Submitted URL: https://t.co/aHrXW7ESH9
Effective URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Submission: On March 11 via manual from IT

Summary

This website contacted 56 IPs in 4 countries across 40 domains to perform 203 HTTP transactions. The main IP is 151.101.2.165, located in San Francisco, United States and belongs to FASTLY - Fastly, US. The main domain is www.csoonline.com.
TLS certificate: Issued by GlobalSign CloudSSL CA - SHA256 - G3 on October 2nd 2018. Valid for: 9 months.
This is the only time www.csoonline.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 104.244.42.69 13414 (TWITTER)
2 82 151.101.2.165 54113 (FASTLY)
1 143.204.214.33 16509 (AMAZON-02)
1 95.100.198.152 16625 (AKAMAI-AS)
3 2a00:1450:400... 15169 (GOOGLE)
1 95.100.198.4 16625 (AKAMAI-AS)
4 2606:4700::68... 13335 (CLOUDFLAR...)
2 2a00:1450:400... 15169 (GOOGLE)
4 35.201.98.64 15169 (GOOGLE)
12 34.226.72.36 14618 (AMAZON-AES)
3 2a00:1450:400... 15169 (GOOGLE)
1 4 142.0.173.130 7160 (NETDYNAMICS)
1 172.217.21.194 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
1 35.190.75.210 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
5 52.19.153.98 16509 (AMAZON-02)
1 143.204.214.66 16509 (AMAZON-02)
2 143.204.214.36 16509 (AMAZON-02)
5 23.211.2.209 16625 (AKAMAI-AS)
1 52.18.226.220 16509 (AMAZON-02)
2 151.101.194.110 54113 (FASTLY)
13 2.18.70.82 16625 (AKAMAI-AS)
2 50.31.142.51 22075 (AS-OUTBRAIN)
3 7 2.18.162.235 16625 (AKAMAI-AS)
2 2a03:2880:f01... 32934 (FACEBOOK)
1 35.201.117.115 15169 (GOOGLE)
5 2a04:4e42::645 54113 (FASTLY)
1 2600:9000:200... 16509 (AMAZON-02)
3 2a00:1450:400... 15169 (GOOGLE)
2 52.218.208.130 16509 (AMAZON-02)
1 1 2606:2800:234... 15133 (EDGECAST)
1 104.244.46.112 13414 (TWITTER)
1 172.217.16.166 15169 (GOOGLE)
2 151.101.2.2 54113 (FASTLY)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a02:26f0:6c0... 20940 (AKAMAI-ASN1)
1 2a00:1450:400... 15169 (GOOGLE)
2 2a03:2880:f11... 32934 (FACEBOOK)
3 151.139.128.10 20446 (HIGHWINDS3)
1 2600:9000:200... 16509 (AMAZON-02)
1 2a00:1450:400... 15169 (GOOGLE)
1 35.158.24.211 16509 (AMAZON-02)
1 4 3.120.56.246 16509 (AMAZON-02)
1 2 35.190.59.101 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 35.153.195.133 14618 (AMAZON-AES)
1 54.88.112.216 14618 (AMAZON-AES)
2 50.31.142.19 22075 (AS-OUTBRAIN)
1 2a00:1450:400... 15169 (GOOGLE)
1 35.190.40.172 15169 (GOOGLE)
2 35.201.67.47 15169 (GOOGLE)
1 52.73.80.148 14618 (AMAZON-AES)
1 52.86.200.205 14618 (AMAZON-AES)
3 34.199.191.3 14618 (AMAZON-AES)
1 54.208.241.180 14618 (AMAZON-AES)
203 56
Apex Domain
Subdomains
Transfer
62 csoonline.com
www.csoonline.com
391 KB
17 outbrainimg.com
tcheck.outbrainimg.com
log.outbrainimg.com
images.outbrainimg.com
454 KB
17 staticworld.net
fonts.staticworld.net
idge.staticworld.net
127 KB
13 blueconic.net
cdn.blueconic.net
idg.blueconic.net
166 KB
11 connatix.com
cdn.connatix.com
cdns.connatix.com
ck.connatix.com
core.connatix.com
rtb.connatix.com
i.connatix.com
trk.connatix.com
v.connatix.com
207 KB
7 skimresources.com
s.skimresources.com
p.skimresources.com
r.skimresources.com
t.skimresources.com
17 KB
7 scorecardresearch.com
sb.scorecardresearch.com
7 KB
7 outbrain.com
widgets.outbrain.com
odb.outbrain.com
mv.outbrain.com
75 KB
7 3lift.com
ib.3lift.com
tlx.3lift.com
eb2.3lift.com
54 KB
5 postrelease.com
jadserve.postrelease.com
3 KB
5 google.com
www.google.com
adservice.google.com
ampcid.google.com
1 KB
4 eloqua.com
secure.p01.eloqua.com
2 KB
4 spiffymachine.com
spiffymachine.com
78 KB
4 ziprecruiter.com
www.ziprecruiter.com
api.ziprecruiter.com
11 KB
3 google-analytics.com
www.google-analytics.com
18 KB
3 consensu.org
admiral.mgr.consensu.org
vendorlist.consensu.org
api.skimlinks.mgr.consensu.org
15 KB
3 googleapis.com
storage.googleapis.com
fonts.googleapis.com
435 B
2 linksynergy.com
automate.linksynergy.com
929 B
2 facebook.com
www.facebook.com
247 B
2 amazonaws.com
automate-prod.s3.amazonaws.com
168 KB
2 facebook.net
connect.facebook.net
60 KB
2 dwin2.com
www.dwin2.com
58 KB
2 gstatic.com
www.gstatic.com
fonts.gstatic.com
104 KB
2 googletagmanager.com
www.googletagmanager.com
63 KB
2 doubleclick.net
securepubads.g.doubleclick.net
ad.doubleclick.net
58 KB
2 google.de
adservice.google.de
ampcid.google.de
537 B
2 idgesg.net
images.idgesg.net
204 KB
1 typekit.net
p.typekit.net
367 B
1 googlesyndication.com
tpc.googlesyndication.com
1 ads-twitter.com
static.ads-twitter.com
2 KB
1 twitter.com
platform.twitter.com
254 B
1 jwplatform.com
content.jwplatform.com
32 KB
1 adsrvr.org
match.adsrvr.org
526 B
1 soundcloud.com
w.soundcloud.com
3 KB
1 permutive.com
cdn.permutive.com
63 KB
1 googletagservices.com
www.googletagservices.com
11 KB
1 techhive.com
images.techhive.com
6 KB
1 indexww.com
js-sec.indexww.com
28 KB
1 ntv.io
s.ntv.io
77 KB
1 t.co
t.co
451 B
203 40
Domain Requested by
62 www.csoonline.com 2 redirects t.co
www.csoonline.com
12 images.outbrainimg.com www.csoonline.com
12 idg.blueconic.net cdn.blueconic.net
12 idge.staticworld.net www.csoonline.com
7 sb.scorecardresearch.com 3 redirects www.csoonline.com
5 widgets.outbrain.com www.csoonline.com
widgets.outbrain.com
5 jadserve.postrelease.com s.ntv.io
www.csoonline.com
5 fonts.staticworld.net www.csoonline.com
fonts.staticworld.net
4 trk.connatix.com www.csoonline.com
4 eb2.3lift.com 1 redirects www.csoonline.com
ib.3lift.com
4 log.outbrainimg.com widgets.outbrain.com
4 secure.p01.eloqua.com 1 redirects www.csoonline.com
4 spiffymachine.com www.csoonline.com
spiffymachine.com
3 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
www.csoonline.com
3 www.google.com www.csoonline.com
www.gstatic.com
2 t.skimresources.com s.skimresources.com
2 automate.linksynergy.com t.co
www.csoonline.com
2 r.skimresources.com 1 redirects www.csoonline.com
2 p.skimresources.com www.csoonline.com
2 www.facebook.com www.csoonline.com
www.googletagmanager.com
2 automate-prod.s3.amazonaws.com t.co
2 connect.facebook.net idg.blueconic.net
connect.facebook.net
2 www.dwin2.com www.googletagmanager.com
www.dwin2.com
2 ib.3lift.com t.co
ib.3lift.com
2 api.ziprecruiter.com www.ziprecruiter.com
2 www.googletagmanager.com www.csoonline.com
www.googletagmanager.com
2 storage.googleapis.com www.csoonline.com
2 www.ziprecruiter.com www.csoonline.com
2 images.idgesg.net www.csoonline.com
1 v.connatix.com www.csoonline.com
1 i.connatix.com www.csoonline.com
1 rtb.connatix.com cdns.connatix.com
1 api.skimlinks.mgr.consensu.org s.skimresources.com
1 fonts.gstatic.com www.csoonline.com
1 core.connatix.com cdns.connatix.com
1 fonts.googleapis.com spiffymachine.com
1 ck.connatix.com cdns.connatix.com
1 mv.outbrain.com widgets.outbrain.com
1 tlx.3lift.com ib.3lift.com
1 ampcid.google.de www.google-analytics.com
1 vendorlist.consensu.org spiffymachine.com
1 s.skimresources.com www.googletagmanager.com
1 ampcid.google.com www.google-analytics.com
1 p.typekit.net www.csoonline.com
1 cdns.connatix.com cdn.connatix.com
1 tpc.googlesyndication.com spiffymachine.com
1 odb.outbrain.com widgets.outbrain.com
1 ad.doubleclick.net spiffymachine.com
1 static.ads-twitter.com www.csoonline.com
1 platform.twitter.com 1 redirects
1 content.jwplatform.com www.csoonline.com
1 cdn.connatix.com t.co
1 admiral.mgr.consensu.org spiffymachine.com
1 tcheck.outbrainimg.com widgets.outbrain.com
1 match.adsrvr.org js-sec.indexww.com
1 w.soundcloud.com www.googletagmanager.com
1 www.gstatic.com www.google.com
1 cdn.permutive.com www.csoonline.com
1 securepubads.g.doubleclick.net www.googletagservices.com
1 adservice.google.com www.googletagservices.com
1 adservice.google.de www.googletagservices.com
1 www.googletagservices.com www.csoonline.com
1 images.techhive.com www.csoonline.com
1 js-sec.indexww.com www.csoonline.com
1 s.ntv.io www.csoonline.com
1 cdn.blueconic.net www.csoonline.com
1 t.co
203 67
Subject Issuer Validity Valid
t.co
DigiCert SHA2 High Assurance Server CA
2018-10-30 -
2019-11-04
a year crt.sh
idg.map.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3
2018-10-02 -
2019-07-17
9 months crt.sh
*.blueconic.net
Thawte RSA CA 2018
2017-12-13 -
2019-12-13
2 years crt.sh
*.ntv.io
DigiCert SHA2 Secure Server CA
2018-06-12 -
2019-12-11
a year crt.sh
www.google.com
Google Internet Authority G3
2019-03-01 -
2019-05-24
3 months crt.sh
san.casalemedia.com
GeoTrust RSA CA 2018
2019-01-09 -
2020-03-09
a year crt.sh
ziprecruiter.com
CloudFlare Inc ECC CA-2
2019-01-03 -
2020-01-03
a year crt.sh
*.storage.googleapis.com
Google Internet Authority G3
2019-03-01 -
2019-05-24
3 months crt.sh
spiffymachine.com
Let's Encrypt Authority X3
2019-03-05 -
2019-06-03
3 months crt.sh
*.g.doubleclick.net
Google Internet Authority G3
2019-03-01 -
2019-05-24
3 months crt.sh
*.p01.eloqua.com
DigiCert SHA2 Secure Server CA
2019-01-14 -
2021-03-14
2 years crt.sh
*.google.com
Google Internet Authority G3
2019-03-01 -
2019-05-24
3 months crt.sh
*.google-analytics.com
Google Internet Authority G3
2019-03-01 -
2019-05-24
3 months crt.sh
*.permutive.com
DigiCert SHA2 Secure Server CA
2018-05-15 -
2019-06-19
a year crt.sh
*.postrelease.com
Amazon
2018-04-25 -
2019-05-25
a year crt.sh
*.soundcloud.com
GlobalSign Domain Validation CA - SHA256 - G2
2018-04-12 -
2020-06-08
2 years crt.sh
*.3lift.com
Amazon
2018-07-24 -
2019-08-24
a year crt.sh
*.outbrain.com
DigiCert SHA2 Secure Server CA
2018-12-14 -
2020-03-14
a year crt.sh
*.adsrvr.org
Trustwave Organization Validation SHA256 CA, Level 1
2017-02-15 -
2019-04-19
2 years crt.sh
f4.shared.global.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3
2019-02-28 -
2019-04-14
a month crt.sh
*.outbrainimg.com
DigiCert SHA2 Secure Server CA
2019-02-24 -
2020-05-25
a year crt.sh
*.scorecardresearch.com
COMODO RSA Organization Validation Secure Server CA
2018-11-28 -
2019-12-26
a year crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA
2019-01-21 -
2019-04-21
3 months crt.sh
admiral.mgr.consensu.org
COMODO RSA Domain Validation Secure Server CA
2018-05-11 -
2020-05-10
2 years crt.sh
*.connatix.com
Go Daddy Secure Certificate Authority - G2
2018-08-20 -
2019-10-19
a year crt.sh
jwplayer.com
Amazon
2019-01-23 -
2020-02-23
a year crt.sh
*.s3.amazonaws.com
DigiCert Baltimore CA-2 G2
2018-11-07 -
2020-02-07
a year crt.sh
ads-twitter.com
DigiCert SHA2 High Assurance Server CA
2018-06-28 -
2019-07-03
a year crt.sh
*.doubleclick.net
Google Internet Authority G3
2019-03-01 -
2019-05-24
3 months crt.sh
f2.shared.global.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3
2019-02-28 -
2019-09-07
6 months crt.sh
tpc.googlesyndication.com
Google Internet Authority G3
2019-03-01 -
2019-05-24
3 months crt.sh
*.typekit.net
DigiCert SHA2 Secure Server CA
2018-07-20 -
2020-01-03
a year crt.sh
*.skimresources.com
DigiCert SHA2 Secure Server CA
2018-09-13 -
2020-10-07
2 years crt.sh
vendorlist.consensu.org
Amazon
2019-03-06 -
2020-04-06
a year crt.sh
*.googleapis.com
Google Internet Authority G3
2019-03-01 -
2019-05-24
3 months crt.sh
*.linksynergy.com
Thawte RSA CA 2018
2018-03-05 -
2019-07-20
a year crt.sh
api.skimlinks.mgr.consensu.org
DigiCert SHA2 Secure Server CA
2018-08-15 -
2019-10-23
a year crt.sh

This page contains 11 frames:

Primary Page: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Frame ID: 66758ADE67784452CFF1D91573D31093
Requests: 192 HTTP requests in this frame

Frame: https://secure.p01.eloqua.com/visitor/v200/svrGP.aspx?pps=31&siteid=1856&ref=https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html?article=security%26security=03-11-2019&ref2=https%3A//t.co/aHrXW7ESH9&tzo=0&ms=517
Frame ID: C464D78C130612EB8116E93FE4733276
Requests: 2 HTTP requests in this frame

Frame: https://admiral.mgr.consensu.org/portal.html
Frame ID: 388ABD394E8DC5405CF3D8A2AECCC127
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LczmkcUAAAAANEO7J277KwH6Kzp6BEQjPTWP4S4&co=aHR0cHM6Ly93d3cuY3Nvb25saW5lLmNvbTo0NDM.&hl=en&v=v1551681158638&size=normal&cb=718ezuufhx9
Frame ID: 6145AB80E6FCBB156329DA723324F2E6
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/safeframe/1-0-23/html/container.html
Frame ID: CA0B1105F2860573E08FA0620BAF435B
Requests: 1 HTTP requests in this frame

Frame: https://cdns.connatix.com/p/1441/min/connatix.renderer.infeed.min_dc.js
Frame ID: 026EE73608CC46DDDE34A2670D770E60
Requests: 8 HTTP requests in this frame

Frame: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Frame ID: E8604859D931FBC5A987CACCE3BCBCA7
Requests: 1 HTTP requests in this frame

Frame: https://tlx.3lift.com/web/auction?inv_code=tan_CSOOnline_MOAP&referrer=https%3A%2F%2Fwww.csoonline.com%2Farticle%2F3345972%2Fqbot-malware-resurfaces-in-new-attack-against-businesses.html&rev=4833279&fe=0&ft=0&cb=1704668189
Frame ID: 09270DD02E995B09CD37BD4337A1E852
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/bframe?hl=en&v=v1551681158638&k=6LczmkcUAAAAANEO7J277KwH6Kzp6BEQjPTWP4S4&cb=66df14odhxz0
Frame ID: FFE73596DCBB6EE08250679874893AF0
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 5C1D4C75FAB43E5DA35E46A73820FF2D
Requests: 1 HTTP requests in this frame

Frame: https://eb2.3lift.com/sync?cb=68972&ld=1
Frame ID: 2AAD6524E4025263C7312DE4B95263F7
Requests: 1 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. https://t.co/aHrXW7ESH9 Page URL
  2. https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • env /^Mustache$/i

Overall confidence: 100%
Detected patterns
  • env /pbjs/i

Overall confidence: 100%
Detected patterns
  • env /^_sf_(?:endpt|async_config)$/i

Overall confidence: 100%
Detected patterns
  • script /googletagservices\.com\/tag\/js\/gpt(?:_mobile)?\.js/i

Overall confidence: 100%
Detected patterns
  • env /^elq(?:SiteID|Load|CurESite)$/i

Overall confidence: 100%
Detected patterns
  • script /\/\/connect\.facebook\.net\/[^\/]*\/[a-z]*\.js/i

Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|(analytics))\.js/i
  • env /^gaGlobal$/i

Overall confidence: 100%
Detected patterns
  • env /^prettyPrint$/i

Overall confidence: 100%
Detected patterns
  • env /^googletag$/i
  • env /^google_tag_manager$/i

Overall confidence: 100%
Detected patterns
  • env /^(?:OutbrainPermaLink|OB_releaseVer)$/i

Overall confidence: 100%
Detected patterns
  • env /^Typekit$/i

Overall confidence: 100%
Detected patterns
  • html /<iframe[^>]* (?:id="comscore"|scr=[^>]+comscore)|\.scorecardresearch\.com\/beacon\.js|COMSCORE\.beacon/i
  • script /\.scorecardresearch\.com\/beacon\.js|COMSCORE\.beacon/i
  • env /^_?COMSCORE$/i

Overall confidence: 100%
Detected patterns
  • script /jquery(?:\-|\.)([\d.]*\d)[^\/]*\.js/i
  • script /jquery.*\.js/i
  • env /^jQuery$/i

Overall confidence: 100%
Detected patterns
  • env /^Recaptcha$/i

Page Statistics

203
Requests

100 %
HTTPS

34 %
IPv6

40
Domains

67
Subdomains

56
IPs

4
Countries

2558 kB
Transfer

8097 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://t.co/aHrXW7ESH9 Page URL
  2. https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 75
  • https://www.csoonline.com/elqNow/elqBlank.htm HTTP 301
  • https://www.csoonline.com/blank/template
Request Chain 76
  • https://secure.p01.eloqua.com/visitor/v200/svrGP.aspx?pps=70&siteid=1856&ref=https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html&ms=923 HTTP 302
  • https://secure.p01.eloqua.com/visitor/v200/svrGP.aspx?pps=70&siteid=1856&ref=https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html&ms=923&elqCookie=1
Request Chain 137
  • https://platform.twitter.com/oct.js HTTP 301
  • https://static.ads-twitter.com/oct.js
Request Chain 141
  • https://sb.scorecardresearch.com/b?c1=2&c2=6035308&c3=&c5=Malware&c6=Article%3A%20News&c15=3345972&ns__t=1552295163965&ns_c=UTF-8&cv=3.1e&c8=Qbot%20malware%20resurfaces%20in%20new%20attack%20against%20businesses%20%7C%20CSO%20Online&c7=https%3A%2F%2Fwww.csoonline.com%2Farticle%2F3345972%2Fqbot-malware-resurfaces-in-new-attack-against-businesses.html&c9=https%3A%2F%2Ft.co%2FaHrXW7ESH9 HTTP 302
  • https://sb.scorecardresearch.com/b2?c1=2&c2=6035308&c3=&c5=Malware&c6=Article%3A%20News&c15=3345972&ns__t=1552295163965&ns_c=UTF-8&cv=3.1e&c8=Qbot%20malware%20resurfaces%20in%20new%20attack%20against%20businesses%20%7C%20CSO%20Online&c7=https%3A%2F%2Fwww.csoonline.com%2Farticle%2F3345972%2Fqbot-malware-resurfaces-in-new-attack-against-businesses.html&c9=https%3A%2F%2Ft.co%2FaHrXW7ESH9
Request Chain 159
  • https://www.csoonline.com/.well-known/pubvendors.json HTTP 302
  • https://www.csoonline.com/
Request Chain 172
  • https://r.skimresources.com/api/?callback=skimlinksBeaconSecondaryCallback&data=%7B%22pubcode%22%3A%22111346X1569475%22%2C%22page%22%3A%22https%3A%2F%2Fwww.csoonline.com%2Farticle%2F3345972%2Fqbot-malware-resurfaces-in-new-attack-against-businesses.html%22%2C%22domains%22%3A%5B%22csoconference.com%22%2C%22securitysmartnewsletter.com%22%2C%22twitter.com%22%2C%22linkedin.com%22%2C%22facebook.com%22%2C%22dashboard.csoonline.com%22%2C%22ereg.me%22%2C%22reddit.com%22%2C%22ziprecruiter.com%22%2C%22varonis.com%22%2C%22pluralsight.pxf.io%22%2C%22click.clickntrax.com%22%2C%22clickit.atrrat.com%22%2C%22go.babbel.com%22%2C%22r.securefunnel.io%22%2C%22outside-stories.de%22%2C%22outbrain.com%22%2C%22idg.com%22%2C%22cio.com%22%2C%22computerworld.com%22%2C%22idc.com%22%2C%22idgconnect.com%22%2C%22infoworld.com%22%2C%22itwhitepapers.com%22%2C%22javaworld.com%22%2C%22networkworld.com%22%5D%7D HTTP 302
  • https://r.skimresources.com/api/?callback=skimlinksBeaconSecondaryCallback&persistence=1&xguid=01D5P00YYZ4891ZGVDP2K16XTN&data=%7B%22pubcode%22%3A%22111346X1569475%22%2C%22page%22%3A%22https%3A%2F%2Fwww.csoonline.com%2Farticle%2F3345972%2Fqbot-malware-resurfaces-in-new-attack-against-businesses.html%22%2C%22domains%22%3A%5B%22csoconference.com%22%2C%22securitysmartnewsletter.com%22%2C%22twitter.com%22%2C%22linkedin.com%22%2C%22facebook.com%22%2C%22dashboard.csoonline.com%22%2C%22ereg.me%22%2C%22reddit.com%22%2C%22ziprecruiter.com%22%2C%22varonis.com%22%2C%22pluralsight.pxf.io%22%2C%22click.clickntrax.com%22%2C%22clickit.atrrat.com%22%2C%22go.babbel.com%22%2C%22r.securefunnel.io%22%2C%22outside-stories.de%22%2C%22outbrain.com%22%2C%22idg.com%22%2C%22cio.com%22%2C%22computerworld.com%22%2C%22idc.com%22%2C%22idgconnect.com%22%2C%22infoworld.com%22%2C%22itwhitepapers.com%22%2C%22javaworld.com%22%2C%22networkworld.com%22%5D%7D&checksum=591e30f10a212ccefa064e882357dfc9f5bbf27b5356ee172ca6e649cf3d7f8d
Request Chain 203
  • https://eb2.3lift.com/sync?cb=68972 HTTP 302
  • https://eb2.3lift.com/sync?cb=68972&ld=1
Request Chain 205
  • https://sb.scorecardresearch.com/p?c1=2&c2=17958079&ns_ap_an=ConnatixWeb&ns_ap_bi=*null&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1552295167577&ns_st_ec=1&ns_st_sp=1&ns_st_sc=1&ns_st_psq=1&ns_st_asq=1&ns_st_sq=1&ns_st_ppc=1&ns_st_apc=1&ns_st_spc=1&ns_st_cn=1&ns_st_ev=play&ns_st_po=0&ns_st_cl=1206000&ns_st_pb=1&ns_st_mp=js_api&ns_st_mv=6.1.1.171219&ns_st_pn=1&ns_st_tp=0&ns_st_ci=v_712028&ns_st_pt=0&ns_st_dpt=0&ns_st_ipt=0&ns_st_et=0&ns_st_det=0&ns_st_upc=0&ns_st_dupc=0&ns_st_iupc=0&ns_st_upa=0&ns_st_dupa=0&ns_st_iupa=0&ns_st_lpc=0&ns_st_dlpc=0&ns_st_lpa=0&ns_st_dlpa=0&ns_st_pa=0&ns_ts=1552295167593&ns_st_bc=0&ns_st_dbc=0&ns_st_bt=0&ns_st_dbt=0&ns_st_bp=0&ns_st_lt=15&ns_st_skc=0&ns_st_dskc=0&ns_st_ska=0&ns_st_dska=0&ns_st_skd=0&ns_st_skt=0&ns_st_dskt=0&ns_st_pc=0&ns_st_dpc=0&ns_st_pp=0&ns_st_br=0&ns_st_rt=100&ns_st_ub=0&ns_st_ki=1200000&ns_st_pr=All%20about%20the%20Samsung%20Galaxy%20S10%2C%20MWC%20%2719%20and%20foldable%20phones%20%7C%20TECH(talk)&ns_st_sn=*null&ns_st_en=*null&ns_st_ep=*null&ns_st_ct=vc11&ns_st_ge=*null&ns_st_st=*null&ns_st_ce=*null&ns_st_ia=*null&ns_st_ddt=*null&ns_st_tdt=*null&ns_st_pu=Connatix&ns_st_ti=*null&c3=*null&c4=*null&c6=*null&c7=https%3A%2F%2Fwww.csoonline.com%2Farticle%2F3345972%2Fqbot-malware-resurfaces-in-new-attack-against-businesses.html&c8=&c9=&cs_ucfr=0 HTTP 302
  • https://sb.scorecardresearch.com/p2?c1=2&c2=17958079&ns_ap_an=ConnatixWeb&ns_ap_bi=*null&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1552295167577&ns_st_ec=1&ns_st_sp=1&ns_st_sc=1&ns_st_psq=1&ns_st_asq=1&ns_st_sq=1&ns_st_ppc=1&ns_st_apc=1&ns_st_spc=1&ns_st_cn=1&ns_st_ev=play&ns_st_po=0&ns_st_cl=1206000&ns_st_pb=1&ns_st_mp=js_api&ns_st_mv=6.1.1.171219&ns_st_pn=1&ns_st_tp=0&ns_st_ci=v_712028&ns_st_pt=0&ns_st_dpt=0&ns_st_ipt=0&ns_st_et=0&ns_st_det=0&ns_st_upc=0&ns_st_dupc=0&ns_st_iupc=0&ns_st_upa=0&ns_st_dupa=0&ns_st_iupa=0&ns_st_lpc=0&ns_st_dlpc=0&ns_st_lpa=0&ns_st_dlpa=0&ns_st_pa=0&ns_ts=1552295167593&ns_st_bc=0&ns_st_dbc=0&ns_st_bt=0&ns_st_dbt=0&ns_st_bp=0&ns_st_lt=15&ns_st_skc=0&ns_st_dskc=0&ns_st_ska=0&ns_st_dska=0&ns_st_skd=0&ns_st_skt=0&ns_st_dskt=0&ns_st_pc=0&ns_st_dpc=0&ns_st_pp=0&ns_st_br=0&ns_st_rt=100&ns_st_ub=0&ns_st_ki=1200000&ns_st_pr=All%20about%20the%20Samsung%20Galaxy%20S10%2C%20MWC%20%2719%20and%20foldable%20phones%20%7C%20TECH(talk)&ns_st_sn=*null&ns_st_en=*null&ns_st_ep=*null&ns_st_ct=vc11&ns_st_ge=*null&ns_st_st=*null&ns_st_ce=*null&ns_st_ia=*null&ns_st_ddt=*null&ns_st_tdt=*null&ns_st_pu=Connatix&ns_st_ti=*null&c3=*null&c4=*null&c6=*null&c7=https%3A%2F%2Fwww.csoonline.com%2Farticle%2F3345972%2Fqbot-malware-resurfaces-in-new-attack-against-businesses.html&c8=&c9=&cs_ucfr=0
Request Chain 208
  • https://sb.scorecardresearch.com/p?c1=2&c2=17958079&ns_ap_an=ConnatixWeb&ns_ap_bi=*null&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1552295167577&ns_st_ec=2&ns_st_sp=1&ns_st_sc=1&ns_st_psq=1&ns_st_asq=1&ns_st_sq=1&ns_st_ppc=1&ns_st_apc=1&ns_st_spc=1&ns_st_cn=1&ns_st_ev=hb&ns_st_po=10002&ns_st_cl=1206000&ns_st_hc=1&ns_st_mp=js_api&ns_st_mv=6.1.1.171219&ns_st_pn=1&ns_st_tp=0&ns_st_ci=v_712028&ns_st_pt=10002&ns_st_dpt=10002&ns_st_ipt=10002&ns_st_et=10002&ns_st_det=10002&ns_st_upc=10002&ns_st_dupc=10002&ns_st_iupc=10002&ns_st_upa=10002&ns_st_dupa=10002&ns_st_iupa=10002&ns_st_lpc=10002&ns_st_dlpc=10002&ns_st_lpa=10002&ns_st_dlpa=10002&ns_st_pa=10002&ns_ts=1552295177595&ns_st_bc=0&ns_st_dbc=0&ns_st_bt=0&ns_st_dbt=0&ns_st_bp=0&ns_st_skc=0&ns_st_dskc=0&ns_st_ska=0&ns_st_dska=0&ns_st_skd=0&ns_st_skt=0&ns_st_dskt=0&ns_st_pc=0&ns_st_dpc=0&ns_st_pp=0&ns_st_br=0&ns_st_rt=100&ns_st_ub=0&ns_st_ki=1200000&ns_st_pr=All%20about%20the%20Samsung%20Galaxy%20S10%2C%20MWC%20%2719%20and%20foldable%20phones%20%7C%20TECH(talk)&ns_st_sn=*null&ns_st_en=*null&ns_st_ep=*null&ns_st_ct=vc11&ns_st_ge=*null&ns_st_st=*null&ns_st_ce=*null&ns_st_ia=*null&ns_st_ddt=*null&ns_st_tdt=*null&ns_st_pu=Connatix&ns_st_ti=*null&c3=*null&c4=*null&c6=*null&c7=https%3A%2F%2Fwww.csoonline.com%2Farticle%2F3345972%2Fqbot-malware-resurfaces-in-new-attack-against-businesses.html&c8=&c9=&cs_ucfr=0 HTTP 302
  • https://sb.scorecardresearch.com/p2?c1=2&c2=17958079&ns_ap_an=ConnatixWeb&ns_ap_bi=*null&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1552295167577&ns_st_ec=2&ns_st_sp=1&ns_st_sc=1&ns_st_psq=1&ns_st_asq=1&ns_st_sq=1&ns_st_ppc=1&ns_st_apc=1&ns_st_spc=1&ns_st_cn=1&ns_st_ev=hb&ns_st_po=10002&ns_st_cl=1206000&ns_st_hc=1&ns_st_mp=js_api&ns_st_mv=6.1.1.171219&ns_st_pn=1&ns_st_tp=0&ns_st_ci=v_712028&ns_st_pt=10002&ns_st_dpt=10002&ns_st_ipt=10002&ns_st_et=10002&ns_st_det=10002&ns_st_upc=10002&ns_st_dupc=10002&ns_st_iupc=10002&ns_st_upa=10002&ns_st_dupa=10002&ns_st_iupa=10002&ns_st_lpc=10002&ns_st_dlpc=10002&ns_st_lpa=10002&ns_st_dlpa=10002&ns_st_pa=10002&ns_ts=1552295177595&ns_st_bc=0&ns_st_dbc=0&ns_st_bt=0&ns_st_dbt=0&ns_st_bp=0&ns_st_skc=0&ns_st_dskc=0&ns_st_ska=0&ns_st_dska=0&ns_st_skd=0&ns_st_skt=0&ns_st_dskt=0&ns_st_pc=0&ns_st_dpc=0&ns_st_pp=0&ns_st_br=0&ns_st_rt=100&ns_st_ub=0&ns_st_ki=1200000&ns_st_pr=All%20about%20the%20Samsung%20Galaxy%20S10%2C%20MWC%20%2719%20and%20foldable%20phones%20%7C%20TECH(talk)&ns_st_sn=*null&ns_st_en=*null&ns_st_ep=*null&ns_st_ct=vc11&ns_st_ge=*null&ns_st_st=*null&ns_st_ce=*null&ns_st_ia=*null&ns_st_ddt=*null&ns_st_tdt=*null&ns_st_pu=Connatix&ns_st_ti=*null&c3=*null&c4=*null&c6=*null&c7=https%3A%2F%2Fwww.csoonline.com%2Farticle%2F3345972%2Fqbot-malware-resurfaces-in-new-attack-against-businesses.html&c8=&c9=&cs_ucfr=0

203 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
aHrXW7ESH9
t.co/
466 B
451 B
Document
General
Full URL
https://t.co/aHrXW7ESH9
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.42.69 San Francisco, United States, ASN13414 (TWITTER - Twitter Inc., US),
Reverse DNS
Software
tsa_f /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=0
X-Xss-Protection 1; mode=block; report=https://twitter.com/i/xss_report

Request headers

:method
GET
:authority
t.co
:scheme
https
:path
/aHrXW7ESH9
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status
200
cache-control
private,max-age=300
content-encoding
gzip
content-length
240
content-type
text/html; charset=utf-8
date
Mon, 11 Mar 2019 09:06:01 GMT
expires
Mon, 11 Mar 2019 09:11:01 GMT
server
tsa_f
set-cookie
muc=89545561-7487-4701-b058-0f16e42db2c2; Max-Age=63072000; Expires=Wed, 10 Mar 2021 09:06:01 GMT; Domain=t.co
strict-transport-security
max-age=0
vary
Origin
x-connection-hash
cca7c6947f736315ace3ea0b49a0a25d
x-response-time
129
x-xss-protection
1; mode=block; report=https://twitter.com/i/xss_report
Primary Request qbot-malware-resurfaces-in-new-attack-against-businesses.html
www.csoonline.com/article/3345972/
134 KB
33 KB
Document
General
Full URL
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Requested by
Host: t.co
URL: https://t.co/aHrXW7ESH9
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
dfbb9333186ccdea2242e5f056f93fbd38c865d5a3aa3b5604daca338e5d157c

Request headers

:method
GET
:authority
www.csoonline.com
:scheme
https
:path
/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer
https://t.co/aHrXW7ESH9
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://t.co/aHrXW7ESH9

Response headers

status
200
server
Apache-Coyote/1.1
content-type
text/html;charset=UTF-8
content-encoding
gzip
via
1.1 varnish 1.1 varnish
accept-ranges
bytes
date
Mon, 11 Mar 2019 09:06:01 GMT
age
23459
x-served-by
cache-sjc3133-SJC, cache-hhn1538-HHN
x-cache
HIT, HIT
x-cache-hits
1, 1
x-timer
S1552295162.599059,VS0,VE1
vary
Accept-Encoding,Cookie
x-via-fastly
Verdad
content-length
33429
jquery-1.10.2.min.js
www.csoonline.com/www/js/jquery/
91 KB
32 KB
Script
General
Full URL
https://www.csoonline.com/www/js/jquery/jquery-1.10.2.min.js
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
b52e06f854795718703ef9723b47a9a23edcbe2ae53ff261926d8d6059056cfe

Request headers

:path
/www/js/jquery/jquery-1.10.2.min.js
pragma
no-cache
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.csoonline.com
referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
:scheme
https
:method
GET
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:01 GMT
content-encoding
gzip
age
412988
x-cache
HIT, HIT
status
200
x-cache-hits
1, 2
content-length
32845
x-via-fastly
Verdad
x-served-by
cache-sjc3147-SJC, cache-hhn1538-HHN
last-modified
Tue, 05 Mar 2019 19:22:36 GMT
server
Apache-Coyote/1.1
x-timer
S1552295162.623185,VS0,VE0
etag
W/"93639-1551813756000"
vary
Accept-Encoding,Cookie
content-type
application/javascript
via
1.1 varnish 1.1 varnish
cache-control
max-age=604800
accept-ranges
bytes
expires
Wed, 13 Mar 2019 00:15:38 GMT
jquery_cookie.js
www.csoonline.com/www/js/jquery/
2 KB
1 KB
Script
General
Full URL
https://www.csoonline.com/www/js/jquery/jquery_cookie.js
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
02d2940a00290f3a9e4955de7821626688c0cacde8c97c762838e6b40ab22926

Request headers

:path
/www/js/jquery/jquery_cookie.js
pragma
no-cache
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.csoonline.com
referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
:scheme
https
:method
GET
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:01 GMT
content-encoding
gzip
age
214762
x-cache
HIT, HIT
status
200
x-cache-hits
1, 1
content-length
908
x-via-fastly
Verdad
x-served-by
cache-sjc3139-SJC, cache-hhn1538-HHN
last-modified
Thu, 07 Mar 2019 19:31:50 GMT
server
Apache-Coyote/1.1
x-timer
S1552295162.623341,VS0,VE4
etag
W/"1946-1551987110000"
vary
Accept-Encoding,Cookie
content-type
application/javascript
via
1.1 varnish 1.1 varnish
cache-control
max-age=604800
accept-ranges
bytes
expires
Fri, 15 Mar 2019 07:24:02 GMT
apollo-locales.js
www.csoonline.com/www/js/
2 KB
1 KB
Script
General
Full URL
https://www.csoonline.com/www/js/apollo-locales.js?v=20190307113302
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
068679090107217f73a1cdc791c646ac0f2b0b5be5089e2f34ca566a082520a1

Request headers

:path
/www/js/apollo-locales.js?v=20190307113302
pragma
no-cache
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.csoonline.com
referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
:scheme
https
:method
GET
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:01 GMT
content-encoding
gzip
age
256936
x-cache
HIT, HIT
status
200
x-cache-hits
1, 2
content-length
927
x-via-fastly
Verdad
x-served-by
cache-sjc3138-SJC, cache-hhn1538-HHN
last-modified
Thu, 07 Mar 2019 19:32:06 GMT
server
Apache-Coyote/1.1
x-timer
S1552295162.623463,VS0,VE0
etag
W/"2442-1551987126000"
vary
Accept-Encoding,Cookie
content-type
application/javascript
via
1.1 varnish 1.1 varnish
cache-control
max-age=604800
accept-ranges
bytes
expires
Thu, 14 Mar 2019 19:42:35 GMT
idg.js
cdn.blueconic.net/
121 KB
37 KB
Script
General
Full URL
https://cdn.blueconic.net/idg.js
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.214.33 Wilmington, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-143-204-214-33.fra53.r.cloudfront.net
Software
Apache /
Resource Hash
389e83d41ad848935bb2f79d850fc6a6e80ece731d3e6c4134a457c2cdd6f7b8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 08:06:17 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-permitted-cross-domain-policies
master-only
age
74
x-cache
Hit from cloudfront
status
200
content-length
37843
x-xss-protection
1; mode=block
last-modified
Wed, 30 Jan 2019 09:19:05 GMT
server
Apache
etag
"1e598-580a966c2ad40-gzip"
vary
Accept-Encoding
content-type
text/javascript; charset=utf-8
via
1.1 89cb19c6f2c9ed0983294d3b12e80e43.cloudfront.net (CloudFront)
cache-control
public, max-age=600, s-maxage=500
accept-ranges
bytes
x-robots-tag
noindex, nofollow
x-amz-cf-id
zVv0VHn4Tb6GCSBQdNwyKYvlJlCJxNLrGjaM7DQumVMZnqKfBRevww==
init_device.js
www.csoonline.com/www/js/
585 B
467 B
Script
General
Full URL
https://www.csoonline.com/www/js/init_device.js
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
4f4ed0e81c2f0016d06ae816dd872edc04e97612c9d36f2f3f4475f2954e7fcc

Request headers

:path
/www/js/init_device.js
pragma
no-cache
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.csoonline.com
referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
:scheme
https
:method
GET
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:01 GMT
content-encoding
gzip
age
405326
x-cache
HIT, HIT
status
200
x-cache-hits
1, 1
content-length
304
x-via-fastly
Verdad
x-served-by
cache-sjc3143-SJC, cache-hhn1538-HHN
last-modified
Tue, 05 Mar 2019 19:22:52 GMT
server
Apache-Coyote/1.1
x-timer
S1552295162.623460,VS0,VE1
etag
W/"585-1551813772000"
vary
Accept-Encoding,Cookie
content-type
application/javascript
via
1.1 varnish 1.1 varnish
cache-control
max-age=604800
accept-ranges
bytes
expires
Wed, 13 Mar 2019 02:30:28 GMT
gpt_includes.js
www.csoonline.com/www/js/ads/
17 KB
5 KB
Script
General
Full URL
https://www.csoonline.com/www/js/ads/gpt_includes.js?v=20190307113302
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
5135d1df063666c53519538511fc14fa73e15278fc7556c64c1da69b13bae3ba

