5fe76b89002b51ecfbcfe67c4eaf99b7ab108168d099dda0d2a40398b06051f8
606438e847fe03016f9b522edc743ae201910c9583ad332d94ae4e3504ceb27e
639b4509780048ed50d9f5cd861010522112bcf8c9c2d26f5ddec78c7e739a5b
643a860832456b5a74825b79d625434b5c4c2a344b8f9bef3614b327bea52646
66752d0563d35538a04b5ab58b05cebb936b9335470b6a211c2718234cae77c2
69e652101a2c4d8040d6f6082b20b858fc8b7840339ca067d64499f2e9b22a9b
6caaf7466d192f0ca133767eef8d61dc2df413af12320419c1ecb390b73e4405
6ce3e202dbc8399999cf2d612b00fe92933870d7372174b9043db85d63afe70b
6de94eed26d5412d87b7b2e72e2d2f0e3aea38903c3f975d77323ac98314e32b
6f51bc9ebf7850acad4c4f8599c06ec74ee3749b7f4e5d38d29fb8aa1fbf1424
736760c50b3462fa190e833ca8d26d2d2e1c6f995ed631d155ad24546bbf2e9f
7478123ab457a28ecf9df78f2832fbdbefc205eaef0930b4f6666903e756be46
74a78cea892f43d01c7573729c200c97dfebe5835476364435e411d0a674e28a
759949fb0ffaa47eb3755d704adfee7be3ab4fd3d3fa2f37381ca6ea8b9506b1
76a18f5f0637e0d73ce1afece898ce8b0fa75bb6b1c1990ae4a7ac6b083045ce
7dda926d3d8e49c55355f139738fb7046f3beb45420f7c5f108c888aa7fc26bf
7fc6b71fecae57ad350ffe89e9059442916fa401c3d3441e8aeb4c20d7a34ec3
7fceadfed55064d3f3d49652e0817c49b2c78de5b6d9280b0477b5b653858bca
7ff1ab2a9fbac7e387401473e291672fed8e4462c74b3bfd369ab34a47fed202
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84cf7b58bf9470a372894d186bbd7e1ccac05b5baa84a7d0be44158f4981effc
855538077b6944e6a4300454d027510188c642643017949aaa8aa58652096f3d
859999ff4ae2fc2a72555fc968f13bf2c9fcbe6c1190726ae82d14bdbdc89c72
87879846a54fe4a250a2a9808103f1ed6943af45e4cbb7f067c44da57c61b3d4
8ac1703c1c34b2be426deda409d39258f82fae17f13e645f377f337a954aedde
8b63cfc4750823ed439e52bb326ff1e25a0ab07846da5c1b956c82ddb9474a1f
8d732b3483eb44546a848a82cc9d6a584c81860aae7255f7ac589dcb3f130535
8e1e9a0b5aeb0d5918ce5ba15e51b17fcbebae531b4d0dcc07655ccd04b6858c
8e5cd0149eff438710d9e98c6834de800d2a0164440937d415f41abfce954e6f
9253b2bc7ff479992bd37d1d951c8ce67695c6031345fe7fb21d9866bb7f93ae
9756bb2e61f42b57e4409a60a2b376ad5eea5f0276c6159ba957973f9210d2f1
9814def2079b6eb77cf4d12001d7fd7e48032d8e1add430ac20033bba091c08e
982421ce4236bc3b2be7cc5c11d09c5a95e61548fabf22c8b98680019c08f578
9869bf998d9dee691349d634a714bf20d6bde49c9d5160eb1cf103f76c4738e5
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a
9a47abcc220084cd32dd51bd76f84ff7839e2dbf1a132fb970e8a1437f03726b
9b61e177f50bb90a24554c909f0e1ecef284283d3cee4b99379dab211ca3e189
a0fded691aed767f851011cd3185b928619298a21a0fbdad4808a9e88b490833
a26fd52082f9c6c191e6f75ca86d82544f74ec979da9c64406a89bea6247a9e9
a3b3c4f67bf2b44294215e2be76f12794e6b142edec201e199c93c38739f2bfc
