anee.me Open in urlscan Pro
52.4.145.119 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32
Effective URL:
https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32?gi=d3d087c403c9
Submission: On December 23 via manual (December 23rd 2019, 6:14:44 pm UTC) from BR

Summary HTTP 51 Redirects Links 27 Behaviour Indicators

Summary

This website contacted 12 IPs in 3 countries across 9 domains to perform 51 HTTP transactions. The main IP is 52.4.145.119, located in Ashburn, United States and belongs to AMAZON-AES - Amazon.com, Inc., US. The main domain is anee.me.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on August 5th 2019. Valid for: a year.

This is the only time anee.me was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 6	52.4.145.119 52.4.145.119	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
1 1	2606:4700::68... 2606:4700::6810:797f	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	2a02:26f0:6c0... 2a02:26f0:6c00:284::13b8	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
23	2606:4700::68... 2606:4700::6810:7991	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
2	2a00:1450:400... 2a00:1450:4001:814::200e	15169 (GOOGLE) (GOOGLE - Google LLC)
1	13.35.254.197 13.35.254.197	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1	13.35.253.62 13.35.253.62	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2	52.0.186.222 52.0.186.222	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
1	2600:9000:205... 2600:9000:2057:3400:19:9934:6a80:93a1	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
3	2600:9000:214... 2600:9000:214f:4a00:11:f728:3040:93a1	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2	34.234.146.186 34.234.146.186	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
10	3.224.124.214 3.224.124.214	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
51	12

6 52.4.145.119 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-52-4-145-119.compute-1.amazonaws.com

anee.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:797f (United States) 1 redirects

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

medium.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:6c00:284::13b8 (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)

cdn.optimizely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

23 2606:4700::6810:7991 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

glyph.medium.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
miro.medium.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn-client.medium.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:814::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.35.254.197 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-13-35-254-197.fra6.r.cloudfront.net

d1z2jf7jlzjs58.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.35.253.62 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-13-35-253-62.fra6.r.cloudfront.net

cdn.branch.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.0.186.222 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-52-0-186-222.compute-1.amazonaws.com

srv-2019-12-23-18.pixel.parsely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2057:3400:19:9934:6a80:93a1 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)

app.link	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:9000:214f:4a00:11:f728:3040:93a1 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)

api2.branch.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.234.146.186 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-34-234-146-186.compute-1.amazonaws.com

errors.client.optimizely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 3.224.124.214 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-3-224-124-214.compute-1.amazonaws.com

collector-medium.lightstep.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
24	medium.com 1 redirects medium.com glyph.medium.com miro.medium.com cdn-client.medium.com	678 KB
10	lightstep.com collector-medium.lightstep.com	2 KB
6	anee.me 1 redirects anee.me	29 KB
4	branch.io cdn.branch.io api2.branch.io	23 KB
3	optimizely.com cdn.optimizely.com errors.client.optimizely.com	86 KB
2	parsely.com srv-2019-12-23-18.pixel.parsely.com	765 B
2	google-analytics.com www.google-analytics.com	18 KB
1	app.link app.link	722 B
1	cloudfront.net d1z2jf7jlzjs58.cloudfront.net	17 KB
51	9

	Domain	Requested by
10	collector-medium.lightstep.com	cdn-client.medium.com
10	cdn-client.medium.com	anee.me cdn-client.medium.com
9	miro.medium.com	anee.me
6	anee.me	1 redirects cdn-client.medium.com
4	glyph.medium.com	anee.me
3	api2.branch.io	cdn-client.medium.com
2	errors.client.optimizely.com	cdn-client.medium.com
2	srv-2019-12-23-18.pixel.parsely.com	d1z2jf7jlzjs58.cloudfront.net
2	www.google-analytics.com	anee.me
1	app.link	cdn.branch.io
1	cdn.branch.io	anee.me
1	d1z2jf7jlzjs58.cloudfront.net	cdn-client.medium.com
1	cdn.optimizely.com	anee.me
1	medium.com	1 redirects
51	14

This site contains links to these domains. Also see Links.

Domain
medium.com
github.com
gnu.org
www.gnu.org
help.medium.com

Subject Issuer	Validity	Valid
anee.me Sectigo RSA Domain Validation Secure Server CA	`2019-08-05` - `2020-08-04`	a year	crt.sh
cdn.optimizely.com DigiCert ECC Secure Server CA	`2018-11-24` - `2020-02-23`	a year	crt.sh
*.medium.com DigiCert SHA2 Secure Server CA	`2018-07-31` - `2020-09-09`	2 years	crt.sh
*.google.com GTS CA 1O1	`2019-12-03` - `2020-02-25`	3 months	crt.sh
*.cloudfront.net DigiCert Global CA G2	`2019-07-17` - `2020-07-05`	a year	crt.sh
*.branch.io DigiCert SHA2 Secure Server CA	`2018-12-05` - `2020-12-08`	2 years	crt.sh
*.pixel.parsely.com Let's Encrypt Authority X3	`2019-12-02` - `2020-03-01`	3 months	crt.sh
appipv4.link Amazon	`2019-08-19` - `2020-09-19`	a year	crt.sh
errors.client.optimizely.com DigiCert SHA2 High Assurance Server CA	`2018-09-24` - `2020-09-28`	2 years	crt.sh
*.lightstep.com Let's Encrypt Authority X3	`2019-09-24` - `2019-12-23`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32?gi=d3d087c403c9
Frame ID: 7477EB84D17DA5994CB5A929C8D6382D
Requests: 55 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32 HTTP 302
https://medium.com/m/global-identity?redirectUrl=https%3A%2F%2Fanee.me%2Freversing-a-real-world... HTTP 302
https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32?gi=d3d087c403c9 Page URL

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Page Statistics

51
Requests

80 %
HTTPS

50 %
IPv6

9
Domains

14
Subdomains

12
IPs

3
Countries

880 kB
Transfer

2590 kB
Size

10
Cookies

27 Outgoing links

These are links going to different origins than the main page.

URL: https://medium.com/?source=post_page-----aadd876c0a32----------------------

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=login&redirect=https%3A%2F%2Fanee.me%2Freversing-a-real-world-249-bytes-backdoor-aadd876c0a32&source=post_page-----aadd876c0a32---------------------nav_reg-
Title: Sign in

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fanee.me%2Freversing-a-real-world-249-bytes-backdoor-aadd876c0a32&source=post_page-----aadd876c0a32---------------------nav_reg-
Title: Get started

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fanee.me%2Freversing-a-real-world-249-bytes-backdoor-aadd876c0a32&source=-554053e80668-------------------------follow_byline-
Title: Follow

Search URL Search Domain Scan URL

URL: https://medium.com/p/aadd876c0a32/share/twitter?source=post_actions_header---------------------------

Search URL Search Domain Scan URL

URL: https://medium.com/p/aadd876c0a32/share/facebook?source=post_actions_header---------------------------

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fanee.me%2Freversing-a-real-world-249-bytes-backdoor-aadd876c0a32&source=post_actions_header--------------------------bookmark_sidebar-

Search URL Search Domain Scan URL

URL: https://github.com/lionaneesh/backdoors/blob/master/pay.bin
Title: sample

Search URL Search Domain Scan URL

URL: http://gnu.org/licenses/gpl.html
Title: http://gnu.org/licenses/gpl.html

Search URL Search Domain Scan URL

URL: http://www.gnu.org/software/gdb/bugs/
Title: http://www.gnu.org/software/gdb/bugs/

Search URL Search Domain Scan URL

URL: http://www.gnu.org/software/gdb/documentation/
Title: http://www.gnu.org/software/gdb/documentation/

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fanee.me%2Freversing-a-real-world-249-bytes-backdoor-aadd876c0a32&source=post_sidebar--------------------------follow_sidebar-
Title: Follow

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fanee.me%2Freversing-a-real-world-249-bytes-backdoor-aadd876c0a32&source=post_sidebar-----aadd876c0a32---------------------clap_sidebar-

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fanee.me%2Freversing-a-real-world-249-bytes-backdoor-aadd876c0a32&source=post_actions_footer-----aadd876c0a32---------------------clap_footer-

Search URL Search Domain Scan URL

URL: https://medium.com/p/aadd876c0a32/share/twitter?source=post_actions_footer---------------------------

Search URL Search Domain Scan URL

URL: https://medium.com/p/aadd876c0a32/share/facebook?source=post_actions_footer---------------------------

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fanee.me%2Freversing-a-real-world-249-bytes-backdoor-aadd876c0a32&source=post_actions_footer--------------------------bookmark_sidebar-

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fanee.me%2Freversing-a-real-world-249-bytes-backdoor-aadd876c0a32&source=follow_footer-554053e80668-------------------------follow_footer-
Title: Follow

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fanee.me%2Freversing-a-real-world-249-bytes-backdoor-aadd876c0a32&source=follow_footer--------------------------follow_footer-
Title: Follow

Search URL Search Domain Scan URL

URL: https://medium.com/p/aadd876c0a32/responses/show?source=follow_footer--------------------------follow_footer-
Title: Write the first response

Search URL Search Domain Scan URL

URL: https://medium.com/about?autoplay=1&source=post_page-----aadd876c0a32----------------------
Title: Discover Medium

Search URL Search Domain Scan URL

URL: https://medium.com/topics?source=post_page-----aadd876c0a32----------------------
Title: Make Medium yours

Search URL Search Domain Scan URL

URL: https://medium.com/membership?source=post_page-----aadd876c0a32----------------------
Title: Become a member