Request headers

:path
/www/js/ads/gpt_includes.js?v=20190307113302
pragma
no-cache
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.csoonline.com
referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
:scheme
https
:method
GET
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:01 GMT
content-encoding
gzip
age
256817
x-cache
HIT, HIT
status
200
x-cache-hits
1, 1
content-length
4931
x-via-fastly
Verdad
x-served-by
cache-sjc3138-SJC, cache-hhn1538-HHN
last-modified
Thu, 07 Mar 2019 19:31:40 GMT
server
Apache-Coyote/1.1
x-timer
S1552295162.645779,VS0,VE1
etag
W/"17299-1551987100000"
vary
Accept-Encoding,Cookie
content-type
application/javascript
via
1.1 varnish 1.1 varnish
cache-control
max-age=604800
accept-ranges
bytes
expires
Thu, 14 Mar 2019 19:44:47 GMT
thm_pre.js
www.csoonline.com/www.idge/js/
23 KB
5 KB
Script
General
Full URL
https://www.csoonline.com/www.idge/js/thm_pre.js?v=20190307113302
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
11fbae7dc8cc2c2a334ab5a7c8296d26a61498644e8bb1e9c5dc00dfb73f5918

Request headers

:path
/www.idge/js/thm_pre.js?v=20190307113302
pragma
no-cache
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.csoonline.com
referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
:scheme
https
:method
GET
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:01 GMT
content-encoding
gzip
age
256935
x-cache
HIT, HIT
status
200
x-cache-hits
1, 1
content-length
5014
x-via-fastly
Verdad
x-served-by
cache-sjc3128-SJC, cache-hhn1538-HHN
last-modified
Thu, 07 Mar 2019 19:28:48 GMT
server
Apache-Coyote/1.1
x-timer
S1552295162.645830,VS0,VE0
etag
W/"23067-1551986928000"
vary
Accept-Encoding,Cookie
content-type
application/javascript
via
1.1 varnish 1.1 varnish
cache-control
max-age=604800
accept-ranges
bytes
expires
Thu, 14 Mar 2019 19:42:35 GMT
gpt_starter.js
www.csoonline.com/www/js/ads/
325 B
513 B
Script
General
Full URL
https://www.csoonline.com/www/js/ads/gpt_starter.js?1234
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
c7d10c776205fd870156fb3289d42a6fb2e8b10c44d5ee438bba0b54aa2da17a

Request headers

:path
/www/js/ads/gpt_starter.js?1234
pragma
no-cache
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.csoonline.com
referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
:scheme
https
:method
GET
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:01 GMT
content-encoding
gzip
age
182592
x-cache
HIT, HIT
status
200
x-cache-hits
1, 1
content-length
235
x-via-fastly
Verdad
x-served-by
cache-sjc3137-SJC, cache-hhn1538-HHN
last-modified
Thu, 07 Mar 2019 19:31:38 GMT
server
Apache-Coyote/1.1
x-timer
S1552295162.645863,VS0,VE1
etag
W/"325-1551987098000"
vary
Accept-Encoding,Cookie
content-type
application/javascript
via
1.1 varnish 1.1 varnish
cache-control
max-age=604800
accept-ranges
bytes
expires
Fri, 15 Mar 2019 02:15:38 GMT
gpt_launcher.js
www.csoonline.com/www/js/ads/
274 B
350 B
Script
General
Full URL
https://www.csoonline.com/www/js/ads/gpt_launcher.js
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
07e23c224d4070a4da152f82dff2e741208f390f67216b2198068149d6f9d281

Request headers

:path
/www/js/ads/gpt_launcher.js
pragma
no-cache
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.csoonline.com
referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
:scheme
https
:method
GET
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:01 GMT
content-encoding
gzip
age
243988
x-cache
HIT, HIT
status
200
x-cache-hits
1, 1
content-length
187
x-via-fastly
Verdad
x-served-by
cache-sjc3131-SJC, cache-hhn1538-HHN
last-modified
Thu, 07 Mar 2019 19:31:40 GMT
server
Apache-Coyote/1.1
x-timer
S1552295162.645908,VS0,VE0
etag
W/"274-1551987100000"
vary
Accept-Encoding,Cookie
content-type
application/javascript
via
1.1 varnish 1.1 varnish
cache-control
max-age=604800
accept-ranges
bytes
expires
Thu, 14 Mar 2019 23:09:02 GMT
inline-header-mobile.css
www.csoonline.com/www.idge/css/
29 KB
6 KB
Stylesheet
General
Full URL
https://www.csoonline.com/www.idge/css/inline-header-mobile.css?v=20190307113302
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
718e83b15b3d2b4421fd413166ea57ffdc7d0886a0393799479ec8e35215de22

Request headers

:path
/www.idge/css/inline-header-mobile.css?v=20190307113302
pragma
no-cache
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/css,*/*;q=0.1
cache-control
no-cache
:authority
www.csoonline.com
referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
:scheme
https
:method
GET
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:01 GMT
content-encoding
gzip
age
256935
x-cache
HIT, HIT
status
200
x-cache-hits
1, 1
content-length
5912
x-via-fastly
Verdad
x-served-by
cache-sjc3134-SJC, cache-hhn1538-HHN
last-modified
Thu, 07 Mar 2019 19:29:50 GMT
server
Apache-Coyote/1.1
x-timer
S1552295162.651207,VS0,VE1
etag
W/"29842-1551986990000"
vary
Accept-Encoding,Cookie
content-type
text/css
via
1.1 varnish 1.1 varnish
cache-control
max-age=604800
accept-ranges
bytes
expires
Thu, 14 Mar 2019 19:42:35 GMT
inline-header.css
www.csoonline.com/www.idge.cso/css/
59 KB
8 KB
Stylesheet
General
Full URL
https://www.csoonline.com/www.idge.cso/css/inline-header.css?v=20190307113302
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
44bbcb2daa9ecc580338ba31f930232c5b5672d8f22e9794ecf1d5eaea068fc5

Request headers

:path
/www.idge.cso/css/inline-header.css?v=20190307113302
pragma
no-cache
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/css,*/*;q=0.1
cache-control
no-cache
:authority
www.csoonline.com
referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
:scheme
https
:method
GET
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:01 GMT
content-encoding
gzip
age
256936
x-cache
HIT, HIT
status
200
x-cache-hits
1, 1
content-length
7940
x-via-fastly
Verdad
x-served-by
cache-sjc3127-SJC, cache-hhn1538-HHN
last-modified
Thu, 07 Mar 2019 19:29:14 GMT
server
Apache-Coyote/1.1
x-timer
S1552295162.651217,VS0,VE1
etag
W/"60500-1551986954000"
vary
Accept-Encoding,Cookie
content-type
text/css
via
1.1 varnish 1.1 varnish
cache-control
max-age=604800
accept-ranges
bytes
expires
Thu, 14 Mar 2019 19:42:35 GMT
normalize.css
www.csoonline.com/www.idge/css/
3 KB
1 KB
Stylesheet
General
Full URL
https://www.csoonline.com/www.idge/css/normalize.css
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
7bf5e7fdfcbb3607190f49d9d6da7228aa62d8632b61b0dd3e0dcb4e712b310d

Request headers

:path
/www.idge/css/normalize.css
pragma
no-cache
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/css,*/*;q=0.1
cache-control
no-cache
:authority
www.csoonline.com
referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
:scheme
https
:method
GET
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:01 GMT
content-encoding
gzip
age
115069
x-cache
HIT, HIT
status
200
x-cache-hits
1, 1
content-length
1313
x-via-fastly
Verdad
x-served-by
cache-sjc3121-SJC, cache-hhn1538-HHN
last-modified
Thu, 07 Mar 2019 19:29:48 GMT
server
Apache-Coyote/1.1
x-timer
S1552295162.651152,VS0,VE0
etag
W/"3168-1551986988000"
vary
Accept-Encoding,Cookie
content-type
text/css
via
1.1 varnish 1.1 varnish
cache-control
max-age=604800
accept-ranges
bytes
expires
Sat, 16 Mar 2019 11:08:03 GMT
prettify.css
www.csoonline.com/www.idge/css/
595 B
577 B
Stylesheet
General
Full URL
https://www.csoonline.com/www.idge/css/prettify.css
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
00e441f817788168d15166b9a82eab1ddb74c0f7edbaa80d02e7831725d1862e

Request headers

:path
/www.idge/css/prettify.css
pragma
no-cache
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/css,*/*;q=0.1
cache-control
no-cache
:authority
www.csoonline.com
referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
:scheme
https
:method
GET
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:01 GMT
content-encoding
gzip
age
114708
x-cache
HIT, HIT
status
200
x-cache-hits
3, 1
content-length
306
x-via-fastly
Verdad
x-served-by
cache-sjc3141-SJC, cache-hhn1538-HHN
last-modified
Thu, 07 Mar 2019 19:29:50 GMT
server
Apache-Coyote/1.1
x-timer
S1552295162.651290,VS0,VE1
etag
W/"595-1551986990000"
vary
Accept-Encoding,Cookie
content-type
text/css
via
1.1 varnish 1.1 varnish
cache-control
max-age=604800
accept-ranges
bytes
expires
Sat, 16 Mar 2019 11:13:57 GMT
select2.css
www.csoonline.com/www.idge.ans/js/select2-3.5.0/
15 KB
3 KB
Stylesheet
General
Full URL
https://www.csoonline.com/www.idge.ans/js/select2-3.5.0/select2.css
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
f91649026d2a05a646860a4be36a5388d5c78b4afc03f5ecd49adcad3c4449c3

Request headers

:path
/www.idge.ans/js/select2-3.5.0/select2.css
pragma
no-cache
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/css,*/*;q=0.1
cache-control
no-cache
:authority
www.csoonline.com
referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
:scheme
https
:method
GET
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:01 GMT
content-encoding
gzip
age
508682
x-cache
HIT, HIT
status
200
x-cache-hits
2, 2
content-length
2743
x-via-fastly
Verdad
x-served-by
cache-sjc3128-SJC, cache-hhn1538-HHN
last-modified
Mon, 04 Mar 2019 19:20:00 GMT
server
Apache-Coyote/1.1
x-timer
S1552295162.651339,VS0,VE0
etag
W/"15679-1551727200000"
vary
Accept-Encoding,Cookie
content-type
text/css
via
1.1 varnish 1.1 varnish
cache-control
max-age=604800
accept-ranges
bytes
expires
Mon, 11 Mar 2019 21:47:47 GMT
article.css
www.csoonline.com/www/css/
212 KB
32 KB
Stylesheet
General
Full URL
https://www.csoonline.com/www/css/article.css?v=20190307113302
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
f51fbadb3f5049cf18b147ff744c5e8ecaeeba60a70eb00c3167b82982bd8995

Request headers

:path
/www/css/article.css?v=20190307113302
pragma
no-cache
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/css,*/*;q=0.1
cache-control
no-cache
:authority
www.csoonline.com
referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
:scheme
https
:method
GET
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:01 GMT
content-encoding
gzip
age
256829
x-cache
HIT, HIT
status
200
x-cache-hits
1, 1
content-length
32597
x-via-fastly
Verdad
x-served-by
cache-sjc3125-SJC, cache-hhn1538-HHN
last-modified
Thu, 07 Mar 2019 19:29:38 GMT
server
Apache-Coyote/1.1
x-timer
S1552295162.651346,VS0,VE1
etag
W/"216966-1551986978000"
vary
Accept-Encoding,Cookie
content-type
text/css
via
1.1 varnish 1.1 varnish
cache-control
max-age=604800
accept-ranges
bytes
expires
Thu, 14 Mar 2019 19:45:04 GMT
insider-promo-styles.css
www.csoonline.com/www.idge/css/
7 KB
2 KB
Stylesheet
General
Full URL
https://www.csoonline.com/www.idge/css/insider-promo-styles.css?v=20190307113302
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
75326dc9dc66947526ac65f342821550ff77e8c936cc6dded2272eb3417a4579

Request headers

:path
/www.idge/css/insider-promo-styles.css?v=20190307113302
pragma
no-cache
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/css,*/*;q=0.1
cache-control
no-cache
:authority
www.csoonline.com
referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
:scheme
https
:method
GET
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:01 GMT
content-encoding
gzip
age
256818
x-cache
HIT, HIT
status
200
x-cache-hits
2, 1
content-length
1642
x-via-fastly
Verdad
x-served-by
cache-sjc3125-SJC, cache-hhn1538-HHN
last-modified
Thu, 07 Mar 2019 19:29:54 GMT
server
Apache-Coyote/1.1
x-timer
S1552295162.652330,VS0,VE1
etag
W/"7411-1551986994000"
vary
Accept-Encoding,Cookie
content-type
text/css
via
1.1 varnish 1.1 varnish
cache-control
max-age=604800
accept-ranges
bytes
expires
Thu, 14 Mar 2019 19:45:34 GMT
article.css
www.csoonline.com/www.idge.cso/css/
44 KB
7 KB
Stylesheet
General
Full URL
https://www.csoonline.com/www.idge.cso/css/article.css?v=20190307113302
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
81d069359ca913e722d8b6686d66d972d3eb372d4e717ccf0372da79b246d4a3

Request headers

:path
/www.idge.cso/css/article.css?v=20190307113302
pragma
no-cache
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/css,*/*;q=0.1
cache-control
no-cache
:authority
www.csoonline.com
referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
:scheme
https
:method
GET
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:01 GMT
content-encoding
gzip
age
256829
x-cache
HIT, HIT
status
200
x-cache-hits
2, 1
content-length
6914
x-via-fastly
Verdad
x-served-by
cache-sjc3147-SJC, cache-hhn1538-HHN
last-modified
Thu, 07 Mar 2019 19:29:14 GMT
server
Apache-Coyote/1.1
x-timer
S1552295162.652298,VS0,VE1
etag
W/"44571-1551986954000"
vary
Accept-Encoding,Cookie
content-type
text/css
via
1.1 varnish 1.1 varnish
cache-control
max-age=604800
accept-ranges
bytes
expires
Thu, 14 Mar 2019 19:45:04 GMT
ss-social.css
www.csoonline.com/www.idge/css/webfonts/
3 KB
1 KB
Stylesheet
General
Full URL
https://www.csoonline.com/www.idge/css/webfonts/ss-social.css
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
c2787f84ac525e6b202f56eb25ef03f40017d11100280dd6f3866cadb4d1f50c

Request headers

:path
/www.idge/css/webfonts/ss-social.css
pragma
no-cache
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/css,*/*;q=0.1
cache-control
no-cache
:authority
www.csoonline.com
referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
:scheme
https
:method
GET
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:01 GMT
content-encoding
gzip
age
228425
x-cache
HIT, HIT
status
200
x-cache-hits
1, 1
content-length
885
x-via-fastly
Verdad
x-served-by
cache-sjc3121-SJC, cache-hhn1538-HHN
last-modified
Thu, 07 Mar 2019 19:29:52 GMT
server
Apache-Coyote/1.1
x-timer
S1552295162.652252,VS0,VE6
etag
W/"3417-1551986992000"
vary
Accept-Encoding,Cookie
content-type
text/css
via
1.1 varnish 1.1 varnish
cache-control
max-age=604800
accept-ranges
bytes
expires
Fri, 15 Mar 2019 09:01:57 GMT
ss-standard.css
www.csoonline.com/www.idge/css/webfonts/
11 KB
3 KB
Stylesheet
General
Full URL
https://www.csoonline.com/www.idge/css/webfonts/ss-standard.css
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
b59054e128a42511aa22399d02cd8365ac1c66a6efe6f4f11cfe1ae16284db0c

Request headers

:path
/www.idge/css/webfonts/ss-standard.css
pragma
no-cache
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/css,*/*;q=0.1
cache-control
no-cache
:authority
www.csoonline.com
referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
:scheme
https
:method
GET
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:01 GMT
content-encoding
gzip
age
107026
x-cache
HIT, HIT
status
200
x-cache-hits
1, 1
content-length
2473
x-via-fastly
Verdad
x-served-by
cache-sjc3143-SJC, cache-hhn1538-HHN
last-modified
Thu, 07 Mar 2019 19:29:52 GMT
server
Apache-Coyote/1.1
x-timer
S1552295162.652294,VS0,VE1
etag
W/"11639-1551986992000"
vary
Accept-Encoding,Cookie
content-type
text/css
via
1.1 varnish 1.1 varnish
cache-control
max-age=604800
accept-ranges
bytes
expires
Sat, 16 Mar 2019 13:22:01 GMT
xyb0fnv.js
fonts.staticworld.net/
18 KB
7 KB
Script
General
Full URL
https://fonts.staticworld.net/xyb0fnv.js
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
5a9c4b424254849d034541d05afd282527236eba23a7d28b2cff1e4b7fb54772

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:01 GMT
content-encoding
gzip
server
nginx
age
178
vary
Accept-Encoding
x-cache
HIT
content-type
application/javascript;charset=utf-8
status
200
cache-control
public, max-age=600
x-cache-hits
1
accept-ranges
bytes
x-timer
S1552295162.678783,VS0,VE4
content-length
7184
via
1.1 varnish
x-served-by
cache-hhn1538-HHN
select2.js
www.csoonline.com/www.idge.ans/js/select2-3.5.0/
77 KB
19 KB
Script
General
Full URL
https://www.csoonline.com/www.idge.ans/js/select2-3.5.0/select2.js
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
f88f33a736ef0e7d27d78a7b2cdadb674ac192db9aede3a42c65ea1fd4386114

Request headers

:path
/www.idge.ans/js/select2-3.5.0/select2.js
pragma
no-cache
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.csoonline.com
referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
:scheme
https
:method
GET
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:01 GMT
content-encoding
gzip
age
428156
x-cache
HIT, HIT
status
200
x-cache-hits
1, 2530
content-length
19734
x-via-fastly
Verdad
x-served-by
cache-sjc3137-SJC, cache-hhn1538-HHN
last-modified
Tue, 05 Mar 2019 19:21:58 GMT
server
Apache-Coyote/1.1
x-timer
S1552295162.652792,VS0,VE0
etag
W/"79220-1551813718000"
vary
Accept-Encoding,Cookie
content-type
application/javascript
via
1.1 varnish 1.1 varnish
cache-control
max-age=604800
accept-ranges
bytes
expires
Tue, 12 Mar 2019 20:05:29 GMT
alc_hashes.js
www.csoonline.com/www/js/utils/
24 KB
9 KB
Script
General
Full URL
https://www.csoonline.com/www/js/utils/alc_hashes.js
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
d1df5c7a5bf7559c17a0037520210c1c3d4affb3f5df0b54dc6d3d87d13a0fab

Request headers

:path
/www/js/utils/alc_hashes.js
pragma
no-cache
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.csoonline.com
referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
:scheme
https
:method
GET
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:01 GMT
content-encoding
gzip
age
110695
x-cache
HIT, HIT
status
200
x-cache-hits
2, 1
content-length
9085
x-via-fastly
Verdad
x-served-by
cache-sjc3127-SJC, cache-hhn1538-HHN
last-modified
Thu, 07 Mar 2019 19:31:56 GMT
server
Apache-Coyote/1.1
x-timer
S1552295162.652702,VS0,VE0
etag
W/"24548-1551987116000"
vary
Accept-Encoding,Cookie
content-type
application/javascript
via
1.1 varnish 1.1 varnish
cache-control
max-age=604800
accept-ranges
bytes
expires
Fri, 15 Mar 2019 08:04:08 GMT
insider_reg_api.js
www.csoonline.com/www/js/insider/
59 KB
21 KB
Script
General
Full URL
https://www.csoonline.com/www/js/insider/insider_reg_api.js?v=20190307113302
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
0093cba7cb9d43a5c6ffcbff9757df1549adfd02c66621f69b1c81abe835790a

Request headers

:path
/www/js/insider/insider_reg_api.js?v=20190307113302
pragma
no-cache
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.csoonline.com
referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
:scheme
https
:method
GET
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:01 GMT
content-encoding
gzip
age
256816
x-cache
HIT, HIT
status
200
x-cache-hits
1, 1
content-length
21798
x-via-fastly
Verdad
x-served-by
cache-sjc3127-SJC, cache-hhn1538-HHN
last-modified
Thu, 07 Mar 2019 19:32:00 GMT
server
Apache-Coyote/1.1
x-timer
S1552295162.652796,VS0,VE1
etag
W/"60405-1551987120000"
vary
Accept-Encoding,Cookie
content-type
application/javascript
via
1.1 varnish 1.1 varnish
cache-control
max-age=604800
accept-ranges
bytes
expires
Thu, 14 Mar 2019 19:44:47 GMT
jquery.maskedinput-1.4.min.js
www.csoonline.com/www/js/insider/
4 KB
2 KB
Script
General
Full URL
https://www.csoonline.com/www/js/insider/jquery.maskedinput-1.4.min.js
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
d61ee6f4c7b8572833d3bdad303493033c896a58ca134680319e3c4bef8756bb

Request headers

:path
/www/js/insider/jquery.maskedinput-1.4.min.js
pragma
no-cache
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.csoonline.com
referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
:scheme
https
:method
GET
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:01 GMT
content-encoding
gzip
age
43349
x-cache
HIT, HIT
status
200
x-cache-hits
1, 1
content-length
1831
x-via-fastly
Verdad
x-served-by
cache-sjc3129-SJC, cache-hhn1538-HHN
last-modified
Thu, 07 Mar 2019 19:31:58 GMT
server
Apache-Coyote/1.1
x-timer
S1552295162.652734,VS0,VE0
etag
W/"4139-1551987118000"
vary
Accept-Encoding,Cookie
content-type
application/javascript
via
1.1 varnish 1.1 varnish
cache-control
max-age=604800
accept-ranges
bytes
expires
Sat, 16 Mar 2019 16:39:18 GMT
elqCfg.js
www.csoonline.com/www/js/analytics/eloqua/
2 KB
1 KB
Script
General
Full URL
https://www.csoonline.com/www/js/analytics/eloqua/elqCfg.js
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
44dc64c082736ee986d3dda3134211b2b5361c6624d9c4acc187a79a8a8d6d6d

Request headers

:path
/www/js/analytics/eloqua/elqCfg.js
pragma
no-cache
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.csoonline.com
referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
:scheme
https
:method
GET
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:01 GMT
content-encoding
gzip
age
79966
x-cache
HIT, HIT
status
200
x-cache-hits
1, 2
content-length
938
x-via-fastly
Verdad
x-served-by
cache-sjc3146-SJC, cache-hhn1538-HHN
last-modified
Thu, 07 Mar 2019 19:31:42 GMT
server
Apache-Coyote/1.1
x-timer
S1552295162.652765,VS0,VE0
etag
W/"2489-1551987102000"
vary
Accept-Encoding,Cookie
content-type
application/javascript
via
1.1 varnish 1.1 varnish
cache-control
max-age=604800
accept-ranges
bytes
expires
Fri, 15 Mar 2019 02:48:44 GMT
elqImg.js
www.csoonline.com/www/js/analytics/eloqua/
730 B
585 B
Script
General
Full URL
https://www.csoonline.com/www/js/analytics/eloqua/elqImg.js
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
df6aa193b8808f4bdc6f38cf7d878dedd8e0aca737e2cf325fb5a967c372bcb8

Request headers

:path
/www/js/analytics/eloqua/elqImg.js
pragma
no-cache
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.csoonline.com
referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
:scheme
https
:method
GET
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:01 GMT
content-encoding
gzip
age
172635
x-cache
HIT, HIT
status
200
x-cache-hits
4, 1
content-length
367
x-via-fastly
Verdad
x-served-by
cache-sjc3133-SJC, cache-hhn1538-HHN
last-modified
Thu, 07 Mar 2019 19:31:42 GMT
server
Apache-Coyote/1.1
x-timer
S1552295162.652770,VS0,VE0
etag
W/"730-1551987102000"
vary
Accept-Encoding,Cookie
content-type
application/javascript
via
1.1 varnish 1.1 varnish
cache-control
max-age=604800
accept-ranges
bytes
expires
Thu, 14 Mar 2019 20:50:49 GMT
elqFCS.js
www.csoonline.com/www/js/analytics/eloqua/
1 KB
697 B
Script
General
Full URL
https://www.csoonline.com/www/js/analytics/eloqua/elqFCS.js
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
8cbde677cfad8b6a5531f472f6e79236392fd06ed3cd4acb9ef31612cbb6a66e

Request headers

:path
/www/js/analytics/eloqua/elqFCS.js
pragma
no-cache
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.csoonline.com
referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
:scheme
https
:method
GET
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:01 GMT
content-encoding
gzip
age
101185
x-cache
HIT, HIT
status
200
x-cache-hits
1, 1
content-length
517
x-via-fastly
Verdad
x-served-by
cache-sjc3133-SJC, cache-hhn1538-HHN
last-modified
Thu, 07 Mar 2019 19:31:42 GMT
server
Apache-Coyote/1.1
x-timer
S1552295162.652693,VS0,VE0
etag
W/"1143-1551987102000"
vary
Accept-Encoding,Cookie
content-type
application/javascript
via
1.1 varnish 1.1 varnish
cache-control
max-age=604800
accept-ranges
bytes
expires
Thu, 14 Mar 2019 20:41:19 GMT
elqScr.js
www.csoonline.com/www/js/analytics/eloqua/
334 B
438 B
Script
General
Full URL
https://www.csoonline.com/www/js/analytics/eloqua/elqScr.js
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
9c857aafeb3aca95b2b9d1db13c1c7f5e1924aaf8d93e0e512bbd5d73ee3d98e

Request headers

:path
/www/js/analytics/eloqua/elqScr.js
pragma
no-cache
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.csoonline.com
referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
:scheme
https
:method
GET
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:01 GMT
content-encoding
gzip
age
134674
x-cache
HIT, HIT
status
200
x-cache-hits
1, 3
content-length
252
x-via-fastly
Verdad
x-served-by
cache-sjc3139-SJC, cache-hhn1538-HHN
last-modified
Thu, 07 Mar 2019 19:31:42 GMT
server
Apache-Coyote/1.1
x-timer
S1552295162.652610,VS0,VE0
etag
W/"334-1551987102000"
vary
Accept-Encoding,Cookie
content-type
application/javascript
via
1.1 varnish 1.1 varnish
cache-control
max-age=604800
accept-ranges
bytes
expires
Fri, 15 Mar 2019 01:07:50 GMT
elqIDG.js
www.csoonline.com/www/js/analytics/eloqua/
812 B
528 B
Script
General
Full URL
https://www.csoonline.com/www/js/analytics/eloqua/elqIDG.js
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
6e574a88a303d27876368be887fc6415d1928a18e7f81c0e2f6e992f32455e66

Request headers

:path
/www/js/analytics/eloqua/elqIDG.js
pragma
no-cache
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.csoonline.com
referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
:scheme
https
:method
GET
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:01 GMT
content-encoding
gzip
age
110892
x-cache
HIT, HIT
status
200
x-cache-hits
1, 1
content-length
384
x-via-fastly
Verdad
x-served-by
cache-sjc3128-SJC, cache-hhn1538-HHN
last-modified
Thu, 07 Mar 2019 19:31:42 GMT
server
Apache-Coyote/1.1
x-timer
S1552295162.652919,VS0,VE1
etag
W/"812-1551987102000"
vary
Accept-Encoding,Cookie
content-type
application/javascript
via
1.1 varnish 1.1 varnish
cache-control
max-age=604800
accept-ranges
bytes
expires
Fri, 15 Mar 2019 08:08:48 GMT
ads.js
www.csoonline.com/www/js/ads/
19 B
222 B
Script
General
Full URL
https://www.csoonline.com/www/js/ads/ads.js
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
6a0f6cf6b4648c192d81b5fc7b70cb2f6819ef4a799e421e8626cae9697aa85a

Request headers

:path
/www/js/ads/ads.js
pragma
no-cache
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.csoonline.com
referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
:scheme
https
:method
GET
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:01 GMT
content-encoding
gzip
age
202748
x-cache
HIT, HIT
status
200
x-cache-hits
2, 1
content-length
39
x-via-fastly
Verdad
x-served-by
cache-sjc3125-SJC, cache-hhn1538-HHN
last-modified
Thu, 07 Mar 2019 19:31:40 GMT
server
Apache-Coyote/1.1
x-timer
S1552295162.652995,VS0,VE0
etag
W/"19-1551987100000"
vary
Accept-Encoding,Cookie
content-type
application/javascript
via
1.1 varnish 1.1 varnish
cache-control
max-age=604800
accept-ranges
bytes
expires
Thu, 14 Mar 2019 20:34:28 GMT
load.js
s.ntv.io/serve/
264 KB
77 KB
Script
General
Full URL
https://s.ntv.io/serve/load.js
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.100.198.152 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-100-198-152.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
b2460fb5aeffb7ec20dee81a7b45dd8cd818cfefa92fd5d88be6a8d984b3e101

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 11 Mar 2019 09:06:01 GMT
Content-Encoding
gzip
x-amz-request-id
42613234AC03CAC1
Transfer-Encoding
chunked
Connection
keep-alive, Transfer-Encoding
x-amz-id-2
8EdxSmlLOK5VPu5pAzxlRBeJvEcLiK7//z2EnEKrWaWIrIFK+znEmd/IGvbdjXkXBnUzMQ3xTUo=
Last-Modified
Fri, 08 Mar 2019 19:58:22 GMT
Server
AmazonS3
ETag
"7468428a69cdc2b2675256d2d421d935"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
Content-Type
application/x-javascript
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=3600
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
api.js
www.google.com/recaptcha/
762 B
548 B
Script
General
Full URL
https://www.google.com/recaptcha/api.js
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:824::2004 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
GSE /
Resource Hash
98239ebcc48e7c9dabc57f495946c02b3e3c907d839f6b69971aee32e237ed85
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:01 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
GSE
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=UTF-8
status
200
cache-control
private, max-age=300
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
447
x-xss-protection
1; mode=block
expires
Mon, 11 Mar 2019 09:06:01 GMT
187051-261008049474226.js
js-sec.indexww.com/ht/p/
93 KB
28 KB
Script
General
Full URL
https://js-sec.indexww.com/ht/p/187051-261008049474226.js
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.100.198.4 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-100-198-4.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
8ef8e09c9bffadb7bf20245743c7573278457e7eceeffe25d2dbef87e7edf2ab

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 11 Mar 2019 09:06:02 GMT
Content-Encoding
gzip
Last-Modified
Mon, 11 Mar 2019 09:01:07 GMT
Server
Apache
ETag
"da3d6f-173e6-583cdd03004fb"
Vary
Accept-Encoding
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=3600
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
text/javascript
Content-Length
28101
Expires
Mon, 11 Mar 2019 10:06:02 GMT
csoonline-logo-print.png
idge.staticworld.net/cso/
3 KB
3 KB
Image
General
Full URL
https://idge.staticworld.net/cso/csoonline-logo-print.png
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
d563a6297e7ec86a7e14ccb7c3fc8e2ef93cda798f6e97ee27fa8a403ed70958

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-amz-version-id
hoCVfAMnSCBX_2olAUofnx9pB.CkE6mT
via
1.1 varnish, 1.1 varnish
age
923140
x-cache
HIT, HIT
status
200
date
Mon, 11 Mar 2019 09:06:01 GMT
content-length
2971
x-amz-id-2
3OuhzWS727M6Mk13vlwXPRfydZIGmKiLU/c8aqkaUlQpZLDNdrR3QSd61nZ6RoLFdQO4NAQfKKs=
x-served-by
cache-jfk8132-JFK, cache-hhn1538-HHN
last-modified
Tue, 27 Mar 2018 00:09:02 GMT
server
AmazonS3
x-timer
S1552295162.928950,VS0,VS0,VE0
etag
"5aee3f8a08baf667d2c3995c8c0b8462"
x-amz-request-id
5B35D97BC8660EC7
cache-control
public, max-age=2592000
accept-ranges
bytes
content-type
image/png
x-cache-hits
2, 1
twitter.svg
idge.staticworld.net/images/
1 KB
1 KB
Image
General
Full URL
https://idge.staticworld.net/images/twitter.svg
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
464e7cde418a559c5035942d1ab154d5d906f378f256a0dd39848d197df6180d

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-amz-version-id
mIV1aQJqOkkgyHLgPXYdWBvfLAAcgw1y
via
1.1 varnish, 1.1 varnish
age
6400
x-cache
HIT, HIT
status
200
date
Mon, 11 Mar 2019 09:06:01 GMT
content-length
1128
x-amz-id-2
IS7arSho6iUpj4wSpJI2P45EGEurwtk18oGrmEciyfK3dgRPNmTAO3FU9CTIT+JVU0sDAhV5Jl4=
x-served-by
cache-jfk8120-JFK, cache-hhn1538-HHN
last-modified
Tue, 27 Mar 2018 00:10:11 GMT
server
AmazonS3
x-timer
S1552295162.928962,VS0,VS0,VE0
etag
"5c2cee17abf8296b156fa142e69516df"
x-amz-request-id
995B80123C2716C8
accept-ranges
bytes
content-type
image/svg+xml
x-cache-hits
19, 35
facebook.svg
idge.staticworld.net/images/
817 B
1 KB
Image
General
Full URL
https://idge.staticworld.net/images/facebook.svg
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
676aa6d4090a54ea6893484095f55c80659fb8538db100cdb8ce1dc82bab42b8

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-amz-version-id
z0fEqr9qBUOYVzkAEhE7W.44xxx.2BcQ
via
1.1 varnish, 1.1 varnish
age
2694
x-cache
HIT, HIT
status
200
date
Mon, 11 Mar 2019 09:06:01 GMT
content-length
817
x-amz-id-2
fXkqJEvqdjNWlOl2WJejDf7eDAjdG41sUSiWK/Dn6xmN9voEytLd1Sr4h2jwiE1EG03VrNumcF0=
x-served-by
cache-jfk8128-JFK, cache-hhn1538-HHN
last-modified
Tue, 27 Mar 2018 00:10:09 GMT
server
AmazonS3
x-timer
S1552295162.928989,VS0,VS0,VE0
etag
"e54119fb283fa31d7980c946d19e701f"
x-amz-request-id
82E0D142A2B3C80F
accept-ranges
bytes
content-type
image/svg+xml
x-cache-hits
6, 21
linkedin.svg
idge.staticworld.net/images/
786 B
1 KB
Image
General
Full URL
https://idge.staticworld.net/images/linkedin.svg
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
03643efcf63e8fbfe6571cd0f1a4ce49f8575a7bee74f2e9fd7fab344e474e48

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-amz-version-id
dIfJAJb7rR9o.DnrV3iep_mz2NuSUCHZ
via
1.1 varnish, 1.1 varnish
age
5279
x-cache
HIT, HIT
status
200
date
Mon, 11 Mar 2019 09:06:01 GMT
content-length
786
x-amz-id-2
mSXpZxKOZMfj/yDum+1w6ZNVCooRoNcPZ0J2JPeJGSjedAMmx3NAPIM5wHuPCQ/dVBxUqevo7EE=
x-served-by
cache-jfk8142-JFK, cache-hhn1538-HHN
last-modified
Tue, 27 Mar 2018 00:10:10 GMT
server
AmazonS3
x-timer
S1552295162.929083,VS0,VS0,VE0
etag
"b828f13d2d6015e831f675f1ca0c1908"
x-amz-request-id
0624126ACD2B7708
accept-ranges
bytes
content-type
image/svg+xml
x-cache-hits
5, 18
reddit.svg
idge.staticworld.net/images/
2 KB
2 KB
Image
General
Full URL
https://idge.staticworld.net/images/reddit.svg
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
47c749c888c850505d68f2745651928d8aec9a6802d6a8b20869fa114af92277

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-amz-version-id
X1o6g.mfoioyv5Lswf3F9n.2ID0CCWF9
via
1.1 varnish, 1.1 varnish
age
6158
x-cache
HIT, HIT
status
200
date
Mon, 11 Mar 2019 09:06:01 GMT
content-length
1556
x-amz-id-2
g49sWDxUPFgvcWsv1FsZtCUj1pnvHOLiVs/Sl7MmS8GOOdPEcEqciIVRNhrFNgIG1ptpbKgq5Jk=
x-served-by
cache-jfk8146-JFK, cache-hhn1538-HHN
last-modified
Tue, 27 Mar 2018 00:10:10 GMT
server
AmazonS3
x-timer
S1552295162.929115,VS0,VS0,VE0
etag
"8159d85ae759a8d251edb65b4dcd285d"
x-amz-request-id
30C864A8B1C07469
accept-ranges
bytes
content-type
image/svg+xml
x-cache-hits
43, 26
mail.svg
idge.staticworld.net/images/
631 B
937 B
Image
General
Full URL
https://idge.staticworld.net/images/mail.svg
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
83d86c9e7359ed844c0e7682abcd5cdb65222d421c61156f17791ac6c2650274

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-amz-version-id
W1fLolU3CaghgVscFveqAiphPY036Sqp
via
1.1 varnish, 1.1 varnish
age
3997
x-cache
HIT, HIT
status
200
date
Mon, 11 Mar 2019 09:06:01 GMT
content-length
631
x-amz-id-2
r5roK5O/FxPND9NPbsxDtu/9FdSwqszeLGaGlDe10C3wMMFi3JuOkmsdQrG6cv8Nwg8pXi94UL0=
x-served-by
cache-jfk8123-JFK, cache-hhn1538-HHN
last-modified
Tue, 27 Mar 2018 00:10:10 GMT
server
AmazonS3
x-timer
S1552295162.929110,VS0,VS0,VE0
etag
"c8fc97e05e008a042825f64ee7d414d1"
x-amz-request-id
9A0E6EC9FD5786B8
accept-ranges
bytes
content-type
image/svg+xml
x-cache-hits
29, 15
print.svg
idge.staticworld.net/images/
782 B
1 KB
Image
General
Full URL
https://idge.staticworld.net/images/print.svg
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
1b197985c0bef8bc365381bd16e15dccf184eb33d0abf0afdb4f567da2000fb2

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-amz-version-id
.7Gmo7QCRJqJTxCocIfBynAqOGj25mL.
via
1.1 varnish, 1.1 varnish
age
2788
x-cache
MISS, HIT
status
200
date
Mon, 11 Mar 2019 09:06:01 GMT
content-length
782
x-amz-id-2
fOPGp+d4KL2Dl4VU9ar8HgCeCkNHFxkqORi2hV6NdePhdj0pIUS50oXnidR5VS/f9/lvIsDe6Ik=
x-served-by
cache-jfk8125-JFK, cache-hhn1538-HHN
last-modified
Tue, 27 Mar 2018 00:10:10 GMT
server
AmazonS3
x-timer
S1552295162.953364,VS0,VS0,VE1
etag
"a9f65e3b5eddc5c537118a146a3333c7"
x-amz-request-id
9BCEF1E38C0A5C1F
accept-ranges
bytes
content-type
image/svg+xml
x-cache-hits
0, 1
lucian_constantin-100258922-byline.jpg
images.techhive.com/images/article/2014/04/
5 KB
6 KB
Image
General
Full URL
https://images.techhive.com/images/article/2014/04/lucian_constantin-100258922-byline.jpg
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
9b1e8d6a6fbd575fde082a6cb30309f23fa6ff311452aefe5e18f6cf0ee80fbe

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-amz-version-id
null
via
1.1 varnish, 1.1 varnish
age
938288
x-cache
HIT, HIT
status
200
date
Mon, 11 Mar 2019 09:06:01 GMT
content-length
5516
x-amz-id-2
8ySE49jn9y0EwtBaWIeRAqoShax9CQT22l6DLWQAMEE/Ga/tqTkH2oQbAixc9ZhCPKC0gjpIOZg=
x-served-by
cache-jfk8129-JFK, cache-hhn1538-HHN
last-modified
Thu, 26 Jan 2017 17:10:28 GMT
server
AmazonS3
x-timer
S1552295162.928955,VS0,VS0,VE0
etag
"6e7116dc13531f473c9788bc7bbeea7e"
x-amz-request-id
0443A1C51D2ECC20
cache-control
public, max-age=2592000
accept-ranges
bytes
content-type
image/jpeg
x-cache-hits
1, 1
malware-cybersecurity-skull-crossbone-100735067-large.jpg
images.idgesg.net/images/article/2017/09/
105 KB
105 KB
Image
General
Full URL
https://images.idgesg.net/images/article/2017/09/malware-cybersecurity-skull-crossbone-100735067-large.jpg
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
0244e3148c74d582c9074b5e426531a78d5e56f81d96e1fd5e79d03cbaf75efb

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-amz-version-id
bKKOO6nmi9AIjZeyZbOmGntZSPHLk3SI
via
1.1 varnish, 1.1 varnish
age
2432
x-cache
HIT, HIT
status
200
date
Mon, 11 Mar 2019 09:06:01 GMT
content-length
107151
x-amz-id-2
HvTqVbZZroJ0wrCApqEeqM+H6L00gh69N51J1edqa9q8hajtjQ5lbd0Lj4eBmIlA9qj1iVCtDzQ=
x-served-by
cache-jfk8130-JFK, cache-hhn1538-HHN
last-modified
Thu, 07 Sep 2017 14:52:54 GMT
server
AmazonS3
x-timer
S1552295162.930692,VS0,VS0,VE1
etag
"8f382a25c3da15f879dfea21b10fd3f6"
x-amz-request-id
A7E7ACD90F3B8B9D
cache-control
public, max-age=2592000
accept-ranges
bytes
content-type
image/jpeg
x-cache-hits
1, 1
amr5nu9xbyudq565nqy55c8jbkufmjuj
www.ziprecruiter.com/jobs-widget/mini/v1/
14 KB
5 KB
Script
General
Full URL
https://www.ziprecruiter.com/jobs-widget/mini/v1/amr5nu9xbyudq565nqy55c8jbkufmjuj
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:b1be , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
54eea3d0cef1bc116cf446d063f4b7786b6b5d39b5344006506d8f0ae306f3f9
Security Headers
Name Value
Strict-Transport-Security max-age=15552000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:01 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
MISS
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=UTF-8
status
200
cache-control
max-age=0, no-cache
strict-transport-security
max-age=15552000
cf-ray
4b5c5eb8deb4befd-FRA
vary
Accept-Encoding
x-xss-protection
1
thumb-100790078-orig.jpg
images.idgesg.net/images/article/2019/03/
99 KB
99 KB
Image
General
Full URL
https://images.idgesg.net/images/article/2019/03/thumb-100790078-orig.jpg
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
38f0e4bc8f247366399ac2200441c57cf4e2c1353d1a9228cac7b18f23c3aaf5

