hotforsecurity.bitdefender.com Open in urlscan Pro
2606:4700::6812:a9de Public Scan

Go To Rescan
Add Verdict Report

URL:
https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Submission: On September 17 via api (September 17th 2020, 11:54:09 pm UTC) from FR

Summary HTTP 74 Redirects Links 31 Behaviour Indicators

Summary

This website contacted 23 IPs in 7 countries across 17 domains to perform 74 HTTP transactions. The main IP is 2606:4700::6812:a9de, located in United States and belongs to CLOUDFLARENET, US. The main domain is hotforsecurity.bitdefender.com.
TLS certificate: Issued by Thawte RSA CA 2018 on October 23rd 2019. Valid for: a year.

This is the only time hotforsecurity.bitdefender.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
39	2606:4700::68... 2606:4700::6812:a9de	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:819::200a	15169 (GOOGLE) (GOOGLE)
5	2a02:26f0:6c0... 2a02:26f0:6c00:28a::1e80	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1 3	52.49.47.228 52.49.47.228	16509 (AMAZON-02) (AMAZON-02)
1	143.204.201.47 143.204.201.47	16509 (AMAZON-02) (AMAZON-02)
2	99.84.144.62 99.84.144.62	16509 (AMAZON-02) (AMAZON-02)
1 1	2600:1901:0:2... 2600:1901:0:2470::	15169 (GOOGLE) (GOOGLE)
1	35.201.112.186 35.201.112.186	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:81a::200e	15169 (GOOGLE) (GOOGLE)
1	192.229.220.142 192.229.220.142	15133 (EDGECAST) (EDGECAST)
2	2a00:1450:400... 2a00:1450:4001:801::2003	15169 (GOOGLE) (GOOGLE)
2	2a04:fa87:fff... 2a04:fa87:fffe::c000:4902	2635 (AUTOMATTIC) (AUTOMATTIC)
2	15.188.154.177 15.188.154.177	16509 (AMAZON-02) (AMAZON-02)
1 1	66.117.28.86 66.117.28.86	15224 (OMNITURE) (OMNITURE)
1	34.248.119.134 34.248.119.134	16509 (AMAZON-02) (AMAZON-02)
1	54.76.90.77 54.76.90.77	16509 (AMAZON-02) (AMAZON-02)
2	2a02:26f0:6c0... 2a02:26f0:6c00:296::25ea	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1 2	2a05:f500:11:... 2a05:f500:11:101::b93f:9005	14413 (LINKEDIN) (LINKEDIN)
1 1	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2a00:1450:400... 2a00:1450:400c:c0c::9b	15169 (GOOGLE) (GOOGLE)
1	35.186.194.58 35.186.194.58	15169 (GOOGLE) (GOOGLE)
3	147.75.32.125 147.75.32.125	54825 (PACKET) (PACKET)
1	99.84.144.121 99.84.144.121	16509 (AMAZON-02) (AMAZON-02)
1	172.217.16.134 172.217.16.134	15169 (GOOGLE) (GOOGLE)
2 2	52.17.84.139 52.17.84.139	16509 (AMAZON-02) (AMAZON-02)
1 2	99.84.144.83 99.84.144.83	16509 (AMAZON-02) (AMAZON-02)
1	52.214.117.39 52.214.117.39	16509 (AMAZON-02) (AMAZON-02)
74	23

39 2606:4700::6812:a9de (United States)

ASN13335 (CLOUDFLARENET, US)

hotforsecurity.bitdefender.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.bitdefender.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:819::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a02:26f0:6c00:28a::1e80 (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)

assets.adobedtm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.49.47.228 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-49-47-228.eu-west-1.compute.amazonaws.com

bitdefender.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.201.47 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-201-47.fra53.r.cloudfront.net

scripts.demandbase.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 99.84.144.62 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-84-144-62.txl52.r.cloudfront.net

api.company-target.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1901:0:2470:: (United States) 1 redirects

ASN15169 (GOOGLE, US)

fullstory.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.201.112.186 (Ascension Island)

ASN15169 (GOOGLE, US)
PTR: 186.112.201.35.bc.googleusercontent.com

edge.fullstory.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:81a::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.229.220.142 (United States)

ASN15133 (EDGECAST, US)

download.bitdefender.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:801::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a04:fa87:fffe::c000:4902 (Ireland)

ASN2635 (AUTOMATTIC, US)

secure.gravatar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 15.188.154.177 (Paris, France)

ASN16509 (AMAZON-02, US)

sstats.bitdefender.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 66.117.28.86 (United States) 1 redirects

ASN15224 (OMNITURE, US)

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.248.119.134 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.76.90.77 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)

bitdefender.tt.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:6c00:296::25ea (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a05:f500:11:101::b93f:9005 (Ireland) 1 redirects

ASN14413 (LINKEDIN, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:21::14 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c0c::9b (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.186.194.58 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: 58.194.186.35.bc.googleusercontent.com

rs.fullstory.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 147.75.32.125 (Amsterdam, Netherlands)

ASN54825 (PACKET, US)
PTR: pkt-ams-k2-shared-ingress4

static.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
script.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
vars.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 99.84.144.121 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-84-144-121.txl52.r.cloudfront.net

tag.demandbase.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.16.134 (United States)

ASN15169 (GOOGLE, US)
PTR: fra15s46-in-f6.1e100.net

fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.17.84.139 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)

match.prod.bidr.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 99.84.144.83 (Seattle, United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-99-84-144-83.txl52.r.cloudfront.net

segments.company-target.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.214.117.39 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-214-117-39.eu-west-1.compute.amazonaws.com

in.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
42	bitdefender.com hotforsecurity.bitdefender.com www.bitdefender.com download.bitdefender.com sstats.bitdefender.com	1 MB
5	adobedtm.com assets.adobedtm.com	116 KB
4	hotjar.com static.hotjar.com script.hotjar.com vars.hotjar.com in.hotjar.com	78 KB
4	company-target.com 1 redirects api.company-target.com segments.company-target.com	3 KB
4	demdex.net 1 redirects bitdefender.demdex.net dpm.demdex.net	3 KB
3	linkedin.com 2 redirects px.ads.linkedin.com www.linkedin.com	3 KB
3	fullstory.com 1 redirects fullstory.com edge.fullstory.com rs.fullstory.com	61 KB
2	bidr.io 2 redirects match.prod.bidr.io	1019 B
2	doubleclick.net stats.g.doubleclick.net fls.doubleclick.net	817 B
2	licdn.com snap.licdn.com	3 KB
2	gravatar.com secure.gravatar.com	10 KB
2	gstatic.com fonts.gstatic.com	22 KB
2	google-analytics.com www.google-analytics.com	19 KB
2	demandbase.com scripts.demandbase.com tag.demandbase.com	18 KB
1	omtrdc.net bitdefender.tt.omtrdc.net	474 B
1	everesttech.net 1 redirects cm.everesttech.net	554 B
1	googleapis.com fonts.googleapis.com	821 B
74	17

	Domain	Requested by
37	hotforsecurity.bitdefender.com	hotforsecurity.bitdefender.com
5	assets.adobedtm.com	hotforsecurity.bitdefender.com assets.adobedtm.com
3	bitdefender.demdex.net	1 redirects hotforsecurity.bitdefender.com assets.adobedtm.com
2	segments.company-target.com	1 redirects hotforsecurity.bitdefender.com
2	match.prod.bidr.io	2 redirects
2	px.ads.linkedin.com	1 redirects hotforsecurity.bitdefender.com
2	snap.licdn.com	assets.adobedtm.com snap.licdn.com
2	sstats.bitdefender.com	assets.adobedtm.com
2	secure.gravatar.com	hotforsecurity.bitdefender.com
2	fonts.gstatic.com	fonts.googleapis.com
2	www.google-analytics.com	hotforsecurity.bitdefender.com www.google-analytics.com
2	api.company-target.com	assets.adobedtm.com tag.demandbase.com
2	www.bitdefender.com	hotforsecurity.bitdefender.com
1	in.hotjar.com	script.hotjar.com
1	vars.hotjar.com	static.hotjar.com
1	script.hotjar.com	static.hotjar.com
1	fls.doubleclick.net	assets.adobedtm.com
1	tag.demandbase.com	assets.adobedtm.com
1	static.hotjar.com	hotforsecurity.bitdefender.com
1	rs.fullstory.com	fullstory.com
1	stats.g.doubleclick.net	www.google-analytics.com
1	www.linkedin.com	1 redirects
1	bitdefender.tt.omtrdc.net	assets.adobedtm.com
1	dpm.demdex.net	hotforsecurity.bitdefender.com
1	cm.everesttech.net	1 redirects
1	download.bitdefender.com	hotforsecurity.bitdefender.com
1	edge.fullstory.com	hotforsecurity.bitdefender.com
1	fullstory.com	1 redirects
1	scripts.demandbase.com	assets.adobedtm.com
1	fonts.googleapis.com	hotforsecurity.bitdefender.com
74	30

This site contains links to these domains. Also see Links.

Domain
twitter.com
seravo.com
blog.nintechnet.com
www.wordfence.com
wordpress.org
facebook.com
www.linkedin.com
www.facebook.com
www.twitter.com
feedly.com
www.bitdefender.com

Subject Issuer	Validity	Valid
*.bitdefender.com Thawte RSA CA 2018	`2019-10-23` - `2020-11-04`	a year	crt.sh
upload.video.google.com GTS CA 1O1	`2020-08-26` - `2020-11-18`	3 months	crt.sh
assets.adobedtm.com DigiCert SHA2 High Assurance Server CA	`2019-10-22` - `2021-10-01`	2 years	crt.sh
*.demdex.net DigiCert SHA2 High Assurance Server CA	`2018-01-09` - `2021-02-12`	3 years	crt.sh
*.demandbase.com Go Daddy Secure Certificate Authority - G2	`2018-09-20` - `2020-11-19`	2 years	crt.sh
*.company-target.com Go Daddy Secure Certificate Authority - G2	`2019-06-19` - `2021-08-18`	2 years	crt.sh
edge.fullstory.com GTS CA 1D2	`2020-08-29` - `2020-11-27`	3 months	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-08-26` - `2020-11-18`	3 months	crt.sh
download.bitdefender.com DigiCert SHA2 Secure Server CA	`2020-04-23` - `2022-05-26`	2 years	crt.sh
*.gstatic.com GTS CA 1O1	`2020-08-26` - `2020-11-18`	3 months	crt.sh
*.gravatar.com Sectigo RSA Domain Validation Secure Server CA	`2020-08-14` - `2022-11-16`	2 years	crt.sh
sstats.bitdefender.com DigiCert SHA2 High Assurance Server CA	`2019-12-30` - `2021-04-01`	a year	crt.sh
*.tt.omtrdc.net DigiCert SHA2 High Assurance Server CA	`2017-10-19` - `2020-11-25`	3 years	crt.sh
*.licdn.com DigiCert SHA2 Secure Server CA	`2019-04-01` - `2021-05-07`	2 years	crt.sh
px.ads.linkedin.com DigiCert SHA2 Secure Server CA	`2020-08-05` - `2021-02-05`	6 months	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2020-08-26` - `2020-11-18`	3 months	crt.sh
*.fullstory.com Let's Encrypt Authority X3	`2020-08-01` - `2020-10-30`	3 months	crt.sh
static.hotjar.com Let's Encrypt Authority X3	`2020-08-16` - `2020-11-14`	3 months	crt.sh
*.doubleclick.net GTS CA 1O1	`2020-08-26` - `2020-11-18`	3 months	crt.sh
script.hotjar.com Let's Encrypt Authority X3	`2020-08-17` - `2020-11-15`	3 months	crt.sh
vars.hotjar.com Let's Encrypt Authority X3	`2020-08-15` - `2020-11-13`	3 months	crt.sh
*.hotjar.com Amazon	`2020-08-29` - `2021-09-28`	a year	crt.sh

This page contains 3 frames:

Primary Page: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Frame ID: 9A00B33D6FCDC2968E13DE472FD59B81
Requests: 72 HTTP requests in this frame

Frame: https://bitdefender.demdex.net/dest5.html?d_nsid=0
Frame ID: 55554E0C5483D40DAC31B90C1734C40E
Requests: 1 HTTP requests in this frame

Frame: https://vars.hotjar.com/box-469cf41adb11dc78be68c1ae7f9457a4.html
Frame ID: E3854B8CA9DFAE5EFD09965AF37B19EC
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

headers link /rel="https:\/\/api\.w\.org\/"/i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers link /rel="https:\/\/api\.w\.org\/"/i

MySQL (Databases) Expand

Overall confidence: 100%
Detected patterns

headers link /rel="https:\/\/api\.w\.org\/"/i

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Page Statistics

74
Requests

100 %
HTTPS

41 %
IPv6

17
Domains

30
Subdomains

23
IPs

7
Countries

1539 kB
Transfer

3808 kB
Size

25
Cookies

31 Outgoing links

These are links going to different origins than the main page.