Search URL Search Domain Scan URL

URL: https://help.medium.com/?source=post_page-----aadd876c0a32----------------------
Title: Help

Search URL Search Domain Scan URL

URL: https://medium.com/policy/9db0094a1e0f?source=post_page-----aadd876c0a32----------------------
Title: Legal

Search URL Search Domain Scan URL

URL: https://medium.com/policy/f03bf92035c9
Title: Privacy Policy

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32 HTTP 302
https://medium.com/m/global-identity?redirectUrl=https%3A%2F%2Fanee.me%2Freversing-a-real-world-249-bytes-backdoor-aadd876c0a32 HTTP 302
https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32?gi=d3d087c403c9 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

51 HTTP transactions
4 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request reversing-a-real-world-249-bytes-backdoor-aadd876c0a32 Show response
anee.me/
Redirect Chain

https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32
https://medium.com/m/global-identity?redirectUrl=https%3A%2F%2Fanee.me%2Freversing-a-real-world-249-bytes-backdoor-aadd876c0a32
https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32?gi=d3d087c403c9

140 KB
28 KB

482ms
482ms

Document
text/html

52.4.145.119
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32?gi=d3d087c403c9

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

52.4.145.119 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-52-4-145-119.compute-1.amazonaws.com

Software

nginx /

Resource Hash

7f6310f71aa1f7ed7ac2c106ebb4fbca47d65e29e1e15212a7be24130d2c2d40

Security Headers

Name	Value
X-Frame-Options	allow-from medium.com

Request headers

:method: GET
:authority: anee.me
:scheme: https
:path: /reversing-a-real-world-249-bytes-backdoor-aadd876c0a32?gi=d3d087c403c9
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-user: ?1
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: none
sec-fetch-mode: navigate
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-User: ?1

Response headers

status: 200
server: nginx
date: Mon, 23 Dec 2019 18:14:23 GMT
content-type: text/html; charset=utf-8
set-cookie: optimizelyEndUserId=lo_HE27pUUT5yfy; path=/; expires=Tue, 22 Dec 2020 18:14:22 GMT; secure uid=lo_HE27pUUT5yfy; path=/; expires=Tue, 22 Dec 2020 18:14:22 GMT; secure; httponly sid=1:gUZ0gM5FKP0QwCoWJz4z/powZ4SgHuM+jYF+/KTRW0dJrCNRpaaekro7LJy9vd4q; path=/; expires=Tue, 22 Dec 2020 18:14:22 GMT; secure; httponly
sepia-upstream: production
x-frame-options: allow-from medium.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
medium-fulfilled-by: lite/master-20191219-181913-44bd600411, rito/master-20191219-181814-e6a5307b5f, tutu/medium-39605
etag: W/"2300d-N5c3mQRF0x5OKendyu3N2Mb1eUc"
vary: Accept-Encoding
content-encoding: gzip
x-envoy-upstream-service-time: 245

Redirect headers

status: 302
date: Mon, 23 Dec 2019 18:14:22 GMT
content-type: application/octet-stream
set-cookie: __cfduid=dec1c203df39522e8750ee53b4cbcd9b01577124862; expires=Wed, 22-Jan-20 18:14:22 GMT; path=/; domain=.medium.com; HttpOnly; SameSite=Lax uid=lo_HE27pUUT5yfy; Expires=Tue, 22-Dec-20 18:14:22 GMT; Domain=.medium.com; Path=/; Secure; HttpOnly optimizelyEndUserId=lo_HE27pUUT5yfy; path=/; expires=Tue, 22 Dec 2020 18:14:22 GMT; domain=.medium.com; secure sid=1:zpOKzMT7PQqGTL4oLw4KG8GKy3wFJfRGCo4QnNb5DIomsDlhy2OjR2kAhl0uDQhD; path=/; expires=Tue, 22 Dec 2020 18:14:22 GMT; domain=.medium.com; secure; httponly __cfruid=57cfbe38479961b96ce7d6f41999edd0cade4624-1577124862; path=/; domain=.medium.com; HttpOnly
content-security-policy: default-src 'self'; connect-src https://localhost https://*.instapaper.com https://*.stripe.com https://glyph.medium.com https://*.paypal.com https://getpocket.com https://medium.com https://*.medium.com https://*.medium.com https://medium.com https://*.medium.com https://*.algolia.net https://cdn-static-1.medium.com https://dnqgz544uhbo8.cloudfront.net https://cdn-videos-1.medium.com https://cdn-audio-1.medium.com https://*.lightstep.com https://*.branch.io 'self'; font-src data: https://*.amazonaws.com https://*.medium.com https://glyph.medium.com https://medium.com https://*.gstatic.com https://dnqgz544uhbo8.cloudfront.net https://cdn-static-1.medium.com 'self'; frame-src chromenull: https: webviewprogressproxy: medium: 'self'; img-src blob: data: https: 'self'; media-src https://*.cdn.vine.co https://d1fcbxp97j4nb2.cloudfront.net https://d262ilb51hltx0.cloudfront.net https://*.medium.com https://gomiro.medium.com https://miro.medium.com https://pbs.twimg.com 'self' blob:; object-src 'self'; script-src 'unsafe-eval' 'unsafe-inline' about: https: 'self'; style-src 'unsafe-inline' data: https: 'self'; report-uri https://csp.medium.com
x-frame-options: sameorigin
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge, Chrome=1
x-powered-by: Medium
x-obvious-tid: 1577124862801:1218c3c50a54
x-obvious-info: 39605-e8d6318,e8d63184489
link: <https://medium.com/humans.txt>; rel="humans"
cache-control: no-cache, no-store, max-age=0, must-revalidate
expires: Thu, 09 Sep 1999 09:09:09 GMT
pragma: no-cache
location: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32?gi=d3d087c403c9
strict-transport-security: max-age=15552000; includeSubDomains; preload
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
server: cloudflare
cf-ray: 549c5095ec51cba0-VIE

GET
H2 200 16180790160.js Show response
cdn.optimizely.com/js/ 278 KB
86 KB 25ms
6ms Script
text/javascript 2a02:26f0:6c00:284::13b8
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.optimizely.com/js/16180790160.js

Requested by

Host: anee.me
URL: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32?gi=d3d087c403c9

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:6c00:284::13b8 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

67895a0f3d58678796f298cb1afebae68139d926f603aeaee4bebefe3d19462a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Referer: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32?gi=d3d087c403c9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-meta-pci_enabled: False
x-amz-version-id: .Dqr.TST2Get30.c3vKchSlez_pqyrck
content-encoding: gzip
x-amz-request-id: 64618EC7D43BB842
status: 200
access-control-max-age: 86400
date: Mon, 23 Dec 2019 18:14:23 GMT
x-amz-replication-status: PENDING
server-timing: cdn;desc="AkamaiION";dur=0,rtt;desc="4";dur=0,cdnip;desc="2a02:26f0:6c00:284::13b8";dur=0,cdnmap;desc="";dur=0,proto;desc="h2";dur=0
strict-transport-security: max-age=15768000
content-length: 86811
x-amz-id-2: p7z5kxaJdrRILxoQfxfMXF/u2BQvo6bGv4zkTcxSpCko3DvG0eJTYDvFkc7XX9oyQRYGdP6RzD4=
last-modified: Mon, 23 Dec 2019 15:32:11 GMT
server: AmazonS3
etag: "2b8a1ee87a7366eafc498738bba5709c"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: x-amz-meta-revision
cache-control: max-age=120
x-amz-meta-revision: 705
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: *

GET
H2 200 m2.css
glyph.medium.com/css/e/sr/latin/e/ssr/latin/e/ssb/latin/ 44 KB
29 KB 111ms
55ms Stylesheet
text/css 2606:4700::6810:7991
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://glyph.medium.com/css/e/sr/latin/e/ssr/latin/e/ssb/latin/m2.css

Requested by

Host: anee.me
URL: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32?gi=d3d087c403c9

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7991 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

087a4c7aa118304c5ce85d5917d95a49b3c93204ef3500752dfde52595e4eac6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32?gi=d3d087c403c9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 23 Dec 2019 18:14:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 3080
status: 200
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 86400
access-control-allow-methods: GET, POST, PUT, DELETE
content-type: text/css
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=14400
access-control-allow-credentials: true
cf-ray: 549c509c8e8159c4-VIE
access-control-allow-headers: Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires: Mon, 23 Dec 2019 22:14:23 GMT

GET
H2 200 0*mAjmZ6EN-Qmt9aip.jpg
miro.medium.com/fit/c/96/96/ 3 KB
3 KB 73ms
39ms Image
image/jpeg 2606:4700::6810:7991
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/fit/c/96/96/0*mAjmZ6EN-Qmt9aip.jpg

Requested by

Host: anee.me
URL: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32?gi=d3d087c403c9

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7991 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

ae3c8955d6957a614ccdafd19afa8455739ef13d5cb386dc6dca9931dd2c6acb

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32?gi=d3d087c403c9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 23 Dec 2019 18:14:23 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 189538
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3197-fb89d63
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length: 2947
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/jpeg
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 549c509c6d978cb0-VIE
expires: Wed, 22 Jan 2020 18:14:23 GMT

GET
H2 200 1*A78Mi8xr0qGonw3oyheIBw.png
miro.medium.com/max/36/ 2 KB
3 KB 84ms
51ms Image
image/png 2606:4700::6810:7991
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/36/1*A78Mi8xr0qGonw3oyheIBw.png?q=20

Requested by

Host: anee.me
URL: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32?gi=d3d087c403c9

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7991 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

