blog.sucuri.net Open in urlscan Pro
2a02:fe80:1010::5 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://blog.sucuri.net/2023/04/balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html
Submission: On April 10 via api (April 10th 2023, 2:10:58 am UTC) from TR — Scanned from DE

Summary HTTP 68 Redirects Links 64 Behaviour Indicators

Summary

This website contacted 29 IPs in 3 countries across 26 domains to perform 68 HTTP transactions. The main IP is 2a02:fe80:1010::5, located in United States and belongs to SUCURI-SEC, US. The main domain is blog.sucuri.net.
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on September 5th 2022. Valid for: a year.

This is the only time blog.sucuri.net was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
27	2a02:fe80:101... 2a02:fe80:1010::5	30148 (SUCURI-SEC) (SUCURI-SEC)
1	2a00:1450:400... 2a00:1450:4001:828::200a	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:80b::200e	15169 (GOOGLE) (GOOGLE)
1	35.186.249.72 35.186.249.72	15169 (GOOGLE) (GOOGLE)
2	2600:9000:223... 2600:9000:223e:6000:7:2bfb:7c00:93a1	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:813::2003	15169 (GOOGLE) (GOOGLE)
1	35.186.240.205 35.186.240.205	15169 (GOOGLE) (GOOGLE)
1	2600:1901:0:b... 2600:1901:0:bc29::	15169 (GOOGLE) (GOOGLE)
1	192.229.233.34 192.229.233.34	15133 (EDGECAST) (EDGECAST)
2	2a00:1450:400... 2a00:1450:4001:82f::2008	15169 (GOOGLE) (GOOGLE)
1	2a02:26f0:780... 2a02:26f0:780::5f65:3669	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2606:4700::68... 2606:4700::6812:863b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	146.75.116.157 146.75.116.157	54113 (FASTLY) (FASTLY)
3	2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1 1	2a00:1450:400... 2a00:1450:4001:802::2002	15169 (GOOGLE) (GOOGLE)
1 3	2a00:1450:400... 2a00:1450:4001:812::2004	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:82b::2003	15169 (GOOGLE) (GOOGLE)
1	2600:9000:20e... 2600:9000:20eb:9000:2:53b2:240:93a1	16509 (AMAZON-02) (AMAZON-02)
3 3	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	2a00:1450:400... 2a00:1450:400c:c0c::9b	15169 (GOOGLE) (GOOGLE)
1	104.244.42.197 104.244.42.197	13414 (TWITTER) (TWITTER)
1	104.244.42.67 104.244.42.67	13414 (TWITTER) (TWITTER)
1		() ()
1	2606:4700::68... 2606:4700::6812:18c4	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6810:8ace	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a03:2880:f11... 2a03:2880:f11c:8183:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	2001:4860:480... 2001:4860:4802:32::36	15169 (GOOGLE) (GOOGLE)
1	34.95.127.121 34.95.127.121	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	2606:4700::68... 2606:4700::6813:9b53	13335 (CLOUDFLAR...) (CLOUDFLARENET)
68	29

27 2a02:fe80:1010::5 (United States)

ASN30148 (SUCURI-SEC, US)

blog.sucuri.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:828::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:80b::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.186.249.72 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 72.249.186.35.bc.googleusercontent.com

d.impactradius-event.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:223e:6000:7:2bfb:7c00:93a1 (United States)

ASN16509 (AMAZON-02, US)

tags.tiqcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:813::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.186.240.205 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 205.240.186.35.bc.googleusercontent.com

sucuri.7eer.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1901:0:bc29:: (Kansas City, United States)

ASN15169 (GOOGLE, US)

cdn.mxpnl.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.229.233.34 (Granada Hills, United States)

ASN15133 (EDGECAST, US)

static.olark.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82f::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:780::5f65:3669 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6812:863b (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-scripts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
js-na1.hs-scripts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 146.75.116.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a03:2880:f01c:8012:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:802::2002 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:812::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:82b::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:20eb:9000:2:53b2:240:93a1 (United States)

ASN16509 (AMAZON-02, US)

cdn.linkedin.oribi.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:21::14 (United States) 3 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400c:c0c::9b (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.197 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.67 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 (None, )

ASN- ()

blog.sucuri.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:18c4 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-banner.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:8ace (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-analytics.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f11c:8183:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)

region1.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.95.127.121 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 121.127.95.34.bc.googleusercontent.com

www.ojrq.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6813:9b53 (United States)

ASN13335 (CLOUDFLARENET, US)

track.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
28	sucuri.net blog.sucuri.net	1 MB
5	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 35 region1.google-analytics.com — Cisco Umbrella Rank: 2284	67 KB
4	linkedin.com 3 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 400 www.linkedin.com — Cisco Umbrella Rank: 579 px4.ads.linkedin.com — Cisco Umbrella Rank: 6196	3 KB
3	google.de www.google.de — Cisco Umbrella Rank: 5216	669 B
3	google.com 1 redirects www.google.com — Cisco Umbrella Rank: 2	731 B
3	doubleclick.net 1 redirects googleads.g.doubleclick.net — Cisco Umbrella Rank: 41 stats.g.doubleclick.net — Cisco Umbrella Rank: 100	1011 B
3	facebook.net connect.facebook.net — Cisco Umbrella Rank: 161	157 KB
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 109	257 B
2	hs-scripts.com js.hs-scripts.com — Cisco Umbrella Rank: 2501 js-na1.hs-scripts.com — Cisco Umbrella Rank: 9060	1 KB
2	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 62	122 KB
2	gstatic.com fonts.gstatic.com	62 KB
2	tiqcdn.com tags.tiqcdn.com — Cisco Umbrella Rank: 1143	34 KB
1	hubspot.com track.hubspot.com — Cisco Umbrella Rank: 2507	891 B
1	ojrq.net www.ojrq.net — Cisco Umbrella Rank: 5595	448 B
1	hs-analytics.net js.hs-analytics.net — Cisco Umbrella Rank: 2380	20 KB
1	hs-banner.com js.hs-banner.com — Cisco Umbrella Rank: 2390	16 KB
1	twitter.com analytics.twitter.com — Cisco Umbrella Rank: 687	394 B
1	t.co t.co — Cisco Umbrella Rank: 525	376 B
1	oribi.io cdn.linkedin.oribi.io — Cisco Umbrella Rank: 1000	374 B
1	ads-twitter.com static.ads-twitter.com — Cisco Umbrella Rank: 701	15 KB
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 853	5 KB
1	olark.com static.olark.com — Cisco Umbrella Rank: 14505	3 KB
1	mxpnl.com cdn.mxpnl.com — Cisco Umbrella Rank: 4332	18 KB
1	7eer.net sucuri.7eer.net	668 B
1	impactradius-event.com d.impactradius-event.com — Cisco Umbrella Rank: 3358	13 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 47	1 KB
68	26

	Domain	Requested by
28	blog.sucuri.net	blog.sucuri.net static.olark.com
4	www.google-analytics.com	blog.sucuri.net www.google-analytics.com
3	www.google.de	blog.sucuri.net
3	www.google.com	1 redirects blog.sucuri.net
3	connect.facebook.net	tags.tiqcdn.com connect.facebook.net
2	www.facebook.com	blog.sucuri.net
2	stats.g.doubleclick.net	www.google-analytics.com
2	px.ads.linkedin.com	2 redirects
2	www.googletagmanager.com	tags.tiqcdn.com www.googletagmanager.com
2	fonts.gstatic.com	fonts.googleapis.com
2	tags.tiqcdn.com	blog.sucuri.net tags.tiqcdn.com
1	track.hubspot.com
1	js-na1.hs-scripts.com	js.hs-analytics.net
1	www.ojrq.net
1	region1.google-analytics.com	www.googletagmanager.com
1	js.hs-analytics.net	js.hs-scripts.com
1	js.hs-banner.com	js.hs-scripts.com
1	analytics.twitter.com	blog.sucuri.net
1	t.co	blog.sucuri.net
1	px4.ads.linkedin.com	blog.sucuri.net
1	www.linkedin.com	1 redirects
1	cdn.linkedin.oribi.io	snap.licdn.com
1	googleads.g.doubleclick.net	1 redirects
1	static.ads-twitter.com	tags.tiqcdn.com
1	js.hs-scripts.com	tags.tiqcdn.com
1	snap.licdn.com	tags.tiqcdn.com
1	static.olark.com	blog.sucuri.net
1	cdn.mxpnl.com	tags.tiqcdn.com
1	sucuri.7eer.net	d.impactradius-event.com
1	d.impactradius-event.com	blog.sucuri.net
1	fonts.googleapis.com	blog.sucuri.net
68	31

This site contains links to these domains. Also see Links.

Domain
sucuri.net
sitecheck.sucuri.net
dashboard.sucuri.net
www.facebook.com
twitter.com
news.drweb.com
vms.drweb.com
www.virustotal.com
urlscan.io
publicwww.com
lifeinhex.com
developer.wordpress.org
www.linkedin.com
www.youtube.com
www.instagram.com
sucuri.hs-sites.com
kb.sucuri.net
labs.sucuri.net

Subject Issuer	Validity	Valid
*.sucuri.net Go Daddy Secure Certificate Authority - G2	`2022-09-05` - `2023-10-07`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2023-03-20` - `2023-06-12`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-03-20` - `2023-06-12`	3 months	crt.sh
*.impactradius-event.com Sectigo RSA Domain Validation Secure Server CA	`2022-12-07` - `2024-01-06`	a year	crt.sh
tags.tiqcdn.com Amazon RSA 2048 M02	`2023-03-01` - `2023-06-16`	4 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-03-20` - `2023-06-12`	3 months	crt.sh
*.7eer.net Sectigo RSA Domain Validation Secure Server CA	`2022-12-09` - `2024-01-07`	a year	crt.sh
*.mxpnl.com GeoTrust Global TLS RSA4096 SHA256 2022 CA1	`2022-07-11` - `2023-07-28`	a year	crt.sh
static.olark.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-03-17` - `2024-04-16`	a year	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2023-02-01` - `2024-01-31`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-06-03` - `2023-06-02`	a year	crt.sh
ads-twitter.com DigiCert TLS RSA SHA256 2020 CA1	`2022-07-22` - `2023-08-22`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2023-01-17` - `2023-04-17`	3 months	crt.sh
linkedin.oribi.io Amazon RSA 2048 M01	`2023-02-24` - `2023-08-06`	5 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-03-20` - `2023-06-12`	3 months	crt.sh
t.co DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2023-02-05` - `2024-02-05`	a year	crt.sh
*.twitter.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2023-02-05` - `2024-02-05`	a year	crt.sh
www.google.com GTS CA 1C3	`2023-03-20` - `2023-06-12`	3 months	crt.sh
www.google.de GTS CA 1C3	`2023-03-20` - `2023-06-12`	3 months	crt.sh
*.ojrq.net Sectigo RSA Domain Validation Secure Server CA	`2022-12-09` - `2024-01-07`	a year	crt.sh
hubspot.com Cloudflare Inc ECC CA-3	`2023-02-05` - `2024-02-05`	a year	crt.sh

This page contains 4 frames:

Primary Page: https://blog.sucuri.net/2023/04/balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html
Frame ID: 3417A62F664FE17F7ACF6A103F4400AB
Requests: 67 HTTP requests in this frame

Frame: https://static.olark.com/jsclient/loader0.js
Frame ID: EA0B4CE535885A2D5C87E18E45CC32CC
Requests: 1 HTTP requests in this frame

Frame: blob://https://blog.sucuri.net/7ecaf39b-e62c-4202-a874-4e56d0f2bef0
Frame ID: 2515364A0D8C32FB379EC838A1E0F181
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 27472C67C6A06FB3FA231935AEB4ED10
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Balada Injector: Synopsis of a Massive Ongoing WordPress Malware Campaign

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

HubSpot Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

js\.hs-analytics\.net/analytics

Impact (Affiliate programs) Expand

Overall confidence: 100%
Detected patterns

d\.impactradius-event\.com

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Select2 (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

select2(?:\.min|\.full)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

68
Requests

97 %
HTTPS

70 %
IPv6

26
Domains

31
Subdomains

29
IPs

3
Countries

1822 kB
Transfer

3194 kB
Size

30
Cookies

64 Outgoing links

These are links going to different origins than the main page.

