URL: https://blog.cyble.com/2023/06/23/trojanized-super-mario-game-installer-spreads-supremebot-malware/
Submission: On June 26 via api from TR — Scanned from DE

Summary

This website contacted 31 IPs in 4 countries across 24 domains to perform 122 HTTP transactions. The main IP is 192.0.78.183, located in San Francisco, United States and belongs to AUTOMATTIC, US. The main domain is blog.cyble.com.
TLS certificate: Issued by R3 on May 25th 2023. Valid for: 3 months.
This is the only time blog.cyble.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
24 192.0.78.183 2635 (AUTOMATTIC)
7 192.0.77.32 2635 (AUTOMATTIC)
3 2a00:1450:400... 15169 (GOOGLE)
5 192.0.77.2 2635 (AUTOMATTIC)
3 2606:4700::68... 13335 (CLOUDFLAR...)
9 2606:4700:20:... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
3 192.0.76.3 2635 (AUTOMATTIC)
1 5 2600:9000:225... 16509 (AMAZON-02)
21 2400:52e0:1e0... 200325 (BUNNYCDN)
4 2606:4700::68... 13335 (CLOUDFLAR...)
1 18.66.112.59 16509 (AMAZON-02)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
2 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a05:d018:cc3... 16509 (AMAZON-02)
2 2001:4860:480... 15169 (GOOGLE)
13 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
2 2a02:26f0:310... 20940 (AKAMAI-ASN1)
1 2a00:1450:400... 15169 (GOOGLE)
1 2600:9000:20e... 16509 (AMAZON-02)
4 4 2620:1ec:21::14 8068 (MICROSOFT...)
1 13.107.42.14 8068 (MICROSOFT...)
5 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:2c40::c7... 209242 (CLOUDFLAR...)
122 31
Apex Domain
Subdomains
Transfer
25 cyble.com
blog.cyble.com
labs.cyble.com
630 KB
22 omappapi.com
a.omappapi.com — Cisco Umbrella Rank: 5771
api.omappapi.com — Cisco Umbrella Rank: 6016
94 KB
15 wp.com
fonts-api.wp.com — Cisco Umbrella Rank: 17288
i0.wp.com — Cisco Umbrella Rank: 3755
s0.wp.com — Cisco Umbrella Rank: 7697
stats.wp.com — Cisco Umbrella Rank: 3092
fonts.wp.com — Cisco Umbrella Rank: 17658
pixel.wp.com — Cisco Umbrella Rank: 2850
532 KB
13 hubspot.com
api.hubspot.com — Cisco Umbrella Rank: 5008
app.hubspot.com — Cisco Umbrella Rank: 5566
track.hubspot.com — Cisco Umbrella Rank: 2462
forms.hubspot.com — Cisco Umbrella Rank: 4653
30 KB
9 amibreached.com
injection.amibreached.com
264 KB
6 adroll.com
s.adroll.com — Cisco Umbrella Rank: 2705
d.adroll.com — Cisco Umbrella Rank: 1432
87 KB
5 hsappstatic.net
static.hsappstatic.net — Cisco Umbrella Rank: 5963
295 KB
5 linkedin.com
px.ads.linkedin.com — Cisco Umbrella Rank: 408
www.linkedin.com — Cisco Umbrella Rank: 563
px4.ads.linkedin.com — Cisco Umbrella Rank: 6542
5 KB
4 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 60
region1.google-analytics.com — Cisco Umbrella Rank: 1832
21 KB
4 hsforms.com
forms.hsforms.com — Cisco Umbrella Rank: 4470
forms-na1.hsforms.com — Cisco Umbrella Rank: 7472
15 KB
3 hsforms.net
js.hsforms.net — Cisco Umbrella Rank: 7235
493 KB
3 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 82
223 KB
2 licdn.com
snap.licdn.com — Cisco Umbrella Rank: 960
6 KB
1 oribi.io
cdn.linkedin.oribi.io — Cisco Umbrella Rank: 1027
375 B
1 gstatic.com
fonts.gstatic.com
19 KB
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 80
1 KB
1 hubapi.com
api.hubapi.com — Cisco Umbrella Rank: 3763
1 KB
1 doubleclick.net
stats.g.doubleclick.net — Cisco Umbrella Rank: 124
345 B
1 usemessages.com
js.usemessages.com — Cisco Umbrella Rank: 5195
22 KB
1 hs-analytics.net
js.hs-analytics.net — Cisco Umbrella Rank: 2379
21 KB
1 hsleadflows.net
js.hsleadflows.net — Cisco Umbrella Rank: 4538
87 KB
1 hs-banner.com
js.hs-banner.com — Cisco Umbrella Rank: 2377
65 KB
1 hsadspixel.net
js.hsadspixel.net — Cisco Umbrella Rank: 3542
3 KB
1 hs-scripts.com
js.hs-scripts.com — Cisco Umbrella Rank: 2641
1 KB
122 24
Domain Requested by
24 blog.cyble.com blog.cyble.com
21 a.omappapi.com blog.cyble.com
a.omappapi.com
9 injection.amibreached.com blog.cyble.com
injection.amibreached.com
7 track.hubspot.com
5 static.hsappstatic.net app.hubspot.com
static.hsappstatic.net
5 s.adroll.com 1 redirects blog.cyble.com
s.adroll.com
5 i0.wp.com blog.cyble.com
4 fonts.wp.com fonts-api.wp.com
3 px.ads.linkedin.com 3 redirects
3 app.hubspot.com js.usemessages.com
static.hsappstatic.net
3 forms.hsforms.com js.hsforms.net
blog.cyble.com
3 js.hsforms.net blog.cyble.com
js.hsforms.net
3 www.googletagmanager.com blog.cyble.com
www.googletagmanager.com
2 snap.licdn.com js.hsadspixel.net
snap.licdn.com
2 pixel.wp.com blog.cyble.com
2 api.hubspot.com js.usemessages.com
2 region1.google-analytics.com www.googletagmanager.com
2 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
2 fonts-api.wp.com blog.cyble.com
1 forms.hubspot.com js.hsleadflows.net
1 labs.cyble.com blog.cyble.com
1 px4.ads.linkedin.com blog.cyble.com
1 www.linkedin.com 1 redirects
1 cdn.linkedin.oribi.io snap.licdn.com
1 fonts.gstatic.com fonts.googleapis.com
1 fonts.googleapis.com a.omappapi.com
1 api.hubapi.com js.hsadspixel.net
1 forms-na1.hsforms.com blog.cyble.com
1 d.adroll.com s.adroll.com
1 stats.g.doubleclick.net www.google-analytics.com
1 js.usemessages.com js.hs-scripts.com
1 js.hs-analytics.net js.hs-scripts.com
1 js.hsleadflows.net js.hs-scripts.com
1 js.hs-banner.com js.hs-scripts.com
1 js.hsadspixel.net js.hs-scripts.com
1 api.omappapi.com a.omappapi.com
1 stats.wp.com blog.cyble.com
1 js.hs-scripts.com blog.cyble.com
1 s0.wp.com blog.cyble.com
122 39
Subject Issuer Validity Valid
tls.automattic.com
R3
2023-05-25 -
2023-08-23
3 months crt.sh
*.wp.com
Sectigo ECC Domain Validation Secure Server CA
2022-11-14 -
2023-12-15
a year crt.sh
*.google-analytics.com
GTS CA 1C3
2023-05-29 -
2023-08-21
3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2023-05-16 -
2024-05-15
a year crt.sh
s.adroll.com
Amazon RSA 2048 M01
2023-06-03 -
2024-07-01
a year crt.sh
a.omappapi.com
R3
2023-05-26 -
2023-08-24
3 months crt.sh
api.opmnstr.com
Amazon RSA 2048 M01
2023-03-01 -
2024-02-08
a year crt.sh
*.g.doubleclick.net
GTS CA 1C3
2023-05-29 -
2023-08-21
3 months crt.sh
d.adroll.com
Amazon RSA 2048 M01
2022-11-08 -
2023-12-07
a year crt.sh
hubspot.com
Cloudflare Inc ECC CA-3
2023-02-05 -
2024-02-05
a year crt.sh
hubapi.com
Cloudflare Inc ECC CA-3
2023-04-07 -
2024-04-06
a year crt.sh
upload.video.google.com
GTS CA 1C3
2023-05-29 -
2023-08-21
3 months crt.sh
snap.licdn.com
DigiCert SHA2 Secure Server CA
2023-02-01 -
2024-01-31
a year crt.sh
*.gstatic.com
GTS CA 1C3
2023-05-29 -
2023-08-21
3 months crt.sh
linkedin.oribi.io
Amazon RSA 2048 M01
2023-06-08 -
2024-07-07
a year crt.sh
hsappstatic.net
Cloudflare Inc ECC CA-3
2023-04-10 -
2024-04-09
a year crt.sh
labs.cyble.com
GTS CA 1P5
2023-05-21 -
2023-08-19
3 months crt.sh