20f36dc2227fc491ac960bbcaf3faba3fdce162151e89501fa7d7d02d033f87c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32?gi=d3d087c403c9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 23 Dec 2019 18:14:23 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 135142
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3216-39bf470
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length: 2483
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 549c509c6d988cb0-VIE
expires: Wed, 22 Jan 2020 18:14:23 GMT

GET
H2 200 0*mAjmZ6EN-Qmt9aip.jpg
miro.medium.com/fit/c/160/160/ 5 KB
5 KB 24ms
24ms Image
image/jpeg 2606:4700::6810:7991
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/fit/c/160/160/0*mAjmZ6EN-Qmt9aip.jpg

Requested by

Host: anee.me
URL: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32?gi=d3d087c403c9

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7991 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

4c0c811a3db3aa6f2b7b91d7409d8c840add9d8aa14f331277f2ea0844dc40a0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32?gi=d3d087c403c9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 23 Dec 2019 18:14:23 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 189538
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3196-7da812a
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length: 5347
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/jpeg
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 549c509cee008cb0-VIE
expires: Wed, 22 Jan 2020 18:14:23 GMT

GET
H2 200 1*7kj8yPzvJpOdfJjadRjVgQ.jpeg
miro.medium.com/fit/c/160/160/ 7 KB
7 KB 50ms
50ms Image
image/jpeg 2606:4700::6810:7991
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/fit/c/160/160/1*7kj8yPzvJpOdfJjadRjVgQ.jpeg

Requested by

Host: anee.me
URL: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32?gi=d3d087c403c9

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7991 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

43995d25616b6b617a5a16563be761aee92acf3c2486eaea066f94ca40492dde

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32?gi=d3d087c403c9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 23 Dec 2019 18:14:23 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 189538
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3203-7aaf868
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length: 6856
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/jpeg
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 549c509cee018cb0-VIE
expires: Wed, 22 Jan 2020 18:14:23 GMT

GET
H2 200 manifest.0b999d52.js Show response
cdn-client.medium.com/lite/static/js/ 4 KB
2 KB 51ms
37ms Script
application/javascript 2606:4700::6810:7991
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/manifest.0b999d52.js

Requested by

Host: anee.me
URL: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32?gi=d3d087c403c9

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7991 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

bcacc03291e15ea96d4e21a04819ec07724402f6af7060631a333c5e20ccb158

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32?gi=d3d087c403c9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 23 Dec 2019 18:14:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 343940
cf-ray: 549c509cbde48cb0-VIE
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
x-amz-request-id: B0B151A6D24A785A
x-amz-id-2: pQu4+vKroFBiBaZC7oSsHzUdJh2215t8rj2Vx95BhjLE8u7uq/vmakRWvRWEyRrYvdt2R5DUTBc=
last-modified: Thu, 19 Dec 2019 18:27:27 GMT
server: cloudflare
etag: W/"a761b05c0dadf2305dc9e17065366b93"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-version-id: zPs_jkvojv.Ei5zNb1snVPBi5wiJrG0L
vary: Accept-Encoding
cache-control: public, max-age=31536000
content-type: application/javascript
expires: Tue, 22 Dec 2020 18:14:23 GMT

GET
H2 200 vendors~main.51281d83.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 757 KB
198 KB 54ms
51ms Script
application/javascript 2606:4700::6810:7991
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/vendors~main.51281d83.chunk.js

Requested by

Host: anee.me
URL: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32?gi=d3d087c403c9

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7991 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

c4ee0fb2923c088dffbcd2ecc5036d08089b254f7a1bdbd271533e1b10db402e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32?gi=d3d087c403c9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 23 Dec 2019 18:14:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 1204201
cf-ray: 549c509cbde78cb0-VIE
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
x-amz-request-id: 6029A51B5F13471D
x-amz-id-2: pOijyW2pPGftFaTGMAhvLUSdYq/B8oUehLOXXal3F0laroG812KNOab1IxnWtxWcKTuvdzqjvDo=
last-modified: Mon, 09 Dec 2019 19:27:37 GMT
server: cloudflare
etag: W/"46d827589f1a5521a8d6ca2c32fff9ca"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-version-id: H9mhz4fNJiDvzVkjtyU_vG4VtGYkmtnA
vary: Accept-Encoding
cache-control: public, max-age=31536000
content-type: application/javascript
expires: Tue, 22 Dec 2020 18:14:23 GMT

GET
H2 200 main.06a3617a.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 433 KB
99 KB 26ms
25ms Script
application/javascript 2606:4700::6810:7991
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/main.06a3617a.chunk.js

Requested by

Host: anee.me
URL: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32?gi=d3d087c403c9

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7991 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

57ed51afe6de1bc8862a42f65f0c9242c7dd33137ecae8e5f73b27c9c15d7f5a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32?gi=d3d087c403c9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 23 Dec 2019 18:14:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 265216
cf-ray: 549c509cedfc8cb0-VIE
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
x-amz-request-id: 26F6C811D816782B
x-amz-id-2: dlH42g0/QV1vBoCr/N7vMrlp3wvAuhzTydSFnpNEyWB9ha6Sy7PHmjz/nxBNG1qlE28qIE37lbU=
last-modified: Thu, 19 Dec 2019 18:27:26 GMT
server: cloudflare
etag: W/"f2f22258b8a6215ac6f485a85511ec8f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-version-id: GCKfaQCgQDC7UY1LDrmoNNJ5DS12lZ0V
vary: Accept-Encoding
cache-control: public, max-age=31536000
content-type: application/javascript
expires: Tue, 22 Dec 2020 18:14:23 GMT

GET
H2 200 vendors~screen.collection.packageBuilder~screen.landingpages.pres45~screen.landingpages.tribute~scre~3e410f11.d2f0cb5c.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 38 KB
16 KB 41ms
40ms Script
application/javascript 2606:4700::6810:7991
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/vendors~screen.collection.packageBuilder~screen.landingpages.pres45~screen.landingpages.tribute~scre~3e410f11.d2f0cb5c.chunk.js

Requested by

Host: anee.me
URL: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32?gi=d3d087c403c9

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7991 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

ec658154249e4a8085e4db08af846b60a435a18504352bb8f002d889e70ece2b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32?gi=d3d087c403c9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 23 Dec 2019 18:14:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 331306
cf-ray: 549c509cedfd8cb0-VIE
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
x-amz-request-id: 29F3D495C30F835E
x-amz-id-2: MvWcRT51ZvS5o6QdG0DhPHf3r/WRxyq7WGy+W7T/kThgEmeUqKQ66Yf1JrrPffgWAPWRpwtf324=
last-modified: Thu, 05 Dec 2019 21:58:46 GMT
server: cloudflare
etag: W/"8b9fec58d0bdfd692d5c65e3b37f33bf"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-version-id: sJq85UZn_PUcguJu9c1aJgvrnhAD7C9I
vary: Accept-Encoding
cache-control: public, max-age=31536000
content-type: application/javascript
expires: Tue, 22 Dec 2020 18:14:23 GMT

GET
H2 200 screen.collection.packageBuilder~screen.landingpages.pres45~screen.landingpages.tribute~screen.post~~4767c889.aad2443a.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 20 KB
6 KB 41ms
40ms Script
application/javascript 2606:4700::6810:7991
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/screen.collection.packageBuilder~screen.landingpages.pres45~screen.landingpages.tribute~screen.post~~4767c889.aad2443a.chunk.js

Requested by

Host: anee.me
URL: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32?gi=d3d087c403c9

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7991 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

5e9acbc5206d9386f001afda29b2065e55c4a2dd5f1fbe1cad56d24b558a64e3

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32?gi=d3d087c403c9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 23 Dec 2019 18:14:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 343940
cf-ray: 549c509cedfe8cb0-VIE
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
x-amz-request-id: DD714BCFB8042233
x-amz-id-2: fofGzPlQTF3H9zi7Ayq8G0yr4Q97cZ1voeSn8TCokROShPb7csM9bUMOj5gHOnHBZycf7JZd21M=
last-modified: Thu, 19 Dec 2019 18:27:30 GMT
server: cloudflare
etag: W/"6b4f624947864939fd2a296a7ad1b0fb"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-version-id: CHvu31pUXxeOrS0k6Y99rRQeCvMon6V9
vary: Accept-Encoding
cache-control: public, max-age=31536000
content-type: application/javascript
expires: Tue, 22 Dec 2020 18:14:23 GMT

GET
H2 200 screen.collection.packageBuilder~screen.landingpages.pres45~screen.landingpages.tribute~screen.post~~73c4bb05.fe059094.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 118 KB
31 KB 49ms
49ms Script
application/javascript 2606:4700::6810:7991
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/screen.collection.packageBuilder~screen.landingpages.pres45~screen.landingpages.tribute~screen.post~~73c4bb05.fe059094.chunk.js

Requested by

Host: anee.me
URL: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32?gi=d3d087c403c9

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7991 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

83ee3c23e78be226d825acf73ec6ca79f4a65d9c7925122e9ccbd87e04d6330b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32?gi=d3d087c403c9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 23 Dec 2019 18:14:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 343940
cf-ray: 549c509cedff8cb0-VIE
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
x-amz-request-id: 18FFBCE45A5A4193
x-amz-id-2: 1iZii56AVfK/eFO+VUWsgw+RQXw6AMsclsLf74RvWTuz9yiqxmibue0Il+L0DUwamQYIDQxJ6r0=
last-modified: Thu, 19 Dec 2019 18:27:30 GMT
server: cloudflare
etag: W/"8aec6b19d2a13457ef70e25ecffe4946"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-version-id: s1Qn2MCqh8X4sm__Yc8ujBZEOM7L.hm5
vary: Accept-Encoding
cache-control: public, max-age=31536000
content-type: application/javascript
expires: Tue, 22 Dec 2020 18:14:23 GMT