URL: https://sucuri.net/website-antivirus/signup
Title: Products

Search URL Search Domain Scan URL

URL: https://sucuri.net/website-security-platform/signup/
Title: Website Security Platform

Search URL Search Domain Scan URL

URL: https://sucuri.net/website-firewall/
Title: Website Firewall (WAF)

Search URL Search Domain Scan URL

URL: https://sucuri.net/custom/enterprise/
Title: Enterprise Website Security

Search URL Search Domain Scan URL

URL: https://sucuri.net/custom/agency/
Title: Multisite Solutions

Search URL Search Domain Scan URL

URL: https://sucuri.net/website-security-platform/
Title: Features

Search URL Search Domain Scan URL

URL: https://sucuri.net/malware-detection-scanning/
Title: Detection

Search URL Search Domain Scan URL

URL: https://sucuri.net/website-hack-protection/
Title: Protection

Search URL Search Domain Scan URL

URL: https://sucuri.net/website-performance/
Title: Performance

Search URL Search Domain Scan URL

URL: https://sucuri.net/website-malware-removal/
Title: Response

Search URL Search Domain Scan URL

URL: https://sucuri.net/website-backups/
Title: Backups

Search URL Search Domain Scan URL

URL: https://sucuri.net/partners/
Title: Partners

Search URL Search Domain Scan URL

URL: https://sucuri.net/referral/
Title: Referral Program

Search URL Search Domain Scan URL

URL: https://sucuri.net/ecommerce-website-security/
Title: Ecommerce

Search URL Search Domain Scan URL

URL: https://sucuri.net/guides/
Title: Resources

Search URL Search Domain Scan URL

URL: https://sucuri.net/webinars/
Title: Webinars

Search URL Search Domain Scan URL

URL: https://sucuri.net/infographics/
Title: Infographics

Search URL Search Domain Scan URL

URL: https://sitecheck.sucuri.net/
Title: SiteCheck

Search URL Search Domain Scan URL

URL: https://sucuri.net/reports/
Title: Reports

Search URL Search Domain Scan URL

URL: https://sucuri.net/email-courses/
Title: Email Courses

Search URL Search Domain Scan URL

URL: https://sucuri.net/website-security-platform/help-now
Title: Immediate Help

Search URL Search Domain Scan URL

URL: https://dashboard.sucuri.net/login/
Title: Login

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer.php?u=https%3A%2F%2Fblog.sucuri.net%2F2023%2F04%2Fbalada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html
Title: Facebook

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?text=Balada%20Injector%3A%20Synopsis%20of%20a%20Massive%20Ongoing%20WordPress%20Malware%20Campaign&url=https://blog.sucuri.net/2023/04/balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html&via=sucurisecurity
Title: Twitter

Search URL Search Domain Scan URL

URL: https://sucuri.net/reports/2022-hacked-website-report/
Title: website threat report.

Search URL Search Domain Scan URL

URL: https://news.drweb.com/show/?i=14646&lng=en&c=23
Title: Linux backdoor malware infects WordPress-based websites

Search URL Search Domain Scan URL

URL: https://vms.drweb.com/virus/?i=25604695
Title: Linux.BackDoor.WordPressExploit.1

Search URL Search Domain Scan URL

URL: https://vms.drweb.com/virus/?i=25604745
Title: Linux.BackDoor.WordPressExploit.2

Search URL Search Domain Scan URL

URL: https://www.virustotal.com/gui/collection/b6a9a5788171c4fdfaf318c5d1462c98ab77f47624d47ecde6b4c8c7fdb47c68
Title: this

Search URL Search Domain Scan URL

URL: https://urlscan.io/responses/416b3163860c4f2aa7fc6114832482d42311b1ee581af1c05fb3eef1bfb0cb5c/
Title: URLScan.io cache

Search URL Search Domain Scan URL

URL: https://publicwww.com/websites/%22timthumb.php%22/
Title: over 70,000 sites

Search URL Search Domain Scan URL

URL: https://lifeinhex.com/stealing-wordpress-credentials/
Title: looked like back in 2020

Search URL Search Domain Scan URL

URL: https://developer.wordpress.org/apis/wp-config-php/#wordpress-upgrade-constants
Title: FTP

Search URL Search Domain Scan URL

URL: https://developer.wordpress.org/rest-api/reference/users/#list-users
Title: WordPress own APIs

Search URL Search Domain Scan URL

URL: https://www.virustotal.com/gui/ip-address/45.9.148.48/relations
Title: 45.9.148 .48

Search URL Search Domain Scan URL

URL: https://sucuri.net/guides/how-to-clean-hacked-wordpress/
Title: WordPress malware cleanup guides

Search URL Search Domain Scan URL

URL: https://sucuri.net/guides/website-security/
Title: website security guide

Search URL Search Domain Scan URL

URL: https://twitter.com/unmaskparasites
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.facebook.com/SucuriSecurity
Title: Facebook

Search URL Search Domain Scan URL

URL: https://twitter.com/sucurisecurity
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/sucuri-security
Title: LinkedIn

Search URL Search Domain Scan URL

URL: https://www.youtube.com/c/sucurinet
Title: YouTube

Search URL Search Domain Scan URL

URL: https://www.instagram.com/sucurisecurity/
Title: Instagram

Search URL Search Domain Scan URL

URL: http://sucuri.hs-sites.com/subscribe-to-security?__hstc=166519265.a6d108bfaa74734599049cd82d103cc2.1681092652258.1681092652258.1681092652258.1&__hssc=166519265.1.1681092652258&__hsfp=3897811554

Search URL Search Domain Scan URL

URL: https://sucuri.net/website-antivirus/
Title: Website AntiVirus

Search URL Search Domain Scan URL

URL: https://sucuri.net/wordpress-security/
Title: WordPress Security

Search URL Search Domain Scan URL

URL: https://sucuri.net/website-firewall/ddos-protection
Title: DDos Protection

Search URL Search Domain Scan URL

URL: https://sucuri.net/website-antivirus/malware-scanning-and-detection
Title: Malware Detection

Search URL Search Domain Scan URL

URL: https://sucuri.net/website-antivirus/malware-removal
Title: Malware Removal

Search URL Search Domain Scan URL

URL: https://sucuri.net/website-firewall/stop-website-attacks-and-hacks
Title: Malware Prevention

Search URL Search Domain Scan URL

URL: https://sucuri.net/website-antivirus/blacklist-removal-and-repair
Title: Blacklist Removal

Search URL Search Domain Scan URL

URL: https://kb.sucuri.net/
Title: Knowledge Base

Search URL Search Domain Scan URL

URL: http://labs.sucuri.net/
Title: Research Labs

Search URL Search Domain Scan URL

URL: https://sucuri.net/faq/
Title: FAQ

Search URL Search Domain Scan URL

URL: https://sucuri.net/company/
Title: About

Search URL Search Domain Scan URL

URL: https://sucuri.net/company/media
Title: Media

Search URL Search Domain Scan URL

URL: https://sucuri.net/company/events
Title: Events

Search URL Search Domain Scan URL

URL: https://sucuri.net/company/employment/
Title: Employment

Search URL Search Domain Scan URL

URL: https://sucuri.net/company/contact-us
Title: Contact

Search URL Search Domain Scan URL

URL: https://sucuri.net/customers/
Title: Testimonials

Search URL Search Domain Scan URL

URL: https://sucuri.net/
Title: Sucuri Home

Search URL Search Domain Scan URL

URL: https://sucuri.net/terms
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://sucuri.net/privacy
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://sucuri.net/cookies
Title: See our policy>>

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 44

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1040458670/?value=1.00&currency_code=USD&label=ZMfLCJ7ZoGgQrseQ8AM&guid=ON&script=0 HTTP 302
https://www.google.com/pagead/1p-user-list/1040458670/?value=1.00&currency_code=USD&label=ZMfLCJ7ZoGgQrseQ8AM&guid=ON&script=0&is_vtc=1&random=161949598 HTTP 302
https://www.google.de/pagead/1p-user-list/1040458670/?value=1.00&currency_code=USD&label=ZMfLCJ7ZoGgQrseQ8AM&guid=ON&script=0&is_vtc=1&random=161949598&ipr=y

Request Chain 46

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=179713&time=1681092651582&url=https%3A%2F%2Fblog.sucuri.net%2F2023%2F04%2Fbalada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D179713%26time%3D1681092651582%26url%3Dhttps%253A%252F%252Fblog.sucuri.net%252F2023%252F04%252Fbalada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=179713&time=1681092651582&url=https%3A%2F%2Fblog.sucuri.net%2F2023%2F04%2Fbalada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html&liSync=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=179713&time=1681092651582&url=https%3A%2F%2Fblog.sucuri.net%2F2023%2F04%2Fbalada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html&liSync=true&e_ipv6=AQLby2j2-DV_CgAAAYdo7ivfS3UBrebpmlUM-yGpndzRDx92mpS4GPIAwmPwdcR1nNGjY15x

68 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html Show response
blog.sucuri.net/2023/04/ 114 KB
35 KB 32ms
7ms Document
text/html 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.sucuri.net/2023/04/balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

a54f6c14c893db230689abea6ee219bceef13371ab6938d5725c93ad02a4b3b4

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: max-age=600
content-encoding: gzip
content-security-policy: upgrade-insecure-requests;
content-type: text/html; charset=UTF-8
date: Mon, 10 Apr 2023 02:10:50 GMT
link: <https://blog.sucuri.net/wp-json/>; rel="https://api.w.org/" <https://blog.sucuri.net/wp-json/wp/v2/posts/31057>; rel="alternate"; type="application/json" <https://blog.sucuri.net/?p=31057>; rel=shortlink
server: nginx
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-gateway-cache-key: 1680809148.801|standard|https|blog.sucuri.net|||/2023/04/balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html
x-gateway-cache-status: HIT
x-gateway-request-id: 89cd7f35cc13ba3cc7d941b2aa014845
x-gateway-skip-cache: 0
x-sucuri-cache: HIT
x-sucuri-id: 15005
x-xss-protection: 1; mode=block

GET
H2 200 style.css
blog.sucuri.net/wp-content/themes/sucuriblog0117/ 72 KB
29 KB 12ms
8ms Stylesheet
text/css 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.sucuri.net/wp-content/themes/sucuriblog0117/style.css?ver=1.2.0

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2023/04/balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

442ea9791bad77a328e1a07c59784d92e10bac3f612ba9b00afba5c7518acc6b

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/2023/04/balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Mon, 10 Apr 2023 02:10:50 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests;
content-encoding: gzip
x-sucuri-cache: HIT
x-xss-protection: 1; mode=block
x-gateway-cache-status: HIT
x-gateway-request-id: 17752ecf8f6edcef5e4fa7fd42961830
last-modified: Tue, 06 Sep 2022 21:58:33 GMT
server: nginx
etag: W/"6317c289-120da"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
x-gateway-cache-key: 1668728459.439||https|blog.sucuri.net|||/wp-content/themes/sucuriblog0117/style.css?ver=1.2.0
x-gateway-skip-cache: 0
cache-control: max-age=315360000
x-sucuri-id: 15005
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 style.min.css
blog.sucuri.net/wp-includes/css/dist/block-library/ 93 KB
16 KB 13ms
9ms Stylesheet
text/css 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.sucuri.net/wp-includes/css/dist/block-library/style.min.css?ver=6.1.1

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2023/04/balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

c324ef26b20264369e4568dc9ef1c5cb1f325f6bc4e8b7c01f7fe93fa353276a

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/2023/04/balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Mon, 10 Apr 2023 02:10:50 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests;
content-encoding: gzip
x-sucuri-cache: HIT
x-xss-protection: 1; mode=block
x-gateway-cache-status: HIT
x-gateway-request-id: ede62aa6572f02f29f12e69eec8282f5
last-modified: Tue, 15 Nov 2022 21:14:51 GMT
server: nginx
etag: W/"6374014b-172a9"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
x-gateway-cache-key: 1668728459.439||https|blog.sucuri.net|||/wp-includes/css/dist/block-library/style.min.css?ver=6.1.1
x-gateway-skip-cache: 0
cache-control: max-age=315360000
x-sucuri-id: 15005
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 classic-themes.min.css
blog.sucuri.net/wp-includes/css/ 217 B
725 B 17ms
13ms Stylesheet
text/css 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.sucuri.net/wp-includes/css/classic-themes.min.css?ver=1