URL: https://twitter.com/@gcluley
Title: @gcluley

Search URL Search Domain Scan URL

URL: https://seravo.com/blog/0-day-vulnerability-in-wp-file-manager/
Title: discovered

Search URL Search Domain Scan URL

URL: https://blog.nintechnet.com/critical-zero-day-vulnerability-fixed-in-wordpress-file-manager-700000-installations/
Title: describe

Search URL Search Domain Scan URL

URL: https://www.wordfence.com/blog/2020/09/700000-wordpress-users-affected-by-zero-day-vulnerability-in-file-manager-plugin/
Title: says

Search URL Search Domain Scan URL

URL: https://wordpress.org/plugins/wp-file-manager/
Title: issued an update

Search URL Search Domain Scan URL

URL: https://facebook.com/grahamcluleycom

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/in/grahamcluley

Search URL Search Domain Scan URL

URL: http://www.facebook.com/bitdefender
Title: 1.3m Fans

Search URL Search Domain Scan URL

URL: http://www.twitter.com/bitdefender
Title: 103.9k Followers

Search URL Search Domain Scan URL

URL: https://feedly.com/i/subscription/feed/https://hotforsecurity.bitdefender.com/feed
Title: 2.7k Subscribers

Search URL Search Domain Scan URL

URL: http://feedly.com/i/subscription/feed%2Fhttps%3A%2F%2Ffeeds.feedburner.com%2FHOTforSecurity
Title: 16 Subscribers

Search URL Search Domain Scan URL

URL: https://www.bitdefender.com/box/
Title: Bitdefender Cybersecurity for Smart Home

Search URL Search Domain Scan URL

URL: https://www.bitdefender.com/solutions/total-security.html
Title: Bitdefender Complete Protection

Search URL Search Domain Scan URL

URL: https://www.bitdefender.com/solutions/internet-security.html
Title: Bitdefender PC Protection

Search URL Search Domain Scan URL

URL: https://www.bitdefender.com/solutions/antivirus-for-mac.html
Title: Bitdefender Antivirus for Mac

Search URL Search Domain Scan URL

URL: https://www.bitdefender.com/solutions/mobile-security-android.html
Title: Bitdefender Mobile Security for Android

Search URL Search Domain Scan URL

URL: https://www.bitdefender.com/solutions/antivirus-comparison.html
Title: Bitdefender Product Comparison

Search URL Search Domain Scan URL

URL: https://www.bitdefender.com/business/security.html
Title: Bitdefender GravityZone Business Security

Search URL Search Domain Scan URL

URL: https://www.bitdefender.com/business/advanced-security.html
Title: Bitdefender GravityZone Advanced Business Security

Search URL Search Domain Scan URL

URL: https://www.bitdefender.com/business/enterprise-security.html
Title: Bitdefender GravityZone Enterprise Security

Search URL Search Domain Scan URL

URL: https://www.bitdefender.com/business/hypervisor-introspection.html
Title: Bitdefender Hypervisor Introspection

Search URL Search Domain Scan URL

URL: https://www.bitdefender.com/business/renew/?icid=NA_quickrenew2015_hotforsecurity_footer
Title: Renewal for Business Customers

Search URL Search Domain Scan URL

URL: https://www.bitdefender.com/Downloads/
Title: Trial Downloads

Search URL Search Domain Scan URL

URL: https://www.bitdefender.com/solutions/free.html
Title: Free Antivirus

Search URL Search Domain Scan URL

URL: https://www.bitdefender.com/scanner/online/free.html
Title: Free Online Virus Scanner

Search URL Search Domain Scan URL

URL: https://www.bitdefender.com/free-virus-removal/
Title: Free Virus Removal Tools

Search URL Search Domain Scan URL

URL: https://www.bitdefender.com/remote/
Title: Live Remote Assistance

Search URL Search Domain Scan URL

URL: https://www.bitdefender.com/toolbox/
Title: Free Tools

Search URL Search Domain Scan URL

URL: https://www.bitdefender.com/site/view/bug-bounty.html
Title: Bug Bounty

Search URL Search Domain Scan URL

URL: https://www.bitdefender.com/news/
Title: Press Center

Search URL Search Domain Scan URL

URL: https://www.bitdefender.com/
Title: Bitdefender - a leading cyber security technology provider

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 33

https://bitdefender.demdex.net/id?d_visid_ver=5.0.1&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=0E920C0F53DA9E9B0A490D45%40AdobeOrg&d_nsid=0&d_coop_safe=1&ts=1600386824845 HTTP 302
https://bitdefender.demdex.net/id/rd?d_visid_ver=5.0.1&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=0E920C0F53DA9E9B0A490D45%40AdobeOrg&d_nsid=0&d_coop_safe=1&ts=1600386824845

Request Chain 38

https://fullstory.com/s/fs.js HTTP 301
https://edge.fullstory.com/s/fs.js

Request Chain 54

https://cm.everesttech.net/cm/dd?d_uuid=91771282364293634101613545754895664405 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=X2P3CQAABQO0fS3-

Request Chain 59

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=359890&url=https%3A%2F%2Fhotforsecurity.bitdefender.com%2Fblog%2Fwordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html&time=1600386825256 HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D359890%26url%3Dhttps%253A%252F%252Fhotforsecurity.bitdefender.com%252Fblog%252Fwordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html%26time%3D1600386825256%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=359890&url=https%3A%2F%2Fhotforsecurity.bitdefender.com%2Fblog%2Fwordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html&time=1600386825256&liSync=true

Request Chain 71

https://match.prod.bidr.io/cookie-sync/demandbase HTTP 303
https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1 HTTP 303
https://segments.company-target.com/log?vendor=choca&user_id=AATFcU6-x-4AABBh3icOFw HTTP 303
https://segments.company-target.com/validateCookie?vendor=choca&user_id=AATFcU6-x-4AABBh3icOFw&verifyHash=7defe6440c24cd5a3550667c97af0779e802a6d6

74 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html Show response
hotforsecurity.bitdefender.com/blog/ 97 KB
20 KB 1232ms
1201ms Document
text/html 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d2727c328499f041006d5d595f86fb080bad6646a3a741eef2ca30a7a5a722bd

Request headers

:method: GET
:authority: hotforsecurity.bitdefender.com
:scheme: https
:path: /blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Thu, 17 Sep 2020 23:53:44 GMT
content-type: text/html; charset=UTF-8
set-cookie: __cfduid=db974974904a2821d2f6ee8f570c377fc1600386823; expires=Sat, 17-Oct-20 23:53:43 GMT; path=/; domain=.bitdefender.com; HttpOnly; SameSite=Lax
link: <https://hotforsecurity.bitdefender.com/wp-json/>; rel="https://api.w.org/" <https://hotforsecurity.bitdefender.com/wp-json/wp/v2/posts/24048>; rel="alternate"; type="application/json" <https://hotforsecurity.bitdefender.com/?p=24048>; rel=shortlink
cf-cache-status: DYNAMIC
cf-request-id: 0540160d5600001f450681e200000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 5d46bf8efc071f45-FRA
content-encoding: gzip

GET
H2 200 wp-emoji-release.min.js Show response
hotforsecurity.bitdefender.com/wp-includes/js/ 14 KB
5 KB 64ms
60ms Script
text/javascript 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hotforsecurity.bitdefender.com/wp-includes/js/wp-emoji-release.min.js?ver=5.5.1
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8cb438bd4d1961f80ade4f1a295ca7de253630adcdd10473932908e638908c5e

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 17 Sep 2020 23:53:44 GMT
content-encoding: gzip
cf-cache-status: REVALIDATED
last-modified: Mon, 07 Sep 2020 12:09:49 GMT
server: cloudflare
etag: W/"60bba-37a6-5aeb81857c3f3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cf-ray: 5d46bf96acd51f45-FRA
cf-request-id: 054016122700001f4506843200000001

GET
H2 200 style.min.css
hotforsecurity.bitdefender.com/wp-includes/css/dist/block-library/ 53 KB
8 KB 68ms
63ms Stylesheet
text/css 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hotforsecurity.bitdefender.com/wp-includes/css/dist/block-library/style.min.css?ver=5.5.1
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8c626f0f9b5c109539b256b73e72c02b300a184f46b4535c2eb86599215c78af

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 17 Sep 2020 23:53:44 GMT
content-encoding: gzip
cf-cache-status: REVALIDATED
last-modified: Mon, 07 Sep 2020 12:09:50 GMT
server: cloudflare
etag: W/"140eb8-d293-5aeb8186c45f3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cf-ray: 5d46bf96acde1f45-FRA
cf-request-id: 054016122b00001f4506844200000001

GET
H2 200 styles.css
hotforsecurity.bitdefender.com/wp-content/plugins/contact-form-7/includes/css/ 1 KB
746 B 74ms
69ms Stylesheet
text/css 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hotforsecurity.bitdefender.com/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.1.3
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 382fe3dd880202e9e2971b7ae531720bc1bf2bb68decbc507d04e64b62531f44

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 17 Sep 2020 23:53:44 GMT
content-encoding: gzip
cf-cache-status: REVALIDATED
last-modified: Mon, 10 Jun 2019 12:23:43 GMT
server: cloudflare
etag: W/"91943-695-58af74046da4e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cf-polished: origSize=1685
cf-ray: 5d46bf96acdf1f45-FRA
cf-request-id: 054016122c00001f4506845200000001
cf-bgj: minify

GET
H2 200 front.min.css
hotforsecurity.bitdefender.com/wp-content/plugins/cookie-notice/css/ 3 KB
1 KB 21ms
16ms Stylesheet
text/css 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hotforsecurity.bitdefender.com/wp-content/plugins/cookie-notice/css/front.min.css?ver=5.5.1
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: db7e27157a918cd3ebf833e1544924cab8837dbcaebe9e00989020ad3e43283d

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 17 Sep 2020 23:53:44 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Wed, 30 Jan 2019 09:26:41 GMT
server: cloudflare
age: 1442
etag: W/"16003d-c04-580a981f1b6ab"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cf-ray: 5d46bf96ace01f45-FRA
cf-request-id: 054016122c00001f4506846200000001

GET
H2 200 simple-line-icons.css
hotforsecurity.bitdefender.com/wp-content/plugins/meks-flexible-shortcodes/css/simple-line/ 9 KB
2 KB 68ms
64ms Stylesheet
text/css 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hotforsecurity.bitdefender.com/wp-content/plugins/meks-flexible-shortcodes/css/simple-line/simple-line-icons.css?ver=1.3.1
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ddb5f37e49e5bb129115dc56bf737c89b3a27770107d3c24abe60b2cec84460e

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 17 Sep 2020 23:53:44 GMT
content-encoding: gzip
cf-cache-status: REVALIDATED
last-modified: Wed, 27 Sep 2017 12:29:25 GMT
server: cloudflare
etag: W/"140269-2d25-55a2af13b3885"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cf-polished: origSize=11557
cf-ray: 5d46bf96ace11f45-FRA
cf-request-id: 054016122c00001f4506847200000001
cf-bgj: minify

GET
H2 200 style.css
hotforsecurity.bitdefender.com/wp-content/plugins/meks-flexible-shortcodes/css/ 11 KB
2 KB 22ms
17ms Stylesheet
text/css 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hotforsecurity.bitdefender.com/wp-content/plugins/meks-flexible-shortcodes/css/style.css?ver=1.3.1
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8ee6a829478761f158d239ceb4dd636ae4e703dc1970057c71628549d1de6d14

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 17 Sep 2020 23:53:44 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Wed, 27 Sep 2017 12:29:25 GMT
server: cloudflare
age: 1442
etag: W/"140261-3c15-55a2af13b2ccd"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cf-polished: origSize=15381
cf-ray: 5d46bf96ace31f45-FRA
cf-request-id: 054016122c00001f4506848200000001
cf-bgj: minify

GET
H2 200 socialfans-style.css
hotforsecurity.bitdefender.com/wp-content/plugins/socialfans-counter/assets/css/ 114 KB
13 KB 37ms
32ms Stylesheet
text/css 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hotforsecurity.bitdefender.com/wp-content/plugins/socialfans-counter/assets/css/socialfans-style.css?ver=4.5
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e4e3e93e78b70bc6e4a01cd3669047ccc88f0c8df0383ade180909c0f2870580

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 17 Sep 2020 23:53:44 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Wed, 15 Feb 2017 22:44:30 GMT
server: cloudflare
age: 1442
etag: W/"160123-1ffd4-548996c6f8f80"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cf-polished: origSize=131028
cf-ray: 5d46bf96ace41f45-FRA
cf-request-id: 054016122c00001f4506849200000001
cf-bgj: minify

GET
H2 200 font-awesome.min.css
hotforsecurity.bitdefender.com/wp-content/plugins/socialfans-counter/assets/css/ 28 KB
6 KB 71ms
67ms Stylesheet
text/css 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hotforsecurity.bitdefender.com/wp-content/plugins/socialfans-counter/assets/css/font-awesome.min.css?ver=4.5
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e07021158049cd2c874f0aa3c3eb60c126414affb59e7185838dcc62531406a0