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-amz-version-id
xvuFmRY55ajSAYAiKBCEikHv0QLCUKDn
via
1.1 varnish, 1.1 varnish
age
477545
x-cache
HIT, HIT
status
200
date
Mon, 11 Mar 2019 09:06:01 GMT
content-length
101073
x-amz-id-2
IeOQmA7IOjD0PMSc5VxFQir8x2lLUWBbydCjgcjcCIRmCaI4i4FJZHh6vIq2As9Q5b4yfGiyBtI=
x-served-by
cache-jfk8148-JFK, cache-hhn1538-HHN
last-modified
Tue, 05 Mar 2019 17:17:04 GMT
server
AmazonS3
x-timer
S1552295162.953384,VS0,VS0,VE1
etag
"a690916dd580df319afbcaee7f539b91"
x-amz-request-id
7BC59C8AE969A02B
cache-control
public, max-age=2592000
accept-ranges
bytes
content-type
image/jpeg
x-cache-hits
1, 1
embedder-jwp.js
www.csoonline.com/www/js/video/
2 KB
809 B
Script
General
Full URL
https://www.csoonline.com/www/js/video/embedder-jwp.js?v=20190307113302
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
f0b97fc49950832323730d508911fa12bd098eca0670ccb3a18ada5af3a34699

Request headers

:path
/www/js/video/embedder-jwp.js?v=20190307113302
pragma
no-cache
cookie
last_visit_bc=1552295161738; BCRevision_1552295161742=%7B%22method%22%3A%22setProperties%22%2C%22param%22%3A%7B%22properties%22%3A%7B%22language%22%3A%5B%22en%22%5D%2C%22currentresolution%22%3A%5B%221600x1200%22%5D%2C%22currentscreenwidth%22%3A%5B1600%5D%2C%22currentscreenheight%22%3A%5B1200%5D%2C%22referrerhost%22%3A%5B%22t.co%22%5D%2C%22new_visit_bc%22%3A%5B%22true%22%5D%7D%2C%22sources%22%3A%7B%22listenerinteractiontype%22%3A%5B%22language%22%2C%22currentresolution%22%2C%22currentscreenwidth%22%2C%22currentscreenheight%22%2C%22referrerhost%22%5D%2C%22newvisitlistener%22%3A%5B%22new_visit_bc%22%5D%7D%7D%2C%22requestId%22%3A%22rev_1552295161742%22%7D; BCRevision_1552295161743=%7B%22method%22%3A%22addProperties%22%2C%22param%22%3A%7B%22properties%22%3A%7B%22resolution%22%3A%5B%221600x1200%22%5D%7D%2C%22sources%22%3A%7B%22listenerinteractiontype%22%3A%5B%22resolution%22%5D%7D%7D%2C%22requestId%22%3A%22rev_1552295161743%22%7D; aiia=true
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.csoonline.com
referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
:scheme
https
:method
GET
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:01 GMT
content-encoding
gzip
age
256824
x-cache
HIT, HIT
status
200
x-cache-hits
2, 1
content-length
640
x-via-fastly
Verdad
x-served-by
cache-sjc3134-SJC, cache-hhn1538-HHN
last-modified
Thu, 07 Mar 2019 19:32:02 GMT
server
Apache-Coyote/1.1
x-timer
S1552295162.897517,VS0,VE1
etag
W/"1760-1551987122000"
vary
Accept-Encoding,Cookie
content-type
application/javascript
via
1.1 varnish 1.1 varnish
cache-control
max-age=604800
accept-ranges
bytes
expires
Thu, 14 Mar 2019 19:45:04 GMT
sponsored-links.css
www.csoonline.com/www.idge/css/
2 KB
830 B
Stylesheet
General
Full URL
https://www.csoonline.com/www.idge/css/sponsored-links.css?v=20190307113302
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
af0f4ef58885b0cec386f2405c78c8bcaec9802a2806c34aadee3ea4bf7a9a9b

Request headers

:path
/www.idge/css/sponsored-links.css?v=20190307113302
pragma
no-cache
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/css,*/*;q=0.1
cache-control
no-cache
:authority
www.csoonline.com
referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
:scheme
https
:method
GET
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:01 GMT
content-encoding
gzip
age
256740
x-cache
HIT, HIT
status
200
x-cache-hits
1, 1
content-length
557
x-via-fastly
Verdad
x-served-by
cache-sjc3121-SJC, cache-hhn1538-HHN
last-modified
Thu, 07 Mar 2019 19:29:56 GMT
server
Apache-Coyote/1.1
x-timer
S1552295162.653006,VS0,VE0
etag
W/"2121-1551986996000"
vary
Accept-Encoding,Cookie
content-type
text/css
via
1.1 varnish 1.1 varnish
cache-control
max-age=604800
accept-ranges
bytes
expires
Thu, 14 Mar 2019 19:45:34 GMT
sponsored-links.css
www.csoonline.com/www.idge.cso/css/
647 B
398 B
Stylesheet
General
Full URL
https://www.csoonline.com/www.idge.cso/css/sponsored-links.css?v=20190307113302
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
6f43f644863ed54af3536b02c6b5969a27d787d22effaf5255b200a441dfcbc3

Request headers

:path
/www.idge.cso/css/sponsored-links.css?v=20190307113302
pragma
no-cache
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/css,*/*;q=0.1
cache-control
no-cache
:authority
www.csoonline.com
referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
:scheme
https
:method
GET
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:01 GMT
content-encoding
gzip
age
256794
x-cache
HIT, HIT
status
200
x-cache-hits
10, 1287
content-length
278
x-via-fastly
Verdad
x-served-by
cache-sjc3125-SJC, cache-hhn1538-HHN
last-modified
Thu, 07 Mar 2019 19:29:12 GMT
server
Apache-Coyote/1.1
x-timer
S1552295162.653637,VS0,VE0
etag
W/"647-1551986952000"
vary
Accept-Encoding,Cookie
content-type
text/css
via
1.1 varnish 1.1 varnish
cache-control
max-age=604800
accept-ranges
bytes
expires
Thu, 14 Mar 2019 19:45:34 GMT
foot.css
www.csoonline.com/www.idge/css/
7 KB
2 KB
Stylesheet
General
Full URL
https://www.csoonline.com/www.idge/css/foot.css?v=20190307113302
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
5f68f284453f53e22e00b7f5deda2e578e59f52f6f80a559869f6b2055e0d225

Request headers

:path
/www.idge/css/foot.css?v=20190307113302
pragma
no-cache
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/css,*/*;q=0.1
cache-control
no-cache
:authority
www.csoonline.com
referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
:scheme
https
:method
GET
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:01 GMT
content-encoding
gzip
age
256802
x-cache
HIT, HIT
status
200
x-cache-hits
2, 2
content-length
1604
x-via-fastly
Verdad
x-served-by
cache-sjc3137-SJC, cache-hhn1538-HHN
last-modified
Thu, 07 Mar 2019 19:29:52 GMT
server
Apache-Coyote/1.1
x-timer
S1552295162.653591,VS0,VE0
etag
W/"7233-1551986992000"
vary
Accept-Encoding,Cookie
content-type
text/css
via
1.1 varnish 1.1 varnish
cache-control
max-age=604800
accept-ranges
bytes
expires
Thu, 14 Mar 2019 19:44:47 GMT
foot.css
www.csoonline.com/www.idge.cso/css/
2 KB
760 B
Stylesheet
General
Full URL
https://www.csoonline.com/www.idge.cso/css/foot.css?v=20190307113302
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
027a7a137fe45b00492b1a4eb5da8a57995cdce44de6b30499c6cbf789431851

Request headers

:path
/www.idge.cso/css/foot.css?v=20190307113302
pragma
no-cache
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/css,*/*;q=0.1
cache-control
no-cache
:authority
www.csoonline.com
referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
:scheme
https
:method
GET
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:01 GMT
content-encoding
gzip
age
256936
x-cache
HIT, HIT
status
200
x-cache-hits
3, 1
content-length
613
x-via-fastly
Verdad
x-served-by
cache-sjc3130-SJC, cache-hhn1538-HHN
last-modified
Thu, 07 Mar 2019 19:29:12 GMT
server
Apache-Coyote/1.1
x-timer
S1552295162.653628,VS0,VE1
etag
W/"2001-1551986952000"
vary
Accept-Encoding,Cookie
content-type
text/css
via
1.1 varnish 1.1 varnish
cache-control
max-age=604800
accept-ranges
bytes
expires
Thu, 14 Mar 2019 19:42:35 GMT
jquery-ui.js
www.csoonline.com/www/js/jquery/
292 KB
70 KB
Script
General
Full URL
https://www.csoonline.com/www/js/jquery/jquery-ui.js
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
66b5ca68288cc2506f1c5709fe38cebccca428406a7ce96e392718203666d503

Request headers

:path
/www/js/jquery/jquery-ui.js
pragma
no-cache
cookie
last_visit_bc=1552295161738; BCRevision_1552295161742=%7B%22method%22%3A%22setProperties%22%2C%22param%22%3A%7B%22properties%22%3A%7B%22language%22%3A%5B%22en%22%5D%2C%22currentresolution%22%3A%5B%221600x1200%22%5D%2C%22currentscreenwidth%22%3A%5B1600%5D%2C%22currentscreenheight%22%3A%5B1200%5D%2C%22referrerhost%22%3A%5B%22t.co%22%5D%2C%22new_visit_bc%22%3A%5B%22true%22%5D%7D%2C%22sources%22%3A%7B%22listenerinteractiontype%22%3A%5B%22language%22%2C%22currentresolution%22%2C%22currentscreenwidth%22%2C%22currentscreenheight%22%2C%22referrerhost%22%5D%2C%22newvisitlistener%22%3A%5B%22new_visit_bc%22%5D%7D%7D%2C%22requestId%22%3A%22rev_1552295161742%22%7D; BCRevision_1552295161743=%7B%22method%22%3A%22addProperties%22%2C%22param%22%3A%7B%22properties%22%3A%7B%22resolution%22%3A%5B%221600x1200%22%5D%7D%2C%22sources%22%3A%7B%22listenerinteractiontype%22%3A%5B%22resolution%22%5D%7D%7D%2C%22requestId%22%3A%22rev_1552295161743%22%7D; aiia=true
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.csoonline.com
referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
:scheme
https
:method
GET
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:01 GMT
content-encoding
gzip
age
212476
x-cache
HIT, HIT
status
200
x-cache-hits
1, 1
content-length
71002
x-via-fastly
Verdad
x-served-by
cache-sjc3147-SJC, cache-hhn1538-HHN
last-modified
Thu, 07 Mar 2019 19:31:52 GMT
server
Apache-Coyote/1.1
x-timer
S1552295162.897611,VS0,VE1
etag
W/"299210-1551987112000"
vary
Accept-Encoding,Cookie
content-type
application/javascript
via
1.1 varnish 1.1 varnish
cache-control
max-age=604800
accept-ranges
bytes
expires
Fri, 15 Mar 2019 08:04:09 GMT
jquery.dfp.min.js
www.csoonline.com/www/js/jquery/
4 KB
2 KB
Script
General
Full URL
https://www.csoonline.com/www/js/jquery/jquery.dfp.min.js
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
053d5c873a012d89c7a079d097426cfddb18b28494a55c51eff89e0294540dfd

Request headers

:path
/www/js/jquery/jquery.dfp.min.js
pragma
no-cache
cookie
last_visit_bc=1552295161738; BCRevision_1552295161742=%7B%22method%22%3A%22setProperties%22%2C%22param%22%3A%7B%22properties%22%3A%7B%22language%22%3A%5B%22en%22%5D%2C%22currentresolution%22%3A%5B%221600x1200%22%5D%2C%22currentscreenwidth%22%3A%5B1600%5D%2C%22currentscreenheight%22%3A%5B1200%5D%2C%22referrerhost%22%3A%5B%22t.co%22%5D%2C%22new_visit_bc%22%3A%5B%22true%22%5D%7D%2C%22sources%22%3A%7B%22listenerinteractiontype%22%3A%5B%22language%22%2C%22currentresolution%22%2C%22currentscreenwidth%22%2C%22currentscreenheight%22%2C%22referrerhost%22%5D%2C%22newvisitlistener%22%3A%5B%22new_visit_bc%22%5D%7D%7D%2C%22requestId%22%3A%22rev_1552295161742%22%7D; BCRevision_1552295161743=%7B%22method%22%3A%22addProperties%22%2C%22param%22%3A%7B%22properties%22%3A%7B%22resolution%22%3A%5B%221600x1200%22%5D%7D%2C%22sources%22%3A%7B%22listenerinteractiontype%22%3A%5B%22resolution%22%5D%7D%7D%2C%22requestId%22%3A%22rev_1552295161743%22%7D; aiia=true
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.csoonline.com
referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
:scheme
https
:method
GET
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:01 GMT
content-encoding
gzip
age
341370
x-cache
HIT, HIT
status
200
x-cache-hits
1, 2
content-length
1722
x-via-fastly
Verdad
x-served-by
cache-sjc3138-SJC, cache-hhn1538-HHN
last-modified
Wed, 06 Mar 2019 17:24:44 GMT
server
Apache-Coyote/1.1
x-timer
S1552295162.897637,VS0,VE0
etag
W/"4433-1551893084000"
vary
Accept-Encoding,Cookie
content-type
application/javascript
via
1.1 varnish 1.1 varnish
cache-control
max-age=604800
accept-ranges
bytes
expires
Wed, 13 Mar 2019 20:13:16 GMT
shortstack_nav.js
www.csoonline.com/www.idge/js/mule/
2 KB
745 B
Script
General
Full URL
https://www.csoonline.com/www.idge/js/mule/shortstack_nav.js
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
fb6b1425ff73fe62d725a3981ac08d9f57e16e14d5ae321c617e21e1d7403d1f

Request headers

:path
/www.idge/js/mule/shortstack_nav.js
pragma
no-cache
cookie
last_visit_bc=1552295161738; BCRevision_1552295161742=%7B%22method%22%3A%22setProperties%22%2C%22param%22%3A%7B%22properties%22%3A%7B%22language%22%3A%5B%22en%22%5D%2C%22currentresolution%22%3A%5B%221600x1200%22%5D%2C%22currentscreenwidth%22%3A%5B1600%5D%2C%22currentscreenheight%22%3A%5B1200%5D%2C%22referrerhost%22%3A%5B%22t.co%22%5D%2C%22new_visit_bc%22%3A%5B%22true%22%5D%7D%2C%22sources%22%3A%7B%22listenerinteractiontype%22%3A%5B%22language%22%2C%22currentresolution%22%2C%22currentscreenwidth%22%2C%22currentscreenheight%22%2C%22referrerhost%22%5D%2C%22newvisitlistener%22%3A%5B%22new_visit_bc%22%5D%7D%7D%2C%22requestId%22%3A%22rev_1552295161742%22%7D; BCRevision_1552295161743=%7B%22method%22%3A%22addProperties%22%2C%22param%22%3A%7B%22properties%22%3A%7B%22resolution%22%3A%5B%221600x1200%22%5D%7D%2C%22sources%22%3A%7B%22listenerinteractiontype%22%3A%5B%22resolution%22%5D%7D%7D%2C%22requestId%22%3A%22rev_1552295161743%22%7D; aiia=true
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.csoonline.com
referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
:scheme
https
:method
GET
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:01 GMT
content-encoding
gzip
age
216166
x-cache
HIT, HIT
status
200
x-cache-hits
1, 1
content-length
480
x-via-fastly
Verdad
x-served-by
cache-sjc3139-SJC, cache-hhn1538-HHN
last-modified
Thu, 07 Mar 2019 19:32:20 GMT
server
Apache-Coyote/1.1
x-timer
S1552295162.897681,VS0,VE1
etag
W/"2129-1551987140000"
vary
Accept-Encoding,Cookie
content-type
application/javascript
via
1.1 varnish 1.1 varnish
cache-control
max-age=604800
accept-ranges
bytes
expires
Fri, 15 Mar 2019 06:59:28 GMT
tracking.js
www.csoonline.com/www/js/analytics/
1 KB
719 B
Script
General
Full URL
https://www.csoonline.com/www/js/analytics/tracking.js
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
607bfd152e5c762ba0f0502f653c7bbb546ad7955e792a9840d4ae28a8219423

Request headers

:path
/www/js/analytics/tracking.js
pragma
no-cache
cookie
last_visit_bc=1552295161738; BCRevision_1552295161742=%7B%22method%22%3A%22setProperties%22%2C%22param%22%3A%7B%22properties%22%3A%7B%22language%22%3A%5B%22en%22%5D%2C%22currentresolution%22%3A%5B%221600x1200%22%5D%2C%22currentscreenwidth%22%3A%5B1600%5D%2C%22currentscreenheight%22%3A%5B1200%5D%2C%22referrerhost%22%3A%5B%22t.co%22%5D%2C%22new_visit_bc%22%3A%5B%22true%22%5D%7D%2C%22sources%22%3A%7B%22listenerinteractiontype%22%3A%5B%22language%22%2C%22currentresolution%22%2C%22currentscreenwidth%22%2C%22currentscreenheight%22%2C%22referrerhost%22%5D%2C%22newvisitlistener%22%3A%5B%22new_visit_bc%22%5D%7D%7D%2C%22requestId%22%3A%22rev_1552295161742%22%7D; BCRevision_1552295161743=%7B%22method%22%3A%22addProperties%22%2C%22param%22%3A%7B%22properties%22%3A%7B%22resolution%22%3A%5B%221600x1200%22%5D%7D%2C%22sources%22%3A%7B%22listenerinteractiontype%22%3A%5B%22resolution%22%5D%7D%7D%2C%22requestId%22%3A%22rev_1552295161743%22%7D; aiia=true
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.csoonline.com
referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
:scheme
https
:method
GET
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:01 GMT
content-encoding
gzip
age
151968
x-cache
HIT, HIT
status
200
x-cache-hits
1, 1
content-length
538
x-via-fastly
Verdad
x-served-by
cache-sjc3128-SJC, cache-hhn1538-HHN
last-modified
Thu, 07 Mar 2019 19:31:44 GMT
server
Apache-Coyote/1.1
x-timer
S1552295162.897731,VS0,VE1
etag
W/"1075-1551987104000"
vary
Accept-Encoding,Cookie
content-type
application/javascript
via
1.1 varnish 1.1 varnish
cache-control
max-age=604800
accept-ranges
bytes
expires
Thu, 14 Mar 2019 20:46:49 GMT
autocomplete.js
www.csoonline.com/www/js/
1 KB
791 B
Script
General
Full URL
https://www.csoonline.com/www/js/autocomplete.js
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
c7e1ddc2de3256e9b1db3c3733f38a74a9cdcbf1c424d559519f85cfe0e321ba

Request headers

:path
/www/js/autocomplete.js
pragma
no-cache
cookie
last_visit_bc=1552295161738; BCRevision_1552295161742=%7B%22method%22%3A%22setProperties%22%2C%22param%22%3A%7B%22properties%22%3A%7B%22language%22%3A%5B%22en%22%5D%2C%22currentresolution%22%3A%5B%221600x1200%22%5D%2C%22currentscreenwidth%22%3A%5B1600%5D%2C%22currentscreenheight%22%3A%5B1200%5D%2C%22referrerhost%22%3A%5B%22t.co%22%5D%2C%22new_visit_bc%22%3A%5B%22true%22%5D%7D%2C%22sources%22%3A%7B%22listenerinteractiontype%22%3A%5B%22language%22%2C%22currentresolution%22%2C%22currentscreenwidth%22%2C%22currentscreenheight%22%2C%22referrerhost%22%5D%2C%22newvisitlistener%22%3A%5B%22new_visit_bc%22%5D%7D%7D%2C%22requestId%22%3A%22rev_1552295161742%22%7D; BCRevision_1552295161743=%7B%22method%22%3A%22addProperties%22%2C%22param%22%3A%7B%22properties%22%3A%7B%22resolution%22%3A%5B%221600x1200%22%5D%7D%2C%22sources%22%3A%7B%22listenerinteractiontype%22%3A%5B%22resolution%22%5D%7D%7D%2C%22requestId%22%3A%22rev_1552295161743%22%7D; aiia=true
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.csoonline.com
referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
:scheme
https
:method
GET
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:01 GMT
content-encoding
gzip
age
494610
x-cache
HIT, HIT
status
200
x-cache-hits
1, 1
content-length
627
x-via-fastly
Verdad
x-served-by
cache-sjc3141-SJC, cache-hhn1538-HHN
last-modified
Mon, 04 Mar 2019 19:22:34 GMT
server
Apache-Coyote/1.1
x-timer
S1552295162.897719,VS0,VE1
etag
W/"1254-1551727354000"
vary
Accept-Encoding,Cookie
content-type
application/javascript
via
1.1 varnish 1.1 varnish
cache-control
max-age=604800
accept-ranges
bytes
expires
Tue, 12 Mar 2019 01:42:28 GMT
social_sidecar.js
www.csoonline.com/www.idge/js/
3 KB
1 KB
Script
General
Full URL
https://www.csoonline.com/www.idge/js/social_sidecar.js
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
e361531fa141864a28133b1d0174d3082ccc117fb347d7a913877faac08b9df0

Request headers

:path
/www.idge/js/social_sidecar.js
pragma
no-cache
cookie
last_visit_bc=1552295161738; BCRevision_1552295161742=%7B%22method%22%3A%22setProperties%22%2C%22param%22%3A%7B%22properties%22%3A%7B%22language%22%3A%5B%22en%22%5D%2C%22currentresolution%22%3A%5B%221600x1200%22%5D%2C%22currentscreenwidth%22%3A%5B1600%5D%2C%22currentscreenheight%22%3A%5B1200%5D%2C%22referrerhost%22%3A%5B%22t.co%22%5D%2C%22new_visit_bc%22%3A%5B%22true%22%5D%7D%2C%22sources%22%3A%7B%22listenerinteractiontype%22%3A%5B%22language%22%2C%22currentresolution%22%2C%22currentscreenwidth%22%2C%22currentscreenheight%22%2C%22referrerhost%22%5D%2C%22newvisitlistener%22%3A%5B%22new_visit_bc%22%5D%7D%7D%2C%22requestId%22%3A%22rev_1552295161742%22%7D; BCRevision_1552295161743=%7B%22method%22%3A%22addProperties%22%2C%22param%22%3A%7B%22properties%22%3A%7B%22resolution%22%3A%5B%221600x1200%22%5D%7D%2C%22sources%22%3A%7B%22listenerinteractiontype%22%3A%5B%22resolution%22%5D%7D%7D%2C%22requestId%22%3A%22rev_1552295161743%22%7D; aiia=true
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.csoonline.com
referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
:scheme
https
:method
GET
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:01 GMT
content-encoding
gzip
age
342495
x-cache
HIT, HIT
status
200
x-cache-hits
1, 1
content-length
1150
x-via-fastly
Verdad
x-served-by
cache-sjc3149-SJC, cache-hhn1538-HHN
last-modified
Wed, 06 Mar 2019 17:26:52 GMT
server
Apache-Coyote/1.1
x-timer
S1552295162.897739,VS0,VE6
etag
W/"3094-1551893212000"
vary
Accept-Encoding,Cookie
content-type
application/javascript
via
1.1 varnish 1.1 varnish
cache-control
max-age=604800
accept-ranges
bytes
expires
Wed, 13 Mar 2019 19:44:32 GMT
jquery.colorbox-min.js
www.csoonline.com/www.idge/js/jquery/plugins/
11 KB
5 KB
Script
General
Full URL
https://www.csoonline.com/www.idge/js/jquery/plugins/jquery.colorbox-min.js
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
f370d6bd05df8e6a5b671f06e038c4d85d95dc5446fdeb8f8762e817882a8322

Request headers

:path
/www.idge/js/jquery/plugins/jquery.colorbox-min.js
pragma
no-cache
cookie
last_visit_bc=1552295161738; BCRevision_1552295161742=%7B%22method%22%3A%22setProperties%22%2C%22param%22%3A%7B%22properties%22%3A%7B%22language%22%3A%5B%22en%22%5D%2C%22currentresolution%22%3A%5B%221600x1200%22%5D%2C%22currentscreenwidth%22%3A%5B1600%5D%2C%22currentscreenheight%22%3A%5B1200%5D%2C%22referrerhost%22%3A%5B%22t.co%22%5D%2C%22new_visit_bc%22%3A%5B%22true%22%5D%7D%2C%22sources%22%3A%7B%22listenerinteractiontype%22%3A%5B%22language%22%2C%22currentresolution%22%2C%22currentscreenwidth%22%2C%22currentscreenheight%22%2C%22referrerhost%22%5D%2C%22newvisitlistener%22%3A%5B%22new_visit_bc%22%5D%7D%7D%2C%22requestId%22%3A%22rev_1552295161742%22%7D; BCRevision_1552295161743=%7B%22method%22%3A%22addProperties%22%2C%22param%22%3A%7B%22properties%22%3A%7B%22resolution%22%3A%5B%221600x1200%22%5D%7D%2C%22sources%22%3A%7B%22listenerinteractiontype%22%3A%5B%22resolution%22%5D%7D%7D%2C%22requestId%22%3A%22rev_1552295161743%22%7D; aiia=true
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.csoonline.com
referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
:scheme
https
:method
GET
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:01 GMT
content-encoding
gzip
age
64241
x-cache
HIT, HIT
status
200
x-cache-hits
1, 1
content-length
4644
x-via-fastly
Verdad
x-served-by
cache-sjc3144-SJC, cache-hhn1538-HHN
last-modified
Thu, 07 Mar 2019 19:32:14 GMT
server
Apache-Coyote/1.1
x-timer
S1552295162.897785,VS0,VE0
etag
W/"11081-1551987134000"
vary
Accept-Encoding,Cookie
content-type
application/javascript
via
1.1 varnish 1.1 varnish
cache-control
max-age=604800
accept-ranges
bytes
expires
Fri, 15 Mar 2019 06:19:54 GMT
article.js
www.csoonline.com/www.idge/js/
2 KB
775 B
Script
General
Full URL
https://www.csoonline.com/www.idge/js/article.js?v=20190307113302
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
786653b773ea8e89e055b1380faa96769ed8bc605d6cfda8332f2c21408040cc

Request headers

:path
/www.idge/js/article.js?v=20190307113302
pragma
no-cache
cookie
last_visit_bc=1552295161738; BCRevision_1552295161742=%7B%22method%22%3A%22setProperties%22%2C%22param%22%3A%7B%22properties%22%3A%7B%22language%22%3A%5B%22en%22%5D%2C%22currentresolution%22%3A%5B%221600x1200%22%5D%2C%22currentscreenwidth%22%3A%5B1600%5D%2C%22currentscreenheight%22%3A%5B1200%5D%2C%22referrerhost%22%3A%5B%22t.co%22%5D%2C%22new_visit_bc%22%3A%5B%22true%22%5D%7D%2C%22sources%22%3A%7B%22listenerinteractiontype%22%3A%5B%22language%22%2C%22currentresolution%22%2C%22currentscreenwidth%22%2C%22currentscreenheight%22%2C%22referrerhost%22%5D%2C%22newvisitlistener%22%3A%5B%22new_visit_bc%22%5D%7D%7D%2C%22requestId%22%3A%22rev_1552295161742%22%7D; BCRevision_1552295161743=%7B%22method%22%3A%22addProperties%22%2C%22param%22%3A%7B%22properties%22%3A%7B%22resolution%22%3A%5B%221600x1200%22%5D%7D%2C%22sources%22%3A%7B%22listenerinteractiontype%22%3A%5B%22resolution%22%5D%7D%7D%2C%22requestId%22%3A%22rev_1552295161743%22%7D; aiia=true
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.csoonline.com
referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
:scheme
https
:method
GET
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:01 GMT
content-encoding
gzip
age
256822
x-cache
HIT, HIT
status
200
x-cache-hits
1, 1
content-length
623
x-via-fastly
Verdad
x-served-by
cache-sjc3139-SJC, cache-hhn1538-HHN
last-modified
Thu, 07 Mar 2019 19:32:22 GMT
server
Apache-Coyote/1.1
x-timer
S1552295162.900319,VS0,VE0
etag
W/"1721-1551987142000"
vary
Accept-Encoding,Cookie
content-type
application/javascript
via
1.1 varnish 1.1 varnish
cache-control
max-age=604800
accept-ranges
bytes
expires
Thu, 14 Mar 2019 19:45:04 GMT
prettify.js
www.csoonline.com/www/js/
14 KB
7 KB
Script
General
Full URL
https://www.csoonline.com/www/js/prettify.js
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
03fe6ca60cfaf61cba3353a0b460ed2912b07b09858e1f01ef55e0cff50e0ec7

Request headers

:path
/www/js/prettify.js
pragma
no-cache
cookie
last_visit_bc=1552295161738; BCRevision_1552295161742=%7B%22method%22%3A%22setProperties%22%2C%22param%22%3A%7B%22properties%22%3A%7B%22language%22%3A%5B%22en%22%5D%2C%22currentresolution%22%3A%5B%221600x1200%22%5D%2C%22currentscreenwidth%22%3A%5B1600%5D%2C%22currentscreenheight%22%3A%5B1200%5D%2C%22referrerhost%22%3A%5B%22t.co%22%5D%2C%22new_visit_bc%22%3A%5B%22true%22%5D%7D%2C%22sources%22%3A%7B%22listenerinteractiontype%22%3A%5B%22language%22%2C%22currentresolution%22%2C%22currentscreenwidth%22%2C%22currentscreenheight%22%2C%22referrerhost%22%5D%2C%22newvisitlistener%22%3A%5B%22new_visit_bc%22%5D%7D%7D%2C%22requestId%22%3A%22rev_1552295161742%22%7D; BCRevision_1552295161743=%7B%22method%22%3A%22addProperties%22%2C%22param%22%3A%7B%22properties%22%3A%7B%22resolution%22%3A%5B%221600x1200%22%5D%7D%2C%22sources%22%3A%7B%22listenerinteractiontype%22%3A%5B%22resolution%22%5D%7D%7D%2C%22requestId%22%3A%22rev_1552295161743%22%7D; aiia=true
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.csoonline.com
referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
:scheme
https
:method
GET
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:01 GMT
content-encoding
gzip
age
580220
x-cache
HIT, HIT
status
200
x-cache-hits
3, 1
content-length
6550
x-via-fastly
Verdad
x-served-by
cache-sjc3130-SJC, cache-hhn1538-HHN
last-modified
Wed, 27 Feb 2019 19:23:00 GMT
server
Apache-Coyote/1.1
x-timer
S1552295162.900399,VS0,VE1
etag
W/"14584-1551295380000"
vary
Accept-Encoding,Cookie
content-type
application/javascript
via
1.1 varnish 1.1 varnish
cache-control
max-age=604800
accept-ranges
bytes
expires
Wed, 06 Mar 2019 23:30:34 GMT
responsive-tables.js
www.csoonline.com/www.idge/js/jquery/
1 KB
716 B
Script
General
Full URL
https://www.csoonline.com/www.idge/js/jquery/responsive-tables.js
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
a739dbffc4a907c1f133b4b26e0daf544ea743218bba5704a910313b0ef3ac10

Request headers

:path
/www.idge/js/jquery/responsive-tables.js
pragma
no-cache
cookie
last_visit_bc=1552295161738; BCRevision_1552295161742=%7B%22method%22%3A%22setProperties%22%2C%22param%22%3A%7B%22properties%22%3A%7B%22language%22%3A%5B%22en%22%5D%2C%22currentresolution%22%3A%5B%221600x1200%22%5D%2C%22currentscreenwidth%22%3A%5B1600%5D%2C%22currentscreenheight%22%3A%5B1200%5D%2C%22referrerhost%22%3A%5B%22t.co%22%5D%2C%22new_visit_bc%22%3A%5B%22true%22%5D%7D%2C%22sources%22%3A%7B%22listenerinteractiontype%22%3A%5B%22language%22%2C%22currentresolution%22%2C%22currentscreenwidth%22%2C%22currentscreenheight%22%2C%22referrerhost%22%5D%2C%22newvisitlistener%22%3A%5B%22new_visit_bc%22%5D%7D%7D%2C%22requestId%22%3A%22rev_1552295161742%22%7D; BCRevision_1552295161743=%7B%22method%22%3A%22addProperties%22%2C%22param%22%3A%7B%22properties%22%3A%7B%22resolution%22%3A%5B%221600x1200%22%5D%7D%2C%22sources%22%3A%7B%22listenerinteractiontype%22%3A%5B%22resolution%22%5D%7D%7D%2C%22requestId%22%3A%22rev_1552295161743%22%7D; aiia=true
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.csoonline.com
referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
:scheme
https
:method
GET
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:01 GMT
content-encoding
gzip
age
311749
x-cache
HIT, HIT
status
200
x-cache-hits
1, 1
content-length
541
x-via-fastly
Verdad
x-served-by
cache-sjc3127-SJC, cache-hhn1538-HHN
last-modified
Wed, 06 Mar 2019 17:26:38 GMT
server
Apache-Coyote/1.1
x-timer
S1552295162.900416,VS0,VE1
etag
W/"1363-1551893198000"
vary
Accept-Encoding,Cookie
content-type
application/javascript
via
1.1 varnish 1.1 varnish
cache-control
max-age=604800
accept-ranges
bytes
expires
Thu, 14 Mar 2019 04:27:51 GMT
jquery.tablesorter.min.js
www.csoonline.com/www.idge/js/jquery/
16 KB
5 KB
Script
General
Full URL
https://www.csoonline.com/www.idge/js/jquery/jquery.tablesorter.min.js
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
55e8d16bb1a291b0524928dd3bd20c191a14d8a947e4b141271f9c595c7bb451

Request headers

:path
/www.idge/js/jquery/jquery.tablesorter.min.js
pragma
no-cache
cookie
last_visit_bc=1552295161738; BCRevision_1552295161742=%7B%22method%22%3A%22setProperties%22%2C%22param%22%3A%7B%22properties%22%3A%7B%22language%22%3A%5B%22en%22%5D%2C%22currentresolution%22%3A%5B%221600x1200%22%5D%2C%22currentscreenwidth%22%3A%5B1600%5D%2C%22currentscreenheight%22%3A%5B1200%5D%2C%22referrerhost%22%3A%5B%22t.co%22%5D%2C%22new_visit_bc%22%3A%5B%22true%22%5D%7D%2C%22sources%22%3A%7B%22listenerinteractiontype%22%3A%5B%22language%22%2C%22currentresolution%22%2C%22currentscreenwidth%22%2C%22currentscreenheight%22%2C%22referrerhost%22%5D%2C%22newvisitlistener%22%3A%5B%22new_visit_bc%22%5D%7D%7D%2C%22requestId%22%3A%22rev_1552295161742%22%7D; BCRevision_1552295161743=%7B%22method%22%3A%22addProperties%22%2C%22param%22%3A%7B%22properties%22%3A%7B%22resolution%22%3A%5B%221600x1200%22%5D%7D%2C%22sources%22%3A%7B%22listenerinteractiontype%22%3A%5B%22resolution%22%5D%7D%7D%2C%22requestId%22%3A%22rev_1552295161743%22%7D; aiia=true
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.csoonline.com
referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
:scheme
https
:method
GET
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:01 GMT
content-encoding
gzip
age
229638
x-cache
HIT, HIT
status
200
x-cache-hits
4, 1
content-length
4834
x-via-fastly
Verdad
x-served-by
cache-sjc3136-SJC, cache-hhn1538-HHN
last-modified
Thu, 07 Mar 2019 19:32:16 GMT
server
Apache-Coyote/1.1
x-timer
S1552295162.900429,VS0,VE0
etag
W/"16373-1551987136000"
vary
Accept-Encoding,Cookie
content-type
application/javascript
via
1.1 varnish 1.1 varnish
cache-control
max-age=604800
accept-ranges
bytes
expires
Fri, 15 Mar 2019 03:17:35 GMT
jquery.lazyload.min.js
www.csoonline.com/www/js/jquery/
3 KB
1 KB
Script
General
Full URL
https://www.csoonline.com/www/js/jquery/jquery.lazyload.min.js
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
a193a57207a9fe3514d40f9f36426ce98dd4dfb8ec15277a9f3b9add4a09472f

Request headers

:path
/www/js/jquery/jquery.lazyload.min.js
pragma
no-cache
cookie
last_visit_bc=1552295161738; BCRevision_1552295161742=%7B%22method%22%3A%22setProperties%22%2C%22param%22%3A%7B%22properties%22%3A%7B%22language%22%3A%5B%22en%22%5D%2C%22currentresolution%22%3A%5B%221600x1200%22%5D%2C%22currentscreenwidth%22%3A%5B1600%5D%2C%22currentscreenheight%22%3A%5B1200%5D%2C%22referrerhost%22%3A%5B%22t.co%22%5D%2C%22new_visit_bc%22%3A%5B%22true%22%5D%7D%2C%22sources%22%3A%7B%22listenerinteractiontype%22%3A%5B%22language%22%2C%22currentresolution%22%2C%22currentscreenwidth%22%2C%22currentscreenheight%22%2C%22referrerhost%22%5D%2C%22newvisitlistener%22%3A%5B%22new_visit_bc%22%5D%7D%7D%2C%22requestId%22%3A%22rev_1552295161742%22%7D; BCRevision_1552295161743=%7B%22method%22%3A%22addProperties%22%2C%22param%22%3A%7B%22properties%22%3A%7B%22resolution%22%3A%5B%221600x1200%22%5D%7D%2C%22sources%22%3A%7B%22listenerinteractiontype%22%3A%5B%22resolution%22%5D%7D%7D%2C%22requestId%22%3A%22rev_1552295161743%22%7D; aiia=true
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.csoonline.com
referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
:scheme
https
:method
GET
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:01 GMT
content-encoding
gzip
age
429073
x-cache
HIT, HIT
status
200
x-cache-hits
1, 1
content-length
1300
x-via-fastly
Verdad
x-served-by
cache-sjc3136-SJC, cache-hhn1538-HHN
last-modified
Tue, 05 Mar 2019 19:22:36 GMT
server
Apache-Coyote/1.1
x-timer
S1552295162.900465,VS0,VE1
etag
W/"3396-1551813756000"
vary
Accept-Encoding,Cookie
content-type
application/javascript
via
1.1 varnish 1.1 varnish
cache-control
max-age=604800
accept-ranges
bytes
expires
Tue, 12 Mar 2019 19:44:38 GMT
global.js
www.csoonline.com/www.idge/js/
7 KB
2 KB
Script
General
Full URL
https://www.csoonline.com/www.idge/js/global.js?v=20190307113302
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
869ff0ba952924c539c2858fbfb032e6caf14f0a8805be73156ca21debd6ea2d

Request headers

:path
/www.idge/js/global.js?v=20190307113302
pragma
no-cache
cookie
last_visit_bc=1552295161738; BCRevision_1552295161742=%7B%22method%22%3A%22setProperties%22%2C%22param%22%3A%7B%22properties%22%3A%7B%22language%22%3A%5B%22en%22%5D%2C%22currentresolution%22%3A%5B%221600x1200%22%5D%2C%22currentscreenwidth%22%3A%5B1600%5D%2C%22currentscreenheight%22%3A%5B1200%5D%2C%22referrerhost%22%3A%5B%22t.co%22%5D%2C%22new_visit_bc%22%3A%5B%22true%22%5D%7D%2C%22sources%22%3A%7B%22listenerinteractiontype%22%3A%5B%22language%22%2C%22currentresolution%22%2C%22currentscreenwidth%22%2C%22currentscreenheight%22%2C%22referrerhost%22%5D%2C%22newvisitlistener%22%3A%5B%22new_visit_bc%22%5D%7D%7D%2C%22requestId%22%3A%22rev_1552295161742%22%7D; BCRevision_1552295161743=%7B%22method%22%3A%22addProperties%22%2C%22param%22%3A%7B%22properties%22%3A%7B%22resolution%22%3A%5B%221600x1200%22%5D%7D%2C%22sources%22%3A%7B%22listenerinteractiontype%22%3A%5B%22resolution%22%5D%7D%7D%2C%22requestId%22%3A%22rev_1552295161743%22%7D; aiia=true
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.csoonline.com
referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
:scheme
https
:method
GET
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:01 GMT
content-encoding
gzip
age
256802
x-cache
HIT, HIT
status
200
x-cache-hits
1, 1
content-length
2370
x-via-fastly
Verdad
x-served-by
cache-sjc3121-SJC, cache-hhn1538-HHN
last-modified
Thu, 07 Mar 2019 19:32:10 GMT
server
Apache-Coyote/1.1
x-timer
S1552295162.900517,VS0,VE1
etag
W/"7636-1551987130000"
vary
Accept-Encoding,Cookie
content-type
application/javascript
via
1.1 varnish 1.1 varnish
cache-control
max-age=604800
accept-ranges
bytes
expires
Thu, 14 Mar 2019 19:44:47 GMT
ss-social.js
www.csoonline.com/www/js/webfonts/
4 KB
2 KB
Script
General
Full URL
https://www.csoonline.com/www/js/webfonts/ss-social.js
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
af34f58ea2fc346a5f7028ad8b721a9bb31405cf283471a37dab53bad10a6a36