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2023/04/balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

5a5f39391fbf5b06db84b8f9716d53de575ee97a627d2c5f12f79a991a671eb5

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/2023/04/balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Mon, 10 Apr 2023 02:10:50 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests;
content-encoding: gzip
x-sucuri-cache: HIT
x-xss-protection: 1; mode=block
x-gateway-cache-status: HIT
x-gateway-request-id: da06ee3298799fe88399d6ab01b6bead
last-modified: Tue, 15 Nov 2022 21:14:51 GMT
server: nginx
etag: W/"6374014b-d9"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
x-gateway-cache-key: 1668728459.439||https|blog.sucuri.net|||/wp-includes/css/classic-themes.min.css?ver=1
x-gateway-skip-cache: 0
cache-control: max-age=315360000
x-sucuri-id: 15005
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 select2.min.css
blog.sucuri.net/wp-content/plugins/facetwp-select2/select2/ 15 KB
3 KB 17ms
13ms Stylesheet
text/css 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.sucuri.net/wp-content/plugins/facetwp-select2/select2/select2.min.css?ver=4.0.1

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2023/04/balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

ed026fedc8b8130aecd7be55e134a42efcaa8e90a5f2f8ec88aa9a1a5ab934ec

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/2023/04/balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Mon, 10 Apr 2023 02:10:50 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests;
content-encoding: gzip
x-sucuri-cache: HIT
x-xss-protection: 1; mode=block
x-gateway-cache-status: HIT
x-gateway-request-id: d5a242294cdff05aa49b6342616087f3
last-modified: Tue, 12 Jul 2016 17:48:32 GMT
server: nginx
etag: W/"57852d70-3af2"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
x-gateway-cache-key: 1668728459.439||https|blog.sucuri.net|||/wp-content/plugins/facetwp-select2/select2/select2.min.css?ver=4.0.1
x-gateway-skip-cache: 0
cache-control: max-age=315360000
x-sucuri-id: 15005
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 mashsb.min.css
blog.sucuri.net/wp-content/plugins/mashsharer/assets/css/ 46 KB
29 KB 18ms
14ms Stylesheet
text/css 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.sucuri.net/wp-content/plugins/mashsharer/assets/css/mashsb.min.css?ver=3.8.8

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2023/04/balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

0500bd58f47403106f2f10da96d8d196941a02a4046e88611a59494557861f98

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/2023/04/balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Mon, 10 Apr 2023 02:10:50 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests;
content-encoding: gzip
x-sucuri-cache: HIT
x-xss-protection: 1; mode=block
x-gateway-cache-status: HIT
x-gateway-request-id: b2a9739238cb1c30fd0fdbabc1780d29
last-modified: Tue, 28 Mar 2023 15:54:59 GMT
server: nginx
etag: W/"64230dd3-b6e3"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
x-gateway-cache-key: 1668728459.439||https|blog.sucuri.net|||/wp-content/plugins/mashsharer/assets/css/mashsb.min.css?ver=3.8.8
x-gateway-skip-cache: 0
cache-control: max-age=315360000
x-sucuri-id: 15005
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 css
fonts.googleapis.com/ 13 KB
1 KB 139ms
50ms Stylesheet
text/css 2a00:1450:4001:828::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans:300,400,400italic,700,600

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2023/04/balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

ebfc5d0bbac3afbc82ba5da9c4aeeaf0271ddcbb2a3716b3dc620b7139a20d02

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Mon, 10 Apr 2023 02:10:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Mon, 10 Apr 2023 02:10:51 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 10 Apr 2023 02:10:51 GMT

GET
H2 200 cookie-banner.css
blog.sucuri.net/wp-content/themes/sucuriblog0117/css/ 10 KB
3 KB 19ms
15ms Stylesheet
text/css 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.sucuri.net/wp-content/themes/sucuriblog0117/css/cookie-banner.css?ver=20200427

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2023/04/balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

40ad5344e8c06d85d6cc2cfd95ad9ed597c3a1aaec5e730efb5fcee9d88b5135

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/2023/04/balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Mon, 10 Apr 2023 02:10:50 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests;
content-encoding: gzip
x-sucuri-cache: HIT
x-xss-protection: 1; mode=block
x-gateway-cache-status: HIT
x-gateway-request-id: 877e32a466115607359632644679ef02
last-modified: Sat, 06 Aug 2022 22:14:06 GMT
server: nginx
etag: W/"62eee7ae-287c"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
x-gateway-cache-key: 1668728459.439||https|blog.sucuri.net|||/wp-content/themes/sucuriblog0117/css/cookie-banner.css?ver=20200427
x-gateway-skip-cache: 0
cache-control: max-age=315360000
x-sucuri-id: 15005
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 frontend.min.js Show response
blog.sucuri.net/wp-content/plugins/google-analytics-premium/assets/js/ 9 KB
3 KB 20ms
16ms Script
application/javascript 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.sucuri.net/wp-content/plugins/google-analytics-premium/assets/js/frontend.min.js?ver=7.10.0

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2023/04/balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

63a6d926d277a3d64d30e349fa0ea2b0630e9801d173e1947ff3bd6060147ef4

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/2023/04/balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Mon, 10 Apr 2023 02:10:50 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests;
content-encoding: gzip
x-sucuri-cache: HIT
x-xss-protection: 1; mode=block
x-gateway-cache-status: HIT
x-gateway-request-id: fa8324587850533a18fb9c11fd14d44b
last-modified: Mon, 18 Nov 2019 16:19:47 GMT
server: nginx
etag: W/"5dd2c4a3-2452"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
x-gateway-cache-key: 1668728459.439||https|blog.sucuri.net|||/wp-content/plugins/google-analytics-premium/assets/js/frontend.min.js?ver=7.10.0
x-gateway-skip-cache: 0
cache-control: max-age=315360000
x-sucuri-id: 15005
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 jquery.min.js Show response
blog.sucuri.net/wp-includes/js/jquery/ 88 KB
36 KB 20ms
16ms Script
application/javascript 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.sucuri.net/wp-includes/js/jquery/jquery.min.js?ver=3.6.1

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2023/04/balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

cc7403bab52ed166e24ea9324241045af370be482f5b594468f4a6ac6e7e7981

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/2023/04/balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Mon, 10 Apr 2023 02:10:50 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests;
content-encoding: gzip
x-sucuri-cache: HIT
x-xss-protection: 1; mode=block
x-gateway-cache-status: HIT
x-gateway-request-id: 91f2f9f276e5d5a55b9b05b4a6bd49d3
last-modified: Tue, 15 Nov 2022 21:14:51 GMT
server: nginx
etag: W/"6374014b-15e54"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
x-gateway-cache-key: 1668728459.439||https|blog.sucuri.net|||/wp-includes/js/jquery/jquery.min.js?ver=3.6.1
x-gateway-skip-cache: 0
cache-control: max-age=315360000
x-sucuri-id: 15005
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 jquery-migrate.min.js Show response
blog.sucuri.net/wp-includes/js/jquery/ 11 KB
5 KB 20ms
17ms Script
application/javascript 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.sucuri.net/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2023/04/balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/2023/04/balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Mon, 10 Apr 2023 02:10:50 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests;
content-encoding: gzip
x-sucuri-cache: HIT
x-xss-protection: 1; mode=block
x-gateway-cache-status: HIT
x-gateway-request-id: 01cce637997d36f5a31121283d7d6918
last-modified: Tue, 15 Nov 2022 21:14:51 GMT
server: nginx
etag: W/"6374014b-2bd8"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
x-gateway-cache-key: 1668728459.439||https|blog.sucuri.net|||/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2
x-gateway-skip-cache: 0
cache-control: max-age=315360000
x-sucuri-id: 15005
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 select2.min.js Show response
blog.sucuri.net/wp-content/plugins/facetwp-select2/select2/ 63 KB
22 KB 21ms
17ms Script
application/javascript 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.sucuri.net/wp-content/plugins/facetwp-select2/select2/select2.min.js?ver=4.0.1

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2023/04/balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

ff6377c5173c4ee30318481c90cb7cc19987f2f5304871236266df11b0f48696

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/2023/04/balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Mon, 10 Apr 2023 02:10:50 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests;
content-encoding: gzip
x-sucuri-cache: HIT
x-xss-protection: 1; mode=block
x-gateway-cache-status: HIT
x-gateway-request-id: 8c786d978cca9064a48cc152ef212a01
last-modified: Tue, 12 Jul 2016 17:48:32 GMT
server: nginx
etag: W/"57852d70-fd75"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
x-gateway-cache-key: 1668728459.439||https|blog.sucuri.net|||/wp-content/plugins/facetwp-select2/select2/select2.min.js?ver=4.0.1
x-gateway-skip-cache: 0
cache-control: max-age=315360000
x-sucuri-id: 15005
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 mashsb.min.js Show response
blog.sucuri.net/wp-content/plugins/mashsharer/assets/js/ 4 KB
2 KB 21ms
17ms Script
application/javascript 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.sucuri.net/wp-content/plugins/mashsharer/assets/js/mashsb.min.js?ver=3.8.8

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2023/04/balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

876f181150664af9e30a4c1da6f8f95eb462aebeb8781db732ff6bc48a1f6632

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/2023/04/balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Mon, 10 Apr 2023 02:10:50 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests;
content-encoding: gzip
x-sucuri-cache: HIT
x-xss-protection: 1; mode=block
x-gateway-cache-status: HIT
x-gateway-request-id: f241bae3097b91c818691db20fd9c610
last-modified: Tue, 28 Mar 2023 15:54:59 GMT
server: nginx
etag: W/"64230dd3-114d"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
x-gateway-cache-key: 1668728459.439||https|blog.sucuri.net|||/wp-content/plugins/mashsharer/assets/js/mashsb.min.js?ver=3.8.8
x-gateway-skip-cache: 0
cache-control: max-age=315360000
x-sucuri-id: 15005
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 122ms
38ms Script
text/javascript 2a00:1450:4001:80b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2023/04/balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 10 Apr 2023 02:05:12 GMT
last-modified: Tue, 10 Jan 2023 21:29:14 GMT
server: Golfe2
age: 339
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20085
expires: Mon, 10 Apr 2023 04:05:12 GMT

GET
H2 200 17-EN-sucuri-blog-newsletter-banner.png
blog.sucuri.net/wp-content/uploads/2017/09/ 3 KB
3 KB 8ms
6ms Image
image/png 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.sucuri.net/wp-content/uploads/2017/09/17-EN-sucuri-blog-newsletter-banner.png

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2023/04/balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

52e26c085124647627c42c2cbce9a619b220a28420761233ea649d320f7c5518

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/2023/04/balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Mon, 10 Apr 2023 02:10:50 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests;
x-sucuri-cache: HIT
content-length: 3010
x-xss-protection: 1; mode=block
x-gateway-cache-status: HIT
x-gateway-request-id: 0c5925b0f48c86c4f5d5b2bb135f16a9
last-modified: Thu, 10 Oct 2019 13:11:10 GMT
server: nginx
etag: "5d9f2dee-bc2"
x-frame-options: SAMEORIGIN
x-gateway-skip-cache: 0
content-type: image/png
x-gateway-cache-key: 1668728459.439||https|blog.sucuri.net|||/wp-content/uploads/2017/09/17-EN-sucuri-blog-newsletter-banner.png
cache-control: max-age=315360000
x-sucuri-id: 15005
accept-ranges: bytes
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 hoverIntent.min.js Show response
blog.sucuri.net/wp-includes/js/ 1 KB
1 KB 7ms
6ms Script
application/javascript 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.sucuri.net/wp-includes/js/hoverIntent.min.js?ver=1.10.2

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2023/04/balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

ed5b5df9ceacfe76857ac51964972b0b417a215b2f50e837fd6b64bad7339c40

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/2023/04/balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Mon, 10 Apr 2023 02:10:50 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests;
content-encoding: gzip
x-sucuri-cache: HIT
x-xss-protection: 1; mode=block
x-gateway-cache-status: HIT
x-gateway-request-id: 75a672a0c505e05ee5882d8a7bdab45f
last-modified: Tue, 15 Nov 2022 21:14:51 GMT
server: nginx
etag: W/"6374014b-5db"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
x-gateway-cache-key: 1668728459.439||https|blog.sucuri.net|||/wp-includes/js/hoverIntent.min.js?ver=1.10.2
x-gateway-skip-cache: 0
cache-control: max-age=315360000
x-sucuri-id: 15005
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 superfish.min.js Show response
blog.sucuri.net/wp-content/themes/genesis/lib/js/menu/ 5 KB
2 KB 6ms
6ms Script
application/javascript 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.sucuri.net/wp-content/themes/genesis/lib/js/menu/superfish.min.js?ver=1.7.5