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 17 Sep 2020 23:53:44 GMT
content-encoding: gzip
cf-cache-status: REVALIDATED
last-modified: Thu, 23 Jun 2016 01:20:54 GMT
server: cloudflare
etag: W/"160112-7152-535e7dd88c980"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cf-ray: 5d46bf96ace61f45-FRA
cf-request-id: 054016122c00001f450684a200000001

GET
H2 200 wen-call-to-action-public.min.css
hotforsecurity.bitdefender.com/wp-content/plugins/wen-call-to-action/public/css/ 950 B
445 B 64ms
60ms Stylesheet
text/css 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hotforsecurity.bitdefender.com/wp-content/plugins/wen-call-to-action/public/css/wen-call-to-action-public.min.css?ver=1.2.0
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e1ae4fa36b6ad8f568dd6e04e1e8d5ff9fa87b2f35d90992313eff26eedcb486

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 17 Sep 2020 23:53:44 GMT
content-encoding: gzip
cf-cache-status: REVALIDATED
last-modified: Tue, 06 Sep 2016 11:04:08 GMT
server: cloudflare
etag: W/"861a7-3b6-53bd4c1776c8e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cf-ray: 5d46bf96acea1f45-FRA
cf-request-id: 054016122c00001f450684b200000001

GET
H2 200 inline-tweet-sharer.css
hotforsecurity.bitdefender.com/wp-content/plugins/inline-tweet-sharer/ 623 B
385 B 62ms
58ms Stylesheet
text/css 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hotforsecurity.bitdefender.com/wp-content/plugins/inline-tweet-sharer/inline-tweet-sharer.css?ver=2.3.1
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3c502ab7dd81c6a775f58e6b0a866befc8c444377d8a8ec4c07b03063db34834

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 17 Sep 2020 23:53:44 GMT
content-encoding: gzip
cf-cache-status: REVALIDATED
last-modified: Mon, 10 Jun 2019 12:23:47 GMT
server: cloudflare
etag: W/"91895-35a-58af74087fa2e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cf-polished: origSize=858
cf-ray: 5d46bf96acec1f45-FRA
cf-request-id: 054016122c00001f450684c200000001
cf-bgj: minify

GET
H2 200 dashicons.min.css
hotforsecurity.bitdefender.com/wp-includes/css/ 58 KB
35 KB 66ms
62ms Stylesheet
text/css 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hotforsecurity.bitdefender.com/wp-includes/css/dashicons.min.css?ver=5.5.1
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dc1a3a3bf97eada084f65b5d87085ddb8d3a76a9e450c6a41211e1698048de91

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 17 Sep 2020 23:53:44 GMT
content-encoding: gzip
cf-cache-status: REVALIDATED
last-modified: Mon, 07 Sep 2020 12:09:50 GMT
server: cloudflare
etag: W/"656fa-e681-5aeb81869a22b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cf-ray: 5d46bf96aced1f45-FRA
cf-request-id: 054016122c00001f450684d200000001

GET
H2 200 css
fonts.googleapis.com/ 7 KB
821 B 18ms
15ms Stylesheet
text/css 2a00:1450:4001:819::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A400%2C300%2C700&subset=latin%2Clatin-ext&ver=2.0

Requested by

Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

d0cbfb1ab0f94123834567e32df7ec74a1c210793f797368d41a4b4c2732d4a0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 17 Sep 2020 23:53:44 GMT
server: ESF
date: Thu, 17 Sep 2020 23:53:44 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 17 Sep 2020 23:53:44 GMT

GET
H2 200 min.css
hotforsecurity.bitdefender.com/wp-content/themes/herald/assets/css/ 209 KB
34 KB 38ms
35ms Stylesheet
text/css 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hotforsecurity.bitdefender.com/wp-content/themes/herald/assets/css/min.css?ver=2.0
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0bafb2bfda20c5019c125a7f3bb4d7c51abf848201dd589e5cd67d0070f8b58a

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 17 Sep 2020 23:53:44 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 12 Feb 2018 12:26:01 GMT
server: cloudflare
age: 6282
etag: W/"913b3-3455b-56502fb292e56"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cf-polished: origSize=214363
cf-ray: 5d46bf96acef1f45-FRA
cf-request-id: 054016122c00001f450684e200000001
cf-bgj: minify

GET
H2 200 style.css
hotforsecurity.bitdefender.com/wp-content/plugins/meks-smart-author-widget/css/ 205 B
287 B 69ms
65ms Stylesheet
text/css 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hotforsecurity.bitdefender.com/wp-content/plugins/meks-smart-author-widget/css/style.css?ver=1.1.1
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e15d1f89cbc821b0605f601a862e07b8e1b77075ece6439d726768183c4ec9de

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 17 Sep 2020 23:53:44 GMT
content-encoding: gzip
cf-cache-status: REVALIDATED
last-modified: Wed, 01 Nov 2017 15:56:11 GMT
server: cloudflare
etag: W/"140012-f5-55cede917491b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cf-polished: origSize=245
cf-ray: 5d46bf96acf01f45-FRA
cf-request-id: 054016122c00001f450684f200000001
cf-bgj: minify

GET
H2 200 style.css
hotforsecurity.bitdefender.com/wp-content/plugins/meks-smart-social-widget/css/ 34 KB
5 KB 79ms
76ms Stylesheet
text/css 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hotforsecurity.bitdefender.com/wp-content/plugins/meks-smart-social-widget/css/style.css?ver=1.4
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3e0383e88d2588eac46cae98bdbc97d681f0ed2540059dbf1106b2d85f92a38d

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 17 Sep 2020 23:53:44 GMT
content-encoding: gzip
cf-cache-status: REVALIDATED
last-modified: Fri, 05 Apr 2019 10:30:38 GMT
server: cloudflare
etag: W/"90d10-a569-585c5fa5741fc"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cf-polished: origSize=42345
cf-ray: 5d46bf96acf21f45-FRA
cf-request-id: 054016122c00001f4506850200000001
cf-bgj: minify

GET
H2 200 frontend-builder-plugin-style.min.css
hotforsecurity.bitdefender.com/wp-content/plugins/divi-builder/includes/builder/styles/ 643 KB
54 KB 36ms
33ms Stylesheet
text/css 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hotforsecurity.bitdefender.com/wp-content/plugins/divi-builder/includes/builder/styles/frontend-builder-plugin-style.min.css?ver=2.24
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c0c7ff312fbaf1ee09e030009f39eef707d97de32504fd2b3ef3e0ec7c5b60f1

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 17 Sep 2020 23:53:44 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 10 Jun 2019 12:23:44 GMT
server: cloudflare
age: 6282
etag: W/"91fea-a0b41-58af74059c226"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cf-ray: 5d46bf96acf31f45-FRA
cf-request-id: 054016122c00001f4506851200000001

GET
H2 200 jquery.js Show response
hotforsecurity.bitdefender.com/wp-includes/js/jquery/ 95 KB
33 KB 25ms
22ms Script
text/javascript 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hotforsecurity.bitdefender.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 17 Sep 2020 23:53:44 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 10 Jun 2019 12:20:45 GMT
server: cloudflare
age: 6282
etag: W/"60b33-17a69-58af735a5e3e6"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cf-ray: 5d46bf96acf41f45-FRA
cf-request-id: 054016122c00001f4506852200000001

GET
H2 200 front.min.js Show response
hotforsecurity.bitdefender.com/wp-content/plugins/cookie-notice/js/ 5 KB
1 KB 68ms
65ms Script
text/javascript 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hotforsecurity.bitdefender.com/wp-content/plugins/cookie-notice/js/front.min.js?ver=1.2.46
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b82eefb6a4f332f80cf77897057def50d542447398557c6be322d86a3ebe613b

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 17 Sep 2020 23:53:44 GMT
content-encoding: gzip
cf-cache-status: REVALIDATED
last-modified: Wed, 30 Jan 2019 09:26:41 GMT
server: cloudflare
etag: W/"160037-14f0-580a981f1aedb"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cf-ray: 5d46bf96acf61f45-FRA
cf-request-id: 054016122c00001f4506853200000001

GET
H2 200 main.js Show response
hotforsecurity.bitdefender.com/wp-content/plugins/meks-flexible-shortcodes/js/ 3 KB
920 B 71ms
68ms Script
text/javascript 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hotforsecurity.bitdefender.com/wp-content/plugins/meks-flexible-shortcodes/js/main.js?ver=1.3.1
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 12229fc93eb6a5572501671207da32beb14c969a0f78bd2ed4bdf254cac1ffd1

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 17 Sep 2020 23:53:44 GMT
content-encoding: gzip
cf-cache-status: REVALIDATED
last-modified: Wed, 27 Sep 2017 12:29:25 GMT
server: cloudflare
etag: W/"14025f-dc9-55a2af13b28e5"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cf-ray: 5d46bf96acf71f45-FRA
cf-request-id: 054016122c00001f4506854200000001

GET
H2 200 frontend.js Show response
hotforsecurity.bitdefender.com/wp-content/plugins/stop-user-enumeration/frontend/js/ 232 B
315 B 64ms
62ms Script
text/javascript 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hotforsecurity.bitdefender.com/wp-content/plugins/stop-user-enumeration/frontend/js/frontend.js?ver=1.3.22
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 84f7bdd9d518f244e12254d2dab2827a56fa1c0be95dd685178105518fdd94d2

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 17 Sep 2020 23:53:44 GMT
content-encoding: gzip
cf-cache-status: REVALIDATED
last-modified: Fri, 19 Jul 2019 09:44:22 GMT
server: cloudflare
etag: W/"9171d-e8-58e05922df320"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cf-ray: 5d46bf96acf81f45-FRA
cf-request-id: 054016122c00001f4506855200000001

GET
H2 200 inline-tweet-sharer.js Show response
hotforsecurity.bitdefender.com/wp-content/plugins/inline-tweet-sharer/ 349 B
355 B 76ms
74ms Script
text/javascript 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hotforsecurity.bitdefender.com/wp-content/plugins/inline-tweet-sharer/inline-tweet-sharer.js?ver=2.3.1
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3aca6f2b898088dab64aaba8faa7d6d90dabaa257a2e2d906832137efda5dcf9

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 17 Sep 2020 23:53:44 GMT
content-encoding: gzip
cf-cache-status: REVALIDATED
last-modified: Mon, 10 Jun 2019 12:23:47 GMT
server: cloudflare
etag: W/"918a2-15d-58af74087fe16"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cf-ray: 5d46bf96acf91f45-FRA
cf-request-id: 054016122c00001f4506856200000001

GET
H2 200 satelliteLib-3a8d5287cf775324dc6c68719a1ddc96c5a139ba.js Show response
assets.adobedtm.com/4b7ac0a30c6cfe2deb06368f62d41f996c29744e/ 241 KB
53 KB 30ms
15ms Script
application/x-javascript 2a02:26f0:6c00:28a::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/4b7ac0a30c6cfe2deb06368f62d41f996c29744e/satelliteLib-3a8d5287cf775324dc6c68719a1ddc96c5a139ba.js
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:28a::1e80 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 862d25e6731d8163d089dc54c7b5e7f658c2735d726f3765d2c8b492566e85e6

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 17 Sep 2020 23:53:44 GMT
content-encoding: gzip
last-modified: Fri, 28 Aug 2020 07:47:09 GMT
server: AkamaiNetStorage
status: 200
etag: "e49e21021330a324d601ecb73700d496:1598600829.411212"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://hotforsecurity.bitdefender.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 18 Sep 2020 00:53:44 GMT

GET
H2 200 h4s.png
hotforsecurity.bitdefender.com/wp-content/uploads/2016/07/ 21 KB
21 KB 62ms
60ms Image
image/png 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hotforsecurity.bitdefender.com/wp-content/uploads/2016/07/h4s.png
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e4f237433fef48f03ba6d84f2677528e1a555fd7956d3b01e09e79d2b326f57d

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 17 Sep 2020 23:53:45 GMT
cf-cache-status: REVALIDATED
last-modified: Tue, 05 Jul 2016 10:34:14 GMT
server: cloudflare
etag: "8a9cc-54c6-536e0fe811580"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 5d46bf985eac1f45-FRA
content-length: 21702
cf-request-id: 054016133500001f4506864200000001

GET
H2 200 wp-file-manager-800x420.jpeg
hotforsecurity.bitdefender.com/wp-content/uploads/2020/09/ 60 KB
60 KB 59ms
57ms Image
image/jpeg 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hotforsecurity.bitdefender.com/wp-content/uploads/2020/09/wp-file-manager-800x420.jpeg
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f9fd92d837373a6762b0b91f80f038ddcf08ee3a2a46efc7dbbe66320008fb07

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 17 Sep 2020 23:53:45 GMT
cf-cache-status: REVALIDATED
last-modified: Wed, 02 Sep 2020 16:21:32 GMT
server: cloudflare
etag: "222743-f001-5ae570760a310"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
status: 200
accept-ranges: bytes
cf-ray: 5d46bf985eae1f45-FRA
content-length: 61441
cf-request-id: 054016133500001f4506865200000001
cf-bgj: h2pri