GET
H2 200 screen.post~screen.post.amp~screen.profile~screen.sequence.library~screen.sequence.post~screen.stori~aba94ffa.20e69cee.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 51 KB
15 KB 27ms
26ms Script
application/javascript 2606:4700::6810:7991
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/screen.post~screen.post.amp~screen.profile~screen.sequence.library~screen.sequence.post~screen.stori~aba94ffa.20e69cee.chunk.js

Requested by

Host: anee.me
URL: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32?gi=d3d087c403c9

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7991 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

d532f3e29539a73b4c3fdd03c5f5b2ac493b4277a5fd38cc732acb4ff3fbde8e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32?gi=d3d087c403c9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 23 Dec 2019 18:14:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 343940
cf-ray: 549c509cfe098cb0-VIE
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
x-amz-request-id: 13C7D53C39D2CC09
x-amz-id-2: 7Y/jXQwxynUAQ5OnZHYBzwihSGdkvOA4g8ixs7SH7plrm8ERN3kuxYwtwTj5UE32lElmaqijSAE=
last-modified: Thu, 19 Dec 2019 18:27:35 GMT
server: cloudflare
etag: W/"fefefc787ab8b71905077731454cf70c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-version-id: pwkqmJwGy_G9z94broXU7BiUkz2qNFR2
vary: Accept-Encoding
cache-control: public, max-age=31536000
content-type: application/javascript
expires: Tue, 22 Dec 2020 18:14:23 GMT

GET
H2 200 screen.post.302854e7.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 259 KB
61 KB 29ms
29ms Script
application/javascript 2606:4700::6810:7991
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/screen.post.302854e7.chunk.js

Requested by

Host: anee.me
URL: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32?gi=d3d087c403c9

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7991 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

2f52e8e6e758abc5b140084ab9fbe9d5496dc72c3acb2fdaa31b445a17303004

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32?gi=d3d087c403c9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 23 Dec 2019 18:14:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 343902
cf-ray: 549c509d2e2c8cb0-VIE
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
x-amz-request-id: CC28D5F58A7E0B65
x-amz-id-2: HpFTQgFmX9veZGfTcL4FqRurupXsMWAxSsqHqoxv03rMBaWXuwAuLu2fQ1RyfsA4NwEJnNZ0rUg=
last-modified: Thu, 19 Dec 2019 18:27:32 GMT
server: cloudflare
etag: W/"e57f0e9f2df03ae62876e4297a3423b1"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-version-id: Le.q8KfslzNldeDfan_S6f.EHb8RowTp
vary: Accept-Encoding
cache-control: public, max-age=31536000
content-type: application/javascript
expires: Tue, 22 Dec 2020 18:14:23 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 43 KB
17 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:814::200e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: anee.me
URL: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32?gi=d3d087c403c9

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32?gi=d3d087c403c9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 19 Aug 2019 17:22:41 GMT
server: Golfe2
age: 6046
date: Mon, 23 Dec 2019 16:33:37 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 17803
expires: Mon, 23 Dec 2019 18:33:37 GMT

GET
DATA 200
OK truncated
/ 156 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4c0cc04185396c9a83cfda3644c23327d7d8ff9247157c438575b83713894173

Request headers

Referer: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32?gi=d3d087c403c9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 9 KB
9 KB Font
font/opentype

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 99c5448d6c84fc71d6805e2485727db250113edcaea123a064f8c26ce95947d8

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Origin: https://anee.me

Response headers

Content-Type: font/opentype

GET
DATA 200
OK truncated
/ 10 KB
10 KB Font
font/opentype

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ef1ed6a034a5055a869c7c25765ee1f2844a27a54e83e8a857d77b3f1cd83dd3

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Origin: https://anee.me

Response headers

Content-Type: font/opentype

GET
H2 200 fell-400-normal.woff
glyph.medium.com/font/78ce731/0-3j_4g_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/ 14 KB
15 KB 82ms
53ms Font
application/font-woff 2606:4700::6810:7991
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://glyph.medium.com/font/78ce731/0-3j_4g_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/fell-400-normal.woff

Requested by

Host: anee.me
URL: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32?gi=d3d087c403c9

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7991 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

f57137897a4e676f0d2199b79def1a95b253a1a938dff9d8ba10519f3beb2b08

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://glyph.medium.com/css/e/sr/latin/e/ssr/latin/e/ssb/latin/m2.css
Origin: https://anee.me

Response headers

date: Mon, 23 Dec 2019 18:14:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 1017166
status: 200
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 86400
access-control-allow-methods: GET, POST, PUT, DELETE
content-type: application/font-woff
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
access-control-allow-credentials: true
cf-ray: 549c509d1ffc599a-VIE
access-control-allow-headers: Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires: Tue, 22 Dec 2020 18:14:23 GMT

GET
DATA 200
OK truncated
/ 10 KB
10 KB Font
font/opentype

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a3d669b687929b3aa777fdd2c400c2b8c6b794978536a64d7e1f71edcf8037e8

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Origin: https://anee.me

Response headers

Content-Type: font/opentype

GET
H2 200 charter-700-normal.woff
glyph.medium.com/font/f50d520/0-3j_4g_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/ 10 KB
10 KB 240ms
211ms Font
application/font-woff 2606:4700::6810:7991
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://glyph.medium.com/font/f50d520/0-3j_4g_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/charter-700-normal.woff

Requested by

Host: anee.me
URL: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32?gi=d3d087c403c9

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7991 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

41532aec4c3a3a0747ca853b064ef7a96483a95798a6526974ec043997e2ccf9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://glyph.medium.com/css/e/sr/latin/e/ssr/latin/e/ssb/latin/m2.css
Origin: https://anee.me

Response headers

date: Mon, 23 Dec 2019 18:14:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 135149
status: 200
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 86400
access-control-allow-methods: GET, POST, PUT, DELETE
content-type: application/font-woff
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
access-control-allow-credentials: true
cf-ray: 549c509d1ffd599a-VIE
access-control-allow-headers: Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires: Tue, 22 Dec 2020 18:14:23 GMT

GET
H2 200 marat-sans-400-normal.woff
glyph.medium.com/font/d8659c9/3k-4f_4h-6bt_6bv-6c3_6c5-6c7_6ca-6cb_6ce-6ch_6cj-6cl_6cn-nvnj/ 14 KB
14 KB 234ms
213ms Font
application/font-woff 2606:4700::6810:7991
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://glyph.medium.com/font/d8659c9/3k-4f_4h-6bt_6bv-6c3_6c5-6c7_6ca-6cb_6ce-6ch_6cj-6cl_6cn-nvnj/marat-sans-400-normal.woff

Requested by

Host: anee.me
URL: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32?gi=d3d087c403c9

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7991 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

12fe85ec038af8c41ba830412520589dbd125d417913c10a57838ac92ab96192

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://glyph.medium.com/css/e/sr/latin/e/ssr/latin/e/ssb/latin/m2.css
Origin: https://anee.me

Response headers

date: Mon, 23 Dec 2019 18:14:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 189538
status: 200
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 86400
access-control-allow-methods: GET, POST, PUT, DELETE
content-type: application/font-woff
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
access-control-allow-credentials: true
cf-ray: 549c509d1ffe599a-VIE
access-control-allow-headers: Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires: Tue, 22 Dec 2020 18:14:23 GMT

GET
H2 200 collect
www.google-analytics.com/r/ 35 B
104 B 14ms
14ms Image
image/gif 2a00:1450:4001:814::200e
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/r/collect?v=1&_v=j79&a=223274477&t=pageview&_s=1&dl=https%3A%2F%2Fanee.me%2Freversing-a-real-world-249-bytes-backdoor-aadd876c0a32%3Fgi%3Dd3d087c403c9&ul=en-us&de=UTF-8&dt=Reversing%20a%20real-world%20249%20bytes%20backdoor!%20-%20Aneesh%20Dogra%E2%80%99s%20Blog&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=IEBAAEAB~&jid=1767421612&gjid=1686056704&cid=1126918382.1577124864&tid=UA-24232453-2&_gid=952716686.1577124864&_r=1&z=1963732825

Requested by

Host: anee.me
URL: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32?gi=d3d087c403c9

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32?gi=d3d087c403c9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 Dec 2019 18:14:23 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
access-control-allow-origin: *
content-type: image/gif
status: 200
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 client-ready
anee.me/_/lite/performance/ 2 B
0 108ms
108ms Fetch
text/plain 52.4.145.119
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://anee.me/_/lite/performance/client-ready

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/main.06a3617a.chunk.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

52.4.145.119 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-52-4-145-119.compute-1.amazonaws.com

Software

nginx /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	allow-from medium.com

Request headers

Referer: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32
Origin: https://anee.me
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 23 Dec 2019 18:14:23 GMT
sepia-upstream: production
server: nginx
x-frame-options: allow-from medium.com
etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc"
vary: Accept-Encoding
content-type: text/plain; charset=utf-8
status: 200
cache-control: no-cache, no-store, max-age=0, must-revalidate
x-envoy-upstream-service-time: 1
medium-fulfilled-by: lite/master-20191219-181913-44bd600411
content-length: 2

GET
H2 200 vendors~tracing.0154598a.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 62 KB
16 KB 33ms
33ms Script
application/javascript 2606:4700::6810:7991
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/vendors~tracing.0154598a.chunk.js