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2023/04/balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

68f2b0a3381830c544349d5df116c2b96ba1d8efa46cf0c15e3a130d91bf6ab4

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/2023/04/balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Mon, 10 Apr 2023 02:10:50 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests;
content-encoding: gzip
x-sucuri-cache: HIT
x-xss-protection: 1; mode=block
x-gateway-cache-status: HIT
x-gateway-request-id: a23fcfafddae2cdc1533aee4af28bd97
last-modified: Tue, 27 Nov 2018 17:57:24 GMT
server: nginx
etag: W/"5bfd8584-13ae"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
x-gateway-cache-key: 1668728459.439||https|blog.sucuri.net|||/wp-content/themes/genesis/lib/js/menu/superfish.min.js?ver=1.7.5
x-gateway-skip-cache: 0
cache-control: max-age=315360000
x-sucuri-id: 15005
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 superfish.args.min.js Show response
blog.sucuri.net/wp-content/themes/genesis/lib/js/menu/ 132 B
697 B 6ms
6ms Script
application/javascript 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.sucuri.net/wp-content/themes/genesis/lib/js/menu/superfish.args.min.js?ver=2.7.1

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2023/04/balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

20550f7bcb2a817ac9a5879e04260da8268e971c0b8031a6b7a2f48a55ee60d5

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/2023/04/balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Mon, 10 Apr 2023 02:10:50 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests;
content-encoding: gzip
x-sucuri-cache: HIT
x-xss-protection: 1; mode=block
x-gateway-cache-status: HIT
x-gateway-request-id: d20bb97ec9f61d48e9c6c68c5361f2d9
last-modified: Tue, 27 Nov 2018 17:57:24 GMT
server: nginx
etag: W/"5bfd8584-84"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
x-gateway-cache-key: 1668728459.439||https|blog.sucuri.net|||/wp-content/themes/genesis/lib/js/menu/superfish.args.min.js?ver=2.7.1
x-gateway-skip-cache: 0
cache-control: max-age=315360000
x-sucuri-id: 15005
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 skip-links.min.js Show response
blog.sucuri.net/wp-content/themes/genesis/lib/js/ 344 B
793 B 6ms
6ms Script
application/javascript 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.sucuri.net/wp-content/themes/genesis/lib/js/skip-links.min.js?ver=2.7.1

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2023/04/balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

0556982c2b3cf8fc78bc3d5d3c1e98b7861a0a8150ef7ecf2f3c7a733e4e0cf8

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/2023/04/balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Mon, 10 Apr 2023 02:10:50 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests;
content-encoding: gzip
x-sucuri-cache: HIT
x-xss-protection: 1; mode=block
x-gateway-cache-status: HIT
x-gateway-request-id: 07b0262255d6c0418094c1e9ea3e80b4
last-modified: Tue, 27 Nov 2018 17:57:24 GMT
server: nginx
etag: W/"5bfd8584-158"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
x-gateway-cache-key: 1668728459.439||https|blog.sucuri.net|||/wp-content/themes/genesis/lib/js/skip-links.min.js?ver=2.7.1
x-gateway-skip-cache: 0
cache-control: max-age=315360000
x-sucuri-id: 15005
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 theme.js Show response
blog.sucuri.net/wp-content/themes/sucuriblog0117/js/ 3 KB
1 KB 6ms
5ms Script
application/javascript 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.sucuri.net/wp-content/themes/sucuriblog0117/js/theme.js?ver=1.1.0

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2023/04/balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

6ae8162fefa27a4c1b69440f19e997af99d94d2e3fef9265e0c44c4caf7cbbda

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/2023/04/balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Mon, 10 Apr 2023 02:10:50 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests;
content-encoding: gzip
x-sucuri-cache: HIT
x-xss-protection: 1; mode=block
x-gateway-cache-status: HIT
x-gateway-request-id: cfd4dc1b6ed30e284397dce30853b87d
last-modified: Wed, 14 Mar 2018 21:46:59 GMT
server: nginx
etag: W/"5aa99853-a37"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
x-gateway-cache-key: 1668728459.439||https|blog.sucuri.net|||/wp-content/themes/sucuriblog0117/js/theme.js?ver=1.1.0
x-gateway-skip-cache: 0
cache-control: max-age=315360000
x-sucuri-id: 15005
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 sticky.js Show response
blog.sucuri.net/wp-content/themes/sucuriblog0117/js/ 9 KB
3 KB 7ms
6ms Script
application/javascript 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.sucuri.net/wp-content/themes/sucuriblog0117/js/sticky.js?ver=1.0.4

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2023/04/balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

cc07dc22acd75d21ea2a03ced344d13aeeea586029288b1d7004739f8ce3c7be

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/2023/04/balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Mon, 10 Apr 2023 02:10:50 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests;
content-encoding: gzip
x-sucuri-cache: HIT
x-xss-protection: 1; mode=block
x-gateway-cache-status: HIT
x-gateway-request-id: f12d8fda71f611294b1795fa9866f071
last-modified: Fri, 27 Jan 2017 03:26:08 GMT
server: nginx
etag: W/"588abdd0-2502"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
x-gateway-cache-key: 1668728459.439||https|blog.sucuri.net|||/wp-content/themes/sucuriblog0117/js/sticky.js?ver=1.0.4
x-gateway-skip-cache: 0
cache-control: max-age=315360000
x-sucuri-id: 15005
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 sticky-init.js Show response
blog.sucuri.net/wp-content/themes/sucuriblog0117/js/ 2 KB
1 KB 6ms
6ms Script
application/javascript 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.sucuri.net/wp-content/themes/sucuriblog0117/js/sticky-init.js?ver=1.0.1

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2023/04/balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

36d47eadbca93ee9613695d80ee179247a0b6bd78b503a549778dbcbe46b0815

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/2023/04/balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Mon, 10 Apr 2023 02:10:50 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests;
content-encoding: gzip
x-sucuri-cache: HIT
x-xss-protection: 1; mode=block
x-gateway-cache-status: HIT
x-gateway-request-id: e77cabfd6a870701e79f6efe828258c8
last-modified: Fri, 27 Jan 2017 03:26:08 GMT
server: nginx
etag: W/"588abdd0-667"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
x-gateway-cache-key: 1668728459.439||https|blog.sucuri.net|||/wp-content/themes/sucuriblog0117/js/sticky-init.js?ver=1.0.1
x-gateway-skip-cache: 0
cache-control: max-age=315360000
x-sucuri-id: 15005
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 cookie-banner.js Show response
blog.sucuri.net/wp-content/themes/sucuriblog0117/js/ 4 KB
2 KB 7ms
7ms Script
application/javascript 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.sucuri.net/wp-content/themes/sucuriblog0117/js/cookie-banner.js?ver=20200914

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2023/04/balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

5aafcc6bf2a5538e40efb22b67dee2fb1f1809b846853b69df489d70cac45a36

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/2023/04/balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Mon, 10 Apr 2023 02:10:50 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests;
content-encoding: gzip
x-sucuri-cache: HIT
x-xss-protection: 1; mode=block
x-gateway-cache-status: HIT
x-gateway-request-id: a2671afa1ba32b7c7ea21db523efb686
last-modified: Mon, 14 Sep 2020 11:23:40 GMT
server: nginx
etag: W/"5f5f52bc-e5b"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
x-gateway-cache-key: 1668728459.439||https|blog.sucuri.net|||/wp-content/themes/sucuriblog0117/js/cookie-banner.js?ver=20200914
x-gateway-skip-cache: 0
cache-control: max-age=315360000
x-sucuri-id: 15005
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 A166802-5dda-4f98-aad8-1f58dbc8f1771.js Show response
d.impactradius-event.com/ 40 KB
13 KB 60ms
14ms Script
text/javascript 35.186.249.72
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://d.impactradius-event.com/A166802-5dda-4f98-aad8-1f58dbc8f1771.js
Requested by: Host: blog.sucuri.net
URL: https://blog.sucuri.net/2023/04/balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.249.72 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 72.249.186.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 8235aa051c240d36805f28bb37173c4e2a40cf4b347e1d99d96db420caba3aa0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Mon, 10 Apr 2023 02:07:19 GMT
content-encoding: gzip
age: 212
x-guploader-uploadid: ADPycdvb1ubJJV8Fnv8kRlw8MXq91bErWjVhFBSh5CaA7mf_SeddviJWYHs2HlXEAmiqKDawVabd-IsQ5sxQHzCianew8b4CpAOy
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12966
last-modified: Tue, 18 Feb 2020 03:14:51 GMT
server: UploadServer
etag: "7b386031dce97320ca627c68daf254c5"
vary: Accept-Encoding
x-goog-generation: 1581995691826115
x-goog-hash: crc32c=zxauHA==, md5=ezhgMdzpcyDKYnxo2vJUxQ==
access-control-allow-origin: *
content-type: text/javascript; charset=utf-8
cache-control: public,max-age=900,s-maxage=300
x-goog-stored-content-length: 12966
accept-ranges: bytes
expires: Mon, 10 Apr 2023 02:12:19 GMT

GET
H2 200 utag.js Show response
tags.tiqcdn.com/utag/gpl/sucuri/prod/ 139 KB
34 KB 35ms
9ms Script
application/javascript 2600:9000:223e:6000:7:2bfb:7c00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/gpl/sucuri/prod/utag.js
Requested by: Host: blog.sucuri.net
URL: https://blog.sucuri.net/2023/04/balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223e:6000:7:2bfb:7c00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 37b06f759d7ecb525d037f9caf9f5abef8fb0917d9c9e795909136e7cb5e3785

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

x-amz-version-id: 6ozmNHTGXnzpvZAhB5RMaxWT9wKO3JT6
content-encoding: gzip
via: 1.1 a2cac9c5f0e90f8b7fede4ac9aca75ca.cloudfront.net (CloudFront)
date: Mon, 10 Apr 2023 02:09:39 GMT
last-modified: Wed, 08 Mar 2023 11:29:55 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P4
age: 73
x-amz-server-side-encryption: AES256
etag: W/"17aa055090387e6a36012e1d58d8dd93"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: d91_SDPswaFjGp0w7hqUnm92TEMZoaU-GHVUUe5P5cS9b1adVLc6Fg==

GET
H2 200 logo.png
blog.sucuri.net/wp-content/themes/sucuriblog0117/images/ 5 KB
6 KB 7ms
7ms Image
image/png 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.sucuri.net/wp-content/themes/sucuriblog0117/images/logo.png

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/wp-content/themes/sucuriblog0117/style.css?ver=1.2.0

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

ec0f53f11e000f28f7dc3a590f746a21c233b2ccbf695cebbf8601b2b912d14d

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/wp-content/themes/sucuriblog0117/style.css?ver=1.2.0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Mon, 10 Apr 2023 02:10:50 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests;
x-sucuri-cache: HIT
content-length: 5361
x-xss-protection: 1; mode=block
x-gateway-cache-status: MISS
x-gateway-request-id: 4fc37e6d83b0679d46060ffcc88db1b5
last-modified: Sat, 06 Aug 2022 22:27:02 GMT
server: nginx
etag: "62eeeab6-14f1"
x-frame-options: SAMEORIGIN
x-gateway-skip-cache: 0
content-type: image/png
x-gateway-cache-key: 1668728459.439||https|blog.sucuri.net|||/wp-content/themes/sucuriblog0117/images/logo.png
cache-control: max-age=315360000
x-sucuri-id: 15005
accept-ranges: bytes
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v34/ 44 KB
44 KB 134ms
41ms Font
font/woff2 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v34/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,400,400italic,700,600

