urlscan.io logo urlscan.io
SecurityTrails logo

blog.cyble.com Open in urlscan Pro
192.0.78.213  Public Scan

Go To Rescan Add Verdict Report
URL: https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/
Submission Tags: falconsandbox
Submission: On February 24 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 33 IPs in 4 countries across 26 domains to perform 108 HTTP transactions. The main IP is 192.0.78.213, located in San Francisco, United States and belongs to AUTOMATTIC, US. The main domain is blog.cyble.com.
TLS certificate: Issued by R3 on January 21st 2023. Valid for: 3 months.
This is the only time blog.cyble.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
29 192.0.78.213 2635 (AUTOMATTIC)
5 192.0.77.32 2635 (AUTOMATTIC)
2 2a00:1450:400... 15169 (GOOGLE)
6 192.0.77.2 2635 (AUTOMATTIC)
3 2606:4700::68... 13335 (CLOUDFLAR...)
9 2606:4700:20:... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
3 192.0.76.3 2635 (AUTOMATTIC)
1 5 2600:9000:20e... 16509 (AMAZON-02)
4 2606:4700::68... 13335 (CLOUDFLAR...)
2 2a00:1450:400... 15169 (GOOGLE)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700:440... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2a05:d018:cc3... 16509 (AMAZON-02)
1 2001:4860:480... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
14 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2a02:26f0:350... 20940 (AKAMAI-ASN1)
1 2600:9000:20e... 16509 (AMAZON-02)
3 3 2620:1ec:22::14 8068 (MICROSOFT...)
1 13.107.42.14 8068 (MICROSOFT...)
5 2606:4700::68... 13335 (CLOUDFLAR...)
1 151.101.66.137 54113 (FASTLY)
1 2606:2c40::c7... 209242 (CLOUDFLAR...)
3 162.247.241.2 23467 (NEWRELIC-...)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
108 33
29    192.0.78.213 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
blog.cyble.com
5    192.0.77.32 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
PTR: wordpress.com
fonts-api.wp.com
s0.wp.com
fonts.wp.com
2    2a00:1450:4001:813::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
6    192.0.77.2 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
PTR: i1.wp.com
i0.wp.com
3    2606:4700::6811:b949 (United States)

ASN13335 (CLOUDFLARENET, US)
js.hsforms.net
9    2606:4700:20::681a:c31 (United States)

ASN13335 (CLOUDFLARENET, US)
injection.amibreached.com
1    2606:4700::6811:d5cc (United States)

ASN13335 (CLOUDFLARENET, US)
js.hs-scripts.com
3    192.0.76.3 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
stats.wp.com
pixel.wp.com
5    2600:9000:20eb:f200:6:9280:1080:93a1 (United States)

ASN16509 (AMAZON-02, US)
s.adroll.com
4    2606:4700::6810:5605 (United States)

ASN13335 (CLOUDFLARENET, US)
forms.hsforms.com
2    2a00:1450:4001:812::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
1    2606:4700::6811:e7cc (United States)

ASN13335 (CLOUDFLARENET, US)
js.hsleadflows.net
1    2606:4700:4400::ac40:9a55 (United States)

ASN13335 (CLOUDFLARENET, US)
js.hs-banner.com
1    2606:4700::6811:47b0 (United States)

ASN13335 (CLOUDFLARENET, US)
js.hs-analytics.net
1    2606:4700::6811:7fab (United States)

ASN13335 (CLOUDFLARENET, US)
js.hscollectedforms.net
1    2606:4700::6811:73b0 (United States)

ASN13335 (CLOUDFLARENET, US)
js.hsadspixel.net
1    2606:4700::6811:eecc (United States)

ASN13335 (CLOUDFLARENET, US)
js.usemessages.com
1    2a05:d018:cc3:fe05:8e03:6849:2fd5:b7a8 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
d.adroll.com
1    2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)
region1.google-analytics.com
1    2a00:1450:400c:c0c::9b (Brussels, Belgium)

ASN15169 (GOOGLE, US)
stats.g.doubleclick.net
14    2606:4700::6813:9b53 (United States)

ASN13335 (CLOUDFLARENET, US)
api.hubspot.com
forms.hubspot.com
app.hubspot.com
track.hubspot.com
1    2606:4700::6810:5805 (United States)

ASN13335 (CLOUDFLARENET, US)
forms-na1.hsforms.com
1    2606:4700::6811:c8cc (United States)

ASN13335 (CLOUDFLARENET, US)
api.hubapi.com
1    2a02:26f0:3500:16::215:149b (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
snap.licdn.com
1    2600:9000:20eb:1000:2:53b2:240:93a1 (United States)

ASN16509 (AMAZON-02, US)
cdn.linkedin.oribi.io
3    2620:1ec:22::14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
px.ads.linkedin.com
www.linkedin.com
1    13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
px4.ads.linkedin.com
5    2606:4700::6811:7d2 (United States)

ASN13335 (CLOUDFLARENET, US)
static.hsappstatic.net
1    151.101.66.137 (United States)

ASN54113 (FASTLY, US)
js-agent.newrelic.com
1    2606:2c40::c73c:671e (United States)

ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US)
labs.cyble.com
3    162.247.241.2 (Apex, United States)

ASN23467 (NEWRELIC-AS-1, US)
bam-cell.nr-data.net
1    2a00:1450:4001:82a::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
1    2a00:1450:4001:80f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.gstatic.com
Apex Domain
Subdomains		 Transfer
30 cyble.com
blog.cyble.com
labs.cyble.com
734 KB
14 hubspot.com
api.hubspot.com — Cisco Umbrella Rank: 4647
forms.hubspot.com — Cisco Umbrella Rank: 2971
app.hubspot.com — Cisco Umbrella Rank: 5281
track.hubspot.com — Cisco Umbrella Rank: 2166
32 KB
14 wp.com
fonts-api.wp.com — Cisco Umbrella Rank: 14415
i0.wp.com — Cisco Umbrella Rank: 3089
s0.wp.com — Cisco Umbrella Rank: 6806
stats.wp.com — Cisco Umbrella Rank: 2729
fonts.wp.com — Cisco Umbrella Rank: 13452
pixel.wp.com — Cisco Umbrella Rank: 2533
762 KB
9 amibreached.com
injection.amibreached.com
264 KB
6 adroll.com
s.adroll.com — Cisco Umbrella Rank: 2488
d.adroll.com — Cisco Umbrella Rank: 1452
82 KB
5 hsappstatic.net
static.hsappstatic.net — Cisco Umbrella Rank: 6645
295 KB
5 hsforms.com
forms.hsforms.com — Cisco Umbrella Rank: 3883
forms-na1.hsforms.com — Cisco Umbrella Rank: 6123
12 KB
4 linkedin.com
px.ads.linkedin.com — Cisco Umbrella Rank: 361
www.linkedin.com — Cisco Umbrella Rank: 564
px4.ads.linkedin.com — Cisco Umbrella Rank: 6058
3 KB
3 nr-data.net
bam-cell.nr-data.net — Cisco Umbrella Rank: 1736
2 KB
3 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 30
region1.google-analytics.com — Cisco Umbrella Rank: 2425
20 KB
3 hsforms.net
js.hsforms.net — Cisco Umbrella Rank: 5785
476 KB
2 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 44
110 KB
1 gstatic.com
www.gstatic.com
163 KB
1 google.com
www.google.com — Cisco Umbrella Rank: 2
906 B
1 newrelic.com
js-agent.newrelic.com — Cisco Umbrella Rank: 358
18 KB
1 oribi.io
cdn.linkedin.oribi.io — Cisco Umbrella Rank: 813
375 B
1 licdn.com
snap.licdn.com — Cisco Umbrella Rank: 704
5 KB
1 hubapi.com
api.hubapi.com — Cisco Umbrella Rank: 3274
877 B
1 doubleclick.net
stats.g.doubleclick.net — Cisco Umbrella Rank: 77
345 B
1 usemessages.com
js.usemessages.com — Cisco Umbrella Rank: 4579
21 KB
1 hsadspixel.net
js.hsadspixel.net — Cisco Umbrella Rank: 2994
3 KB
1 hscollectedforms.net
js.hscollectedforms.net — Cisco Umbrella Rank: 4532
25 KB
1 hs-analytics.net
js.hs-analytics.net — Cisco Umbrella Rank: 2005
20 KB
1 hs-banner.com
js.hs-banner.com — Cisco Umbrella Rank: 2016
63 KB
1 hsleadflows.net
js.hsleadflows.net — Cisco Umbrella Rank: 4038
87 KB
1 hs-scripts.com
js.hs-scripts.com — Cisco Umbrella Rank: 2106
1001 B
108 26
Domain Requested by
29 blog.cyble.com blog.cyble.com
9 injection.amibreached.com blog.cyble.com
injection.amibreached.com
7 track.hubspot.com
6 i0.wp.com blog.cyble.com
5 static.hsappstatic.net app.hubspot.com
5 s.adroll.com 1 redirects blog.cyble.com
s.adroll.com
4 forms.hsforms.com js.hsforms.net
blog.cyble.com
3 bam-cell.nr-data.net app.hubspot.com
3 app.hubspot.com js.usemessages.com
static.hsappstatic.net
app.hubspot.com
3 js.hsforms.net blog.cyble.com
js.hsforms.net
2 px.ads.linkedin.com 2 redirects
2 forms.hubspot.com js.hscollectedforms.net
js.hsleadflows.net
2 api.hubspot.com js.usemessages.com
2 pixel.wp.com blog.cyble.com
2 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
2 fonts.wp.com fonts-api.wp.com
2 www.googletagmanager.com blog.cyble.com
www.googletagmanager.com
2 fonts-api.wp.com blog.cyble.com
1 www.gstatic.com www.google.com
1 www.google.com js.hsleadflows.net
1 labs.cyble.com blog.cyble.com
1 js-agent.newrelic.com app.hubspot.com
1 px4.ads.linkedin.com blog.cyble.com
1 www.linkedin.com 1 redirects
1 cdn.linkedin.oribi.io snap.licdn.com
1 snap.licdn.com js.hsadspixel.net
1 api.hubapi.com js.hsadspixel.net
1 forms-na1.hsforms.com blog.cyble.com
1 stats.g.doubleclick.net www.google-analytics.com
1 region1.google-analytics.com www.googletagmanager.com
1 d.adroll.com s.adroll.com
1 js.usemessages.com js.hs-scripts.com
1 js.hsadspixel.net js.hs-scripts.com
1 js.hscollectedforms.net js.hs-scripts.com
1 js.hs-analytics.net js.hs-scripts.com
1 js.hs-banner.com js.hs-scripts.com
1 js.hsleadflows.net js.hs-scripts.com
1 stats.wp.com blog.cyble.com
1 js.hs-scripts.com blog.cyble.com
1 s0.wp.com blog.cyble.com
108 40
Subject Issuer Validity Valid
tls.automattic.com
R3		 2023-01-21 -
2023-04-21		 3 months crt.sh
*.wp.com
Sectigo ECC Domain Validation Secure Server CA		 2022-11-14 -
2023-12-15		 a year crt.sh
*.google-analytics.com
GTS CA 1C3		 2023-02-08 -
2023-05-03		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2022-06-15 -
2023-06-15		 a year crt.sh
s.adroll.com
Amazon		 2022-07-03 -
2023-08-01		 a year crt.sh
d.adroll.com
Amazon RSA 2048 M01		 2022-11-08 -
2023-12-07		 a year crt.sh
*.g.doubleclick.net
GTS CA 1C3		 2023-02-08 -
2023-05-03		 3 months crt.sh
hubspot.com
Cloudflare Inc ECC CA-3		 2023-02-05 -
2024-02-05		 a year crt.sh
hubapi.com
Cloudflare Inc ECC CA-3		 2022-05-07 -
2023-05-07		 a year crt.sh
snap.licdn.com
DigiCert SHA2 Secure Server CA		 2023-02-01 -
2024-01-31		 a year crt.sh
linkedin.oribi.io
Amazon		 2022-07-07 -
2023-08-06		 a year crt.sh
hsappstatic.net
Cloudflare Inc ECC CA-3		 2022-05-10 -
2023-05-10		 a year crt.sh
js-agent.newrelic.com
GlobalSign Atlas R3 DV TLS CA 2022 Q2		 2022-07-10 -
2023-08-11		 a year crt.sh
labs.cyble.com
Cloudflare Inc ECC CA-3		 2022-07-18 -
2023-07-17		 a year crt.sh
*.nr-data.net
DigiCert TLS RSA SHA256 2020 CA1		 2022-11-18 -
2023-12-19		 a year crt.sh
www.google.com
GTS CA 1C3		 2023-02-08 -
2023-05-03		 3 months crt.sh
*.gstatic.com
GTS CA 1C3		 2023-02-08 -
2023-05-03		 3 months crt.sh

This page contains 5 frames:

Primary Page: https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/
Frame ID: D9103A3A67415C00211F22E15F792FE3
Requests: 85 HTTP requests in this frame

Frame: https://js.hsforms.net/forms/v2.js
Frame ID: 775146A8990427336A30175DA66268A3
Requests: 1 HTTP requests in this frame

Frame: https://js.hsforms.net/forms/v2.js
Frame ID: 8BAE2F5F4A6C1EBD8E326D69160FD3EE
Requests: 1 HTTP requests in this frame

Frame: https://app.hubspot.com/conversations-visitor/21289959/threads/utk/35592f98564a4b4f8db8d50c9ad21901?uuid=79c07825097049f09d40c1f476e93824&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=blog.cyble.com&inApp53=false&messagesUtk=35592f98564a4b4f8db8d50c9ad21901&url=https%3A%2F%2Fblog.cyble.com%2F2022%2F03%2F31%2Fdeep-dive-analysis-borat-rat%2F&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=false&enableWidgetCookieBanner=false&isInCMS=false
Frame ID: 35E5FA7899C39E2A05E77990E713300F
Requests: 13 HTTP requests in this frame

Frame: https://injection.amibreached.com/stats.json
Frame ID: 8537D05E7CF0F81FC852F32A93C523B2
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Deep Dive Analysis – Borat RAT — Cyble

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]+s\d+\.wp\.com
  • /wp-(?:content|includes)/
Overall confidence: 100%
Detected patterns
  • (?:a|s)\.adroll\.com
Overall confidence: 100%
Detected patterns
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js
Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtag/js
Overall confidence: 100%
Detected patterns
  • js\.hs-analytics\.net/analytics
Overall confidence: 100%
Detected patterns
  • snap\.licdn\.com/li\.lms-analytics/insight\.min\.js
Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

108
Requests

98 %
HTTPS

79 %
IPv6

26
Domains

40
Subdomains

33
IPs

4
Countries

3198 kB
Transfer

9674 kB
Size

22
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 35
  • https://s.adroll.com/j/exp/ELNAF2EZDFHJRAP3ODLCUU/index.js HTTP 302
  • https://s.adroll.com/j/exp/index.js
Request Chain 76
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4053396&time=1677225467598&url=https%3A%2F%2Fblog.cyble.com%2F2022%2F03%2F31%2Fdeep-dive-analysis-borat-rat%2F HTTP 302
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D4053396%26time%3D1677225467598%26url%3Dhttps%253A%252F%252Fblog.cyble.com%252F2022%252F03%252F31%252Fdeep-dive-analysis-borat-rat%252F%26liSync%3Dtrue HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4053396&time=1677225467598&url=https%3A%2F%2Fblog.cyble.com%2F2022%2F03%2F31%2Fdeep-dive-analysis-borat-rat%2F&liSync=true HTTP 302
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4053396&time=1677225467598&url=https%3A%2F%2Fblog.cyble.com%2F2022%2F03%2F31%2Fdeep-dive-analysis-borat-rat%2F&liSync=true&e_ipv6=AQJ-Cr-xg3PeaAAAAYaCbaDUNzG7wkEQ92D4pMNpEVtk0SbQDRB-5Ty-uHwymwWf

108 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/ 		344 KB
70 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.213 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
281e04a59706f68917361c14a5f10af0547fdf83d88b2f72c9096f3b2547494d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cf-edge-cache
cache,platform=wordpress
content-encoding
br
content-type
text/html; charset=UTF-8
date
Fri, 24 Feb 2023 07:57:45 GMT
host-header
WordPress.com
link
<https://blog.cyble.com/wp-json/>; rel="https://api.w.org/" <https://blog.cyble.com/wp-json/wp/v2/posts/10342>; rel="alternate"; type="application/json" <https://wp.me/pbX1h1-2GO>; rel=shortlink
server
nginx
strict-transport-security
max-age=31536000
vary
Accept-Encoding Cookie
x-ac
2.hhn _atomic_ams BYPASS
x-hacker
If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.
x-pingback
https://blog.cyble.com/xmlrpc.php
/
blog.cyble.com/_static/ 		2 MB
206 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://blog.cyble.com/_static/??-eJylVO12qyAQfKFSEk00+dFznwVhY7dB1sPH8eTt72pNa05KWts/6sLMMAyLQy80uQguyvgKHQSpQvSKnwFikDoE2aHDE4KRJz8hzTOPPPPM0/BJ7m1q0QXZJi4b8K1sElojG0v6LCw2XvmLDPFiIUe16kIpitajuQWi0zYZtvbGZsCgAstOmbkseqaDFxZapS9Lh1k2zy3r3+9KW04LdY48kDe9hxBEiCoG0SmnWrbae5ryfRjKKyjD2BNR5NdslfzyfDKQnOKdBm9DAjLsXe5jXkxjj2L50s6jLkm9JWWWxJHRU4hiX28O364zZfbDta7kZCN2KsJ9eEwSo0riFhC/tH0sttu1Z8cdKQc0LXsQN7vI6LxB7JU+y45MsjAe2BkybXN1Ol1ioYwht/wWVamPh1qD3hdNsRdlUe+Kstys2PChPO7XwHebcg282typ52KYI5SBNCr73q03RU5IE50RhKOIGj77aFWnj5fmxCChBgjUzTI8MNd/F+N/izPrrt+XOoEsPrwg11xH8Pw9Qv91L9uqro5FXVa7/7/hVUc=
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.213 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
2e1e46a5845c7b902ee470f94c6e9e3b3f16169f9592e98575ae0b907c4dcac2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

x-hacker
If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.
date
Fri, 24 Feb 2023 07:57:46 GMT
strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Mon, 20 Feb 2023 21:09:24 GMT
server
nginx
x-ac
2.hhn _atomic_ams BYPASS
x-page-optimize
uncached
etag
W/"3e9bc07e07ce598a9695a0782f24504b"
vary
Accept-Encoding
content-type
text/css;charset=utf-8
cache-control
max-age=31536000
host-header
WordPress.com
css
fonts-api.wp.com/ 		3 KB
1002 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts-api.wp.com/css?family=Open+Sans%3A400%2C&display=fallback&ver=4.0.2
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
0f12c37bfbe94e5c37d4c4a0ab301f496683db922639b0e43f2b9977492fe57b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Fri, 24 Feb 2023 07:57:46 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
content-encoding
gzip
cross-origin-resource-policy
cross-origin
x-xss-protection
0
x-nc
BYPASS hhn 2
last-modified
Fri, 24 Feb 2023 06:55:53 GMT
server
nginx
cross-origin-opener-policy
same-origin-allow-popups
vary
Accept-Encoding, Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
css
fonts-api.wp.com/ 		72 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts-api.wp.com/css?family=Open+Sans%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic%7CRoboto+Slab%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic%7CRoboto%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic&display=auto&ver=6.1.1
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
9cbfded9ac9d2c7859171766e11fd1b8feb6301984b505af951e4fbe3d443347
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Fri, 24 Feb 2023 07:57:46 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
content-encoding
gzip
cross-origin-resource-policy
cross-origin
x-xss-protection
0
x-nc
BYPASS hhn 2
last-modified
Fri, 24 Feb 2023 06:44:56 GMT
server
nginx
cross-origin-opener-policy
same-origin-allow-popups
vary
Accept-Encoding, Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
token-bridge.js
blog.cyble.com/wp-content/plugins/jetpack/jetpack_vendor/automattic/jetpack-videopress/build/lib/ 		10 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.cyble.com/wp-content/plugins/jetpack/jetpack_vendor/automattic/jetpack-videopress/build/lib/token-bridge.js?ver=0.10.12
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.213 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
5891c67601020cabaf90ed5ddda027b085f57af3ab6c669cdeadd85ddd1f62a8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Fri, 24 Feb 2023 07:57:46 GMT
strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Mon, 20 Feb 2023 21:09:24 GMT
server
nginx
x-ac
2.hhn _atomic_ams BYPASS
etag
W/"63f3e184-26ca"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=315360000
expires
Thu, 31 Dec 2037 23:55:55 GMT
jquery.min.js
blog.cyble.com/wp-includes/js/jquery/ 		88 KB
31 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.cyble.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.1
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.213 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
cc7403bab52ed166e24ea9324241045af370be482f5b594468f4a6ac6e7e7981
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Fri, 24 Feb 2023 07:57:46 GMT
strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Mon, 19 Sep 2022 14:16:24 GMT
server
nginx
x-ac
2.hhn _atomic_ams BYPASS
etag
W/"632879b8-15e54"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=315360000
expires
Thu, 31 Dec 2037 23:55:55 GMT
/
blog.cyble.com/_static/ 		20 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.cyble.com/_static/??-eJx1jUsKwzAMRC9UJfSTZFV6lGAc1diNJVeSMb19k5JtYWA28960ApH8WhfUPm15V5TPUZBjEGfY5Uhd0lMr4JkMyfqy1hBJ+8ayFEFVUHOmkB25gAJFeNf5qsZ5fsqGzUn/SDzzKyIQW/S4Y7/98frI9/M4DcP1dhmnLwxDQVA=
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.213 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
82dbeea789c21359a9d808969f52d40a37ac85078a6cd1cbee0e702314c46997
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

x-hacker
If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.
date
Fri, 24 Feb 2023 07:57:46 GMT
strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Sat, 04 Feb 2023 18:11:07 GMT
server
nginx
x-ac
2.hhn _atomic_ams BYPASS
x-page-optimize
uncached
etag
W/"9a121e33c9fcb9609f70d3536458e3a7"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=31536000
host-header
WordPress.com
js
www.googletagmanager.com/gtag/ 		111 KB
44 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=UA-201575643-1
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
00e2f93c1204e4b91261e71d2100e678888a67ba2579d404caa472516d117ac7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Fri, 24 Feb 2023 07:57:46 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
44571
x-xss-protection
0
last-modified
Fri, 24 Feb 2023 06:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Fri, 24 Feb 2023 07:57:46 GMT
wp-emoji-release.min.js
blog.cyble.com/wp-includes/js/ 		18 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.cyble.com/wp-includes/js/wp-emoji-release.min.js?ver=6.1.1
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.213 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
5aad5fbd4238981a9ff5e2772ff1353dfe1a801fb49542fe157418c1438f7782
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Fri, 24 Feb 2023 07:57:46 GMT
strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Tue, 12 Apr 2022 05:56:23 GMT
server
nginx
x-ac
2.hhn _atomic_ams BYPASS
etag
W/"62551487-48b9"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=315360000
expires
Thu, 31 Dec 2037 23:55:55 GMT
Cyble-CIRIL-pyyv4ww1nowvginyhq7nrmlg0x8pxv1qcifo3udnvq.png
blog.cyble.com/wp-content/uploads/elementor/thumbs/ 		4 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.cyble.com/wp-content/uploads/elementor/thumbs/Cyble-CIRIL-pyyv4ww1nowvginyhq7nrmlg0x8pxv1qcifo3udnvq.png
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.213 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef896b86a77ae191af41c2714906decbab4bbb7fd32321c14f4f398eb7f264ba
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Fri, 24 Feb 2023 07:57:46 GMT
strict-transport-security
max-age=31536000
x-ac
2.hhn _atomic_ams BYPASS
last-modified
Sat, 10 Dec 2022 19:16:39 GMT
server
nginx
etag
"6394db17-11bc"
access-control-allow-methods
GET, HEAD
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=604800
accept-ranges
bytes
content-length
4540
expires
Fri, 03 Mar 2023 07:57:46 GMT
subscribe-to-CRIL.jpg
i0.wp.com/blog.cyble.com/wp-content/uploads/2021/11/ 		16 KB
16 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i0.wp.com/blog.cyble.com/wp-content/uploads/2021/11/subscribe-to-CRIL.jpg
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
382e9768b5578d5ad05e51e37670a3cf93d4593a49bcbee1f5e8b66d0d8c1c53
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