GET
H2 200 ads.js Show response
www.bitdefender.com/themes/draco/scripts/ 65 B
281 B 856ms
840ms Script
application/x-javascript 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bitdefender.com/themes/draco/scripts/ads.js
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e6ea464d3d20c2a23b116f868ba8e02e8f79580632cfa26d7721026a49d66b31

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: public
date: Thu, 17 Sep 2020 23:53:45 GMT
content-encoding: gzip
cf-cache-status: MISS
last-modified: Tue, 20 Dec 2016 09:43:19 GMT
server: cloudflare
status: 200
etag: W/"5858fd37-41"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 5d46bf973d871f45-FRA
cf-request-id: 054016128600001f450685a200000001

GET
H2 200 generalDigitalData Show response
www.bitdefender.com/site/Main/ 32 KB
7 KB 273ms
260ms Script
application/javascript 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bitdefender.com/site/Main/generalDigitalData?p=/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html&t=single&dl=en&h=hot4sec.rbx.ovh.bitdefender.net&s=hotforsecurity.bitdefender.com&err=

Requested by

Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dbf0fbbf5d89d767d911d99bd4d56fab45682d60a8e337ea9367e02879bd1950

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Sep 2020 23:53:45 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=63072000; includeSubdomains; preload
content-type: application/javascript
status: 200
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray: 5d46bf973d881f45-FRA
cf-request-id: 054016128600001f450685b200000001
expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H2 200 jquery.adrotate.clicktracker.js Show response
hotforsecurity.bitdefender.com/wp-content/plugins/adrotate/library/ 1 KB
695 B 16ms
13ms Script
text/javascript 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hotforsecurity.bitdefender.com/wp-content/plugins/adrotate/library/jquery.adrotate.clicktracker.js
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2f64b025cec8c93dcb01fe88f0e79c134bc0a6c751787360153865dfa9f3a962

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 17 Sep 2020 23:53:45 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Fri, 19 Jul 2019 09:44:21 GMT
server: cloudflare
age: 6283
etag: W/"91626-40b-58e059224b3f0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cf-ray: 5d46bf985ea41f45-FRA
cf-request-id: 054016133400001f450685d200000001

GET
H2 200 scripts.js Show response
hotforsecurity.bitdefender.com/wp-content/plugins/contact-form-7/includes/js/ 14 KB
4 KB 61ms
58ms Script
text/javascript 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hotforsecurity.bitdefender.com/wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=5.1.3
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b7e17926b30342edecee8b3a93029ac51462e2b479277d8e077ba57173eb1900

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 17 Sep 2020 23:53:45 GMT
content-encoding: gzip
cf-cache-status: REVALIDATED
last-modified: Mon, 10 Jun 2019 12:23:43 GMT
server: cloudflare
etag: W/"91932-3868-58af74046ce96"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cf-ray: 5d46bf985ea51f45-FRA
cf-request-id: 054016133400001f450685e200000001

GET
H2 200 socialfans-script.js Show response
hotforsecurity.bitdefender.com/wp-content/plugins/socialfans-counter/assets/js/ 7 KB
2 KB 67ms
65ms Script
text/javascript 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hotforsecurity.bitdefender.com/wp-content/plugins/socialfans-counter/assets/js/socialfans-script.js?ver=4.5
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 89b026459d5ad9b78afcd0ba868276048e24e67d75bf0737e08e33552edb3cee

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 17 Sep 2020 23:53:45 GMT
content-encoding: gzip
cf-cache-status: REVALIDATED
last-modified: Wed, 15 Feb 2017 22:44:30 GMT
server: cloudflare
etag: W/"160136-1d23-548996c6f8f80"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cf-ray: 5d46bf985ea61f45-FRA
cf-request-id: 054016133400001f450685f200000001

GET
H2 200 min.js Show response
hotforsecurity.bitdefender.com/wp-content/themes/herald/assets/js/ 94 KB
27 KB 23ms
21ms Script
text/javascript 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hotforsecurity.bitdefender.com/wp-content/themes/herald/assets/js/min.js?ver=2.0
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1d13655d1693b0b46340f6b5391c0154b6566fcfe95741d40674ae9a1b5a0293

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 17 Sep 2020 23:53:45 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 12 Feb 2018 12:26:01 GMT
server: cloudflare
age: 6283
etag: W/"913a1-178be-56502fb29229e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cf-ray: 5d46bf985ea71f45-FRA
cf-request-id: 054016133400001f4506860200000001

GET
H2 200 divi-builder.min.js Show response
hotforsecurity.bitdefender.com/wp-content/plugins/divi-builder/js/ 209 KB
49 KB 23ms
21ms Script
text/javascript 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hotforsecurity.bitdefender.com/wp-content/plugins/divi-builder/js/divi-builder.min.js?ver=2.24
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8f1495396c589ea4cd4497c74fe9e218e9913e38504847ad4361d12d7b13bda9

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 17 Sep 2020 23:53:45 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 10 Jun 2019 12:23:44 GMT
server: cloudflare
age: 1443
etag: W/"91d4b-3444d-58af74057e596"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cf-ray: 5d46bf985ea81f45-FRA
cf-request-id: 054016133400001f4506861200000001

GET
H2 200 common.js Show response
hotforsecurity.bitdefender.com/wp-content/plugins/divi-builder/core/admin/js/ 1 KB
683 B 73ms
71ms Script
text/javascript 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hotforsecurity.bitdefender.com/wp-content/plugins/divi-builder/core/admin/js/common.js?ver=3.24
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c05ee8fac93fde19412046a913b9aecd86210aba6b72cff7c94e01170dd11e3b

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 17 Sep 2020 23:53:45 GMT
content-encoding: gzip
cf-cache-status: REVALIDATED
last-modified: Mon, 10 Jun 2019 12:23:44 GMT
server: cloudflare
etag: W/"91db3-550-58af740582fce"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cf-ray: 5d46bf985ea91f45-FRA
cf-request-id: 054016133400001f4506862200000001

GET
H2 200 wp-embed.min.js Show response
hotforsecurity.bitdefender.com/wp-includes/js/ 1 KB
901 B 58ms
57ms Script
text/javascript 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hotforsecurity.bitdefender.com/wp-includes/js/wp-embed.min.js?ver=5.5.1
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6ebcda7a3a41ef97f0b4071160ceb1020e540fdc0f790079a5c2ef01ab654fe0

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 17 Sep 2020 23:53:45 GMT
content-encoding: gzip
cf-cache-status: REVALIDATED
last-modified: Mon, 07 Sep 2020 12:09:49 GMT
server: cloudflare
etag: W/"64a65-59a-5aeb818605f13"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cf-ray: 5d46bf985eab1f45-FRA
cf-request-id: 054016133500001f4506863200000001

GET
H/1.1

200
OK

rd Show response
bitdefender.demdex.net/id/
Redirect Chain

https://bitdefender.demdex.net/id?d_visid_ver=5.0.1&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=0E920C0F53DA9E9B0A490D45%40AdobeOrg&d_nsid=0&d_coop_safe=1&ts=1600386824845
https://bitdefender.demdex.net/id/rd?d_visid_ver=5.0.1&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=0E920C0F53DA9E9B0A490D45%40AdobeOrg&d_nsid=0&d_coop_safe=1&ts=1600386824845

971 B
1 KB

35ms
34ms

XHR
application/json

52.49.47.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://bitdefender.demdex.net/id/rd?d_visid_ver=5.0.1&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=0E920C0F53DA9E9B0A490D45%40AdobeOrg&d_nsid=0&d_coop_safe=1&ts=1600386824845

Requested by

Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.49.47.228 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-49-47-228.eu-west-1.compute.amazonaws.com

Software

Resource Hash

e527753dd01da7b8f6a6feeae7474c9b8099870ebbf1ea1dacc31f07b10ac8de

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

DCS: dcs-prod-irl1-v081-0383eea97.edge-irl1.demdex.com 5.78.0.20200908113611 2ms (+0ms)
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
X-TID: WjujYegRSLw=
Vary: Origin, Accept-Encoding, User-Agent
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://hotforsecurity.bitdefender.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 515
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Access-Control-Allow-Origin: https://hotforsecurity.bitdefender.com
X-TID: C2zrRu0rTkA=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://bitdefender.demdex.net/id/rd?d_visid_ver=5.0.1&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=0E920C0F53DA9E9B0A490D45%40AdobeOrg&d_nsid=0&d_coop_safe=1&ts=1600386824845
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 mbox-contents-e392e41418bacceda95c05b2c49657ebca0324a2.js Show response
assets.adobedtm.com/4b7ac0a30c6cfe2deb06368f62d41f996c29744e/ 92 KB
31 KB 8ms
8ms Script
application/x-javascript 2a02:26f0:6c00:28a::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/4b7ac0a30c6cfe2deb06368f62d41f996c29744e/mbox-contents-e392e41418bacceda95c05b2c49657ebca0324a2.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/4b7ac0a30c6cfe2deb06368f62d41f996c29744e/satelliteLib-3a8d5287cf775324dc6c68719a1ddc96c5a139ba.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:28a::1e80 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 159526f78a28685850dc55b5b8776267c1b242fd12504e7d8e7e838b22a849cd

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Thu, 17 Sep 2020 23:53:44 GMT
content-encoding: gzip
last-modified: Thu, 16 Jul 2020 12:49:54 GMT
server: AkamaiNetStorage
status: 200
etag: "d66c216299277839f6ed2f2b6e4c2b90:1594903794.35391"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://hotforsecurity.bitdefender.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 31385
expires: Fri, 18 Sep 2020 00:53:44 GMT

GET
H2 200 satellite-5afad58064746d59a10078e2.js Show response
assets.adobedtm.com/4b7ac0a30c6cfe2deb06368f62d41f996c29744e/scripts/ 361 B
549 B 9ms
7ms Script
application/x-javascript 2a02:26f0:6c00:28a::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/4b7ac0a30c6cfe2deb06368f62d41f996c29744e/scripts/satellite-5afad58064746d59a10078e2.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/4b7ac0a30c6cfe2deb06368f62d41f996c29744e/satelliteLib-3a8d5287cf775324dc6c68719a1ddc96c5a139ba.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:28a::1e80 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 3426d7ced4ac00288838068e457aca4d7804c1e5e9a92ef61a858d3e97fae4f6

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 17 Sep 2020 23:53:45 GMT
content-encoding: gzip
last-modified: Tue, 04 Aug 2020 14:08:10 GMT
server: AkamaiNetStorage
status: 200
etag: "50f093ab328808186f4c389066a15557:1596550090.643657"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://hotforsecurity.bitdefender.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 273
expires: Fri, 18 Sep 2020 00:53:45 GMT

GET
H2 200 ee38c350.min.js Show response
scripts.demandbase.com/adobeanalytics/ 5 KB
2 KB 77ms
23ms Script
application/javascript 143.204.201.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://scripts.demandbase.com/adobeanalytics/ee38c350.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/4b7ac0a30c6cfe2deb06368f62d41f996c29744e/satelliteLib-3a8d5287cf775324dc6c68719a1ddc96c5a139ba.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.201.47 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-201-47.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 483741ab3576b4cdf24b73a2f017ea6e20468471b387cc484eccee5fd1fd1cb4

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

x-amz-version-id: N.PIJWfZDnfeciwZpz.LPjhMyH.wV0Gb
content-encoding: gzip
last-modified: Wed, 08 Jan 2020 23:59:25 GMT
server: AmazonS3
age: 76303
etag: "2023fd9ed69b2ab1edf55023bfaaa06e"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
date: Thu, 17 Sep 2020 02:42:02 GMT
x-amz-cf-pop: FRA53-C1
x-amz-cf-id: QEu5P_m7Uf4G1CV3RM7aFCrQ5K1dNp7D8XqcsS3Hpj9QKQXFQeBEAg==
via: 1.1 850ccace60916919bf31313cb9176e01.cloudfront.net (CloudFront)

GET
H2 200 ip.json Show response
api.company-target.com/api/v2/ 464 B
720 B 152ms
83ms Script
application/javascript 99.84.144.62
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.company-target.com/api/v2/ip.json?key=b7702e4099c19fbb2580e68d489df700&callback=Dmdbase_CDC.callback
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/4b7ac0a30c6cfe2deb06368f62d41f996c29744e/satelliteLib-3a8d5287cf775324dc6c68719a1ddc96c5a139ba.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.144.62 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-144-62.txl52.r.cloudfront.net
Software: nginx /
Resource Hash: 58205d75a762322da5bbc678933948ff2c395fb5683e5453d094420aee24b030

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Thu, 17 Sep 2020 23:53:44 GMT
identification-source: CENTRAL
x-amz-cf-pop: TXL52-C1
x-cache: Miss from cloudfront
status: 200
request-id: f1515cac-d03b-4ff9-ab53-5c46030203a4
content-encoding: gzip
pragma: no-cache
server: nginx
vary: Accept-Encoding, Origin
content-type: application/javascript;charset=utf-8
via: 1.1 df2b5b3f847bbe9ad7f475c0831bcc3a.cloudfront.net (CloudFront)
cache-control: no-cache, no-store, max-age=0, must-revalidate
api-version: v2
x-amz-cf-id: -74_YrxpS5n2YTyCeN1aF84rGgW70I7PXPhTznyXTkxQB1BZka5Iag==
expires: Wed, 16 Sep 2020 23:53:44 GMT