a5fa6e1ad7a4121ebd2c5625f83e6e0883c32e2c1ffbf35bc2743f12717c4313
a6ae50acb2000fab66cfd21243ebe3e48bcda59331a4b39100cd9152407ce757
a8f961f7ae2f3245e8383f659d264eb56983adb23a399b23a62fa951734d0768
ab313de30e88839debcbd24c24054cf91123244d263a16a9aa3864a50befaf92
abae7907ec871ff169333a353a830e2834440b42645b84a4c1ab228223cc6131
abf0a396ecd082fb921175db8d4bc820ac383082eb4f8a566f4cee5aaa786808
aea0c8ddd84132838fcee935f9d827ec5f7ba116e443b25db7a5bcc944cbe914
aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
af3661ba51edf3da65414119d0b8042aee9cf1312c39b8652070b6ae3de24cee
b12c1cd811f54d11bfdcb5e235e73934a8b8a7a85eafb8529117f9a5bb64ccf8
b3125d3c4f7dfa6652acea2cf7845db41eb5531788f0743c8e08122fb4df1b2b
b68659ff00e064d9afb54423ec69597994c1a141433f2ba1d58a2307c7a8dbea
b980a05e2b73c6bbf5536e4281a084f6718548214c496f599f7ef427a49cc327
b9b000e237865c5af89426052f9b7f1ed078a04d64ad0646a9a5aedc3581c6e2
bfe6c3c6e8c38610223dbeae0821e5afec8c5b114d7828268609a88c43c5770c
c414cd0e204de974f73753c7e28d7638e7b3691bb8b1a2bab6b25bb7fed7ce77
c59b9753598e273fd99fcc3a1e4b56a9537b629d0c714f3d4f347cfa1214804d
c66614f9b335585b0cb4cc77e3a0ba22a358e6d0e234ec4d9f9f89fa3848fdc5
c68a880944aa03082e88bbe6c7df7747ee45f506fa777e76fb41709a0ba5a935
c787e9dd6dc8ea3c935f5f0f30e3b9e4a3e066b4619bb244f569883f8e318a24
cab944a462b37f84a06e26dc28c9d68818410763a2cd2d606d66c1d7eae7a906
d1a301f4dd52945b5cf0f0c018af9779de11a70d82c26edb17139756af5a16d5
d242e05b27b8d6ace3bfc206e9ab79ee073cd07647ffeb3c257b8abb61ae9cb4
d6453e4ef533b200e04bb79efd3225c1f8e9fac71ece2ef7f7b9c7d8b4b7b73c
d80a9fbd9c4a76d5d7c6b14e635088b322863f7a78f61508df1e77342669e0ec
d8c69f17ea9a0ab3fd3c929d5582527da38ac63d5b64fd8e9d4e63832b3a0cce
d99ea9db1da8549489666d36c9e3fb717842550eed1554e96860af8d30c3b008
d9ac862518df3efb07d7cecda391ab683489cf26fa04d62e179ba60869dd69bb
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e533fb7de77474066905d811094257f4e166b6849e7ae584c2ef44ced9c80433
e89bbc7723c5114f9cf138c6019bbca4e4f5e13f6b9febaa38c92c4c3584a964
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f0c6d2d27de284102b03e30cd74be808801ec53ca49f30b4d15620ee84ea39f5
f32d41f2099a0be20e6b57c5e0d1b71c079d3e1345827b0f5c5b97c6e5e3f78d
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
f8ef655ef916e39713ede9c6db56d7ca5618bd82cf5ac991dcd013f05e0fdfc7
fa5b7fb2b246d858b0f8abc0b1fcd0893d57869851de3be301ab384c2a37703a
fc48d1d80ece71a79a7b39877f4104d49d3da6c3665cf6dc203000fb7df4447e
ff1797154ee7426f3b00269114eb7074444e2c782d3063bdd2fccc76059375bf
ff51d0f7e159b0235a222f81ca24f2082c8ea226995de3b8f01fe7bfc2bf2ea2
ffa31f5802b20d64a10c71ad93394c1e2b4b16f33e2f479d8274fd02ce0a594f