x-nc
HIT hhn 3
date
Fri, 24 Feb 2023 07:57:46 GMT
x-content-type-options
nosniff
last-modified
Sat, 10 Dec 2022 20:48:17 GMT
server
nginx
etag
"90f4a9863ca68d73"
vary
Accept
access-control-allow-methods
GET, HEAD
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=63115200
timing-allow-origin
*
link
<http://blog.cyble.com/wp-content/uploads/2021/11/subscribe-to-CRIL.jpg>; rel="canonical"
content-length
16232
expires
Tue, 10 Dec 2024 08:48:17 GMT
v2.js
js.hsforms.net/forms/ 		509 KB
159 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.hsforms.net/forms/v2.js
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:b949 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
00bc02698b9ebaa0d592d285bb9a3f1b3a85f93fa5d9c696d0787f2f4ce07df9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Fri, 24 Feb 2023 07:57:46 GMT
x-amz-version-id
97n1NK24479GA_0k3m6LzTvBevV5homK
via
1.1 fc5ebd2517d85e358aa686aaadd64c2a.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-amz-cf-pop
IAD55-P3
age
467
x-amz-server-side-encryption
AES256
content-security-policy-report-only
frame-ancestors 'self'; report-uri https://exceptions.hubspot.com/csp/report?resource=forms-embed/static-1.2730/bundles/project-v2.js&cfRay=79e69b95abd59bc8-IAD
x-cache
Hit from cloudfront
cache-tag
staticjsapp-forms-embed-v2-web-prod,staticjsapp-prod
content-encoding
br
x-amz-replication-status
COMPLETED
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Wed, 22 Feb 2023 10:16:31 UTC
server
cloudflare
etag
W/"868e4e70cc752a1ded857134fa6c3ac2"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=flU%2FTod2QaMteoVP3CAgCmde1ROCMeXdMH9FBrT7GknB%2Faws%2FJIGIrzaKZHvnH9y%2BgZYK%2BBmFcu7dwNV8GkrakAcDkat87fIfUs%2FteE1zlegKJJCJO1uZIZIvt8CErn9zciyJE8lEgBTaXre"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
x-hs-cache-status
HIT
cache-control
s-maxage=600, max-age=300
cf-ray
79e6a6fc3ced9162-FRA
x-amz-cf-id
9JhLsG3I5s6lWzluVh8Um5fCD7R004iOYIN0YhukSeK6yJpAwwjbbw==
x-hs-target-asset
forms-embed/static-1.2730/bundles/project-v2.js
aib-injectable.js
injection.amibreached.com/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://injection.amibreached.com/aib-injectable.js
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:c31 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
186cb05caa2a06748336b3123d7ac53986a650cffcab18f34e5c0ee3c057f591
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Fri, 24 Feb 2023 07:57:46 GMT
strict-transport-security
max-age=15552000; includeSubDomains; preload
via
1.1 c359abeab0060e721cfaac65ce34b1cc.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-content-type-options
nosniff
age
2952
x-amz-cf-pop
FRA56-C1
content-encoding
br
x-cache
Hit from cloudfront
last-modified
Mon, 23 May 2022 20:31:50 GMT
server
cloudflare
etag
W/"662ed2e07a2c9b151332e0a8da3b9922"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9CZiPghCZQWGlDvvk9kRX6HV27rUUTKQwOrlBY4%2FM04E4htQfQ27xEKhiTtYipnefhk090AqTnW%2FgvjlkW%2Bkn63ZHu8jsGUZAi6%2FtMLGi5tlBtCV%2B01lMbxJSwDDXxN5bTgbTFvIa8tXfax0eRgW%2BjcSqBYlheU%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=120
cf-ray
79e6a6fcedeb3614-FRA
x-amz-cf-id
cjncDtiGuIKDizzHASD4Tf5K1-7Y9hXmDCrCaSYRzts7Wdw2-NgMXw==
Cyble-Black-Logo-pgc6refcqrafz6dvgr4i3sq3uvztw8xaslgdchelt6.png
blog.cyble.com/wp-content/uploads/elementor/thumbs/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.cyble.com/wp-content/uploads/elementor/thumbs/Cyble-Black-Logo-pgc6refcqrafz6dvgr4i3sq3uvztw8xaslgdchelt6.png
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.213 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
05096f7a0e9de1566ba03be810da6d252f233a7c999021d5f2f3aa975e92ab0f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Fri, 24 Feb 2023 07:57:46 GMT
strict-transport-security
max-age=31536000
x-ac
2.hhn _atomic_ams BYPASS
last-modified
Sat, 10 Dec 2022 19:08:28 GMT
server
nginx
etag
"6394d92c-c9d"
access-control-allow-methods
GET, HEAD
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=604800
accept-ranges
bytes
content-length
3229
expires
Fri, 03 Mar 2023 07:57:46 GMT
bilmur.min.js
s0.wp.com/wp-content/js/ 		7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/wp-content/js/bilmur.min.js?m=202308
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
51dc1ea3b9642d966bbdf2c63346e4d2d3f668a693fa8e7f1e31bf6acbe48860

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

x-nc
HIT hhn 2
date
Fri, 24 Feb 2023 07:57:46 GMT
content-encoding
br
x-ac
2.hhn _dfw MISS
server
nginx
etag
W/"63bbf1d2-1a69"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
expires
Tue, 20 Feb 2024 00:00:00 GMT
/
blog.cyble.com/_static/ 		38 KB
8 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://blog.cyble.com/_static/??-eJyVjMsOwiAQRX9IOqmJlY3xWyi9NugwEAbC7xcTXblyee7j9Gx8kgqplLntQZTAiINTIaeKqsRhpccYGdehKYK8KhXsjV2ZYpBp8Kn/ip6o2fkXxbQ1hpJ3JTUFk/aQUczaZGP8/f4U5hu8Bfd4m5freb5Yu9gDLeFQRA==
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.213 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1e6ebf687f918671709224ad3047910b592542de487e4a38209f42d58b0062a5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

x-hacker
If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.
date
Fri, 24 Feb 2023 07:57:46 GMT
strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Tue, 27 Dec 2022 16:34:28 GMT
server
nginx
x-ac
2.hhn _atomic_ams BYPASS
x-page-optimize
uncached
etag
W/"35b150a0a020bb35697e5bd7022fc4d7"
vary
Accept-Encoding
content-type
text/css;charset=utf-8
cache-control
max-age=31536000
host-header
WordPress.com
form-styles.js
blog.cyble.com/wp-content/plugins/jetpack/modules/contact-form/js/ 		5 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.cyble.com/wp-content/plugins/jetpack/modules/contact-form/js/form-styles.js?ver=11.9-a.5
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.213 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1995d935c3a3de4ce9fe397f5a5e0384fc241d4b96672c9370507b8a40f07f1c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Fri, 24 Feb 2023 07:57:46 GMT
strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Mon, 20 Feb 2023 21:09:24 GMT
server
nginx
x-ac
2.hhn _atomic_ams BYPASS
etag
W/"63f3e184-12da"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=315360000
expires
Thu, 31 Dec 2037 23:55:55 GMT
/
blog.cyble.com/_static/ 		18 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.cyble.com/_static/??wp-content/themes/astra/assets/js/minified/frontend.min.js,wp-content/plugins/jetpack/_inc/build/photon/photon.min.js?m=1674151884
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.213 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
88f35c5a0bc3765e6c46152a4312f977886f1535ba7b7d6c96089318bc632b3e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

x-hacker
If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.
date
Fri, 24 Feb 2023 07:57:46 GMT
strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Thu, 19 Jan 2023 18:11:24 GMT
server
nginx
x-ac
2.hhn _atomic_ams BYPASS
x-page-optimize
uncached
etag
W/"2d6ef5a76fbc8ae6bcf44ca6e8e82f2c"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=31536000
host-header
WordPress.com
21289959.js
js.hs-scripts.com/ 		3 KB
1001 B 		Script
General
Check archive.org
Download Go to
Full URL
https://js.hs-scripts.com/21289959.js?integration=WordPress&ver=10.0.21
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:d5cc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
00585b51d2e93e6d4c40e66779584602f9943952c189b02e53bc3ea1355b5e7f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Fri, 24 Feb 2023 07:57:46 GMT
content-encoding
br
cf-cache-status
EXPIRED
last-modified
Fri, 24 Feb 2023 06:48:14 GMT
server
cloudflare
x-hubspot-correlation-id
7e7c6f25-377c-4436-af92-654a78469c47
x-trace
2BE1E0777366CD849E1E4DF67C10A8D1F8C6028A12000000000000000000
vary
origin, Accept-Encoding
access-control-max-age
3600
content-type
application/javascript;charset=utf-8
access-control-allow-origin
https://blog.cyble.com
cache-control
public, max-age=60
access-control-allow-credentials
true
cf-ray
79e6a6fe29c3bb50-FRA
expires
Fri, 24 Feb 2023 07:58:46 GMT
/
blog.cyble.com/_static/ 		293 KB
78 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.cyble.com/_static/??-eJytU9tuwjAM/aGFbC0q9GHap6C0MSUsTbrYgcHXz71BpVGY0F6axnbOJXaOjSi9I3AkY2O90igVUlBCae3d9F9kaZmvVyXAcrlOE7F8zZM0SfPFHl+OV5TGxso4lHugRpWf47o5gNM+SBXJ14rIlGNGWHU+CVOrClBqgyQNIwWEkgyz+gIhHCD8P80kMAO+A6UhiK33LEiAhZqzjG4cw6Lchq5ez5y+1IsmeL5JBEJpTSGxVoE4FVn+V4RwWlwji9q4B1Y3LX0RjdWyVMFHBHsxOQYmMFxto2bTrLh327YZ9B2maIkrCSaWp/KtYRXd92kMg558A+P6FA6fEewpKrCi8Uj37u6+mr4LY04EQHOGIbrpd3ewb/aZhR2h6HrC0UWIjgX8CeU3wpOnx/EUtdfRAs7MRPcWhmcToAIHQbVmHpNWkbcFhGqYxh6Ep4whiFtiT1tj50ZxSsupG9WP6Hbef7ZkGr6HUx/1+1u2yvJklWbLH2Mg2hs=
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.213 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
40fa423c0a2005cdbcc227e2f80036430c2a57c240691735c2be49fa6a73a00a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

x-hacker
If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.
date
Fri, 24 Feb 2023 07:57:46 GMT
strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Mon, 20 Feb 2023 21:09:24 GMT
server
nginx
x-ac
2.hhn _atomic_ams BYPASS
x-page-optimize
uncached
etag
W/"b4558e1cd543ffb11657a0a18ceefa44"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=31536000
host-header
WordPress.com
index.min.js
blog.cyble.com/wp-content/plugins/gutenberg/build/i18n/ 		10 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.cyble.com/wp-content/plugins/gutenberg/build/i18n/index.min.js?ver=3d2aeabd3f84698c0e2c
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.213 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
81ca0d70f50ab00f0c1e0933c11bf7bb6aada2366994784564f4d324dfd7a60c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Fri, 24 Feb 2023 07:57:46 GMT
strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Wed, 07 Dec 2022 20:54:04 GMT
server
nginx
x-ac
2.hhn _atomic_ams BYPASS
etag
W/"6390fd6c-26bc"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=315360000
expires
Thu, 31 Dec 2037 23:55:55 GMT
frontend.min.js
blog.cyble.com/wp-content/plugins/elementor-pro/assets/js/ 		22 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.cyble.com/wp-content/plugins/elementor-pro/assets/js/frontend.min.js?ver=3.11.1
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.213 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
49c8a7c10278c65517da8ce7b7f1776f72550c01169b00d2e99f95866d423d20
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Fri, 24 Feb 2023 07:57:46 GMT
strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Thu, 16 Feb 2023 18:11:11 GMT
server
nginx
x-ac
2.hhn _atomic_ams BYPASS
etag
W/"63ee71bf-576a"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=315360000
expires
Thu, 31 Dec 2037 23:55:55 GMT
/
blog.cyble.com/_static/ 		33 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.cyble.com/_static/??wp-content/plugins/elementor/assets/lib/waypoints/waypoints.min.js,wp-includes/js/jquery/ui/core.min.js?m=1671645681
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.213 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
984d8a00a23b717ad2d084139b7a0880fb888e7c9030a11f5e3bfde3670ffa68
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

x-hacker
If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.
date
Fri, 24 Feb 2023 07:57:46 GMT
strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Wed, 21 Dec 2022 18:01:21 GMT
server
nginx
x-ac
2.hhn _atomic_ams BYPASS
x-page-optimize
uncached
etag
W/"9cb3e1480a9e0fd65c0c8636bb9812ac"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=31536000
host-header
WordPress.com
frontend.min.js
blog.cyble.com/wp-content/plugins/elementor/assets/js/ 		40 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.cyble.com/wp-content/plugins/elementor/assets/js/frontend.min.js?ver=3.9.2
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.213 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
a9c399a3695f864f52665163ff94626e3b77b44747e1519b03e5f82597b004d7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Fri, 24 Feb 2023 07:57:46 GMT
strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Wed, 21 Dec 2022 18:01:21 GMT
server
nginx
x-ac
2.hhn _atomic_ams BYPASS
etag
W/"63a349f1-9ef8"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=315360000
expires
Thu, 31 Dec 2037 23:55:55 GMT
elements-handlers.min.js
blog.cyble.com/wp-content/plugins/elementor-pro/assets/js/ 		29 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.cyble.com/wp-content/plugins/elementor-pro/assets/js/elements-handlers.min.js?ver=3.11.1
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.213 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1ebc29b1b1236540315d066cde79707059f371d75f34d274a28bbf90fc5e4620
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Fri, 24 Feb 2023 07:57:46 GMT
strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Thu, 16 Feb 2023 18:11:11 GMT
server
nginx
x-ac
2.hhn _atomic_ams BYPASS
etag
W/"63ee71bf-73a1"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=315360000
expires
Thu, 31 Dec 2037 23:55:55 GMT
jquery.sticky.min.js
blog.cyble.com/wp-content/plugins/elementor-pro/assets/lib/sticky/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.cyble.com/wp-content/plugins/elementor-pro/assets/lib/sticky/jquery.sticky.min.js?m=1676571071
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.213 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
34bbd1c367ffc7d80fcff86c7e5f8777e70f4911bb324e8ecfc7dd3604a96e68
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Fri, 24 Feb 2023 07:57:46 GMT
strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Thu, 16 Feb 2023 18:11:11 GMT
server
nginx
x-ac
2.hhn _atomic_ams BYPASS
etag
W/"63ee71bf-e89"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=315360000
expires
Thu, 31 Dec 2037 23:55:55 GMT
e-202308.js
stats.wp.com/ 		9 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://stats.wp.com/e-202308.js
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
82d0aae1e7b8cfc0574d6548d1f35096f5e4310321aa964ff3fdb46c4d12e302

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

x-nc
HIT hhn
date
Fri, 24 Feb 2023 07:57:46 GMT
content-encoding
br
server
nginx
etag
W/"62f6b688-3508"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
expires
Mon, 19 Feb 2024 09:43:34 GMT
wsm_new.js
blog.cyble.com/wp-content/plugins/wordpress-stats-manager-pro/js/ 		23 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.cyble.com/wp-content/plugins/wordpress-stats-manager-pro/js/wsm_new.js?v=1.1
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.213 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
7883c3cfb3f71df2ec3c0574dd83d0b6849a12248b6b9142ea99752636310a47
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Fri, 24 Feb 2023 07:57:46 GMT
strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Sat, 04 Feb 2023 18:11:07 GMT
server
nginx
x-ac
2.hhn _atomic_ams BYPASS
etag
W/"63de9fbb-5d2e"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=315360000
expires
Thu, 31 Dec 2037 23:55:55 GMT
roundtrip.js
s.adroll.com/j/ELNAF2EZDFHJRAP3ODLCUU/ 		75 KB
23 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s.adroll.com/j/ELNAF2EZDFHJRAP3ODLCUU/roundtrip.js
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20eb:f200:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
efcc7b4245ed6c18ad0297df0cbe908c617d6b14be42f8628a762393d493bacd

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

X-Amz-Version-Id
ssDLOOIaBvMvYRrCwEIWmLedr9Xa_u3J
Content-Encoding
gzip
Via
1.1 34f50889bc574f1edeb41dd758962a5a.cloudfront.net (CloudFront)
Date
Fri, 24 Feb 2023 07:57:46 GMT
Age
433
X-Amz-Cf-Pop
FRA2-C1
X-Amz-Server-Side-Encryption
AES256
Transfer-Encoding
chunked
X-Cache
Hit from cloudfront
Connection
keep-alive
Last-Modified
Wed, 22 Feb 2023 05:53:21 GMT
Server
AmazonS3
Etag
W/"dfdf35742911bb97b0594cef6c3c669d"
Vary
Accept-Encoding
Access-Control-Max-Age
600
Content-Type
text/javascript; charset=utf-8
Access-Control-Allow-Origin
*
Access-Control-Allow-Methods
GET
Cache-Control
max-age=3600, must-revalidate
Access-Control-Allow-Credentials
false
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
pueFS5S1mYQ02Vsj55F9egsUAIhLv8DLYsGDKbxRZ-28WQn-SFg7Fw==
truncated
/ 		42 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Content-Type
image/gif
json
forms.hsforms.com/embed/v3/form/21289959/f7da69d1-3801-430f-b109-5f44b65a9326/ 		37 KB
6 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://forms.hsforms.com/embed/v3/form/21289959/f7da69d1-3801-430f-b109-5f44b65a9326/json?hs_static_app=forms-embed&hs_static_app_version=1.2730&X-HubSpot-Static-App-Info=forms-embed-1.2730
Requested by
Host: js.hsforms.net
URL: https://js.hsforms.net/forms/v2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5605 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3a97df184952701ca99e998fc63f05cc6182b2810e8dd15f7ea57012c11cb3a1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept
application/json, text/plain, */*
Referer
https://blog.cyble.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

x-origin-hublet
na1
date
Fri, 24 Feb 2023 07:57:46 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
br
cf-cache-status
DYNAMIC
x-hubspot-correlation-id
6197f04b-e48c-4a34-9d6c-a7c3a0cd9ff6
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
server
cloudflare
x-trace
2B801CE70FE7B5B3F7E8B2C577141FC354908E8EC7000000000000000000
vary
origin
access-control-allow-methods
OPTIONS, GET
content-type
application/json;charset=utf-8
access-control-allow-origin
https://blog.cyble.com
access-control-expose-headers
X-Origin-Hublet
access-control-max-age
180
access-control-allow-credentials
false
cache-control
max-age=0, no-cache, no-store
x-robots-tag
none
access-control-allow-headers
*
cf-ray
79e6a6feca3f2bb2-FRA
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.wp.com/s/opensans/v34/ 		44 KB
44 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.wp.com/s/opensans/v34/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
Requested by
Host: fonts-api.wp.com
URL: https://fonts-api.wp.com/css?family=Open+Sans%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic%7CRoboto+Slab%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic%7CRoboto%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic&display=auto&ver=6.1.1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
8778e9af2422858d7052ff9a0f3c12c08ae976bdd6e0316db144cd5579cd97db
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts-api.wp.com/
Origin
https://blog.cyble.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