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/manifest.0b999d52.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7991 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

037593f8fd10db1df005e17412f8d42274315767d03f74230a52f1871f03b7c4

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 23 Dec 2019 18:14:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 495406
cf-ray: 549c509ecfb68cb0-VIE
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
x-amz-request-id: 4259B6AA64B64BD8
x-amz-id-2: KfkLj7XKGw/gm88B42YisAUjxDNXTnArE0yo5hod8Ngh2EdjrhU/TbgmPu+NMg1Xj/rnIJO4+CI=
last-modified: Wed, 04 Dec 2019 00:24:14 GMT
server: cloudflare
etag: W/"afcbddc62374f70c228505b2f1591bc7"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-version-id: IMxz6jNiD0LVohM5OAWO2A9nZPB2dGMP
vary: Accept-Encoding
cache-control: public, max-age=31536000
content-type: application/javascript
expires: Tue, 22 Dec 2020 18:14:23 GMT

GET
H2 200 tracing.075b133f.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 2 KB
1 KB 25ms
25ms Script
application/javascript 2606:4700::6810:7991
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/tracing.075b133f.chunk.js

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/manifest.0b999d52.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7991 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

57416757e1bde9b95d0c6afb6f7c4a3353119a5793d69076b74df7d0dfee8127

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 23 Dec 2019 18:14:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 331306
cf-ray: 549c509ecfb78cb0-VIE
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
x-amz-request-id: 0BE0408195AFACA0
x-amz-id-2: c7gRio+3FPFCOrLOry2KRKS4PSucVqz1CZ8l8J2nnM5GpPcquqjiawaQwgc/jQ7LhdpAGjtX0H0=
last-modified: Thu, 05 Dec 2019 21:58:45 GMT
server: cloudflare
etag: W/"aaaeeaf00e1dcd42155129dcb4d66d23"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-version-id: 4G.1P9JcOjuvfCbapU..TfY1z_AG_4qx
vary: Accept-Encoding
cache-control: public, max-age=31536000
content-type: application/javascript
expires: Tue, 22 Dec 2020 18:14:23 GMT

POST
H2 200 graphql Show response
anee.me/_/ 94 B
359 B 211ms
211ms Fetch
application/json 52.4.145.119
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://anee.me/_/graphql
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.51281d83.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.4.145.119 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-4-145-119.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 8f68c9f27e0c32a6d1909ff9382cb7e2b00b7960d9a1ef4cb887fe10a00954a4

Request headers

apollographql-client-name: lite
Medium-Frontend-Route: post
Origin: https://anee.me
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Graphql-Operation: InteractivePostBodyQuery
content-type: application/json
accept: */*
Referer: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32
Medium-Frontend-App: lite/master-20191219-181913-44bd600411
apollographql-client-version: master-20191219-181913-44bd600411

Response headers

date: Mon, 23 Dec 2019 18:14:24 GMT
sepia-upstream: production
server: nginx
etag: W/"5e-UOmgMoW8Ro12QmnDE6cwpy2gh+8"
status: 200
content-type: application/json; charset=utf-8
access-control-allow-origin: *
medium-fulfilled-by: rito/master-20191219-181814-e6a5307b5f, tutu/medium-39605
x-envoy-upstream-service-time: 104
content-length: 94
x-request-received-at: 1577124864009

GET
H/1.1 200
OK p.js Show response
d1z2jf7jlzjs58.cloudfront.net/keys/medium.com/ 41 KB
17 KB 85ms
21ms Script
application/x-javascript 13.35.254.197
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://d1z2jf7jlzjs58.cloudfront.net/keys/medium.com/p.js
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/main.06a3617a.chunk.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.35.254.197 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-35-254-197.fra6.r.cloudfront.net
Software: nginx /
Resource Hash: 58711bafae315df048e1bc0c36ae1dfd017810b34fd9b4b021f774694397baad

Request headers

Referer: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sun, 22 Dec 2019 18:20:06 GMT
Content-Encoding: gzip
Age: 86109
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
Pragma: public
Last-Modified: Mon, 07 Oct 2019 18:17:48 GMT
Server: nginx
ETag: W/"5d9b814c-a469"
Content-Type: application/x-javascript
Via: 1.1 9bca546700a965c9c77ef5b8dbe65cc4.cloudfront.net (CloudFront)
Cache-Control: max-age=86400, public
X-Amz-Cf-Pop: FRA6-C1
X-Amz-Cf-Id: TsydsqCUJTkiOvlipOy4S-FqJybL2XAn4usXjSKQrNoI-RMhKsBGVw==
Expires: Mon, 23 Dec 2019 18:19:09 GMT

GET
H2 200 0*mAjmZ6EN-Qmt9aip.jpg
miro.medium.com/fit/c/48/48/ 2 KB
2 KB 31ms
30ms Image
image/jpeg 2606:4700::6810:7991
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/fit/c/48/48/0*mAjmZ6EN-Qmt9aip.jpg

Requested by

Host: anee.me
URL: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7991 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

8b1f080db03ca75e0ea8d50f2e1d50ca82c953cd4a5cab1c0851e7a05b8b82e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 23 Dec 2019 18:14:24 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 1739077
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3196-7da812a
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length: 1536
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/jpeg
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 549c50a109658cb0-VIE
expires: Wed, 22 Jan 2020 18:14:24 GMT

GET
H2 200 1*A78Mi8xr0qGonw3oyheIBw.png
miro.medium.com/max/18/ 774 B
1 KB 21ms
21ms Image
image/png 2606:4700::6810:7991
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/18/1*A78Mi8xr0qGonw3oyheIBw.png?q=20

Requested by

Host: anee.me
URL: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7991 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

74024a029175d458983dd508f4b8bb0effdee667121893b6061f5c0ed04dafdf

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 23 Dec 2019 18:14:24 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 120819
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3217-8161a0a
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length: 774
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 549c50a109668cb0-VIE
expires: Wed, 22 Jan 2020 18:14:24 GMT

GET
H2 200 0*mAjmZ6EN-Qmt9aip.jpg
miro.medium.com/fit/c/80/80/ 2 KB
2 KB 44ms
44ms Image
image/jpeg 2606:4700::6810:7991
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/fit/c/80/80/0*mAjmZ6EN-Qmt9aip.jpg

Requested by

Host: anee.me
URL: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7991 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

646ce4f3fa0efd1d0568e90ed0d30a8924ca06a0e185c785647c76cab94d9eb4

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 23 Dec 2019 18:14:24 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 699982
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3209-f49543a
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length: 2397
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/jpeg
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 549c50a109678cb0-VIE
expires: Wed, 22 Jan 2020 18:14:24 GMT

GET
H2 200 1*7kj8yPzvJpOdfJjadRjVgQ.jpeg
miro.medium.com/fit/c/80/80/ 3 KB
3 KB 43ms
42ms Image
image/jpeg 2606:4700::6810:7991
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/fit/c/80/80/1*7kj8yPzvJpOdfJjadRjVgQ.jpeg

Requested by

Host: anee.me
URL: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7991 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

30acf4ac2e2615245914a0d2e470697edddae43a5411e13f0e2b6e13c12423c2

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 23 Dec 2019 18:14:24 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 280906
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3203-7aaf868
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length: 2762
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/jpeg
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 549c50a109698cb0-VIE
expires: Wed, 22 Jan 2020 18:14:24 GMT

GET
H/1.1 200
OK branch-latest.min.js Show response
cdn.branch.io/ 72 KB
22 KB 87ms
23ms Script
text/javascript 13.35.253.62
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.branch.io/branch-latest.min.js
Requested by: Host: anee.me
URL: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32?gi=d3d087c403c9
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.35.253.62 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-35-253-62.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 200b68bbdf9c2da0d476171ed46ffab16cac6ee742582310438d511c7cd7d315

Request headers

Referer: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id: u0SrVcR4IiRlieei1odV0xSiikdlv4ff
Content-Encoding: gzip
Last-Modified: Wed, 11 Dec 2019 00:16:44 GMT
Server: AmazonS3
Age: 97
ETag: "941dbbc68e8388cbb67f0663975777a3"
X-Cache: Hit from cloudfront
Content-Type: text/javascript
Via: 1.1 560d8d35213ac925f8d05c5730db1582.cloudfront.net (CloudFront)
Cache-Control: max-age=300
Date: Mon, 23 Dec 2019 18:12:49 GMT
X-Amz-Cf-Pop: FRA6-C1
Connection: keep-alive
Content-Length: 21893
X-Amz-Cf-Id: cwn89CtJxUzJNsmXT2ahFfo5qXY_gJHO5kEYJzuzFYKzS6HrxY7fYQ==

GET
H2 200 1*A78Mi8xr0qGonw3oyheIBw.png
miro.medium.com/max/679/ 136 KB
136 KB 46ms
46ms Image
image/png 2606:4700::6810:7991
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/679/1*A78Mi8xr0qGonw3oyheIBw.png

Requested by

Host: anee.me
URL: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7991 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

f3d92afda30c3a5886195a917a68af53f7103dea11c03d3f0d3c2992c64b0636

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 23 Dec 2019 18:14:24 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 158440
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3217-8161a0a
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length: 139124
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 549c50a169a48cb0-VIE
expires: Wed, 22 Jan 2020 18:14:24 GMT