Request headers

:path
/www/js/webfonts/ss-social.js
pragma
no-cache
cookie
last_visit_bc=1552295161738; BCRevision_1552295161742=%7B%22method%22%3A%22setProperties%22%2C%22param%22%3A%7B%22properties%22%3A%7B%22language%22%3A%5B%22en%22%5D%2C%22currentresolution%22%3A%5B%221600x1200%22%5D%2C%22currentscreenwidth%22%3A%5B1600%5D%2C%22currentscreenheight%22%3A%5B1200%5D%2C%22referrerhost%22%3A%5B%22t.co%22%5D%2C%22new_visit_bc%22%3A%5B%22true%22%5D%7D%2C%22sources%22%3A%7B%22listenerinteractiontype%22%3A%5B%22language%22%2C%22currentresolution%22%2C%22currentscreenwidth%22%2C%22currentscreenheight%22%2C%22referrerhost%22%5D%2C%22newvisitlistener%22%3A%5B%22new_visit_bc%22%5D%7D%7D%2C%22requestId%22%3A%22rev_1552295161742%22%7D; BCRevision_1552295161743=%7B%22method%22%3A%22addProperties%22%2C%22param%22%3A%7B%22properties%22%3A%7B%22resolution%22%3A%5B%221600x1200%22%5D%7D%2C%22sources%22%3A%7B%22listenerinteractiontype%22%3A%5B%22resolution%22%5D%7D%7D%2C%22requestId%22%3A%22rev_1552295161743%22%7D; aiia=true
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.csoonline.com
referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
:scheme
https
:method
GET
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:01 GMT
content-encoding
gzip
age
183579
x-cache
HIT, HIT
status
200
x-cache-hits
1, 1
content-length
1766
x-via-fastly
Verdad
x-served-by
cache-sjc3139-SJC, cache-hhn1538-HHN
last-modified
Thu, 07 Mar 2019 19:31:46 GMT
server
Apache-Coyote/1.1
x-timer
S1552295162.900587,VS0,VE1
etag
W/"3950-1551987106000"
vary
Accept-Encoding,Cookie
content-type
application/javascript
via
1.1 varnish 1.1 varnish
cache-control
max-age=604800
accept-ranges
bytes
expires
Fri, 15 Mar 2019 02:05:19 GMT
ss-standard.js
www.csoonline.com/www/js/webfonts/
11 KB
4 KB
Script
General
Full URL
https://www.csoonline.com/www/js/webfonts/ss-standard.js
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
bdfe5b167ff906b96e1f8f028ac8f5e41af7a1892d0cc3a275d28057ba79c0a9

Request headers

:path
/www/js/webfonts/ss-standard.js
pragma
no-cache
cookie
last_visit_bc=1552295161738; BCRevision_1552295161742=%7B%22method%22%3A%22setProperties%22%2C%22param%22%3A%7B%22properties%22%3A%7B%22language%22%3A%5B%22en%22%5D%2C%22currentresolution%22%3A%5B%221600x1200%22%5D%2C%22currentscreenwidth%22%3A%5B1600%5D%2C%22currentscreenheight%22%3A%5B1200%5D%2C%22referrerhost%22%3A%5B%22t.co%22%5D%2C%22new_visit_bc%22%3A%5B%22true%22%5D%7D%2C%22sources%22%3A%7B%22listenerinteractiontype%22%3A%5B%22language%22%2C%22currentresolution%22%2C%22currentscreenwidth%22%2C%22currentscreenheight%22%2C%22referrerhost%22%5D%2C%22newvisitlistener%22%3A%5B%22new_visit_bc%22%5D%7D%7D%2C%22requestId%22%3A%22rev_1552295161742%22%7D; BCRevision_1552295161743=%7B%22method%22%3A%22addProperties%22%2C%22param%22%3A%7B%22properties%22%3A%7B%22resolution%22%3A%5B%221600x1200%22%5D%7D%2C%22sources%22%3A%7B%22listenerinteractiontype%22%3A%5B%22resolution%22%5D%7D%7D%2C%22requestId%22%3A%22rev_1552295161743%22%7D; aiia=true
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.csoonline.com
referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
:scheme
https
:method
GET
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:01 GMT
content-encoding
gzip
age
89059
x-cache
HIT, HIT
status
200
x-cache-hits
1, 1
content-length
3925
x-via-fastly
Verdad
x-served-by
cache-sjc3143-SJC, cache-hhn1538-HHN
last-modified
Thu, 07 Mar 2019 19:31:46 GMT
server
Apache-Coyote/1.1
x-timer
S1552295162.900679,VS0,VE1
etag
W/"10818-1551987106000"
vary
Accept-Encoding,Cookie
content-type
application/javascript
via
1.1 varnish 1.1 varnish
cache-control
max-age=604800
accept-ranges
bytes
expires
Fri, 15 Mar 2019 00:09:58 GMT
brandAnalytics.js
www.csoonline.com/www/js/analytics/
2 KB
636 B
Script
General
Full URL
https://www.csoonline.com/www/js/analytics/brandAnalytics.js
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
9844fb443bd322af1d908116fa890abdbed6b8b6fe73fba91c9beb8408318aad

Request headers

:path
/www/js/analytics/brandAnalytics.js
pragma
no-cache
cookie
last_visit_bc=1552295161738; BCRevision_1552295161742=%7B%22method%22%3A%22setProperties%22%2C%22param%22%3A%7B%22properties%22%3A%7B%22language%22%3A%5B%22en%22%5D%2C%22currentresolution%22%3A%5B%221600x1200%22%5D%2C%22currentscreenwidth%22%3A%5B1600%5D%2C%22currentscreenheight%22%3A%5B1200%5D%2C%22referrerhost%22%3A%5B%22t.co%22%5D%2C%22new_visit_bc%22%3A%5B%22true%22%5D%7D%2C%22sources%22%3A%7B%22listenerinteractiontype%22%3A%5B%22language%22%2C%22currentresolution%22%2C%22currentscreenwidth%22%2C%22currentscreenheight%22%2C%22referrerhost%22%5D%2C%22newvisitlistener%22%3A%5B%22new_visit_bc%22%5D%7D%7D%2C%22requestId%22%3A%22rev_1552295161742%22%7D; BCRevision_1552295161743=%7B%22method%22%3A%22addProperties%22%2C%22param%22%3A%7B%22properties%22%3A%7B%22resolution%22%3A%5B%221600x1200%22%5D%7D%2C%22sources%22%3A%7B%22listenerinteractiontype%22%3A%5B%22resolution%22%5D%7D%7D%2C%22requestId%22%3A%22rev_1552295161743%22%7D; aiia=true
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.csoonline.com
referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
:scheme
https
:method
GET
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:01 GMT
content-encoding
gzip
age
218763
x-cache
HIT, HIT
status
200
x-cache-hits
1, 1
content-length
461
x-via-fastly
Verdad
x-served-by
cache-sjc3136-SJC, cache-hhn1538-HHN
last-modified
Thu, 07 Mar 2019 19:31:44 GMT
server
Apache-Coyote/1.1
x-timer
S1552295162.900913,VS0,VE6
etag
W/"2516-1551987104000"
vary
Accept-Encoding,Cookie
content-type
application/javascript
via
1.1 varnish 1.1 varnish
cache-control
max-age=604800
accept-ranges
bytes
expires
Fri, 15 Mar 2019 06:19:54 GMT
jquery.lazyload-ad.js
www.csoonline.com/www/js/ads/
10 KB
3 KB
Script
General
Full URL
https://www.csoonline.com/www/js/ads/jquery.lazyload-ad.js
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
4e6b5fc328bac95eec2e30afa8a58224c9accc6d70daf0e864d75c4c6d07fe94

Request headers

:path
/www/js/ads/jquery.lazyload-ad.js
pragma
no-cache
cookie
last_visit_bc=1552295161738; BCRevision_1552295161742=%7B%22method%22%3A%22setProperties%22%2C%22param%22%3A%7B%22properties%22%3A%7B%22language%22%3A%5B%22en%22%5D%2C%22currentresolution%22%3A%5B%221600x1200%22%5D%2C%22currentscreenwidth%22%3A%5B1600%5D%2C%22currentscreenheight%22%3A%5B1200%5D%2C%22referrerhost%22%3A%5B%22t.co%22%5D%2C%22new_visit_bc%22%3A%5B%22true%22%5D%7D%2C%22sources%22%3A%7B%22listenerinteractiontype%22%3A%5B%22language%22%2C%22currentresolution%22%2C%22currentscreenwidth%22%2C%22currentscreenheight%22%2C%22referrerhost%22%5D%2C%22newvisitlistener%22%3A%5B%22new_visit_bc%22%5D%7D%7D%2C%22requestId%22%3A%22rev_1552295161742%22%7D; BCRevision_1552295161743=%7B%22method%22%3A%22addProperties%22%2C%22param%22%3A%7B%22properties%22%3A%7B%22resolution%22%3A%5B%221600x1200%22%5D%7D%2C%22sources%22%3A%7B%22listenerinteractiontype%22%3A%5B%22resolution%22%5D%7D%7D%2C%22requestId%22%3A%22rev_1552295161743%22%7D; aiia=true
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.csoonline.com
referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
:scheme
https
:method
GET
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:01 GMT
content-encoding
gzip
age
161468
x-cache
HIT, HIT
status
200
x-cache-hits
1, 1
content-length
3069
x-via-fastly
Verdad
x-served-by
cache-sjc3136-SJC, cache-hhn1538-HHN
last-modified
Thu, 07 Mar 2019 19:31:40 GMT
server
Apache-Coyote/1.1
x-timer
S1552295162.900923,VS0,VE1
etag
W/"9912-1551987100000"
vary
Accept-Encoding,Cookie
content-type
application/javascript
via
1.1 varnish 1.1 varnish
cache-control
max-age=604800
accept-ranges
bytes
expires
Fri, 15 Mar 2019 08:04:31 GMT
pippio.min.js
storage.googleapis.com/cdn.pippio.com/sdk/
0
0
Script
General
Full URL
https://storage.googleapis.com/cdn.pippio.com/sdk/pippio.min.js
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:81b::2010 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

liveRamp.js
www.csoonline.com/www/js/utils/
907 B
746 B
Script
General
Full URL
https://www.csoonline.com/www/js/utils/liveRamp.js
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
650ae71f579feb5002cf59bb44ead1b0fbec98923fe09a9dbfdde2b865f664ef

Request headers

:path
/www/js/utils/liveRamp.js
pragma
no-cache
cookie
last_visit_bc=1552295161738; BCRevision_1552295161742=%7B%22method%22%3A%22setProperties%22%2C%22param%22%3A%7B%22properties%22%3A%7B%22language%22%3A%5B%22en%22%5D%2C%22currentresolution%22%3A%5B%221600x1200%22%5D%2C%22currentscreenwidth%22%3A%5B1600%5D%2C%22currentscreenheight%22%3A%5B1200%5D%2C%22referrerhost%22%3A%5B%22t.co%22%5D%2C%22new_visit_bc%22%3A%5B%22true%22%5D%7D%2C%22sources%22%3A%7B%22listenerinteractiontype%22%3A%5B%22language%22%2C%22currentresolution%22%2C%22currentscreenwidth%22%2C%22currentscreenheight%22%2C%22referrerhost%22%5D%2C%22newvisitlistener%22%3A%5B%22new_visit_bc%22%5D%7D%7D%2C%22requestId%22%3A%22rev_1552295161742%22%7D; BCRevision_1552295161743=%7B%22method%22%3A%22addProperties%22%2C%22param%22%3A%7B%22properties%22%3A%7B%22resolution%22%3A%5B%221600x1200%22%5D%7D%2C%22sources%22%3A%7B%22listenerinteractiontype%22%3A%5B%22resolution%22%5D%7D%7D%2C%22requestId%22%3A%22rev_1552295161743%22%7D; aiia=true
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.csoonline.com
referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
:scheme
https
:method
GET
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:01 GMT
content-encoding
gzip
age
178980
x-cache
HIT, HIT
status
200
x-cache-hits
1, 1
content-length
465
x-via-fastly
Verdad
x-served-by
cache-sjc3131-SJC, cache-hhn1538-HHN
last-modified
Thu, 07 Mar 2019 19:31:56 GMT
server
Apache-Coyote/1.1
x-timer
S1552295162.901034,VS0,VE1
etag
W/"907-1551987116000"
vary
Accept-Encoding,Cookie
content-type
application/javascript
via
1.1 varnish 1.1 varnish
cache-control
max-age=604800
accept-ranges
bytes
expires
Fri, 15 Mar 2019 03:17:35 GMT
cyd3Vkrqtd-ClWmwn4oT2UgRVFzxMujpGSwHmogdm3LpvfSUBhItArin36Z82cfR8fnYg
spiffymachine.com/v2/0/
79 KB
24 KB
Script
General
Full URL
https://spiffymachine.com/v2/0/cyd3Vkrqtd-ClWmwn4oT2UgRVFzxMujpGSwHmogdm3LpvfSUBhItArin36Z82cfR8fnYg
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.201.98.64 Ann Arbor, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
64.98.201.35.bc.googleusercontent.com
Software
/
Resource Hash
6be471d5146e0c52c4967781fc4b41ce4e9b62739cc739632a1e854dd811189d

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:02 GMT
content-encoding
gzip
x-datacenter
gce-europe-west3
etag
9f50938bab34a755b47e6f04b12f262116502620ccc74769dff989a76af4f2a5
vary
Accept-Encoding
x-hostname
claire
content-type
application/javascript
status
200
cache-control
private, must-revalidate, max-age=21600
timing-allow-origin
*
json
idg.blueconic.net/DG/DEFAULT/rest/rpc/
71 KB
14 KB
XHR
General
Full URL
https://idg.blueconic.net/DG/DEFAULT/rest/rpc/json?referer=https%3A%2F%2Fwww.csoonline.com%2Farticle%2F3345972%2Fqbot-malware-resurfaces-in-new-attack-against-businesses.html&bcsessionid=&bctempid=&overruleReferrer=&time=2019-03-11T09%3A06%3A01%2B00%3A00&ts=1552295161778
Requested by
Host: cdn.blueconic.net
URL: https://cdn.blueconic.net/idg.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.226.72.36 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-226-72-36.compute-1.amazonaws.com
Software
- /
Resource Hash
fc20cc8543767eb4b7a68f4bf2510fa52f7692c3cb4d7320f9a0aea623b513d8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Origin
https://www.csoonline.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
text/plain

Response headers

date
Mon, 11 Mar 2019 09:06:02 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-permitted-cross-domain-policies
master-only
p3p
policyref="", CP="DSP"
status
200
content-length
13516
x-xss-protection
1; mode=block
pragma
no-cache
server
-
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.csoonline.com
cache-control
no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials
true
x-robots-tag
noindex, nofollow
expires
Thu, 01 Jan 1970 00:00:00 GMT
gpt.js
www.googletagservices.com/tag/js/
32 KB
11 KB
Script
General
Full URL
https://www.googletagservices.com/tag/js/gpt.js
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/www/js/ads/gpt_starter.js?1234
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:806::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
d917db9bc5ae04090ba70496c77d09672b9765c1a7f831185a861743baa5cec5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:01 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"103 / 713 of 1000 / last-modified: 1552081118"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
10811
x-xss-protection
1; mode=block
expires
Mon, 11 Mar 2019 09:06:01 GMT
inline-header.css
www.csoonline.com/www.idge/css/
9 KB
2 KB
Stylesheet
General
Full URL
https://www.csoonline.com/www.idge/css/inline-header.css?v=20190307113302
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
6bb4062c9a8a904038de2727004696ce7ac61aa04746e1f3431245c8d6338bba

Request headers

:path
/www.idge/css/inline-header.css?v=20190307113302
pragma
no-cache
cookie
last_visit_bc=1552295161738; BCRevision_1552295161742=%7B%22method%22%3A%22setProperties%22%2C%22param%22%3A%7B%22properties%22%3A%7B%22language%22%3A%5B%22en%22%5D%2C%22currentresolution%22%3A%5B%221600x1200%22%5D%2C%22currentscreenwidth%22%3A%5B1600%5D%2C%22currentscreenheight%22%3A%5B1200%5D%2C%22referrerhost%22%3A%5B%22t.co%22%5D%2C%22new_visit_bc%22%3A%5B%22true%22%5D%7D%2C%22sources%22%3A%7B%22listenerinteractiontype%22%3A%5B%22language%22%2C%22currentresolution%22%2C%22currentscreenwidth%22%2C%22currentscreenheight%22%2C%22referrerhost%22%5D%2C%22newvisitlistener%22%3A%5B%22new_visit_bc%22%5D%7D%7D%2C%22requestId%22%3A%22rev_1552295161742%22%7D; BCRevision_1552295161743=%7B%22method%22%3A%22addProperties%22%2C%22param%22%3A%7B%22properties%22%3A%7B%22resolution%22%3A%5B%221600x1200%22%5D%7D%2C%22sources%22%3A%7B%22listenerinteractiontype%22%3A%5B%22resolution%22%5D%7D%7D%2C%22requestId%22%3A%22rev_1552295161743%22%7D; aiia=true
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/css,*/*;q=0.1
cache-control
no-cache
:authority
www.csoonline.com
referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
:scheme
https
:method
GET
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:01 GMT
content-encoding
gzip
age
256863
x-cache
HIT, HIT
status
200
x-cache-hits
1, 1
content-length
1894
x-via-fastly
Verdad
x-served-by
cache-sjc3125-SJC, cache-hhn1538-HHN
last-modified
Thu, 07 Mar 2019 19:29:56 GMT
server
Apache-Coyote/1.1
x-timer
S1552295162.838089,VS0,VE1
etag
W/"9207-1551986996000"
vary
Accept-Encoding,Cookie
content-type
text/css
via
1.1 varnish 1.1 varnish
cache-control
max-age=604800
accept-ranges
bytes
expires
Thu, 14 Mar 2019 19:42:36 GMT
print.css
www.csoonline.com/www.idge/css/
2 KB
875 B
Stylesheet
General
Full URL
https://www.csoonline.com/www.idge/css/print.css
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
a5e5c781317ce492049cb1f9e1deec67c47bbe5dbd03ec12f688cf7a221a79f2

Request headers

:path
/www.idge/css/print.css
pragma
no-cache
cookie
last_visit_bc=1552295161738; BCRevision_1552295161742=%7B%22method%22%3A%22setProperties%22%2C%22param%22%3A%7B%22properties%22%3A%7B%22language%22%3A%5B%22en%22%5D%2C%22currentresolution%22%3A%5B%221600x1200%22%5D%2C%22currentscreenwidth%22%3A%5B1600%5D%2C%22currentscreenheight%22%3A%5B1200%5D%2C%22referrerhost%22%3A%5B%22t.co%22%5D%2C%22new_visit_bc%22%3A%5B%22true%22%5D%7D%2C%22sources%22%3A%7B%22listenerinteractiontype%22%3A%5B%22language%22%2C%22currentresolution%22%2C%22currentscreenwidth%22%2C%22currentscreenheight%22%2C%22referrerhost%22%5D%2C%22newvisitlistener%22%3A%5B%22new_visit_bc%22%5D%7D%7D%2C%22requestId%22%3A%22rev_1552295161742%22%7D; BCRevision_1552295161743=%7B%22method%22%3A%22addProperties%22%2C%22param%22%3A%7B%22properties%22%3A%7B%22resolution%22%3A%5B%221600x1200%22%5D%7D%2C%22sources%22%3A%7B%22listenerinteractiontype%22%3A%5B%22resolution%22%5D%7D%7D%2C%22requestId%22%3A%22rev_1552295161743%22%7D; aiia=true
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/css,*/*;q=0.1
cache-control
no-cache
:authority
www.csoonline.com
referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
:scheme
https
:method
GET
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:01 GMT
content-encoding
gzip
age
254533
x-cache
HIT, HIT
status
200
x-cache-hits
1, 1
content-length
733
x-via-fastly
Verdad
x-served-by
cache-sjc3143-SJC, cache-hhn1538-HHN
last-modified
Thu, 07 Mar 2019 19:29:56 GMT
server
Apache-Coyote/1.1
x-timer
S1552295162.901040,VS0,VE1
etag
W/"1871-1551986996000"
vary
Accept-Encoding,Cookie
content-type
text/css
via
1.1 varnish 1.1 varnish
cache-control
max-age=604800
accept-ranges
bytes
expires
Thu, 14 Mar 2019 20:23:21 GMT
svrGP.aspx
secure.p01.eloqua.com/visitor/v200/
49 B
373 B
Image
General
Full URL
https://secure.p01.eloqua.com/visitor/v200/svrGP.aspx?pps=3&siteid=1856&ref2=https%3A//t.co/aHrXW7ESH9&tzo=0&ms=863
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
142.0.173.130 Redwood City, United States, ASN7160 (NETDYNAMICS - Oracle Corporation, US),
Reverse DNS
Software
/
Resource Hash
f1ccea6b7204d9f7913ab45e1afa51d79f83bd4f0319de937b0132e6e02b1aab
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;
X-Content-Type-Options nosniff

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Strict-Transport-Security
max-age=31536000;
X-Content-Type-Options
nosniff
Date
Mon, 11 Mar 2019 09:06:02 GMT
P3P
CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA",
Cache-Control
private,no-cache, no-store
Content-Type
image/gif
Content-Length
49
Expires
-1
template
www.csoonline.com/blank/ Frame C464
Redirect Chain
  • https://www.csoonline.com/elqNow/elqBlank.htm
  • https://www.csoonline.com/blank/template
11 B
286 B
Document
General
Full URL
https://www.csoonline.com/blank/template
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/www/js/analytics/eloqua/elqFCS.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
636159b35205da4142a43bc02d2849d77d3ac07a0946211585cde15a9c6ff21f

Request headers

:method
GET
:authority
www.csoonline.com
:scheme
https
:path
/blank/template
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
accept-encoding
gzip, deflate, br
cookie
last_visit_bc=1552295161738; BCRevision_1552295161742=%7B%22method%22%3A%22setProperties%22%2C%22param%22%3A%7B%22properties%22%3A%7B%22language%22%3A%5B%22en%22%5D%2C%22currentresolution%22%3A%5B%221600x1200%22%5D%2C%22currentscreenwidth%22%3A%5B1600%5D%2C%22currentscreenheight%22%3A%5B1200%5D%2C%22referrerhost%22%3A%5B%22t.co%22%5D%2C%22new_visit_bc%22%3A%5B%22true%22%5D%7D%2C%22sources%22%3A%7B%22listenerinteractiontype%22%3A%5B%22language%22%2C%22currentresolution%22%2C%22currentscreenwidth%22%2C%22currentscreenheight%22%2C%22referrerhost%22%5D%2C%22newvisitlistener%22%3A%5B%22new_visit_bc%22%5D%7D%7D%2C%22requestId%22%3A%22rev_1552295161742%22%7D; BCRevision_1552295161743=%7B%22method%22%3A%22addProperties%22%2C%22param%22%3A%7B%22properties%22%3A%7B%22resolution%22%3A%5B%221600x1200%22%5D%7D%2C%22sources%22%3A%7B%22listenerinteractiontype%22%3A%5B%22resolution%22%5D%7D%7D%2C%22requestId%22%3A%22rev_1552295161743%22%7D; aiia=true
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html

Response headers

status
200
server
Apache-Coyote/1.1
content-type
text/html;charset=UTF-8
content-encoding
gzip
cache-control
max-age=14400
x-fastly-ttl
14400.000
x-fastly-stale
432000.000
via
1.1 varnish 1.1 varnish
accept-ranges
bytes
date
Mon, 11 Mar 2019 09:06:01 GMT
age
19585
x-served-by
cache-sjc3144-SJC, cache-hhn1538-HHN
x-cache
HIT, HIT
x-cache-hits
2, 1
x-timer
S1552295162.930384,VS0,VE1
vary
Accept-Encoding,Cookie
x-via-fastly
Verdad
content-length
23

Redirect headers

status
301
server
Apache-Coyote/1.1
location
/blank/template
content-encoding
gzip
content-type
text/html; charset=UTF-8
cache-control
max-age=14400
x-fastly-ttl
14400.000
x-fastly-stale
432000.000
via
1.1 varnish 1.1 varnish
accept-ranges
bytes
date
Mon, 11 Mar 2019 09:06:01 GMT
age
5153
x-served-by
cache-sjc3137-SJC, cache-hhn1538-HHN
x-cache
HIT, HIT
x-cache-hits
1, 1
x-timer
S1552295162.904346,VS0,VE1
vary
Accept-Encoding,Cookie
x-via-fastly
Verdad
content-length
20
svrGP.aspx
secure.p01.eloqua.com/visitor/v200/
Redirect Chain
  • https://secure.p01.eloqua.com/visitor/v200/svrGP.aspx?pps=70&siteid=1856&ref=https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html&ms=923
  • https://secure.p01.eloqua.com/visitor/v200/svrGP.aspx?pps=70&siteid=1856&ref=https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html&ms=923&elqCookie=1
79 B
504 B
Script
General
Full URL
https://secure.p01.eloqua.com/visitor/v200/svrGP.aspx?pps=70&siteid=1856&ref=https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html&ms=923&elqCookie=1
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
142.0.173.130 Redwood City, United States, ASN7160 (NETDYNAMICS - Oracle Corporation, US),
Reverse DNS
Software
/
Resource Hash
32b0df3e653d112a7a911f612507d48f1da42b1338d385dd2a690c5bef068e65
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;
X-Content-Type-Options nosniff

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Strict-Transport-Security
max-age=31536000;
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Date
Mon, 11 Mar 2019 09:06:02 GMT
Vary
Accept-Encoding
P3P
CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA",
Cache-Control
private,no-cache, no-store
Content-Type
application/javascript; charset=utf-8
Content-Length
104
Expires
-1

Redirect headers

Pragma
no-cache
Strict-Transport-Security
max-age=31536000;
X-Content-Type-Options
nosniff
Date
Mon, 11 Mar 2019 09:06:02 GMT
P3P
CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA",
Location
//secure.p01.eloqua.com/visitor/v200/svrGP.aspx?pps=70&siteid=1856&ref=https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html&ms=923&elqCookie=1
Cache-Control
private,no-cache, no-store
Content-Type
text/html; charset=utf-8
Content-Length
352
Expires
-1
integrator.js
adservice.google.de/adsid/
109 B
171 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.js?domain=www.csoonline.com
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:806::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:02 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
application/javascript; charset=UTF-8
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
104
x-xss-protection
1; mode=block
integrator.js
adservice.google.com/adsid/
109 B
171 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.csoonline.com
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:806::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:02 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
application/javascript; charset=UTF-8
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
104
x-xss-protection
1; mode=block
pubads_impl_318.js
securepubads.g.doubleclick.net/gpt/
159 KB
58 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_318.js
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
172.217.21.194 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s12-in-f2.1e100.net
Software
sffe /
Resource Hash
825614864dd2332974044ff99c9661f05f9500150b5f3339b683e28ed353c3bd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:02 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 07 Mar 2019 16:13:26 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
58628
x-xss-protection
1; mode=block
expires
Mon, 11 Mar 2019 09:06:02 GMT
e532e22e2682b808006d3546e2dfe2a0
idg.blueconic.net/plugin/plugin/
103 KB
23 KB
Script
General
Full URL
https://idg.blueconic.net/plugin/plugin/e532e22e2682b808006d3546e2dfe2a0
Requested by
Host: cdn.blueconic.net
URL: https://cdn.blueconic.net/idg.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.226.72.36 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-226-72-36.compute-1.amazonaws.com
Software
- /
Resource Hash
64277b6800f0d55b58762f127ae212a67a462f20eee80f84e724e4d3721c4a4e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:02 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
text/javascript; charset=utf-8
server
-
etag
e532e22e2682b808006d3546e2dfe2a0
p3p
policyref="", CP="DSP"
status
200
x-permitted-cross-domain-policies
master-only
cache-control
private, max-age=31536000
x-robots-tag
noindex, nofollow
content-length
23483
x-xss-protection
1; mode=block
expires
Tue, 10 Mar 2020 09:06:02 GMT
lai9s0WlvrPiQ5L_cdrso4RiyfzVoZU9LvwlSHiKGRQVkAx4Mo_dqdkpNFmmgSH8bT1NgI68uTYHqQUTmjN
spiffymachine.com/v2/0/
174 KB
53 KB
Script
General
Full URL
https://spiffymachine.com/v2/0/lai9s0WlvrPiQ5L_cdrso4RiyfzVoZU9LvwlSHiKGRQVkAx4Mo_dqdkpNFmmgSH8bT1NgI68uTYHqQUTmjN
Requested by
Host: spiffymachine.com
URL: https://spiffymachine.com/v2/0/cyd3Vkrqtd-ClWmwn4oT2UgRVFzxMujpGSwHmogdm3LpvfSUBhItArin36Z82cfR8fnYg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.201.98.64 Ann Arbor, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
64.98.201.35.bc.googleusercontent.com
Software
/
Resource Hash
25a3412ecf9482a74c0db805a854815112cb943f5f6b87494de825c30e19e41c

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Origin
https://www.csoonline.com

Response headers

date
Mon, 11 Mar 2019 09:06:02 GMT
content-encoding
gzip
x-datacenter
gce-europe-west3
etag
df2eb6e9942d062122a0a4584c3eb570cd9784b6195e13366da8da901621bb49
vary
Accept-Encoding
access-control-allow-methods
POST, OPTIONS
content-type
application/javascript
status
200
cache-control
private, must-revalidate, max-age=21600
access-control-allow-credentials
true
access-control-allow-headers
DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Cookie
x-hostname
claire
timing-allow-origin
*
access-control-allow-origin
*
4118f513af2b31bb142a85eaf4739f5b
idg.blueconic.net/plugin/library/
274 KB
82 KB
Script
General
Full URL
https://idg.blueconic.net/plugin/library/4118f513af2b31bb142a85eaf4739f5b
Requested by
Host: cdn.blueconic.net
URL: https://cdn.blueconic.net/idg.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.226.72.36 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-226-72-36.compute-1.amazonaws.com
Software
- /
Resource Hash
f18332dc9ef7ad7797c980a92ed2fd2293f14045450f82bf48680dbc1f6c5cbe
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:02 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
text/javascript; charset=utf-8
server
-
etag
4118f513af2b31bb142a85eaf4739f5b
p3p
policyref="", CP="DSP"
status
200
x-permitted-cross-domain-policies
master-only
cache-control
private, max-age=31536000
x-robots-tag
noindex, nofollow
content-length
83089
x-xss-protection
1; mode=block
expires
Tue, 10 Mar 2020 09:06:02 GMT
LB-Zone-2
idg.blueconic.net/DG/DEFAULT/rest/rpc/json/
1 KB
1 KB
XHR
General
Full URL
https://idg.blueconic.net/DG/DEFAULT/rest/rpc/json/LB-Zone-2?referer=https%3A%2F%2Fwww.csoonline.com%2Farticle%2F3345972%2Fqbot-malware-resurfaces-in-new-attack-against-businesses.html&bcsessionid=&bctempid=ab2aa214-1123-4528-89b9-b7f7f5202bea&overruleReferrer=&time=2019-03-11T09%3A06%3A02%2B00%3A00&ts=1552295162423
Requested by
Host: cdn.blueconic.net
URL: https://cdn.blueconic.net/idg.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.226.72.36 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-226-72-36.compute-1.amazonaws.com
Software
- /
Resource Hash
3b267b550e32a9af68b9fb141e21b0e8b8c754bec523bb5c84b1192f0566a389
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Origin
https://www.csoonline.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
text/plain

Response headers

date
Mon, 11 Mar 2019 09:06:02 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-permitted-cross-domain-policies
master-only
p3p
policyref="", CP="DSP"
status
200
content-length
591
x-xss-protection
1; mode=block
pragma
no-cache
server
-
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.csoonline.com
cache-control
no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials
true
x-robots-tag
noindex, nofollow
expires
Thu, 01 Jan 1970 00:00:00 GMT
svrGP.aspx
secure.p01.eloqua.com/visitor/v200/ Frame C464
0
0
Document
General
Full URL
https://secure.p01.eloqua.com/visitor/v200/svrGP.aspx?pps=31&siteid=1856&ref=https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html?article=security%26security=03-11-2019&ref2=https%3A//t.co/aHrXW7ESH9&tzo=0&ms=517
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/www/js/analytics/eloqua/elqFCS.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
142.0.173.130 Redwood City, United States, ASN7160 (NETDYNAMICS - Oracle Corporation, US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;
X-Content-Type-Options nosniff

Request headers

Host
secure.p01.eloqua.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Accept-Encoding
gzip, deflate, br
Cookie
ELOQUA=GUID=60638FE03172446D85A5DF8EFE5DE044; ELQSTATUS=OK
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html

Response headers

Cache-Control
private,no-cache, no-store
Pragma
no-cache
Content-Type
text/html; charset=utf-8
Content-Encoding
gzip
Expires
-1
Vary
Accept-Encoding
P3P
CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA",
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000;
Date
Mon, 11 Mar 2019 09:06:03 GMT
Content-Length
82
gtm.js
www.googletagmanager.com/
121 KB
34 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-WR6LD2P
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:808::2008 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Google Tag Manager (scaffolding) /
Resource Hash
f3f5ffdec8df4dfa69ca6dd3d9a5b21f6d3df554cf782aedce5b904db53b72c4
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:02 GMT
content-encoding
br
last-modified
Fri, 08 Mar 2019 15:38:34 GMT
server
Google Tag Manager (scaffolding)
access-control-allow-origin
http://www.googletagmanager.com
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
status
200
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
content-length
34262
x-xss-protection
1; mode=block
expires
Mon, 11 Mar 2019 09:06:02 GMT
f5b3be27-f789-4ef1-8867-37c67da5b361-web.js
cdn.permutive.com/
307 KB
63 KB
Script
General
Full URL
https://cdn.permutive.com/f5b3be27-f789-4ef1-8867-37c67da5b361-web.js
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/www/js/jquery/jquery-1.10.2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.190.75.210 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
210.75.190.35.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
097c45e6c3b4abc30becb9f129283c3450b0f58e6a40568f325da275ffd8e913

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:04:25 GMT
content-encoding
gzip
age
97
status
200
x-guploader-uploadid
AEnB2Uqt8F7xN3_XZrXR5Ymdev5qJn2SYP5rhblJKC-92zp8rijkvfX5y9ZZ5RcFDTTJ9GyqPJPrzuyYa41j38Te-cBwH8g1tw
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
1
x-goog-stored-content-encoding
gzip
alt-svc
clear
content-length
64108
last-modified
Thu, 07 Mar 2019 13:06:53 GMT
server
UploadServer
etag
"eef42404f6d372769c0dc6fe155930f1"
vary
Accept-Encoding
x-goog-hash
crc32c=ayI3mg==, md5=7vQkBPbTcnacDcb+FVkw8Q==
x-goog-generation
1551964013847006
cache-control
max-age=300, public
x-goog-stored-content-length
64108
accept-ranges
bytes
content-type
application/javascript
expires
Mon, 11 Mar 2019 09:09:25 GMT
cso-logo-idg.svg
idge.staticworld.net/cso/
4 KB
4 KB
Image
General
Full URL
https://idge.staticworld.net/cso/cso-logo-idg.svg
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
ef7755857c07a98436dce7c81f0071da4925b63aa320f6a600eafdc08d620f5f

Request headers

Referer
https://www.csoonline.com/www.idge.cso/css/inline-header.css?v=20190307113302
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-amz-version-id
oZFBpEq1ZhNl2KLvmAO7EkSd4kjPfufK
via
1.1 varnish, 1.1 varnish
age
3177
x-cache
HIT, HIT
status
200
date
Mon, 11 Mar 2019 09:06:02 GMT
content-length
3923
x-amz-id-2
pKIaUFYPGH0pSzislJQraW5d9RCm92MtJWpEWMZ7cx+ISaQV7kqQT5qRVk3nPFWtv7Kf/ixlW/A=
x-served-by
cache-jfk8120-JFK, cache-hhn1538-HHN
last-modified
Tue, 27 Mar 2018 00:09:02 GMT
server
AmazonS3
x-timer
S1552295163.568065,VS0,VS0,VE0
etag
"52e975d0aa09163968fbd12cf29e4088"
x-amz-request-id
E2A45E3DD9BB41D1
accept-ranges
bytes
content-type
image/svg+xml
x-cache-hits
3, 1
insider-logo-updated.svg
idge.staticworld.net/images/
3 KB
3 KB
Image
General
Full URL
https://idge.staticworld.net/images/insider-logo-updated.svg
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
90e7f8120f6d2e856e3a487abe2551c75bea54bee192a5a9b8afa4a0216eefa6

Request headers

Referer
https://www.csoonline.com/www.idge/css/inline-header-mobile.css?v=20190307113302
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-amz-version-id
CqyWtbm.VH6O14ZU_g_VPqkHhNPzIAa5
via
1.1 varnish, 1.1 varnish
age
1354
x-cache
HIT, HIT
status
200
date
Mon, 11 Mar 2019 09:06:02 GMT
content-length
3102
x-amz-id-2
+x+wbxhxXgZqAJTP2l+1NUIEWqQC1k8n0++uxcIvEYTscG95Vm/YfPNbN4MkleG9Lv8ofuVN2ow=
x-served-by
cache-jfk8137-JFK, cache-hhn1538-HHN
last-modified
Tue, 27 Mar 2018 00:10:09 GMT
server
AmazonS3
x-timer
S1552295163.568009,VS0,VS0,VE0
etag
"6f2e6c9e8e4cba254e168d6355376522"
x-amz-request-id
58CD8F68193BE161
accept-ranges
bytes
content-type
image/svg+xml
x-cache-hits
2, 4
1e9931ac822394ca58763bb9c2b176c55b16fb81-l.woff2
fonts.staticworld.net/k/
23 KB
23 KB
Font
General
Full URL
https://fonts.staticworld.net/k/1e9931ac822394ca58763bb9c2b176c55b16fb81-l.woff2
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
ef756e21b4660483b0d200e15873d899d783fc49abccebcf5d2ebc5d7e6f8e31

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Origin
https://www.csoonline.com

Response headers

date
Mon, 11 Mar 2019 09:06:02 GMT
via
1.1 varnish
server
nginx
age
382910
x-cache
HIT
content-type
application/font-woff2
status
200
cache-control
public, max-age=604800
x-cache-hits
1
accept-ranges
bytes
x-timer
S1552295163.614770,VS0,VE0
access-control-allow-origin
*
content-length
23704
x-served-by
cache-hhn1525-HHN
11d2ee7f5263f1d47690006c1c14df1ec3ec3232-l.woff2
fonts.staticworld.net/k/
23 KB
23 KB
Font
General
Full URL
https://fonts.staticworld.net/k/11d2ee7f5263f1d47690006c1c14df1ec3ec3232-l.woff2
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
dfd9e061f289eeaf739ed0e3f756905b4c61dfb2403c1a5c8feb47134aa43dad

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Origin
https://www.csoonline.com

Response headers

date
Mon, 11 Mar 2019 09:06:02 GMT
via
1.1 varnish
server
nginx
age
274810
x-cache
HIT
content-type
application/font-woff2
status
200
cache-control
public, max-age=604800
x-cache-hits
1
accept-ranges
bytes
x-timer
S1552295163.614826,VS0,VE0
access-control-allow-origin
*
content-length
23500
x-served-by
cache-hhn1525-HHN
ss-standard.woff
www.csoonline.com/www.idge/css/webfonts/
26 KB
27 KB
Font
General
Full URL
https://www.csoonline.com/www.idge/css/webfonts/ss-standard.woff
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
d2aae940b6d023c99cbd656bbd0868f51bcf4a93455efef42cc95d8a4c7bceca

Request headers

:path
/www.idge/css/webfonts/ss-standard.woff
pragma
no-cache
cookie
last_visit_bc=1552295161738; aiia=true; BCTempID=ab2aa214-1123-4528-89b9-b7f7f5202bea; BCZoneID=LB-Zone-2
origin
https://www.csoonline.com
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.csoonline.com
referer
https://www.csoonline.com/www.idge/css/webfonts/ss-standard.css
:scheme
https
:method
GET
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.csoonline.com/www.idge/css/webfonts/ss-standard.css
Origin
https://www.csoonline.com

Response headers

date
Mon, 11 Mar 2019 09:06:02 GMT
content-encoding
gzip
age
6443
x-cache
HIT, HIT
status
200
content-length
27058
x-via-fastly
Verdad
x-served-by
cache-sjc3143-SJC, cache-hhn1538-HHN
last-modified
Thu, 07 Mar 2019 19:28:48 GMT
server
Apache-Coyote/1.1
x-timer
S1552295163.568040,VS0,VE1
etag
W/"27096-1551986928000"
vary
Accept-Encoding,Cookie
content-type
font/woff
via
1.1 varnish 1.1 varnish
accept-ranges
bytes
x-cache-hits
45, 1
ss-social-circle.woff
www.csoonline.com/www.idge/css/webfonts/
10 KB
10 KB
Font
General
Full URL
https://www.csoonline.com/www.idge/css/webfonts/ss-social-circle.woff
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
8982bee74ee4a24031eea6ffe2cf2a3a41b3eee01490dfb4b8a641ef69dc923f

Request headers

:path
/www.idge/css/webfonts/ss-social-circle.woff
pragma
no-cache
cookie
last_visit_bc=1552295161738; aiia=true; BCTempID=ab2aa214-1123-4528-89b9-b7f7f5202bea; BCZoneID=LB-Zone-2
origin
https://www.csoonline.com
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.csoonline.com
referer
https://www.csoonline.com/www.idge/css/webfonts/ss-social.css
:scheme
https
:method
GET
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.csoonline.com/www.idge/css/webfonts/ss-social.css
Origin
https://www.csoonline.com