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8778e9af2422858d7052ff9a0f3c12c08ae976bdd6e0316db144cd5579cd97db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://blog.sucuri.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Tue, 04 Apr 2023 10:31:04 GMT
x-content-type-options: nosniff
age: 488387
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 44856
x-xss-protection: 0
last-modified: Mon, 15 Aug 2022 18:20:18 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 03 Apr 2024 10:31:04 GMT

GET
H2 200 footer-logo.png
blog.sucuri.net/wp-content/themes/sucuriblog0117/images/ 5 KB
6 KB 6ms
6ms Image
image/png 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.sucuri.net/wp-content/themes/sucuriblog0117/images/footer-logo.png

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/wp-content/themes/sucuriblog0117/style.css?ver=1.2.0

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

618e2688a71e0742e9a4d0de4d85e59351a5748ffce32f5518cd7a5d292a6d1b

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/wp-content/themes/sucuriblog0117/style.css?ver=1.2.0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Mon, 10 Apr 2023 02:10:50 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests;
x-sucuri-cache: HIT
content-length: 5139
x-xss-protection: 1; mode=block
x-gateway-cache-status: MISS
x-gateway-request-id: 031a1c80cfe8c3925492646ad8cc6465
last-modified: Sat, 06 Aug 2022 22:38:51 GMT
server: nginx
etag: "62eeed7b-1413"
x-frame-options: SAMEORIGIN
x-gateway-skip-cache: 0
content-type: image/png
x-gateway-cache-key: 1668728459.439||https|blog.sucuri.net|||/wp-content/themes/sucuriblog0117/images/footer-logo.png
cache-control: max-age=315360000
x-sucuri-id: 15005
accept-ranges: bytes
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
DATA 200
OK truncated
/ 11 KB
11 KB Font
application/octet-stream

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 745caffca4b97cf5cf2374d82c6dfb6fb7c7b694e85432f92ec4dcb35f4418c9

Request headers

Referer
Origin: https://blog.sucuri.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Content-Type: application/octet-stream

GET
H2 200 memQYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWq8tWZ0Pw86hd0Rk8ZkWVAewA.woff2
fonts.gstatic.com/s/opensans/v34/ 17 KB
18 KB 183ms
95ms Font
font/woff2 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v34/memQYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWq8tWZ0Pw86hd0Rk8ZkWVAewA.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,400,400italic,700,600

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9ad0a22b0c58240a7a92b4c01aa31f39a5918dea6a8fdfa77e63042abc4fca31

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://blog.sucuri.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Tue, 04 Apr 2023 10:35:00 GMT
x-content-type-options: nosniff
age: 488151
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 17820
x-xss-protection: 0
last-modified: Mon, 15 Aug 2022 18:13:12 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 03 Apr 2024 10:35:00 GMT

GET
DATA 200
OK truncated
/ 14 KB
14 KB Font
application/x-font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1cfd32e37f8aba263101f06e8f702adfaef55a6601857cf5e2c6dd0b0388dcd6

Request headers

Referer
Origin: https://blog.sucuri.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Content-Type: application/x-font-woff;charset=utf-8

GET
H2 200 23-BlogPost_Feature-Image_1490x700_Balada-Injector-745x350.jpg
blog.sucuri.net/wp-content/uploads/2023/04/ 37 KB
37 KB 10ms
6ms Image
image/jpeg 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.sucuri.net/wp-content/uploads/2023/04/23-BlogPost_Feature-Image_1490x700_Balada-Injector-745x350.jpg

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2023/04/balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

0909a4caf07b3e1d47c08f2d2ed8ecb4dce51f9ecba63e4cb5c01efb58d99c01

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/2023/04/balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Mon, 10 Apr 2023 02:10:51 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests;
x-sucuri-cache: HIT
content-length: 37705
x-xss-protection: 1; mode=block
x-gateway-cache-status: HIT
x-gateway-request-id: 56eaf04f5a46fdcde86dae4699e81fa1
last-modified: Thu, 06 Apr 2023 18:53:39 GMT
server: nginx
etag: "642f1533-9349"
x-frame-options: SAMEORIGIN
x-gateway-skip-cache: 0
content-type: image/jpeg
x-gateway-cache-key: 1668728459.439||https|blog.sucuri.net|||/wp-content/uploads/2023/04/23-BlogPost_Feature-Image_1490x700_Balada-Injector-745x350.jpg
cache-control: max-age=315360000
x-sucuri-id: 15005
accept-ranges: bytes
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 balada_injector_charcode.png
blog.sucuri.net/wp-content/uploads/2023/04/ 454 KB
455 KB 11ms
8ms Image
image/png 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.sucuri.net/wp-content/uploads/2023/04/balada_injector_charcode.png

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2023/04/balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

5831beaf47c2a88b3b5f5e9a63c926d4bdc81935e62c933480589600d6c620f1

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/2023/04/balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Mon, 10 Apr 2023 02:10:51 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests;
x-sucuri-cache: HIT
content-length: 465385
x-xss-protection: 1; mode=block
x-gateway-cache-status: MISS
x-gateway-request-id: 62bc6dffb4fe13dd1cf161ed87c7c3e5
last-modified: Thu, 06 Apr 2023 18:29:19 GMT
server: nginx
etag: "642f0f7f-719e9"
x-frame-options: SAMEORIGIN
x-gateway-skip-cache: 0
content-type: image/png
x-gateway-cache-key: 1668728459.439||https|blog.sucuri.net|||/wp-content/uploads/2023/04/balada_injector_charcode.png
cache-control: max-age=315360000
x-sucuri-id: 15005
accept-ranges: bytes
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 linux_malware_virustotal_collection.png
blog.sucuri.net/wp-content/uploads/2023/04/ 218 KB
218 KB 22ms
19ms Image
image/png 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.sucuri.net/wp-content/uploads/2023/04/linux_malware_virustotal_collection.png

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2023/04/balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

1abca284bab280a1bc28b3e6d159c1b2ebe0ba91c20a0457aca44f4c9ddca3fc

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/2023/04/balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Mon, 10 Apr 2023 02:10:51 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests;
x-sucuri-cache: HIT
content-length: 222783
x-xss-protection: 1; mode=block
x-gateway-cache-status: MISS
x-gateway-request-id: 86bc1aea271403fcde8cc2fa0378f82d
last-modified: Thu, 06 Apr 2023 18:30:07 GMT
server: nginx
etag: "642f0faf-3663f"
x-frame-options: SAMEORIGIN
x-gateway-skip-cache: 0
content-type: image/png
x-gateway-cache-key: 1668728459.439||https|blog.sucuri.net|||/wp-content/uploads/2023/04/linux_malware_virustotal_collection.png
cache-control: max-age=315360000
x-sucuri-id: 15005
accept-ranges: bytes
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 23-sucuri-blog-sidebar-banner-need-help-cleaning-up-malware-on-your-website-get-help-now-1.png
blog.sucuri.net/wp-content/uploads/2023/01/ 332 KB
333 KB 24ms
22ms Image
image/png 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.sucuri.net/wp-content/uploads/2023/01/23-sucuri-blog-sidebar-banner-need-help-cleaning-up-malware-on-your-website-get-help-now-1.png

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2023/04/balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

1dd7d08e151a4b5cf34c116970b4248d8721fe35d1f2219982725ebd851562e4

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/2023/04/balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Mon, 10 Apr 2023 02:10:51 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests;
x-sucuri-cache: HIT
content-length: 340122
x-xss-protection: 1; mode=block
x-gateway-cache-status: MISS
x-gateway-request-id: 3a82a86ef91ee627de332cb7fbfa71a0
last-modified: Fri, 27 Jan 2023 16:22:07 GMT
server: nginx
etag: "63d3fa2f-5309a"
x-frame-options: SAMEORIGIN
x-gateway-skip-cache: 0
content-type: image/png
x-gateway-cache-key: 1668728459.439||https|blog.sucuri.net|||/wp-content/uploads/2023/01/23-sucuri-blog-sidebar-banner-need-help-cleaning-up-malware-on-your-website-get-help-now-1.png
cache-control: max-age=315360000
x-sucuri-id: 15005
accept-ranges: bytes
expires: Thu, 31 Dec 2037 23:55:55 GMT

POST
H2 200 3713 Show response
sucuri.7eer.net/xur/ 119 B
668 B 65ms
26ms XHR
application/json 35.186.240.205
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://sucuri.7eer.net/xur/3713
Requested by: Host: d.impactradius-event.com
URL: https://d.impactradius-event.com/A166802-5dda-4f98-aad8-1f58dbc8f1771.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.240.205 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 205.240.186.35.bc.googleusercontent.com
Software: /
Resource Hash: 09e8d3a17e3a585efa7d0f859200e567b84a53fe9a6edeb56dc9cf8b226725ac

Request headers

Referer: https://blog.sucuri.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

pragma: no-cache
date: Mon, 10 Apr 2023 02:10:51 GMT
via: 1.1 google
p3p: policyref="/w3c/p3p.xml", CP="ALL BUS LEG DSP COR ADM CUR DEV PSA OUR NAV INT"
access-control-allow-origin: https://blog.sucuri.net
content-type: application/json; charset=UTF-8
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 10 Apr 2023 02:10:51 GMT

GET
H2 200 mixpanel-2-latest.min.js Show response
cdn.mxpnl.com/libs/ 51 KB
18 KB 52ms
15ms Script
text/javascript 2600:1901:0:bc29::
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.mxpnl.com/libs/mixpanel-2-latest.min.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/gpl/sucuri/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1901:0:bc29:: Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: UploadServer /
Resource Hash: 7cceac0e1b94c5964df6d6da287f575859f66716dfb73ce20317061829ac4704

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Sun, 09 Apr 2023 21:50:17 GMT
content-encoding: gzip
age: 15634
x-guploader-uploadid: ADPycdsx1TDPtGKZS6o4SY7r2He9W1JTm6YprUsyq8AVlMQ5t7rVtbojQTZ0_Q2jLfqhE-d6MMRYGl7hOpjKB2RxylP7fA
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 2
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 17668
last-modified: Fri, 24 Mar 2023 19:07:41 GMT
server: UploadServer
etag: "f33a0f9c1247a4ca80af96ee30b43366"
vary: Accept-Encoding
x-goog-generation: 1679684861532215
x-goog-hash: crc32c=SVKeCw==, md5=8zoPnBJHpMqAr5buMLQzZg==
access-control-allow-origin: *
content-type: text/javascript
cache-control: public,max-age=86400
x-goog-stored-content-length: 17668
accept-ranges: bytes
expires: Mon, 10 Apr 2023 21:50:17 GMT

GET
H2 200 loader0.js Show response
static.olark.com/jsclient/ Frame EA0B 9 KB
3 KB 81ms
7ms Script
application/javascript 192.229.233.34
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://static.olark.com/jsclient/loader0.js
Requested by: Host: blog.sucuri.net
URL: https://blog.sucuri.net/2023/04/balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.229.233.34 Granada Hills, United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (frb/6794) /
Resource Hash: e4d08f877611f0c9211f3099d2bf66a57b97f4c8a03e4bc8f9dcc9299b4d09e7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Mon, 10 Apr 2023 02:10:51 GMT
content-encoding: gzip
via: 1.1 google
last-modified: Mon, 05 Dec 2022 22:24:31 GMT
server: ECS (frb/6794)
age: 456
etag: W/"638e6f9f-224a"
vary: Accept-Encoding
x-cache: HIT
content-type: application/javascript; charset=utf-8
p3p: CP='Olark does not have a P3P policy. Learn why here: http://olark.com/p3p'
cache-control: max-age=2700
accept-ranges: bytes
content-length: 3152
expires: Mon, 10 Apr 2023 02:55:51 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 4 B
209 B 46ms
45ms XHR
text/plain 2a00:1450:4001:80b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j99&a=1757836877&t=pageview&_s=1&dl=https%3A%2F%2Fblog.sucuri.net%2F2023%2F04%2Fbalada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html&ul=en-us&de=UTF-8&dt=Balada%20Injector%3A%20Synopsis%20of%20a%20Massive%20Ongoing%20WordPress%20Malware%20Campaign&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IGBACEABBAAAACAAI~&jid=875773481&gjid=1609452037&cid=236918569.1681092652&tid=UA-4077922-18&_gid=1077521046.1681092652&_r=1&_slc=1&z=900926977

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.sucuri.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 10 Apr 2023 02:10:51 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://blog.sucuri.net
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 113 KB
44 KB 143ms
52ms Script
application/javascript 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-4077922-18