GET
H2

200

fs.js Show response
edge.fullstory.com/s/
Redirect Chain

https://fullstory.com/s/fs.js
https://edge.fullstory.com/s/fs.js

201 KB
61 KB

67ms
21ms

Script
application/javascript

35.201.112.186
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://edge.fullstory.com/s/fs.js
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.112.186 , Ascension Island, ASN15169 (GOOGLE, US),
Reverse DNS: 186.112.201.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: d7b38fb952a78e6eb880a5bd612db89e572edf28a14f63830744bd97856e5dc5

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 17 Sep 2020 23:50:56 GMT
content-encoding: gzip
age: 169
x-guploader-uploadid: ABg5-Uwm5hIMRozQov3iJnNFM-d3RRJ-Moa4rnxR_Fr4NTleGE43Fjs_Fb3YSKplgAaACU_xa9yp632JcZdasL3RSpOSmydmqg
x-goog-storage-class: MULTI_REGIONAL
status: 200
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
alt-svc: clear
content-length: 61619
last-modified: Wed, 09 Sep 2020 14:43:45 GMT
server: UploadServer
etag: "2d5677ac529501af1cd3b383127ad5df"
x-goog-hash: crc32c=vmbjRA==, md5=LVZ3rFKVAa8c07ODEnrV3w==
x-goog-generation: 1599662625306900
access-control-allow-origin: *
cache-control: public, max-age=600,no-transform
x-goog-stored-content-length: 61619
accept-ranges: bytes
content-type: application/javascript
expires: Fri, 18 Sep 2020 00:00:56 GMT

Redirect headers

date: Fri, 11 Sep 2020 23:45:04 GMT
via: 1.1 google
age: 518921
status: 301
location: https://edge.fullstory.com/s/fs.js
access-control-allow-origin: *
cache-control: public, max-age=31536000
strict-transport-security: max-age=63072000
timing-allow-origin: *
alt-svc: clear
content-length: 0

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 45 KB
18 KB 7ms
5ms Script
text/javascript 2a00:1450:4001:81a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

60863e86aa7743d1ac841da7f473a05cd57fba81d661cef658e385437f80d5ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 09 Sep 2020 01:50:37 GMT
server: Golfe2
age: 2285
date: Thu, 17 Sep 2020 23:15:40 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18650
expires: Fri, 18 Sep 2020 01:15:40 GMT

GET
H2 200 hotforsecurity.jpg
hotforsecurity.bitdefender.com/wp-content/uploads/2019/10/ 481 KB
481 KB 16ms
16ms Image
image/jpeg 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hotforsecurity.bitdefender.com/wp-content/uploads/2019/10/hotforsecurity.jpg
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e0971026066e53fcd75d7f54008d457c621f42ff371ccfc3075684efc7405d8a

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 17 Sep 2020 23:53:45 GMT
cf-cache-status: HIT
last-modified: Thu, 31 Oct 2019 13:28:25 GMT
server: cloudflare
age: 7094
etag: "21662-782ca-59634d2f678bb"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
status: 200
accept-ranges: bytes
cf-ray: 5d46bf986ec51f45-FRA
content-length: 492234
cf-request-id: 054016133e00001f4506866200000001
cf-bgj: h2pri

GET
H2 200 dragon.png
download.bitdefender.com/resources/themes/draco/images/ 140 KB
140 KB 65ms
17ms Image
image/png 192.229.220.142
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://download.bitdefender.com/resources/themes/draco/images/dragon.png

Requested by

Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.220.142 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (ama/8B62) /

Resource Hash

4d0d2a0d54d25d91923590d3383b8aac038fa588a499df562598fd18064c88df

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN *.bitdefender.com

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 17 Sep 2020 23:53:45 GMT
last-modified: Sat, 20 Jan 2018 04:07:08 GMT
server: ECAcc (ama/8B62)
age: 14096
status: 200
etag: "5a62c06c-22fc8"
x-frame-options: SAMEORIGIN *.bitdefender.com
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=7200
accept-ranges: bytes
content-length: 143304
expires: Fri, 18 Sep 2020 01:53:45 GMT

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v20/ 11 KB
11 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C300%2C700&subset=latin%2Clatin-ext&ver=2.0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0d9fd7ccabde9b202de45ee6b65878ce9594975d8e8810b0878d3f3fa3637d0e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://hotforsecurity.bitdefender.com
Referer: https://fonts.googleapis.com/css?family=Roboto%3A400%2C300%2C700&subset=latin%2Clatin-ext&ver=2.0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 14 Sep 2020 09:03:56 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:18:58 GMT
server: sffe
age: 312589
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11020
x-xss-protection: 0
expires: Tue, 14 Sep 2021 09:03:56 GMT

GET
H2 200 fontawesome-webfont.woff2
hotforsecurity.bitdefender.com/wp-content/themes/herald/assets/fonts/ 75 KB
76 KB 62ms
62ms Font
application/octet-stream 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hotforsecurity.bitdefender.com/wp-content/themes/herald/assets/fonts/fontawesome-webfont.woff2?v=4.7.0
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/wp-content/themes/herald/assets/css/min.css?ver=2.0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d792afdac7f7ae5de7c6964950c6c61dc6e3f3813180a59e141c7cb4ac4364dc

Request headers

Origin: https://hotforsecurity.bitdefender.com
Referer: https://hotforsecurity.bitdefender.com/wp-content/themes/herald/assets/css/min.css?ver=2.0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 17 Sep 2020 23:53:45 GMT
content-encoding: gzip
cf-cache-status: REVALIDATED
last-modified: Mon, 12 Feb 2018 12:26:01 GMT
server: cloudflare
etag: W/"91400-12d68-56502fb2a2086"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/plain; charset=UTF-8
status: 200
cf-ray: 5d46bf987ed11f45-FRA
cf-request-id: 054016134800001f4506867200000001

GET
H2 200 KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
fonts.gstatic.com/s/roboto/v20/ 11 KB
11 KB 7ms
5ms Font
font/woff2 2a00:1450:4001:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C300%2C700&subset=latin%2Clatin-ext&ver=2.0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://hotforsecurity.bitdefender.com
Referer: https://fonts.googleapis.com/css?family=Roboto%3A400%2C300%2C700&subset=latin%2Clatin-ext&ver=2.0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 14 Sep 2020 09:03:54 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:18:50 GMT
server: sffe
age: 312591
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11016
x-xss-protection: 0
expires: Tue, 14 Sep 2021 09:03:54 GMT

GET
H2 200 socialfans.woff
hotforsecurity.bitdefender.com/wp-content/plugins/socialfans-counter/assets/font/ 17 KB
17 KB 60ms
58ms Font
application/octet-stream 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hotforsecurity.bitdefender.com/wp-content/plugins/socialfans-counter/assets/font/socialfans.woff?v=4.5
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e5ad690c7a754826152d2ecab11de59d6d03326ff66af754860112601ca157c3

Request headers

Origin: https://hotforsecurity.bitdefender.com
Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 17 Sep 2020 23:53:45 GMT
content-encoding: gzip
cf-cache-status: REVALIDATED
last-modified: Thu, 29 Jan 2015 21:24:38 GMT
server: cloudflare
etag: W/"16012e-442c-50dd11d82f180"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/plain; charset=UTF-8
status: 200
cf-ray: 5d46bf987ed51f45-FRA
cf-request-id: 054016134b00001f4506868200000001

GET
H2 200 5fdc27b8b6f6fd69e77aa017a53cceb5
secure.gravatar.com/avatar/ 4 KB
4 KB 22ms
7ms Image
image/jpeg 2a04:fa87:fffe::c000:4902
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.gravatar.com/avatar/5fdc27b8b6f6fd69e77aa017a53cceb5?s=112&d=mm&r=g
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 52193931ee193d8ab70d0bb34f251f5849b092b783c2d671184a7853e86a040a

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT fra 3
date: Thu, 17 Sep 2020 23:53:45 GMT
last-modified: Thu, 18 Jun 2020 13:37:43 GMT
server: nginx
status: 200
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=300
content-disposition: inline; filename="5fdc27b8b6f6fd69e77aa017a53cceb5.jpeg"
accept-ranges: bytes
link: <https://www.gravatar.com/avatar/5fdc27b8b6f6fd69e77aa017a53cceb5?s=112&d=mm&r=g>; rel="canonical"
content-length: 4233
expires: Thu, 17 Sep 2020 23:58:45 GMT

GET
H2 200 wp-file-manager.jpeg
hotforsecurity.bitdefender.com/wp-content/uploads/2020/09/ 64 KB
64 KB 57ms
56ms Image
image/jpeg 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hotforsecurity.bitdefender.com/wp-content/uploads/2020/09/wp-file-manager.jpeg
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b47116dba01d7e6bac5d27ef84a0963de4fbe7ae36592fddda0c54a1fc8c8be2

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 17 Sep 2020 23:53:45 GMT
cf-cache-status: REVALIDATED
last-modified: Wed, 02 Sep 2020 16:21:30 GMT
server: cloudflare
etag: "21a81-fe2d-5ae57073e78f8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
status: 200
accept-ranges: bytes
cf-ray: 5d46bf994fd21f45-FRA
content-length: 65069
cf-request-id: 05401613cb00001f450686d200000001
cf-bgj: h2pri

GET
H2 200 us-dept-of-treasury-300x200.jpg
hotforsecurity.bitdefender.com/wp-content/uploads/2020/09/ 16 KB
17 KB 60ms
58ms Image
image/jpeg 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hotforsecurity.bitdefender.com/wp-content/uploads/2020/09/us-dept-of-treasury-300x200.jpg
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 306c9714fc0da628f79970bbcc854b8bbbda370dbf90fe73486330eab400be0e

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 17 Sep 2020 23:53:45 GMT
cf-cache-status: REVALIDATED
last-modified: Thu, 17 Sep 2020 13:41:03 GMT
server: cloudflare
etag: "222bb6-41cc-5af8289108915"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
status: 200
accept-ranges: bytes
cf-ray: 5d46bf994fd51f45-FRA
content-length: 16844
cf-request-id: 05401613cc00001f450686e200000001
cf-bgj: h2pri

GET
H2 200 Staples-Discloses-Data-Breach-Exposing-Limited-Customer-Information-300x200.jpg
hotforsecurity.bitdefender.com/wp-content/uploads/2020/09/ 5 KB
5 KB 60ms
59ms Image
image/jpeg 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hotforsecurity.bitdefender.com/wp-content/uploads/2020/09/Staples-Discloses-Data-Breach-Exposing-Limited-Customer-Information-300x200.jpg
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0199e005e1574444217590e9fe93bb935175faad3cb4a621eec9be03aa8ba6fb

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 17 Sep 2020 23:53:45 GMT
cf-cache-status: REVALIDATED
last-modified: Thu, 17 Sep 2020 10:26:06 GMT
server: cloudflare
etag: "222b85-151f-5af7fcfd6f889"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
status: 200
accept-ranges: bytes
cf-ray: 5d46bf994fd61f45-FRA
content-length: 5407
cf-request-id: 05401613cc00001f450686f200000001
cf-bgj: h2pri

GET
H2 200 Dusseldorf-University-Hospital-Emergency-Care-Postponed-After-Alleged-Cyber-Attack-300x200.jpg
hotforsecurity.bitdefender.com/wp-content/uploads/2020/09/ 9 KB
9 KB 58ms
57ms Image
image/jpeg 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hotforsecurity.bitdefender.com/wp-content/uploads/2020/09/Dusseldorf-University-Hospital-Emergency-Care-Postponed-After-Alleged-Cyber-Attack-300x200.jpg
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a73b5169f6b32abacf73b3e8c2e199528e16dee392a605f6fcd15de325b9b09f

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 17 Sep 2020 23:53:45 GMT
cf-cache-status: REVALIDATED
last-modified: Wed, 16 Sep 2020 15:05:18 GMT
server: cloudflare
etag: "222b5e-22da-5af6f9882023d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
status: 200
accept-ranges: bytes
cf-ray: 5d46bf994fd71f45-FRA
content-length: 8922
cf-request-id: 05401613cc00001f4506870200000001
cf-bgj: h2pri

GET
H2 200 5fdc27b8b6f6fd69e77aa017a53cceb5
secure.gravatar.com/avatar/ 6 KB
6 KB 21ms
6ms Image
image/jpeg 2a04:fa87:fffe::c000:4902
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.gravatar.com/avatar/5fdc27b8b6f6fd69e77aa017a53cceb5?s=140&d=mm&r=g
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 13c93fe0e5e18bb4cff177634ecdb8fedb52afdf3c4d2b4cb6f1ef1cf481e9c4