x-nc
HIT hhn 1
date
Fri, 24 Feb 2023 07:57:46 GMT
x-content-type-options
nosniff
last-modified
Mon, 15 Aug 2022 18:20:18 GMT
server
nginx
age
193712
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
content-length
44856
x-xss-protection
0
fa-solid-900.woff2
blog.cyble.com/wp-content/plugins/elementor/assets/lib/font-awesome/webfonts/ 		76 KB
77 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://blog.cyble.com/wp-content/plugins/elementor/assets/lib/font-awesome/webfonts/fa-solid-900.woff2
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/_static/??-eJylVO12qyAQfKFSEk00+dFznwVhY7dB1sPH8eTt72pNa05KWts/6sLMMAyLQy80uQguyvgKHQSpQvSKnwFikDoE2aHDE4KRJz8hzTOPPPPM0/BJ7m1q0QXZJi4b8K1sElojG0v6LCw2XvmLDPFiIUe16kIpitajuQWi0zYZtvbGZsCgAstOmbkseqaDFxZapS9Lh1k2zy3r3+9KW04LdY48kDe9hxBEiCoG0SmnWrbae5ryfRjKKyjD2BNR5NdslfzyfDKQnOKdBm9DAjLsXe5jXkxjj2L50s6jLkm9JWWWxJHRU4hiX28O364zZfbDta7kZCN2KsJ9eEwSo0riFhC/tH0sttu1Z8cdKQc0LXsQN7vI6LxB7JU+y45MsjAe2BkybXN1Ol1ioYwht/wWVamPh1qD3hdNsRdlUe+Kstys2PChPO7XwHebcg282typ52KYI5SBNCr73q03RU5IE50RhKOIGj77aFWnj5fmxCChBgjUzTI8MNd/F+N/izPrrt+XOoEsPrwg11xH8Pw9Qv91L9uqro5FXVa7/7/hVUc=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.213 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
d0b4256abed72481585662971262eabee345c19f837af00d7ce24239d3b40eef
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://blog.cyble.com/_static/??-eJylVO12qyAQfKFSEk00+dFznwVhY7dB1sPH8eTt72pNa05KWts/6sLMMAyLQy80uQguyvgKHQSpQvSKnwFikDoE2aHDE4KRJz8hzTOPPPPM0/BJ7m1q0QXZJi4b8K1sElojG0v6LCw2XvmLDPFiIUe16kIpitajuQWi0zYZtvbGZsCgAstOmbkseqaDFxZapS9Lh1k2zy3r3+9KW04LdY48kDe9hxBEiCoG0SmnWrbae5ryfRjKKyjD2BNR5NdslfzyfDKQnOKdBm9DAjLsXe5jXkxjj2L50s6jLkm9JWWWxJHRU4hiX28O364zZfbDta7kZCN2KsJ9eEwSo0riFhC/tH0sttu1Z8cdKQc0LXsQN7vI6LxB7JU+y45MsjAe2BkybXN1Ol1ioYwht/wWVamPh1qD3hdNsRdlUe+Kstys2PChPO7XwHebcg282typ52KYI5SBNCr73q03RU5IE50RhKOIGj77aFWnj5fmxCChBgjUzTI8MNd/F+N/izPrrt+XOoEsPrwg11xH8Pw9Qv91L9uqro5FXVa7/7/hVUc=
Origin
https://blog.cyble.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Fri, 24 Feb 2023 07:57:46 GMT
strict-transport-security
max-age=31536000
x-ac
2.hhn _atomic_ams BYPASS
last-modified
Wed, 21 Dec 2022 18:01:21 GMT
server
nginx
etag
"63a349f1-13174"
access-control-allow-methods
GET, HEAD
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
max-age=604800
accept-ranges
bytes
content-length
78196
expires
Fri, 03 Mar 2023 07:57:46 GMT
fa-brands-400.woff2
blog.cyble.com/wp-content/plugins/elementor/assets/lib/font-awesome/webfonts/ 		75 KB
75 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://blog.cyble.com/wp-content/plugins/elementor/assets/lib/font-awesome/webfonts/fa-brands-400.woff2
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/_static/??-eJylVO12qyAQfKFSEk00+dFznwVhY7dB1sPH8eTt72pNa05KWts/6sLMMAyLQy80uQguyvgKHQSpQvSKnwFikDoE2aHDE4KRJz8hzTOPPPPM0/BJ7m1q0QXZJi4b8K1sElojG0v6LCw2XvmLDPFiIUe16kIpitajuQWi0zYZtvbGZsCgAstOmbkseqaDFxZapS9Lh1k2zy3r3+9KW04LdY48kDe9hxBEiCoG0SmnWrbae5ryfRjKKyjD2BNR5NdslfzyfDKQnOKdBm9DAjLsXe5jXkxjj2L50s6jLkm9JWWWxJHRU4hiX28O364zZfbDta7kZCN2KsJ9eEwSo0riFhC/tH0sttu1Z8cdKQc0LXsQN7vI6LxB7JU+y45MsjAe2BkybXN1Ol1ioYwht/wWVamPh1qD3hdNsRdlUe+Kstys2PChPO7XwHebcg282typ52KYI5SBNCr73q03RU5IE50RhKOIGj77aFWnj5fmxCChBgjUzTI8MNd/F+N/izPrrt+XOoEsPrwg11xH8Pw9Qv91L9uqro5FXVa7/7/hVUc=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.213 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
43c072c16c9ee6d67acdfa6c6d6685ff1e74eb4237b7cc3c1348ab1c108b26af
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://blog.cyble.com/_static/??-eJylVO12qyAQfKFSEk00+dFznwVhY7dB1sPH8eTt72pNa05KWts/6sLMMAyLQy80uQguyvgKHQSpQvSKnwFikDoE2aHDE4KRJz8hzTOPPPPM0/BJ7m1q0QXZJi4b8K1sElojG0v6LCw2XvmLDPFiIUe16kIpitajuQWi0zYZtvbGZsCgAstOmbkseqaDFxZapS9Lh1k2zy3r3+9KW04LdY48kDe9hxBEiCoG0SmnWrbae5ryfRjKKyjD2BNR5NdslfzyfDKQnOKdBm9DAjLsXe5jXkxjj2L50s6jLkm9JWWWxJHRU4hiX28O364zZfbDta7kZCN2KsJ9eEwSo0riFhC/tH0sttu1Z8cdKQc0LXsQN7vI6LxB7JU+y45MsjAe2BkybXN1Ol1ioYwht/wWVamPh1qD3hdNsRdlUe+Kstys2PChPO7XwHebcg282typ52KYI5SBNCr73q03RU5IE50RhKOIGj77aFWnj5fmxCChBgjUzTI8MNd/F+N/izPrrt+XOoEsPrwg11xH8Pw9Qv91L9uqro5FXVa7/7/hVUc=
Origin
https://blog.cyble.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Fri, 24 Feb 2023 07:57:46 GMT
strict-transport-security
max-age=31536000
x-ac
2.hhn _atomic_ams BYPASS
last-modified
Wed, 21 Dec 2022 18:01:21 GMT
server
nginx
etag
"63a349f1-12bdc"
access-control-allow-methods
GET, HEAD
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
max-age=604800
accept-ranges
bytes
content-length
76764
expires
Fri, 03 Mar 2023 07:57:46 GMT
memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2
fonts.wp.com/s/opensans/v34/ 		47 KB
47 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.wp.com/s/opensans/v34/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2
Requested by
Host: fonts-api.wp.com
URL: https://fonts-api.wp.com/css?family=Open+Sans%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic%7CRoboto+Slab%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic%7CRoboto%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic&display=auto&ver=6.1.1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
84161c46238fff2c6920ebc28f02cddd7b710cf3d1107853f540b084320f6afd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts-api.wp.com/
Origin
https://blog.cyble.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

x-nc
HIT hhn 1
date
Fri, 24 Feb 2023 07:57:46 GMT
x-content-type-options
nosniff
last-modified
Mon, 15 Aug 2022 18:22:41 GMT
server
nginx
age
10225
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
content-length
47952
x-xss-protection
0
json
forms.hsforms.com/embed/v3/form/21289959/f7da69d1-3801-430f-b109-5f44b65a9326/ 		37 KB
5 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://forms.hsforms.com/embed/v3/form/21289959/f7da69d1-3801-430f-b109-5f44b65a9326/json?hs_static_app=forms-embed&hs_static_app_version=1.2730&X-HubSpot-Static-App-Info=forms-embed-1.2730
Requested by
Host: js.hsforms.net
URL: https://js.hsforms.net/forms/v2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5605 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b280d9e9449293cacef8128e089d9ae4210bc40a70c78925e58a1bc816de14f2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept
application/json, text/plain, */*
Referer
https://blog.cyble.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

x-origin-hublet
na1
date
Fri, 24 Feb 2023 07:57:46 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
br
cf-cache-status
DYNAMIC
x-hubspot-correlation-id
e6a00105-b5f1-4e22-b186-292bddeb0e0a
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
server
cloudflare
x-trace
2BCFC42596E5F5F74E6210CC1A991B54085E311043000000000000000000
vary
origin
access-control-allow-methods
OPTIONS, GET
content-type
application/json;charset=utf-8
access-control-allow-origin
https://blog.cyble.com
access-control-expose-headers
X-Origin-Hublet
access-control-max-age
180
access-control-allow-credentials
false
cache-control
max-age=0, no-cache, no-store
x-robots-tag
none
access-control-allow-headers
*
cf-ray
79e6a6fefa8c2bb2-FRA
index.js
s.adroll.com/j/exp/
Redirect Chain
  • https://s.adroll.com/j/exp/ELNAF2EZDFHJRAP3ODLCUU/index.js
  • https://s.adroll.com/j/exp/index.js
28 B
784 B 		Script
General
Check archive.org
Download Go to
Full URL
https://s.adroll.com/j/exp/index.js
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/
Protocol
HTTP/1.1
Server
2600:9000:20eb:f200:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

X-Amz-Version-Id
CiD7z5Qr2ECIL.Zbw84rFXTGVfvZ9kAA
Date
Thu, 23 Feb 2023 20:15:43 GMT
Via
1.1 34f50889bc574f1edeb41dd758962a5a.cloudfront.net (CloudFront)
Age
42124
X-Amz-Cf-Pop
FRA2-C1
X-Amz-Server-Side-Encryption
AES256
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
28
Last-Modified
Thu, 01 Dec 2022 00:29:34 GMT
Server
AmazonS3
Etag
"5816cced8568d223aa09d889f300692b"
Vary
Accept-Encoding
Access-Control-Max-Age
600
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Access-Control-Allow-Methods
GET
Access-Control-Allow-Credentials
false
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
eobomp-RZ47PIDpUtjvMuEZIZ3mlu0UC_6QdU5GPspGh2f_ZL2i5fg==

Redirect headers

Date
Fri, 24 Feb 2023 05:55:16 GMT
Via
1.1 34f50889bc574f1edeb41dd758962a5a.cloudfront.net (CloudFront)
Age
7350
X-Amz-Cf-Pop
FRA2-C1
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
0
Server
AmazonS3
Access-Control-Max-Age
600
Access-Control-Allow-Methods
GET
Content-Type
application/xml
Location
https://s.adroll.com/j/exp/index.js
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
false
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
aNi3RNV0mJlmDi54a35q0J5waAZPlmBE4rbWfczoaifpqlbc0eao9Q==
analytics.js
www.google-analytics.com/ 		49 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-201575643-1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Fri, 24 Feb 2023 06:14:50 GMT
last-modified
Tue, 10 Jan 2023 21:29:14 GMT
server
Golfe2
age
6176
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20085
expires
Fri, 24 Feb 2023 08:14:50 GMT
js
www.googletagmanager.com/gtag/ 		179 KB
67 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=G-4FJGSRPM4S&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-201575643-1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
0c3116c717c15f7308971a14f3e0dfe7a4e3fd357ec044b2eae10361d76b9279
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Fri, 24 Feb 2023 07:57:46 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
68006
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Fri, 24 Feb 2023 07:57:46 GMT
/
blog.cyble.com/ 		0
57 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.cyble.com/?wmcAction=wmcTrack&action_name=Deep%20Dive%20Analysis%20%E2%80%93%20Borat%20RAT%20%E2%80%94%20Cyble&siteId=1&rec=1&rand=793362&h=7&m=57&s=46&url=https%3A%2F%2Fblog.cyble.com%2F2022%2F03%2F31%2Fdeep-dive-analysis-borat-rat%2F&uid=0&pid=10342&visitorId=e8aaae1f3183cf5c&fvts=1677225467&vc=1&idn=0&refts=0&lvts=1677225467&fullRef=&send_image=1&pdf=1&qt=0&rp=0&wma=0&dir=0&fla=0&java=0&gears=0&ag=0&cookie=1&res=1600x1200&gtms=1910&pvId=PJoOb9&browser=Chrome_110&os=Windows_10&device=Desktop
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.213 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

cf-edge-cache
cache,platform=wordpress
x-hacker
If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.
date
Fri, 24 Feb 2023 07:57:47 GMT
strict-transport-security
max-age=31536000
content-encoding
br
x-ac
2.hhn _atomic_ams BYPASS
server
nginx
vary
Accept-Encoding, Cookie
content-type
text/html; charset=utf-8
host-header
WordPress.com
leadflows.js
js.hsleadflows.net/ 		545 KB
87 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.hsleadflows.net/leadflows.js
Requested by
Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/21289959.js?integration=WordPress&ver=10.0.21
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:e7cc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
008651e9dd70e90c5fd8e3951f209a3306e02daa2b9a2701c0db0162a9629c3b

Request headers

Referer
https://blog.cyble.com/
Origin
https://blog.cyble.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Fri, 24 Feb 2023 07:57:46 GMT
x-amz-version-id
SRJBdRCVnO2Eke6An7gEtfPYcNAkUClC
via
1.1 7c77abdf1c625c25627fe2a24e660a34.cloudfront.net (CloudFront)
cf-cache-status
HIT
content-encoding
br
x-amz-cf-pop
IAD12-P3
age
23579
x-amz-server-side-encryption
AES256
content-security-policy-report-only
frame-ancestors 'self'; report-uri https://exceptions.hubspot.com/csp/report?resource=lead-flows-js/static-1.1152/bundle/main/lead-flows-release.js&cfRay=79e467526a162c6b-IAD
x-cache
Hit from cloudfront
cache-tag
staticjsapp-lead-flows-cloudflare-web-prod,staticjsapp-prod
x-amz-replication-status
COMPLETED
last-modified
Wed, 22 Feb 2023 03:38:55 UTC
server
cloudflare
etag
W/"89d08b8b507e76a2cabe72075102a8cb"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
x-hs-cache-status
HIT
cache-control
s-maxage=86400, max-age=0
cf-ray
79e6a7003d4a2c39-FRA
x-amz-cf-id
MqGvB9ZcQzsnMmrvRUcOdgJqDMqrWHkMwIMLI6T68_v21McF9K1V1Q==
x-hs-target-asset
lead-flows-js/static-1.1152/bundle/main/lead-flows-release.js
banner.js
js.hs-banner.com/v2/21289959/ 		202 KB
63 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.hs-banner.com/v2/21289959/banner.js
Requested by
Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/21289959.js?integration=WordPress&ver=10.0.21
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::ac40:9a55 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fa28de0db846c10133053b2afac2c078ac3655d4cb66d5d7e46eba419e5a6566

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Fri, 24 Feb 2023 07:57:47 GMT
x-amz-version-id
9PVx6RHh0AxWs6vZv1y.SO2DCM7C9pcn
content-encoding
br
cf-cache-status
REVALIDATED
x-amz-request-id
4KC7TPFZMFQRHX06
x-amz-server-side-encryption
AES256
x-amz-id-2
kD0Qm1LmVenPKcj8HW8/4+TUSscLNwF/ivt7byAR8C3AEc+RUgmHBJEnzmu1fcDr1F5ZNbzqank=
last-modified
Fri, 03 Feb 2023 23:00:19 GMT
server
cloudflare
etag
W/"80410d0b77494d74b75f59d3556a1422"
access-control-max-age
604800
access-control-allow-methods
GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
https://blog.cyble.com
access-control-expose-headers
x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
cache-control
max-age=300, public
access-control-allow-credentials
true
vary
origin, Accept-Encoding
timing-allow-origin
*
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
cf-ray
79e6a7003fa535e4-FRA
expires
Fri, 24 Feb 2023 08:02:47 GMT
21289959.js
js.hs-analytics.net/analytics/1677225300000/ 		65 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.hs-analytics.net/analytics/1677225300000/21289959.js
Requested by
Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/21289959.js?integration=WordPress&ver=10.0.21
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:47b0 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a819a519974256c873c03c3b41adcf1d818df9456f18d6bdf939904d6163bd63

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Fri, 24 Feb 2023 07:57:47 GMT
x-amz-version-id
null
content-encoding
br
cf-cache-status
MISS
x-amz-request-id
CYVMEFZSR3PZ9D6H
x-amz-server-side-encryption
AES256
x-amz-id-2
rZHGAJY0c5gQtUFPFGj/FKBKZx3bInGzBkIQ8nS41XuqqmQZqx/Fk09sfbOGWfiMZuyjld45sb4=
last-modified
Tue, 21 Feb 2023 19:39:36 GMT
server
cloudflare
etag
W/"b496c29074920fd85b159cecd2e3812b"
vary
origin, Accept-Encoding
content-type
text/javascript
cache-control
max-age=300, public
access-control-allow-credentials
false
cf-ray
79e6a7003ac692bd-FRA
expires
Fri, 24 Feb 2023 08:02:47 GMT
collectedforms.js
js.hscollectedforms.net/ 		68 KB
25 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.hscollectedforms.net/collectedforms.js
Requested by
Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/21289959.js?integration=WordPress&ver=10.0.21
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7fab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
36b42aceb12f34135ce39544c6b143dbdd5690ee9a8809c49a3a37ba014bd200

Request headers

Referer
https://blog.cyble.com/
Origin
https://blog.cyble.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Fri, 24 Feb 2023 07:57:47 GMT
x-amz-version-id
SRrb.93sqm.lmAPDUKFHizePSATAJlo.
via
1.1 b0c7b942a33f0f4451718aee53f7840c.cloudfront.net (CloudFront)
cf-cache-status
EXPIRED
content-encoding
br
x-amz-cf-pop
IAD12-P1
x-amz-server-side-encryption
AES256
content-security-policy-report-only
frame-ancestors 'self'; report-uri https://exceptions.hubspot.com/csp/report?resource=collected-forms-embed-js/static-1.315/bundles/project.js&cfRay=79e6a7003897367f-IAD
x-cache
Hit from cloudfront
cache-tag
staticjsapp-collected-forms-embed-js-web-prod,staticjsapp-prod
x-amz-replication-status
COMPLETED
last-modified
Tue, 07 Feb 2023 01:17:58 UTC
server
cloudflare
etag
W/"257b82c9f242c143eb09b6862e336a56"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
x-hs-cache-status
HIT
cache-control
s-maxage=600, max-age=300
cf-ray
79e6a7003897367f-FRA
x-amz-cf-id
0WsWUANT09zM52uLJX1qpuJqdytize9SeG-jboGa-0p56SzidRzIog==
x-hs-target-asset
collected-forms-embed-js/static-1.315/bundles/project.js
fb.js
js.hsadspixel.net/ 		6 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.hsadspixel.net/fb.js
Requested by
Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/21289959.js?integration=WordPress&ver=10.0.21
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:73b0 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
552da695674e5ff5a53e685eac5440a231023675c5098e54c1516e73ec99f35a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Fri, 24 Feb 2023 07:57:46 GMT
x-amz-version-id
1ZaYK3sC7unZOzTPEqwB36un4rYvqT1Y
via
1.1 6057ee56438e208609fccc94cdceb78c.cloudfront.net (CloudFront)
cf-cache-status
HIT
content-encoding
br
x-amz-cf-pop
IAD55-P3
age
590
x-amz-server-side-encryption
AES256
content-security-policy-report-only
frame-ancestors 'self'; report-uri https://exceptions.hubspot.com/csp/report?resource=adsscriptloaderstatic/static-1.327/bundles/pixels-release.js&cfRay=79e69893e8cd9bb9-IAD
x-cache
Hit from cloudfront
cache-tag
staticjsapp-AdsScriptLoaderCloudflare-web-prod,staticjsapp-prod
x-amz-replication-status
COMPLETED
last-modified
Tue, 21 Feb 2023 03:24:48 UTC
server
cloudflare
etag
W/"c5fb4d0d970e121f5c6f72a277677133"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
x-hs-cache-status
MISS
cache-control
max-age=600
cf-ray
79e6a70038339b64-FRA
x-amz-cf-id
8k4z_rO1qinHDfjLtsVEGi5T-KlXYNRhtmJFB_yGBaqBLzZ-reEJBg==
x-hs-target-asset
adsscriptloaderstatic/static-1.327/bundles/pixels-release.js
conversations-embed.js
js.usemessages.com/ 		73 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.usemessages.com/conversations-embed.js
Requested by
Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/21289959.js?integration=WordPress&ver=10.0.21
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:eecc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
aae2185bf9e0f1dc5a8f35de66bb1cb30b3e5ed3d726cb4077aaff72a2547f9e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Fri, 24 Feb 2023 07:57:46 GMT
x-amz-version-id
5k26n6jGKWvNXLRuEGyS9RQHyta3y8Zn
via
1.1 34411558fb3a23efdbbaaddb8a12b574.cloudfront.net (CloudFront)
cf-cache-status
HIT
content-encoding
br
x-amz-cf-pop
IAD12-P1
age
150
x-amz-server-side-encryption
AES256
content-security-policy-report-only
frame-ancestors 'self'; report-uri https://exceptions.hubspot.com/csp/report?resource=conversations-embed/static-1.12342/bundles/project.js&cfRay=79e6a351b8f4997a-IAD
x-cache
Hit from cloudfront
cache-tag
staticjsapp-conversations-embed-web-prod,staticjsapp-prod
x-amz-replication-status
COMPLETED
last-modified
Fri, 24 Feb 2023 12:14:30 UTC
server
cloudflare
etag
W/"5014ca3fae42657f43ce2774728311ce"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
x-hs-cache-status
HIT
cache-control
max-age=600
cf-ray
79e6a700293c68fb-FRA
x-amz-cf-id
vi5wqGT4S1ZTWjp0tKBdpndIF41A2RdvtvJGtE6Sa7bmdXKCdJvOzQ==
x-hs-target-asset
conversations-embed/static-1.12342/bundles/project.js
ELNAF2EZDFHJRAP3ODLCUU
d.adroll.com/consent/check/ 		453 B
546 B 		Script
General
Check archive.org
Download Go to
Full URL
https://d.adroll.com/consent/check/ELNAF2EZDFHJRAP3ODLCUU?pv=52483856912.15736&arrfrr=https%3A%2F%2Fblog.cyble.com%2F2022%2F03%2F31%2Fdeep-dive-analysis-borat-rat%2F&_s=13eb77a877880fd4ca1b85bb1203cabb&_b=2
Requested by
Host: s.adroll.com
URL: https://s.adroll.com/j/ELNAF2EZDFHJRAP3ODLCUU/roundtrip.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a05:d018:cc3:fe05:8e03:6849:2fd5:b7a8 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx/1.22.1 /
Resource Hash
a6b6fd7e46c0b439dcf078fe31628308ade96a05054cd20d60a88130238275b6

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Fri, 24 Feb 2023 07:57:47 GMT
server
nginx/1.22.1
content-length
453
content-type
application/javascript
collect
www.google-analytics.com/j/ 		2 B
206 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j99&aip=1&a=2077965623&t=pageview&_s=1&dl=https%3A%2F%2Fblog.cyble.com%2F2022%2F03%2F31%2Fdeep-dive-analysis-borat-rat%2F&ul=en-us&de=UTF-8&dt=Deep%20Dive%20Analysis%20%E2%80%93%20Borat%20RAT%20%E2%80%94%20Cyble&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YGBACUABBAAAACAAI~&jid=1724317513&gjid=1773466856&cid=1423516158.1677225467&tid=UA-201575643-1&_gid=856149022.1677225467&_r=1&gtm=457e32m0&did=dZTNiMT&gdid=dZTNiMT&z=1836498056
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.cyble.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Fri, 24 Feb 2023 07:57:46 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://blog.cyble.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
g.gif
pixel.wp.com/ 		50 B
93 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.wp.com/g.gif?v=ext&blog=176605947&post=10342&tz=-5&srv=blog.cyble.com&hp=atomic&ac=2&amp=0&j=1%3A11.9-a.5&host=blog.cyble.com&ref=&fcp=2711&rand=0.7727039233627553
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

access-control-allow-origin
*
date
Fri, 24 Feb 2023 07:57:46 GMT
cache-control
no-cache
server
nginx
content-length
50
content-type
image/gif
v2.js
js.hsforms.net/forms/ Frame 7751 		509 KB
159 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.hsforms.net/forms/v2.js
Requested by
Host: js.hsforms.net
URL: https://js.hsforms.net/forms/v2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:b949 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
00bc02698b9ebaa0d592d285bb9a3f1b3a85f93fa5d9c696d0787f2f4ce07df9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Fri, 24 Feb 2023 07:57:46 GMT
x-amz-version-id
97n1NK24479GA_0k3m6LzTvBevV5homK
via
1.1 fc5ebd2517d85e358aa686aaadd64c2a.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-amz-cf-pop
IAD55-P3
age
467
x-amz-server-side-encryption
AES256
content-security-policy-report-only
frame-ancestors 'self'; report-uri https://exceptions.hubspot.com/csp/report?resource=forms-embed/static-1.2730/bundles/project-v2.js&cfRay=79e69b95abd59bc8-IAD
x-cache
Hit from cloudfront
cache-tag
staticjsapp-forms-embed-v2-web-prod,staticjsapp-prod
content-encoding
br
x-amz-replication-status
COMPLETED
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Wed, 22 Feb 2023 10:16:31 UTC
server
cloudflare
etag
W/"868e4e70cc752a1ded857134fa6c3ac2"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=f%2Bm%2FC6bapxbVTCMtdwlYSO9UjZ2Q2zmUzitIMdJHZD9upWSg4JaU0XbD7ZhRLv8B6K9XwMsBL2D3qtkn6qF2kO7WgxTHlDBljdHZJqJZBNOPOKu0MdQTHBxBjQU9%2Fzi7vZLligL%2B1ytbNYQ6"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
x-hs-cache-status
HIT
cache-control
s-maxage=600, max-age=300
cf-ray
79e6a7007b599162-FRA
x-amz-cf-id
9JhLsG3I5s6lWzluVh8Um5fCD7R004iOYIN0YhukSeK6yJpAwwjbbw==
x-hs-target-asset
forms-embed/static-1.2730/bundles/project-v2.js
v2.js
js.hsforms.net/forms/ Frame 8BAE 		509 KB
159 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.hsforms.net/forms/v2.js
Requested by
Host: js.hsforms.net
URL: https://js.hsforms.net/forms/v2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:b949 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
00bc02698b9ebaa0d592d285bb9a3f1b3a85f93fa5d9c696d0787f2f4ce07df9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Fri, 24 Feb 2023 07:57:46 GMT
x-amz-version-id
97n1NK24479GA_0k3m6LzTvBevV5homK
via
1.1 fc5ebd2517d85e358aa686aaadd64c2a.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-amz-cf-pop
IAD55-P3
age
467
x-amz-server-side-encryption
AES256
content-security-policy-report-only
frame-ancestors 'self'; report-uri https://exceptions.hubspot.com/csp/report?resource=forms-embed/static-1.2730/bundles/project-v2.js&cfRay=79e69b95abd59bc8-IAD
x-cache
Hit from cloudfront
cache-tag
staticjsapp-forms-embed-v2-web-prod,staticjsapp-prod
content-encoding
br
x-amz-replication-status
COMPLETED
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Wed, 22 Feb 2023 10:16:31 UTC
server
cloudflare
etag
W/"868e4e70cc752a1ded857134fa6c3ac2"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pOmKTftNvYBkL06vUesP6n7DHlJZmzyZpxNvB85EEXt9uLbOrdfIxXJrdKQuqgbnqfrH0cffW%2Fr7ThFDfuRWttbbuW7IWfZPg0UnanHVkIipJmF7hefeGY6H5UH0A0Ivo7SV5xwn%2F0SgrSjd"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
x-hs-cache-status
HIT
cache-control
s-maxage=600, max-age=300
cf-ray
79e6a7008b669162-FRA
x-amz-cf-id
9JhLsG3I5s6lWzluVh8Um5fCD7R004iOYIN0YhukSeK6yJpAwwjbbw==
x-hs-target-asset
forms-embed/static-1.2730/bundles/project-v2.js
collect
region1.google-analytics.com/g/ 		0
253 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://region1.google-analytics.com/g/collect?v=2&tid=G-4FJGSRPM4S&gtm=45je32m0&_p=2077965623&gdid=dZTNiMT&cid=1423516158.1677225467&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1677225466&sct=1&seg=0&dl=https%3A%2F%2Fblog.cyble.com%2F2022%2F03%2F31%2Fdeep-dive-analysis-borat-rat%2F&dt=Deep%20Dive%20Analysis%20%E2%80%93%20Borat%20RAT%20%E2%80%94%20Cyble&en=page_view&_fv=1&_ss=1&_ee=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-4FJGSRPM4S&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 24 Feb 2023 07:57:47 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://blog.cyble.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/j/ 		1 B
345 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j99&tid=UA-201575643-1&cid=1423516158.1677225467&jid=1724317513&gjid=1773466856&_gid=856149022.1677225467&_u=YGBACUAABAAAACAAI~&z=79230744
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c0c::9b Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.cyble.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
date
Fri, 24 Feb 2023 07:57:47 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://blog.cyble.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1
expires
Fri, 01 Jan 1990 00:00:00 GMT
Cyble-Borat-RAT-Analysis-1.png
i0.wp.com/blog.cyble.com/wp-content/uploads/2022/03/ 		311 KB
312 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i0.wp.com/blog.cyble.com/wp-content/uploads/2022/03/Cyble-Borat-RAT-Analysis-1.png?w=1200&ssl=1
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
ecc9d5746610402c20ff241fa49535259e7851199832f97f340b1410efe7243f
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