Response headers

date
Mon, 11 Mar 2019 09:06:02 GMT
content-encoding
gzip
age
3338
x-cache
HIT, HIT
status
200
content-length
9695
x-via-fastly
Verdad
x-served-by
cache-sjc3135-SJC, cache-hhn1538-HHN
last-modified
Thu, 07 Mar 2019 19:28:48 GMT
server
Apache-Coyote/1.1
x-timer
S1552295163.568092,VS0,VE0
etag
W/"9732-1551986928000"
vary
Accept-Encoding,Cookie
content-type
font/woff
via
1.1 varnish 1.1 varnish
accept-ranges
bytes
x-cache-hits
1, 1
recaptcha__en.js
www.gstatic.com/recaptcha/api2/v1551681158638/
260 KB
90 KB
Script
General
Full URL
https://www.gstatic.com/recaptcha/api2/v1551681158638/recaptcha__en.js
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:81f::2003 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
224188bb6dab42ea7cdaf59b0476e84c06ba69efbbc8c469c9d1bd5df2d5e730
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Fri, 08 Mar 2019 22:58:16 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 06 Mar 2019 20:15:00 GMT
server
sffe
age
209266
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=31536000
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
92290
x-xss-protection
1; mode=block
expires
Sat, 07 Mar 2020 22:58:16 GMT
t
jadserve.postrelease.com/
3 KB
1 KB
Script
General
Full URL
https://jadserve.postrelease.com/t?ntv_url=https%3A%2F%2Fwww.csoonline.com%2Farticle%2F3345972%2Fqbot-malware-resurfaces-in-new-attack-against-businesses.html&prx_referrer=https%3A%2F%2Ft.co%2FaHrXW7ESH9
Requested by
Host: s.ntv.io
URL: https://s.ntv.io/serve/load.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.19.153.98 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-19-153-98.eu-west-1.compute.amazonaws.com
Software
nginx/1.12.1 /
Resource Hash
36e9076022a724a5bcf6b84d8c16c64ba4673ce1e0ac662d8b1bd776c3e645af

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 11 Mar 2019 09:06:02 GMT
content-encoding
gzip
server
nginx/1.12.1
access-control-allow-origin
*
p3p
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-type
text/javascript;charset=UTF-8
content-length
976
expires
Mon, 1 Jan 1990 12:00:00 GMT
gtm.js
www.googletagmanager.com/
104 KB
30 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-5WC9SK&l=dataLayer
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WR6LD2P
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:808::2008 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Google Tag Manager (scaffolding) /
Resource Hash
62ef2ee49141f627e08df7685328ee8bcd658111520a0c465599c253be20bf29
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:02 GMT
content-encoding
br
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
server
Google Tag Manager (scaffolding)
access-control-allow-origin
http://www.googletagmanager.com
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
status
200
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
content-length
30515
x-xss-protection
1; mode=block
expires
Mon, 11 Mar 2019 09:06:02 GMT
api.js
w.soundcloud.com/player/
5 KB
3 KB
Script
General
Full URL
https://w.soundcloud.com/player/api.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WR6LD2P
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.214.66 Wilmington, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-143-204-214-66.fra53.r.cloudfront.net
Software
am/2 /
Resource Hash
78d83d68ccf7a24aca085486bfc291760424279b6f5308092af4fe600b9d1e19

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 11 Mar 2019 09:02:32 GMT
Via
sssr, 1.1 f960fa0538fdb326fc338e984fa7ece9.cloudfront.net (CloudFront)
Last-Modified
Fri, 01 Mar 2019 09:48:29 GMT
Server
am/2
Age
210
P3P
policyref="https://w.soundcloud.com/player/w3c/p3p.xml", CP="NON DSP COR CUR ADM DEV TAI PSAo PSDo OUR STP CNT"
ETag
W/"1298-1751308584"
Transfer-Encoding
chunked
X-Cache
Hit from cloudfront
Content-Type
application/javascript
Cache-Control
public, max-age=300
Connection
keep-alive
Accept-Ranges
bytes
Content-Encoding
gzip
X-Amz-Cf-Id
tDyU-Dxq9tzvsfeLf162rF1c2hzWptGLkaaH6phA3wP7807Uorlm0Q==
cso-module-bg.png
idge.staticworld.net/cso/
981 B
1 KB
Image
General
Full URL
https://idge.staticworld.net/cso/cso-module-bg.png
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
333218e3819ed86435d75ec897ccc3620cb61010ce3cfc8c74c0ade22d942f7d

Request headers

Referer
https://www.csoonline.com/www.idge.cso/css/article.css?v=20190307113302
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-amz-version-id
bM5PMw.kY7V.W2_0hz9tioNDUD2ZLdP2
via
1.1 varnish, 1.1 varnish
age
2536676
x-cache
HIT, HIT
status
200
date
Mon, 11 Mar 2019 09:06:02 GMT
content-length
981
x-amz-id-2
PYuIxZn7Goqc5MrFLbIrV/pyqpFbJBLarOusTIF5574T3sTBG9tWZ9THXhxyIJmPDuMzNMpA/fE=
x-served-by
cache-jfk8140-JFK, cache-hhn1538-HHN
last-modified
Tue, 27 Mar 2018 00:09:02 GMT
server
AmazonS3
x-timer
S1552295163.688901,VS0,VS0,VE0
etag
"eda3be2ef21c85f54e5bb057f7bdcbe3"
x-amz-request-id
9AD08276A506E95E
cache-control
public, max-age=2592000
accept-ranges
bytes
content-type
image/png
x-cache-hits
1, 1
widget_init
api.ziprecruiter.com/jobs/v1/
295 B
371 B
Script
General
Full URL
https://api.ziprecruiter.com/jobs/v1/widget_init?widget_version=v1&widget_type=mini&options=%7B%22results_per_page%22%3A8%2C%22container%22%3A%22zipsearch_container%22%2C%22search%22%3A%22CISO%22%2C%22radius_miles%22%3A%2250%22%7D&api_key=amr5nu9xbyudq565nqy55c8jbkufmjuj&callback=jsonp720552
Requested by
Host: www.ziprecruiter.com
URL: https://www.ziprecruiter.com/jobs-widget/mini/v1/amr5nu9xbyudq565nqy55c8jbkufmjuj
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:b1be , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
deda424c41a841e454faa598ed300ed300178ba319274cf28e39b3c79332ea22
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:02 GMT
content-encoding
br
server
cloudflare
access-control-allow-origin
*
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000
access-control-allow-methods
GET, POST
content-type
application/javascript; charset=utf-8
status
200
cf-ray
4b5c5ebefa2cbefd-FRA
access-control-allow-headers
X-Requested-With
truncated
/
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
9d02d662da8a47fb5fb610b545007507b6017028043dbb63cd09ec897d3b9627

Request headers

Response headers

Content-Type
image/png
truncated
/
715 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5a3f1dd74233f605e511f1b5b244bedf85ac88ba264caf4d6401bc7ec2017dcd

Request headers

Response headers

Content-Type
image/png
truncated
/
178 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
3ee0806e69f2ae70a2267a58ac5fc5d52b5aa7aca6f3c0c08adad605fd8fbc16

Request headers

Response headers

Content-Type
image/svg+xml
truncated
/
352 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5f3592a8b8037ea064764a2815799612063c6722d314d1d66d3a9391c3c16d66

Request headers

Response headers

Content-Type
image/svg+xml
truncated
/
299 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
a3d5b21692435e785aa0e698356735093bb93f6c2f61410c49761ee2448f7289

Request headers

Response headers

Content-Type
image/svg+xml
truncated
/
243 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
9d2d8043c302d3a9da9277374a53e2285c471d5dc8397885b4931b82771d5cae

Request headers

Response headers

Content-Type
image/svg+xml
truncated
/
381 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
63271dcce1a2518271ecc2b0bdcc5afc9c5f0968a8635e0f97a4c9747309eb82

Request headers

Response headers

Content-Type
image/svg+xml
ss-social-regular.woff
www.csoonline.com/www.idge/css/webfonts/
16 KB
17 KB
Font
General
Full URL
https://www.csoonline.com/www.idge/css/webfonts/ss-social-regular.woff
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
3d5629a5cbadabfd67e7c99b9e71569f356ebf7fddabd5b3c24e37b49a48c605

Request headers

:path
/www.idge/css/webfonts/ss-social-regular.woff
pragma
no-cache
cookie
last_visit_bc=1552295161738; aiia=true; BCSessionID=ab2aa214-1123-4528-89b9-b7f7f5202bea; inSession=true; firstSessionDate=Mon, 11 Mar 2019 09:06:02 GMT; currentSessionDate=Mon, 11 Mar 2019 09:06:02 GMT; sessionNumber=1; lastSessionDate=Mon, 11 Mar 2019 09:06:02 GMT
origin
https://www.csoonline.com
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.csoonline.com
referer
https://www.csoonline.com/www.idge/css/webfonts/ss-social.css
:scheme
https
:method
GET
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.csoonline.com/www.idge/css/webfonts/ss-social.css
Origin
https://www.csoonline.com

Response headers

date
Mon, 11 Mar 2019 09:06:02 GMT
content-encoding
gzip
age
8463
x-cache
HIT, HIT
status
200
content-length
16793
x-via-fastly
Verdad
x-served-by
cache-sjc3121-SJC, cache-hhn1538-HHN
last-modified
Thu, 07 Mar 2019 19:28:48 GMT
server
Apache-Coyote/1.1
x-timer
S1552295163.838637,VS0,VE0
etag
W/"16804-1551986928000"
vary
Accept-Encoding,Cookie
content-type
font/woff
via
1.1 varnish 1.1 varnish
accept-ranges
bytes
x-cache-hits
5, 1
ttj
ib.3lift.com/
4 KB
2 KB
Script
General
Full URL
https://ib.3lift.com/ttj?inv_code=tan_CSOOnline_MOAP
Requested by
Host: t.co
URL: https://t.co/aHrXW7ESH9
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.214.36 Wilmington, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-143-204-214-36.fra53.r.cloudfront.net
Software
/
Resource Hash
145c052ae99fd431a6cc07d78e77785e7f75a49371db90c2216d4e45bbb84d09

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Sat, 9 Mar 2019 20:52:24 GMT
Content-Encoding
gzip
ETag
"57502c3ed367f75e177d2bd920935006"
X-Cache
Hit from cloudfront
Content-Type
application/javascript; charset=utf-8
Via
1.1 c5c25772c7f14e267596e0f8ce51d9bc.cloudfront.net (CloudFront)
Cache-Control
public, max-age=900
Connection
keep-alive
Content-Length
1713
X-Amz-Cf-Id
947vQzZ5udBnhSbGuZyDxVHM1N5NhKYOQHhzCQudwH8gGHTBH9_NFA==
trk.gif
jadserve.postrelease.com/
43 B
339 B
Image
General
Full URL
https://jadserve.postrelease.com/trk.gif?ntv_ui=d59b13b7-0852-4920-9ff9-a80c91aa71f1&ntv_fl=Js-9sgkIMAcneH5bOKp6X9uWqFUFyflRK83NhSSTeR4=&ntv_ht=-iSGXAA&ntv_at=303,302&ntv_a=AAAAAAAAAAYwIMA&ord=1552295162847&ntv_dpl=1011,1016,1001,1019,1005,1006,1007&prx_referrer=https%3A%2F%2Ft.co%2FaHrXW7ESH9&ntv_it
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.19.153.98 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-19-153-98.eu-west-1.compute.amazonaws.com
Software
nginx/1.12.1 /
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 11 Mar 2019 09:06:02 GMT
server
nginx/1.12.1
access-control-allow-origin
*
p3p
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-type
image/gif
content-length
43
expires
Mon, 1 Jan 1990 12:00:00 GMT
trk.gif
jadserve.postrelease.com/
43 B
339 B
Image
General
Full URL
https://jadserve.postrelease.com/trk.gif?ntv_ui=d59b13b7-0852-4920-9ff9-a80c91aa71f1&ntv_fl=Js-9sgkIMAcneH5bOKp6X9uWqFUFyflRK83NhSSTeR4=&ntv_ht=-iSGXAA&ntv_at=321,322,333,323&ntv_a=AAAAAAAAAAYwIMA&ntv_jlt=6&ntv_jad=241&ntv_jte=1065&ntv_jtr=3
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.19.153.98 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-19-153-98.eu-west-1.compute.amazonaws.com
Software
nginx/1.12.1 /
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 11 Mar 2019 09:06:02 GMT
server
nginx/1.12.1
access-control-allow-origin
*
p3p
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-type
image/gif
content-length
43
expires
Mon, 1 Jan 1990 12:00:00 GMT
trk.gif
jadserve.postrelease.com/
43 B
339 B
Image
General
Full URL
https://jadserve.postrelease.com/trk.gif?ntv_ui=d59b13b7-0852-4920-9ff9-a80c91aa71f1&ntv_fl=Js-9sgkIMAcneH5bOKp6X9uWqFUFyflRK83NhSSTeR4=&ntv_ht=-iSGXAA&ntv_at=806&ntv_a=AAAAAAAAAAYwIMA&ntv_sat=5&ord=1552295162852&prx_referrer=https%3A%2F%2Ft.co%2FaHrXW7ESH9&ntv_it
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.19.153.98 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-19-153-98.eu-west-1.compute.amazonaws.com
Software
nginx/1.12.1 /
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 11 Mar 2019 09:06:02 GMT
server
nginx/1.12.1
access-control-allow-origin
*
p3p
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-type
image/gif
content-length
43
expires
Mon, 1 Jan 1990 12:00:00 GMT
outbrain.js
widgets.outbrain.com/
110 KB
39 KB
Script
General
Full URL
https://widgets.outbrain.com/outbrain.js?_=1552295161680
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/www/js/jquery/jquery-1.10.2.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.211.2.209 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-211-2-209.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
f9c96666149eee7854565396eafd702e0aa3cfa26f7c0f889517fa01e8ce2398

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 11 Mar 2019 09:06:02 GMT
Content-Encoding
gzip
Last-Modified
Thu, 07 Mar 2019 11:35:18 GMT
Server
Apache
ETag
"e8bf17df4ebddfba940fd6e0f2fd619b:1551958518"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET,POST
Content-Type
application/x-javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=604800
Access-Control-Allow-Credentials
false
Connection
keep-alive
Accept-Ranges
bytes
Timing-Allow-Origin
*
Content-Length
39139
rid
match.adsrvr.org/track/
109 B
526 B
XHR
General
Full URL
https://match.adsrvr.org/track/rid?ttd_pid=casale&fmt=json&p=187051
Requested by
Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/187051-261008049474226.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.18.226.220 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-18-226-220.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
5d636559a5278d540eb8ffd94f40e46f639346f2e30d247e8971e825b6620c54

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Origin
https://www.csoonline.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

date
Mon, 11 Mar 2019 09:06:02 GMT
x-aspnet-version
4.0.30319
status
200
vary
Origin
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.csoonline.com
cache-control
private
access-control-allow-credentials
true
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length
109
expires
Wed, 10 Apr 2019 09:06:02 GMT
53bda1f76f9c39acaa206f8f94dedecab98fb76d-l.woff2
fonts.staticworld.net/k/
24 KB
24 KB
Font
General
Full URL
https://fonts.staticworld.net/k/53bda1f76f9c39acaa206f8f94dedecab98fb76d-l.woff2
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
ed4b59c842945fa6d990f7d9a750c87a92f7ba60f7f19f8d18af145853c35c1a

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Origin
https://www.csoonline.com

Response headers

date
Mon, 11 Mar 2019 09:06:02 GMT
via
1.1 varnish
server
nginx
age
581865
x-cache
HIT
content-type
application/font-woff2
status
200
cache-control
public, max-age=604800
x-cache-hits
4
accept-ranges
bytes
x-timer
S1552295163.905579,VS0,VE0
access-control-allow-origin
*
content-length
24568
x-served-by
cache-hhn1525-HHN
v1
api.ziprecruiter.com/jobs/
7 KB
4 KB
Script
General
Full URL
https://api.ziprecruiter.com/jobs/v1?search=CISO&location=Frankfurt%20am%20Main%2C%20Hesse&radius_miles=50&days_ago=&jobs_per_page=5&page=1&format=mini&widget_version=v1&widget_event_log_id=e527603c-43dc-11e9-99c3-06586a2da610&non_interaction=1&alerts_api_key=&api_key=amr5nu9xbyudq565nqy55c8jbkufmjuj&callback=jsonp77789
Requested by
Host: www.ziprecruiter.com
URL: https://www.ziprecruiter.com/jobs-widget/mini/v1/amr5nu9xbyudq565nqy55c8jbkufmjuj
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:b1be , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
39b814cfd9bbc4a9430a668eba8e0d740c6d96afd5b240f8080cbd48ea103472
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:03 GMT
content-encoding
br
server
cloudflare
access-control-allow-origin
*
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000
access-control-allow-methods
GET, POST
content-type
application/javascript; charset=utf-8
status
200
x-rate-limiting-active
1
x-rate-was-limited
0
cf-ray
4b5c5ec07ce2befd-FRA
access-control-allow-headers
X-Requested-With
ziprecruiter-logo-200px.png
www.ziprecruiter.com/img/
2 KB
2 KB
Image
General
Full URL
https://www.ziprecruiter.com/img/ziprecruiter-logo-200px.png
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:b1be , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
68251443dc2470c880d1693ad765c1596328187f88cd6fb3e4df215ff82b165e
Security Headers
Name Value
Strict-Transport-Security max-age=15552000
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:02 GMT
cf-cache-status
HIT
cf-polished
origFmt=png, origSize=2720
status
200
content-disposition
inline; filename="ziprecruiter-logo-200px.webp"
strict-transport-security
max-age=15552000
content-length
1742
last-modified
Fri, 08 Mar 2019 02:57:27 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"5c81da17-aa0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
content-type
image/webp
accept-ranges
bytes
cf-ray
4b5c5ec07ce5befd-FRA
cf-bgj
imgq:85
pub.531979.min.js
www.dwin2.com/
197 KB
58 KB
Script
General
Full URL
https://www.dwin2.com/pub.531979.min.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5WC9SK&l=dataLayer
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.110 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
e4f6b157a82a75e1553a63fa88f1369badef61c08a2f4288cefed3fd885c7d9d

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:02 GMT
content-encoding
gzip
age
5565
x-cache
HIT, HIT
status
200
content-length
59072
x-served-by
cache-lcy19246-LCY, cache-hhn1524-HHN
last-modified
Mon, 11 Mar 2019 04:07:14 GMT
server
nginx
x-timer
S1552295163.994063,VS0,VE0
etag
"5c85def2-e6c0"
vary
Accept-Encoding
content-type
application/javascript
via
1.1 varnish, 1.1 varnish
expires
Mon, 11 Mar 2019 08:33:17 GMT
cache-control
max-age=3600
accept-ranges
bytes
x-cache-hits
25, 29
bundle.js
ib.3lift.com/rev/4833279baf8156b5abdae577f01065e6641b1d90/dist/
148 KB
51 KB
Script
General
Full URL
https://ib.3lift.com/rev/4833279baf8156b5abdae577f01065e6641b1d90/dist/bundle.js
Requested by
Host: ib.3lift.com
URL: https://ib.3lift.com/ttj?inv_code=tan_CSOOnline_MOAP
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.214.36 Wilmington, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-143-204-214-36.fra53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
428109164f44a354f7909a9dff4245e232d1dfb7397a4ed35dab62580412968a

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 20 Feb 2019 18:17:23 GMT
Content-Encoding
gzip
Last-Modified
Wed, 20 Feb 2019 18:16:33 GMT
Server
AmazonS3
Age
1608521
ETag
"3a3a9d3a0bdc2c25c2804b5a243963bc"
X-Cache
Hit from cloudfront
Content-Type
text/javascript
Via
1.1 c5c25772c7f14e267596e0f8ce51d9bc.cloudfront.net (CloudFront)
Cache-Control
max-age=31536000, immutable
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
51727
X-Amz-Cf-Id
ad6VTUhSP_DTSrxNvAcr0gwWVI6fhLfVv-0DStyu24PNlWTbXv_EmA==
d3d3LmNzb29ubGluZS5jb20=
tcheck.outbrainimg.com/tcheck/check/
16 B
476 B
XHR
General
Full URL
https://tcheck.outbrainimg.com/tcheck/check/d3d3LmNzb29ubGluZS5jb20=
Requested by
Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js?_=1552295161680
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.70.82 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-70-82.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
929701ed632814943e3df803ddd9e3f179ccf889c0ad7b7f3392bd8d109b174f
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains;

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Origin
https://www.csoonline.com

Response headers

Strict-Transport-Security
max-age=0; includeSubDomains;
ETag
W/"10-us8lSJutAxKqLzf8c1+n5XstcwY"
Access-Control-Max-Age
43200
Access-Control-Allow-Methods
GET,POST
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=4882
Date
Mon, 11 Mar 2019 09:06:03 GMT
Connection
keep-alive
Access-Control-Allow-Credentials
false
Content-Length
16
Expires
Mon, 11 Mar 2019 10:27:25 GMT
init.js
www.dwin2.com/
55 B
259 B
Script
General
Full URL
https://www.dwin2.com/init.js?t=1552295163107
Requested by
Host: www.dwin2.com
URL: https://www.dwin2.com/pub.531979.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.110 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
b9b7a6409fe8b5947364399f4945e658f388f58012d739f4ce91f5ba834f80e2

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:03 GMT
content-encoding
gzip
age
813
x-cache
HIT, HIT
status
200
content-length
73
x-served-by
cache-lcy19245-LCY, cache-hhn1524-HHN
last-modified
Thu, 07 Mar 2019 14:14:33 GMT
server
nginx
x-timer
S1552295163.342467,VS0,VE0
etag
"5c812749-37"
vary
Accept-Encoding
content-type
application/javascript
via
1.1 varnish, 1.1 varnish
expires
Thu, 07 Mar 2019 15:18:35 GMT
cache-control
max-age=3600
accept-ranges
bytes
x-cache-hits
188, 46
dwce_cheq_events
log.outbrainimg.com/loggerServices/
4 B
299 B
XHR
General
Full URL
https://log.outbrainimg.com/loggerServices/dwce_cheq_events?timestamp=1552295163350&sessionId=b41f65c5-8897-65ec-4b4c-230bbabe97d3&url=www.csoonline.com&cheqEvent=0&exitReason=2
Requested by
Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js?_=1552295161680
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
50.31.142.51 Chicago, United States, ASN22075 (AS-OUTBRAIN - Outbrain, Inc., US),
Reverse DNS
chi.outbrain.com
Software
/
Resource Hash
b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Origin
https://www.csoonline.com

Response headers

Pragma
no-cache
Date
Mon, 11 Mar 2019 09:06:03 GMT
Access-Control-Allow-Methods
GET,POST
Content-Type
application/json; charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
no-cache, no-store, must-revalidate
Connection
close
Content-Length
4
Expires
0
beacon.js
sb.scorecardresearch.com/
1 KB
1 KB
Script
General
Full URL
https://sb.scorecardresearch.com/beacon.js
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.162.235 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-162-235.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
76c393f564f53c19e795307e622edc8657a603f7a816c2646385697286d11313

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 11 Mar 2019 09:06:03 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
private, no-transform, max-age=86400
Connection
keep-alive
Content-Length
902
Expires
Tue, 12 Mar 2019 09:06:03 GMT
pippio.min.js
storage.googleapis.com/cdn.pippio.com/sdk/
0
0
Script
General
Full URL
https://storage.googleapis.com/cdn.pippio.com/sdk/pippio.min.js
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:81b::2010 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

json
idg.blueconic.net/DG/DEFAULT/rest/rpc/
2 KB
1 KB
XHR
General
Full URL
https://idg.blueconic.net/DG/DEFAULT/rest/rpc/json?referer=https%3A%2F%2Fwww.csoonline.com%2Farticle%2F3345972%2Fqbot-malware-resurfaces-in-new-attack-against-businesses.html&bcsessionid=ab2aa214-1123-4528-89b9-b7f7f5202bea&bctempid=&overruleReferrer=&time=2019-03-11T09%3A06%3A03%2B00%3A00&ts=1552295163452
Requested by
Host: cdn.blueconic.net
URL: https://cdn.blueconic.net/idg.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.226.72.36 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-226-72-36.compute-1.amazonaws.com
Software
- /
Resource Hash
e728da52df03a40b8e3dc28fefa9da7364147cbf05bf3e8ddb449909bd374d0f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Origin
https://www.csoonline.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
text/plain

Response headers

date
Mon, 11 Mar 2019 09:06:03 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-permitted-cross-domain-policies
master-only
p3p
policyref="", CP="DSP"
status
200
content-length
853
x-xss-protection
1; mode=block
pragma
no-cache
server
-
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.csoonline.com
cache-control
no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials
true
x-robots-tag
noindex, nofollow
expires
Thu, 01 Jan 1970 00:00:00 GMT
json
idg.blueconic.net/DG/DEFAULT/rest/rpc/
2 KB
1 KB
XHR
General
Full URL
https://idg.blueconic.net/DG/DEFAULT/rest/rpc/json?referer=https%3A%2F%2Fwww.csoonline.com%2Farticle%2F3345972%2Fqbot-malware-resurfaces-in-new-attack-against-businesses.html&bcsessionid=ab2aa214-1123-4528-89b9-b7f7f5202bea&bctempid=&overruleReferrer=&time=2019-03-11T09%3A06%3A03%2B00%3A00&ts=1552295163487
Requested by
Host: cdn.blueconic.net
URL: https://cdn.blueconic.net/idg.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.226.72.36 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-226-72-36.compute-1.amazonaws.com
Software
- /
Resource Hash
4493bd61bcc5d25e333a27da08bed762121fb981f6a8727fbdca8883ccb09cb0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Origin
https://www.csoonline.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
text/plain

Response headers

date
Mon, 11 Mar 2019 09:06:03 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-permitted-cross-domain-policies
master-only
p3p
policyref="", CP="DSP"
status
200
content-length
853
x-xss-protection
1; mode=block
pragma
no-cache
server
-
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.csoonline.com
cache-control
no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials
true
x-robots-tag
noindex, nofollow
expires
Thu, 01 Jan 1970 00:00:00 GMT
stats
idg.blueconic.net/rest/recommendations/
14 B
521 B
Script
General
Full URL
https://idg.blueconic.net/rest/recommendations/stats?storeId=efd50875-4f2e-45e8-8c72-41e0c1340350&action=view&itemId=www.csoonline.com%2Farticle%2F3345972%2Fqbot-malware-resurfaces-in-new-attack-against-businesses.html&url=https%3A%2F%2Fwww.csoonline.com%2Farticle%2F3345972%2Fqbot-malware-resurfaces-in-new-attack-against-businesses.html&profileId=ab2aa214-1123-4528-89b9-b7f7f5202bea&isEntrypage=true&hash=771353fca40cdc9a21e7824c91a229f5&referer=https%3A%2F%2Fwww.csoonline.com%2Farticle%2F3345972%2Fqbot-malware-resurfaces-in-new-attack-against-businesses.html&bcsessionid=ab2aa214-1123-4528-89b9-b7f7f5202bea&bctempid=&overruleReferrer=&time=2019-03-11T09%3A06%3A03%2B00%3A00&callback=bc_json180
Requested by
Host: cdn.blueconic.net
URL: https://cdn.blueconic.net/idg.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.226.72.36 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-226-72-36.compute-1.amazonaws.com
Software
- /
Resource Hash
c2c35f00e3a84bab52a27b0f73f083694ada76cb1b405bdddd49d275499ecc9e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 11 Mar 2019 09:06:03 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
text/javascript;charset=utf-8
server
-
p3p
policyref="", CP="DSP"
status
200
x-permitted-cross-domain-policies
master-only
cache-control
no-cache, no-store, no-transform, must-revalidate, private
x-robots-tag
noindex, nofollow
content-length
34
x-xss-protection
1; mode=block
expires
Thu, 01 Jan 1970 00:00:00 GMT
fbevents.js
connect.facebook.net/en_US/
52 KB
15 KB
Script
General
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: idg.blueconic.net
URL: https://idg.blueconic.net/plugin/plugin/e532e22e2682b808006d3546e2dfe2a0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:216:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
6bb981959d783d83df88b9aa48738948c9a8a22c1a31b8cb5305d3e338ebf9a7
Security Headers
Name Value
Content-Security-Policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma
public
x-fb-debug
Eb8JOpI+Y6ev/39IwOxncRtPN+DW51bn1WccxTKuQuOm28O9GF2xDRe2dsqK0JP3b4qxYfeE6rp6Lmtyi6a+WA==
content-encoding
gzip
x-content-type-options
nosniff
date
Mon, 11 Mar 2019 09:06:03 GMT
x-frame-options
DENY
content-type
application/x-javascript; charset=utf-8
status
200
cache-control
public, max-age=1200
content-security-policy
default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
strict-transport-security
max-age=31536000; preload; includeSubDomains
vary
Accept-Encoding
content-length
15216
x-xss-protection
0
expires
Sat, 01 Jan 2000 00:00:00 GMT
json
idg.blueconic.net/DG/DEFAULT/rest/rpc/
94 B
974 B
XHR
General
Full URL
https://idg.blueconic.net/DG/DEFAULT/rest/rpc/json?referer=https%3A%2F%2Fwww.csoonline.com%2Farticle%2F3345972%2Fqbot-malware-resurfaces-in-new-attack-against-businesses.html&bcsessionid=ab2aa214-1123-4528-89b9-b7f7f5202bea&bctempid=&overruleReferrer=&time=2019-03-11T09%3A06%3A03%2B00%3A00&ts=1552295163541
Requested by
Host: cdn.blueconic.net
URL: https://cdn.blueconic.net/idg.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.226.72.36 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-226-72-36.compute-1.amazonaws.com
Software
- /
Resource Hash
9c27ac6ce63d02cc1e160209b072acc023370e305185aa4d11e844c4c26efa0a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Origin
https://www.csoonline.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
text/plain

Response headers

date
Mon, 11 Mar 2019 09:06:03 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-permitted-cross-domain-policies
master-only
p3p
policyref="", CP="DSP"
status
200
content-length
105
x-xss-protection
1; mode=block
pragma
no-cache
server
-
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.csoonline.com
cache-control
no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials
true
x-robots-tag
noindex, nofollow
expires
Thu, 01 Jan 1970 00:00:00 GMT
portal.html
admiral.mgr.consensu.org/ Frame 388A
0
0
Document
General
Full URL
https://admiral.mgr.consensu.org/portal.html
Requested by
Host: spiffymachine.com
URL: https://spiffymachine.com/v2/0/lai9s0WlvrPiQ5L_cdrso4RiyfzVoZU9LvwlSHiKGRQVkAx4Mo_dqdkpNFmmgSH8bT1NgI68uTYHqQUTmjN
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.201.117.115 Ann Arbor, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
115.117.201.35.bc.googleusercontent.com
Software
nginx /
Resource Hash

Request headers

:method
GET
:authority
admiral.mgr.consensu.org
:scheme
https
:path
/portal.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html

Response headers

status
200
server
nginx
date
Mon, 11 Mar 2019 09:06:03 GMT
content-type
text/html
last-modified
Wed, 16 May 2018 16:27:21 GMT
vary
Accept-Encoding
x-hostname
jeremy
content-encoding
gzip
via
1.1 google
alt-svc
clear
connatix.renderer.infeed.min.js
cdn.connatix.com/min/
1 KB
1 KB
Script
General
Full URL
https://cdn.connatix.com/min/connatix.renderer.infeed.min.js
Requested by
Host: t.co
URL: https://t.co/aHrXW7ESH9
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42::645 , European Union, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Varnish /
Resource Hash
c002b2f0b3b338784fc2c1b63037d32ee06295fdff151730a9ab7afe078bf438

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:03 GMT
via
1.1 varnish
server
Varnish
age
0
x-cache
HIT
content-type
application/javascript
status
200
cache-control
no-cache, no-store, must-revalidate, max-age=0
x-cache-hits
0
accept-ranges
bytes
x-timer
S1552295164.689412,VS0,VE0
content-length
1324
retry-after
0
x-served-by
cache-fra19148-FRA
embed-wrapper
www.csoonline.com/video/embed/94127/
776 B
625 B
XHR
General
Full URL
https://www.csoonline.com/video/embed/94127/embed-wrapper
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/www/js/jquery/jquery-1.10.2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
573fc6351137287c5b5a0d05bb3af321a65c753ded48750b6fea84ad32be7a17

Request headers

:path
/video/embed/94127/embed-wrapper
pragma
no-cache
cookie
last_visit_bc=1552295161738; aiia=true; BCSessionID=ab2aa214-1123-4528-89b9-b7f7f5202bea; inSession=true; firstSessionDate=Mon, 11 Mar 2019 09:06:02 GMT; currentSessionDate=Mon, 11 Mar 2019 09:06:02 GMT; sessionNumber=1; lastSessionDate=Mon, 11 Mar 2019 09:06:02 GMT; zs_search=CISO; zs_location=Frankfurt%20am%20Main%2C%20Hesse; zs_radius_miles=50; zs_days_ago=%20; BCRevision_1552295163455=%7B%22method%22%3A%22createEvent%22%2C%22param%22%3A%7B%22type%22%3A%5B%22new_visit%22%5D%2C%22referrer%22%3A%5B%22https%3A%2F%2Ft.co%2FaHrXW7ESH9%22%5D%2C%22profile%22%3A%5B%22ab2aa214-1123-4528-89b9-b7f7f5202bea%22%5D%7D%2C%22requestId%22%3A%22rev_1552295163455%22%7D
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.csoonline.com
x-requested-with
XMLHttpRequest
:scheme
https
referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
:method
GET
Accept
*/*
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:03 GMT
content-encoding
gzip
server
Apache-Coyote/1.1
age
1
x-served-by
cache-sjc3143-SJC, cache-hhn1538-HHN
vary
Accept-Encoding,Cookie
x-cache
HIT, HIT
content-type
text/html;charset=UTF-8
status
200
accept-ranges
bytes
x-timer
S1552295164.690561,VS0,VE0
content-length
452
via
1.1 varnish 1.1 varnish
x-via-fastly
Verdad
x-cache-hits
1, 1
70eb6864ef9e702ce9ed95c93a9cdaabb1c939cc-l.woff2
fonts.staticworld.net/k/
24 KB
24 KB
Font
General
Full URL
https://fonts.staticworld.net/k/70eb6864ef9e702ce9ed95c93a9cdaabb1c939cc-l.woff2
Requested by
Host: fonts.staticworld.net
URL: https://fonts.staticworld.net/xyb0fnv.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
551c004633e25f9dd42ff8e4af57138e73e1a06349e8296ed7180046c0452ae3

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Origin
https://www.csoonline.com

Response headers

date
Mon, 11 Mar 2019 09:06:03 GMT
via
1.1 varnish
server
nginx
age
581865
x-cache
HIT
content-type
application/font-woff2
status
200
cache-control
public, max-age=604800
x-cache-hits
4
accept-ranges
bytes
x-timer
S1552295164.703767,VS0,VE0
access-control-allow-origin
*
content-length
24108
x-served-by
cache-hhn1525-HHN
anchor
www.google.com/recaptcha/api2/ Frame 6145
0
0
Document
General
Full URL
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LczmkcUAAAAANEO7J277KwH6Kzp6BEQjPTWP4S4&co=aHR0cHM6Ly93d3cuY3Nvb25saW5lLmNvbTo0NDM.&hl=en&v=v1551681158638&size=normal&cb=718ezuufhx9
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/api2/v1551681158638/recaptcha__en.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:824::2004 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
GSE /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-F1nQ+B1FfXN1BwvXCCuOFQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
www.google.com
:scheme
https
:path
/recaptcha/api2/anchor?ar=1&k=6LczmkcUAAAAANEO7J277KwH6Kzp6BEQjPTWP4S4&co=aHR0cHM6Ly93d3cuY3Nvb25saW5lLmNvbTo0NDM.&hl=en&v=v1551681158638&size=normal&cb=718ezuufhx9
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html

Response headers

status
200
content-type
text/html; charset=utf-8
cache-control
no-cache, no-store, max-age=0, must-revalidate
pragma
no-cache
expires
Mon, 01 Jan 1990 00:00:00 GMT
date
Mon, 11 Mar 2019 09:06:03 GMT
content-security-policy
script-src 'report-sample' 'nonce-F1nQ+B1FfXN1BwvXCCuOFQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding
gzip
x-content-type-options
nosniff
x-xss-protection
1; mode=block
content-length
11351
server
GSE
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
e6Ya2Zt9.js
content.jwplatform.com/libraries/
97 KB
32 KB
Script
General
Full URL
https://content.jwplatform.com/libraries/e6Ya2Zt9.js?_=1552295161681
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/www/js/jquery/jquery-1.10.2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:200d:5600:1:a3fa:7cc0:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
openresty /
Resource Hash
5960a4c10782b43074d54e27e215bc504ec339606d2ee4b026ab574639618b33

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:03 GMT
content-encoding
gzip
server
openresty
access-control-allow-origin
*
x-cache
Miss from cloudfront
content-type
text/javascript; charset=utf-8
status
200
cache-control
max-age=150, max-stale=180
content-length
32110
via
1.1 c2890b1d84d781704a34b9aa5c069d4e.cloudfront.net (CloudFront)
x-amz-cf-id
VMzpLIoddsMv8H1eQguR2TO9ZrHFVVvf405o-LKNM8A_uAlEKy6OLg==
expires
Mon, 11 Mar 2019 09:08:33 GMT
btn-play-default.svg
idge.staticworld.net/idgtv/
1 KB
2 KB
Image
General
Full URL
https://idge.staticworld.net/idgtv/btn-play-default.svg
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
3208c96177b7053855574338b4f374864c84450a2bb498d257f96b24fa89228a

Request headers

Referer
https://www.csoonline.com/www/css/article.css?v=20190307113302
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-amz-version-id
59aOSMAOZ.swyLJWWE0LGhyzKU_fOIKo
via
1.1 varnish, 1.1 varnish
age
1647
x-cache
HIT, HIT
status
200
date
Mon, 11 Mar 2019 09:06:03 GMT
content-length
1519
x-amz-id-2
mVmdwZsW4hlkJdWRj9RhjrvK7iSGALxkKZn2zi83Jx45ziiNYhypStX74K2ogTEmhQTo0OvpKwU=
x-served-by
cache-jfk8132-JFK, cache-hhn1538-HHN
last-modified
Tue, 27 Mar 2018 00:10:04 GMT
server
AmazonS3
x-timer
S1552295164.860447,VS0,VS0,VE0
etag
"4801095ec3a1666b5c86deb4e4a5e98d"
x-amz-request-id
15B8D0F8F138BB95
accept-ranges
bytes
content-type
image/svg+xml
x-cache-hits
1, 1
analytics.js
www.google-analytics.com/
43 KB
17 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WR6LD2P
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:816::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
3e552578c7d450b023f2cd9d28f830be4335c3acc6c4ab6dadda0769f09e5f22
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 16 Jan 2019 20:01:45 GMT
server
Golfe2
age
4749
date
Mon, 11 Mar 2019 07:46:54 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
17543
expires
Mon, 11 Mar 2019 09:46:54 GMT
minified_logic.js
automate-prod.s3.amazonaws.com/
16 KB
17 KB
XHR
General
Full URL
https://automate-prod.s3.amazonaws.com/minified_logic.js
Requested by
Host: t.co
URL: https://t.co/aHrXW7ESH9
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.218.208.130 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
s3-us-west-2-w.amazonaws.com
Software
AmazonS3 /
Resource Hash
ca51e0a28d0a5a6056e312625cf15051dd1aab76d64107af6ac2a393448e0028

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Origin
https://www.csoonline.com

Response headers

Date
Mon, 11 Mar 2019 09:06:05 GMT
Last-Modified
Mon, 11 Jun 2018 15:27:35 GMT
Server
AmazonS3
x-amz-request-id
D806607111E7FF53
ETag
"9cc4261239704356e7381ce6c6e9526e"
Vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method
Access-Control-Allow-Methods
GET
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Access-Control-Max-Age
3000
Cache-Control
max-age=315360000, no-transform, public
Accept-Ranges
bytes
Content-Length
16396
x-amz-id-2
tjLgWdezBBLiCZKaGkWIeQvdty+LnLsGEbFMZSuQ4J3JqIaTtbdh7lo5mdAMUhQ0BXusil5vZzM=
oct.js
static.ads-twitter.com/
Redirect Chain
  • https://platform.twitter.com/oct.js
  • https://static.ads-twitter.com/oct.js
5 KB
2 KB
Script
General
Full URL
https://static.ads-twitter.com/oct.js
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.46.112 San Francisco, United States, ASN13414 (TWITTER - Twitter Inc., US),
Reverse DNS
Software
/
Resource Hash
319949c8c08b86e9c35ea542c0dc0c30cedaa9b8d3d3c3327a36c91aefbd8af5

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:04 GMT
content-encoding
gzip
age
32746
x-cache
HIT
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status
200
content-length
1954
x-served-by
cache-tw-lon2-cr1-29-TWLON2
last-modified
Tue, 23 Jan 2018 19:05:33 GMT
x-timer
S1552295164.177301,VS0,VE0
etag
"b7b33882a4f3ffd5cbf07434f3137166+gzip"
vary
Accept-Encoding,Host
content-type
application/javascript; charset=utf-8
via
1.1 varnish
cache-control
no-cache
accept-ranges
bytes