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/gpl/sucuri/prod/utag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

573da15ef5446c1f832d03404b586102531cc36153ec9349bf281665dc6a379b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Mon, 10 Apr 2023 02:10:51 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 44947
x-xss-protection: 0
last-modified: Mon, 10 Apr 2023 00:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 10 Apr 2023 02:10:51 GMT

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 13 KB
5 KB 33ms
7ms Script
application/x-javascript 2a02:26f0:780::5f65:3669
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/gpl/sucuri/prod/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:780::5f65:3669 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

f56ccb2db87aacedd9415232e40f80bff9939703df2f9c3f9ec8a092e545349f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Mon, 10 Apr 2023 02:10:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 10 Jan 2023 17:22:56 GMT
x-cdn: AKAM
vary: Accept-Encoding
content-type: application/x-javascript;charset=utf-8
cache-control: max-age=53010
accept-ranges: bytes
content-length: 4777

GET
H2 200 498146.js Show response
js.hs-scripts.com/ 853 B
793 B 76ms
25ms Script
application/javascript 2606:4700::6812:863b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-scripts.com/498146.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/gpl/sucuri/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:863b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fe4fecb6d8eb408ff7a3b023464d5f5661e54ef9204cd9ccd1feedcbc1beda73

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Mon, 10 Apr 2023 02:10:51 GMT
content-encoding: br
cf-cache-status: HIT
x-hubspot-correlation-id: 3799447d-8dd6-4f1f-a7ae-8763931f78ae
age: 30
cf-polished: origSize=960
cf-bgj: minify
last-modified: Mon, 10 Apr 2023 02:10:21 GMT
server: cloudflare
x-trace: 2B46C24B6EC404287975AA019FEEF2CD551C7E96FA000000000000000000
access-control-max-age: 3600
vary: origin, Accept-Encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: https://dashboard.sucuri.net
cache-control: public, max-age=60
access-control-allow-credentials: true
cf-ray: 7b5774b069a93633-FRA
expires: Mon, 10 Apr 2023 02:11:51 GMT

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 56 KB
15 KB 42ms
9ms Script
application/javascript 146.75.116.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/gpl/sucuri/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.75.116.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Mon, 10 Apr 2023 02:10:51 GMT
content-encoding: gzip
last-modified: Thu, 27 Oct 2022 16:56:53 GMT
etag: "32ad004436155ec972bc50e6238b5b67+gzip+gzip"
vary: Accept-Encoding,Host
x-cache: HIT, HIT
content-type: application/javascript; charset=utf-8
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
x-tw-cdn: FT
cache-control: no-cache
accept-ranges: bytes
content-length: 15375
x-served-by: cache-iad-kjyo7100081-IAD, cache-fra-eddf8230025-FRA

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 107 KB
28 KB 34ms
13ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/gpl/sucuri/prod/utag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

dbf060c555e91a539d9cb849f4aa0c656db9b0a1da32c99aafb12d7c508c6849

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Mon, 10 Apr 2023 02:10:51 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 27909
x-fb-rlafr: 0
x-xss-protection: 0
pragma: public
x-fb-debug: vY+jyc19Dsi0J4wyt27KDCJs5dP/L4w9srxCSNfvspksh3ZZqCd5MfSvdrzFxFP1AmzCU+kJGoUUJbsfBKJC4Q==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
x-fb-trip-id: 686109401
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
cache-control: public, max-age=1200
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 utag.v.js Show response
tags.tiqcdn.com/utag/tiqapp/ 2 B
411 B 13ms
9ms Script
application/javascript 2600:9000:223e:6000:7:2bfb:7c00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/tiqapp/utag.v.js?a=gpl/sucuri/202301122129&cb=1681092651543
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/gpl/sucuri/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223e:6000:7:2bfb:7c00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

x-amz-version-id: 2XUX04X5QEw0.xFya64khU._sHTRl_Pz
date: Mon, 10 Apr 2023 02:05:09 GMT
via: 1.1 a2cac9c5f0e90f8b7fede4ac9aca75ca.cloudfront.net (CloudFront)
last-modified: Sat, 11 Mar 2023 06:57:46 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P4
age: 343
x-amz-server-side-encryption: AES256
etag: "7bc0ee636b3b83484fc3b9348863bd22"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
accept-ranges: bytes
content-length: 2
x-amz-cf-id: S9wgHOJbstK_GCbzjOO6h7ou4v9Q3lPgmXO03nl-jUcZT6KUtImKhA==

GET
H2

200

/
www.google.de/pagead/1p-user-list/1040458670/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1040458670/?value=1.00&currency_code=USD&label=ZMfLCJ7ZoGgQrseQ8AM&guid=ON&script=0
https://www.google.com/pagead/1p-user-list/1040458670/?value=1.00&currency_code=USD&label=ZMfLCJ7ZoGgQrseQ8AM&guid=ON&script=0&is_vtc=1&random=161949598
https://www.google.de/pagead/1p-user-list/1040458670/?value=1.00&currency_code=USD&label=ZMfLCJ7ZoGgQrseQ8AM&guid=ON&script=0&is_vtc=1&random=161949598&ipr=y

42 B
154 B

49ms
49ms

Image
image/gif

2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/1040458670/?value=1.00&currency_code=USD&label=ZMfLCJ7ZoGgQrseQ8AM&guid=ON&script=0&is_vtc=1&random=161949598&ipr=y

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2023/04/balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html

Protocol

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Apr 2023 02:10:51 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 10 Apr 2023 02:10:51 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
location: https://www.google.de/pagead/1p-user-list/1040458670/?value=1.00&currency_code=USD&label=ZMfLCJ7ZoGgQrseQ8AM&guid=ON&script=0&is_vtc=1&random=161949598&ipr=y
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 token Show response
cdn.linkedin.oribi.io/partner/179713/domain/blog.sucuri.net/ 36 B
374 B 34ms
8ms XHR
application/json 2600:9000:20eb:9000:2:53b2:240:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.linkedin.oribi.io/partner/179713/domain/blog.sucuri.net/token
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:9000:2:53b2:240:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89

Request headers

Accept: *
Referer: https://blog.sucuri.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Mon, 10 Apr 2023 00:23:30 GMT
content-encoding: gzip
via: 1.1 c3b74c81fdcb7942211a6c721efa13fc.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C1
age: 6441
vary: accept-encoding
x-cache: Hit from cloudfront
content-type: application/json
access-control-allow-origin: *
cache-control: public, max-age=26899
x-amz-cf-id: R5Gl_qE8qw3qjiPfobebxVStyeckxqJMpAhnnSWljWikrmbiRaeMQg==

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=179713&time=1681092651582&url=https%3A%2F%2Fblog.sucuri.net%2F2023%2F04%2Fbalada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign...
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D179713%26time%3D1681092651582%26url%3Dhttps%253A%252F%252Fblog.sucuri.net%252F202...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=179713&time=1681092651582&url=https%3A%2F%2Fblog.sucuri.net%2F2023%2F04%2Fbalada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign...
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=179713&time=1681092651582&url=https%3A%2F%2Fblog.sucuri.net%2F2023%2F04%2Fbalada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaig...

0
264 B

168ms
149ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=179713&time=1681092651582&url=https%3A%2F%2Fblog.sucuri.net%2F2023%2F04%2Fbalada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html&liSync=true&e_ipv6=AQLby2j2-DV_CgAAAYdo7ivfS3UBrebpmlUM-yGpndzRDx92mpS4GPIAwmPwdcR1nNGjY15x
Requested by: Host: blog.sucuri.net
URL: https://blog.sucuri.net/2023/04/balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Mon, 10 Apr 2023 02:10:51 GMT
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: 6C89DA2A3D664582B74B452CC7C704D6 Ref B: FRAEDGE1211 Ref C: 2023-04-10T02:10:52Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-type: application/javascript
x-li-fabric: prod-ltx1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAX48eJd3A5Gvd0CdPazQw==

Redirect headers

date: Mon, 10 Apr 2023 02:10:51 GMT
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: E44693C87C0548DCB75DC69C44AA80B1 Ref B: FRAEDGE1513 Ref C: 2023-04-10T02:10:51Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-ltx1
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=179713&time=1681092651582&url=https%3A%2F%2Fblog.sucuri.net%2F2023%2F04%2Fbalada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html&liSync=true&e_ipv6=AQLby2j2-DV_CgAAAYdo7ivfS3UBrebpmlUM-yGpndzRDx92mpS4GPIAwmPwdcR1nNGjY15x
x-li-proto: http/2
content-length: 0
x-li-uuid: AAX48eJbR5m18d7uib4BBA==

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
349 B 71ms
18ms XHR
text/plain 2a00:1450:400c:c0c::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j99&tid=UA-4077922-18&cid=236918569.1681092652&jid=875773481&gjid=1609452037&_gid=1077521046.1681092652&_u=IGBACEAABAAAACAAI~&z=434475748

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c0c::9b Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.sucuri.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Mon, 10 Apr 2023 02:10:51 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://blog.sucuri.net
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 adsct
t.co/i/ 43 B
376 B 148ms
118ms Image
image/gif 104.244.42.197
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?bci=3&eci=2&event_id=d7f21d43-3cf1-4e8f-a9df-b1d0ff412aba&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=89d7d696-8b32-4293-b61f-39ce114d2641&tw_document_href=https%3A%2F%2Fblog.sucuri.net%2F2023%2F04%2Fbalada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nuyl9&type=javascript&version=2.3.29

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2023/04/balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.197 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

x-response-time: 110
date: Mon, 10 Apr 2023 02:10:51 GMT
strict-transport-security: max-age=0
server: tsa_o
content-type: image/gif;charset=utf-8
x-transaction-id: ffe764a4409372d3
cache-control: no-cache, no-store, max-age=0
perf: 7626143928
x-connection-hash: 19b51dacc2ee08e13c74ad5aa9d001edf7722ec7dfaa8a023b201910600cadca
content-length: 43

GET
H2 200 adsct
analytics.twitter.com/i/ 43 B
394 B 182ms
113ms Image
image/gif 104.244.42.67
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=d7f21d43-3cf1-4e8f-a9df-b1d0ff412aba&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=89d7d696-8b32-4293-b61f-39ce114d2641&tw_document_href=https%3A%2F%2Fblog.sucuri.net%2F2023%2F04%2Fbalada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nuyl9&type=javascript&version=2.3.29

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2023/04/balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.67 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

x-response-time: 107
date: Mon, 10 Apr 2023 02:10:51 GMT
strict-transport-security: max-age=631138519
server: tsa_o
content-type: image/gif;charset=utf-8
x-transaction-id: 5908f635db36bc3c
cache-control: no-cache, no-store, max-age=0
perf: 7626143928
x-connection-hash: fc35b57ff6c4c70060da924ffb9fb60fc7da4f8567a3ea22f5d420e0a215d943
content-length: 43

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
107 B 137ms
49ms Image
image/gif 2a00:1450:4001:812::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j99&tid=UA-4077922-18&cid=236918569.1681092652&jid=875773481&_u=IGBACEAABAAAACAAI~&z=862613226

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2023/04/balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Apr 2023 02:10:51 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
408 B 138ms
48ms Image
image/gif 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j99&tid=UA-4077922-18&cid=236918569.1681092652&jid=875773481&_u=IGBACEAABAAAACAAI~&z=862613226

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2023/04/balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Apr 2023 02:10:51 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 identity.js Show response
connect.facebook.net/signals/plugins/ 64 KB
20 KB 11ms
9ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/plugins/identity.js?v=2.9.100

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

7e86f52cb0d423805ec541a4bccae5156a01fbe36355e6d798a450593212651f

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Mon, 10 Apr 2023 02:10:51 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 20722
x-fb-rlafr: 0
x-xss-protection: 0
pragma: public
x-fb-debug: o4eEBqy23ZbKS6Po+yLNpYuuiE7MTB4E5ScBRv/HcfEuIEuOaV/ALgDhhuFmPc/0YExb90nq+vv2PJdjbV1UcQ==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
x-fb-trip-id: 686109401
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
cache-control: public, max-age=1200
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 309646199598471 Show response
connect.facebook.net/signals/config/ 377 KB
108 KB 13ms
12ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/309646199598471?v=2.9.100&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