x-nc
HIT hhn 4
date
Fri, 24 Feb 2023 07:57:46 GMT
x-content-type-options
nosniff
last-modified
Fri, 10 Feb 2023 12:46:57 GMT
server
nginx
etag
"0ee00c9e695f7f99"
vary
Accept
access-control-allow-methods
GET, HEAD
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=63115200
timing-allow-origin
*
link
<https://blog.cyble.com/wp-content/uploads/2022/03/Cyble-Borat-RAT-Analysis-1.png>; rel="canonical"
content-length
318958
expires
Mon, 10 Feb 2025 00:46:57 GMT
Borat.png
i0.wp.com/blog.cyble.com/wp-content/uploads/2022/03/ 		174 KB
174 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i0.wp.com/blog.cyble.com/wp-content/uploads/2022/03/Borat.png?w=790&ssl=1
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
f4d6de4b24d947574c1fadd157febab5fe454eb3498b620dcf2dbcb304ef36a1
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

x-nc
HIT hhn 4
date
Fri, 24 Feb 2023 07:57:46 GMT
x-content-type-options
nosniff
last-modified
Fri, 10 Feb 2023 23:00:44 GMT
server
nginx
etag
"36017f9a7ed26e07"
vary
Accept
access-control-allow-methods
GET, HEAD
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=63115200
timing-allow-origin
*
link
<https://blog.cyble.com/wp-content/uploads/2022/03/Borat.png>; rel="canonical"
content-length
177684
expires
Mon, 10 Feb 2025 11:00:44 GMT
nav-menu.c8d112707fd7172d2a9d.bundle.min.js
blog.cyble.com/wp-content/plugins/elementor-pro/assets/js/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.cyble.com/wp-content/plugins/elementor-pro/assets/js/nav-menu.c8d112707fd7172d2a9d.bundle.min.js
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/_static/??-eJytU9tuwjAM/aGFbC0q9GHap6C0MSUsTbrYgcHXz71BpVGY0F6axnbOJXaOjSi9I3AkY2O90igVUlBCae3d9F9kaZmvVyXAcrlOE7F8zZM0SfPFHl+OV5TGxso4lHugRpWf47o5gNM+SBXJ14rIlGNGWHU+CVOrClBqgyQNIwWEkgyz+gIhHCD8P80kMAO+A6UhiK33LEiAhZqzjG4cw6Lchq5ez5y+1IsmeL5JBEJpTSGxVoE4FVn+V4RwWlwji9q4B1Y3LX0RjdWyVMFHBHsxOQYmMFxto2bTrLh327YZ9B2maIkrCSaWp/KtYRXd92kMg558A+P6FA6fEewpKrCi8Uj37u6+mr4LY04EQHOGIbrpd3ewb/aZhR2h6HrC0UWIjgX8CeU3wpOnx/EUtdfRAs7MRPcWhmcToAIHQbVmHpNWkbcFhGqYxh6Ep4whiFtiT1tj50ZxSsupG9WP6Hbef7ZkGr6HUx/1+1u2yvJklWbLH2Mg2hs=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.213 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
7d90b453482d4b820a70f83b54185e4a728b673b3697ec8a16a56bd0490beee4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Fri, 24 Feb 2023 07:57:47 GMT
strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Thu, 16 Feb 2023 18:11:11 GMT
server
nginx
x-ac
2.hhn _atomic_ams BYPASS
etag
W/"63ee71bf-104f"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
expires
Fri, 03 Mar 2023 07:57:47 GMT
share-buttons.0bdd88c45462dfb2b073.bundle.min.js
blog.cyble.com/wp-content/plugins/elementor-pro/assets/js/ 		1 KB
632 B 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.cyble.com/wp-content/plugins/elementor-pro/assets/js/share-buttons.0bdd88c45462dfb2b073.bundle.min.js
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/_static/??-eJytU9tuwjAM/aGFbC0q9GHap6C0MSUsTbrYgcHXz71BpVGY0F6axnbOJXaOjSi9I3AkY2O90igVUlBCae3d9F9kaZmvVyXAcrlOE7F8zZM0SfPFHl+OV5TGxso4lHugRpWf47o5gNM+SBXJ14rIlGNGWHU+CVOrClBqgyQNIwWEkgyz+gIhHCD8P80kMAO+A6UhiK33LEiAhZqzjG4cw6Lchq5ez5y+1IsmeL5JBEJpTSGxVoE4FVn+V4RwWlwji9q4B1Y3LX0RjdWyVMFHBHsxOQYmMFxto2bTrLh327YZ9B2maIkrCSaWp/KtYRXd92kMg558A+P6FA6fEewpKrCi8Uj37u6+mr4LY04EQHOGIbrpd3ewb/aZhR2h6HrC0UWIjgX8CeU3wpOnx/EUtdfRAs7MRPcWhmcToAIHQbVmHpNWkbcFhGqYxh6Ep4whiFtiT1tj50ZxSsupG9WP6Hbef7ZkGr6HUx/1+1u2yvJklWbLH2Mg2hs=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.213 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
660d01dcbd26f28ab61d6b59dd61778a214cc791669d32159de4895284d3b273
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Fri, 24 Feb 2023 07:57:47 GMT
strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Thu, 16 Feb 2023 18:11:11 GMT
server
nginx
x-ac
2.hhn _atomic_ams BYPASS
etag
W/"63ee71bf-4bd"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
expires
Fri, 03 Mar 2023 07:57:47 GMT
load-more.c9f6aac03af905f4e206.bundle.min.js
blog.cyble.com/wp-content/plugins/elementor-pro/assets/js/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.cyble.com/wp-content/plugins/elementor-pro/assets/js/load-more.c9f6aac03af905f4e206.bundle.min.js
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/_static/??-eJytU9tuwjAM/aGFbC0q9GHap6C0MSUsTbrYgcHXz71BpVGY0F6axnbOJXaOjSi9I3AkY2O90igVUlBCae3d9F9kaZmvVyXAcrlOE7F8zZM0SfPFHl+OV5TGxso4lHugRpWf47o5gNM+SBXJ14rIlGNGWHU+CVOrClBqgyQNIwWEkgyz+gIhHCD8P80kMAO+A6UhiK33LEiAhZqzjG4cw6Lchq5ez5y+1IsmeL5JBEJpTSGxVoE4FVn+V4RwWlwji9q4B1Y3LX0RjdWyVMFHBHsxOQYmMFxto2bTrLh327YZ9B2maIkrCSaWp/KtYRXd92kMg558A+P6FA6fEewpKrCi8Uj37u6+mr4LY04EQHOGIbrpd3ewb/aZhR2h6HrC0UWIjgX8CeU3wpOnx/EUtdfRAs7MRPcWhmcToAIHQbVmHpNWkbcFhGqYxh6Ep4whiFtiT1tj50ZxSsupG9WP6Hbef7ZkGr6HUx/1+1u2yvJklWbLH2Mg2hs=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.213 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
64dd2add3eaca027b742a358076888171c1bd514090122491f8070abc33a01bd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Fri, 24 Feb 2023 07:57:47 GMT
strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Thu, 16 Feb 2023 18:11:11 GMT
server
nginx
x-ac
2.hhn _atomic_ams BYPASS
etag
W/"63ee71bf-15eb"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
expires
Fri, 03 Mar 2023 07:57:47 GMT
posts.e33113a212454e383747.bundle.min.js
blog.cyble.com/wp-content/plugins/elementor-pro/assets/js/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.cyble.com/wp-content/plugins/elementor-pro/assets/js/posts.e33113a212454e383747.bundle.min.js
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/_static/??-eJytU9tuwjAM/aGFbC0q9GHap6C0MSUsTbrYgcHXz71BpVGY0F6axnbOJXaOjSi9I3AkY2O90igVUlBCae3d9F9kaZmvVyXAcrlOE7F8zZM0SfPFHl+OV5TGxso4lHugRpWf47o5gNM+SBXJ14rIlGNGWHU+CVOrClBqgyQNIwWEkgyz+gIhHCD8P80kMAO+A6UhiK33LEiAhZqzjG4cw6Lchq5ez5y+1IsmeL5JBEJpTSGxVoE4FVn+V4RwWlwji9q4B1Y3LX0RjdWyVMFHBHsxOQYmMFxto2bTrLh327YZ9B2maIkrCSaWp/KtYRXd92kMg558A+P6FA6fEewpKrCi8Uj37u6+mr4LY04EQHOGIbrpd3ewb/aZhR2h6HrC0UWIjgX8CeU3wpOnx/EUtdfRAs7MRPcWhmcToAIHQbVmHpNWkbcFhGqYxh6Ep4whiFtiT1tj50ZxSsupG9WP6Hbef7ZkGr6HUx/1+1u2yvJklWbLH2Mg2hs=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.213 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
783cf6a898e6f349f7271e29af3f38e72b106e3b4a14fcb2851130c697080113
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Fri, 24 Feb 2023 07:57:47 GMT
strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Thu, 16 Feb 2023 18:11:11 GMT
server
nginx
x-ac
2.hhn _atomic_ams BYPASS
etag
W/"63ee71bf-cfd"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
expires
Fri, 03 Mar 2023 07:57:47 GMT
text-editor.2c35aafbe5bf0e127950.bundle.min.js
blog.cyble.com/wp-content/plugins/elementor/assets/js/ 		1 KB
704 B 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.cyble.com/wp-content/plugins/elementor/assets/js/text-editor.2c35aafbe5bf0e127950.bundle.min.js
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/_static/??-eJytU9tuwjAM/aGFbC0q9GHap6C0MSUsTbrYgcHXz71BpVGY0F6axnbOJXaOjSi9I3AkY2O90igVUlBCae3d9F9kaZmvVyXAcrlOE7F8zZM0SfPFHl+OV5TGxso4lHugRpWf47o5gNM+SBXJ14rIlGNGWHU+CVOrClBqgyQNIwWEkgyz+gIhHCD8P80kMAO+A6UhiK33LEiAhZqzjG4cw6Lchq5ez5y+1IsmeL5JBEJpTSGxVoE4FVn+V4RwWlwji9q4B1Y3LX0RjdWyVMFHBHsxOQYmMFxto2bTrLh327YZ9B2maIkrCSaWp/KtYRXd92kMg558A+P6FA6fEewpKrCi8Uj37u6+mr4LY04EQHOGIbrpd3ewb/aZhR2h6HrC0UWIjgX8CeU3wpOnx/EUtdfRAs7MRPcWhmcToAIHQbVmHpNWkbcFhGqYxh6Ep4whiFtiT1tj50ZxSsupG9WP6Hbef7ZkGr6HUx/1+1u2yvJklWbLH2Mg2hs=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.213 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
359c32724ded3d649d66332ac70da65306ff8c45ff08f9d0e253ae1fd175e109
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Fri, 24 Feb 2023 07:57:47 GMT
strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Wed, 21 Dec 2022 18:01:21 GMT
server
nginx
x-ac
2.hhn _atomic_ams BYPASS
etag
W/"63a349f1-54f"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
expires
Fri, 03 Mar 2023 07:57:47 GMT
public
api.hubspot.com/livechat-public/v1/message/ 		3 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.hubspot.com/livechat-public/v1/message/public?portalId=21289959&conversations-embed=static-1.12342&mobile=false&messagesUtk=35592f98564a4b4f8db8d50c9ad21901&traceId=35592f98564a4b4f8db8d50c9ad21901
Requested by
Host: js.usemessages.com
URL: https://js.usemessages.com/conversations-embed.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
167366195a9618f21c99e0f802cea0734226d4a602743f68929830963bfff08f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://blog.cyble.com/
accept-language
de-DE,de;q=0.9
X-HubSpot-Messages-Uri
https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Fri, 24 Feb 2023 07:57:47 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id
80e31dff-76e2-4535-a193-5821cffd49ba
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
1395
server
cloudflare
x-trace
2B6D185BD61511DAE179A64422D3A6D1771D8A2326000000000000000000
vary
origin, Accept-Encoding
access-control-allow-methods
GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type
application/json;charset=utf-8
access-control-allow-origin
https://blog.cyble.com
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0hvNIMT6%2BFbCiwubf9rJWnq6C5fgDvH%2BBpxpCJf8S1nL4BgQyaVFN3cMoHK15Z%2B0HkDhZmyF4Ce2yi00APpk47FAd%2FWId519pNaO3o7w5I0meW46T%2BMCJtMLFSQke0BLSx0eWIpan9kQKMTfaA%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control
no-cache, no-store, no-transform, must-revalidate, max-age=0
access-control-allow-credentials
false
cf-ray
79e6a702ae563a5c-FRA
access-control-allow-headers
Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent, X-HubSpot-Messages-Uri
public
api.hubspot.com/livechat-public/v1/message/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://api.hubspot.com/livechat-public/v1/message/public?portalId=21289959&conversations-embed=static-1.12342&mobile=false&messagesUtk=35592f98564a4b4f8db8d50c9ad21901&traceId=35592f98564a4b4f8db8d50c9ad21901
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept
*/*
Access-Control-Request-Headers
x-hubspot-messages-uri
Access-Control-Request-Method
GET
Origin
https://blog.cyble.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

access-control-allow-credentials
false
access-control-allow-headers
Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent, X-HubSpot-Messages-Uri
access-control-allow-methods
GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
access-control-allow-origin
https://blog.cyble.com
allow
HEAD,GET,OPTIONS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
79e6a701cd393a5c-FRA
content-length
18
content-type
text/plain; charset=utf-8
date
Fri, 24 Feb 2023 07:57:47 GMT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sBcCMjyumCrZT%2F9c07TOP9foLkHTdMR1U%2B97MGe9reoWZVytosWComZ0gh84rIJjjKo2rT%2FJ68ZjjcTAZVhYOy5RPVYUYMrEJwuNy%2BhBtoVjp%2FGI30XR6s8ZjjCmedanpS7%2F06ajbEhy%2F36%2FGg%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
strict-transport-security
max-age=31536000; includeSubDomains; preload
vary
origin, Accept-Encoding
x-hubspot-correlation-id
a338d397-bb42-4091-9423-acbae0c708d8
x-trace
2B55AB55C4B7904FF0BAD517AAF4668828B0DD78D7000000000000000000
counters.gif
forms.hsforms.com/embed/v3/ 		35 B
392 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://forms.hsforms.com/embed/v3/counters.gif?key=forms-embed-v2-DEFINITION_SUCCESS&count=1
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6810:5605 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Fri, 24 Feb 2023 07:57:47 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-cache-status
DYNAMIC
server
cloudflare
x-hubspot-correlation-id
1c20045a-186d-4167-90a7-4ee797e28f54
x-trace
2B23A5DB0483719B26013B44802571B66848D14CDD000000000000000000
vary
origin
content-type
image/gif
access-control-expose-headers
X-Origin-Hublet
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
false
x-robots-tag
none
cf-ray
79e6a701ce9c3645-FRA
content-length
35
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
consent_tcfv2.js
s.adroll.com/j/ 		410 KB
55 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s.adroll.com/j/consent_tcfv2.js
Requested by
Host: s.adroll.com
URL: https://s.adroll.com/j/ELNAF2EZDFHJRAP3ODLCUU/roundtrip.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20eb:f200:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
91144fbcc0e3f609b021e362ec29d2a9b58f15e840f229eb99ea2c04d927882b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

X-Amz-Version-Id
44sIT20LqRj70wQHqyIoOw7etYYdjkbK
Content-Encoding
gzip
Via
1.1 34f50889bc574f1edeb41dd758962a5a.cloudfront.net (CloudFront)
Date
Fri, 24 Feb 2023 07:56:09 GMT
Age
99
X-Amz-Cf-Pop
FRA2-C1
X-Amz-Server-Side-Encryption
AES256
Transfer-Encoding
chunked
X-Cache
Hit from cloudfront
Connection
keep-alive
Last-Modified
Wed, 04 May 2022 19:41:48 GMT
Server
AmazonS3
Etag
W/"0a7d0ea8d7d31b07e925fe340acf431b"
Vary
Accept-Encoding
Access-Control-Max-Age
600
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Access-Control-Allow-Methods
GET
Cache-Control
max-age=300, must-revalidate
Access-Control-Allow-Credentials
false
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
kc_imEXZ5ya0MBQhp1DiDH2wbyQ08hCbIw0mwB01rUXPl2AYJ7aOoA==
counters.gif
forms-na1.hsforms.com/embed/v3/ 		35 B
437 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://forms-na1.hsforms.com/embed/v3/counters.gif?key=forms-embed-v2-RENDER_SUCCESS&count=1
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5805 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Fri, 24 Feb 2023 07:57:47 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-cache-status
DYNAMIC
server
cloudflare
x-hubspot-correlation-id
c654934e-fa03-403b-b6fa-71cbeb61adbd
x-trace
2B7D78527E36621291C26B8968CB194B928A54337F000000000000000000
vary
origin
content-type
image/gif
access-control-expose-headers
X-Origin-Hublet
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
false
x-robots-tag
none
cf-ray
79e6a7024af65b86-FRA
content-length
35
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
json
forms.hubspot.com/collected-forms/v1/config/ 		116 B
686 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://forms.hubspot.com/collected-forms/v1/config/json?portalId=21289959&utk=
Requested by
Host: js.hscollectedforms.net
URL: https://js.hscollectedforms.net/collectedforms.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c27a8d0abc42f5fcd3a4ad9480ca7bd1bbe1fcb23d5438b4420f1cbcab3ecc9f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept
application/json, text/plain, */*
Referer
https://blog.cyble.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Fri, 24 Feb 2023 07:57:47 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id
6d0be020-b9eb-4855-871c-ff5901847cb2
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
server
cloudflare
vary
origin
access-control-allow-methods
GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type
application/json;charset=utf-8
access-control-allow-origin
https://blog.cyble.com
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=y%2BLRjcVBhtsM40PcKKvcckayhcO5v%2BUkt6CtNo0opA%2FiGpCYnTqX8r%2BnIQpJXTrqN6Kq2hFu3AeFLrWukUn%2BD0wYlBLOYh1QVerQ8sWPDRDpLj8EyImiqtDp6HzE%2FzEVDuHMCbzV5IZbCZzwvfwA"}],"group":"cf-nel","max_age":604800}
access-control-max-age
180
access-control-allow-credentials
false
x-robots-tag
none
access-control-allow-headers
*
cf-ray
79e6a7023dd73a5c-FRA
eicons.woff2
blog.cyble.com/wp-content/plugins/elementor/assets/lib/eicons/fonts/ 		91 KB
91 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://blog.cyble.com/wp-content/plugins/elementor/assets/lib/eicons/fonts/eicons.woff2?5.16.0
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/_static/??-eJylVO12qyAQfKFSEk00+dFznwVhY7dB1sPH8eTt72pNa05KWts/6sLMMAyLQy80uQguyvgKHQSpQvSKnwFikDoE2aHDE4KRJz8hzTOPPPPM0/BJ7m1q0QXZJi4b8K1sElojG0v6LCw2XvmLDPFiIUe16kIpitajuQWi0zYZtvbGZsCgAstOmbkseqaDFxZapS9Lh1k2zy3r3+9KW04LdY48kDe9hxBEiCoG0SmnWrbae5ryfRjKKyjD2BNR5NdslfzyfDKQnOKdBm9DAjLsXe5jXkxjj2L50s6jLkm9JWWWxJHRU4hiX28O364zZfbDta7kZCN2KsJ9eEwSo0riFhC/tH0sttu1Z8cdKQc0LXsQN7vI6LxB7JU+y45MsjAe2BkybXN1Ol1ioYwht/wWVamPh1qD3hdNsRdlUe+Kstys2PChPO7XwHebcg282typ52KYI5SBNCr73q03RU5IE50RhKOIGj77aFWnj5fmxCChBgjUzTI8MNd/F+N/izPrrt+XOoEsPrwg11xH8Pw9Qv91L9uqro5FXVa7/7/hVUc=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.213 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
691fa7d17effc7d303eda0ad7e4a1d91b2f375506cfc8a774480cc2b55f156ea
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://blog.cyble.com/_static/??-eJylVO12qyAQfKFSEk00+dFznwVhY7dB1sPH8eTt72pNa05KWts/6sLMMAyLQy80uQguyvgKHQSpQvSKnwFikDoE2aHDE4KRJz8hzTOPPPPM0/BJ7m1q0QXZJi4b8K1sElojG0v6LCw2XvmLDPFiIUe16kIpitajuQWi0zYZtvbGZsCgAstOmbkseqaDFxZapS9Lh1k2zy3r3+9KW04LdY48kDe9hxBEiCoG0SmnWrbae5ryfRjKKyjD2BNR5NdslfzyfDKQnOKdBm9DAjLsXe5jXkxjj2L50s6jLkm9JWWWxJHRU4hiX28O364zZfbDta7kZCN2KsJ9eEwSo0riFhC/tH0sttu1Z8cdKQc0LXsQN7vI6LxB7JU+y45MsjAe2BkybXN1Ol1ioYwht/wWVamPh1qD3hdNsRdlUe+Kstys2PChPO7XwHebcg282typ52KYI5SBNCr73q03RU5IE50RhKOIGj77aFWnj5fmxCChBgjUzTI8MNd/F+N/izPrrt+XOoEsPrwg11xH8Pw9Qv91L9uqro5FXVa7/7/hVUc=
Origin
https://blog.cyble.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Fri, 24 Feb 2023 07:57:47 GMT
strict-transport-security
max-age=31536000
x-ac
2.hhn _atomic_ams BYPASS
last-modified
Wed, 21 Dec 2022 18:01:21 GMT
server
nginx
etag
"63a349f1-16cbc"
access-control-allow-methods
GET, HEAD
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
max-age=315360000
accept-ranges
bytes
content-length
93372
expires
Thu, 31 Dec 2037 23:55:55 GMT
share-link.min.js
blog.cyble.com/wp-content/plugins/elementor/assets/lib/share-link/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.cyble.com/wp-content/plugins/elementor/assets/lib/share-link/share-link.min.js?ver=3.9.2
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/wp-content/plugins/elementor/assets/js/frontend.min.js?ver=3.9.2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.213 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
138154c0deed3326477b9b4909175101070a5a3a95342291b53d8cc9879a5f47
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Fri, 24 Feb 2023 07:57:47 GMT
strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Wed, 21 Dec 2022 18:01:21 GMT
server
nginx
x-ac
2.hhn _atomic_ams BYPASS
etag
W/"63a349f1-a3c"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=315360000
expires
Thu, 31 Dec 2037 23:55:55 GMT
nextroll-32x32.png
s.adroll.com/i/favicon/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.adroll.com/i/favicon/nextroll-32x32.png
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20eb:f200:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
bcaf0e3f087296133e0a996ee3d289a8d1a690147c93e0ab62019b505e6f9355