Redirect headers

Location
https://static.ads-twitter.com/oct.js
Date
Mon, 11 Mar 2019 09:06:03 GMT
Server
ECS (fcn/40D0)
Content-Length
0
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Afrniv
ad.doubleclick.net/ddm/adj/Byghh/
11 B
221 B
Script
General
Full URL
https://ad.doubleclick.net/ddm/adj/Byghh/Afrniv
Requested by
Host: spiffymachine.com
URL: https://spiffymachine.com/v2/0/cyd3Vkrqtd-ClWmwn4oT2UgRVFzxMujpGSwHmogdm3LpvfSUBhItArin36Z82cfR8fnYg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
172.217.16.166 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f166.1e100.net
Software
cafe /
Resource Hash
f1e945400c04241ef089d71de3b0cf7e202431ac4685ada318714fe07ee9dcb0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 11 Mar 2019 09:06:03 GMT
content-encoding
br
x-content-type-options
nosniff
content-type
text/javascript; charset=UTF-8
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
no-cache, must-revalidate
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
14
x-xss-protection
1; mode=block
expires
Fri, 01 Jan 1990 00:00:00 GMT
get
odb.outbrain.com/utils/
31 KB
11 KB
Script
General
Full URL
https://odb.outbrain.com/utils/get?url=https%3A%2F%2Fwww.csoonline.com%2Farticle%2F3345972%2Fqbot-malware-resurfaces-in-new-attack-against-businesses.html&settings=true&recs=true&widgetJSId=AR_1&key=NANOWDGT01&idx=0&version=01020406&apv=false&sig=Mf8AN16n&format=html&rand=83731&osLang=en-US&winW=1600&winH=1200&scrW=1600&scrH=1200&adblck=false&secured=true&va=true&cmpStat=1&ref=https%3A%2F%2Ft.co%2FaHrXW7ESH9
Requested by
Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js?_=1552295161680
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.2 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
/
Resource Hash
eca03da06b638144342cd49d7f4f4e82bd9830b729dc53981f897bd27957ac23
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains;

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security
max-age=0; includeSubDomains;
content-encoding
gzip
traffic-path
NYDC1, JFK, HHN, Europe1
x-cache
MISS, MISS
p3p
policyref="http://www.outbrain.com/w3c/p3p.xml",CP="NOI NID CURa DEVa TAIa PSAa PSDa OUR IND UNI"
status
200
x-served-by
cache-jfk8137-JFK, cache-hhn1534-HHN
pragma
no-cache
x-timer
S1552295164.044463,VS0,VE141
date
Mon, 11 Mar 2019 09:06:04 GMT
vary
Accept-Encoding, User-Agent
content-type
text/x-json; charset=UTF-8
via
1.1 varnish, 1.1 varnish
expires
Thu, 01 Jan 1970 00:00:00 GMT
cache-control
no-cache
backend-ip
104.156.90.37
accept-ranges
bytes, bytes
x-cache-hits
0, 0
container.html
tpc.googlesyndication.com/safeframe/1-0-23/html/ Frame CA0B
0
0
Document
General
Full URL
https://tpc.googlesyndication.com/safeframe/1-0-23/html/container.html
Requested by
Host: spiffymachine.com
URL: https://spiffymachine.com/v2/0/cyd3Vkrqtd-ClWmwn4oT2UgRVFzxMujpGSwHmogdm3LpvfSUBhItArin36Z82cfR8fnYg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:815::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
tpc.googlesyndication.com
:scheme
https
:path
/safeframe/1-0-23/html/container.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html

Response headers

status
200
accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
timing-allow-origin
*
content-length
1479
date
Sat, 09 Mar 2019 04:09:21 GMT
expires
Sun, 08 Mar 2020 04:09:21 GMT
last-modified
Tue, 10 Apr 2018 14:51:09 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
1; mode=block
cache-control
public, immutable, max-age=31536000
age
190602
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
b2
sb.scorecardresearch.com/
Redirect Chain
  • https://sb.scorecardresearch.com/b?c1=2&c2=6035308&c3=&c5=Malware&c6=Article%3A%20News&c15=3345972&ns__t=1552295163965&ns_c=UTF-8&cv=3.1e&c8=Qbot%20malware%20resurfaces%20in%20new%20attack%20agains...
  • https://sb.scorecardresearch.com/b2?c1=2&c2=6035308&c3=&c5=Malware&c6=Article%3A%20News&c15=3345972&ns__t=1552295163965&ns_c=UTF-8&cv=3.1e&c8=Qbot%20malware%20resurfaces%20in%20new%20attack%20again...
0
248 B
Image
General
Full URL
https://sb.scorecardresearch.com/b2?c1=2&c2=6035308&c3=&c5=Malware&c6=Article%3A%20News&c15=3345972&ns__t=1552295163965&ns_c=UTF-8&cv=3.1e&c8=Qbot%20malware%20resurfaces%20in%20new%20attack%20against%20businesses%20%7C%20CSO%20Online&c7=https%3A%2F%2Fwww.csoonline.com%2Farticle%2F3345972%2Fqbot-malware-resurfaces-in-new-attack-against-businesses.html&c9=https%3A%2F%2Ft.co%2FaHrXW7ESH9
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.162.235 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-162-235.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 11 Mar 2019 09:06:04 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection
keep-alive
Content-Length
0
Expires
Mon, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
https://sb.scorecardresearch.com/b2?c1=2&c2=6035308&c3=&c5=Malware&c6=Article%3A%20News&c15=3345972&ns__t=1552295163965&ns_c=UTF-8&cv=3.1e&c8=Qbot%20malware%20resurfaces%20in%20new%20attack%20against%20businesses%20%7C%20CSO%20Online&c7=https%3A%2F%2Fwww.csoonline.com%2Farticle%2F3345972%2Fqbot-malware-resurfaces-in-new-attack-against-businesses.html&c9=https%3A%2F%2Ft.co%2FaHrXW7ESH9
Pragma
no-cache
Date
Mon, 11 Mar 2019 09:06:03 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection
keep-alive
Content-Length
0
Expires
Mon, 01 Jan 1990 00:00:00 GMT
528995260596026
connect.facebook.net/signals/config/
186 KB
45 KB
Script
General
Full URL
https://connect.facebook.net/signals/config/528995260596026?v=2.8.42&r=stable
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:216:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
d74669775f5e65a0cf6dc15010754e94d4018936d967a689134eff6afaa8347d
Security Headers
Name Value
Content-Security-Policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
status
200
vary
Origin, Accept-Encoding
x-xss-protection
0
pragma
public
x-fb-debug
KbHl0VWaIXslfrY0VILa3a7vifoUCRVOrRd1w6mvG3vd95DdsjwNlOjv/9LYQ0IeDrprqzQjloAUHb41PrzdFQ==
date
Mon, 11 Mar 2019 09:06:04 GMT
x-frame-options
DENY
access-control-allow-methods
OPTIONS
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
https://connect.facebook.net
access-control-expose-headers
X-FB-Debug, X-Loader-Length
cache-control
public, max-age=1200
access-control-allow-credentials
true
content-security-policy
default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires
Sat, 01 Jan 2000 00:00:00 GMT
connatix.renderer.infeed.min_dc.js
cdns.connatix.com/p/1441/min/ Frame 026E
704 KB
183 KB
Script
General
Full URL
https://cdns.connatix.com/p/1441/min/connatix.renderer.infeed.min_dc.js
Requested by
Host: cdn.connatix.com
URL: https://cdn.connatix.com/min/connatix.renderer.infeed.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42::645 , European Union, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
/
Resource Hash
eb8fb328ea3b6842d06fdbda892773d24457b4479b1570a793e8705717c553db

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:04 GMT
content-encoding
gzip
age
245522
x-cache
HIT, HIT
status
200
content-length
186846
via
1.1 varnish, 1.1 varnish
x-served-by
cache-dca17747-DCA, cache-fra19148-FRA
last-modified
Fri, 08 Mar 2019 12:52:53 GMT
x-timer
S1552295164.092077,VS0,VE0
etag
"69e71ffa06ededa0877250e41801b159"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
max-age=31557600
accept-ranges
bytes
x-cache-hits
1, 16729
p.gif
p.typekit.net/
35 B
367 B
Image
General
Full URL
https://p.typekit.net/p.gif?s=1&k=xyb0fnv&ht=sh&h=www.csoonline.com&f=25310.25312.25314.25318&a=620309&js=1.18.24&app=typekit&e=js&_=1552295164091
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:6c00:28d::19fd , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
nginx /
Resource Hash
9b9265c69a5cc295d1ab0d04e0273b3677db1a6216ce2ccf4efc8c277ed84b39

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 11 Mar 2019 09:06:04 GMT
Last-Modified
Thu, 12 Jul 2018 20:40:02 GMT
Server
nginx
ETag
"5b47bca2-23"
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
max-age=604800
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
35
Expires
Mon, 12 Nov 2018 16:18:49 GMT
linkid.js
www.google-analytics.com/plugins/ua/
2 KB
932 B
Script
General
Full URL
https://www.google-analytics.com/plugins/ua/linkid.js
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:816::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 08:16:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 21 Apr 2016 03:17:22 GMT
server
sffe
age
2978
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=3600
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
856
x-xss-protection
1; mode=block
expires
Mon, 11 Mar 2019 09:16:26 GMT
publisher:getClientId
ampcid.google.com/v1/
74 B
437 B
XHR
General
Full URL
https://ampcid.google.com/v1/publisher:getClientId?key=AIzaSyA65lEHUEizIsNtlbNo-l2K18dT680nsaM
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:81c::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
ESF /
Resource Hash
991bfe84fec788f2b7d432b99a60c1e2aa2e799bc0137da8cf478299d0fc9a10
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Origin
https://www.csoonline.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
text/plain

Response headers

date
Mon, 11 Mar 2019 09:06:04 GMT
content-encoding
gzip
x-content-type-options
nosniff
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
server
ESF
status
200
x-frame-options
SAMEORIGIN
content-type
application/json; charset=UTF-8
access-control-allow-origin
https://www.csoonline.com
access-control-expose-headers
content-encoding,date,server,content-length
cache-control
private
access-control-allow-credentials
true
vary
Origin, X-Origin, Referer
content-length
94
x-xss-protection
1; mode=block
ob_smartFeedLogo.min.svg
widgets.outbrain.com/images/widgetIcons/
7 KB
7 KB
Image
General
Full URL
https://widgets.outbrain.com/images/widgetIcons/ob_smartFeedLogo.min.svg
Requested by
Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js?_=1552295161680
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.211.2.209 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-211-2-209.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
8050f05c230d74be333b63cef230e786094e9100f55fa19c6c0831e95870768d

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 11 Mar 2019 09:06:04 GMT
Last-Modified
Tue, 19 Feb 2019 08:26:18 GMT
Server
Apache
ETag
"f370d19306add072a726e7f4ade8dc57:1550564778"
Access-Control-Allow-Methods
GET,POST
Content-Type
image/svg+xml
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
false
Connection
keep-alive
Accept-Ranges
bytes
Timing-Allow-Origin
*
Content-Length
7090
achoice.svg
widgets.outbrain.com/images/widgetIcons/
3 KB
2 KB
Image
General
Full URL
https://widgets.outbrain.com/images/widgetIcons/achoice.svg
Requested by
Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js?_=1552295161680
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.211.2.209 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-211-2-209.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
2c87952cc1c23627496c7874271042bdb6af21efdf7cbf36ec4d98e6cec34d04

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 11 Mar 2019 09:06:04 GMT
Content-Encoding
gzip
Last-Modified
Tue, 19 Feb 2019 08:26:12 GMT
Server
Apache
ETag
"9d26fa4e7238ed94f1d0d92afb453b3e:1550564772"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET,POST
Content-Type
image/svg+xml
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
false
Connection
keep-alive
Accept-Ranges
bytes
Timing-Allow-Origin
*
Content-Length
1368
obUserSync.html
widgets.outbrain.com/widgetOBUserSync/ Frame E860
0
0
Document
General
Full URL
https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Requested by
Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js?_=1552295161680
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.211.2.209 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-211-2-209.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash

Request headers

Host
widgets.outbrain.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Accept-Encoding
gzip, deflate, br
Cookie
obuid=98b0a556-a5d6-4438-a925-0cb73131ac4a; recs_070e9ec9c17f401d0fe03945f9725269=0B1925901673A2023122671A1951582307A2103995423A2013685717A2160867695ACD1
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html

Response headers

Server
Apache
ETag
"37c9f7a42683c3820a79e7bd10983856:1551801234"
Last-Modified
Tue, 05 Mar 2019 15:53:54 GMT
Accept-Ranges
bytes
Content-Type
text/html
Vary
Accept-Encoding
Content-Encoding
gzip
Cache-Control
max-age=604800
Date
Mon, 11 Mar 2019 09:06:04 GMT
Content-Length
3464
Connection
keep-alive
Timing-Allow-Origin
*
Access-Control-Allow-Credentials
false
Access-Control-Allow-Methods
GET,POST
Access-Control-Allow-Origin
*
streamFeed.js
widgets.outbrain.com/nanoWidget/01020406/module/
16 KB
7 KB
Script
General
Full URL
https://widgets.outbrain.com/nanoWidget/01020406/module/streamFeed.js
Requested by
Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js?_=1552295161680
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.211.2.209 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-211-2-209.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
8f1ac58f2b6b1582e13e06eefaa91ade1b78a5c86bd377401d860aaf03415ee5

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 11 Mar 2019 09:06:04 GMT
Content-Encoding
gzip
Last-Modified
Thu, 07 Mar 2019 11:34:01 GMT
Server
Apache
ETag
"b4005e8bd2fc6dd2043f9bf636a57718:1551958441"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET,POST
Content-Type
application/x-javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=604800
Access-Control-Allow-Credentials
false
Connection
keep-alive
Accept-Ranges
bytes
Timing-Allow-Origin
*
Content-Length
6449
eyJpdSI6ImQ5NzFhYTQwYTZkNDQxOWUwYWQyNzEyMmJhZmI5YjRjNGU5Y2ZmYWQ1MTJjYjlmNmE1NGE4ZmIwYjExZmIzMzkiLCJ3Ijo0MDAsImgiOjMwMCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp
images.outbrainimg.com/transform/v3/
22 KB
22 KB
Image
General
Full URL
https://images.outbrainimg.com/transform/v3/eyJpdSI6ImQ5NzFhYTQwYTZkNDQxOWUwYWQyNzEyMmJhZmI5YjRjNGU5Y2ZmYWQ1MTJjYjlmNmE1NGE4ZmIwYjExZmIzMzkiLCJ3Ijo0MDAsImgiOjMwMCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.70.82 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-70-82.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
8d7738b8385564c0a23d5a6bb9532830a46f9eed00d67b80f105a6570a3b100e
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains;

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security
max-age=0; includeSubDomains;
Content-Encoding
gzip
Last-Modified
Thu, 21 Feb 2019 12:41:27 GMT
Date
Mon, 11 Mar 2019 09:06:04 GMT
Vary
Accept-Encoding
Content-Type
image/webp
Cache-Control
max-age=1463375
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
22399
eyJpdSI6IjI0OGI4Y2UwNTBhNDYwNTUyMmMyMmYzZjRkZGEzYzEyNzNjYWNkNTYwYzc4NDE2YjNiNWE3MzYwMDI5YTBmMDAiLCJ3Ijo0MDAsImgiOjMwMCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp
images.outbrainimg.com/transform/v3/
72 KB
72 KB
Image
General
Full URL
https://images.outbrainimg.com/transform/v3/eyJpdSI6IjI0OGI4Y2UwNTBhNDYwNTUyMmMyMmYzZjRkZGEzYzEyNzNjYWNkNTYwYzc4NDE2YjNiNWE3MzYwMDI5YTBmMDAiLCJ3Ijo0MDAsImgiOjMwMCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.70.82 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-70-82.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
363713bee3b3ed898f66f802f4e43945ab0f6094053a986db4bdd575428465b6
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains;

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security
max-age=0; includeSubDomains;
Content-Encoding
gzip
Last-Modified
Mon, 18 Feb 2019 15:42:52 GMT
Date
Mon, 11 Mar 2019 09:06:04 GMT
Vary
Accept-Encoding
Content-Type
image/webp
Cache-Control
max-age=738569
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
73830
eyJpdSI6IjkwNDEyODY4OGFiZDc1MTYwMjNhYzdmZWE3NmM4NWI0MDI0YTUzMmIwMTg2YTdkM2Q2MjliYWExNDFmYjU1NjUiLCJ3Ijo0MDAsImgiOjMwMCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp
images.outbrainimg.com/transform/v3/
50 KB
51 KB
Image
General
Full URL
https://images.outbrainimg.com/transform/v3/eyJpdSI6IjkwNDEyODY4OGFiZDc1MTYwMjNhYzdmZWE3NmM4NWI0MDI0YTUzMmIwMTg2YTdkM2Q2MjliYWExNDFmYjU1NjUiLCJ3Ijo0MDAsImgiOjMwMCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.70.82 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-70-82.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
005836e6ecfaaaceb6137887c8176994494690448569e84938656c2af4393e0e
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains;

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security
max-age=0; includeSubDomains;
Content-Encoding
gzip
Last-Modified
Thu, 07 Feb 2019 12:26:08 GMT
Date
Mon, 11 Mar 2019 09:06:04 GMT
Vary
Accept-Encoding
Content-Type
image/webp
Cache-Control
max-age=1205683
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
51398
eyJpdSI6IjFkOGFhYmE2ZTRmZjIyODNhYjM2YjVlNjBjMjNmYjU0ODVmYTY4N2ZlNGQxZTE5NGFiZTkxYmMzZjRiZGEzMmUiLCJ3Ijo0MDAsImgiOjMwMCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp
images.outbrainimg.com/transform/v3/
20 KB
20 KB
Image
General
Full URL
https://images.outbrainimg.com/transform/v3/eyJpdSI6IjFkOGFhYmE2ZTRmZjIyODNhYjM2YjVlNjBjMjNmYjU0ODVmYTY4N2ZlNGQxZTE5NGFiZTkxYmMzZjRiZGEzMmUiLCJ3Ijo0MDAsImgiOjMwMCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.70.82 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-70-82.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e079e2d9169b771821fa35bd0cb3995ac40e350435800bf98d641098355bc217
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains;

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security
max-age=0; includeSubDomains;
Content-Encoding
gzip
Last-Modified
Fri, 08 Feb 2019 05:59:32 GMT
Date
Mon, 11 Mar 2019 09:06:04 GMT
Vary
Accept-Encoding
Content-Type
image/webp
Cache-Control
max-age=1454988
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
20367
eyJpdSI6IjZjY2QwODc5MDA0ZWUzZmM3Yjg1NzRhN2VjNDczYTRjYTlmNmM3OWY3YmQ1ODA2ZjliNjA2YmU5ZjkzOTk2MmQiLCJ3Ijo0MDAsImgiOjMwMCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp
images.outbrainimg.com/transform/v3/
50 KB
50 KB
Image
General
Full URL
https://images.outbrainimg.com/transform/v3/eyJpdSI6IjZjY2QwODc5MDA0ZWUzZmM3Yjg1NzRhN2VjNDczYTRjYTlmNmM3OWY3YmQ1ODA2ZjliNjA2YmU5ZjkzOTk2MmQiLCJ3Ijo0MDAsImgiOjMwMCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.70.82 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-70-82.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
6e6c7f819d445a069c18f506c629c6043d86bdc1546875fab9cee18d051edb9f
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains;

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security
max-age=0; includeSubDomains;
Content-Encoding
gzip
Last-Modified
Thu, 07 Feb 2019 00:00:58 GMT
Date
Mon, 11 Mar 2019 09:06:04 GMT
Vary
Accept-Encoding
Content-Type
image/webp
Cache-Control
max-age=1505739
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
50769
eyJpdSI6IjBkOTY4OGRkM2Y1Y2YwZTgwNTliNzE3OGViM2Q5NGFlYTI3ZjZmMjY0NTI0MWEyNWM4NmNiNWY1YjVmMTMzNWEiLCJ3Ijo0MDAsImgiOjMwMCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp
images.outbrainimg.com/transform/v3/
13 KB
13 KB
Image
General
Full URL
https://images.outbrainimg.com/transform/v3/eyJpdSI6IjBkOTY4OGRkM2Y1Y2YwZTgwNTliNzE3OGViM2Q5NGFlYTI3ZjZmMjY0NTI0MWEyNWM4NmNiNWY1YjVmMTMzNWEiLCJ3Ijo0MDAsImgiOjMwMCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.70.82 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-70-82.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
1c13316139fa198c6f9c3bd390558ed6aefdad457aa33b21317f743343bc91f4
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains;

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security
max-age=0; includeSubDomains;
Content-Encoding
gzip
Last-Modified
Tue, 19 Feb 2019 08:56:33 GMT
Date
Mon, 11 Mar 2019 09:06:04 GMT
Vary
Accept-Encoding
Content-Type
image/webp
Cache-Control
max-age=779740
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
13428
/
www.facebook.com/tr/
44 B
247 B
Image
General
Full URL
https://www.facebook.com/tr/?id=528995260596026&ev=BlueConic_ALL&dl=https%3A%2F%2Fwww.csoonline.com%2Farticle%2F3345972%2Fqbot-malware-resurfaces-in-new-attack-against-businesses.html&rl=https%3A%2F%2Ft.co%2FaHrXW7ESH9&if=false&ts=1552295164517&cd[BCSegment]=%5B%22CSO%20visitors%22%2C%22IP%20address%22%2C%22Placement%20ID%22%2C%22Visited%20any%20B2B%22%2C%22Visitors%20not%20in%20segment%20%5C%22zach%20test%20segment%5C%22%22%2C%22Not%20subscribed%20to%20Sailthru%22%2C%22All%20Visitors%22%2C%22%5BBC%20Expert%5D%20%E2%80%93%20Unknown%20(no%20email%20address)%22%5D&sw=1600&sh=1200&v=2.8.42&r=stable&ec=0&o=30&fbp=fb.1.1552295164515.1609928471&it=1552295163988&coo=false&rqm=GET
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f11c:8083:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:04 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
content-type
image/gif
status
200
cache-control
no-cache, must-revalidate, max-age=0
content-length
44
expires
Mon, 11 Mar 2019 09:06:04 GMT
111346X1569475.skimlinks.js
s.skimresources.com/js/
37 KB
14 KB
Script
General
Full URL
https://s.skimresources.com/js/111346X1569475.skimlinks.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WR6LD2P
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.139.128.10 Dallas, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
db84430d0769e415e5f0a9c9cd2565f55bd4b80b38a45299d3576f0842f2b3a9

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:04 GMT
content-encoding
gzip
last-modified
Wed, 06 Mar 2019 12:21:00 GMT
server
AmazonS3
x-amz-request-id
1A8DBA4B4CEFFA8F
etag
"e930ea83ac96f880ec68430ac9bc3b80"
x-hw
1552295164.cds028.pa1.hn,1552295164.cds002.pa1.c
content-type
application/octet-stream
status
200
cache-control
max-age=3600
accept-ranges
bytes
content-length
14410
x-amz-id-2
hV4T+WmhKsbE4h16wLY22QncaumWzT1fpmg35p4z90dk+1PqUrb/8ibxmQ5mAQaVaym442u3Y2E=
/
www.csoonline.com/
Redirect Chain
  • https://www.csoonline.com/.well-known/pubvendors.json
  • https://www.csoonline.com/
116 KB
25 KB
Fetch
General
Full URL
https://www.csoonline.com/
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
41e9b0d0acfeefdf42280a2a2ad1281879fa771c7e122ba95b1af1aeb068e0ac

Request headers

:path
/
pragma
no-cache
cookie
last_visit_bc=1552295161738; aiia=true; inSession=true; firstSessionDate=Mon, 11 Mar 2019 09:06:02 GMT; currentSessionDate=Mon, 11 Mar 2019 09:06:02 GMT; sessionNumber=1; lastSessionDate=Mon, 11 Mar 2019 09:06:02 GMT; zs_search=CISO; zs_location=Frankfurt%20am%20Main%2C%20Hesse; zs_radius_miles=50; zs_days_ago=%20; BCSessionID=No%20profile%20present%20and%20will%20not%20be%20created.; AMP_TOKEN=%24RETRIEVING; _fbp=fb.1.1552295164515.1609928471
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.csoonline.com
referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
:scheme
https
:method
GET
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:04 GMT
content-encoding
gzip
server
Apache-Coyote/1.1
age
4515
x-served-by
cache-sjc3131-SJC, cache-hhn1538-HHN
vary
Accept-Encoding,Cookie
x-cache
HIT, HIT
content-type
text/html;charset=UTF-8
status
200
accept-ranges
bytes
x-timer
S1552295165.683755,VS0,VE1
content-length
25374
via
1.1 varnish 1.1 varnish
x-via-fastly
Verdad
x-cache-hits
1, 1

Redirect headers

date
Mon, 11 Mar 2019 09:06:04 GMT
via
1.1 varnish
server
Varnish
x-timer
S1552295165.549516,VS0,VE0
x-served-by
cache-hhn1538-HHN
status
302
x-cache
HIT
location
https://www.csoonline.com
retry-after
0
accept-ranges
bytes
content-length
0
x-via-fastly
Verdad
x-cache-hits
0
vendorlist.json
vendorlist.consensu.org/
77 KB
14 KB
Fetch
General
Full URL
https://vendorlist.consensu.org/vendorlist.json
Requested by
Host: spiffymachine.com
URL: https://spiffymachine.com/v2/0/lai9s0WlvrPiQ5L_cdrso4RiyfzVoZU9LvwlSHiKGRQVkAx4Mo_dqdkpNFmmgSH8bT1NgI68uTYHqQUTmjN
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:200d:9a00:1:af78:4c0:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
50ce00ed072a39317bfd698cff66f0233eb061cf02d57e07f3daa273e0effd7e

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Origin
https://www.csoonline.com

Response headers

date
Fri, 08 Mar 2019 07:23:37 GMT
content-encoding
gzip
vary
Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
age
5433
x-cache
Hit from cloudfront
status
200
access-control-allow-origin
*
last-modified
Thu, 07 Mar 2019 16:00:18 GMT
server
AmazonS3
access-control-max-age
86400
access-control-allow-methods
GET
x-amz-version-id
PJ1Jy6JytVXY_zDMcRYtYALhv6aB0ShI
via
1.1 d89eaba973a5c1614ea9f0994f5e8a12.cloudfront.net (CloudFront)
cache-control
max-age=259200
content-type
application/json; charset=utf-8
x-amz-cf-id
OismgthtHG5Dfzn4QjJa1Gkckx9Xef1kGU0yKg7SLaf7AoLFg_rvrg==
publisher:getClientId
ampcid.google.de/v1/
3 B
366 B
XHR
General
Full URL
https://ampcid.google.de/v1/publisher:getClientId?key=AIzaSyA65lEHUEizIsNtlbNo-l2K18dT680nsaM
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:817::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
ESF /
Resource Hash
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Origin
https://www.csoonline.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
text/plain

Response headers

date
Mon, 11 Mar 2019 09:06:04 GMT
content-encoding
gzip
x-content-type-options
nosniff
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
server
ESF
status
200
x-frame-options
SAMEORIGIN
content-type
application/json; charset=UTF-8
access-control-allow-origin
https://www.csoonline.com
access-control-expose-headers
content-encoding,date,server,content-length
cache-control
private
access-control-allow-credentials
true
vary
Origin, X-Origin, Referer
content-length
23
x-xss-protection
1; mode=block
json
idg.blueconic.net/DG/DEFAULT/rest/rpc/
105 B
672 B
XHR
General
Full URL
https://idg.blueconic.net/DG/DEFAULT/rest/rpc/json?referer=https%3A%2F%2Fwww.csoonline.com%2Farticle%2F3345972%2Fqbot-malware-resurfaces-in-new-attack-against-businesses.html&bcsessionid=No%20profile%20present%20and%20will%20not%20be%20created.&bctempid=&overruleReferrer=&time=2019-03-11T09%3A06%3A04%2B00%3A00&ts=1552295164630
Requested by
Host: cdn.blueconic.net
URL: https://cdn.blueconic.net/idg.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.226.72.36 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-226-72-36.compute-1.amazonaws.com
Software
- /
Resource Hash
951582c15ddd424b079cd402c7e1fbccbb379d99e2c6e3cc10a7d50f89a56492
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Origin
https://www.csoonline.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
text/plain

Response headers

date
Mon, 11 Mar 2019 09:06:04 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-permitted-cross-domain-policies
master-only
p3p
policyref="", CP="DSP"
status
200
content-length
113
x-xss-protection
1; mode=block
pragma
no-cache
server
-
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.csoonline.com
cache-control
no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials
true
x-robots-tag
noindex, nofollow
expires
Thu, 01 Jan 1970 00:00:00 GMT
auction
tlx.3lift.com/web/ Frame 0927
47 B
505 B
Script
General
Full URL
https://tlx.3lift.com/web/auction?inv_code=tan_CSOOnline_MOAP&referrer=https%3A%2F%2Fwww.csoonline.com%2Farticle%2F3345972%2Fqbot-malware-resurfaces-in-new-attack-against-businesses.html&rev=4833279&fe=0&ft=0&cb=1704668189
Requested by
Host: ib.3lift.com
URL: https://ib.3lift.com/rev/4833279baf8156b5abdae577f01065e6641b1d90/dist/bundle.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.158.24.211 Frankfurt, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-35-158-24-211.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
cde81914d5156c8bb54bf877e4bbe622a6b63853c141fb1539b97aff17149ce4
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 11 Mar 2019 09:06:04 GMT
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-type
application/javascript; charset=utf-8
content-length
47
x-xss-protection
0
expires
Thu, 15 Oct 1992 20:10:00 GMT
sce
eb2.3lift.com/
37 B
139 B
Image
General
Full URL
https://eb2.3lift.com/sce?inv_code=tan_CSOOnline_MOAP&rev_hash=4833279&e=Error%3A%20Error%20getting%20gdpr%20vendorConsentData%3A%20__cmp%20getConsentData%20timeout&block=checkGdprCmp&lvl=2&dc=&cb=11300
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.120.56.246 Fairfield, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-3-120-56-246.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status
200
date
Mon, 11 Mar 2019 09:06:04 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
37
content-type
image/gif
json
idg.blueconic.net/DG/DEFAULT/rest/rpc/
105 B
673 B
XHR
General
Full URL
https://idg.blueconic.net/DG/DEFAULT/rest/rpc/json?referer=https%3A%2F%2Fwww.csoonline.com%2Farticle%2F3345972%2Fqbot-malware-resurfaces-in-new-attack-against-businesses.html&bcsessionid=No%20profile%20present%20and%20will%20not%20be%20created.&bctempid=&overruleReferrer=&time=2019-03-11T09%3A06%3A04%2B00%3A00&ts=1552295164663
Requested by
Host: cdn.blueconic.net
URL: https://cdn.blueconic.net/idg.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.226.72.36 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-226-72-36.compute-1.amazonaws.com
Software
- /
Resource Hash
36d94dfb0e48cce0dea2052d2d6229908ea8dc30211f6a33f552e882484349cc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Origin
https://www.csoonline.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
text/plain

Response headers

date
Mon, 11 Mar 2019 09:06:04 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-permitted-cross-domain-policies
master-only
p3p
policyref="", CP="DSP"
status
200
content-length
113
x-xss-protection
1; mode=block
pragma
no-cache
server
-
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.csoonline.com
cache-control
no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials
true
x-robots-tag
noindex, nofollow
expires
Thu, 01 Jan 1970 00:00:00 GMT
json
idg.blueconic.net/DG/DEFAULT/rest/rpc/
105 B
672 B
XHR
General
Full URL
https://idg.blueconic.net/DG/DEFAULT/rest/rpc/json?referer=https%3A%2F%2Fwww.csoonline.com%2Farticle%2F3345972%2Fqbot-malware-resurfaces-in-new-attack-against-businesses.html&bcsessionid=No%20profile%20present%20and%20will%20not%20be%20created.&bctempid=&overruleReferrer=&time=2019-03-11T09%3A06%3A04%2B00%3A00&ts=1552295164669
Requested by
Host: cdn.blueconic.net
URL: https://cdn.blueconic.net/idg.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.226.72.36 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-226-72-36.compute-1.amazonaws.com
Software
- /
Resource Hash
7637c18add506b00a934e6091b0f86d2d21160b1b56f43e3f90ba59ad938c187
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Origin
https://www.csoonline.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
text/plain

Response headers

date
Mon, 11 Mar 2019 09:06:04 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-permitted-cross-domain-policies
master-only
p3p
policyref="", CP="DSP"
status
200
content-length
113
x-xss-protection
1; mode=block
pragma
no-cache
server
-
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.csoonline.com
cache-control
no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials
true
x-robots-tag
noindex, nofollow
expires
Thu, 01 Jan 1970 00:00:00 GMT
widgetGlobalEvent
log.outbrainimg.com/loggerServices/
4 B
299 B
XHR
General
Full URL
https://log.outbrainimg.com/loggerServices/widgetGlobalEvent?rId=33c29b811e63f1b918200fa374afe808&pvId=33c29b811e63f1b918200fa374afe808&sid=1464780&pid=28429&idx=0&wId=100&pad=6&org=0&tm=1637&eT=0&wRV=01020406&pVis=1&lsd=98b0a556-a5d6-4438-a925-0cb73131ac4a&eIdx=&cheq=0&ab=0&wl=0
Requested by
Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js?_=1552295161680
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
50.31.142.51 Chicago, United States, ASN22075 (AS-OUTBRAIN - Outbrain, Inc., US),
Reverse DNS
chi.outbrain.com
Software
/
Resource Hash
b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Origin
https://www.csoonline.com

Response headers

Pragma
no-cache
Date
Mon, 11 Mar 2019 09:06:05 GMT
Access-Control-Allow-Methods
GET,POST
Content-Type
application/json; charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
no-cache, no-store, must-revalidate
Connection
close
Content-Length
4
Expires
0
collect
www.google-analytics.com/r/
35 B
111 B
Image
General
Full URL
https://www.google-analytics.com/r/collect?v=1&_v=j73&a=1456867052&t=pageview&_s=1&dl=https%3A%2F%2Fwww.csoonline.com%2Farticle%2F3345972%2Fqbot-malware-resurfaces-in-new-attack-against-businesses.html&dr=https%3A%2F%2Ft.co%2FaHrXW7ESH9&ul=en-us&de=UTF-8&dt=Qbot%20malware%20resurfaces%20in%20new%20attack%20against%20businesses%20%7C%20CSO%20Online&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=aGBAAEAjAAQC~&jid=483604776&gjid=1234511879&cid=2113975724.1552295165&uid=&tid=UA-300704-9&_gid=1587423069.1552295165&_r=1&gtm=2wg2q1WR6LD2P&cg1=malware&cg2=news&cg3=Lucian%20Constantin&cg4=article&cg5=us&cd1=false&cd2=&cd3=&cd4=notapplicable&cd5=Mon%2C%2011%20Mar%202019%2009%3A06%3A02%20GMT&cd6=Mon%2C%2011%20Mar%202019%2009%3A06%3A02%20GMT&cd7=0&cd8=1&cd9=production&cd10=cso%20online&cd11=US&cd12=enterprise&cd13=false&cd14=&cd15=Web&cd16=&cd17=malware&cd18=3513&cd19=windows%20security%2Csecurity&cd20=3513%2C3864%2C2206&cd21=&cd22=&cd23=&cd24=&cd25=&cd26=news&cd27=3345972&cd28=article&cd29=Lucian%20Constantin&cd30=cso&cd31=true&cd32=&cd33=&cd34=&cd35=&cd36=&cd37=false&cd38=1&cd39=2019-03-01&cd40=2019-03-01&cd41=9&cd42=9&cd43=false&cd44=false&cd45=&cd46=false&cd47=&cd48=&cd49=&cd50=&cd51=&cd52=&cd53=67&cd54=965%2C941&cd55=&cd56=&cd79=us&cd80=global&cd81=false&cd82=false&z=191279461
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:816::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 11 Mar 2019 09:06:04 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
access-control-allow-origin
*
content-type
image/gif
status
200
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
get
mv.outbrain.com/Multivac/api/
39 KB
9 KB
Script
General
Full URL
https://mv.outbrain.com/Multivac/api/get?url=https%3A%2F%2Fwww.csoonline.com%2Farticle%2F3345972%2Fqbot-malware-resurfaces-in-new-attack-against-businesses.html&settings=true&recs=true&widgetJSId=AR_1&key=NANOWDGT01&version=01020406&apv=true&sig=Mf8AN16n&format=html&rand=53761&lsd=98b0a556-a5d6-4438-a925-0cb73131ac4a&lsdt=1552295164253&osLang=en-US&va=true&cmpStat=1&scrW=1600&scrH=1200&t=MV8zM2MyOWI4MTFlNjNmMWI5MTgyMDBmYTM3NGFmZTgwOF8w&winW=1600&winH=1200&adblck=false&secured=true&feedIdx=0&lastIdx=0&lastCardIdx=0&fAB=no_abtest&ref=https%3A%2F%2Ft.co%2FaHrXW7ESH9
Requested by
Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/nanoWidget/01020406/module/streamFeed.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.2 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
/
Resource Hash
0c8e60cb95d6b536c9e6c56a94d313fc0891ea0efc5a018da59acdc2ac6535c1

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:04 GMT
content-encoding
gzip
traffic-path
NYDC1, JFK, HHN, Europe1
x-cache
MISS, MISS
p3p
policyref="http://www.outbrain.com/w3c/p3p.xml",CP="NOI NID CURa DEVa TAIa PSAa PSDa OUR IND UNI"
status
200
content-length
9404
x-served-by
cache-jfk8131-JFK, cache-hhn1534-HHN
pragma
no-cache
x-timer
S1552295165.749131,VS0,VE206
vary
Accept-Encoding, User-Agent
content-type
application/json; charset=UTF-8
via
1.1 varnish, 1.1 varnish
expires
Thu, 01 Jan 1970 00:00:00 GMT
cache-control
no-cache
backend-ip
104.156.90.31
accept-ranges
bytes, bytes
x-cache-hits
0, 0
px.gif
p.skimresources.com/
43 B
107 B
Image
General
Full URL
https://p.skimresources.com/px.gif?ch=1&rn=7.990612778474924
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.139.128.10 Dallas, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
Software
UploadServer /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:04 GMT
status
200
x-guploader-uploadid
AEnB2UqqHJYj8L-BZty9QWUmBU5axc_BNXEV_cFMA3iffmPZObDqCGrW5ut8lZEdh31-pfLUtCz1PkiG0oS75guIZDy_lJC4Ew
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
4
x-goog-stored-content-encoding
identity
content-length
43
x-hw
1552295164.cds028.pa1.hn,1552295164.cds008.pa1.c
last-modified
Tue, 23 Oct 2018 13:19:28 GMT
server
UploadServer
etag
"f837aa60b6fe83458f790db60d529fc9"
x-goog-hash
crc32c=xra6Ow==, md5=+DeqYLb+g0WPeQ22DVKfyQ==
x-goog-generation
1540300768038458
cache-control
public, max-age=7200
x-goog-stored-content-length
43
accept-ranges
bytes
content-type
image/gif
px.gif
p.skimresources.com/
43 B
471 B
Image
General
Full URL
https://p.skimresources.com/px.gif?ch=2&rn=7.990612778474924
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.139.128.10 Dallas, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
Software
UploadServer /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:04 GMT
status
200
x-guploader-uploadid
AEnB2UqqHJYj8L-BZty9QWUmBU5axc_BNXEV_cFMA3iffmPZObDqCGrW5ut8lZEdh31-pfLUtCz1PkiG0oS75guIZDy_lJC4Ew
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
4
x-goog-stored-content-encoding
identity
content-length
43
x-hw
1552295164.cds028.pa1.hn,1552295164.cds008.pa1.c
last-modified
Tue, 23 Oct 2018 13:19:28 GMT
server
UploadServer
etag
"f837aa60b6fe83458f790db60d529fc9"
x-goog-hash
crc32c=xra6Ow==, md5=+DeqYLb+g0WPeQ22DVKfyQ==
x-goog-generation
1540300768038458
cache-control
public, max-age=7200
x-goog-stored-content-length
43
accept-ranges
bytes
content-type
image/gif
/
r.skimresources.com/api/
Redirect Chain
  • https://r.skimresources.com/api/?callback=skimlinksBeaconSecondaryCallback&data=%7B%22pubcode%22%3A%22111346X1569475%22%2C%22page%22%3A%22https%3A%2F%2Fwww.csoonline.com%2Farticle%2F3345972%2Fqbot-...
  • https://r.skimresources.com/api/?callback=skimlinksBeaconSecondaryCallback&persistence=1&xguid=01D5P00YYZ4891ZGVDP2K16XTN&data=%7B%22pubcode%22%3A%22111346X1569475%22%2C%22page%22%3A%22https%3A%2F%...
183 B
478 B
Script
General
Full URL
https://r.skimresources.com/api/?callback=skimlinksBeaconSecondaryCallback&persistence=1&xguid=01D5P00YYZ4891ZGVDP2K16XTN&data=%7B%22pubcode%22%3A%22111346X1569475%22%2C%22page%22%3A%22https%3A%2F%2Fwww.csoonline.com%2Farticle%2F3345972%2Fqbot-malware-resurfaces-in-new-attack-against-businesses.html%22%2C%22domains%22%3A%5B%22csoconference.com%22%2C%22securitysmartnewsletter.com%22%2C%22twitter.com%22%2C%22linkedin.com%22%2C%22facebook.com%22%2C%22dashboard.csoonline.com%22%2C%22ereg.me%22%2C%22reddit.com%22%2C%22ziprecruiter.com%22%2C%22varonis.com%22%2C%22pluralsight.pxf.io%22%2C%22click.clickntrax.com%22%2C%22clickit.atrrat.com%22%2C%22go.babbel.com%22%2C%22r.securefunnel.io%22%2C%22outside-stories.de%22%2C%22outbrain.com%22%2C%22idg.com%22%2C%22cio.com%22%2C%22computerworld.com%22%2C%22idc.com%22%2C%22idgconnect.com%22%2C%22infoworld.com%22%2C%22itwhitepapers.com%22%2C%22javaworld.com%22%2C%22networkworld.com%22%5D%7D&checksum=591e30f10a212ccefa064e882357dfc9f5bbf27b5356ee172ca6e649cf3d7f8d
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.190.59.101 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
101.59.190.35.bc.googleusercontent.com
Software
openresty/1.11.2.5 /
Resource Hash
3da7b38ea4a200dde862bf0d45ddbbe2056d09e97757387717b2a99fdd52cd8b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:04 GMT
via
1.1 google
x-content-type-options
nosniff
server
openresty/1.11.2.5
access-control-allow-origin
https://www.csoonline.com
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
status
200
access-control-allow-credentials
true
content-type
application/javascript
alt-svc
clear