60d495ab1865780ed2b5aa47aea9ab7f33ccb18ce883ca3aae3c5c396852a680

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Mon, 10 Apr 2023 02:10:51 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 110250
x-fb-rlafr: 0
x-xss-protection: 0
pragma: public
x-fb-debug: KMn/zNSXA63lBfzvPduYo9uTMhVXQMCocUTxEF6SwRnG8SdbjJemiyUPLsw2YoBlQMCnS5tAHdbjzdF6tSEQ8w==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
x-fb-trip-id: 686109401
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
cache-control: public, max-age=1200
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
BLOB 200
OK 7ecaf39b-e62c-4202-a874-4e56d0f2bef0 Show response
https://blog.sucuri.net/ Frame 2515 147 B
0 Document
text/html

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://blog.sucuri.net/7ecaf39b-e62c-4202-a874-4e56d0f2bef0
Requested by: Host: static.olark.com
URL: https://static.olark.com/jsclient/loader0.js
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ef75b33904d93af24fa40e39bfc332becf6145911fb0715a252445b5e2bcb79e

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Content-Length: 147
Content-Type: text/html

GET
H2 200 498146.js Show response
js.hs-banner.com/ 61 KB
16 KB 446ms
406ms Script
text/javascript 2606:4700::6812:18c4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-banner.com/498146.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/498146.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:18c4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2c3754dbf3be2a19c5fbe1e5f9ea8eab4ad76db99447205b59ae1d9caae9d0ae

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Mon, 10 Apr 2023 02:10:52 GMT
x-amz-version-id: YJL5EQdeSrlaTD3IfzdQO61roVhquRgl
content-encoding: br
cf-cache-status: REVALIDATED
x-amz-request-id: CQ6H3NC78J76S46S
x-amz-server-side-encryption: AES256
x-amz-id-2: 3es8kw7HWEN8JezJLABPA9xlJc6Cdp+LjLC57QWBi74oeulE1ojpZ6NTZhMPQ1ZUt6uttLHPxec=
last-modified: Tue, 25 Oct 2022 19:55:48 GMT
server: cloudflare
etag: W/"9ae527d7cf18b7690dcb17fee9bb6df1"
access-control-max-age: 604800
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: https://wafx.sucuri.net
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
cache-control: max-age=300, public
access-control-allow-credentials: true
vary: origin, Accept-Encoding
timing-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
cf-ray: 7b5774b16e02364b-FRA
expires: Mon, 10 Apr 2023 02:15:52 GMT

GET
H2 200 498146.js Show response
js.hs-analytics.net/analytics/1681092600000/ 65 KB
20 KB 49ms
21ms Script
text/javascript 2606:4700::6810:8ace
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-analytics.net/analytics/1681092600000/498146.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/498146.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:8ace , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4dbf2b440080899a6e5a6c28fe6148a55ec7dffb7678e9e7bf5e2487d2aa4191

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Mon, 10 Apr 2023 02:10:51 GMT
x-amz-version-id: null
content-encoding: br
cf-cache-status: HIT
x-amz-request-id: GXDFQD2DDSVNKSST
age: 30
x-amz-server-side-encryption: AES256
x-amz-id-2: Vaxa7ODEy/IHSVqBmWZRT0obcurgsp5LeCvl/Si7lWMdGYwx8su8tobzbXoSva9vfDbuF2Yu1pU=
last-modified: Thu, 23 Mar 2023 16:29:37 GMT
server: cloudflare
etag: W/"caa2de1f637590c6333dfe32991f7c26"
vary: origin, Accept-Encoding
content-type: text/javascript
cache-control: max-age=300, public
access-control-allow-credentials: false
cf-ray: 7b5774b15e97040c-FRA
expires: Mon, 10 Apr 2023 02:15:21 GMT

GET
H2 200 /
www.facebook.com/tr/ 0
185 B 31ms
8ms Image
text/plain 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=309646199598471&ev=PageView&dl=https%3A%2F%2Fblog.sucuri.net%2F2023%2F04%2Fbalada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html&rl=&if=false&ts=1681092651744&sw=1600&sh=1200&v=2.9.100&r=stable&a=tmtealium&ec=0&o=30&cs_est=true&fbp=fb.1.1681092651743.1402565080&it=1681092651695&coo=false&eid=7505c365107866237765c8ea3195053c&tm=1&rqm=GET

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2023/04/balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Mon, 10 Apr 2023 02:10:51 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H3 200 js Show response
www.google-analytics.com/gtm/ 123 KB
47 KB 53ms
53ms Script
application/javascript 2a00:1450:4001:80b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/gtm/js?id=GTM-TMKM2TQ&t=gtag_UA_4077922_18&cid=236918569.1681092652

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

3c5a703be24b159205dd361ad4e4d7cfd531c0145b9f89c00441f4703822ee8f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Mon, 10 Apr 2023 02:10:51 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 48161
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 10 Apr 2023 02:10:51 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 222 KB
78 KB 52ms
51ms Script
application/javascript 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-L206HXJP92&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-4077922-18

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

c3176977350f660d4b5b4c5efd797ac6d18971aa2e8458f7d4358298dd623c5d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Mon, 10 Apr 2023 02:10:51 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 79326
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 10 Apr 2023 02:10:51 GMT

POST
H3 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 45ms
44ms XHR
text/plain 2a00:1450:4001:80b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j99&a=1757836877&t=pageview&_s=1&dl=https%3A%2F%2Fblog.sucuri.net%2F2023%2F04%2Fbalada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html&ul=en-us&de=UTF-8&dt=Balada%20Injector%3A%20Synopsis%20of%20a%20Massive%20Ongoing%20WordPress%20Malware%20Campaign&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=6GDACUADRAAAACgCI~&jid=1361121422&gjid=1589335715&cid=236918569.1681092652&tid=UA-4077922-18&_gid=1077521046.1681092652&_r=1&gtm=457e3430&npa=1&z=171771534

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.sucuri.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 10 Apr 2023 02:10:51 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://blog.sucuri.net
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
region1.google-analytics.com/g/ 0
245 B 47ms
17ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-L206HXJP92&gtm=45je3430&_p=1757836877&gdid=dYmQxMT&cid=236918569.1681092652&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1681092651&sct=1&seg=0&dl=https%3A%2F%2Fblog.sucuri.net%2F2023%2F04%2Fbalada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html&dt=Balada%20Injector%3A%20Synopsis%20of%20a%20Massive%20Ongoing%20WordPress%20Malware%20Campaign&en=page_view&_fv=1&_ss=1&_ee=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-L206HXJP92&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Apr 2023 02:10:51 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://blog.sucuri.net
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
70 B 19ms
18ms XHR
text/plain 2a00:1450:400c:c0c::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j99&tid=UA-4077922-18&cid=236918569.1681092652&jid=1361121422&gjid=1589335715&_gid=1077521046.1681092652&npa=1&_u=6GDACUADRAAAACgCI~&z=1198343313

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c0c::9b Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.sucuri.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Mon, 10 Apr 2023 02:10:51 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://blog.sucuri.net
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
107 B 51ms
50ms Image
image/gif 2a00:1450:4001:812::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j99&tid=UA-4077922-18&cid=236918569.1681092652&jid=1361121422&npa=1&_u=6GDACUADRAAAACgCI~&z=270448403

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2023/04/balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Apr 2023 02:10:51 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
107 B 52ms
51ms Image
image/gif 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j99&tid=UA-4077922-18&cid=236918569.1681092652&jid=1361121422&npa=1&_u=6GDACUADRAAAACgCI~&z=270448403

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2023/04/balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Apr 2023 02:10:51 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.ojrq.net/p/ 50 B
448 B 60ms
19ms Image
image/gif 34.95.127.121
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.ojrq.net/p/?return=&cid=3713&tpsync=no&auth=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.95.127.121 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 121.127.95.34.bc.googleusercontent.com
Software: /
Resource Hash: ec34cd386427fe6deacf99f4fdbeea4b1d1ed25f505411650d7ceaa843a7fc63

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Apr 2023 02:10:52 GMT
via: 1.1 google
content-type: image/gif
p3p: policyref="/w3c/p3p.xml", CP="ALL BUS LEG DSP COR ADM CUR DEV PSA OUR NAV INT"
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 50
expires: Mon, 10 Apr 2023 02:10:52 GMT

GET
H2 200 498146.js Show response
js-na1.hs-scripts.com/ 960 B
659 B 137ms
129ms Script
application/javascript 2606:4700::6812:863b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js-na1.hs-scripts.com/498146.js
Requested by: Host: js.hs-analytics.net
URL: https://js.hs-analytics.net/analytics/1681092600000/498146.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:863b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d69d0c5584317568915dfa6fd13bbd0ca66ac95b6e1c13dd62fbbe286ba87da4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Mon, 10 Apr 2023 02:10:52 GMT
content-encoding: br
cf-cache-status: EXPIRED
last-modified: Mon, 10 Apr 2023 01:05:13 GMT
server: cloudflare
x-hubspot-correlation-id: a07609cb-b7ff-4541-a7a9-42158189c2b7
x-trace: 2BA692378AEDC9BE6E635D75533FC49E30AA23DAEF000000000000000000
vary: origin, Accept-Encoding
access-control-max-age: 3600
content-type: application/javascript;charset=utf-8
access-control-allow-origin: https://blog.sucuri.net
cache-control: public, max-age=30
access-control-allow-credentials: true
cf-ray: 7b5774b4bb4b3633-FRA

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
891 B 151ms
128ms Image
image/gif 2606:4700::6813:9b53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=3897811554&v=1.1&a=498146&rcu=https%3A%2F%2Fblog.sucuri.net%2F2023%2F04%2Fbalada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html&pu=https%3A%2F%2Fblog.sucuri.net%2F2023%2F04%2Fbalada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html&t=Balada+Injector%3A+Synopsis+of+a+Massive+Ongoing+WordPress+Malware+Campaign&cts=1681092652262&vi=a6d108bfaa74734599049cd82d103cc2&nc=true&u=166519265.a6d108bfaa74734599049cd82d103cc2.1681092652258.1681092652258.1681092652258.1&b=166519265.1.1681092652258&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Mon, 10 Apr 2023 02:10:52 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id: c43b50ef-cb1d-4237-88be-1624ad6f2e50
p3p: CP="NOI CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 45
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eHjAQsBmZOtFi4RK78QDQhVEM0DT2xO%2FKtPypQhmDKkbyNqOuuww5MAd0u7CCRPO7Ml5cOr3bpUl1I7mt1yahRhp%2FzOoN4HcQ7odBj53heFf74qzSxsUgrMJI70fnwdS4vbCXn4WCDhPn8%2Fp7EUf"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
cf-ray: 7b5774b4cb1e9226-FRA
x-robots-tag: none

POST
H2 200 / Show response
www.facebook.com/tr/ Frame 2747 0
72 B 8ms
7ms Document
text/plain 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Content-Type: application/x-www-form-urlencoded
Origin: https://blog.sucuri.net
Referer: https://blog.sucuri.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin: https://blog.sucuri.net
alt-svc: h3=":443"; ma=86400
content-length: 0
content-type: text/plain
cross-origin-resource-policy: cross-origin
date: Mon, 10 Apr 2023 02:10:52 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains

Verdicts & Comments Add Verdict or Comment

61 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

30 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.sucuri.net/	1969-12-31 23:59:59	Name: IR_gbd Value: sucuri.net
.sucuri.net/	1970-01-20 13:07:48	Name: CONSENTMGR Value: c1:1%7Cc2:1%7Cc3:1%7Cc4:1%7Cc5:1%7Cc6:1%7Cc7:1%7Cc8:1%7Cc9:1%7Cc10:1%7Cc11:1%7Cc12:1%7Cc13:1%7Cc14:1%7Cc15:1%7Cts:1681092651489%7Cconsent:true
.sucuri.net/	1970-01-20 19:43:48	Name: utag_main Value: v_id:018768ee29e30041a6ba81ff1ab403074006d06c00b08$_sn:1$_ss:1$_st:1681094451492$ses_id:1681092651492%3Bexp-session$_pn:1%3Bexp-session
.sucuri.net/	1970-01-20 10:59:39	Name: _gid Value: GA1.2.1077521046.1681092652
.sucuri.net/	1970-01-20 10:58:12	Name: _gat Value: 1
.7eer.net/	1970-01-20 20:34:12	Name: brwsr Value: eacb3fbc-d744-11ed-a1f6-b5074c358207
.7eer.net/	1970-01-20 10:59:39	Name: irtps Value: 1
.sucuri.net/	1969-12-31 23:59:59	Name: IR_3713 Value: 1681092651546%7C0%7C1681092651478%7C%7C
.sucuri.net/	1970-01-20 20:34:12	Name: IR_PI Value: eacb3fbc-d744-11ed-a1f6-b5074c358207%7C1681179051478
.sucuri.net/	1970-01-20 19:43:48	Name: mp_c59343135653bd9019d29f1db79e348b_mixpanel Value: %7B%22distinct_id%22%3A%20%22%24device%3A18768ee2a2f835-0b9cec42165c9-623b5556-1d4c00-18768ee2a307c9%22%2C%22%24device_id%22%3A%20%2218768ee2a2f835-0b9cec42165c9-623b5556-1d4c00-18768ee2a307c9%22%2C%22%24initial_referrer%22%3A%20%22%24direct%22%2C%22%24initial_referring_domain%22%3A%20%22%24direct%22%7D
blog.sucuri.net/	1970-01-20 10:59:39	Name: ln_or Value: eyIxNzk3MTMiOiJkIn0%3D
.doubleclick.net/	1970-01-20 10:58:13	Name: test_cookie Value: CheckForPermission
.sucuri.net/	1970-01-20 13:07:48	Name: _fbp Value: fb.1.1681092651743.1402565080
.linkedin.com/	1970-01-20 11:41:24	Name: UserMatchHistory Value: AQLFWZablha72gAAAYdo7iqfsmCzKAA-qnRgwL-QCi5f2qw-54plROHyTOwRTSuBhE2OUX5AxMT_Qw
.linkedin.com/	1970-01-20 11:41:24	Name: AnalyticsSyncHistory Value: AQKF6bsI8CTH_wAAAYdo7iqfvurQrMISGoOFm8GnWwLZJdEPbJ3aG_DAa4jksA-4GrlF1z4Ku5yVt7sIjHbfhQ
.linkedin.com/	1970-01-20 19:43:48	Name: bcookie Value: "v=2&a809cf34-b706-47f2-8c28-efab0656d244"
.linkedin.com/	1970-01-20 10:59:39	Name: lidc Value: "b=TGST02:s=T:r=T:a=T:p=T:g=2991:u=1:x=1:i=1681092651:t=1681179051:v=2:sig=AQHmMEcMBCr1sWjLhYmkeJOYC0Tipo4l"
.t.co/	1970-01-20 20:34:12	Name: muc_ads Value: 17643383-2585-40b8-9c06-d413705fce52
.twitter.com/	1970-01-20 20:34:12	Name: personalization_id Value: "v1_j80hdz20QRO0bOrvBhh/5A=="
.sucuri.net/	1970-01-20 10:58:12	Name: _gat_gtag_UA_4077922_18 Value: 1
.sucuri.net/	1970-01-20 20:34:12	Name: _ga_L206HXJP92 Value: GS1.1.1681092651.1.0.1681092651.0.0.0
.sucuri.net/	1970-01-20 20:34:12	Name: _ga Value: GA1.1.236918569.1681092652
.www.linkedin.com/	1970-01-20 19:43:48	Name: bscookie Value: "v=1&202304100210512c1b4119-57b6-4c3e-8800-74cad8f55848AQHVop2HtZqEI4rGseyF_RG-35NrDhqK"
.linkedin.com/	1970-01-20 15:17:24	Name: li_gc Value: MTswOzE2ODEwOTI2NTE7MjswMjEFMbbNtGg7WNC/kTBbak+nE31kx2pwSRoPxoHIYf/nXw==
.sucuri.net/	1970-01-20 15:17:24	Name: __hstc Value: 166519265.a6d108bfaa74734599049cd82d103cc2.1681092652258.1681092652258.1681092652258.1
.sucuri.net/	1970-01-20 15:17:24	Name: hubspotutk Value: a6d108bfaa74734599049cd82d103cc2
.sucuri.net/	1969-12-31 23:59:59	Name: __hssrc Value: 1
.sucuri.net/	1970-01-20 10:58:14	Name: __hssc Value: 166519265.1.1681092652258
.ojrq.net/	1970-01-20 20:34:12	Name: brwsr Value: eb415a5c-d744-11ed-ab28-619fcc8f5e66
.hubspot.com/	1970-01-20 10:58:14	Name: __cf_bm Value: djUbogcQnsuDLvKjFhdz9WZkTscfaB4ZglXjV_CBs0o-1681092652-0-AcimejcuTBpWmkbN8R7z8STn95/4OmfX1LdPkVmR0wEbO5AgeCxxjqbxt66KOTvWnanNsEPYu1tvDyc/26SGNQk=

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

analytics.twitter.com
blog.sucuri.net
cdn.linkedin.oribi.io
cdn.mxpnl.com
connect.facebook.net
d.impactradius-event.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
js-na1.hs-scripts.com
js.hs-analytics.net
js.hs-banner.com
js.hs-scripts.com
px.ads.linkedin.com
px4.ads.linkedin.com
region1.google-analytics.com
snap.licdn.com
static.ads-twitter.com
static.olark.com
stats.g.doubleclick.net
sucuri.7eer.net
t.co
tags.tiqcdn.com
track.hubspot.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.linkedin.com
www.ojrq.net

104.244.42.197
104.244.42.67
13.107.42.14
146.75.116.157
192.229.233.34
2001:4860:4802:32::36
2600:1901:0:bc29::
2600:9000:20eb:9000:2:53b2:240:93a1
2600:9000:223e:6000:7:2bfb:7c00:93a1
2606:4700::6810:8ace
2606:4700::6812:18c4
2606:4700::6812:863b
2606:4700::6813:9b53
2620:1ec:21::14
2a00:1450:4001:802::2002
2a00:1450:4001:80b::200e
2a00:1450:4001:812::2004
2a00:1450:4001:813::2003
2a00:1450:4001:828::200a
2a00:1450:4001:82b::2003
2a00:1450:4001:82f::2008
2a00:1450:400c:c0c::9b
2a02:26f0:780::5f65:3669
2a02:fe80:1010::5
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
34.95.127.121
35.186.240.205
35.186.249.72
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300
0500bd58f47403106f2f10da96d8d196941a02a4046e88611a59494557861f98
0556982c2b3cf8fc78bc3d5d3c1e98b7861a0a8150ef7ecf2f3c7a733e4e0cf8
0909a4caf07b3e1d47c08f2d2ed8ecb4dce51f9ecba63e4cb5c01efb58d99c01
09e8d3a17e3a585efa7d0f859200e567b84a53fe9a6edeb56dc9cf8b226725ac
1abca284bab280a1bc28b3e6d159c1b2ebe0ba91c20a0457aca44f4c9ddca3fc
1cfd32e37f8aba263101f06e8f702adfaef55a6601857cf5e2c6dd0b0388dcd6
1dd7d08e151a4b5cf34c116970b4248d8721fe35d1f2219982725ebd851562e4
20550f7bcb2a817ac9a5879e04260da8268e971c0b8031a6b7a2f48a55ee60d5
2c3754dbf3be2a19c5fbe1e5f9ea8eab4ad76db99447205b59ae1d9caae9d0ae
36d47eadbca93ee9613695d80ee179247a0b6bd78b503a549778dbcbe46b0815
37b06f759d7ecb525d037f9caf9f5abef8fb0917d9c9e795909136e7cb5e3785
3c5a703be24b159205dd361ad4e4d7cfd531c0145b9f89c00441f4703822ee8f
40ad5344e8c06d85d6cc2cfd95ad9ed597c3a1aaec5e730efb5fcee9d88b5135
442ea9791bad77a328e1a07c59784d92e10bac3f612ba9b00afba5c7518acc6b
4dbf2b440080899a6e5a6c28fe6148a55ec7dffb7678e9e7bf5e2487d2aa4191
52e26c085124647627c42c2cbce9a619b220a28420761233ea649d320f7c5518
573da15ef5446c1f832d03404b586102531cc36153ec9349bf281665dc6a379b
5831beaf47c2a88b3b5f5e9a63c926d4bdc81935e62c933480589600d6c620f1
5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de
5a5f39391fbf5b06db84b8f9716d53de575ee97a627d2c5f12f79a991a671eb5
5aafcc6bf2a5538e40efb22b67dee2fb1f1809b846853b69df489d70cac45a36
60d495ab1865780ed2b5aa47aea9ab7f33ccb18ce883ca3aae3c5c396852a680
618e2688a71e0742e9a4d0de4d85e59351a5748ffce32f5518cd7a5d292a6d1b
63a6d926d277a3d64d30e349fa0ea2b0630e9801d173e1947ff3bd6060147ef4
68f2b0a3381830c544349d5df116c2b96ba1d8efa46cf0c15e3a130d91bf6ab4
6ae8162fefa27a4c1b69440f19e997af99d94d2e3fef9265e0c44c4caf7cbbda
745caffca4b97cf5cf2374d82c6dfb6fb7c7b694e85432f92ec4dcb35f4418c9
7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89
7cceac0e1b94c5964df6d6da287f575859f66716dfb73ce20317061829ac4704
7e86f52cb0d423805ec541a4bccae5156a01fbe36355e6d798a450593212651f
8235aa051c240d36805f28bb37173c4e2a40cf4b347e1d99d96db420caba3aa0
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
876f181150664af9e30a4c1da6f8f95eb462aebeb8781db732ff6bc48a1f6632
8778e9af2422858d7052ff9a0f3c12c08ae976bdd6e0316db144cd5579cd97db
9ad0a22b0c58240a7a92b4c01aa31f39a5918dea6a8fdfa77e63042abc4fca31
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb
a54f6c14c893db230689abea6ee219bceef13371ab6938d5725c93ad02a4b3b4
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
c3176977350f660d4b5b4c5efd797ac6d18971aa2e8458f7d4358298dd623c5d
c324ef26b20264369e4568dc9ef1c5cb1f325f6bc4e8b7c01f7fe93fa353276a
cc07dc22acd75d21ea2a03ced344d13aeeea586029288b1d7004739f8ce3c7be
cc7403bab52ed166e24ea9324241045af370be482f5b594468f4a6ac6e7e7981
cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee
d69d0c5584317568915dfa6fd13bbd0ca66ac95b6e1c13dd62fbbe286ba87da4
dbf060c555e91a539d9cb849f4aa0c656db9b0a1da32c99aafb12d7c508c6849
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4d08f877611f0c9211f3099d2bf66a57b97f4c8a03e4bc8f9dcc9299b4d09e7
ebfc5d0bbac3afbc82ba5da9c4aeeaf0271ddcbb2a3716b3dc620b7139a20d02
ec0f53f11e000f28f7dc3a590f746a21c233b2ccbf695cebbf8601b2b912d14d
ec34cd386427fe6deacf99f4fdbeea4b1d1ed25f505411650d7ceaa843a7fc63
ed026fedc8b8130aecd7be55e134a42efcaa8e90a5f2f8ec88aa9a1a5ab934ec
ed5b5df9ceacfe76857ac51964972b0b417a215b2f50e837fd6b64bad7339c40
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef75b33904d93af24fa40e39bfc332becf6145911fb0715a252445b5e2bcb79e
f56ccb2db87aacedd9415232e40f80bff9939703df2f9c3f9ec8a092e545349f
fe4fecb6d8eb408ff7a3b023464d5f5661e54ef9204cd9ccd1feedcbc1beda73
ff6377c5173c4ee30318481c90cb7cc19987f2f5304871236266df11b0f48696

blog.sucuri.net Open in urlscan Pro 2a02:fe80:1010::5 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

68 Requests

97 %HTTPS

70 %IPv6

26 Domains

31 Subdomains

29 IPs

3 Countries

1822 kBTransfer

3194 kBSize

30 Cookies

64 Outgoing links

Redirected requests

68 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

blog.sucuri.net Open in urlscan Pro
2a02:fe80:1010::5 Public Scan

Screenshot
Live screenshot

Full Image

68
Requests

97 %
HTTPS

70 %
IPv6

26
Domains

31
Subdomains

29
IPs

3
Countries

1822 kB
Transfer

3194 kB
Size

30
Cookies

68 HTTP transactions
2 data transactions