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

X-Amz-Version-Id
eTpwxbAIDHDUN.4tfrROIgU_pzKN9Xh0
Date
Thu, 23 Feb 2023 08:21:03 GMT
Via
1.1 34f50889bc574f1edeb41dd758962a5a.cloudfront.net (CloudFront)
Age
85005
X-Amz-Cf-Pop
FRA2-C1
X-Amz-Server-Side-Encryption
AES256
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
1615
Last-Modified
Mon, 28 Jun 2021 18:19:21 GMT
Server
AmazonS3
Etag
"403a0a7dcf2d617e7ea852bfb9d11945"
Vary
Accept-Encoding
Access-Control-Max-Age
600
Content-Type
image/png
Access-Control-Allow-Origin
*
Access-Control-Allow-Methods
GET
Access-Control-Allow-Credentials
false
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
bNAJBjLXQZ9MwzaMRQDZyjRZ6AgJrNobYMSbYSXMVTdsZuTMhL9Qpg==
Mallox-FICCI-Ransomware-attack.png
i0.wp.com/blog.cyble.com/wp-content/uploads/2023/02/ 		58 KB
58 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i0.wp.com/blog.cyble.com/wp-content/uploads/2023/02/Mallox-FICCI-Ransomware-attack.png?fit=300%2C150&ssl=1
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/_static/??-eJytU9tuwjAM/aGFbC0q9GHap6C0MSUsTbrYgcHXz71BpVGY0F6axnbOJXaOjSi9I3AkY2O90igVUlBCae3d9F9kaZmvVyXAcrlOE7F8zZM0SfPFHl+OV5TGxso4lHugRpWf47o5gNM+SBXJ14rIlGNGWHU+CVOrClBqgyQNIwWEkgyz+gIhHCD8P80kMAO+A6UhiK33LEiAhZqzjG4cw6Lchq5ez5y+1IsmeL5JBEJpTSGxVoE4FVn+V4RwWlwji9q4B1Y3LX0RjdWyVMFHBHsxOQYmMFxto2bTrLh327YZ9B2maIkrCSaWp/KtYRXd92kMg558A+P6FA6fEewpKrCi8Uj37u6+mr4LY04EQHOGIbrpd3ewb/aZhR2h6HrC0UWIjgX8CeU3wpOnx/EUtdfRAs7MRPcWhmcToAIHQbVmHpNWkbcFhGqYxh6Ep4whiFtiT1tj50ZxSsupG9WP6Hbef7ZkGr6HUx/1+1u2yvJklWbLH2Mg2hs=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
d55a5fdb0b754e2814219eabcefeaf7350bbc8890c28f9d1a8a62228bb92e52b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

x-nc
HIT hhn 2
date
Fri, 24 Feb 2023 07:57:47 GMT
x-content-type-options
nosniff
last-modified
Fri, 24 Feb 2023 06:59:03 GMT
server
nginx
etag
"f57bc82c0da45e6f"
vary
Accept
access-control-allow-methods
GET, HEAD
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=63115200
timing-allow-origin
*
link
<https://blog.cyble.com/wp-content/uploads/2023/02/Mallox-FICCI-Ransomware-attack.png>; rel="canonical"
content-length
59408
expires
Sun, 23 Feb 2025 18:59:03 GMT
ChatGPT-Phishing.png
i0.wp.com/blog.cyble.com/wp-content/uploads/2023/02/ 		46 KB
46 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i0.wp.com/blog.cyble.com/wp-content/uploads/2023/02/ChatGPT-Phishing.png?fit=300%2C150&ssl=1
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/_static/??-eJytU9tuwjAM/aGFbC0q9GHap6C0MSUsTbrYgcHXz71BpVGY0F6axnbOJXaOjSi9I3AkY2O90igVUlBCae3d9F9kaZmvVyXAcrlOE7F8zZM0SfPFHl+OV5TGxso4lHugRpWf47o5gNM+SBXJ14rIlGNGWHU+CVOrClBqgyQNIwWEkgyz+gIhHCD8P80kMAO+A6UhiK33LEiAhZqzjG4cw6Lchq5ez5y+1IsmeL5JBEJpTSGxVoE4FVn+V4RwWlwji9q4B1Y3LX0RjdWyVMFHBHsxOQYmMFxto2bTrLh327YZ9B2maIkrCSaWp/KtYRXd92kMg558A+P6FA6fEewpKrCi8Uj37u6+mr4LY04EQHOGIbrpd3ewb/aZhR2h6HrC0UWIjgX8CeU3wpOnx/EUtdfRAs7MRPcWhmcToAIHQbVmHpNWkbcFhGqYxh6Ep4whiFtiT1tj50ZxSsupG9WP6Hbef7ZkGr6HUx/1+1u2yvJklWbLH2Mg2hs=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
420c5ecbca4fceed2f5134103a51095cbc1fff7fc1b6d7e3bb220f1b7481664d
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

x-nc
HIT hhn 2
date
Fri, 24 Feb 2023 07:57:47 GMT
x-content-type-options
nosniff
last-modified
Wed, 22 Feb 2023 07:37:18 GMT
server
nginx
etag
"43ef47e3040fbf1e"
vary
Accept
access-control-allow-methods
GET, HEAD
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=63115200
timing-allow-origin
*
link
<https://blog.cyble.com/wp-content/uploads/2023/02/ChatGPT-Phishing.png>; rel="canonical"
content-length
46608
expires
Fri, 21 Feb 2025 19:37:18 GMT
Hactivism-worldwide.jpg
i0.wp.com/blog.cyble.com/wp-content/uploads/2023/02/ 		55 KB
56 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i0.wp.com/blog.cyble.com/wp-content/uploads/2023/02/Hactivism-worldwide.jpg?fit=300%2C150&ssl=1
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/_static/??-eJytU9tuwjAM/aGFbC0q9GHap6C0MSUsTbrYgcHXz71BpVGY0F6axnbOJXaOjSi9I3AkY2O90igVUlBCae3d9F9kaZmvVyXAcrlOE7F8zZM0SfPFHl+OV5TGxso4lHugRpWf47o5gNM+SBXJ14rIlGNGWHU+CVOrClBqgyQNIwWEkgyz+gIhHCD8P80kMAO+A6UhiK33LEiAhZqzjG4cw6Lchq5ez5y+1IsmeL5JBEJpTSGxVoE4FVn+V4RwWlwji9q4B1Y3LX0RjdWyVMFHBHsxOQYmMFxto2bTrLh327YZ9B2maIkrCSaWp/KtYRXd92kMg558A+P6FA6fEewpKrCi8Uj37u6+mr4LY04EQHOGIbrpd3ewb/aZhR2h6HrC0UWIjgX8CeU3wpOnx/EUtdfRAs7MRPcWhmcToAIHQbVmHpNWkbcFhGqYxh6Ep4whiFtiT1tj50ZxSsupG9WP6Hbef7ZkGr6HUx/1+1u2yvJklWbLH2Mg2hs=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
0b4f1badfe13e54558ffcff6ffc1934ebf3a048d12321f574c3e4cb80ba862bb
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

x-nc
HIT hhn 4
date
Fri, 24 Feb 2023 07:57:47 GMT
x-content-type-options
nosniff
last-modified
Tue, 21 Feb 2023 14:07:18 GMT
server
nginx
etag
"2f56310172d21ae7"
vary
Accept
access-control-allow-methods
GET, HEAD
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=63115200
timing-allow-origin
*
link
<https://blog.cyble.com/wp-content/uploads/2023/02/Hactivism-worldwide.jpg>; rel="canonical"
content-length
56770
expires
Fri, 21 Feb 2025 02:07:18 GMT
json
api.hubapi.com/hs-script-loader-public/v1/config/pixels-and-events/ 		114 B
877 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.hubapi.com/hs-script-loader-public/v1/config/pixels-and-events/json?portalId=21289959
Requested by
Host: js.hsadspixel.net
URL: https://js.hsadspixel.net/fb.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:c8cc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
90b705145ef82e9d8493aae55c9bfb3200ec0620c8946b20b0b28366557d6a4a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Fri, 24 Feb 2023 07:57:47 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id
44c75bc1-1b21-4a2b-8368-78ef25ecfc95
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
server
cloudflare
x-trace
2B59F1242FAE488668C33CFC52C0505128B87EB122000000000000000000
vary
origin, Accept-Encoding
access-control-allow-methods
GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type
application/json;charset=utf-8
access-control-allow-origin
https://blog.cyble.com
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=87seEvUlR0r2FL7RxSiGbCSNIfOdTEdpK1oD2dnnD3QNw%2BEWVY1VP%2F9RGWCVRjH2%2FZRfMBaWu45XojCtmmG%2FUXqZnkLERCuTem2El1uJlCjcYIlV8Bb7BJtw228TyBx%2BMeS3YzVVos%2Bm7IFg"}],"group":"cf-nel","max_age":604800}
access-control-max-age
180
access-control-allow-credentials
false
cf-ray
79e6a702ffb290a6-FRA
access-control-allow-headers
*
counters.gif
forms.hsforms.com/embed/v3/ 		35 B
356 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://forms.hsforms.com/embed/v3/counters.gif?key=collected-forms-embed-js-form-bind&count=3
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6810:5605 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Fri, 24 Feb 2023 07:57:47 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-cache-status
DYNAMIC
server
cloudflare
x-hubspot-correlation-id
e8c89e4d-e0f0-463c-900f-da340f987d10
x-trace
2BAA5D99DB6243404A31221EAA235957B7E31147AE000000000000000000
vary
origin
content-type
image/gif
access-control-expose-headers
X-Origin-Hublet
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
false
x-robots-tag
none
cf-ray
79e6a702f82d3645-FRA
content-length
35
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
35592f98564a4b4f8db8d50c9ad21901
app.hubspot.com/conversations-visitor/21289959/threads/utk/ Frame 35E5 		51 KB
19 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://app.hubspot.com/conversations-visitor/21289959/threads/utk/35592f98564a4b4f8db8d50c9ad21901?uuid=79c07825097049f09d40c1f476e93824&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=blog.cyble.com&inApp53=false&messagesUtk=35592f98564a4b4f8db8d50c9ad21901&url=https%3A%2F%2Fblog.cyble.com%2F2022%2F03%2F31%2Fdeep-dive-analysis-borat-rat%2F&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=false&enableWidgetCookieBanner=false&isInCMS=false
Requested by
Host: js.usemessages.com
URL: https://js.usemessages.com/conversations-embed.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c3d1a4eaec7041443d470897f3c75fe3de2534377fc82e1b6ca27082af5da8ce
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://blog.cyble.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-credentials
false
age
446
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control
max-age=600
cache-tag
staticjsapp-conversations-visitor-ui-web-prod,staticjsapp-prod
cf-cache-status
DYNAMIC
cf-ray
79e6a7042d4592c3-FRA
content-encoding
br
content-security-policy-report-only
script-src 'self' www.hubspot.com *.hsappstatic.net *.hs-analytics.net *.hs-banner.com *.hsforms.net *.hsleadflows.net *.hs-scripts.com *.hubspotfeedback.com *.usemessages.com js.hubspot.com *.hsadspixel.net *.hscollectedforms.net js-agent.newrelic.com bam.nr-data.net bam-cell.nr-data.net *.google-analytics.com www.googletagmanager.com data: 'unsafe-inline' 'unsafe-eval' blob: connect.facebook.net www.gstatic.cn www.gstatic.com www.google.com *.fullstory.com fullstory.com apis.google.com snap.licdn.com; report-uri https://exceptions.hubspot.com/csp/report?resource=conversations-visitor-ui/static-1.14794/html/index.html&cfRay=79e6a7042d4592c3&reqUrl=https%3A%2F%2Fapp.hubspot.com%2Fconversations-visitor%2F21289959%2Fthreads%2Futk%2F35592f98564a4b4f8db8d50c9ad21901%3Fuuid%3D79c07825097049f09d40c1f476e93824%26mobile%3Dfalse%26mobileSafari%3Dfalse%26hideWelcomeMessage%3Dfalse%26hstc%3Dnull%26domain%3Dblog.cyble.com%26inApp53%3Dfalse%26messagesUtk%3D35592f98564a4b4f8db8d50c9ad21901%26url%3Dhttps%253A%252F%252Fblog.cyble.com%252F2022%252F03%252F31%252Fdeep-dive-analysis-borat-rat%252F%26inline%3Dfalse%26isFullscreen%3Dfalse%26globalCookieOptOut%3Dnull%26isFirstVisitorSession%3Dtrue%26isAttachmentDisabled%3Dfalse%26enableWidgetCookieBanner%3Dfalse%26isInCMS%3Dfalse&referrer=https%3A%2F%2Fblog.cyble.com%2F&cfenv=prod&pdt=2023-02-24&csp=ro
content-type
text/html; charset=utf-8
date
Fri, 24 Feb 2023 07:57:47 GMT
etag
W/"859591267aee245ffe44111e4a36f1f8"
last-modified
Fri, 24 Feb 2023 12:14:30 UTC
report-to
{"group":"default","max_age":86400,"endpoints":[{"url":"https://exceptions.hubspot.com/csp/reports"}]}
reporting-endpoints
default="https://exceptions.hubspot.com/csp/reports?cfRay=79e6a7042d4592c3&resource=conversations-visitor-ui/static-1.14794/html/index.html"
server
cloudflare
strict-transport-security
max-age=31536000; includeSubDomains; preload
vary
origin, Accept-Encoding
via
1.1 a53ebc5c4d12bc9682b9c11ea18dccbe.cloudfront.net (CloudFront)
x-amz-cf-id
YlhRKi1zJvke6CHDwrjTjqu_Ne8bJMQjayQrpo451RuOUOnw-QxJ4w==
x-amz-cf-pop
IAD12-P1
x-amz-replication-status
COMPLETED
x-amz-server-side-encryption
AES256
x-amz-version-id
4lf7Wrvm_b5e5YaV2ILZe8L5JvSUGK3g
x-cache
Hit from cloudfront
x-hs-cache-status
MISS
x-hs-target-asset
conversations-visitor-ui/static-1.14794/html/index.html
x-hs-worker-debug-mode
false
insight.min.js
snap.licdn.com/li.lms-analytics/ 		13 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by
Host: js.hsadspixel.net
URL: https://js.hsadspixel.net/fb.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:16::215:149b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
f56ccb2db87aacedd9415232e40f80bff9939703df2f9c3f9ec8a092e545349f
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Fri, 24 Feb 2023 07:57:47 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 10 Jan 2023 17:22:56 GMT
x-cdn
AKAM
vary
Accept-Encoding
content-type
application/x-javascript;charset=utf-8
cache-control
max-age=9972
accept-ranges
bytes
content-length
4777
token
cdn.linkedin.oribi.io/partner/4053396/domain/blog.cyble.com/ 		36 B
375 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://cdn.linkedin.oribi.io/partner/4053396/domain/blog.cyble.com/token
Requested by
Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20eb:1000:2:53b2:240:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89

Request headers

Accept
*
Referer
https://blog.cyble.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Fri, 24 Feb 2023 07:49:35 GMT
content-encoding
gzip
via
1.1 42b60ee17f7593fff72ca1cb725d6c9a.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C1
age
492
vary
accept-encoding
x-cache
Hit from cloudfront
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=3600
x-amz-cf-id
od-jzzMYte7xOndZA9B9ZE8F4sT6YFhF2HNs6cd9tuJIfDz7XQ0QvQ==
collect
px4.ads.linkedin.com/
Redirect Chain
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4053396&time=1677225467598&url=https%3A%2F%2Fblog.cyble.com%2F2022%2F03%2F31%2Fdeep-dive-analysis-borat-rat%2F
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D4053396%26time%3D1677225467598%26url%3Dhttps%253A%252F%252Fblog.cyble.com%252F202...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4053396&time=1677225467598&url=https%3A%2F%2Fblog.cyble.com%2F2022%2F03%2F31%2Fdeep-dive-analysis-borat-rat%2F&liSync=true
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4053396&time=1677225467598&url=https%3A%2F%2Fblog.cyble.com%2F2022%2F03%2F31%2Fdeep-dive-analysis-borat-rat%2F&liSync=true&e_ipv6=AQJ-Cr-xg3PeaAA...
0
264 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4053396&time=1677225467598&url=https%3A%2F%2Fblog.cyble.com%2F2022%2F03%2F31%2Fdeep-dive-analysis-borat-rat%2F&liSync=true&e_ipv6=AQJ-Cr-xg3PeaAAAAYaCbaDUNzG7wkEQ92D4pMNpEVtk0SbQDRB-5Ty-uHwymwWf
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/
Protocol
H2
Server
13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Fri, 24 Feb 2023 07:57:48 GMT
x-li-pop
afd-prod-ltx1-x
x-msedge-ref
Ref A: 417DF5AB47314EEEB08A3DD2B78255B9 Ref B: FRAEDGE2017 Ref C: 2023-02-24T07:57:48Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
content-type
application/javascript
x-li-fabric
prod-ltx1
x-li-proto
http/2
content-length
0
x-li-uuid
AAX1bXw/CTejaj6MdN2CAA==