Redirect headers

date
Mon, 11 Mar 2019 09:06:04 GMT
via
1.1 google
server
openresty/1.11.2.5
access-control-allow-origin
https://www.csoonline.com
location
//r.skimresources.com/api/?callback=skimlinksBeaconSecondaryCallback&persistence=1&xguid=01D5P00YYZ4891ZGVDP2K16XTN&data=%7B%22pubcode%22%3A%22111346X1569475%22%2C%22page%22%3A%22https%3A%2F%2Fwww.csoonline.com%2Farticle%2F3345972%2Fqbot-malware-resurfaces-in-new-attack-against-businesses.html%22%2C%22domains%22%3A%5B%22csoconference.com%22%2C%22securitysmartnewsletter.com%22%2C%22twitter.com%22%2C%22linkedin.com%22%2C%22facebook.com%22%2C%22dashboard.csoonline.com%22%2C%22ereg.me%22%2C%22reddit.com%22%2C%22ziprecruiter.com%22%2C%22varonis.com%22%2C%22pluralsight.pxf.io%22%2C%22click.clickntrax.com%22%2C%22clickit.atrrat.com%22%2C%22go.babbel.com%22%2C%22r.securefunnel.io%22%2C%22outside-stories.de%22%2C%22outbrain.com%22%2C%22idg.com%22%2C%22cio.com%22%2C%22computerworld.com%22%2C%22idc.com%22%2C%22idgconnect.com%22%2C%22infoworld.com%22%2C%22itwhitepapers.com%22%2C%22javaworld.com%22%2C%22networkworld.com%22%5D%7D&checksum=591e30f10a212ccefa064e882357dfc9f5bbf27b5356ee172ca6e649cf3d7f8d
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
status
302
access-control-allow-credentials
true
content-type
text/html
alt-svc
clear
content-length
167
bframe
www.google.com/recaptcha/api2/ Frame FFE7
0
0
Document
General
Full URL
https://www.google.com/recaptcha/api2/bframe?hl=en&v=v1551681158638&k=6LczmkcUAAAAANEO7J277KwH6Kzp6BEQjPTWP4S4&cb=66df14odhxz0
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/api2/v1551681158638/recaptcha__en.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:824::2004 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
GSE /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-ALiSJ8seLmrqV6hZIlihwQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
www.google.com
:scheme
https
:path
/recaptcha/api2/bframe?hl=en&v=v1551681158638&k=6LczmkcUAAAAANEO7J277KwH6Kzp6BEQjPTWP4S4&cb=66df14odhxz0
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html

Response headers

status
200
content-type
text/html; charset=utf-8
cache-control
no-cache, no-store, max-age=0, must-revalidate
pragma
no-cache
expires
Mon, 01 Jan 1990 00:00:00 GMT
date
Mon, 11 Mar 2019 09:06:04 GMT
content-security-policy
script-src 'report-sample' 'nonce-ALiSJ8seLmrqV6hZIlihwQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding
gzip
x-content-type-options
nosniff
x-xss-protection
1; mode=block
content-length
1129
server
GSE
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
g
ck.connatix.com/
46 B
103 B
Script
General
Full URL
https://ck.connatix.com/g?callback=cnxJSONP_8dfca920c946c95e23ff1552295164886
Requested by
Host: cdns.connatix.com
URL: https://cdns.connatix.com/p/1441/min/connatix.renderer.infeed.min_dc.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42::645 , European Union, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Varnish /
Resource Hash
b6c4cbeb4768a00cd24d9859033fe49ba45ed76c425f007e7f19f0218e9d206f

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:04 GMT
via
1.1 varnish
server
Varnish
age
0
x-cache
HIT
status
200
cache-control
no-cache, no-store, must-revalidate, max-age=0
x-cache-hits
0
accept-ranges
bytes
x-timer
S1552295165.913841,VS0,VE0
content-length
46
retry-after
0
x-served-by
cache-fra19148-FRA
r
eb2.3lift.com/
37 B
139 B
Image
General
Full URL
https://eb2.3lift.com/r?inv_code=tan_CSOOnline_MOAP&aid=57173044151873278960&rev_hash=4833279&rr=auction&domain=www.csoonline.com&ref=https%253A%252F%252Fwww.csoonline.com%252Farticle%252F3345972%252Fqbot-malware-resurfaces-in-new-attack-against-businesses.html&pr=t.co&cb=46050
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.120.56.246 Fairfield, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-3-120-56-246.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status
200
date
Mon, 11 Mar 2019 09:06:04 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
37
content-type
image/gif
css
fonts.googleapis.com/
767 B
435 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Lato:400,600
Requested by
Host: spiffymachine.com
URL: https://spiffymachine.com/v2/0/lai9s0WlvrPiQ5L_cdrso4RiyfzVoZU9LvwlSHiKGRQVkAx4Mo_dqdkpNFmmgSH8bT1NgI68uTYHqQUTmjN
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:820::200a , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
ESF /
Resource Hash
06d10ddd446ea86ebea46a23a233c9a5fd8df1ce12dfde397d6edbf273f3b852
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Mon, 11 Mar 2019 09:06:04 GMT
server
ESF
access-control-allow-origin
*
date
Mon, 11 Mar 2019 09:06:04 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
status
200
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
x-xss-protection
1; mode=block
expires
Mon, 11 Mar 2019 09:06:04 GMT
xp35fk24bu8fvo1ajpk3qdt2izxuffjj
automate.linksynergy.com/wakeup/
0
366 B
XHR
General
Full URL
https://automate.linksynergy.com/wakeup/xp35fk24bu8fvo1ajpk3qdt2izxuffjj
Requested by
Host: t.co
URL: https://t.co/aHrXW7ESH9
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.153.195.133 Seattle, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-35-153-195-133.compute-1.amazonaws.com
Software
nginx/1.12.2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Access-Control-Request-Method
PUT
Origin
https://www.csoonline.com
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 11 Mar 2019 09:06:05 GMT
Server
nginx/1.12.2
X-Frame-Options
SAMEORIGIN
Access-Control-Allow-Methods
PUT, OPTIONS
Content-Type
application/json
Access-Control-Allow-Origin
https://www.csoonline.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
Content-Type
Content-Length
0
xp35fk24bu8fvo1ajpk3qdt2izxuffjj
automate-prod.s3.amazonaws.com/info/
151 KB
151 KB
XHR
General
Full URL
https://automate-prod.s3.amazonaws.com/info/xp35fk24bu8fvo1ajpk3qdt2izxuffjj
Requested by
Host: t.co
URL: https://t.co/aHrXW7ESH9
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.218.208.130 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
s3-us-west-2-w.amazonaws.com
Software
AmazonS3 /
Resource Hash
414605cffd0e9743e4798e12e7b2f635180828c036bb973958d3f95555ab07da

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Origin
https://www.csoonline.com

Response headers

Date
Mon, 11 Mar 2019 09:06:06 GMT
Last-Modified
Mon, 11 Mar 2019 06:24:40 GMT
Server
AmazonS3
x-amz-request-id
E6AFE770C928D716
ETag
"029773d907ff40be1c5bba5c37f64613"
Vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method
Access-Control-Allow-Methods
GET
Content-Type
text/plain
Access-Control-Allow-Origin
*
Access-Control-Max-Age
3000
Accept-Ranges
bytes
Content-Length
154291
x-amz-id-2
fUECwmkoOyq+Erk+yAyotA+W6ijJse0EIy7RO3gmrfaRKFe11fOELzmdG1Z6M9BFSyxoLu9hV0c=
pls
core.connatix.com/ Frame 026E
5 KB
2 KB
Script
General
Full URL
https://core.connatix.com/pls?callback=jQuery32104905654625031579_1552295164870&token=f073f8b0-983a-43af-97ea-148dc87d9994&p=https%3A%2F%2Fwww.csoonline.com%2Farticle%2F3345972%2Fqbot-malware-resurfaces-in-new-attack-against-businesses.html&c_v=1441_0_5_1_0&page_guid=2383761cbdc69449a85a1552295164996&spp=1&_=1552295164871
Requested by
Host: cdns.connatix.com
URL: https://cdns.connatix.com/p/1441/min/connatix.renderer.infeed.min_dc.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.88.112.216 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-88-112-216.compute-1.amazonaws.com
Software
nginx/1.12.2 /
Resource Hash
f02d7c693c8e6915039e6b2f0f7fb3513015cbffa0ebe1994120bfb4240c02b9

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status
200
date
Mon, 11 Mar 2019 09:06:05 GMT
content-encoding
gzip
server
nginx/1.12.2
access-control-allow-origin
*
widgetGlobalEvent
log.outbrainimg.com/loggerServices/
4 B
299 B
XHR
General
Full URL
https://log.outbrainimg.com/loggerServices/widgetGlobalEvent?rId=c9dac19d72260a4fc475ed22cb28d455&pvId=33c29b811e63f1b918200fa374afe808&sid=1464780&pid=28429&idx=1&wId=972&pad=0&org=3&tm=1964&eT=0&wRV=01020406&pVis=0&lsd=98b0a556-a5d6-4438-a925-0cb73131ac4a&eIdx=&ab=0&wl=0
Requested by
Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js?_=1552295161680
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
50.31.142.19 Chicago, United States, ASN22075 (AS-OUTBRAIN - Outbrain, Inc., US),
Reverse DNS
chi.outbrain.com
Software
/
Resource Hash
b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Origin
https://www.csoonline.com

Response headers

Pragma
no-cache
Date
Mon, 11 Mar 2019 09:06:05 GMT
Access-Control-Allow-Methods
GET,POST
Content-Type
application/json; charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
no-cache, no-store, must-revalidate
Connection
close
Content-Length
4
Expires
0
widgetGlobalEvent
log.outbrainimg.com/loggerServices/
4 B
299 B
XHR
General
Full URL
https://log.outbrainimg.com/loggerServices/widgetGlobalEvent?rId=ac0aa684549a6fecb772f0334886a247&pvId=33c29b811e63f1b918200fa374afe808&sid=1464780&pid=28429&idx=2&wId=973&pad=2&org=0&tm=1970&eT=0&wRV=01020406&pVis=1&lsd=98b0a556-a5d6-4438-a925-0cb73131ac4a&eIdx=&ab=0&wl=0
Requested by
Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js?_=1552295161680
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
50.31.142.19 Chicago, United States, ASN22075 (AS-OUTBRAIN - Outbrain, Inc., US),
Reverse DNS
chi.outbrain.com
Software
/
Resource Hash
b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Origin
https://www.csoonline.com

Response headers

Pragma
no-cache
Date
Mon, 11 Mar 2019 09:06:05 GMT
Access-Control-Allow-Methods
GET,POST
Content-Type
application/json; charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
no-cache, no-store, must-revalidate
Connection
close
Content-Length
4
Expires
0
eyJpdSI6IjFkYzExYTQ2ZGM2OTM1ZmMxZGI0NDMxOTc0NmU0ZmY0ZmM3Y2YwY2ZiZTVjNzgyOTAyOTZiZTJlODUxOTUxNjciLCJ3Ijo0MDAsImgiOjMwMCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp
images.outbrainimg.com/transform/v3/
40 KB
40 KB
Image
General
Full URL
https://images.outbrainimg.com/transform/v3/eyJpdSI6IjFkYzExYTQ2ZGM2OTM1ZmMxZGI0NDMxOTc0NmU0ZmY0ZmM3Y2YwY2ZiZTVjNzgyOTAyOTZiZTJlODUxOTUxNjciLCJ3Ijo0MDAsImgiOjMwMCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.70.82 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-70-82.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
d09cac80198d84f2ada470d13889756debe35785a0485205640538fc7f7555b4
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains;

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security
max-age=0; includeSubDomains;
Content-Encoding
gzip
Last-Modified
Thu, 21 Feb 2019 11:30:35 GMT
Date
Mon, 11 Mar 2019 09:06:05 GMT
Vary
Accept-Encoding
Content-Type
image/webp
Cache-Control
max-age=923826
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
40758
eyJpdSI6IjkyZDFhOGVhZDhmOWE4MDQxMjQ2ZDdiOTIyNjQ1NjZhYzcyY2JlOTI2ZWI1MjU2Y2VmMTM3YjUxMTQ0NmVjMjUiLCJ3Ijo0MCwiaCI6NDAsImQiOjIuMCwiY3MiOjAsImYiOjR9.webp
images.outbrainimg.com/transform/v3/
1 KB
2 KB
Image
General
Full URL
https://images.outbrainimg.com/transform/v3/eyJpdSI6IjkyZDFhOGVhZDhmOWE4MDQxMjQ2ZDdiOTIyNjQ1NjZhYzcyY2JlOTI2ZWI1MjU2Y2VmMTM3YjUxMTQ0NmVjMjUiLCJ3Ijo0MCwiaCI6NDAsImQiOjIuMCwiY3MiOjAsImYiOjR9.webp
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.70.82 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-70-82.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
97fcd922e5c4c070fba458eee6dd50c3133431ab01e93041ac5c8840634f9261
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains;

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security
max-age=0; includeSubDomains;
Content-Encoding
gzip
Last-Modified
Wed, 20 Feb 2019 19:25:26 -05:00
Date
Mon, 11 Mar 2019 09:06:05 GMT
Vary
Accept-Encoding
Content-Type
image/webp
Cache-Control
max-age=1398060
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
1522
eyJpdSI6IjBhNTFmYTM3ZjlhY2NiNDRhNTJmZjI0ZjA5YmUyNWRjYjljM2NiZTU0ZjYxMTdkMWU1MWVkNmNhYTE0YmNkZjIiLCJ3Ijo0MDAsImgiOjMwMCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp
images.outbrainimg.com/transform/v3/
22 KB
23 KB
Image
General
Full URL
https://images.outbrainimg.com/transform/v3/eyJpdSI6IjBhNTFmYTM3ZjlhY2NiNDRhNTJmZjI0ZjA5YmUyNWRjYjljM2NiZTU0ZjYxMTdkMWU1MWVkNmNhYTE0YmNkZjIiLCJ3Ijo0MDAsImgiOjMwMCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.70.82 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-70-82.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
0613a840d5b0798e90d044ea6f3d38f1ac59389786cb8ea150c8fb24043f0504
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains;

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security
max-age=0; includeSubDomains;
Content-Encoding
gzip
Last-Modified
Thu, 28 Feb 2019 11:24:25 GMT
Date
Mon, 11 Mar 2019 09:06:05 GMT
Vary
Accept-Encoding
Content-Type
image/webp
Cache-Control
max-age=1523847
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
22833
eyJpdSI6IjFhODY5MWRhNzZkM2ExYTdiMjc5ODVkMjUwYzJmZTM3ZGQxMGRkOWFhOWU4ZTFlODJkNzE5NzRiMTRmMWZmOWUiLCJ3Ijo0MDAsImgiOjMwMCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp
images.outbrainimg.com/transform/v3/
102 KB
102 KB
Image
General
Full URL
https://images.outbrainimg.com/transform/v3/eyJpdSI6IjFhODY5MWRhNzZkM2ExYTdiMjc5ODVkMjUwYzJmZTM3ZGQxMGRkOWFhOWU4ZTFlODJkNzE5NzRiMTRmMWZmOWUiLCJ3Ijo0MDAsImgiOjMwMCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.70.82 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-70-82.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
61c790f0e933abdb14e7b7d525814fe726a3efcf6c2f3897dc8f8a89e0f8c8b8
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains;

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security
max-age=0; includeSubDomains;
Content-Encoding
gzip
Last-Modified
Tue, 19 Feb 2019 11:16:36 -05:00
Date
Mon, 11 Mar 2019 09:06:05 GMT
Vary
Accept-Encoding
Content-Type
image/webp
Cache-Control
max-age=761725
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
104118
eyJpdSI6IjYxZDcwNzI4YTFhZjFlZjU5NWVmMzJkOTVmYmUyZDQyMzgyMGJjZjM3MTEwODE3ZTY2ODI1MGIwYTdhNGRhMmYiLCJ3Ijo0MDAsImgiOjMwMCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp
images.outbrainimg.com/transform/v3/
17 KB
18 KB
Image
General
Full URL
https://images.outbrainimg.com/transform/v3/eyJpdSI6IjYxZDcwNzI4YTFhZjFlZjU5NWVmMzJkOTVmYmUyZDQyMzgyMGJjZjM3MTEwODE3ZTY2ODI1MGIwYTdhNGRhMmYiLCJ3Ijo0MDAsImgiOjMwMCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.70.82 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-70-82.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
a18dad582d93588b2468876414bf47d4cca0de272fdc2bed3f5eeec3e171deb3
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains;

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security
max-age=0; includeSubDomains;
Content-Encoding
gzip
Last-Modified
Thu, 07 Feb 2019 22:29:35 GMT
Date
Mon, 11 Mar 2019 09:06:05 GMT
Vary
Accept-Encoding
Content-Type
image/webp
Cache-Control
max-age=1458603
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
17829
eyJpdSI6IjNmMzkzMzI1MmQ2ODAzODBlZTNmMTA0MTA3ZWI0NTUyZDM4MzM1ZGE3NDNmZGMxYzFlZWI1MTI4M2Y4MjFkOWEiLCJ3Ijo0MDAsImgiOjMwMCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp
images.outbrainimg.com/transform/v3/
39 KB
39 KB
Image
General
Full URL
https://images.outbrainimg.com/transform/v3/eyJpdSI6IjNmMzkzMzI1MmQ2ODAzODBlZTNmMTA0MTA3ZWI0NTUyZDM4MzM1ZGE3NDNmZGMxYzFlZWI1MTI4M2Y4MjFkOWEiLCJ3Ijo0MDAsImgiOjMwMCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.70.82 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-70-82.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
85049fe919f9908b6daf11500e28f10921f33c44dcd76d3600dc5307269e59a6
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains;

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security
max-age=0; includeSubDomains;
Content-Encoding
gzip
Last-Modified
Wed, 30 Jan 2019 10:30:24 GMT
Date
Mon, 11 Mar 2019 09:06:05 GMT
Vary
Accept-Encoding
Content-Type
image/webp
Cache-Control
max-age=1471667
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
39466
CSO-logo-black-for-ins.png
idge.staticworld.net/ins/
5 KB
5 KB
Image
General
Full URL
https://idge.staticworld.net/ins/CSO-logo-black-for-ins.png
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.165 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
bfcd89614e4c5a8445a83d1aefa355494827569b86214432a2e44a99b26b25a7

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-amz-version-id
u1yWaZ4dYi5AEZBMvpCz64gUZ2EGejr9
via
1.1 varnish, 1.1 varnish
age
260481
x-cache
HIT, HIT
status
200
date
Mon, 11 Mar 2019 09:06:05 GMT
content-length
5196
x-amz-id-2
Pnk28DvHGKnrEwsK0n2nULYRQagoW6S+pCX/gtxxqHJsw3Uf13BNhFF0IoiFWUSaPdHb9Hvo0Ao=
x-served-by
cache-jfk8133-JFK, cache-hhn1538-HHN
last-modified
Tue, 27 Mar 2018 00:10:11 GMT
server
AmazonS3
x-timer
S1552295165.048745,VS0,VS0,VE0
etag
"9968b8136eeba2f2485b2162cd66d371"
x-amz-request-id
CC1279DB220D7E80
cache-control
public, max-age=2592000
accept-ranges
bytes
content-type
image/png
x-cache-hits
1, 1
uve8rGF0MlFrrT4IoUQzVtjbfyvz8bDPlXMhdmW96HIK8bQOkpGrCHvrBwOjItCV2FUWCBRaecOI8jyvw
spiffymachine.com/v2/0/
358 B
489 B
Fetch
General
Full URL
https://spiffymachine.com/v2/0/uve8rGF0MlFrrT4IoUQzVtjbfyvz8bDPlXMhdmW96HIK8bQOkpGrCHvrBwOjItCV2FUWCBRaecOI8jyvw
Requested by
Host: spiffymachine.com
URL: https://spiffymachine.com/v2/0/cyd3Vkrqtd-ClWmwn4oT2UgRVFzxMujpGSwHmogdm3LpvfSUBhItArin36Z82cfR8fnYg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.201.98.64 Ann Arbor, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
64.98.201.35.bc.googleusercontent.com
Software
/
Resource Hash
ff2d9713b2a879d780a4676b43882f1ac9cf83b235005b419ca3aada51ecb912

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Origin
https://www.csoonline.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Mon, 11 Mar 2019 09:06:05 GMT
x-datacenter
gce-europe-west3
status
200
vary
Accept-Encoding
access-control-allow-methods
POST, OPTIONS
content-type
application/json; charset=utf-8
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
x-hostname
claire
timing-allow-origin
*
access-control-allow-headers
DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Cookie
content-length
358
expires
Mon, 11 Mar 2019 09:06:04 GMT
S6uyw4BMUTPHjx4wXiWtFCc.woff2
fonts.gstatic.com/s/lato/v14/
14 KB
14 KB
Font
General
Full URL
https://fonts.gstatic.com/s/lato/v14/S6uyw4BMUTPHjx4wXiWtFCc.woff2
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:825::2003 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
52726fb580d6bffc46615863ddbf4c319524b5a68fb484be2972bdad4fd0310d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://fonts.googleapis.com/css?family=Lato:400,600
Origin
https://www.csoonline.com

Response headers

date
Fri, 08 Mar 2019 23:44:00 GMT
x-content-type-options
nosniff
last-modified
Wed, 11 Oct 2017 18:23:20 GMT
server
sffe
age
206525
content-type
font/woff2
status
200
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-origin
*
content-length
13944
x-xss-protection
1; mode=block
expires
Sat, 07 Mar 2020 23:44:00 GMT
iab
api.skimlinks.mgr.consensu.org/
772 B
638 B
XHR
General
Full URL
https://api.skimlinks.mgr.consensu.org/iab
Requested by
Host: s.skimresources.com
URL: https://s.skimresources.com/js/111346X1569475.skimlinks.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.190.40.172 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
172.40.190.35.bc.googleusercontent.com
Software
nginx/1.14.0 /
Resource Hash
4898c2b9f8c2f931ef6a819d36e0019867931d9519af933ab4bd5edce724b2a8
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Origin
https://www.csoonline.com

Response headers

date
Mon, 11 Mar 2019 09:06:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
nginx/1.14.0
access-control-allow-headers
*
status
200
vary
Accept-Encoding
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin
https://www.csoonline.com
access-control-allow-credentials
true
content-type
application/json
alt-svc
clear
via
1.1 google
track.php
t.skimresources.com/api/
22 B
411 B
XHR
General
Full URL
https://t.skimresources.com/api/track.php
Requested by
Host: s.skimresources.com
URL: https://s.skimresources.com/js/111346X1569475.skimlinks.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.201.67.47 Ann Arbor, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
47.67.201.35.bc.googleusercontent.com
Software
Python/3.7 aiohttp/3.5.4 /
Resource Hash
fcc83a5b6aef86420c1ad553167106df96bd0ff4192ffe52b1647599948edbcf
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Origin
https://www.csoonline.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

pragma
no-cache
date
Mon, 11 Mar 2019 09:06:05 GMT
via
1.1 google
x-content-type-options
nosniff
server
Python/3.7 aiohttp/3.5.4
access-control-allow-headers
Origin, Accept, Content-Type, X-Requested-With, X-CSRF-Token
status
200
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/plain; charset=utf-8, application/javascript
access-control-allow-origin
https://www.csoonline.com
cache-control
no-store, no-cache, must-revalidate
access-control-allow-credentials
true
warning
299 - "Deprecated API"
alt-svc
clear
content-length
22
link
t.skimresources.com/api/
22 B
92 B
XHR
General
Full URL
https://t.skimresources.com/api/link
Requested by
Host: s.skimresources.com
URL: https://s.skimresources.com/js/111346X1569475.skimlinks.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.201.67.47 Ann Arbor, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
47.67.201.35.bc.googleusercontent.com
Software
Python/3.7 aiohttp/3.5.4 /
Resource Hash
fcc83a5b6aef86420c1ad553167106df96bd0ff4192ffe52b1647599948edbcf
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Origin
https://www.csoonline.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

pragma
no-cache
date
Mon, 11 Mar 2019 09:06:05 GMT
via
1.1 google
x-content-type-options
nosniff
server
Python/3.7 aiohttp/3.5.4
access-control-allow-headers
Origin, Accept, Content-Type, X-Requested-With, X-CSRF-Token
status
200
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/plain; charset=utf-8, application/javascript
access-control-allow-origin
https://www.csoonline.com
cache-control
no-store, no-cache, must-revalidate
access-control-allow-credentials
true
warning
299 - "Deprecated API"
alt-svc
clear
content-length
22
xp35fk24bu8fvo1ajpk3qdt2izxuffjj
automate.linksynergy.com/wakeup/
19 B
563 B
XHR
General
Full URL
https://automate.linksynergy.com/wakeup/xp35fk24bu8fvo1ajpk3qdt2izxuffjj
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.73.80.148 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-52-73-80-148.compute-1.amazonaws.com
Software
nginx/1.12.2 /
Resource Hash
90ac357d2d308c8bb95d1b9ee610fb203fddfe3ea02c74a0140983d435a96694
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Origin
https://www.csoonline.com

Response headers

Date
Mon, 11 Mar 2019 09:06:06 GMT
Server
nginx/1.12.2
X-Frame-Options
SAMEORIGIN
Access-Control-Allow-Methods
PUT, OPTIONS
P3p
CP="NOI DSP COR CURa ADMa DEVa OUR BUS STA"
Access-Control-Allow-Origin
https://www.csoonline.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json
Access-Control-Allow-Headers
Content-Type
Content-Length
19
/
www.facebook.com/tr/ Frame 5C1D
0
0
Document
General
Full URL
https://www.facebook.com/tr/
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5WC9SK&l=dataLayer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f11c:8083:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash

Request headers

:method
POST
:authority
www.facebook.com
:scheme
https
:path
/tr/
content-length
4000
pragma
no-cache
cache-control
no-cache
origin
https://www.csoonline.com
upgrade-insecure-requests
1
content-type
application/x-www-form-urlencoded
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
accept-encoding
gzip, deflate, br
Origin
https://www.csoonline.com
Upgrade-Insecure-Requests
1
Content-Type
application/x-www-form-urlencoded
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html

Response headers

status
200
content-type
text/plain
access-control-allow-origin
https://www.csoonline.com
access-control-allow-credentials
true
content-length
0
server
proxygen-bolt
date
Mon, 11 Mar 2019 09:06:05 GMT
g
rtb.connatix.com/
82 B
280 B
Script
General
Full URL
https://rtb.connatix.com/g?c_pw=400&c_ph=225&c_tk=C018218D-4AD0-4E01-8158-045425E65946&c_bu=https%3A%2F%2Fwww.csoonline.com%2Farticle%2F3345972%2Fqbot-malware-resurfaces-in-new-attack-against-businesses.html&c_ivt=0&connatix_sess=HjjZV2nAJv5niGLZd872dlZ5PIyQMBnpa59nxUENYN082srBW7qrvZeU_KNd0W9letY76YmXPTBkXph9wY83KOaI_7EXr4czl8aNBI49dMj68DTuYQ3oiuNDS-jD4NheEXFTXLssOMxuWhOPzg5smPS3Xbpq273NfepxGqSEjYRcIMzfaCH23oO6RHeWDtRY&notServed=false&xplr=false&c_s=false&c_pl=H7C0g8Gg_W36JEzDPrtA6CfAUAC6s-L0MqtAOtkrV8TC3aFVRq258ti5r4Cwibh00FDsVcaZJl6YmfyZeWissJtBukiU5r4yGeNBbgmYlGn_8D-Qywb1UkCNkqDaiw2P4ZK-3v6lCxGP-ffvodDrsDKzwCPmAJMkZlRps3OyU-BU3Hv05ib1C93Qq6noxnDeEBGIuNRs-QaGyZ1N2juzUn76apRqWGfaR524tnkGo3KQbKBO9w4OTUkdkHNXa2Sx6Z2Sl3ZPpGSVKqda0OGmZw&gdpr=1&med_id=712028&request_guid=248e8e6466bfed6434a71552295166621&req_no=0&p=https%3A%2F%2Fwww.csoonline.com%2Farticle%2F3345972%2Fqbot-malware-resurfaces-in-new-attack-against-businesses.h&c_v=1441_0_5_1_0&callback=cnxJSONP_eec227a1f53bfc0b8a781552295166621
Requested by
Host: cdns.connatix.com
URL: https://cdns.connatix.com/p/1441/min/connatix.renderer.infeed.min_dc.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.86.200.205 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-52-86-200-205.compute-1.amazonaws.com
Software
nginx/1.12.2 /
Resource Hash
53703bf2fc4b5d2b3065102a19f44575c8c131694de7a15d613e4023db1aeb6e

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Mon, 11 Mar 2019 09:06:07 GMT
Content-Encoding
gzip
Server
nginx/1.12.2
Connection
keep-alive
Content-Length
101
1.jpg
i.connatix.com/s3/connatix-uploads/93ede1c3-b102-4e03-a4e6-df973a05e620/
19 KB
19 KB
Image
General
Full URL
https://i.connatix.com/s3/connatix-uploads/93ede1c3-b102-4e03-a4e6-df973a05e620/1.jpg?mode=stretch&connatiximg=true&scale=both&height=225&width=400
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42::645 , European Union, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
/
Resource Hash
f75e9ba57ce68d261291eebb9fcebbc49cf193891af925f37256528354f7a6b2

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 09:06:06 GMT
via
1.1 varnish, 1.1 varnish
age
971463
x-cache
HIT, HIT
content-type
image/jpeg
status
200
cache-control
max-age=31557600
x-cache-hits
1, 1
accept-ranges
bytes
x-timer
S1552295167.772309,VS0,VE0
access-control-allow-origin
*
content-length
19469
x-served-by
cache-sjc3129-SJC, cache-fra19148-FRA
r
trk.connatix.com/ Frame 026E
0
153 B
Image
General
Full URL
https://trk.connatix.com/r?connatix_sess=HjjZV2nAJv5niGLZd872dlZ5PIyQMBnpa59nxUENYN082srBW7qrvZeU_KNd0W9letY76YmXPTBkXph9wY83KOaI_7EXr4czl8aNBI49dMj68DTuYQ3oiuNDS-jD4NheEXFTXLssOMxuWhOPzg5smPS3Xbpq273NfepxGqSEjYRcIMzfaCH23oO6RHeWDtRY&videoID=712028&c_pl=H7C0g8Gg_W36JEzDPrtA6CfAUAC6s-L0MqtAOtkrV8TC3aFVRq258ti5r4Cwibh00FDsVcaZJl6YmfyZeWissJtBukiU5r4yGeNBbgmYlGn_8D-Qywb1UkCNkqDaiw2P4ZK-3v6lCxGP-ffvodDrsDKzwCPmAJMkZlRps3OyU-BU3Hv05ib1C93Qq6noxnDeEBGIuNRs-QaGyZ1N2juzUn76apRqWGfaR524tnkGo3KQbKBO9w4OTUkdkHNXa2Sx6Z2Sl3ZPpGSVKqda0OGmZw&p=https%3A%2F%2Fwww.csoonline.com%2Farticle%2F3345972%2Fqbot-malware-resurfaces-in-new-attack-against-businesses.h&c_v=1441_0_5_1_0&spp=1
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.199.191.3 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-199-191-3.compute-1.amazonaws.com
Software
nginx/1.12.2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Mon, 11 Mar 2019 09:06:07 GMT
Server
nginx/1.12.2
Connection
keep-alive
Content-Length
0
vwt
trk.connatix.com/ Frame 026E
0
153 B
Image
General
Full URL
https://trk.connatix.com/vwt?connatix_sess=HjjZV2nAJv5niGLZd872dlZ5PIyQMBnpa59nxUENYN082srBW7qrvZeU_KNd0W9letY76YmXPTBkXph9wY83KOaI_7EXr4czl8aNBI49dMj68DTuYQ3oiuNDS-jD4NheEXFTXLssOMxuWhOPzg5smPS3Xbpq273NfepxGqSEjYRcIMzfaCH23oO6RHeWDtRY&c_vid=712028&c_pl=H7C0g8Gg_W36JEzDPrtA6CfAUAC6s-L0MqtAOtkrV8TC3aFVRq258ti5r4Cwibh00FDsVcaZJl6YmfyZeWissJtBukiU5r4yGeNBbgmYlGn_8D-Qywb1UkCNkqDaiw2P4ZK-3v6lCxGP-ffvodDrsDKzwCPmAJMkZlRps3OyU-BU3Hv05ib1C93Qq6noxnDeEBGIuNRs-QaGyZ1N2juzUn76apRqWGfaR524tnkGo3KQbKBO9w4OTUkdkHNXa2Sx6Z2Sl3ZPpGSVKqda0OGmZw&p=https%3A%2F%2Fwww.csoonline.com%2Farticle%2F3345972%2Fqbot-malware-resurfaces-in-new-attack-against-businesses.h&c_v=1441_0_5_1_0&spp=1
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.199.191.3 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-199-191-3.compute-1.amazonaws.com
Software
nginx/1.12.2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Mon, 11 Mar 2019 09:06:07 GMT
Server
nginx/1.12.2
Connection
keep-alive
Content-Length
0
1_360_1.mp4
v.connatix.com/93ede1c3-b102-4e03-a4e6-df973a05e620/
2 MB
0
Media
General
Full URL
https://v.connatix.com/93ede1c3-b102-4e03-a4e6-df973a05e620/1_360_1.mp4
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42::645 , European Union, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Accept-Encoding
identity;q=1, *;q=0
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Range
bytes=0-
chrome-proxy
frfr

Response headers

x-amz-version-id
tJjRDkKazP.5NR6_QZqUkkr9z.rUm1Ha
via
1.1 varnish, 1.1 varnish
etag
"99922997e9ad834b0c38cbf087a3cab5-16"
age
971676
x-cache
HIT, HIT
status
206
Content-Length
83302824
x-served-by
cache-sjc3125-SJC, cache-fra19148-FRA
Content-Range
bytes 0-83302823/83302824
last-modified
Thu, 28 Feb 2019 01:54:25 GMT
x-timer
S1552295167.145481,VS0,VE0
date
Mon, 11 Mar 2019 09:06:07 GMT
content-type
video/mp4
access-control-allow-origin
*
cache-control
max-age=31557600
accept-ranges
bytes, bytes
x-cache-hits
0, 0
clr
trk.connatix.com/ Frame 026E
0
153 B
Image
General
Full URL
https://trk.connatix.com/clr?c_vid=712028&id_cl=fc2a5b883e9b5a8cd9611552295167156&c_pl=H7C0g8Gg_W36JEzDPrtA6CfAUAC6s-L0MqtAOtkrV8TC3aFVRq258ti5r4Cwibh00FDsVcaZJl6YmfyZeWissJtBukiU5r4yGeNBbgmYlGn_8D-Qywb1UkCNkqDaiw2P4ZK-3v6lCxGP-ffvodDrsDKzwCPmAJMkZlRps3OyU-BU3Hv05ib1C93Qq6noxnDeEBGIuNRs-QaGyZ1N2juzUn76apRqWGfaR524tnkGo3KQbKBO9w4OTUkdkHNXa2Sx6Z2Sl3ZPpGSVKqda0OGmZw&p=https%3A%2F%2Fwww.csoonline.com%2Farticle%2F3345972%2Fqbot-malware-resurfaces-in-new-attack-against-businesses.h&c_v=1441_0_5_1_0&spp=1
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.208.241.180 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-208-241-180.compute-1.amazonaws.com
Software
nginx/1.12.2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Mon, 11 Mar 2019 09:06:07 GMT
Server
nginx/1.12.2
Connection
keep-alive
Content-Length
0
vwt
trk.connatix.com/ Frame 026E
0
153 B
Image
General
Full URL
https://trk.connatix.com/vwt?c_pl=H7C0g8Gg_W36JEzDPrtA6CfAUAC6s-L0MqtAOtkrV8TC3aFVRq258ti5r4Cwibh00FDsVcaZJl6YmfyZeWissJtBukiU5r4yGeNBbgmYlGn_8D-Qywb1UkCNkqDaiw2P4ZK-3v6lCxGP-ffvodDrsDKzwCPmAJMkZlRps3OyU-BU3Hv05ib1C93Qq6noxnDeEBGIuNRs-QaGyZ1N2juzUn76apRqWGfaR524tnkGo3KQbKBO9w4OTUkdkHNXa2Sx6Z2Sl3ZPpGSVKqda0OGmZw&id_cl=fc2a5b883e9b5a8cd9611552295167156&c_vid=712028&p=https%3A%2F%2Fwww.csoonline.com%2Farticle%2F3345972%2Fqbot-malware-resurfaces-in-new-attack-against-businesses.h&c_v=1441_0_5_1_0&spp=1
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.199.191.3 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-199-191-3.compute-1.amazonaws.com
Software
nginx/1.12.2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Mon, 11 Mar 2019 09:06:07 GMT
Server
nginx/1.12.2
Connection
keep-alive
Content-Length
0
sync
eb2.3lift.com/ Frame 2AAD
Redirect Chain
  • https://eb2.3lift.com/sync?cb=68972
  • https://eb2.3lift.com/sync?cb=68972&ld=1
0
0
Document
General
Full URL
https://eb2.3lift.com/sync?cb=68972&ld=1
Requested by
Host: ib.3lift.com
URL: https://ib.3lift.com/rev/4833279baf8156b5abdae577f01065e6641b1d90/dist/bundle.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.120.56.246 Fairfield, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-3-120-56-246.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash

Request headers

:method
GET
:authority
eb2.3lift.com
:scheme
https
:path
/sync?cb=68972&ld=1
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
accept-encoding
gzip, deflate, br
cookie
tluid=14595276816250468173
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html

Response headers

status
200
date
Mon, 11 Mar 2019 09:06:07 GMT
content-type
text/html; charset=utf-8
content-length
531
set-cookie
sync=CgkIcxDxiYLgli0KCgjmARDxiYLgli0KCQgJEPGJguCWLQoKCKkBEPGJguCWLQoJCDoQ8YmC4JYtCgoIvQEQ8YmC4JYtCgoIjgEQ8YmC4JYtCgoI3gEQ8YmC4JYtCgkIHxDxiYLgli0KCQhfEPGJguCWLQ==; Max-Age=7776000; Expires=Sun, 9 Jun 2019 09:06:07 GMT; Path=/sync; Domain=.3lift.com tluid=14595276816250468173; Max-Age=7776000; Expires=Sun, 9 Jun 2019 09:06:07 GMT; Path=/; Domain=.3lift.com
content-encoding
gzip
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
cache-control
no-cache, no-store, must-revalidate

Redirect headers

status
302
date
Mon, 11 Mar 2019 09:06:07 GMT
content-length
0
set-cookie
tluid=14595276816250468173; Max-Age=7776000; Expires=Sun, 9 Jun 2019 09:06:07 GMT; Path=/; Domain=.3lift.com
location
/sync?cb=68972&ld=1
cache-control
no-cache, no-store, must-revalidate
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
clzXfVAMEqBL2loH2tCQWMia_oKbzrnQxMLgDgdfPZXbYmGaAjqMoWILr86wp3wI1EyOkZJp6i_ycCVXQ
spiffymachine.com/v2/0/
214 B
295 B
Fetch
General
Full URL
https://spiffymachine.com/v2/0/clzXfVAMEqBL2loH2tCQWMia_oKbzrnQxMLgDgdfPZXbYmGaAjqMoWILr86wp3wI1EyOkZJp6i_ycCVXQ
Requested by
Host: spiffymachine.com
URL: https://spiffymachine.com/v2/0/cyd3Vkrqtd-ClWmwn4oT2UgRVFzxMujpGSwHmogdm3LpvfSUBhItArin36Z82cfR8fnYg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.201.98.64 Ann Arbor, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
64.98.201.35.bc.googleusercontent.com
Software
/
Resource Hash
f82702090179a03da2173b04ce94f3b27d955720178b26b22d06f75b39b8aa84