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT fra 3
date: Thu, 17 Sep 2020 23:53:45 GMT
last-modified: Thu, 18 Jun 2020 13:37:43 GMT
server: nginx
status: 200
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=300
content-disposition: inline; filename="5fdc27b8b6f6fd69e77aa017a53cceb5.jpeg"
accept-ranges: bytes
link: <https://www.gravatar.com/avatar/5fdc27b8b6f6fd69e77aa017a53cceb5?s=140&d=mm&r=g>; rel="canonical"
content-length: 5706
expires: Thu, 17 Sep 2020 23:58:45 GMT

GET
H/1.1 200
OK Cookie set dest5.html
bitdefender.demdex.net/ Frame 5555 0
0 33ms
33ms Document
text/html 52.49.47.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://bitdefender.demdex.net/dest5.html?d_nsid=0

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/4b7ac0a30c6cfe2deb06368f62d41f996c29744e/satelliteLib-3a8d5287cf775324dc6c68719a1ddc96c5a139ba.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.49.47.228 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-49-47-228.eu-west-1.compute.amazonaws.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Host: bitdefender.demdex.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: demdex=91771282364293634101613545754895664405
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html

Response headers

Accept-Ranges: bytes
Cache-Control: max-age=21600
Content-Encoding: gzip
Content-Type: text/html
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Last-Modified: Wed, 09 Sep 2020 13:55:01 GMT
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Set-Cookie: demdex=91771282364293634101613545754895664405;Path=/;Domain=.demdex.net;Expires=Tue, 16-Mar-2021 23:53:45 GMT;Max-Age=15552000;Secure;SameSite=None
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Accept-Encoding, User-Agent
X-TID: LGMedATlSOA=
Content-Length: 2785
Connection: keep-alive

GET
H2 200 id Show response
sstats.bitdefender.com/ 48 B
494 B 122ms
31ms XHR
application/x-javascript 15.188.154.177
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://sstats.bitdefender.com/id?d_visid_ver=5.0.1&d_fieldgroup=A&mcorgid=0E920C0F53DA9E9B0A490D45%40AdobeOrg&mid=91746310007468016851615970500255528914&ts=1600386825169

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/4b7ac0a30c6cfe2deb06368f62d41f996c29744e/satelliteLib-3a8d5287cf775324dc6c68719a1ddc96c5a139ba.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.188.154.177 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

jag /

Resource Hash

a77fcc0e1d2b05a7b143a3bce78a94afbb19f571aa0da4dd87caf322e2f8db46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

status: 200
date: Thu, 17 Sep 2020 23:53:44 GMT
x-content-type-options: nosniff
server: jag
xserver: anedge-6485bbc5d6-xtzgs
vary: Origin
x-c: master-1362.Ibf4d3d.M0-447
p3p: CP="This is not a P3P policy"
access-control-allow-origin: https://hotforsecurity.bitdefender.com
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
content-type: application/x-javascript;charset=utf-8
content-length: 48
x-xss-protection: 1; mode=block

GET
H/1.1

200
OK

ibs:dpid=411&dpuuid=X2P3CQAABQO0fS3-
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=91771282364293634101613545754895664405
https://dpm.demdex.net/ibs:dpid=411&dpuuid=X2P3CQAABQO0fS3-

42 B
915 B

134ms
34ms

Image
image/gif

34.248.119.134
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=411&dpuuid=X2P3CQAABQO0fS3-

Requested by

Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.248.119.134 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

DCS: dcs-prod-irl1-v081-09f48a4e2.edge-irl1.demdex.com 5.78.0.20200908113611 0ms (+1ms)
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-TID: P/5dhXLgSyM=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 42
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Date: Thu, 17 Sep 2020 23:53:44 GMT
Server: AMO-cookiemap/1.1
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=X2P3CQAABQO0fS3-
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=15,max=100
Content-Length: 0

POST
H2 200 delivery Show response
bitdefender.tt.omtrdc.net/rest/v1/ 284 B
474 B 124ms
50ms XHR
application/json 54.76.90.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://bitdefender.tt.omtrdc.net/rest/v1/delivery?client=bitdefender&sessionId=c2ff4e8810e041c68ca96037023858b3&version=2.3.1
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/4b7ac0a30c6cfe2deb06368f62d41f996c29744e/mbox-contents-e392e41418bacceda95c05b2c49657ebca0324a2.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.76.90.77 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 9e2df4fbb1b43c49d6f79ba1371442cae02971a52ce74a4fa9546dbd498e08b2

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 17 Sep 2020 23:53:45 GMT
content-encoding: gzip
status: 200
vary: Origin,Accept-Encoding
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://hotforsecurity.bitdefender.com
access-control-allow-credentials: true
x-request-id: f5903a5831647983a9e71336fa00e6e3

GET
H/1.1 200
OK insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 965 B
760 B 6ms
6ms Script
application/x-javascript 2a02:26f0:6c00:296::25ea
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/4b7ac0a30c6cfe2deb06368f62d41f996c29744e/scripts/satellite-5afad58064746d59a10078e2.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:296::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: /
Resource Hash: 83af74f9ae1d1e4be00a7e271ab233c20ecc5769bdbd1c72e0524dc86bdf12e4

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 17 Sep 2020 23:53:45 GMT
Content-Encoding: gzip
Last-Modified: Thu, 17 Sep 2020 18:39:56 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=67984
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 447

POST
H3-Q050 200 collect Show response
www.google-analytics.com/j/ 4 B
408 B 40ms
14ms XHR
text/plain 2a00:1450:4001:81a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j86&a=402030778&t=pageview&_s=1&dl=https%3A%2F%2Fhotforsecurity.bitdefender.com%2Fblog%2Fwordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html&ul=en-us&de=UTF-8&dt=WordPress%20Websites%20Attacked%20via%20File%20Manager%20Plugin%20Vulnerability%20%E2%80%93%20HOTforSecurity&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAAC~&jid=1232082919&gjid=1132577082&cid=1667260811.1600386825&tid=UA-2819970-3&_gid=698736560.1600386825&_r=1&_slc=1&z=262227726

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 17 Sep 2020 23:53:45 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
status: 200
content-type: text/plain
access-control-allow-origin: https://hotforsecurity.bitdefender.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK insight.old.min.js Show response
snap.licdn.com/li.lms-analytics/ 3 KB
2 KB 10ms
10ms Script
application/x-javascript 2a02:26f0:6c00:296::25ea
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.old.min.js
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:296::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: /
Resource Hash: 41dd5e421fe221a7d2921d6fa2b36e8b01a9f2c054aaef5fad866fe896c1d1e0

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 17 Sep 2020 23:53:45 GMT
Content-Encoding: gzip
Last-Modified: Thu, 03 Sep 2020 20:29:41 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=53737
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1576

GET
H2

200

collect
px.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=359890&url=https%3A%2F%2Fhotforsecurity.bitdefender.com%2Fblog%2Fwordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html&time...
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D359890%26url%3Dhttps%253A%252F%252Fhotforsecurity.bitdefender.com%252Fblog%252Fwo...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=359890&url=https%3A%2F%2Fhotforsecurity.bitdefender.com%2Fblog%2Fwordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html&time...

0
80 B

167ms
167ms

Image
application/javascript

2a05:f500:11:101::b93f:9005
LINKEDIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=359890&url=https%3A%2F%2Fhotforsecurity.bitdefender.com%2Fblog%2Fwordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html&time=1600386825256&liSync=true
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:f500:11:101::b93f:9005 , Ireland, ASN14413 (LINKEDIN, US),
Reverse DNS
Software: Play /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 17 Sep 2020 23:53:46 GMT
server: Play
linkedin-action: 1
x-li-fabric: prod-lor1
status: 200
x-li-proto: http/2
x-li-pop: prod-tln1
content-type: application/javascript
content-length: 0
x-li-uuid: j3RuxFa3NRZgHyTMiisAAA==

Redirect headers

content-security-policy: default-src *; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id https://lnkd.demdex.net/event blob: https://accounts.google.com/gsi/status https://linkedin.sc.omtrdc.net/b/ss/ www.google-analytics.com static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com https://snap.licdn.com/li.lms-analytics/insight.min.js platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'; report-uri https://www.linkedin.com/platform-telemetry/csp?f=l
x-content-type-options: nosniff
linkedin-action: 1
status: 302
content-length: 0
x-li-uuid: Ikhou1a3NRbw2cMI/CoAAA==
pragma: no-cache
x-li-pop: afd-prod-lor1
x-msedge-ref: Ref A: 6DCD10D65F5B461EAEA1D2905952313D Ref B: FRAEDGE1111 Ref C: 2020-09-17T23:53:45Z
x-frame-options: sameorigin
date: Thu, 17 Sep 2020 23:53:45 GMT
expect-ct: max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct"
strict-transport-security: max-age=2592000
x-li-fabric: prod-lor1
location: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=359890&url=https%3A%2F%2Fhotforsecurity.bitdefender.com%2Fblog%2Fwordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html&time=1600386825256&liSync=true
x-xss-protection: 1; mode=block
cache-control: no-cache, no-store
x-li-proto: http/2
expires: Thu, 01 Jan 1970 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
94 B 16ms
16ms XHR
text/plain 2a00:1450:400c:c0c::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j86&tid=UA-2819970-3&cid=1667260811.1600386825&jid=1232082919&gjid=1132577082&_gid=698736560.1600386825&_u=IEBAAEAAAAAAAC~&z=1710496989

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c0c::9b Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Thu, 17 Sep 2020 23:53:45 GMT
status: 200
content-type: text/plain
access-control-allow-origin: https://hotforsecurity.bitdefender.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 202 page Show response
rs.fullstory.com/rec/ 52 B
237 B 178ms
134ms XHR
text/plain 35.186.194.58
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://rs.fullstory.com/rec/page

Requested by

Host: fullstory.com
URL: https://fullstory.com/s/fs.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.186.194.58 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

58.194.186.35.bc.googleusercontent.com

Software

Resource Hash

1776651e4a3c9aeb0124d70ef86c2832dc6900251e7771124b482283256d710d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 17 Sep 2020 23:53:45 GMT
via: 1.1 google
x-content-type-options: nosniff
status: 202
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://hotforsecurity.bitdefender.com
access-control-allow-credentials: true
alt-svc: clear
content-length: 52

GET
H2 200 hotjar-37798.js Show response
static.hotjar.com/c/ 46 KB
7 KB 48ms
17ms Script
application/javascript 147.75.32.125
PACKET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hotjar.com/c/hotjar-37798.js?sv=5

Requested by

Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

147.75.32.125 Amsterdam, Netherlands, ASN54825 (PACKET, US),

Reverse DNS

pkt-ams-k2-shared-ingress4

Software

Resource Hash

c7bea7ada6845fd4b93022dd6b4803b00d534aae54b46f414bd8d7bbdb7ac65a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 17 Sep 2020 23:53:45 GMT
content-encoding: br
x-content-type-options: nosniff
content-type: application/javascript
section-io-tag: hotjarjs
age: 2
status: 200
section-io-cache: Hit
vary: Accept-Encoding
content-length: 7083
cache-control: max-age=60
etag: W/f13f6c222b258d1efe8fb06c85d5b1ba
access-control-max-age: 600
section-io-origin-status: 304
access-control-allow-origin: *
x-cache-hit: 1
section-io-origin-time-seconds: 0.019
accept-ranges: bytes
section-io-id: 14a4792131e4de3e518286ba2e0b9886
section-origin-responded: true

GET
H2 200 satellite-5d02108464746d34ba000300.js Show response
assets.adobedtm.com/4b7ac0a30c6cfe2deb06368f62d41f996c29744e/scripts/ 318 B
529 B 6ms
6ms Script
application/x-javascript 2a02:26f0:6c00:28a::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/4b7ac0a30c6cfe2deb06368f62d41f996c29744e/scripts/satellite-5d02108464746d34ba000300.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/4b7ac0a30c6cfe2deb06368f62d41f996c29744e/satelliteLib-3a8d5287cf775324dc6c68719a1ddc96c5a139ba.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:28a::1e80 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: edefa01f1cd7ecdfc0ad42300ae3583e3d3f51f0b5a2be2bd476aeebf47f2514

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 17 Sep 2020 23:53:45 GMT
content-encoding: gzip
last-modified: Fri, 28 Aug 2020 07:47:11 GMT
server: AkamaiNetStorage
status: 200
etag: "ab15a6c3bbc9e645694fd46ec06a5c01:1598600831.865136"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://hotforsecurity.bitdefender.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 254
expires: Fri, 18 Sep 2020 00:53:45 GMT

GET
H2 200 s-code-contents-f491ecdc05b0507cfd2c52966e13abbfea654982.js Show response
assets.adobedtm.com/4b7ac0a30c6cfe2deb06368f62d41f996c29744e/ 85 KB
31 KB 6ms
6ms Script
application/x-javascript 2a02:26f0:6c00:28a::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/4b7ac0a30c6cfe2deb06368f62d41f996c29744e/s-code-contents-f491ecdc05b0507cfd2c52966e13abbfea654982.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/4b7ac0a30c6cfe2deb06368f62d41f996c29744e/satelliteLib-3a8d5287cf775324dc6c68719a1ddc96c5a139ba.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:28a::1e80 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 0659613b273942da1c8965a916f32f6f3cfdb020f61c1a3432ee74649d24b1c9