Redirect headers

date
Fri, 24 Feb 2023 07:57:47 GMT
x-li-pop
afd-prod-ltx1-x
x-msedge-ref
Ref A: 0E08DDAFC7FB46ABAE0AA679EDB6EE34 Ref B: VIEEDGE2121 Ref C: 2023-02-24T07:57:48Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
x-li-fabric
prod-ltx1
location
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4053396&time=1677225467598&url=https%3A%2F%2Fblog.cyble.com%2F2022%2F03%2F31%2Fdeep-dive-analysis-borat-rat%2F&liSync=true&e_ipv6=AQJ-Cr-xg3PeaAAAAYaCbaDUNzG7wkEQ92D4pMNpEVtk0SbQDRB-5Ty-uHwymwWf
x-li-proto
http/2
content-length
0
x-li-uuid
AAX1bXw8KN+EC4GKBAXYoA==
stats.json
injection.amibreached.com/ Frame 8537 		124 B
979 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://injection.amibreached.com/stats.json
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:c31 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
bbdb1d21246d1c1a65aca8b41818f593b2d4704a459983866c0d331151b91887
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Fri, 24 Feb 2023 07:57:48 GMT
strict-transport-security
max-age=15552000; includeSubDomains; preload
via
1.1 7d33dc9d9c2f04588ae01f5adb466032.cloudfront.net (CloudFront)
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-content-type-options
nosniff
age
50979
x-amz-cf-pop
BOM78-P6
content-encoding
br
x-cache
Hit from cloudfront
last-modified
Mon, 23 May 2022 20:31:52 GMT
server
cloudflare
etag
W/"b660d52d56d1db01c2e37397c007a1e4"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/json
access-control-allow-origin
https://blog.cyble.com
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=futQNDxjimYSFwBsU4eZvGi3f2sKp6HLhUELprvYayM3vOz6D%2Fl1SjzX%2BBsU9QeWE36vSZDowY5h2BuU2Fo318hkT9wT0zSKyaL5c9WFxsoWD%2BbEcbj9ng9ShtCgpV7WcdlszzGMJGc%2BjVnueHDuKL4wBeOZeKc%3D"}],"group":"cf-nel","max_age":604800}
access-control-expose-headers
x-amz-server-side-encryption, x-amz-request-id, x-amz-id-2, x-origin
access-control-max-age
3000
access-control-allow-credentials
true
cf-ray
79e6a7061b499119-FRA
x-amz-cf-id
QMDhCKTjbybtCYEQrkActUqsrBYM_EyB8xpmAKKyHXThIxQc9MJYkA==
bundle.production.js
static.hsappstatic.net/head-dlb/static-1.270/ Frame 35E5 		44 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.hsappstatic.net/head-dlb/static-1.270/bundle.production.js
Requested by
Host: app.hubspot.com
URL: https://app.hubspot.com/conversations-visitor/21289959/threads/utk/35592f98564a4b4f8db8d50c9ad21901?uuid=79c07825097049f09d40c1f476e93824&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=blog.cyble.com&inApp53=false&messagesUtk=35592f98564a4b4f8db8d50c9ad21901&url=https%3A%2F%2Fblog.cyble.com%2F2022%2F03%2F31%2Fdeep-dive-analysis-borat-rat%2F&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=false&enableWidgetCookieBanner=false&isInCMS=false
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7d2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
71df9a91f89add02cba236b426b0dd7610a062d5e43a3c86a25a117a53cdf2cc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://app.hubspot.com/
Origin
https://app.hubspot.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Fri, 24 Feb 2023 07:57:47 GMT
x-amz-version-id
LysCEn1IWOZ4CIC6b3SCgmmVc3yyp9tz
via
1.1 db7ddd3365519d8ae74d9efd1464b57c.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-amz-cf-pop
BOM50-C1
age
222252
x-amz-server-side-encryption
AES256
content-encoding
br
x-cache
Hit from cloudfront
x-amz-replication-status
COMPLETED
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Fri, 17 Feb 2023 16:39:40 GMT
server
cloudflare
etag
W/"3b99fcbae7301000b4029b060cd94242"
access-control-max-age
3000
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
https://app.hubspot.com
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HF2FBrWzkyw1cJqyBzcEYlZpApaN2GHlx2LQviIbnDK0ZIJwFhSloo8uEnjryeCZuINOpNz7p7IlTx3pHt75TAfYCoKb2VGh8Qo0jKVIkRLFHRrDYCv7XmETQJ0YU0qy8fZDtZRIkLEkGnEMspm%2BhisICcs%3D"}],"group":"cf-nel","max_age":604800}
vary
Origin,Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-credentials
true
cache-control
public, max-age=31536000
cf-ray
79e6a7063e49bb59-FRA
x-amz-cf-id
7RDnbCGQyqiQ1hYsvQakiPul8B5tMGzBUkcCg82luKcvMLmnSDvdbw==
expires
Sat, 24 Feb 2024 07:57:47 GMT
visitor.css
static.hsappstatic.net/conversations-visitor-ui/static-1.14289/sass/ Frame 35E5 		20 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://static.hsappstatic.net/conversations-visitor-ui/static-1.14289/sass/visitor.css
Requested by
Host: app.hubspot.com
URL: https://app.hubspot.com/conversations-visitor/21289959/threads/utk/35592f98564a4b4f8db8d50c9ad21901?uuid=79c07825097049f09d40c1f476e93824&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=blog.cyble.com&inApp53=false&messagesUtk=35592f98564a4b4f8db8d50c9ad21901&url=https%3A%2F%2Fblog.cyble.com%2F2022%2F03%2F31%2Fdeep-dive-analysis-borat-rat%2F&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=false&enableWidgetCookieBanner=false&isInCMS=false
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7d2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
963563d75d17a3c2b444ad4d73e3e9c24a43f6f9e121cce484aa6c7d197af73c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://app.hubspot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Fri, 24 Feb 2023 07:57:47 GMT
x-amz-version-id
8cTUQYaMqbf6Yv8IIYst6y8hd.mcxuTh
via
1.1 8fd360cd20d33fa1400394ae41746f66.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-amz-cf-pop
FRA56-C2
age
1994980
x-amz-server-side-encryption
AES256
content-encoding
br
x-cache
RefreshHit from cloudfront
x-amz-replication-status
COMPLETED
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Thu, 19 Jan 2023 19:32:55 GMT
server
cloudflare
etag
W/"3192955eca3e03437d10c02e718e1960"
vary
Origin,Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cNJLajWAlN%2FdDgyAJu6EusNwCK4HYX7n5vwRziwCc6J%2Fz36SelElMLDKAR0DgV0mOJxjMk3IJhzOPMiMTv924s%2FS7GkSSf6mWl3RGYtOH8KlDnJslGPxkLWvHGV5N1mAwx6kvOTRHsHJROpd5i9RC%2Fy4qp4%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
public, max-age=31536000
cf-ray
79e6a7063968367f-FRA
x-amz-cf-id
znwq3L50u5M20M5NbKE6j_QGQRzI3MDBRZBvr3DEJyHniRIxzbJNwQ==
expires
Sat, 24 Feb 2024 07:57:47 GMT
bundle.production.js
static.hsappstatic.net/hubspot-dlb/static-1.354/ Frame 35E5 		295 KB
94 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.hsappstatic.net/hubspot-dlb/static-1.354/bundle.production.js
Requested by
Host: app.hubspot.com
URL: https://app.hubspot.com/conversations-visitor/21289959/threads/utk/35592f98564a4b4f8db8d50c9ad21901?uuid=79c07825097049f09d40c1f476e93824&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=blog.cyble.com&inApp53=false&messagesUtk=35592f98564a4b4f8db8d50c9ad21901&url=https%3A%2F%2Fblog.cyble.com%2F2022%2F03%2F31%2Fdeep-dive-analysis-borat-rat%2F&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=false&enableWidgetCookieBanner=false&isInCMS=false
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7d2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2449ac1a9451021a441c818e5eaed77a5e880504ad0815c40f0f19ab84ca6cfa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://app.hubspot.com/
Origin
https://app.hubspot.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Fri, 24 Feb 2023 07:57:47 GMT
x-amz-version-id
Aj74JH9zHucnM4eKyPxhPDYcnw_QEp7F
via
1.1 ef337dd302517121dfb2acfcd2bcfca8.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-amz-cf-pop
PHL51-P1
age
1518705
x-amz-server-side-encryption
AES256
content-encoding
br
x-cache
Miss from cloudfront
x-amz-replication-status
COMPLETED
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Wed, 01 Feb 2023 23:38:38 GMT
server
cloudflare
etag
W/"e18613eeedf95727a868236b293e5f98"
access-control-max-age
3000
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
https://app.hubspot.com
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=K7k9%2BITJWsf6bWS3L7XCxclydLRDgXetDqlBnASUbDZ8ndV2wFSQtL%2B6DuJXPC2OY5lTm%2BYIjUi5F%2FqO15orF5TMHpbPQE3hYYk0Ltwxybgo5ornZPtnkvp4M5OV4HxrN5aWxDS2KXlhSUhiRtLzyjDk9YE%3D"}],"group":"cf-nel","max_age":604800}
vary
Origin,Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-credentials
true
cache-control
public, max-age=31536000
cf-ray
79e6a7063e4cbb59-FRA
x-amz-cf-id
hhjgLh2IhSfC2loQSbM91iv2UXI1PYjn5avMfK5WDG3FirhXUb7uMg==
expires
Sat, 24 Feb 2024 07:57:47 GMT
visitor.js
static.hsappstatic.net/conversations-visitor-ui/static-1.14794/bundles/ Frame 35E5 		608 KB
179 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.hsappstatic.net/conversations-visitor-ui/static-1.14794/bundles/visitor.js
Requested by
Host: app.hubspot.com
URL: https://app.hubspot.com/conversations-visitor/21289959/threads/utk/35592f98564a4b4f8db8d50c9ad21901?uuid=79c07825097049f09d40c1f476e93824&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=blog.cyble.com&inApp53=false&messagesUtk=35592f98564a4b4f8db8d50c9ad21901&url=https%3A%2F%2Fblog.cyble.com%2F2022%2F03%2F31%2Fdeep-dive-analysis-borat-rat%2F&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=false&enableWidgetCookieBanner=false&isInCMS=false
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7d2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f9dec2536b45036a83edfa39f851d090deb7887b6999d696b50810f4369d962a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://app.hubspot.com/
Origin
https://app.hubspot.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Fri, 24 Feb 2023 07:57:47 GMT
x-amz-version-id
kKgY1OOBzpbpSW86TMyumKQwuwmgqC3E
via
1.1 be868d7f633deda2e751380068dbbab4.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-amz-cf-pop
BOM50-C1
age
27784
x-amz-server-side-encryption
AES256
content-encoding
br
x-cache
Hit from cloudfront
x-amz-replication-status
COMPLETED
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Thu, 23 Feb 2023 22:02:01 GMT
server
cloudflare
etag
W/"776953b15d90a240b58ce79cae08db0c"
access-control-max-age
3000
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
https://app.hubspot.com
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nN4pf6yDfu64re24iPFbPcIaH96rnDC2UEnM9zMXm7a4Oc1OVbc2xZyukeTA5CMvizcT%2FZrcs1LK%2FrJ677v1nrauXiIpHqZwA2bu6orHS1oaU3%2FjT%2Bv4A3JLD9xb%2Bbnf%2Ft4W9SPgkWImVDGaOtRy5LbI0gM%3D"}],"group":"cf-nel","max_age":604800}
vary
Origin,Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-credentials
true
cache-control
public, max-age=31536000
cf-ray
79e6a7063e4abb59-FRA
x-amz-cf-id
krnl4MmmfMej9tLthIM20dpXoxmXC8uZytrFHqtHYQpUy81D_r1oFQ==
expires
Sat, 24 Feb 2024 07:57:47 GMT
i18n-data-data-locales-en-us.js
static.hsappstatic.net/conversations-visitor-ui/static-1.14711/ Frame 35E5 		776 B
919 B 		Script
General
Check archive.org
Download Go to
Full URL
https://static.hsappstatic.net/conversations-visitor-ui/static-1.14711/i18n-data-data-locales-en-us.js
Requested by
Host: app.hubspot.com
URL: https://app.hubspot.com/conversations-visitor/21289959/threads/utk/35592f98564a4b4f8db8d50c9ad21901?uuid=79c07825097049f09d40c1f476e93824&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=blog.cyble.com&inApp53=false&messagesUtk=35592f98564a4b4f8db8d50c9ad21901&url=https%3A%2F%2Fblog.cyble.com%2F2022%2F03%2F31%2Fdeep-dive-analysis-borat-rat%2F&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=false&enableWidgetCookieBanner=false&isInCMS=false
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7d2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7423b7bf0cf4294d4716ebd117701e2808fdaf5bffe46d6d3afa50d3359f537d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://app.hubspot.com/
Origin
https://app.hubspot.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Fri, 24 Feb 2023 07:57:48 GMT
x-amz-version-id
4AfzkA2T8U2tBNJMXMvOd2tbIqIJyMy3
via
1.1 891011d51eb2353ebe8601f5b6467070.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-amz-cf-pop
FRA56-P2
age
53012
x-amz-server-side-encryption
AES256
content-encoding
br
x-cache
Hit from cloudfront
x-amz-replication-status
COMPLETED
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Fri, 17 Feb 2023 20:04:35 GMT
server
cloudflare
etag
W/"5fea6a21ebd166095e60e111878c4f64"
access-control-max-age
3000
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
https://app.hubspot.com
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DLU2ZQlMfLXqBXueczxyZil%2BjAHS1e2XLJZ2MY2KgXZuuSqRES4OOzap1a43zBqJLmvPhFCQ7RZkKSn1YA2FQJ2oq6I1BVHRyzTwsYRyCGOo5bkKWdD%2BvAgxFV4RN6%2BALhqnQqlEcdHaWbrAMprq5n%2BD6Ss%3D"}],"group":"cf-nel","max_age":604800}
vary
Origin,Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-credentials
true
cache-control
public, max-age=31536000
cf-ray
79e6a7071f85bb59-FRA
x-amz-cf-id
nD8UBsuaBs8cJWYWl40MOl2fYAzeYyNhXyDe6Uys6LSBEkzEeQuaBQ==
expires
Sat, 24 Feb 2024 07:57:48 GMT
nr-spa-1216.min.js
js-agent.newrelic.com/ Frame 35E5 		49 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js-agent.newrelic.com/nr-spa-1216.min.js
Requested by
Host: app.hubspot.com
URL: https://app.hubspot.com/conversations-visitor/21289959/threads/utk/35592f98564a4b4f8db8d50c9ad21901?uuid=79c07825097049f09d40c1f476e93824&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=blog.cyble.com&inApp53=false&messagesUtk=35592f98564a4b4f8db8d50c9ad21901&url=https%3A%2F%2Fblog.cyble.com%2F2022%2F03%2F31%2Fdeep-dive-analysis-borat-rat%2F&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=false&enableWidgetCookieBanner=false&isInCMS=false
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.66.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
545156adeae44dadc82b98d504f805ebe77fb79c928ef34eed1057bb9d4cb8fe

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://app.hubspot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

x-amz-version-id
UU.F5jvoumAjQChriwTQHbisCFw_OInU
content-encoding
gzip
via
1.1 varnish
date
Fri, 24 Feb 2023 07:57:48 GMT
x-amz-request-id
DP5C34X5Z6YPAHYP
x-cache
HIT
cross-origin-resource-policy
cross-origin
content-length
18216
x-amz-id-2
67zAQpTRyZG7pPDlS3UCix35OM10Kcjz/Vm9dpVF8RQfw3cfNLbbSTu8x/qYuCVGXVSe6wcFJKs=
x-served-by
cache-hhn-etou8220066-HHN
last-modified
Thu, 14 Apr 2022 16:45:57 GMT
server
AmazonS3
x-timer
S1677225468.118500,VS0,VE0
etag
"63e2df852d15ab21d7ff8fc4363222e8"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=7200, stale-if-error=604800
accept-ranges
bytes
x-cache-hits
2291
hawk.png
labs.cyble.com/hs-fs/hubfs/ Frame 35E5 		10 KB
11 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://labs.cyble.com/hs-fs/hubfs/hawk.png?width=108&height=108
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:2c40::c73c:671e , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
979338f4aa8d1de1b994be15531b85f1d9deef4d8da685bf18286d9928488520
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://app.hubspot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Fri, 24 Feb 2023 07:57:48 GMT
strict-transport-security
max-age=31536000
via
1.1 5b2c25375d693d0fb882145cde66154e.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
1537224
x-amz-cf-pop
IAD55-P1
cf-polished
origSize=13721, status=vary_header_present
x-amz-server-side-encryption
AES256
edge-cache-tag
F-83412232556,P-21289959,FLS-ALL
cache-tag
F-83412232556,P-21289959,FLS-ALL
x-amz-storage-class
INTELLIGENT_TIERING
x-cache
RefreshHit from cloudfront
x-hs-https-only
worker
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 15
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
10237
last-modified
Tue, 31 Jan 2023 17:55:34 GMT
cf-bgj
imgq:85,h2pri
server
cloudflare
etag
"71a4b4d7a329d9270ca923d26543acd7"
vary
origin, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lM%2Fd6fvofHydyVUs11A3YPI7%2Fu9BhsERu7ux%2FXeONja1sEK6uqQPd2bJe8V7imUiDYGXER02DKJkCNyfxtkBtJlzIdaR95iOIhY8NnOITGfY%2FarDx4%2FFlZpYogil25ftZvyNAe04BKj0MU%2BE"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
access-control-allow-credentials
false
accept-ranges
bytes
cf-ray
79e6a7080de19290-FRA
x-amz-cf-id
xF6yLZWQVWwaiLqqqXKRYojVLBOl2RFEqueDeHuoYt_NXjM1ImN0JQ==
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 15
rhumb
app.hubspot.com/api/cartographer/v1/ Frame 35E5 		0
1 KB 		Ping
General
Check archive.org
Download Go to
Full URL
https://app.hubspot.com/api/cartographer/v1/rhumb?hs_static_app=conversations-visitor-ui&hs_static_app_version=1.14794
Requested by
Host: static.hsappstatic.net
URL: https://static.hsappstatic.net/conversations-visitor-ui/static-1.14794/bundles/visitor.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://app.hubspot.com/conversations-visitor/21289959/threads/utk/35592f98564a4b4f8db8d50c9ad21901?uuid=79c07825097049f09d40c1f476e93824&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=blog.cyble.com&inApp53=false&messagesUtk=35592f98564a4b4f8db8d50c9ad21901&url=https%3A%2F%2Fblog.cyble.com%2F2022%2F03%2F31%2Fdeep-dive-analysis-borat-rat%2F&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=false&enableWidgetCookieBanner=false&isInCMS=false
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Fri, 24 Feb 2023 07:57:48 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id
29a298fb-e96d-492c-be5d-95c0747da58b
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
server
cloudflare
vary
origin, Accept-Encoding
access-control-allow-methods
GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FvDGZLwY%2FA%2Be%2F5oumI61Hlf1uyTMeFP6zfIAq6MFwMkHmvaqEWB9mMrlnFyDzmoncMZhyeCq3010zv1vphBdNkUYv%2B35Pt6jNMspb6Ch9DuV4IwzKzWtzI69y72R1FMkV7%2FGxFUBkPAHz%2FZDNQ%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
https://app.hubspot.com
access-control-expose-headers
x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing, X-Hubspot-Correct-Hublet, X-HubSpot-Auth-Failure
access-control-max-age
604800
access-control-allow-credentials
true
cf-ray
79e6a707cb3092c3-FRA
access-control-allow-headers
Authorization, Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer
timing-allow-origin
*
welcomeMessages
app.hubspot.com/api/livechat-public/v1/bots/public/bot/2122156/ Frame 35E5 		940 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://app.hubspot.com/api/livechat-public/v1/bots/public/bot/2122156/welcomeMessages?hs_static_app=conversations-visitor-ui&hs_static_app_version=1.14794&conversations-visitor-ui=static-1.14794&traceId=35592f98564a4b4f8db8d50c9ad21901&sessionId=AMOaWbLkghOXdf4Brd3-oP6yRXjIDYwdwiJ40SltyLV1C5SSfsP2wkPuDzuSK5_UeYQtm7iPNfTDtEC4tl1Tx1YakouvsYQeJlWlaBrLFLJgGDIiELuImsSDTncxkRUDCYhMtWFUXzWvQUarwxgSzWiJnatahyfibbryYjcpwfUfdfxSA3iPyXE
Requested by
Host: app.hubspot.com
URL: https://app.hubspot.com/conversations-visitor/21289959/threads/utk/35592f98564a4b4f8db8d50c9ad21901?uuid=79c07825097049f09d40c1f476e93824&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=blog.cyble.com&inApp53=false&messagesUtk=35592f98564a4b4f8db8d50c9ad21901&url=https%3A%2F%2Fblog.cyble.com%2F2022%2F03%2F31%2Fdeep-dive-analysis-borat-rat%2F&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=false&enableWidgetCookieBanner=false&isInCMS=false
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8bfc26c55329ff2191cc630cd6fedbcc742a0161222529327970449e0ce2e6f6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://app.hubspot.com/conversations-visitor/21289959/threads/utk/35592f98564a4b4f8db8d50c9ad21901?uuid=79c07825097049f09d40c1f476e93824&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=blog.cyble.com&inApp53=false&messagesUtk=35592f98564a4b4f8db8d50c9ad21901&url=https%3A%2F%2Fblog.cyble.com%2F2022%2F03%2F31%2Fdeep-dive-analysis-borat-rat%2F&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=false&enableWidgetCookieBanner=false&isInCMS=false
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Fri, 24 Feb 2023 07:57:48 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id
814f9ce5-c6b2-40f0-9ca6-a8881f35edbf
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
server
cloudflare
x-trace
2B0645DE0B61436876F755902559416ABF4281B1B8000000000000000000
vary
origin, Accept-Encoding
access-control-allow-methods
GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type
application/json;charset=utf-8
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Btxp%2F5n8IxnY2I%2B6y%2FWefZ5BBYTFRAQm3vkvcEQsuKgGckbXbCIlad8iPLXJMIPv2j6DF3ReiJlf86se8pE4yX6SJQfySuNgX448bku7ahAiXL%2FWuvQ%2FyJWMMk%2FlZblGFyUhf6C6BKxQNij%2Beg%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials
false
cf-ray
79e6a707dc5939cd-FRA
access-control-allow-headers
Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent, X-HubSpot-Messages-Uri
f9d051f404
bam-cell.nr-data.net/1/ Frame 35E5 		49 B
945 B 		Script
General
Check archive.org
Download Go to
Full URL
https://bam-cell.nr-data.net/1/f9d051f404?a=205242107&sa=1&v=1216.487a282&t=Unnamed%20Transaction&rst=657&ck=1&ref=https://app.hubspot.com/conversations-visitor/21289959/threads/utk/35592f98564a4b4f8db8d50c9ad21901&be=405&fe=555&dc=526&af=err,xhr,stn,ins,spa&perf=%7B%22timing%22:%7B%22of%22:1677225467504,%22n%22:0,%22f%22:0,%22dn%22:1,%22dne%22:14,%22c%22:14,%22s%22:21,%22ce%22:33,%22rq%22:33,%22rp%22:330,%22rpe%22:331,%22dl%22:334,%22di%22:525,%22ds%22:525,%22de%22:526,%22dc%22:554,%22l%22:554,%22le%22:555%7D,%22navigation%22:%7B%7D%7D&fp=644&ja=%7B%22nrSnippetVersion%22:%221216%22,%22environment%22:%22prod%22,%22deployed%22:true,%22hublet%22:%22na1%22,%22userAgentRaw%22:%22Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/110.0.5481.177%20Safari/537.36%22,%22supportsPromiseRejectionEvent%22:true,%22hsOlderBrowserVersion%22:false,%22deviceMemory%22:8,%22cpuCores%22:4,%22downloadSpeedMbps%22:9,%22effectiveConnectionType%22:%224g%22,%22networkLatencyMs%22:0,%22conditionalPolyfillsInstalled%22:false,%22portalId%22:21289959,%22package%22:%22conversations-visitor-ui%22,%22packageVersion%22:%221.14794%22,%22template%22:%22visitor-index.html.tsx%22,%22user-online%22:true,%22visibility%22:%22visible%22,%22currentVisibility%22:%22visible%22,%22isEmbeddedInProduct%22:%22false%22,%22reactRhumbVersion%22:%221.8731%22,%22reaganVersion%22:%22react-rhumb%22,%22route%22:%22/%22,%22numReaganChecksStarted%22:1,%22numPreviousReaganChecksAborted%22:0,%22avgDurationBeforePreviousReaganAborts%22:0,%22numPreviousReaganChecksFailed%22:0,%22numPreviousReaganChecksSuccessful%22:0,%22supportsUserTiming%22:true,%22supportsPerformanceTimeline%22:true,%22supportsHighResolutionTime%22:true%7D&jsonp=NREUM.setToken
Requested by
Host: app.hubspot.com
URL: https://app.hubspot.com/conversations-visitor/21289959/threads/utk/35592f98564a4b4f8db8d50c9ad21901?uuid=79c07825097049f09d40c1f476e93824&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=blog.cyble.com&inApp53=false&messagesUtk=35592f98564a4b4f8db8d50c9ad21901&url=https%3A%2F%2Fblog.cyble.com%2F2022%2F03%2F31%2Fdeep-dive-analysis-borat-rat%2F&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=false&enableWidgetCookieBanner=false&isInCMS=false
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
162.247.241.2 Apex, United States, ASN23467 (NEWRELIC-AS-1, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dac715f087720dd7ff7067f5d2ec1988851fa93140ae8a9cbfaa15659dd7fd82