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Origin
https://www.csoonline.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Mon, 11 Mar 2019 09:06:07 GMT
x-datacenter
gce-europe-west3
status
200
vary
Accept-Encoding
access-control-allow-methods
POST, OPTIONS
content-type
application/json; charset=utf-8
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
x-hostname
claire
timing-allow-origin
*
access-control-allow-headers
DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Cookie
content-length
214
expires
Mon, 11 Mar 2019 09:06:06 GMT
p2
sb.scorecardresearch.com/ Frame 026E
Redirect Chain
  • https://sb.scorecardresearch.com/p?c1=2&c2=17958079&ns_ap_an=ConnatixWeb&ns_ap_bi=*null&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1552295167577&ns_st_ec=1&ns_st_sp=1&ns...
  • https://sb.scorecardresearch.com/p2?c1=2&c2=17958079&ns_ap_an=ConnatixWeb&ns_ap_bi=*null&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1552295167577&ns_st_ec=1&ns_st_sp=1&n...
43 B
309 B
Image
General
Full URL
https://sb.scorecardresearch.com/p2?c1=2&c2=17958079&ns_ap_an=ConnatixWeb&ns_ap_bi=*null&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1552295167577&ns_st_ec=1&ns_st_sp=1&ns_st_sc=1&ns_st_psq=1&ns_st_asq=1&ns_st_sq=1&ns_st_ppc=1&ns_st_apc=1&ns_st_spc=1&ns_st_cn=1&ns_st_ev=play&ns_st_po=0&ns_st_cl=1206000&ns_st_pb=1&ns_st_mp=js_api&ns_st_mv=6.1.1.171219&ns_st_pn=1&ns_st_tp=0&ns_st_ci=v_712028&ns_st_pt=0&ns_st_dpt=0&ns_st_ipt=0&ns_st_et=0&ns_st_det=0&ns_st_upc=0&ns_st_dupc=0&ns_st_iupc=0&ns_st_upa=0&ns_st_dupa=0&ns_st_iupa=0&ns_st_lpc=0&ns_st_dlpc=0&ns_st_lpa=0&ns_st_dlpa=0&ns_st_pa=0&ns_ts=1552295167593&ns_st_bc=0&ns_st_dbc=0&ns_st_bt=0&ns_st_dbt=0&ns_st_bp=0&ns_st_lt=15&ns_st_skc=0&ns_st_dskc=0&ns_st_ska=0&ns_st_dska=0&ns_st_skd=0&ns_st_skt=0&ns_st_dskt=0&ns_st_pc=0&ns_st_dpc=0&ns_st_pp=0&ns_st_br=0&ns_st_rt=100&ns_st_ub=0&ns_st_ki=1200000&ns_st_pr=All%20about%20the%20Samsung%20Galaxy%20S10%2C%20MWC%20%2719%20and%20foldable%20phones%20%7C%20TECH(talk)&ns_st_sn=*null&ns_st_en=*null&ns_st_ep=*null&ns_st_ct=vc11&ns_st_ge=*null&ns_st_st=*null&ns_st_ce=*null&ns_st_ia=*null&ns_st_ddt=*null&ns_st_tdt=*null&ns_st_pu=Connatix&ns_st_ti=*null&c3=*null&c4=*null&c6=*null&c7=https%3A%2F%2Fwww.csoonline.com%2Farticle%2F3345972%2Fqbot-malware-resurfaces-in-new-attack-against-businesses.html&c8=&c9=&cs_ucfr=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.162.235 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-162-235.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 11 Mar 2019 09:06:07 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Expires
Mon, 01 Jan 1990 00:00:00 GMT
Connection
keep-alive
Content-Length
43
Content-Type
image/gif

Redirect headers

Location
https://sb.scorecardresearch.com/p2?c1=2&c2=17958079&ns_ap_an=ConnatixWeb&ns_ap_bi=*null&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1552295167577&ns_st_ec=1&ns_st_sp=1&ns_st_sc=1&ns_st_psq=1&ns_st_asq=1&ns_st_sq=1&ns_st_ppc=1&ns_st_apc=1&ns_st_spc=1&ns_st_cn=1&ns_st_ev=play&ns_st_po=0&ns_st_cl=1206000&ns_st_pb=1&ns_st_mp=js_api&ns_st_mv=6.1.1.171219&ns_st_pn=1&ns_st_tp=0&ns_st_ci=v_712028&ns_st_pt=0&ns_st_dpt=0&ns_st_ipt=0&ns_st_et=0&ns_st_det=0&ns_st_upc=0&ns_st_dupc=0&ns_st_iupc=0&ns_st_upa=0&ns_st_dupa=0&ns_st_iupa=0&ns_st_lpc=0&ns_st_dlpc=0&ns_st_lpa=0&ns_st_dlpa=0&ns_st_pa=0&ns_ts=1552295167593&ns_st_bc=0&ns_st_dbc=0&ns_st_bt=0&ns_st_dbt=0&ns_st_bp=0&ns_st_lt=15&ns_st_skc=0&ns_st_dskc=0&ns_st_ska=0&ns_st_dska=0&ns_st_skd=0&ns_st_skt=0&ns_st_dskt=0&ns_st_pc=0&ns_st_dpc=0&ns_st_pp=0&ns_st_br=0&ns_st_rt=100&ns_st_ub=0&ns_st_ki=1200000&ns_st_pr=All%20about%20the%20Samsung%20Galaxy%20S10%2C%20MWC%20%2719%20and%20foldable%20phones%20%7C%20TECH(talk)&ns_st_sn=*null&ns_st_en=*null&ns_st_ep=*null&ns_st_ct=vc11&ns_st_ge=*null&ns_st_st=*null&ns_st_ce=*null&ns_st_ia=*null&ns_st_ddt=*null&ns_st_tdt=*null&ns_st_pu=Connatix&ns_st_ti=*null&c3=*null&c4=*null&c6=*null&c7=https%3A%2F%2Fwww.csoonline.com%2Farticle%2F3345972%2Fqbot-malware-resurfaces-in-new-attack-against-businesses.html&c8=&c9=&cs_ucfr=0
Pragma
no-cache
Date
Mon, 11 Mar 2019 09:06:07 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection
keep-alive
Content-Length
0
Expires
Mon, 01 Jan 1990 00:00:00 GMT
trk.gif
jadserve.postrelease.com/
43 B
408 B
Image
General
Full URL
https://jadserve.postrelease.com/trk.gif?ntv_ui=d59b13b7-0852-4920-9ff9-a80c91aa71f1&ntv_fl=Js-9sgkIMAcneH5bOKp6X9uWqFUFyflRK83NhSSTeR4=&ntv_ht=-iSGXAA&ntv_at=808&ntv_a=AAAAAAAAAAYwIMA&ntv_sat=5&ord=1552295169218&prx_referrer=https%3A%2F%2Ft.co%2FaHrXW7ESH9&ntv_it
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.19.153.98 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-19-153-98.eu-west-1.compute.amazonaws.com
Software
nginx/1.12.1 /
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 11 Mar 2019 09:06:09 GMT
server
nginx/1.12.1
access-control-allow-origin
*
p3p
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-type
image/gif
content-length
43
expires
Mon, 1 Jan 1990 12:00:00 GMT
json
idg.blueconic.net/DG/DEFAULT/rest/rpc/
2 KB
2 KB
XHR
General
Full URL
https://idg.blueconic.net/DG/DEFAULT/rest/rpc/json?referer=https%3A%2F%2Fwww.csoonline.com%2Farticle%2F3345972%2Fqbot-malware-resurfaces-in-new-attack-against-businesses.html&bcsessionid=&bctempid=&overruleReferrer=&time=2019-03-11T09%3A06%3A10%2B00%3A00&ts=1552295170673
Requested by
Host: cdn.blueconic.net
URL: https://cdn.blueconic.net/idg.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.226.72.36 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-226-72-36.compute-1.amazonaws.com
Software
- /
Resource Hash
a8206fb44d253e6a4ab71b4d546c5ca79f03971925b9618d9f15d6b633f48a03
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
Origin
https://www.csoonline.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
text/plain

Response headers

date
Mon, 11 Mar 2019 09:06:10 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-permitted-cross-domain-policies
master-only
p3p
policyref="", CP="DSP"
status
200
content-length
855
x-xss-protection
1; mode=block
pragma
no-cache
server
-
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.csoonline.com
cache-control
no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials
true
x-robots-tag
noindex, nofollow
expires
Thu, 01 Jan 1970 00:00:00 GMT
p2
sb.scorecardresearch.com/ Frame 026E
Redirect Chain
  • https://sb.scorecardresearch.com/p?c1=2&c2=17958079&ns_ap_an=ConnatixWeb&ns_ap_bi=*null&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1552295167577&ns_st_ec=2&ns_st_sp=1&ns...
  • https://sb.scorecardresearch.com/p2?c1=2&c2=17958079&ns_ap_an=ConnatixWeb&ns_ap_bi=*null&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1552295167577&ns_st_ec=2&ns_st_sp=1&n...
43 B
309 B
Image
General
Full URL
https://sb.scorecardresearch.com/p2?c1=2&c2=17958079&ns_ap_an=ConnatixWeb&ns_ap_bi=*null&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1552295167577&ns_st_ec=2&ns_st_sp=1&ns_st_sc=1&ns_st_psq=1&ns_st_asq=1&ns_st_sq=1&ns_st_ppc=1&ns_st_apc=1&ns_st_spc=1&ns_st_cn=1&ns_st_ev=hb&ns_st_po=10002&ns_st_cl=1206000&ns_st_hc=1&ns_st_mp=js_api&ns_st_mv=6.1.1.171219&ns_st_pn=1&ns_st_tp=0&ns_st_ci=v_712028&ns_st_pt=10002&ns_st_dpt=10002&ns_st_ipt=10002&ns_st_et=10002&ns_st_det=10002&ns_st_upc=10002&ns_st_dupc=10002&ns_st_iupc=10002&ns_st_upa=10002&ns_st_dupa=10002&ns_st_iupa=10002&ns_st_lpc=10002&ns_st_dlpc=10002&ns_st_lpa=10002&ns_st_dlpa=10002&ns_st_pa=10002&ns_ts=1552295177595&ns_st_bc=0&ns_st_dbc=0&ns_st_bt=0&ns_st_dbt=0&ns_st_bp=0&ns_st_skc=0&ns_st_dskc=0&ns_st_ska=0&ns_st_dska=0&ns_st_skd=0&ns_st_skt=0&ns_st_dskt=0&ns_st_pc=0&ns_st_dpc=0&ns_st_pp=0&ns_st_br=0&ns_st_rt=100&ns_st_ub=0&ns_st_ki=1200000&ns_st_pr=All%20about%20the%20Samsung%20Galaxy%20S10%2C%20MWC%20%2719%20and%20foldable%20phones%20%7C%20TECH(talk)&ns_st_sn=*null&ns_st_en=*null&ns_st_ep=*null&ns_st_ct=vc11&ns_st_ge=*null&ns_st_st=*null&ns_st_ce=*null&ns_st_ia=*null&ns_st_ddt=*null&ns_st_tdt=*null&ns_st_pu=Connatix&ns_st_ti=*null&c3=*null&c4=*null&c6=*null&c7=https%3A%2F%2Fwww.csoonline.com%2Farticle%2F3345972%2Fqbot-malware-resurfaces-in-new-attack-against-businesses.html&c8=&c9=&cs_ucfr=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.162.235 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-162-235.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db

Request headers

Referer
https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 11 Mar 2019 09:06:17 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Expires
Mon, 01 Jan 1990 00:00:00 GMT
Connection
keep-alive
Content-Length
43
Content-Type
image/gif

Redirect headers

Location
https://sb.scorecardresearch.com/p2?c1=2&c2=17958079&ns_ap_an=ConnatixWeb&ns_ap_bi=*null&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1552295167577&ns_st_ec=2&ns_st_sp=1&ns_st_sc=1&ns_st_psq=1&ns_st_asq=1&ns_st_sq=1&ns_st_ppc=1&ns_st_apc=1&ns_st_spc=1&ns_st_cn=1&ns_st_ev=hb&ns_st_po=10002&ns_st_cl=1206000&ns_st_hc=1&ns_st_mp=js_api&ns_st_mv=6.1.1.171219&ns_st_pn=1&ns_st_tp=0&ns_st_ci=v_712028&ns_st_pt=10002&ns_st_dpt=10002&ns_st_ipt=10002&ns_st_et=10002&ns_st_det=10002&ns_st_upc=10002&ns_st_dupc=10002&ns_st_iupc=10002&ns_st_upa=10002&ns_st_dupa=10002&ns_st_iupa=10002&ns_st_lpc=10002&ns_st_dlpc=10002&ns_st_lpa=10002&ns_st_dlpa=10002&ns_st_pa=10002&ns_ts=1552295177595&ns_st_bc=0&ns_st_dbc=0&ns_st_bt=0&ns_st_dbt=0&ns_st_bp=0&ns_st_skc=0&ns_st_dskc=0&ns_st_ska=0&ns_st_dska=0&ns_st_skd=0&ns_st_skt=0&ns_st_dskt=0&ns_st_pc=0&ns_st_dpc=0&ns_st_pp=0&ns_st_br=0&ns_st_rt=100&ns_st_ub=0&ns_st_ki=1200000&ns_st_pr=All%20about%20the%20Samsung%20Galaxy%20S10%2C%20MWC%20%2719%20and%20foldable%20phones%20%7C%20TECH(talk)&ns_st_sn=*null&ns_st_en=*null&ns_st_ep=*null&ns_st_ct=vc11&ns_st_ge=*null&ns_st_st=*null&ns_st_ce=*null&ns_st_ia=*null&ns_st_ddt=*null&ns_st_tdt=*null&ns_st_pu=Connatix&ns_st_ti=*null&c3=*null&c4=*null&c6=*null&c7=https%3A%2F%2Fwww.csoonline.com%2Farticle%2F3345972%2Fqbot-malware-resurfaces-in-new-attack-against-businesses.html&c8=&c9=&cs_ucfr=0
Pragma
no-cache
Date
Mon, 11 Mar 2019 09:06:17 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection
keep-alive
Content-Length
0
Expires
Mon, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

292 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask function| getQueryVariable function| $ function| jQuery function| getApolloLocaleSlugMap function| getApolloLocaleIdMap function| getApolloLocaleBrandMap function| getCountryCodeLocaleMap function| getCookie function| setCookie function| getFastlyCountryCode function| getLocaleFromCountryCode function| getSelectedLocale function| setSelectedLocale function| browserLocaleError function| setBrowserLocale function| getRedirectLocale function| getBrowserLocale function| getLocale object| googletag function| __cmp object| consent function| runQueue function| watchConsentQueue function| bindReshowCmp function| admiral object| jQuery1102008766300728885268 object| blueConicPreListeners function| BCClass object| blueConicClient string| twitterUrl string| linkedInUrl string| facebookUrl object| IDG string| positionDataTag object| adUnitIdsMap function| getSrcCookie function| isElementAboveTheFold function| isElementInViewport function| isVisible function| isTabVisible function| buildPositionData object| adLayer boolean| global_ShowSuper boolean| global_ShowHero string| url object| Logon object| $thm function| loadGPT object| Typekit object| Select2 string| brandCode string| brandName string| brandId boolean| regDebugLog string| regApiUrl string| apiKey string| tokenPrefix string| tokenSuffix string| brandDomain string| insiderContentType boolean| notEmptyArticle boolean| notEmptyMediaResource boolean| isInsiderPremium boolean| isResourceInsiderPremium string| assetId string| placementId object| _alcTag object| ALC object| Hashes string| elqSiteID string| elqVer string| elqERoot string| elqSecERoot string| elqPPS function| elqErr string| elqCurESite string| elqAltESite number| elqWCount boolean| elqTryI string| elqStr object| elqTID boolean| elqTRun boolean| elqLoad boolean| elqFail string| elqCurE function| elqClearT function| elqWrite function| elqInit function| elqReplace function| elqQString function| elqAddQS object| elqWDt object| elqDt number| elqMs number| elqTzo string| elqRef2 function| elqFCS object| closure_memoize_cache_ object| googleToken object| googleIMState object| google_js_reporting_queue function| processGoogleToken object| GPT_jstiming undefined| google_measure_js_timing string| slot function| 4dm1r11545242527 function| GetElqCustomerGUID string| elqCustomerGUID boolean| canRunAds string| oneRegPlacementID boolean| supMontMods undefined| segs object| ntvConfig string| prodNames string| prodManufacturers string| prodCategories string| prodVendors string| insiderSignedIn string| idg_uuid string| dlJobFunction object| dlJobPosition object| dlIndustry undefined| insiderToken undefined| tokens string| sincePublished string| edition object| dataLayer object| _sf_async_config string| adBlockStatus function| AdBlockEnabled function| numberFromDataLayer function| stringFromDataLayer object| permutive object| ___grecaptcha_cfg object| grecaptcha boolean| __google_recaptcha_client object| $jscomp object| ntv undefined| nQuery object| prdom function| ntvInsertTracking function| ntvTrackingUrlUtil function| ntvStopWatch function| ntvTimeOnContentStopWatch function| ntvGetElementViewability function| ntvViewableImpressionTracker function| ntvArticleTracker function| ntvjQueryInit function| ntvExtends function| ntvAppendStylesheet function| ntvAppendScript object| ntvToutAds object| PostRelease function| parcelRequire function| TrackerFactory function| _MOAT function| _Viant object| businessLogic function| sticky_relocate object| google_tag_manager function| postscribe function| isValidEmailAddress function| encodeQueryData function| bindEmailModal string| firstSessionDate string| lastSessionDate string| currentSessionDate number| sessionNumber undefined| inSession number| daysSinceLastSession object| currentTime number| longExpiry undefined| lastSessionMS function| zipsearch_widget object| zipsearch function| jsonp720552 function| executeDRRMobile function| executeDRRDesktop object| recaptcha object| Mustache function| BlueConicMetaDataService function| RuleService function| FormRuleService function| ouibounce function| BlockAdBlock object| blockAdBlock object| bcConnectionUtil function| md5 object| jsonpath function| BlueConicDataLayerUtil object| script object| child string| obEdition string| widgetId object| headertag function| headertag_render object| pbjs object| SC function| jsonp77789 object| _tlImpressionBusLoader object| OBR string| OB_releaseVer function| OBR$ object| outbrain object| outbrain_rater function| DP_jQuery_1552295163083 object| AWIN object| domains object| converter object| awinit function| getLoginStatusForOmniture function| getQsVal function| getTrackingToken function| socialTrack function| linkedInTrack object| tl_jsonp object| __core-js_shared__ object| core object| tlScriptCandidates object| _tlCreatives function| debounce function| printPage function| initZooms boolean| PR_SHOULD_USE_CONTINUATION function| prettyPrintOne function| prettyPrint object| PR function| readCookie function| readRawCookie function| getUrlParams function| initAccordion undefined| ss_android undefined| ss_set undefined| ss_icons undefined| ss_keywords undefined| ss_legacy undefined| ss_getElementsByClassName undefined| ss_liga object| g_brandAnalyticsInfoMap object| LazyLoader object| xrayAd object| _comscore object| acceptedDomains string| cleanedHost object| a object| f function| fbq function| _fbq boolean| showPromo object| closure_lm_928887 function| generateSubtag string| GoogleAnalyticsObject function| ga object| _auto function| ael object| httpRequest function| onYouTubeIframeAPIReady function| udm_ object| ns_p object| COMSCORE object| bc_json180 object| google_tag_data object| gaplugins object| jwDefaults object| webpackJsonpjwplayer function| jwplayer object| twttr number| _tlTagsPending object| gaGlobal object| gaData object| __SKIM_JS_GLOBAL__ function| skimlinksBeaconCallback function| skimlinksBeaconSecondaryCallback function| skimlinksBeaconAuxCallback string| _linkedin_data_partner_id boolean| cnx_poly object| cnxBindings function| cnxUnbind object| cnxtimeouts object| cnxintervals function| cnxSetTimeout function| cnxSetInterval function| cnxClearAll object| cnxUmm string| cnxPageGuid object| cnxJSONP_8dfca920c946c95e23ff1552295164886 object| cnxJSONP_eec227a1f53bfc0b8a781552295166621 boolean| _tlSyncDone function| cnxAddEventListener

2 Cookies

Domain/Path Name / Value
.3lift.com/ Name: tluid
Value: 14595276816250468173
.3lift.com/sync Name: sync
Value: CgkIcxDxiYLgli0KCgjmARDxiYLgli0KCQgJEPGJguCWLQoKCKkBEPGJguCWLQoJCDoQ8YmC4JYtCgoIvQEQ8YmC4JYtCgoIjgEQ8YmC4JYtCgoI3gEQ8YmC4JYtCgkIHxDxiYLgli0KCQhfEPGJguCWLQ==

7 Console Messages

Source Level URL
Text
console-api log URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html(Line 386)
Message:
+++ 1) in locales.editions.jsp - COUNTRY CODE IS DEFINED AS: +++
console-api log URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html(Line 391)
Message:
====INSIDE locales-editions.jsp - getSelectedLocale() = undefined and getLocale() = 0 and countryCode = us
console-api error URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_318.js(Line 1)
Message:
Exception in queued GPT command
console-api error URL: https://idg.blueconic.net/plugin/library/4118f513af2b31bb142a85eaf4739f5b(Line 13)
Message:
Error in getFieldValue:
console-api log URL: https://www.csoonline.com/article/3345972/qbot-malware-resurfaces-in-new-attack-against-businesses.html(Line 126)
Message:
*****GDPR: EU user?
console-api log (Line 1)
Message:
Local storage not available.
console-api log (Line 1)
Message:
Automate is initialized.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=0
X-Xss-Protection 1; mode=block; report=https://twitter.com/i/xss_report

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ad.doubleclick.net
admiral.mgr.consensu.org
adservice.google.com
adservice.google.de
ampcid.google.com
ampcid.google.de
api.skimlinks.mgr.consensu.org
api.ziprecruiter.com
automate-prod.s3.amazonaws.com
automate.linksynergy.com
cdn.blueconic.net
cdn.connatix.com
cdn.permutive.com
cdns.connatix.com
ck.connatix.com
connect.facebook.net
content.jwplatform.com
core.connatix.com
eb2.3lift.com
fonts.googleapis.com
fonts.gstatic.com
fonts.staticworld.net
i.connatix.com
ib.3lift.com
idg.blueconic.net
idge.staticworld.net
images.idgesg.net
images.outbrainimg.com
images.techhive.com
jadserve.postrelease.com
js-sec.indexww.com
log.outbrainimg.com
match.adsrvr.org
mv.outbrain.com
odb.outbrain.com
p.skimresources.com
p.typekit.net
platform.twitter.com
r.skimresources.com
rtb.connatix.com
s.ntv.io
s.skimresources.com
sb.scorecardresearch.com
secure.p01.eloqua.com
securepubads.g.doubleclick.net
spiffymachine.com
static.ads-twitter.com
storage.googleapis.com
t.co
t.skimresources.com
tcheck.outbrainimg.com
tlx.3lift.com
tpc.googlesyndication.com
trk.connatix.com
v.connatix.com
vendorlist.consensu.org
w.soundcloud.com
widgets.outbrain.com
www.csoonline.com
www.dwin2.com
www.facebook.com
www.google-analytics.com
www.google.com
www.googletagmanager.com
www.googletagservices.com
www.gstatic.com
www.ziprecruiter.com
104.244.42.69
104.244.46.112
142.0.173.130
143.204.214.33
143.204.214.36
143.204.214.66
151.101.194.110
151.101.2.165
151.101.2.2
151.139.128.10
172.217.16.166
172.217.21.194
2.18.162.235
2.18.70.82
23.211.2.209
2600:9000:200d:5600:1:a3fa:7cc0:93a1
2600:9000:200d:9a00:1:af78:4c0:93a1
2606:2800:234:59:254c:406:2366:268c
2606:4700::6810:b1be
2a00:1450:4001:806::2002
2a00:1450:4001:808::2008
2a00:1450:4001:815::2001
2a00:1450:4001:816::200e
2a00:1450:4001:817::200e
2a00:1450:4001:81b::2010
2a00:1450:4001:81c::200e
2a00:1450:4001:81f::2003
2a00:1450:4001:820::200a
2a00:1450:4001:824::2004
2a00:1450:4001:825::2003
2a02:26f0:6c00:28d::19fd
2a03:2880:f01c:216:face:b00c:0:3
2a03:2880:f11c:8083:face:b00c:0:25de
2a04:4e42::645
3.120.56.246
34.199.191.3
34.226.72.36
35.153.195.133
35.158.24.211
35.190.40.172
35.190.59.101
35.190.75.210
35.201.117.115
35.201.67.47
35.201.98.64
50.31.142.19
50.31.142.51
52.18.226.220
52.19.153.98
52.218.208.130
52.73.80.148
52.86.200.205
54.208.241.180
54.88.112.216
95.100.198.152
95.100.198.4
005836e6ecfaaaceb6137887c8176994494690448569e84938656c2af4393e0e
0093cba7cb9d43a5c6ffcbff9757df1549adfd02c66621f69b1c81abe835790a
00e441f817788168d15166b9a82eab1ddb74c0f7edbaa80d02e7831725d1862e
0244e3148c74d582c9074b5e426531a78d5e56f81d96e1fd5e79d03cbaf75efb
027a7a137fe45b00492b1a4eb5da8a57995cdce44de6b30499c6cbf789431851
02d2940a00290f3a9e4955de7821626688c0cacde8c97c762838e6b40ab22926
03643efcf63e8fbfe6571cd0f1a4ce49f8575a7bee74f2e9fd7fab344e474e48
03fe6ca60cfaf61cba3353a0b460ed2912b07b09858e1f01ef55e0cff50e0ec7
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
053d5c873a012d89c7a079d097426cfddb18b28494a55c51eff89e0294540dfd
0613a840d5b0798e90d044ea6f3d38f1ac59389786cb8ea150c8fb24043f0504
068679090107217f73a1cdc791c646ac0f2b0b5be5089e2f34ca566a082520a1
06d10ddd446ea86ebea46a23a233c9a5fd8df1ce12dfde397d6edbf273f3b852
07e23c224d4070a4da152f82dff2e741208f390f67216b2198068149d6f9d281
097c45e6c3b4abc30becb9f129283c3450b0f58e6a40568f325da275ffd8e913
0c8e60cb95d6b536c9e6c56a94d313fc0891ea0efc5a018da59acdc2ac6535c1
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
11fbae7dc8cc2c2a334ab5a7c8296d26a61498644e8bb1e9c5dc00dfb73f5918
145c052ae99fd431a6cc07d78e77785e7f75a49371db90c2216d4e45bbb84d09
1b197985c0bef8bc365381bd16e15dccf184eb33d0abf0afdb4f567da2000fb2
1c13316139fa198c6f9c3bd390558ed6aefdad457aa33b21317f743343bc91f4
224188bb6dab42ea7cdaf59b0476e84c06ba69efbbc8c469c9d1bd5df2d5e730
24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db
25a3412ecf9482a74c0db805a854815112cb943f5f6b87494de825c30e19e41c
2c87952cc1c23627496c7874271042bdb6af21efdf7cbf36ec4d98e6cec34d04
319949c8c08b86e9c35ea542c0dc0c30cedaa9b8d3d3c3327a36c91aefbd8af5
3208c96177b7053855574338b4f374864c84450a2bb498d257f96b24fa89228a
32b0df3e653d112a7a911f612507d48f1da42b1338d385dd2a690c5bef068e65
333218e3819ed86435d75ec897ccc3620cb61010ce3cfc8c74c0ade22d942f7d
363713bee3b3ed898f66f802f4e43945ab0f6094053a986db4bdd575428465b6
36d94dfb0e48cce0dea2052d2d6229908ea8dc30211f6a33f552e882484349cc
36e9076022a724a5bcf6b84d8c16c64ba4673ce1e0ac662d8b1bd776c3e645af
389e83d41ad848935bb2f79d850fc6a6e80ece731d3e6c4134a457c2cdd6f7b8
38f0e4bc8f247366399ac2200441c57cf4e2c1353d1a9228cac7b18f23c3aaf5
39b814cfd9bbc4a9430a668eba8e0d740c6d96afd5b240f8080cbd48ea103472
3b267b550e32a9af68b9fb141e21b0e8b8c754bec523bb5c84b1192f0566a389
3d5629a5cbadabfd67e7c99b9e71569f356ebf7fddabd5b3c24e37b49a48c605
3da7b38ea4a200dde862bf0d45ddbbe2056d09e97757387717b2a99fdd52cd8b
3e552578c7d450b023f2cd9d28f830be4335c3acc6c4ab6dadda0769f09e5f22
3ee0806e69f2ae70a2267a58ac5fc5d52b5aa7aca6f3c0c08adad605fd8fbc16
414605cffd0e9743e4798e12e7b2f635180828c036bb973958d3f95555ab07da
41e9b0d0acfeefdf42280a2a2ad1281879fa771c7e122ba95b1af1aeb068e0ac
428109164f44a354f7909a9dff4245e232d1dfb7397a4ed35dab62580412968a
4493bd61bcc5d25e333a27da08bed762121fb981f6a8727fbdca8883ccb09cb0
44bbcb2daa9ecc580338ba31f930232c5b5672d8f22e9794ecf1d5eaea068fc5
44dc64c082736ee986d3dda3134211b2b5361c6624d9c4acc187a79a8a8d6d6d
464e7cde418a559c5035942d1ab154d5d906f378f256a0dd39848d197df6180d
47c749c888c850505d68f2745651928d8aec9a6802d6a8b20869fa114af92277
4898c2b9f8c2f931ef6a819d36e0019867931d9519af933ab4bd5edce724b2a8
4e6b5fc328bac95eec2e30afa8a58224c9accc6d70daf0e864d75c4c6d07fe94
4f4ed0e81c2f0016d06ae816dd872edc04e97612c9d36f2f3f4475f2954e7fcc
50ce00ed072a39317bfd698cff66f0233eb061cf02d57e07f3daa273e0effd7e
5135d1df063666c53519538511fc14fa73e15278fc7556c64c1da69b13bae3ba
52726fb580d6bffc46615863ddbf4c319524b5a68fb484be2972bdad4fd0310d
53703bf2fc4b5d2b3065102a19f44575c8c131694de7a15d613e4023db1aeb6e
54eea3d0cef1bc116cf446d063f4b7786b6b5d39b5344006506d8f0ae306f3f9
551c004633e25f9dd42ff8e4af57138e73e1a06349e8296ed7180046c0452ae3
55e8d16bb1a291b0524928dd3bd20c191a14d8a947e4b141271f9c595c7bb451
573fc6351137287c5b5a0d05bb3af321a65c753ded48750b6fea84ad32be7a17
5960a4c10782b43074d54e27e215bc504ec339606d2ee4b026ab574639618b33
5a3f1dd74233f605e511f1b5b244bedf85ac88ba264caf4d6401bc7ec2017dcd
5a9c4b424254849d034541d05afd282527236eba23a7d28b2cff1e4b7fb54772
5d636559a5278d540eb8ffd94f40e46f639346f2e30d247e8971e825b6620c54
5f3592a8b8037ea064764a2815799612063c6722d314d1d66d3a9391c3c16d66
5f68f284453f53e22e00b7f5deda2e578e59f52f6f80a559869f6b2055e0d225
607bfd152e5c762ba0f0502f653c7bbb546ad7955e792a9840d4ae28a8219423
61c790f0e933abdb14e7b7d525814fe726a3efcf6c2f3897dc8f8a89e0f8c8b8
62ef2ee49141f627e08df7685328ee8bcd658111520a0c465599c253be20bf29
63271dcce1a2518271ecc2b0bdcc5afc9c5f0968a8635e0f97a4c9747309eb82
636159b35205da4142a43bc02d2849d77d3ac07a0946211585cde15a9c6ff21f
64277b6800f0d55b58762f127ae212a67a462f20eee80f84e724e4d3721c4a4e
650ae71f579feb5002cf59bb44ead1b0fbec98923fe09a9dbfdde2b865f664ef
66b5ca68288cc2506f1c5709fe38cebccca428406a7ce96e392718203666d503
676aa6d4090a54ea6893484095f55c80659fb8538db100cdb8ce1dc82bab42b8
68251443dc2470c880d1693ad765c1596328187f88cd6fb3e4df215ff82b165e
6a0f6cf6b4648c192d81b5fc7b70cb2f6819ef4a799e421e8626cae9697aa85a
6bb4062c9a8a904038de2727004696ce7ac61aa04746e1f3431245c8d6338bba
6bb981959d783d83df88b9aa48738948c9a8a22c1a31b8cb5305d3e338ebf9a7
6be471d5146e0c52c4967781fc4b41ce4e9b62739cc739632a1e854dd811189d
6e574a88a303d27876368be887fc6415d1928a18e7f81c0e2f6e992f32455e66
6e6c7f819d445a069c18f506c629c6043d86bdc1546875fab9cee18d051edb9f
6f43f644863ed54af3536b02c6b5969a27d787d22effaf5255b200a441dfcbc3
718e83b15b3d2b4421fd413166ea57ffdc7d0886a0393799479ec8e35215de22
75326dc9dc66947526ac65f342821550ff77e8c936cc6dded2272eb3417a4579
7637c18add506b00a934e6091b0f86d2d21160b1b56f43e3f90ba59ad938c187
76c393f564f53c19e795307e622edc8657a603f7a816c2646385697286d11313
786653b773ea8e89e055b1380faa96769ed8bc605d6cfda8332f2c21408040cc
78d83d68ccf7a24aca085486bfc291760424279b6f5308092af4fe600b9d1e19
7bf5e7fdfcbb3607190f49d9d6da7228aa62d8632b61b0dd3e0dcb4e712b310d
8050f05c230d74be333b63cef230e786094e9100f55fa19c6c0831e95870768d
81d069359ca913e722d8b6686d66d972d3eb372d4e717ccf0372da79b246d4a3
825614864dd2332974044ff99c9661f05f9500150b5f3339b683e28ed353c3bd
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
83d86c9e7359ed844c0e7682abcd5cdb65222d421c61156f17791ac6c2650274
85049fe919f9908b6daf11500e28f10921f33c44dcd76d3600dc5307269e59a6
869ff0ba952924c539c2858fbfb032e6caf14f0a8805be73156ca21debd6ea2d
8982bee74ee4a24031eea6ffe2cf2a3a41b3eee01490dfb4b8a641ef69dc923f
8cbde677cfad8b6a5531f472f6e79236392fd06ed3cd4acb9ef31612cbb6a66e
8d7738b8385564c0a23d5a6bb9532830a46f9eed00d67b80f105a6570a3b100e
8ef8e09c9bffadb7bf20245743c7573278457e7eceeffe25d2dbef87e7edf2ab
8f1ac58f2b6b1582e13e06eefaa91ade1b78a5c86bd377401d860aaf03415ee5
90ac357d2d308c8bb95d1b9ee610fb203fddfe3ea02c74a0140983d435a96694
90e7f8120f6d2e856e3a487abe2551c75bea54bee192a5a9b8afa4a0216eefa6
929701ed632814943e3df803ddd9e3f179ccf889c0ad7b7f3392bd8d109b174f
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
951582c15ddd424b079cd402c7e1fbccbb379d99e2c6e3cc10a7d50f89a56492
97fcd922e5c4c070fba458eee6dd50c3133431ab01e93041ac5c8840634f9261
98239ebcc48e7c9dabc57f495946c02b3e3c907d839f6b69971aee32e237ed85
9844fb443bd322af1d908116fa890abdbed6b8b6fe73fba91c9beb8408318aad
991bfe84fec788f2b7d432b99a60c1e2aa2e799bc0137da8cf478299d0fc9a10
9b1e8d6a6fbd575fde082a6cb30309f23fa6ff311452aefe5e18f6cf0ee80fbe
9b9265c69a5cc295d1ab0d04e0273b3677db1a6216ce2ccf4efc8c277ed84b39
9c27ac6ce63d02cc1e160209b072acc023370e305185aa4d11e844c4c26efa0a
9c857aafeb3aca95b2b9d1db13c1c7f5e1924aaf8d93e0e512bbd5d73ee3d98e
9d02d662da8a47fb5fb610b545007507b6017028043dbb63cd09ec897d3b9627
9d2d8043c302d3a9da9277374a53e2285c471d5dc8397885b4931b82771d5cae
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a18dad582d93588b2468876414bf47d4cca0de272fdc2bed3f5eeec3e171deb3
a193a57207a9fe3514d40f9f36426ce98dd4dfb8ec15277a9f3b9add4a09472f
a3d5b21692435e785aa0e698356735093bb93f6c2f61410c49761ee2448f7289
a5e5c781317ce492049cb1f9e1deec67c47bbe5dbd03ec12f688cf7a221a79f2
a739dbffc4a907c1f133b4b26e0daf544ea743218bba5704a910313b0ef3ac10
a8206fb44d253e6a4ab71b4d546c5ca79f03971925b9618d9f15d6b633f48a03
af0f4ef58885b0cec386f2405c78c8bcaec9802a2806c34aadee3ea4bf7a9a9b
af34f58ea2fc346a5f7028ad8b721a9bb31405cf283471a37dab53bad10a6a36
b2460fb5aeffb7ec20dee81a7b45dd8cd818cfefa92fd5d88be6a8d984b3e101
b52e06f854795718703ef9723b47a9a23edcbe2ae53ff261926d8d6059056cfe
b59054e128a42511aa22399d02cd8365ac1c66a6efe6f4f11cfe1ae16284db0c
b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b
b6c4cbeb4768a00cd24d9859033fe49ba45ed76c425f007e7f19f0218e9d206f
b9b7a6409fe8b5947364399f4945e658f388f58012d739f4ce91f5ba834f80e2
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bdfe5b167ff906b96e1f8f028ac8f5e41af7a1892d0cc3a275d28057ba79c0a9
bfcd89614e4c5a8445a83d1aefa355494827569b86214432a2e44a99b26b25a7
c002b2f0b3b338784fc2c1b63037d32ee06295fdff151730a9ab7afe078bf438
c2787f84ac525e6b202f56eb25ef03f40017d11100280dd6f3866cadb4d1f50c
c2c35f00e3a84bab52a27b0f73f083694ada76cb1b405bdddd49d275499ecc9e
c7d10c776205fd870156fb3289d42a6fb2e8b10c44d5ee438bba0b54aa2da17a
c7e1ddc2de3256e9b1db3c3733f38a74a9cdcbf1c424d559519f85cfe0e321ba
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
ca51e0a28d0a5a6056e312625cf15051dd1aab76d64107af6ac2a393448e0028
cde81914d5156c8bb54bf877e4bbe622a6b63853c141fb1539b97aff17149ce4
d09cac80198d84f2ada470d13889756debe35785a0485205640538fc7f7555b4
d1df5c7a5bf7559c17a0037520210c1c3d4affb3f5df0b54dc6d3d87d13a0fab
d2aae940b6d023c99cbd656bbd0868f51bcf4a93455efef42cc95d8a4c7bceca
d563a6297e7ec86a7e14ccb7c3fc8e2ef93cda798f6e97ee27fa8a403ed70958
d61ee6f4c7b8572833d3bdad303493033c896a58ca134680319e3c4bef8756bb
d74669775f5e65a0cf6dc15010754e94d4018936d967a689134eff6afaa8347d
d917db9bc5ae04090ba70496c77d09672b9765c1a7f831185a861743baa5cec5
db84430d0769e415e5f0a9c9cd2565f55bd4b80b38a45299d3576f0842f2b3a9
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
deda424c41a841e454faa598ed300ed300178ba319274cf28e39b3c79332ea22
df6aa193b8808f4bdc6f38cf7d878dedd8e0aca737e2cf325fb5a967c372bcb8
dfbb9333186ccdea2242e5f056f93fbd38c865d5a3aa3b5604daca338e5d157c
dfd9e061f289eeaf739ed0e3f756905b4c61dfb2403c1a5c8feb47134aa43dad
e079e2d9169b771821fa35bd0cb3995ac40e350435800bf98d641098355bc217
e361531fa141864a28133b1d0174d3082ccc117fb347d7a913877faac08b9df0
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4f6b157a82a75e1553a63fa88f1369badef61c08a2f4288cefed3fd885c7d9d
e728da52df03a40b8e3dc28fefa9da7364147cbf05bf3e8ddb449909bd374d0f
eb8fb328ea3b6842d06fdbda892773d24457b4479b1570a793e8705717c553db
eca03da06b638144342cd49d7f4f4e82bd9830b729dc53981f897bd27957ac23
ed4b59c842945fa6d990f7d9a750c87a92f7ba60f7f19f8d18af145853c35c1a
ef756e21b4660483b0d200e15873d899d783fc49abccebcf5d2ebc5d7e6f8e31
ef7755857c07a98436dce7c81f0071da4925b63aa320f6a600eafdc08d620f5f
f02d7c693c8e6915039e6b2f0f7fb3513015cbffa0ebe1994120bfb4240c02b9
f0b97fc49950832323730d508911fa12bd098eca0670ccb3a18ada5af3a34699
f18332dc9ef7ad7797c980a92ed2fd2293f14045450f82bf48680dbc1f6c5cbe
f1ccea6b7204d9f7913ab45e1afa51d79f83bd4f0319de937b0132e6e02b1aab
f1e945400c04241ef089d71de3b0cf7e202431ac4685ada318714fe07ee9dcb0
f370d6bd05df8e6a5b671f06e038c4d85d95dc5446fdeb8f8762e817882a8322
f3f5ffdec8df4dfa69ca6dd3d9a5b21f6d3df554cf782aedce5b904db53b72c4
f51fbadb3f5049cf18b147ff744c5e8ecaeeba60a70eb00c3167b82982bd8995
f75e9ba57ce68d261291eebb9fcebbc49cf193891af925f37256528354f7a6b2
f82702090179a03da2173b04ce94f3b27d955720178b26b22d06f75b39b8aa84
f88f33a736ef0e7d27d78a7b2cdadb674ac192db9aede3a42c65ea1fd4386114
f91649026d2a05a646860a4be36a5388d5c78b4afc03f5ecd49adcad3c4449c3
f9c96666149eee7854565396eafd702e0aa3cfa26f7c0f889517fa01e8ce2398
fb6b1425ff73fe62d725a3981ac08d9f57e16e14d5ae321c617e21e1d7403d1f
fc20cc8543767eb4b7a68f4bf2510fa52f7692c3cb4d7320f9a0aea623b513d8
fcc83a5b6aef86420c1ad553167106df96bd0ff4192ffe52b1647599948edbcf
ff2d9713b2a879d780a4676b43882f1ac9cf83b235005b419ca3aada51ecb912