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 17 Sep 2020 23:53:45 GMT
content-encoding: gzip
last-modified: Fri, 28 Aug 2020 07:47:09 GMT
server: AkamaiNetStorage
status: 200
etag: "6a422418026a56c63c8bc524117a02d4:1598600829.732987"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://hotforsecurity.bitdefender.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 31532
expires: Fri, 18 Sep 2020 00:53:45 GMT

GET
H2 200 ee38c350.min.js Show response
tag.demandbase.com/ 57 KB
16 KB 108ms
38ms Script
application/javascript 99.84.144.121
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tag.demandbase.com/ee38c350.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/4b7ac0a30c6cfe2deb06368f62d41f996c29744e/scripts/satellite-5d02108464746d34ba000300.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.144.121 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-144-121.txl52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: b4eaafafc797a31bcb3e91a0c171404d8084ab3b924e7e0ee94bc1dab35bb7d5

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: p9C3gcO6ONJe9xpJzyEtOoH0XrOJVHac
content-encoding: gzip
last-modified: Thu, 03 Sep 2020 14:14:48 GMT
server: AmazonS3
age: 2391
etag: "27413c32acc2787f619b30d68f2dd23a"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript; charset=utf-8
status: 200
cache-control: public, max-age=3600
date: Thu, 17 Sep 2020 23:13:55 GMT
x-amz-cf-pop: TXL52-C1
x-amz-cf-id: 8gnAkwNMgXMuunWkOEgNSPjmWsH6VUanv-JEpvrhBfFfueyZDZRioA==
via: 1.1 458f29e42261f01e7368474593f44b66.cloudfront.net (CloudFront)

GET
H2 200 json Show response
fls.doubleclick.net/ 40 B
723 B 84ms
33ms Script
text/javascript 172.217.16.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fls.doubleclick.net/json?spot=5165113&src=&var=s_3_Integrate_DFA_get_0&host=integrate.112.2o7.net%2Fdfa_echo%3Fvar%3Ds_3_Integrate_DFA_get_0%26AQE%3D1%26A2S%3D1&ord=5404628965889

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/4b7ac0a30c6cfe2deb06368f62d41f996c29744e/s-code-contents-f491ecdc05b0507cfd2c52966e13abbfea654982.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.134 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f6.1e100.net

Software

cafe /

Resource Hash

e32a6ae5e43f7f652674e0f03dc23f86839f839b29ee4e63c01c93da180bb0d0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 17 Sep 2020 23:53:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 60
x-xss-protection: 0
pragma: no-cache
server: cafe
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: no-cache, must-revalidate
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 modules.5fdb294d4cb17b8c9a47.js Show response
script.hotjar.com/ 360 KB
70 KB 49ms
18ms Script
application/javascript 147.75.32.125
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.hotjar.com/modules.5fdb294d4cb17b8c9a47.js
Requested by: Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-37798.js?sv=5
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 147.75.32.125 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS: pkt-ams-k2-shared-ingress4
Software: /
Resource Hash: b5fb6443344734b6a16af14f4fd4446832356d3b4b1b566df218678a098ba2ca

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 17 Sep 2020 23:53:45 GMT
content-encoding: br
age: 26106
status: 200
section-io-cache: Hit
content-length: 71575
last-modified: Thu, 17 Sep 2020 16:35:02 GMT
etag: "05df4610f3591cf54fee41e507f5db01"
vary: Accept-Encoding
section-io-origin-status: 200
access-control-allow-origin: *
cache-control: max-age=31536000
section-io-origin-time-seconds: 0.093
section-io-id: 7124755b363efc5960466b8acd459015
accept-ranges: bytes
content-type: application/javascript
section-origin-responded: true

GET
H2 200 box-469cf41adb11dc78be68c1ae7f9457a4.html
vars.hotjar.com/ Frame E385 0
0 48ms
16ms Document
text/html 147.75.32.125
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://vars.hotjar.com/box-469cf41adb11dc78be68c1ae7f9457a4.html
Requested by: Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-37798.js?sv=5
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 147.75.32.125 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS: pkt-ams-k2-shared-ingress4
Software: /
Resource Hash

Request headers

:method: GET
:authority: vars.hotjar.com
:scheme: https
:path: /box-469cf41adb11dc78be68c1ae7f9457a4.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html

Response headers

status: 200
date: Thu, 17 Sep 2020 23:53:45 GMT
content-type: text/html
content-length: 851
last-modified: Mon, 17 Aug 2020 18:24:17 GMT
etag: "d594f1d4c3e5dbd6b556c60d34e0daea"
cache-control: max-age=31536000
content-encoding: br
section-io-origin-status: 200
section-io-origin-time-seconds: 0.045
section-origin-responded: true
age: 2671969
vary: Accept-Encoding
section-io-cache: Hit
accept-ranges: bytes
section-io-id: 44d670c6d4a4c290edf1f72592ee1e4e

GET
H2 200 s38906014517130 Show response
sstats.bitdefender.com/b/ss/bitdefenderproduction/10/JS-2.20.0-D7QN/ 768 B
1 KB 54ms
54ms Script
application/x-javascript 15.188.154.177
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://sstats.bitdefender.com/b/ss/bitdefenderproduction/10/JS-2.20.0-D7QN/s38906014517130?AQB=1&ndh=1&pf=1&callback=s_c_il[1].doPostbacks&et=1&t=18%2F8%2F2020%201%3A53%3A45%205%20-120&d.&nsid=0&jsonv=1&.d&sdid=334988D74A70797C-7697AEA84FA3CC24&D=D%3D&mid=91746310007468016851615970500255528914&aamlh=6&ce=UTF-8&cdp=2&fpCookieDomainPeriods=2&pageName=h4s%3Aarticle%3Awordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048&g=https%3A%2F%2Fhotforsecurity.bitdefender.com%2Fblog%2Fwordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html&c.&s_dmdbase=ISP%20Visitor%3AISP%20Visitor%3AISP%20Visitor%3AISP%20Visitor%3AISP%20Visitor%3AISP%20Visitor%3ABot%3AISP%20Visitor&s_dmdbase_custom1=ISP%20Visitor%3AISP%20Visitor%3AISP%20Visito%3AISP%20Visitor%3AISP%20Visitor%3AISP%20Visitor%3AISP%20Visitor%3AISP%20Visitor&.c&cc=EUR&ch=h4s&server=h4s&aamb=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&c1=article&v1=h4s%3Aarticle%3Awordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048&c2=wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048&v3=D%3Dc8&c4=bitdefenderproduction&v4=D%3Dc9&c5=https%3A%2F%2Fhotforsecurity.bitdefender.com%2Fblog%2Fwordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html&v5=D%3Dc10&c6=us&v6=D%3Dc6&c7=en&v7=D%3Dc7&c8=17%2F9%2F2020&c9=01%3A53%7C01%3A00-01%3A59%7Cfriday%7Cgmt%20%2B2&c10=false&c75=%7Cprod&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=0E920C0F53DA9E9B0A490D45%40AdobeOrg&AQE=1

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/4b7ac0a30c6cfe2deb06368f62d41f996c29744e/s-code-contents-f491ecdc05b0507cfd2c52966e13abbfea654982.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.188.154.177 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

jag /

Resource Hash

9d217cf4a1047ffd0c3e377c05a68841b9afd79fdc0ee5f0dab8982bf80d613c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-aam-tid: 3JsyUpR6Q/Q=
date: Thu, 17 Sep 2020 23:53:45 GMT
x-content-type-options: nosniff
x-c: master-1362.Ibf4d3d.M0-447
p3p: CP="This is not a P3P policy"
status: 200
content-length: 768
x-xss-protection: 1; mode=block
dcs: dcs-prod-irl1-v081-05ae8eb25.edge-irl1.demdex.com 5.78.0.20200908113611 4ms (+1ms)
pragma: no-cache
last-modified: Fri, 18 Sep 2020 23:53:45 GMT
server: jag
xserver: anedge-6485bbc5d6-mh4dn
etag: 3436804537247432704-4621513173862174694
vary: *
content-type: application/x-javascript;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, no-transform, private
expires: Wed, 16 Sep 2020 23:53:45 GMT

GET
H2 200 ip.json Show response
api.company-target.com/api/v2/ 438 B
950 B 116ms
116ms XHR
application/json 99.84.144.62
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.company-target.com/api/v2/ip.json?referrer=&page=https%3A%2F%2Fhotforsecurity.bitdefender.com%2Fblog%2Fwordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html&page_title=WordPress%20Websites%20Attacked%20via%20File%20Manager%20Plugin%20Vulnerability%20%E2%80%93%20HOTforSecurity&src=tag&key=4df37d5c7636f0687f8288c1a889681f
Requested by: Host: tag.demandbase.com
URL: https://tag.demandbase.com/ee38c350.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.144.62 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-144-62.txl52.r.cloudfront.net
Software: nginx /
Resource Hash: 73af05a4ed76ae72e7e11c8da4b8d7c677caecc0a370f0d750582a8008411eb3

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 17 Sep 2020 23:53:45 GMT
identification-source: CENTRAL
vary: Accept-Encoding, Origin
x-amz-cf-pop: TXL52-C1
x-cache: Miss from cloudfront
status: 200
request-id: 3204e2b4-9e68-43b7-898b-e26c781d0c34
content-encoding: gzip
pragma: no-cache
access-control-allow-origin: https://hotforsecurity.bitdefender.com
server: nginx
access-control-max-age: 7200
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json;charset=utf-8
via: 1.1 df2b5b3f847bbe9ad7f475c0831bcc3a.cloudfront.net (CloudFront)
access-control-expose-headers
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
api-version: v2
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: oe4r4N7cN4-XWw2fxWc0EJMCbf-IAJhYSPuC2paesPbXxjjuowNYkg==
expires: Wed, 16 Sep 2020 23:53:45 GMT

GET
H/1.1

200
OK

validateCookie
segments.company-target.com/
Redirect Chain

https://match.prod.bidr.io/cookie-sync/demandbase
https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1
https://segments.company-target.com/log?vendor=choca&user_id=AATFcU6-x-4AABBh3icOFw
https://segments.company-target.com/validateCookie?vendor=choca&user_id=AATFcU6-x-4AABBh3icOFw&verifyHash=7defe6440c24cd5a3550667c97af0779e802a6d6

26 B
409 B

234ms
234ms

Image
image/gif

99.84.144.83
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://segments.company-target.com/validateCookie?vendor=choca&user_id=AATFcU6-x-4AABBh3icOFw&verifyHash=7defe6440c24cd5a3550667c97af0779e802a6d6
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.144.83 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-144-83.txl52.r.cloudfront.net
Software: /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 17 Sep 2020 23:53:46 GMT
Via: 1.1 f23d0814f3a7efcdd4936fa69b3d072b.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: TXL52-C1
Vary: Origin
X-Cache: Miss from cloudfront
Content-Type: image/gif
Transfer-Encoding: chunked
Connection: keep-alive
trace-id: 032426562bedae29
X-Amz-Cf-Id: m-JDI4lUXna8zV07L3D_LmS-SCh6mqtM9RAUYL9RE4zwVofBd0ScPg==

Redirect headers

Date: Thu, 17 Sep 2020 23:53:46 GMT
Via: 1.1 f23d0814f3a7efcdd4936fa69b3d072b.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: TXL52-C1
Vary: Origin
X-Cache: Miss from cloudfront
Location: /validateCookie?vendor=choca&user_id=AATFcU6-x-4AABBh3icOFw&verifyHash=7defe6440c24cd5a3550667c97af0779e802a6d6
Connection: keep-alive
trace-id: 6686145121ea1e28
Content-Length: 0
X-Amz-Cf-Id: vwx_rmCw7vnVqM9Km9wL1nW9yzYc_ItQczckPKOW8zEtNu-3U36T9g==

POST
H2 200 visit-data Show response
in.hotjar.com/api/v2/client/sites/37798/ 178 B
320 B 104ms
38ms XHR
application/json 52.214.117.39
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://in.hotjar.com/api/v2/client/sites/37798/visit-data?sv=5
Requested by: Host: script.hotjar.com
URL: https://script.hotjar.com/modules.5fdb294d4cb17b8c9a47.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.214.117.39 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-214-117-39.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 6154d5f7f6961e042d013bab33fd02b691970d873f44f3c32d8fcc6e79ef5bcd

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain; charset=UTF-8

Response headers

date: Thu, 17 Sep 2020 23:53:45 GMT
content-encoding: br
status: 200
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
access-control-max-age: 86400
access-control-allow-credentials: true