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://app.hubspot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date
Fri, 24 Feb 2023 07:57:48 GMT
Content-Encoding
gzip
CF-Cache-Status
DYNAMIC
NEL
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
Server
cloudflare
Transfer-Encoding
chunked
access-control-allow-methods
GET, POST, PUT, HEAD, OPTIONS
Content-Type
text/javascript
Access-Control-Allow-Origin
*
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OudAYvHXbJwU59LmFxtiQMFOhxEMPEogV08wsxHaFa84Fn6S3RE%2FzrjHjwa%2F8MTtorx2dPakVdbyF%2BtjhHlmggfRHs3P5JCm04rQ6xVIcB18wtRR6FvxWEECUaVR7QXhHG7CQR7s"}],"group":"cf-nel","max_age":604800}
Vary
Accept-Encoding
access-control-allow-credentials
true
Cross-Origin-Resource-Policy
cross-origin
Connection
keep-alive
CF-Ray
79e6a708bb9e3653-FRA
__ptq.gif
track.hubspot.com/ 		45 B
380 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=1706262889&v=1.1&a=21289959&ct=blog-post&rcu=https%3A%2F%2Fblog.cyble.com%2F2022%2F03%2F31%2Fdeep-dive-analysis-borat-rat%2F&pu=https%3A%2F%2Fblog.cyble.com%2F2022%2F03%2F31%2Fdeep-dive-analysis-borat-rat%2F&t=Deep+Dive+Analysis+%E2%80%93+Borat+RAT+%E2%80%94+Cyble&cts=1677225468387&vi=7e5c4e87904404589ae8d36f4af73079&nc=true&u=27441379.7e5c4e87904404589ae8d36f4af73079.1677225468383.1677225468383.1677225468383.1&b=27441379.1.1677225468383&cc=15
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Fri, 24 Feb 2023 07:57:48 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id
f659af95-4c69-4d8f-8585-628e21da85af
p3p
CP="NOI CUR ADM OUR NOR STA NID"
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
45
server
cloudflare
vary
origin, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FTYvTPvlhLrVdBO7zm2YwrhnDcPXhPG8VUBRCXKf66EGdaoDsldScpfRakyh3pANySxMufe5IwK0L8UInboGA%2FWJwS9nADz5koO3UurLI%2FEKOTWETIXGKZveH7YhXd81koGgD3y7BqQDTIEJyD8h"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
cache-control
no-cache, no-store, no-transform
access-control-allow-credentials
false
cf-ray
79e6a7099dfb92c3-FRA
x-robots-tag
none
__ptq.gif
track.hubspot.com/ 		45 B
359 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://track.hubspot.com/__ptq.gif?k=15&fi=f7da69d1-3801-430f-b109-5f44b65a9326&fci=c5fcfc17-eb43-467a-a0aa-9eefc7f4cffa&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=1706262889&v=1.1&a=21289959&ct=blog-post&rcu=https%3A%2F%2Fblog.cyble.com%2F2022%2F03%2F31%2Fdeep-dive-analysis-borat-rat%2F&pu=https%3A%2F%2Fblog.cyble.com%2F2022%2F03%2F31%2Fdeep-dive-analysis-borat-rat%2F&t=Deep+Dive+Analysis+%E2%80%93+Borat+RAT+%E2%80%94+Cyble&cts=1677225468389&vi=7e5c4e87904404589ae8d36f4af73079&nc=true&u=27441379.7e5c4e87904404589ae8d36f4af73079.1677225468383.1677225468383.1677225468383.1&b=27441379.1.1677225468383&cc=15
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Fri, 24 Feb 2023 07:57:48 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id
4cabca5a-602c-4fe0-9ded-63c086e337cb
p3p
CP="NOI CUR ADM OUR NOR STA NID"
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
45
server
cloudflare
vary
origin, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YPftCz6W0hz8nOWp5doUj%2BH%2FFkyn8rY0EE93ZD7311a9A6GNspFuCdVoeiN4%2F%2BalZTrdGfrVqeGYhckgIiCAhdnyS%2ByiswQT4BvU47hn90PkYp%2BOnKeWLlw4C1ULCCReF1pkwJwJknDd9NvmoZq2"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
cache-control
no-cache, no-store, no-transform
access-control-allow-credentials
false
cf-ray
79e6a7099dfd92c3-FRA
x-robots-tag
none
__ptq.gif
track.hubspot.com/ 		45 B
355 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://track.hubspot.com/__ptq.gif?k=17&fi=f7da69d1-3801-430f-b109-5f44b65a9326&fci=c5fcfc17-eb43-467a-a0aa-9eefc7f4cffa&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=1706262889&v=1.1&a=21289959&ct=blog-post&rcu=https%3A%2F%2Fblog.cyble.com%2F2022%2F03%2F31%2Fdeep-dive-analysis-borat-rat%2F&pu=https%3A%2F%2Fblog.cyble.com%2F2022%2F03%2F31%2Fdeep-dive-analysis-borat-rat%2F&t=Deep+Dive+Analysis+%E2%80%93+Borat+RAT+%E2%80%94+Cyble&cts=1677225468390&vi=7e5c4e87904404589ae8d36f4af73079&nc=true&u=27441379.7e5c4e87904404589ae8d36f4af73079.1677225468383.1677225468383.1677225468383.1&b=27441379.1.1677225468383&cc=15
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Fri, 24 Feb 2023 07:57:48 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id
2517e0e6-bf3f-4da1-bd1b-6cc5eed59b50
p3p
CP="NOI CUR ADM OUR NOR STA NID"
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
45
server
cloudflare
vary
origin, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7Pl3HpidHN4jLfL7DgrVi1vtHtwEQJ3DI0ppatPuaSSOEx3xqGPAu6ehzk6Zg1PJJn7YNTPTXtH8ibu1mlymWxNTR28%2BgO%2BVI0C0vi2WnwKo8%2FGsMYNg74BVMcmEdqQ9FjWXrmau0cGp4Z7cUgEx"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
cache-control
no-cache, no-store, no-transform
access-control-allow-credentials
false
cf-ray
79e6a7099df992c3-FRA
x-robots-tag
none
__ptq.gif
track.hubspot.com/ 		45 B
411 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://track.hubspot.com/__ptq.gif?k=15&fi=f7da69d1-3801-430f-b109-5f44b65a9326&fci=6069e0e8-eee9-4005-b5ca-711a7b386963&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=1706262889&v=1.1&a=21289959&ct=blog-post&rcu=https%3A%2F%2Fblog.cyble.com%2F2022%2F03%2F31%2Fdeep-dive-analysis-borat-rat%2F&pu=https%3A%2F%2Fblog.cyble.com%2F2022%2F03%2F31%2Fdeep-dive-analysis-borat-rat%2F&t=Deep+Dive+Analysis+%E2%80%93+Borat+RAT+%E2%80%94+Cyble&cts=1677225468391&vi=7e5c4e87904404589ae8d36f4af73079&nc=true&u=27441379.7e5c4e87904404589ae8d36f4af73079.1677225468383.1677225468383.1677225468383.1&b=27441379.1.1677225468383&cc=15
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Fri, 24 Feb 2023 07:57:48 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id
7e4ed6b6-ac98-4600-b58b-ccb39710578b
p3p
CP="NOI CUR ADM OUR NOR STA NID"
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
45
server
cloudflare
vary
origin, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=S6pBT1mjnBkVep%2FtX8tivh0HJLVCgmzyDqmT1yeaSXWuYRTPInO8mEpMjcpxS8ebyMGjW5vuGFSXOS%2FzVTT8ufK%2BIB9XG%2BDsEXvDzvLivGnzJMoXVtxl7bdM2nByR1BNrFGm6JDixGfZ%2BeSFu2mr"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
cache-control
no-cache, no-store, no-transform
access-control-allow-credentials
false
cf-ray
79e6a7099dfc92c3-FRA
x-robots-tag
none
__ptq.gif
track.hubspot.com/ 		45 B
515 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://track.hubspot.com/__ptq.gif?k=17&fi=f7da69d1-3801-430f-b109-5f44b65a9326&fci=6069e0e8-eee9-4005-b5ca-711a7b386963&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=1706262889&v=1.1&a=21289959&ct=blog-post&rcu=https%3A%2F%2Fblog.cyble.com%2F2022%2F03%2F31%2Fdeep-dive-analysis-borat-rat%2F&pu=https%3A%2F%2Fblog.cyble.com%2F2022%2F03%2F31%2Fdeep-dive-analysis-borat-rat%2F&t=Deep+Dive+Analysis+%E2%80%93+Borat+RAT+%E2%80%94+Cyble&cts=1677225468392&vi=7e5c4e87904404589ae8d36f4af73079&nc=true&u=27441379.7e5c4e87904404589ae8d36f4af73079.1677225468383.1677225468383.1677225468383.1&b=27441379.1.1677225468383&cc=15
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Fri, 24 Feb 2023 07:57:48 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id
127a7390-d6e8-4094-866c-8256a453feec
p3p
CP="NOI CUR ADM OUR NOR STA NID"
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
45
server
cloudflare
vary
origin, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Am1XBoH5kTBgKIgStl9rdSgYH2UODIxUOa1X0fI8vETod6jqHDoBuDBHIXmfQFJOY99NsTRRraCEhG9DbDzo%2B6aBpaxXlyANL%2FpZLMW6EowK2ciBkDny7LJ%2BpRaBzRaheseRvwbYN3Y9y2A%2FSNbI"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
cache-control
no-cache, no-store, no-transform
access-control-allow-credentials
false
cf-ray
79e6a7099dfa92c3-FRA
x-robots-tag
none
f9d051f404
bam-cell.nr-data.net/ins/1/ Frame 35E5 		0
686 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://bam-cell.nr-data.net/ins/1/f9d051f404?a=205242107&sa=1&v=1216.487a282&t=Unnamed%20Transaction&rst=914&ck=1&ref=https://app.hubspot.com/conversations-visitor/21289959/threads/utk/35592f98564a4b4f8db8d50c9ad21901
Requested by
Host: app.hubspot.com
URL: https://app.hubspot.com/conversations-visitor/21289959/threads/utk/35592f98564a4b4f8db8d50c9ad21901?uuid=79c07825097049f09d40c1f476e93824&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=blog.cyble.com&inApp53=false&messagesUtk=35592f98564a4b4f8db8d50c9ad21901&url=https%3A%2F%2Fblog.cyble.com%2F2022%2F03%2F31%2Fdeep-dive-analysis-borat-rat%2F&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=false&enableWidgetCookieBanner=false&isInCMS=false
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
162.247.241.2 Apex, United States, ASN23467 (NEWRELIC-AS-1, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://app.hubspot.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
content-type
text/plain

Response headers

Date
Fri, 24 Feb 2023 07:57:48 GMT
CF-Cache-Status
DYNAMIC
NEL
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
Server
cloudflare
Vary
Accept-Encoding
access-control-allow-methods
GET, POST, PUT, HEAD, OPTIONS
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NHXbypyF22MfbGAwq6aTvq%2BlicxcwHQrW3TYxgiELQ%2Bhc9%2B%2FmCbPAw8C%2BS%2F6Be67CmXERPwgNGpZuIRFTbcg%2BUo7JbEhoCexTYslYMU7%2FPstRktWCPvD5jMsblBfDJ%2B1UON%2FKKmf"}],"group":"cf-nel","max_age":604800}
Access-Control-Allow-Origin
https://app.hubspot.com
access-control-allow-credentials
true
Connection
keep-alive
CF-Ray
79e6a709acd63653-FRA
f9d051f404
bam-cell.nr-data.net/events/1/ Frame 35E5 		24 B
745 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://bam-cell.nr-data.net/events/1/f9d051f404?a=205242107&sa=1&v=1216.487a282&t=Unnamed%20Transaction&rst=918&ck=1&ref=https://app.hubspot.com/conversations-visitor/21289959/threads/utk/35592f98564a4b4f8db8d50c9ad21901
Requested by
Host: app.hubspot.com
URL: https://app.hubspot.com/conversations-visitor/21289959/threads/utk/35592f98564a4b4f8db8d50c9ad21901?uuid=79c07825097049f09d40c1f476e93824&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=blog.cyble.com&inApp53=false&messagesUtk=35592f98564a4b4f8db8d50c9ad21901&url=https%3A%2F%2Fblog.cyble.com%2F2022%2F03%2F31%2Fdeep-dive-analysis-borat-rat%2F&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=false&enableWidgetCookieBanner=false&isInCMS=false
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
162.247.241.2 Apex, United States, ASN23467 (NEWRELIC-AS-1, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0c9cf152a0ad00d4f102c93c613c104914be5517ac8f8e0831727f8bfbe8b300

Request headers

Referer
https://app.hubspot.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
content-type
text/plain

Response headers

Date
Fri, 24 Feb 2023 07:57:48 GMT
CF-Cache-Status
DYNAMIC
NEL
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
Server
cloudflare
Vary
Accept-Encoding
access-control-allow-methods
GET, POST, PUT, HEAD, OPTIONS
Content-Type
image/gif
Access-Control-Allow-Origin
https://app.hubspot.com
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gbjlgHNO%2Bp5dF1oDNmKxNusqhH%2FoNvPx%2Bh%2F3XKjriJw0MUMuA1hBeU26gV1grWgEuxdfFFGPILUvAnmC9mPjwy2peWr2qv1FmnxMQLah7%2BBLbfkZp9UWtL2JL%2FT6%2BwGw%2FzAKl%2B3n"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials
true
Connection
keep-alive
CF-Ray
79e6a709c9302bd1-FRA
Content-Length
24
json
forms.hubspot.com/lead-flows-config/v1/config/ 		24 KB
5 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://forms.hubspot.com/lead-flows-config/v1/config/json?portalId=21289959&utk=7e5c4e87904404589ae8d36f4af73079&__hstc=27441379.7e5c4e87904404589ae8d36f4af73079.1677225468383.1677225468383.1677225468383.1&__hssc=27441379.1.1677225468383&currentUrl=https%3A%2F%2Fblog.cyble.com%2F2022%2F03%2F31%2Fdeep-dive-analysis-borat-rat%2F
Requested by
Host: js.hsleadflows.net
URL: https://js.hsleadflows.net/leadflows.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ba0cbf950ff5a982de86b935614ed251f12f9813346b8c7191ee2673f7daca09
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Fri, 24 Feb 2023 07:57:48 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id
8fae28c4-4939-4ef6-98b8-89e230562268
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
server
cloudflare
vary
origin
access-control-allow-methods
GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type
application/json;charset=utf-8
access-control-allow-origin
https://blog.cyble.com
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XAgDTdL870OKBKC%2FDSJtvaSObuoWTtOUezD9Z35pmnSpxPHdv1gX6tMzJRuPB01Lz10ZQk%2FdYly5ixo5H3AqrxHYmF5EALl8N8CsJVg6NdrVPyhOOpivGCZ36dZsIeiB6EpRLcDDUxukAs6cN28z"}],"group":"cf-nel","max_age":604800}
access-control-max-age
180
access-control-allow-credentials
false
cache-control
max-age=0, no-cache, no-store
x-robots-tag
none
access-control-allow-headers
Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent
cf-ray
79e6a709fbee2c75-FRA
inject.8d8a39d8fa64efbb0671.bundle.js
injection.amibreached.com/ Frame 8537 		130 KB
44 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://injection.amibreached.com/inject.8d8a39d8fa64efbb0671.bundle.js
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:c31 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9af44543fbf7b09c3d68e46dcb21d2cb9ec5f18bbd537cea92360a85c5db793e
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Fri, 24 Feb 2023 07:57:48 GMT
strict-transport-security
max-age=15552000; includeSubDomains; preload
via
1.1 6165dcc1fdf84ac65e8204c05709f1ca.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-content-type-options
nosniff
age
2951
x-amz-cf-pop
FRA56-C1
content-encoding
br
x-cache
Hit from cloudfront
last-modified
Mon, 23 May 2022 20:31:51 GMT
server
cloudflare
etag
W/"046f84a87526210ff005ab33291675c9"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BzwPGuaORRoQmCXnr1UmQSB9GJke5pzfw65PLpDaWASUJJ05beXXET1IaqQE9C1volftF%2Fc1xNrP1JSRJQHXwTaBUGkxlD3STXIPMRhkaNpt10IS5hRGGnEY1KiLLZxiA6Mgh4NmewtwMCADP5nvFZ%2FPi86vV%2BM%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=120
cf-ray
79e6a70aa9353614-FRA
x-amz-cf-id
99V3MBA9EtbZfwuiI_weWdktXIML2t146HgQnXPCdXNcQW3szFIQUA==
main.8d8a39d8fa64efbb0671.css
injection.amibreached.com/css/ Frame 8537 		703 B
718 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://injection.amibreached.com/css/main.8d8a39d8fa64efbb0671.css
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:c31 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c7d0240fd43289ab1411c5fa1277574ee436d3a3bbb82d34c4d82f32d04517b8
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Fri, 24 Feb 2023 07:57:48 GMT
strict-transport-security
max-age=15552000; includeSubDomains; preload
via
1.1 9570c3a1725c20e6faed117bbb74223a.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-content-type-options
nosniff
age
2951
x-amz-cf-pop
FRA56-C1
content-encoding
br
x-cache
Hit from cloudfront
last-modified
Mon, 23 May 2022 20:31:51 GMT
server
cloudflare
etag
W/"ff4f518052149a21c5b6397b3f717f6a"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WX%2FGem%2Fp0kZxSrI9M2G8olNsf%2B9rv2usC7lMLdA3q9k%2BzIJ3zUAPM%2FX9O2DyGKCW7FaYV9J5G2JJjcvvgUE34joPweb3KGs4qBgUkrXA1zOrkUXMXOJb25dJXgc0VQ2JG25P0gfWsZpj%2FhBTY886MhiGhA1ESok%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=120
cf-ray
79e6a70aa9373614-FRA
x-amz-cf-id
6bBRQlzl7JO02aBN2MUAKBt-lu2RJ3yemhC8Aq3K_V22mkQDuXWcWg==
272.8d8a39d8fa64efbb0671.css
injection.amibreached.com/css/ Frame 8537 		348 KB
52 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://injection.amibreached.com/css/272.8d8a39d8fa64efbb0671.css
Requested by
Host: injection.amibreached.com
URL: https://injection.amibreached.com/inject.8d8a39d8fa64efbb0671.bundle.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:c31 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c77d2ba289d0e2827ad7f79b00972a63c7f4426d89b8ce6b5da90a368760cfe4
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Fri, 24 Feb 2023 07:57:48 GMT
strict-transport-security
max-age=15552000; includeSubDomains; preload
via
1.1 cf2939e85531f45f3306f792ea104eaa.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-content-type-options
nosniff
age
2951
x-amz-cf-pop
FRA56-C1
content-encoding
br
x-cache
Hit from cloudfront
last-modified
Mon, 23 May 2022 20:31:51 GMT
server
cloudflare
etag
W/"a858af055119af47585aeffbfd69ceac"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iqtLNcJhje60JydOix0MWFZr3REpGALaZOlMvHufUJxhoTBFiMRc5ffQlZT6zWySS2WBAxlv9m5UFuC5GkMbaYxxVzbAzRDs9jJ7HHnGkXHYtLfDDZVfWElYXKL4SoE1Fjx3idK9KmTPD%2B0cVapvMvpSrhgP0GE%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=120
cf-ray
79e6a70b19e03614-FRA
x-amz-cf-id
mV1VcD8KLwykpHnq1egcdf6eF_8dGnfH2GPlGc1lunaRN9DqYma8_w==
272.8d8a39d8fa64efbb0671.chunk.js
injection.amibreached.com/chunks/ Frame 8537 		381 KB
101 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://injection.amibreached.com/chunks/272.8d8a39d8fa64efbb0671.chunk.js
Requested by
Host: injection.amibreached.com
URL: https://injection.amibreached.com/inject.8d8a39d8fa64efbb0671.bundle.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:c31 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
29d409fee0f34ebc05fa36076c101b77e28dccbcfdbfbf4cf248371820ca9ddb
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Fri, 24 Feb 2023 07:57:48 GMT
strict-transport-security
max-age=15552000; includeSubDomains; preload
via
1.1 4874e0c922f34c928345f4c183ea11b4.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-content-type-options
nosniff
age
2951
x-amz-cf-pop
FRA56-C1
content-encoding
br
x-cache
Hit from cloudfront
last-modified
Mon, 23 May 2022 20:31:50 GMT
server
cloudflare
etag
W/"a161e1a55882deeacea4aadc5ab6a660"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wp6RaAp1RVBtIy6FtXDaDMsZ0sVDa5vMCaoRcNcNWa4V7cQAF5nZRY7w22BjkzNYjf%2B0U5XZrdthiz6HjZDREdTCQBcwc0PJFzMsOsjJQo2tKahE8Pqc1BWBqhtFqDD%2BpArDrCZtBTAmXDqukmPnj3upwpg70VI%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=120
cf-ray
79e6a70b19e33614-FRA
x-amz-cf-id
_Zy0FD_YAiG7bLSBe7g1VBk0wO9KZ44585uOrNYjHEwTIF3_pUY6xw==
349.8d8a39d8fa64efbb0671.css
injection.amibreached.com/css/ Frame 8537 		3 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://injection.amibreached.com/css/349.8d8a39d8fa64efbb0671.css
Requested by
Host: injection.amibreached.com
URL: https://injection.amibreached.com/inject.8d8a39d8fa64efbb0671.bundle.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:c31 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9d904f71a4d973dac278821490969eb0a63dd97635584930bbbbec0a3e608d75
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Fri, 24 Feb 2023 07:57:48 GMT
strict-transport-security
max-age=15552000; includeSubDomains; preload
via
1.1 cc763905c39a59494c951c09271b0422.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-content-type-options
nosniff
age
2951
x-amz-cf-pop
FRA56-C1
content-encoding
br
x-cache
Hit from cloudfront
last-modified
Mon, 23 May 2022 20:31:51 GMT
server
cloudflare
etag
W/"d5e9ad0edf5f90c0d209a111611b1fba"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2YNGdM9fdrsrBpyngVGX6%2BQkOqf4KZpr9pqEbWFWpTWLKHmlW604z9AnDbFla7Qx%2FArOgdz%2FPTUNbTAZAfD3w3IikU3HD4%2BnFz6kGgZ6LmrnZ%2BmjdBD%2BYtc4bQyb%2F5Ng8DEvGH56C2ONVFcCofAyC53iFun5v6o%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=120
cf-ray
79e6a70b19e13614-FRA
x-amz-cf-id
fJt37ev3pMzZVMAXSKWZCJk6XDY6OXahgCeHPrunbrgBnkGnoBcCkw==
349.8d8a39d8fa64efbb0671.chunk.js
injection.amibreached.com/chunks/ Frame 8537 		16 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://injection.amibreached.com/chunks/349.8d8a39d8fa64efbb0671.chunk.js
Requested by
Host: injection.amibreached.com
URL: https://injection.amibreached.com/inject.8d8a39d8fa64efbb0671.bundle.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:c31 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a2c197367cb631f88fca96c13ec0c06d0a99bc5398d0349716bc06ce7a91e8ce
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Fri, 24 Feb 2023 07:57:48 GMT
strict-transport-security
max-age=15552000; includeSubDomains; preload
via
1.1 98997c223299d9efd138e7fb9a08a072.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-content-type-options
nosniff
age
2951
x-amz-cf-pop
FRA56-C1
content-encoding
br
x-cache
Hit from cloudfront
last-modified
Mon, 23 May 2022 20:31:51 GMT
server
cloudflare
etag
W/"0e05edf25a54d46e1a8ef01ec442978b"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bpSHXg%2FHK95%2FDtoW3mRIPxtk9HFOtliI9aXC%2BtCKdVYe10mJnOiA6NzTVZMM%2BrZ%2FI9V779SCA7dNeaGZKWBXddK9Nxpc437JGSr7vddRtYc75V6fJWdNAh2oRCNu2%2BKTgV6%2FMIH56M6n%2FHZjLuxF%2Bxa4fTvlLQ8%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=120
cf-ray
79e6a70b19e73614-FRA
x-amz-cf-id
QDn9px5ApsXmbL0_RBLU294sQPgOZvwk4GGFRo3KksPSNspP8VPQuw==
enterprise.js
www.google.com/recaptcha/ 		942 B
906 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/enterprise.js?render=explicit
Requested by
Host: js.hsleadflows.net
URL: https://js.hsleadflows.net/leadflows.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
51fa19c42421ef063ab8805822ef9dace56a4fd415343d118e455710679df1e2
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Fri, 24 Feb 2023 07:57:48 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy
frame-ancestors 'self'
server
GSE
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=300
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
586
x-xss-protection
1; mode=block
expires
Fri, 24 Feb 2023 07:57:48 GMT
__ptq.gif
track.hubspot.com/ 		45 B
640 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://track.hubspot.com/__ptq.gif?k=16&fi=e9f522ed-287e-4257-ac1f-21c1b6386922&lfi=4339818&ft=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=1706262889&v=1.1&a=21289959&ct=blog-post&rcu=https%3A%2F%2Fblog.cyble.com%2F2022%2F03%2F31%2Fdeep-dive-analysis-borat-rat%2F&pu=https%3A%2F%2Fblog.cyble.com%2F2022%2F03%2F31%2Fdeep-dive-analysis-borat-rat%2F&t=Deep+Dive+Analysis+%E2%80%93+Borat+RAT+%E2%80%94+Cyble&cts=1677225468657&vi=7e5c4e87904404589ae8d36f4af73079&nc=true&u=27441379.7e5c4e87904404589ae8d36f4af73079.1677225468383.1677225468383.1677225468383.1&b=27441379.1.1677225468383&cc=15
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Fri, 24 Feb 2023 07:57:48 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id
32020a37-ad0e-4080-9c28-84f3107518c3
p3p
CP="NOI CUR ADM OUR NOR STA NID"
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
45
server
cloudflare
vary
origin, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iOX6nmCa93N2mZm5n9NuVy8vTOd87Ez75YEgc4nyEn9B2tEdjetndyuHUQe%2BsbAfRrQaVW0WfGs%2BBoqyEwObnkl8UUO1bxFpA0Zp0e%2BnK8qdLGNgQOOp1hEv2iTw2CzXUGsaZQI4DGzQF0r%2FTHWh"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
cache-control
no-cache, no-store, no-transform
access-control-allow-credentials
false
cf-ray
79e6a70b294039cd-FRA
x-robots-tag
none
__ptq.gif
track.hubspot.com/ 		45 B
644 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://track.hubspot.com/__ptq.gif?k=16&fi=8af5df7f-7224-4e24-859c-130a9ca0ccda&lfi=3720108&ft=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=1706262889&v=1.1&a=21289959&ct=blog-post&rcu=https%3A%2F%2Fblog.cyble.com%2F2022%2F03%2F31%2Fdeep-dive-analysis-borat-rat%2F&pu=https%3A%2F%2Fblog.cyble.com%2F2022%2F03%2F31%2Fdeep-dive-analysis-borat-rat%2F&t=Deep+Dive+Analysis+%E2%80%93+Borat+RAT+%E2%80%94+Cyble&cts=1677225468658&vi=7e5c4e87904404589ae8d36f4af73079&nc=true&u=27441379.7e5c4e87904404589ae8d36f4af73079.1677225468383.1677225468383.1677225468383.1&b=27441379.1.1677225468383&cc=15
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Fri, 24 Feb 2023 07:57:48 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id
e8d575fd-95c2-4079-be32-1cec2576e22f
p3p
CP="NOI CUR ADM OUR NOR STA NID"
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
45
server
cloudflare
vary
origin, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=e%2FSUrZHAnE8kj5apboOfVnWE%2BrqvmnU2dod2fkVqSAv5tmzN7KCdFbzLztDSlR6GNTwxe1TfwPXiDD0qIoBgSKC5XSY125MRHCokNzVJZDjeRbyJ%2Bp8%2FkESZDOV4MNaQRiUSekkdgcdGnIHOgR3W"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
cache-control
no-cache, no-store, no-transform
access-control-allow-credentials
false
cf-ray
79e6a70b294139cd-FRA
x-robots-tag
none
recaptcha__de.js
www.gstatic.com/recaptcha/releases/Nh10qRQB5k2ucc5SCBLAQ4nA/ 		408 KB
163 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/recaptcha/releases/Nh10qRQB5k2ucc5SCBLAQ4nA/recaptcha__de.js
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/enterprise.js?render=explicit
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5a064c8f9ca44c02248a7e18e762f6ca616477ebc3b9e13a896fa4d6f74ef202
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://blog.cyble.com/
Origin
https://blog.cyble.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Fri, 24 Feb 2023 07:30:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
1619
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
166391
x-xss-protection
0
last-modified
Mon, 20 Feb 2023 05:03:28 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
vary
Accept-Encoding
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Sat, 24 Feb 2024 07:30:49 GMT
primeicons.ttf
injection.amibreached.com/assets/fonts/ Frame 8537 		56 KB
57 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://injection.amibreached.com/assets/fonts/primeicons.ttf
Requested by
Host: injection.amibreached.com
URL: https://injection.amibreached.com/css/272.8d8a39d8fa64efbb0671.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:c31 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c1e93246e1f3ea9a11fa1a6d7c14e48a1da911f92043e2e6ef59da5ffd38f070
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://injection.amibreached.com/css/272.8d8a39d8fa64efbb0671.css
Origin
https://blog.cyble.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Fri, 24 Feb 2023 07:57:49 GMT
strict-transport-security
max-age=15552000; includeSubDomains; preload
via
1.1 2bbba694ff55d664208103e9c25dce14.cloudfront.net (CloudFront)
cf-cache-status
REVALIDATED
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-content-type-options
nosniff
x-amz-cf-pop
FRA2-C1
x-cache
Hit from cloudfront
content-length
57384
last-modified
Mon, 23 May 2022 20:31:50 GMT
server
cloudflare
etag
"121254f73060bcbb53ca13258dbd134f"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
binary/octet-stream
access-control-allow-origin
https://blog.cyble.com
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Wl3ynUSAfk0l5kGSLmROc4f2IPotpfvYnTVPzn6lyf0EbTsJBc78hgJIr7wB5n6YkLTV4yySS4moSMAUZ0C74cTGUktk9w1rp85AR2nauDmfiiUuLzQO0ne1MHYw8ARMhnYkAtQB97MBNjs6%2FJQQ9ow9VFpyZOU%3D"}],"group":"cf-nel","max_age":604800}
access-control-expose-headers
x-amz-server-side-encryption, x-amz-request-id, x-amz-id-2, x-origin
cache-control
max-age=120
access-control-allow-credentials
true
access-control-max-age
3000
accept-ranges
bytes
cf-ray
79e6a70bd98b9119-FRA
x-amz-cf-id
skea_aYGA2YuvkVaDYaMIikncuxtxRK4PjXdBogjhMo3IRBLzQJfPg==
boom.gif
pixel.wp.com/ 		0
37 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.wp.com/boom.gif?bilmur=1&cumulative_layout_shift=0.029&largest_contentful_paint=3075&batcache_hit=0&provider=wordpress.com&service=atomic&effective_connection_type=4g&rtt=0&downlink=10000&host_name=blog.cyble.com&url_path=%2F2022%2F03%2F31%2Fdeep-dive-analysis-borat-rat%2F&nt_fetchStart=0&nt_domainLookupStart=1&nt_domainLookupEnd=18&nt_connectStart=18&nt_connectEnd=118&nt_secureConnectionStart=107&nt_requestStart=118&nt_responseStart=1934&nt_responseEnd=2028&nt_domLoading=1936&nt_domInteractive=2934&nt_domContentLoadedEventStart=2935&nt_domContentLoadedEventEnd=2959&nt_domComplete=4378&nt_loadEventStart=4378&nt_loadEventEnd=4407&nt_redirectCount=0&nt_nextHopProtocol=h2&nt_api_level=2&start_render=2711&first_contentful_paint=2711&resource_size=2684593&resource_transferred=594206&js_size=633052&js_transferred=190737&resource_cache_percent=0&js_cache_percent=0&last_resource_end=4779
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