GET
H/1.1 200
OK / Show response
srv-2019-12-23-18.pixel.parsely.com/start/ 77 B
380 B 433ms
108ms Script
application/json 52.0.186.222
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://srv-2019-12-23-18.pixel.parsely.com/start/?rand=1577124864296&plid=25416794&idsite=medium.com&url=https%3A%2F%2Fanee.me%2Freversing-a-real-world-249-bytes-backdoor-aadd876c0a32&urlref=&screen=1600x1200%7C1600x1200%7C24&data=%7B%22viewerStatus%22%3A%22visitor%22%7D&sid=1&surl=https%3A%2F%2Fanee.me%2Freversing-a-real-world-249-bytes-backdoor-aadd876c0a32&sref=&sts=1577124864291&slts=0&title=Reversing+a+real-world+249+bytes+backdoor!+-+Aneesh+Dogra%E2%80%99s+Blog&date=Mon+Dec+23+2019+19%3A14%3A24+GMT%2B0100+(Central+European+Standard+Time)&action=pageview&js=1&pvid=67590232&callback=parselyStartCallback
Requested by: Host: d1z2jf7jlzjs58.cloudfront.net
URL: https://d1z2jf7jlzjs58.cloudfront.net/keys/medium.com/p.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.0.186.222 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-0-186-222.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 4c9c628a7ab599bc6e3c5cf76959d68fb6d7b00ebcad55d4df295f0a1c298f28

Request headers

Referer: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 23 Dec 2019 18:14:24 GMT
Server: nginx
Connection: keep-alive
Content-Type: application/json
Content-Length: 77
P3P: CP="CUR ADM OUR NOR STA NID"

GET
H/1.1 200
OK _r Show response
app.link/ 90 B
722 B 179ms
157ms Script
text/javascript 2600:9000:2057:3400:19:9934:6a80:93a1
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://app.link/_r?sdk=web2.52.3&branch_key=key_live_ofxXr2qTrrU9NqURK8ZwEhknBxiI6KBm&callback=branch_callback__0

Requested by

Host: cdn.branch.io
URL: https://cdn.branch.io/branch-latest.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:9000:2057:3400:19:9934:6a80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

Software

openresty/1.13.6.2 / Express

Resource Hash

8b0e987839631d16141568e3bf7988a5fd6e3e200280d27eb57266e0cea8debf

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 23 Dec 2019 18:14:24 GMT
Via: 1.1 3095e870e1a1a1b03178e40ab1872de5.cloudfront.net (CloudFront)
X-Content-Type-Options: nosniff
Server: openresty/1.13.6.2
X-Amz-Cf-Pop: FRA6-C1
X-Powered-By: Express
X-Cache: Miss from cloudfront
Content-Type: text/javascript; charset=utf-8
Connection: keep-alive
Content-Length: 90
ETag: W/"5a-T2GYzVUQ1+nOCW/7oxZ2yUuvbLM"
X-Amz-Cf-Id: 7a1qMYL8MUoPDb1MS47y6IVgIzKFpyGIe2yrJuRhPc9Lks96g-1QAw==

POST
H2 200 open Show response
api2.branch.io/v1/ 312 B
601 B 332ms
317ms XHR
application/json 2600:9000:214f:4a00:11:f728:3040:93a1
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://api2.branch.io/v1/open
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.51281d83.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:214f:4a00:11:f728:3040:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software: openresty/1.13.6.2 /
Resource Hash: 3f51d1e173af1f67ac47ff7bb39c6648ff8827bfa00c125d3213fa7b3712e523

Request headers

Referer: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32
Origin: https://anee.me
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 23 Dec 2019 18:14:24 GMT
via: 1.1 73f3a23156999272233949c078c30859.cloudfront.net (CloudFront)
server: openresty/1.13.6.2
x-amz-cf-pop: FRA53-C1
status: 200
x-cache: Miss from cloudfront
content-type: application/json
access-control-allow-origin: *
cache-control: no-cache
content-length: 312
x-amz-cf-id: gunvwomuOR5TlrUpJzpMGHWeSFd9J4oKxoAQW7JFEOk6pW86pXJQlg==

OPTIONS
H/1.1 200
OK log Show response
errors.client.optimizely.com/ 13 B
399 B 494ms
112ms XHR
text/plain 34.234.146.186
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://errors.client.optimizely.com/log
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.51281d83.chunk.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.234.146.186 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-34-234-146-186.compute-1.amazonaws.com
Software: /
Resource Hash: 16f1efa415bfdd7abcf8fdd76cc05ae6fa66ffdfdc730368ecea89ecfe5c3a12

Request headers

Access-Control-Request-Method: POST
Origin: https://anee.me
Referer: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Access-Control-Request-Headers: content-type

Response headers

Date: Mon, 23 Dec 2019 18:14:25 GMT
Allow: POST,OPTIONS
Access-Control-Allow-Methods: GET,POST,OPTIONS
Content-Type: text/plain
Access-Control-Allow-Origin: https://anee.me
Access-Control-Max-Age: 1800
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: X-Requested-With,Content-Type,Accept,Origin
Content-Length: 13

POST
H2 200 render
anee.me/_/lite/performance/ 2 B
0 107ms
106ms Fetch
text/plain 52.4.145.119
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://anee.me/_/lite/performance/render

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/main.06a3617a.chunk.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

52.4.145.119 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-52-4-145-119.compute-1.amazonaws.com

Software

nginx /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	allow-from medium.com

Request headers

Referer: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32
Origin: https://anee.me
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 23 Dec 2019 18:14:24 GMT
sepia-upstream: production
server: nginx
x-frame-options: allow-from medium.com
etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc"
vary: Accept-Encoding
content-type: text/plain; charset=utf-8
status: 200
cache-control: no-cache, no-store, max-age=0, must-revalidate
x-envoy-upstream-service-time: 1
medium-fulfilled-by: lite/master-20191219-181913-44bd600411
content-length: 2

POST
H2 200 pageview Show response
api2.branch.io/v1/ 28 B
362 B 318ms
318ms XHR
application/json 2600:9000:214f:4a00:11:f728:3040:93a1
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://api2.branch.io/v1/pageview
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.51281d83.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:214f:4a00:11:f728:3040:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software: openresty/1.13.6.2 / Express
Resource Hash: a82dc28d43942326b346f92907df3bea5e38b2325ef97176f3b6234966bf19eb

Request headers

Referer: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32
Origin: https://anee.me
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 23 Dec 2019 18:14:25 GMT
via: 1.1 73f3a23156999272233949c078c30859.cloudfront.net (CloudFront)
server: openresty/1.13.6.2
x-amz-cf-pop: FRA53-C1
x-powered-by: Express
etag: W/"1c-KRZWpHfIKyIHGKJ9mp9lAyX+vFY"
status: 200
x-cache: Miss from cloudfront
content-type: application/json; charset=utf-8
access-control-allow-origin: *
content-length: 28
x-amz-cf-id: _LkM5fV9i7nUojdE56Yqvzng1l55JicPwC8Ye6tFTjS9GY9lDuXoCw==

OPTIONS
H2 200 reports Show response
collector-medium.lightstep.com/api/v0/ 0
174 B 328ms
109ms XHR
text/plain 3.224.124.214
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-medium.lightstep.com/api/v0/reports
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.51281d83.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.224.124.214 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-3-224-124-214.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Access-Control-Request-Method: POST
Origin: https://anee.me
Referer: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Access-Control-Request-Headers: content-type,lightstep-access-token

Response headers

status: 200
date: Mon, 23 Dec 2019 18:14:25 GMT
access-control-allow-credentials: true
access-control-allow-origin: *
access-control-allow-headers: LightStep-Access-Token, Content-Type
content-length: 0
access-control-allow-methods: POST

POST
H2 200 pageview Show response
api2.branch.io/v1/ 28 B
362 B 318ms
317ms XHR
application/json 2600:9000:214f:4a00:11:f728:3040:93a1
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://api2.branch.io/v1/pageview
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.51281d83.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:214f:4a00:11:f728:3040:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software: openresty/1.13.6.2 / Express
Resource Hash: a82dc28d43942326b346f92907df3bea5e38b2325ef97176f3b6234966bf19eb

Request headers

Referer: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32
Origin: https://anee.me
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 23 Dec 2019 18:14:25 GMT
via: 1.1 73f3a23156999272233949c078c30859.cloudfront.net (CloudFront)
server: openresty/1.13.6.2
x-amz-cf-pop: FRA53-C1
x-powered-by: Express
etag: W/"1c-KRZWpHfIKyIHGKJ9mp9lAyX+vFY"
status: 200
x-cache: Miss from cloudfront
content-type: application/json; charset=utf-8
access-control-allow-origin: *
content-length: 28
x-amz-cf-id: 7pYLUXH_mXaHertXu4LvtItEkbDn4kBlcguBWgPAaDtmHHwSrlfuvg==

POST
H2 200 reports Show response
collector-medium.lightstep.com/api/v0/ 113 B
311 B 104ms
104ms XHR
application/json 3.224.124.214
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-medium.lightstep.com/api/v0/reports
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.224.124.214 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-3-224-124-214.compute-1.amazonaws.com
Software: /
Resource Hash: afab3e600d7a3bb8a3223ae2c4ca08b39f970c00f51b8bf1cfa04599e5e72935

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32
Origin: https://anee.me
LightStep-Access-Token: ce5be895bef60919541332990ac9fef2
Content-Type: application/json

Response headers

date: Mon, 23 Dec 2019 18:14:25 GMT
status: 200
access-control-allow-methods: POST
content-type: application/json
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: LightStep-Access-Token, Content-Type
content-length: 113

POST
H/1.1 204
No Content log Show response
errors.client.optimizely.com/ 0
233 B 113ms
113ms XHR
text/plain 34.234.146.186
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://errors.client.optimizely.com/log
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.234.146.186 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-34-234-146-186.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32
Origin: https://anee.me
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/json