Verdicts & Comments Add Verdict or Comment

200 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

25 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.demdex.net/	1970-01-19 16:52:18	Name: dextp Value: 60-1-1600386825244\|121998-1-1600386825346\|129099-1-1600386825447
.bitdefender.com/	1969-12-31 23:59:59	Name: s_ppv Value: h4s%253Aarticle%253Awordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048%2C34%2C34%2C1200%2C1600%2C1200%2C1600%2C1200%2C1%2CP
.bitdefender.com/	1969-12-31 23:59:59	Name: s_ht Value: 1600386825913
.bitdefender.com/	1970-01-20 06:04:18	Name: AMCV_0E920C0F53DA9E9B0A490D45%40AdobeOrg Value: 2000951482%7CMCIDTS%7C18523%7CMCMID%7C91746310007468016851615970500255528914%7CMCAAMLH-1600991625%7C6%7CMCAAMB-1600991625%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1600394025s%7CNONE%7CMCAID%7CNONE%7CMCSYNCSOP%7C411-18530%7CvVersion%7C5.0.1
.bitdefender.com/	1970-01-19 21:18:42	Name: _hjid Value: 74c46c4e-c5ad-4715-b192-efb5f060b101
.bitdefender.com/	1969-12-31 23:59:59	Name: s_ppvl Value: h4s%253Aarticle%253Awordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048%2C34%2C34%2C1200%2C1600%2C1200%2C1600%2C1200%2C1%2CP
.bitdefender.com/	1969-12-31 23:59:59	Name: _hjTLDTest Value: 1
.bitdefender.com/	1970-01-19 12:33:08	Name: s_dfa Value: bitdefenderproduction
.hotforsecurity.bitdefender.com/	1970-01-19 13:16:18	Name: aam_uuid Value: 91771282364293634101613545754895664405
.bitdefender.com/	1969-12-31 23:59:59	Name: s_cc Value: true
.bitdefender.com/	1970-01-19 12:34:33	Name: _gid Value: GA1.2.698736560.1600386825
.bitdefender.com/	1969-12-31 23:59:59	Name: s_hc Value: 1%7C0%7C0%7C0%7C0
.bitdefender.com/	1970-01-20 06:04:18	Name: _ga Value: GA1.2.1667260811.1600386825
.bitdefender.com/	1969-12-31 23:59:59	Name: at_check Value: true
.bitdefender.com/	1970-01-19 12:33:08	Name: mboxEdgeCluster Value: 37
.bitdefender.com/	1970-01-20 06:07:11	Name: mbox Value: session#c2ff4e8810e041c68ca96037023858b3#1600388685\|PC#c2ff4e8810e041c68ca96037023858b3.37_0#1663631626
hotforsecurity.bitdefender.com/	1970-01-19 12:33:06	Name: _hjIncludedInPageviewSample Value: 1
.bitdefender.com/	1970-01-19 12:33:06	Name: _gat Value: 1
.bitdefender.com/	1970-01-20 06:04:18	Name: s_ecid Value: MCMID%7C91746310007468016851615970500255528914
.bitdefender.com/	1970-01-19 12:33:08	Name: dmdbase_cdc Value: DBSET
.bitdefender.com/	1970-01-19 21:18:42	Name: bd112 Value: XY%2FBTsQwDET%2FJQdOJClLtaqKIi5c9ws2HJLWTS3SpHLcFoT4d9re4GSP9WY0vn%2BLhaJoxcg8t1ZbvW2b8sg9DJB6INXlyeqCDFbfHCarAyQgF98wIO%2FDsXudjdU%2B5rC7M%2FUzQSlyA3%2B4inTMrvuAXq7o5IAR5OSSC0ByjkvAJNclHokeI%2FKXvNRV3aiRp%2FjgpvmFTcEUIpyijwbSuY1mzFwX6BT5T5XX8U%2FnBHxS5aCGTDu30B7%2B%2F7ETAiIjHgXjBIX3g2ifrlX13FybS%2F3z%2Fgs%3D
.bitdefender.com/	1970-01-19 12:33:08	Name: _hjAbsoluteSessionInProgress Value: 0
.demdex.net/	1970-01-19 16:52:18	Name: demdex Value: 91771282364293634101613545754895664405
.bitdefender.com/	1970-01-19 13:16:18	Name: __cfduid Value: db974974904a2821d2f6ee8f570c377fc1600386823
.bitdefender.com/	1969-12-31 23:59:59	Name: AMCVS_0E920C0F53DA9E9B0A490D45%40AdobeOrg Value: 1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.company-target.com
assets.adobedtm.com
bitdefender.demdex.net
bitdefender.tt.omtrdc.net
cm.everesttech.net
download.bitdefender.com
dpm.demdex.net
edge.fullstory.com
fls.doubleclick.net
fonts.googleapis.com
fonts.gstatic.com
fullstory.com
hotforsecurity.bitdefender.com
in.hotjar.com
match.prod.bidr.io
px.ads.linkedin.com
rs.fullstory.com
script.hotjar.com
scripts.demandbase.com
secure.gravatar.com
segments.company-target.com
snap.licdn.com
sstats.bitdefender.com
static.hotjar.com
stats.g.doubleclick.net
tag.demandbase.com
vars.hotjar.com
www.bitdefender.com
www.google-analytics.com
www.linkedin.com
143.204.201.47
147.75.32.125
15.188.154.177
172.217.16.134
192.229.220.142
2600:1901:0:2470::
2606:4700::6812:a9de
2620:1ec:21::14
2a00:1450:4001:801::2003
2a00:1450:4001:819::200a
2a00:1450:4001:81a::200e
2a00:1450:400c:c0c::9b
2a02:26f0:6c00:28a::1e80
2a02:26f0:6c00:296::25ea
2a04:fa87:fffe::c000:4902
2a05:f500:11:101::b93f:9005
34.248.119.134
35.186.194.58
35.201.112.186
52.17.84.139
52.214.117.39
52.49.47.228
54.76.90.77
66.117.28.86
99.84.144.121
99.84.144.62
99.84.144.83
0199e005e1574444217590e9fe93bb935175faad3cb4a621eec9be03aa8ba6fb
0659613b273942da1c8965a916f32f6f3cfdb020f61c1a3432ee74649d24b1c9
0bafb2bfda20c5019c125a7f3bb4d7c51abf848201dd589e5cd67d0070f8b58a
0d9fd7ccabde9b202de45ee6b65878ce9594975d8e8810b0878d3f3fa3637d0e
12229fc93eb6a5572501671207da32beb14c969a0f78bd2ed4bdf254cac1ffd1
13c93fe0e5e18bb4cff177634ecdb8fedb52afdf3c4d2b4cb6f1ef1cf481e9c4
159526f78a28685850dc55b5b8776267c1b242fd12504e7d8e7e838b22a849cd
1776651e4a3c9aeb0124d70ef86c2832dc6900251e7771124b482283256d710d
1d13655d1693b0b46340f6b5391c0154b6566fcfe95741d40674ae9a1b5a0293
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df
2f64b025cec8c93dcb01fe88f0e79c134bc0a6c751787360153865dfa9f3a962
306c9714fc0da628f79970bbcc854b8bbbda370dbf90fe73486330eab400be0e
3426d7ced4ac00288838068e457aca4d7804c1e5e9a92ef61a858d3e97fae4f6
382fe3dd880202e9e2971b7ae531720bc1bf2bb68decbc507d04e64b62531f44
3aca6f2b898088dab64aaba8faa7d6d90dabaa257a2e2d906832137efda5dcf9
3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1
3c502ab7dd81c6a775f58e6b0a866befc8c444377d8a8ec4c07b03063db34834
3e0383e88d2588eac46cae98bdbc97d681f0ed2540059dbf1106b2d85f92a38d
41dd5e421fe221a7d2921d6fa2b36e8b01a9f2c054aaef5fad866fe896c1d1e0
483741ab3576b4cdf24b73a2f017ea6e20468471b387cc484eccee5fd1fd1cb4
4d0d2a0d54d25d91923590d3383b8aac038fa588a499df562598fd18064c88df
52193931ee193d8ab70d0bb34f251f5849b092b783c2d671184a7853e86a040a
58205d75a762322da5bbc678933948ff2c395fb5683e5453d094420aee24b030
5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479
60863e86aa7743d1ac841da7f473a05cd57fba81d661cef658e385437f80d5ef
6154d5f7f6961e042d013bab33fd02b691970d873f44f3c32d8fcc6e79ef5bcd
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6ebcda7a3a41ef97f0b4071160ceb1020e540fdc0f790079a5c2ef01ab654fe0
73af05a4ed76ae72e7e11c8da4b8d7c677caecc0a370f0d750582a8008411eb3
83af74f9ae1d1e4be00a7e271ab233c20ecc5769bdbd1c72e0524dc86bdf12e4
84f7bdd9d518f244e12254d2dab2827a56fa1c0be95dd685178105518fdd94d2
862d25e6731d8163d089dc54c7b5e7f658c2735d726f3765d2c8b492566e85e6
89b026459d5ad9b78afcd0ba868276048e24e67d75bf0737e08e33552edb3cee
8c626f0f9b5c109539b256b73e72c02b300a184f46b4535c2eb86599215c78af
8cb438bd4d1961f80ade4f1a295ca7de253630adcdd10473932908e638908c5e
8ee6a829478761f158d239ceb4dd636ae4e703dc1970057c71628549d1de6d14
8f1495396c589ea4cd4497c74fe9e218e9913e38504847ad4361d12d7b13bda9
9d217cf4a1047ffd0c3e377c05a68841b9afd79fdc0ee5f0dab8982bf80d613c
9e2df4fbb1b43c49d6f79ba1371442cae02971a52ce74a4fa9546dbd498e08b2
a73b5169f6b32abacf73b3e8c2e199528e16dee392a605f6fcd15de325b9b09f
a77fcc0e1d2b05a7b143a3bce78a94afbb19f571aa0da4dd87caf322e2f8db46
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
b47116dba01d7e6bac5d27ef84a0963de4fbe7ae36592fddda0c54a1fc8c8be2
b4eaafafc797a31bcb3e91a0c171404d8084ab3b924e7e0ee94bc1dab35bb7d5
b5fb6443344734b6a16af14f4fd4446832356d3b4b1b566df218678a098ba2ca
b7e17926b30342edecee8b3a93029ac51462e2b479277d8e077ba57173eb1900
b82eefb6a4f332f80cf77897057def50d542447398557c6be322d86a3ebe613b
c05ee8fac93fde19412046a913b9aecd86210aba6b72cff7c94e01170dd11e3b
c0c7ff312fbaf1ee09e030009f39eef707d97de32504fd2b3ef3e0ec7c5b60f1
c7bea7ada6845fd4b93022dd6b4803b00d534aae54b46f414bd8d7bbdb7ac65a
d0cbfb1ab0f94123834567e32df7ec74a1c210793f797368d41a4b4c2732d4a0
d2727c328499f041006d5d595f86fb080bad6646a3a741eef2ca30a7a5a722bd
d792afdac7f7ae5de7c6964950c6c61dc6e3f3813180a59e141c7cb4ac4364dc
d7b38fb952a78e6eb880a5bd612db89e572edf28a14f63830744bd97856e5dc5
db7e27157a918cd3ebf833e1544924cab8837dbcaebe9e00989020ad3e43283d
dbf0fbbf5d89d767d911d99bd4d56fab45682d60a8e337ea9367e02879bd1950
dc1a3a3bf97eada084f65b5d87085ddb8d3a76a9e450c6a41211e1698048de91
ddb5f37e49e5bb129115dc56bf737c89b3a27770107d3c24abe60b2cec84460e
e07021158049cd2c874f0aa3c3eb60c126414affb59e7185838dcc62531406a0
e0971026066e53fcd75d7f54008d457c621f42ff371ccfc3075684efc7405d8a
e15d1f89cbc821b0605f601a862e07b8e1b77075ece6439d726768183c4ec9de
e1ae4fa36b6ad8f568dd6e04e1e8d5ff9fa87b2f35d90992313eff26eedcb486
e32a6ae5e43f7f652674e0f03dc23f86839f839b29ee4e63c01c93da180bb0d0
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4e3e93e78b70bc6e4a01cd3669047ccc88f0c8df0383ade180909c0f2870580
e4f237433fef48f03ba6d84f2677528e1a555fd7956d3b01e09e79d2b326f57d
e527753dd01da7b8f6a6feeae7474c9b8099870ebbf1ea1dacc31f07b10ac8de
e5ad690c7a754826152d2ecab11de59d6d03326ff66af754860112601ca157c3
e6ea464d3d20c2a23b116f868ba8e02e8f79580632cfa26d7721026a49d66b31
edefa01f1cd7ecdfc0ad42300ae3583e3d3f51f0b5a2be2bd476aeebf47f2514
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f9fd92d837373a6762b0b91f80f038ddcf08ee3a2a46efc7dbbe66320008fb07

hotforsecurity.bitdefender.com Open in urlscan Pro 2606:4700::6812:a9de Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

74 Requests

100 %HTTPS

41 %IPv6

17 Domains

30 Subdomains

23 IPs

7 Countries

1539 kBTransfer

3808 kBSize

25 Cookies

31 Outgoing links

Redirected requests

74 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

hotforsecurity.bitdefender.com Open in urlscan Pro
2606:4700::6812:a9de Public Scan

Screenshot
Live screenshot

Full Image

74
Requests

100 %
HTTPS

41 %
IPv6

17
Domains

30
Subdomains

23
IPs

7
Countries

1539 kB
Transfer

3808 kB
Size

25
Cookies

74 HTTP transactions
0 data transactions