access-control-allow-origin
*
date
Fri, 24 Feb 2023 07:57:50 GMT
cache-control
no-cache
server
nginx

Verdicts & Comments Add Verdict or Comment

167 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 boolean| credentialless object| _wpemojiSettings object| videopressAjax undefined| $ function| jQuery string| wsm_ajax object| cnArgs function| ajax_user_online function| gtag object| dataLayer object| _hsq object| _wsm string| adroll_adv_id string| adroll_pix_id string| adroll_version boolean| __adroll_loaded object| adroll object| hubspot object| HubSpotForms object| hbspt object| hsFormsOnReady object| artemis object| google_tag_manager function| __adroll__ string| adroll_sid object| google_tag_data string| GoogleAnalyticsObject function| ga object| __adroll function| __cmp function| __tcfapi boolean| adroll_sendrolling_cross_device object| adroll_form_fields function| adroll_tpc_callback function| handleFormStyles function| generateStyleVariables function| getBackgroundColor object| astra function| astraGetParents function| getParents function| astraToggleClass function| toggleClass function| astraTriggerEvent function| astraSmoothScroll function| astScrollToTopHandler function| popupTriggerClick function| AstraToggleSubMenu function| AstraToggleSetup function| astraNavMenuToggle object| leadin_wordpress object| astraAddon object| jetpackLazyImagesL10n object| jetpackSwiperLibraryPath object| jetpackCarouselStrings object| uael_posts_script function| display_mega_menu_on_load object| items function| apply_megamenu_width_styles object| runtime function| astraToggleSetupPro function| astraNavMenuTogglePro string| sticky_header_on_devices string| site_layout_box_width string| hook_sticky_footer string| sticky_footer_on_devices function| EvEmitter function| imagesLoaded function| jQueryBridget function| getSize function| matchesSelector object| fizzyUIUtils function| Outlayer function| Isotope function| Masonry function| addResizeListener function| removeResizeListener object| webpackChunkelementor_pro object| webpackChunkelementor object| elementorModules object| regeneratorRuntime function| setImmediate function| clearImmediate object| wp object| twemoji object| JSON_WSM number| width number| height object| clientInfo object| Wsm function| wsm_log object| _hsp function| sprintf function| vsprintf object| ElementorProFrontendConfig object| elementorProFrontend function| Waypoint object| uael_particles_script object| elementorFrontendConfig object| elementorFrontend object| scope_array number| backend function| Sticky object| _stq object| __adroll_consent_data object| gaplugins object| gaGlobal object| gaData function| st_go function| linktracker_init object| wpcom object| adroll_exp_list boolean| hubspot_live_messages_running object| HubSpotConversations boolean| PIXELS_RAN object| enabledEventSettings object| globalRoot undefined| hns function| bindToWindowOnError function| defineProperties object| leadflows function| OutpostErrorReporter function| _registerAvailablePopup object| _availablePopups boolean| popupPoliceActive undefined| hns2 undefined| jade undefined| I18n undefined| Pikaday undefined| reqwest undefined| exports undefined| define boolean| LEAD_FLOWS_RAN boolean| COMMON_SETUP_RAN object| __adroll_consent boolean| __adroll_consent_is_gdpr string| __adroll_consent_user_country string| __adroll_consent_adv_country object| __hsCollectedFormsDebug object| $jscomp string| BANNER_VERSION string| TCF_VERSION string| IABWRITE_NO_COOKIE object| __adroll_consent_banner object| __adroll_consent_prev_lastchild boolean| _hspb_loaded boolean| _hspb_ran object| _paq function| sanitizeKey boolean| _hstc_loaded function| ShareLink object| _linkedin_data_partner_ids function| lintrk boolean| _already_called_lintrk boolean| _hstc_ran string| __hsUserToken number| expireDateTime boolean| LEAD_FLOW_DOCUMENT_READY_RAN object| ___grecaptcha_cfg object| grecaptcha string| __recaptcha_api boolean| __google_recaptcha_client object| recaptcha

22 Cookies

Domain/Path Name / Value
blog.cyble.com/ Name: _wsm_id_1_abdf
Value: e8aaae1f3183cf5c.1677225467.1.1677225467.1677225467
blog.cyble.com/ Name: _wsm_ses_1_abdf
Value: *
.cyble.com/ Name: _gid
Value: GA1.2.856149022.1677225467
.cyble.com/ Name: _gat_gtag_UA_201575643_1
Value: 1
.cyble.com/ Name: _ga_4FJGSRPM4S
Value: GS1.1.1677225466.1.0.1677225466.0.0.0
.cyble.com/ Name: _ga
Value: GA1.1.1423516158.1677225467
blog.cyble.com/ Name: ln_or
Value: eyI0MDUzMzk2IjoiZCJ9
.hubspot.com/ Name: __cf_bm
Value: xI9rFnVjxMSz8bFOmI5QGJNIOVAepd6dYHa2a0ZwXZ0-1677225467-0-AdmOCsKbLYglWeCz8zHtBoA13owdljrm9jRCjz7e/1y49uBuqrsesi/d3BcS7k0vuUKuR/HHFXz2QSDtd0o+a5k=
.linkedin.com/ Name: UserMatchHistory
Value: AQIF88EpZWCRFAAAAYaCbZ9Iz6yElBcpHGw0We_iSgG8GmhHdnaIheJeO3cyjSabO8vLTXYrurQX-g
.linkedin.com/ Name: AnalyticsSyncHistory
Value: AQL0COL0xwgLFwAAAYaCbZ9Is_zExoUZkbZtDBbyrehkpZVbkdamGrRHllk5sMDW7YgeItiyZEzqhbjXauDjxQ
.linkedin.com/ Name: bcookie
Value: "v=2&c78190bb-ab95-4ce7-8a3d-3667284024ec"
.linkedin.com/ Name: lidc
Value: "b=TGST03:s=T:r=T:a=T:p=T:g=2925:u=1:x=1:i=1677225467:t=1677311867:v=2:sig=AQGpnbvyLGDsXYIPblz4V8VT7YhXcPr_"
.www.linkedin.com/ Name: bscookie
Value: "v=1&202302240757470ceb69e9-d222-406d-8144-d07cbd1acbfcAQE2AogBBrH-ZVAiL7YmBQ_u9nm-13RA"
.linkedin.com/ Name: li_gc
Value: MTswOzE2NzcyMjU0Njc7MjswMjEegBYoWmTgFU5KFpbW0BkeuoWP3f6epr9lmQG6sKtLZA==
.blog.cyble.com/ Name: messagesUtk
Value: 35592f98564a4b4f8db8d50c9ad21901
.labs.cyble.com/ Name: __cf_bm
Value: kSkeFvgxK5wE7sgo40C5OuJKpkq9tWRx2KH2ovkrNNc-1677225468-0-Ae+9YQeSJrtsopy15HzjeNaI5RfigLDv9HJaZmB+2YiiEdbem/toNrop/E4ANaHMYxdw7WRmWYJlUK+bWAJ8pCg=
.labs.cyble.com/ Name: __cfruid
Value: 3a1b4f7d4b069dcb7e8ac56481c9e3e1bc41df07-1677225468
.cyble.com/ Name: __hstc
Value: 27441379.7e5c4e87904404589ae8d36f4af73079.1677225468383.1677225468383.1677225468383.1
.cyble.com/ Name: hubspotutk
Value: 7e5c4e87904404589ae8d36f4af73079
.cyble.com/ Name: __hssrc
Value: 1
.cyble.com/ Name: __hssc
Value: 27441379.1.1677225468383
.nr-data.net/ Name: JSESSIONID
Value: 45f0ecc1836228a1

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.hubapi.com
api.hubspot.com
app.hubspot.com
bam-cell.nr-data.net
blog.cyble.com
cdn.linkedin.oribi.io
d.adroll.com
fonts-api.wp.com
fonts.wp.com
forms-na1.hsforms.com
forms.hsforms.com
forms.hubspot.com
i0.wp.com
injection.amibreached.com
js-agent.newrelic.com
js.hs-analytics.net
js.hs-banner.com
js.hs-scripts.com
js.hsadspixel.net
js.hscollectedforms.net
js.hsforms.net
js.hsleadflows.net
js.usemessages.com
labs.cyble.com
pixel.wp.com
px.ads.linkedin.com
px4.ads.linkedin.com
region1.google-analytics.com
s.adroll.com
s0.wp.com
snap.licdn.com
static.hsappstatic.net
stats.g.doubleclick.net
stats.wp.com
track.hubspot.com
www.google-analytics.com
www.google.com
www.googletagmanager.com
www.gstatic.com
www.linkedin.com
13.107.42.14
151.101.66.137
162.247.241.2
192.0.76.3
192.0.77.2
192.0.77.32
192.0.78.213
2001:4860:4802:32::36
2600:9000:20eb:1000:2:53b2:240:93a1
2600:9000:20eb:f200:6:9280:1080:93a1
2606:2c40::c73c:671e
2606:4700:20::681a:c31
2606:4700:4400::ac40:9a55
2606:4700::6810:5605
2606:4700::6810:5805
2606:4700::6811:47b0
2606:4700::6811:73b0
2606:4700::6811:7d2
2606:4700::6811:7fab
2606:4700::6811:b949
2606:4700::6811:c8cc
2606:4700::6811:d5cc
2606:4700::6811:e7cc
2606:4700::6811:eecc
2606:4700::6813:9b53
2620:1ec:22::14
2a00:1450:4001:80f::2003
2a00:1450:4001:812::200e
2a00:1450:4001:813::2008
2a00:1450:4001:82a::2004
2a00:1450:400c:c0c::9b
2a02:26f0:3500:16::215:149b
2a05:d018:cc3:fe05:8e03:6849:2fd5:b7a8
00585b51d2e93e6d4c40e66779584602f9943952c189b02e53bc3ea1355b5e7f
008651e9dd70e90c5fd8e3951f209a3306e02daa2b9a2701c0db0162a9629c3b
00bc02698b9ebaa0d592d285bb9a3f1b3a85f93fa5d9c696d0787f2f4ce07df9
00e2f93c1204e4b91261e71d2100e678888a67ba2579d404caa472516d117ac7
05096f7a0e9de1566ba03be810da6d252f233a7c999021d5f2f3aa975e92ab0f
0b4f1badfe13e54558ffcff6ffc1934ebf3a048d12321f574c3e4cb80ba862bb
0c3116c717c15f7308971a14f3e0dfe7a4e3fd357ec044b2eae10361d76b9279
0c9cf152a0ad00d4f102c93c613c104914be5517ac8f8e0831727f8bfbe8b300
0f12c37bfbe94e5c37d4c4a0ab301f496683db922639b0e43f2b9977492fe57b
138154c0deed3326477b9b4909175101070a5a3a95342291b53d8cc9879a5f47
167366195a9618f21c99e0f802cea0734226d4a602743f68929830963bfff08f
186cb05caa2a06748336b3123d7ac53986a650cffcab18f34e5c0ee3c057f591
1995d935c3a3de4ce9fe397f5a5e0384fc241d4b96672c9370507b8a40f07f1c
1e6ebf687f918671709224ad3047910b592542de487e4a38209f42d58b0062a5
1ebc29b1b1236540315d066cde79707059f371d75f34d274a28bbf90fc5e4620
2449ac1a9451021a441c818e5eaed77a5e880504ad0815c40f0f19ab84ca6cfa
281e04a59706f68917361c14a5f10af0547fdf83d88b2f72c9096f3b2547494d
29d409fee0f34ebc05fa36076c101b77e28dccbcfdbfbf4cf248371820ca9ddb
2e1e46a5845c7b902ee470f94c6e9e3b3f16169f9592e98575ae0b907c4dcac2
34bbd1c367ffc7d80fcff86c7e5f8777e70f4911bb324e8ecfc7dd3604a96e68
359c32724ded3d649d66332ac70da65306ff8c45ff08f9d0e253ae1fd175e109
36b42aceb12f34135ce39544c6b143dbdd5690ee9a8809c49a3a37ba014bd200
382e9768b5578d5ad05e51e37670a3cf93d4593a49bcbee1f5e8b66d0d8c1c53
3a97df184952701ca99e998fc63f05cc6182b2810e8dd15f7ea57012c11cb3a1
40fa423c0a2005cdbcc227e2f80036430c2a57c240691735c2be49fa6a73a00a
420c5ecbca4fceed2f5134103a51095cbc1fff7fc1b6d7e3bb220f1b7481664d
43c072c16c9ee6d67acdfa6c6d6685ff1e74eb4237b7cc3c1348ab1c108b26af
49c8a7c10278c65517da8ce7b7f1776f72550c01169b00d2e99f95866d423d20
51dc1ea3b9642d966bbdf2c63346e4d2d3f668a693fa8e7f1e31bf6acbe48860
51fa19c42421ef063ab8805822ef9dace56a4fd415343d118e455710679df1e2
545156adeae44dadc82b98d504f805ebe77fb79c928ef34eed1057bb9d4cb8fe
552da695674e5ff5a53e685eac5440a231023675c5098e54c1516e73ec99f35a
5891c67601020cabaf90ed5ddda027b085f57af3ab6c669cdeadd85ddd1f62a8
5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de
5a064c8f9ca44c02248a7e18e762f6ca616477ebc3b9e13a896fa4d6f74ef202
5aad5fbd4238981a9ff5e2772ff1353dfe1a801fb49542fe157418c1438f7782
64dd2add3eaca027b742a358076888171c1bd514090122491f8070abc33a01bd
660d01dcbd26f28ab61d6b59dd61778a214cc791669d32159de4895284d3b273
691fa7d17effc7d303eda0ad7e4a1d91b2f375506cfc8a774480cc2b55f156ea
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
71df9a91f89add02cba236b426b0dd7610a062d5e43a3c86a25a117a53cdf2cc
7423b7bf0cf4294d4716ebd117701e2808fdaf5bffe46d6d3afa50d3359f537d
783cf6a898e6f349f7271e29af3f38e72b106e3b4a14fcb2851130c697080113
7883c3cfb3f71df2ec3c0574dd83d0b6849a12248b6b9142ea99752636310a47
7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89
7d90b453482d4b820a70f83b54185e4a728b673b3697ec8a16a56bd0490beee4
81ca0d70f50ab00f0c1e0933c11bf7bb6aada2366994784564f4d324dfd7a60c
82d0aae1e7b8cfc0574d6548d1f35096f5e4310321aa964ff3fdb46c4d12e302
82dbeea789c21359a9d808969f52d40a37ac85078a6cd1cbee0e702314c46997
84161c46238fff2c6920ebc28f02cddd7b710cf3d1107853f540b084320f6afd
8778e9af2422858d7052ff9a0f3c12c08ae976bdd6e0316db144cd5579cd97db
88f35c5a0bc3765e6c46152a4312f977886f1535ba7b7d6c96089318bc632b3e
8bfc26c55329ff2191cc630cd6fedbcc742a0161222529327970449e0ce2e6f6
90b705145ef82e9d8493aae55c9bfb3200ec0620c8946b20b0b28366557d6a4a
91144fbcc0e3f609b021e362ec29d2a9b58f15e840f229eb99ea2c04d927882b
963563d75d17a3c2b444ad4d73e3e9c24a43f6f9e121cce484aa6c7d197af73c
979338f4aa8d1de1b994be15531b85f1d9deef4d8da685bf18286d9928488520
984d8a00a23b717ad2d084139b7a0880fb888e7c9030a11f5e3bfde3670ffa68
9af44543fbf7b09c3d68e46dcb21d2cb9ec5f18bbd537cea92360a85c5db793e
9cbfded9ac9d2c7859171766e11fd1b8feb6301984b505af951e4fbe3d443347
9d904f71a4d973dac278821490969eb0a63dd97635584930bbbbec0a3e608d75
a2c197367cb631f88fca96c13ec0c06d0a99bc5398d0349716bc06ce7a91e8ce
a6b6fd7e46c0b439dcf078fe31628308ade96a05054cd20d60a88130238275b6
a819a519974256c873c03c3b41adcf1d818df9456f18d6bdf939904d6163bd63
a9c399a3695f864f52665163ff94626e3b77b44747e1519b03e5f82597b004d7
aae2185bf9e0f1dc5a8f35de66bb1cb30b3e5ed3d726cb4077aaff72a2547f9e
b280d9e9449293cacef8128e089d9ae4210bc40a70c78925e58a1bc816de14f2
ba0cbf950ff5a982de86b935614ed251f12f9813346b8c7191ee2673f7daca09
bbdb1d21246d1c1a65aca8b41818f593b2d4704a459983866c0d331151b91887
bcaf0e3f087296133e0a996ee3d289a8d1a690147c93e0ab62019b505e6f9355
c1e93246e1f3ea9a11fa1a6d7c14e48a1da911f92043e2e6ef59da5ffd38f070
c27a8d0abc42f5fcd3a4ad9480ca7bd1bbe1fcb23d5438b4420f1cbcab3ecc9f
c3d1a4eaec7041443d470897f3c75fe3de2534377fc82e1b6ca27082af5da8ce
c77d2ba289d0e2827ad7f79b00972a63c7f4426d89b8ce6b5da90a368760cfe4
c7d0240fd43289ab1411c5fa1277574ee436d3a3bbb82d34c4d82f32d04517b8
cc7403bab52ed166e24ea9324241045af370be482f5b594468f4a6ac6e7e7981
d0b4256abed72481585662971262eabee345c19f837af00d7ce24239d3b40eef
d55a5fdb0b754e2814219eabcefeaf7350bbc8890c28f9d1a8a62228bb92e52b
dac715f087720dd7ff7067f5d2ec1988851fa93140ae8a9cbfaa15659dd7fd82
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ecc9d5746610402c20ff241fa49535259e7851199832f97f340b1410efe7243f
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef896b86a77ae191af41c2714906decbab4bbb7fd32321c14f4f398eb7f264ba
efcc7b4245ed6c18ad0297df0cbe908c617d6b14be42f8628a762393d493bacd
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
f4d6de4b24d947574c1fadd157febab5fe454eb3498b620dcf2dbcb304ef36a1
f56ccb2db87aacedd9415232e40f80bff9939703df2f9c3f9ec8a092e545349f
f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52
f9dec2536b45036a83edfa39f851d090deb7887b6999d696b50810f4369d962a
fa28de0db846c10133053b2afac2c078ac3655d4cb66d5d7e46eba419e5a6566