Response headers

Access-Control-Allow-Origin: https://anee.me
Access-Control-Expose-Headers
Access-Control-Allow-Credentials: true
Connection: keep-alive
Date: Mon, 23 Dec 2019 18:14:25 GMT
Content-Type: text/plain

OPTIONS
H2 200 reports Show response
collector-medium.lightstep.com/api/v0/ 0
174 B 102ms
102ms XHR
text/plain 3.224.124.214
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-medium.lightstep.com/api/v0/reports
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.51281d83.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.224.124.214 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-3-224-124-214.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Access-Control-Request-Method: POST
Origin: https://anee.me
Referer: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Access-Control-Request-Headers: content-type,lightstep-access-token

Response headers

status: 200
date: Mon, 23 Dec 2019 18:14:25 GMT
access-control-allow-credentials: true
access-control-allow-origin: *
access-control-allow-headers: LightStep-Access-Token, Content-Type
content-length: 0
access-control-allow-methods: POST

POST
H2 200 reports Show response
collector-medium.lightstep.com/api/v0/ 113 B
311 B 104ms
103ms XHR
application/json 3.224.124.214
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-medium.lightstep.com/api/v0/reports
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.224.124.214 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-3-224-124-214.compute-1.amazonaws.com
Software: /
Resource Hash: ac6e7fb0065482fe5e4f632efd85e4f1c12dbc37a1230dbff98c493621f7d206

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32
Origin: https://anee.me
LightStep-Access-Token: ce5be895bef60919541332990ac9fef2
Content-Type: application/json

Response headers

date: Mon, 23 Dec 2019 18:14:25 GMT
status: 200
access-control-allow-methods: POST
content-type: application/json
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: LightStep-Access-Token, Content-Type
content-length: 113

OPTIONS
H2 200 reports Show response
collector-medium.lightstep.com/api/v0/ 0
174 B 104ms
104ms XHR
text/plain 3.224.124.214
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-medium.lightstep.com/api/v0/reports
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.51281d83.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.224.124.214 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-3-224-124-214.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Access-Control-Request-Method: POST
Origin: https://anee.me
Referer: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Access-Control-Request-Headers: content-type,lightstep-access-token

Response headers

status: 200
date: Mon, 23 Dec 2019 18:14:26 GMT
access-control-allow-credentials: true
access-control-allow-origin: *
access-control-allow-headers: LightStep-Access-Token, Content-Type
content-length: 0
access-control-allow-methods: POST

POST
H2 200 reports Show response
collector-medium.lightstep.com/api/v0/ 113 B
311 B 103ms
103ms XHR
application/json 3.224.124.214
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-medium.lightstep.com/api/v0/reports
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.224.124.214 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-3-224-124-214.compute-1.amazonaws.com
Software: /
Resource Hash: 4c4eb212330cef7b9f77c5191498a70b7112854f5c9499dc016dcb152957139e

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32
Origin: https://anee.me
LightStep-Access-Token: ce5be895bef60919541332990ac9fef2
Content-Type: application/json

Response headers

date: Mon, 23 Dec 2019 18:14:26 GMT
status: 200
access-control-allow-methods: POST
content-type: application/json
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: LightStep-Access-Token, Content-Type
content-length: 113

OPTIONS
H2 200 reports Show response
collector-medium.lightstep.com/api/v0/ 0
174 B 104ms
103ms XHR
text/plain 3.224.124.214
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-medium.lightstep.com/api/v0/reports
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.51281d83.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.224.124.214 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-3-224-124-214.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Access-Control-Request-Method: POST
Origin: https://anee.me
Referer: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Access-Control-Request-Headers: content-type,lightstep-access-token

Response headers

status: 200
date: Mon, 23 Dec 2019 18:14:26 GMT
access-control-allow-credentials: true
access-control-allow-origin: *
access-control-allow-headers: LightStep-Access-Token, Content-Type
content-length: 0
access-control-allow-methods: POST

POST
H2 200 reports Show response
collector-medium.lightstep.com/api/v0/ 113 B
311 B 102ms
102ms XHR
application/json 3.224.124.214
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-medium.lightstep.com/api/v0/reports
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.224.124.214 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-3-224-124-214.compute-1.amazonaws.com
Software: /
Resource Hash: 5161f0246f5c30f17177c2fef245f7475f4d18761fe29a0610cffc67c7a4b1b5

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32
Origin: https://anee.me
LightStep-Access-Token: ce5be895bef60919541332990ac9fef2
Content-Type: application/json

Response headers

date: Mon, 23 Dec 2019 18:14:26 GMT
status: 200
access-control-allow-methods: POST
content-type: application/json
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: LightStep-Access-Token, Content-Type
content-length: 113

POST
H2 200 batch
anee.me/_/ 97 B
0 154ms
154ms Fetch
application/json 52.4.145.119
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://anee.me/_/batch

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/main.06a3617a.chunk.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

52.4.145.119 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-52-4-145-119.compute-1.amazonaws.com

Software

nginx / Medium

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; connect-src https://localhost https://.instapaper.com https://.stripe.com https://glyph.medium.com https://.paypal.com https://getpocket.com https://anee.me https://.anee.me https://.medium.com https://medium.com https://.medium.com https://.algolia.net https://cdn-static-1.medium.com https://dnqgz544uhbo8.cloudfront.net https://cdn-videos-1.medium.com https://cdn-audio-1.medium.com https://.lightstep.com https://.branch.io 'self'; font-src data: https://.amazonaws.com https://.medium.com https://glyph.medium.com https://medium.com https://.gstatic.com https://dnqgz544uhbo8.cloudfront.net https://cdn-static-1.medium.com 'self'; frame-src chromenull: https: webviewprogressproxy: medium: 'self'; img-src blob: data: https: 'self'; media-src https://.cdn.vine.co https://d1fcbxp97j4nb2.cloudfront.net https://d262ilb51hltx0.cloudfront.net https://.medium.com https://gomiro.medium.com https://miro.medium.com https://pbs.twimg.com 'self' blob:; object-src 'self'; script-src 'unsafe-eval' 'unsafe-inline' about: https: 'self'; style-src 'unsafe-inline' data: https: 'self'; report-uri https://csp.medium.com
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Referer: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32
Origin: https://anee.me
x-xsrf-token: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
content-type: application/json

Response headers

content-security-policy: default-src 'self'; connect-src https://localhost https://*.instapaper.com https://*.stripe.com https://glyph.medium.com https://*.paypal.com https://getpocket.com https://anee.me https://*.anee.me https://*.medium.com https://medium.com https://*.medium.com https://*.algolia.net https://cdn-static-1.medium.com https://dnqgz544uhbo8.cloudfront.net https://cdn-videos-1.medium.com https://cdn-audio-1.medium.com https://*.lightstep.com https://*.branch.io 'self'; font-src data: https://*.amazonaws.com https://*.medium.com https://glyph.medium.com https://medium.com https://*.gstatic.com https://dnqgz544uhbo8.cloudfront.net https://cdn-static-1.medium.com 'self'; frame-src chromenull: https: webviewprogressproxy: medium: 'self'; img-src blob: data: https: 'self'; media-src https://*.cdn.vine.co https://d1fcbxp97j4nb2.cloudfront.net https://d262ilb51hltx0.cloudfront.net https://*.medium.com https://gomiro.medium.com https://miro.medium.com https://pbs.twimg.com 'self' blob:; object-src 'self'; script-src 'unsafe-eval' 'unsafe-inline' about: https: 'self'; style-src 'unsafe-inline' data: https: 'self'; report-uri https://csp.medium.com
x-content-type-options: nosniff
x-powered-by: Medium
x-obvious-info: 39605-e8d6318,e8d63184489
status: 200
content-length: 97
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge, Chrome=1
pragma: no-cache
link: <https://medium.com/humans.txt>; rel="humans"
x-obvious-tid: 1577124868866:bd974158f350
server: nginx
date: Mon, 23 Dec 2019 18:14:28 GMT
x-frame-options: sameorigin
content-type: application/json; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
x-opentracing: {"ot-tracer-spanid":"65912e91498a7c2f","ot-tracer-traceid":"78ffe8d469e3757f","ot-tracer-sampled":"true"}
expires: Thu, 09 Sep 1999 09:09:09 GMT

OPTIONS
H2 200 reports Show response
collector-medium.lightstep.com/api/v0/ 0
174 B 106ms
106ms XHR
text/plain 3.224.124.214
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-medium.lightstep.com/api/v0/reports
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.51281d83.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.224.124.214 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-3-224-124-214.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Access-Control-Request-Method: POST
Origin: https://anee.me
Referer: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Access-Control-Request-Headers: content-type,lightstep-access-token

Response headers

status: 200
date: Mon, 23 Dec 2019 18:14:29 GMT
access-control-allow-credentials: true
access-control-allow-origin: *
access-control-allow-headers: LightStep-Access-Token, Content-Type
content-length: 0
access-control-allow-methods: POST

POST
H2 200 reports Show response
collector-medium.lightstep.com/api/v0/ 113 B
311 B 104ms
104ms XHR
application/json 3.224.124.214
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-medium.lightstep.com/api/v0/reports
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.224.124.214 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-3-224-124-214.compute-1.amazonaws.com
Software: /
Resource Hash: 08115800c4cd98d34a23e9260db512d99820971fba2948ee959134eab13c24f2

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32
Origin: https://anee.me
LightStep-Access-Token: ce5be895bef60919541332990ac9fef2
Content-Type: application/json

Response headers

date: Mon, 23 Dec 2019 18:14:29 GMT
status: 200
access-control-allow-methods: POST
content-type: application/json
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: LightStep-Access-Token, Content-Type
content-length: 113

GET
H/1.1 200
OK /
srv-2019-12-23-18.pixel.parsely.com/event/ 43 B
385 B 110ms
109ms Image
image/gif 52.0.186.222
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://srv-2019-12-23-18.pixel.parsely.com/event/?rand=1577124874794&plid=25416794&idsite=medium.com&url=https%3A%2F%2Fanee.me%2Freversing-a-real-world-249-bytes-backdoor-aadd876c0a32&urlref=&screen=1600x1200%7C1600x1200%7C24&data=%7B%7D&sid=1&surl=https%3A%2F%2Fanee.me%2Freversing-a-real-world-249-bytes-backdoor-aadd876c0a32&sref=&sts=1577124874793&slts=0&date=Mon+Dec+23+2019+19%3A14%3A34+GMT%2B0100+(Central+European+Standard+Time)&action=heartbeat&inc=5&tt=4900&pvid=67590232&u=pid%3D1a2158298345a5c995a07388f8677a29
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.0.186.222 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-0-186-222.compute-1.amazonaws.com
Software: nginx /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 23 Dec 2019 18:14:34 GMT
Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT
Server: nginx
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
P3P: CP="CUR ADM OUR NOR STA NID"

Verdicts & Comments Add Verdict or Comment

25 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

10 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
anee.me/	1970-01-19 06:15:29	Name: lightstep_session_id Value: 0705c9ee5457d4ba
.anee.me/	1970-01-19 06:05:24	Name: _gat Value: 1
.anee.me/	1970-01-19 06:05:26	Name: _parsely_session Value: {%22sid%22:1%2C%22surl%22:%22https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32%22%2C%22sref%22:%22%22%2C%22sts%22:1577124864291%2C%22slts%22:0}
.anee.me/	1970-01-19 06:06:51	Name: _gid Value: GA1.2.952716686.1577124864
.anee.me/	1970-01-19 15:34:48	Name: _parsely_visitor Value: {%22id%22:%22pid=1a2158298345a5c995a07388f8677a29%22%2C%22session_count%22:1%2C%22last_session_ts%22:1577124864291}
anee.me/	1970-01-19 14:51:00	Name: sid Value: 1:gUZ0gM5FKP0QwCoWJz4z/powZ4SgHuM+jYF+/KTRW0dJrCNRpaaekro7LJy9vd4q
anee.me/	1970-01-19 06:15:29	Name: lightstep_guid/lite-web Value: 01f27fa60f62bd3d
.anee.me/	1970-01-19 23:36:36	Name: _ga Value: GA1.2.1126918382.1577124864
anee.me/	1970-01-19 14:51:00	Name: uid Value: lo_HE27pUUT5yfy
anee.me/	1970-01-19 14:51:00	Name: optimizelyEndUserId Value: lo_HE27pUUT5yfy

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://cdn-client.medium.com/lite/static/js/main.06a3617a.chunk.js(Line 1) Message: -+++++= .+++++= .+@@@@@+ #@@@@: .@@@@@= @@@@@ @+@@@@- =#@@@@@ @ +@@@@: :% @@@@@ @ @@@@-%: @@@@@ @ @@@@- @@@@@ -@- #@@+ :@@@@@: -#@@@#- ## =@@@@@@@= ....... .........
console-api	log	URL: https://cdn-client.medium.com/lite/static/js/main.06a3617a.chunk.js(Line 1) Message: We're hiring! https://medium.com/jobs-at-medium/work-at-medium-959d1a85284e

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Frame-Options	allow-from medium.com

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

anee.me
api2.branch.io
app.link
cdn-client.medium.com
cdn.branch.io
cdn.optimizely.com
collector-medium.lightstep.com
d1z2jf7jlzjs58.cloudfront.net
errors.client.optimizely.com
glyph.medium.com
medium.com
miro.medium.com
srv-2019-12-23-18.pixel.parsely.com
www.google-analytics.com
13.35.253.62
13.35.254.197
2600:9000:2057:3400:19:9934:6a80:93a1
2600:9000:214f:4a00:11:f728:3040:93a1
2606:4700::6810:797f
2606:4700::6810:7991
2a00:1450:4001:814::200e
2a02:26f0:6c00:284::13b8
3.224.124.214
34.234.146.186
52.0.186.222
52.4.145.119
037593f8fd10db1df005e17412f8d42274315767d03f74230a52f1871f03b7c4
08115800c4cd98d34a23e9260db512d99820971fba2948ee959134eab13c24f2
087a4c7aa118304c5ce85d5917d95a49b3c93204ef3500752dfde52595e4eac6
12fe85ec038af8c41ba830412520589dbd125d417913c10a57838ac92ab96192
16f1efa415bfdd7abcf8fdd76cc05ae6fa66ffdfdc730368ecea89ecfe5c3a12
200b68bbdf9c2da0d476171ed46ffab16cac6ee742582310438d511c7cd7d315
20f36dc2227fc491ac960bbcaf3faba3fdce162151e89501fa7d7d02d033f87c
2f52e8e6e758abc5b140084ab9fbe9d5496dc72c3acb2fdaa31b445a17303004
30acf4ac2e2615245914a0d2e470697edddae43a5411e13f0e2b6e13c12423c2
3f51d1e173af1f67ac47ff7bb39c6648ff8827bfa00c125d3213fa7b3712e523
41532aec4c3a3a0747ca853b064ef7a96483a95798a6526974ec043997e2ccf9
43995d25616b6b617a5a16563be761aee92acf3c2486eaea066f94ca40492dde
4c0c811a3db3aa6f2b7b91d7409d8c840add9d8aa14f331277f2ea0844dc40a0
4c0cc04185396c9a83cfda3644c23327d7d8ff9247157c438575b83713894173
4c4eb212330cef7b9f77c5191498a70b7112854f5c9499dc016dcb152957139e
4c9c628a7ab599bc6e3c5cf76959d68fb6d7b00ebcad55d4df295f0a1c298f28
5161f0246f5c30f17177c2fef245f7475f4d18761fe29a0610cffc67c7a4b1b5
57416757e1bde9b95d0c6afb6f7c4a3353119a5793d69076b74df7d0dfee8127
57ed51afe6de1bc8862a42f65f0c9242c7dd33137ecae8e5f73b27c9c15d7f5a
58711bafae315df048e1bc0c36ae1dfd017810b34fd9b4b021f774694397baad
5e9acbc5206d9386f001afda29b2065e55c4a2dd5f1fbe1cad56d24b558a64e3
646ce4f3fa0efd1d0568e90ed0d30a8924ca06a0e185c785647c76cab94d9eb4
67895a0f3d58678796f298cb1afebae68139d926f603aeaee4bebefe3d19462a
74024a029175d458983dd508f4b8bb0effdee667121893b6061f5c0ed04dafdf
7f6310f71aa1f7ed7ac2c106ebb4fbca47d65e29e1e15212a7be24130d2c2d40
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
83ee3c23e78be226d825acf73ec6ca79f4a65d9c7925122e9ccbd87e04d6330b
8b0e987839631d16141568e3bf7988a5fd6e3e200280d27eb57266e0cea8debf
8b1f080db03ca75e0ea8d50f2e1d50ca82c953cd4a5cab1c0851e7a05b8b82e6
8f68c9f27e0c32a6d1909ff9382cb7e2b00b7960d9a1ef4cb887fe10a00954a4
99c5448d6c84fc71d6805e2485727db250113edcaea123a064f8c26ce95947d8
a3d669b687929b3aa777fdd2c400c2b8c6b794978536a64d7e1f71edcf8037e8
a82dc28d43942326b346f92907df3bea5e38b2325ef97176f3b6234966bf19eb
ac6e7fb0065482fe5e4f632efd85e4f1c12dbc37a1230dbff98c493621f7d206
ae3c8955d6957a614ccdafd19afa8455739ef13d5cb386dc6dca9931dd2c6acb
afab3e600d7a3bb8a3223ae2c4ca08b39f970c00f51b8bf1cfa04599e5e72935
bcacc03291e15ea96d4e21a04819ec07724402f6af7060631a333c5e20ccb158
c4ee0fb2923c088dffbcd2ecc5036d08089b254f7a1bdbd271533e1b10db402e
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d532f3e29539a73b4c3fdd03c5f5b2ac493b4277a5fd38cc732acb4ff3fbde8e
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ec658154249e4a8085e4db08af846b60a435a18504352bb8f002d889e70ece2b
ef1ed6a034a5055a869c7c25765ee1f2844a27a54e83e8a857d77b3f1cd83dd3
f3d92afda30c3a5886195a917a68af53f7103dea11c03d3f0d3c2992c64b0636
f57137897a4e676f0d2199b79def1a95b253a1a938dff9d8ba10519f3beb2b08

anee.me Open in urlscan Pro 52.4.145.119 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

51 Requests

80 %HTTPS

50 %IPv6

9 Domains

14 Subdomains

12 IPs

3 Countries

880 kBTransfer

2590 kBSize

10 Cookies

27 Outgoing links

Page URL History

Redirected requests

51 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

anee.me Open in urlscan Pro
52.4.145.119 Public Scan

Screenshot
Live screenshot

Full Image

51
Requests

80 %
HTTPS

50 %
IPv6

9
Domains

14
Subdomains

12
IPs

3
Countries

880 kB
Transfer

2590 kB
Size

10
Cookies

51 HTTP transactions
4 data transactions