This page contains 5 frames:

Primary Page: https://blog.cyble.com/2023/06/23/trojanized-super-mario-game-installer-spreads-supremebot-malware/
Frame ID: C3A9AEA4406A169CE19C004E219E842D
Requests: 103 HTTP requests in this frame

Frame: https://js.hsforms.net/forms/v2.js
Frame ID: 77649547312796A53666B1E581DACCAB
Requests: 1 HTTP requests in this frame

Frame: https://js.hsforms.net/forms/v2.js
Frame ID: D1BB5E015C1C43F2FCD1674BFC74D524
Requests: 1 HTTP requests in this frame

Frame: https://app.hubspot.com/conversations-visitor/21289959/threads/utk/e2cfb1058d12465db637db36642344d8?uuid=6033cec75f6445d9b3ca509d85a4e507&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=blog.cyble.com&inApp53=false&messagesUtk=e2cfb1058d12465db637db36642344d8&url=https%3A%2F%2Fblog.cyble.com%2F2023%2F06%2F23%2Ftrojanized-super-mario-game-installer-spreads-supremebot-malware%2F&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=true&enableWidgetCookieBanner=false&isInCMS=false
Frame ID: 0402AA77A79C1E3F24204E57FB542BB9
Requests: 9 HTTP requests in this frame

Frame: https://injection.amibreached.com/stats.json
Frame ID: A512F337C960963B00B912FCA9844C38
Requests: 8 HTTP requests in this frame

Screenshot

Page Title

Cyble — Trojanized Super Mario Game Installer Spreads SupremeBot Malware

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]+s\d+\.wp\.com
  • /wp-(?:content|includes)/

Overall confidence: 100%
Detected patterns
  • (?:a|s)\.adroll\.com

Overall confidence: 100%
Detected patterns
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js

Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtag/js

Overall confidence: 100%
Detected patterns
  • js\.hs-analytics\.net/analytics

Overall confidence: 100%
Detected patterns
  • snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Overall confidence: 100%
Detected patterns
  • jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

122
Requests

98 %
HTTPS

81 %
IPv6

24
Domains

39
Subdomains

31
IPs

4
Countries

2910 kB
Transfer

9539 kB
Size

24
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 38
  • https://s.adroll.com/j/exp/ELNAF2EZDFHJRAP3ODLCUU/index.js HTTP 302
  • https://s.adroll.com/j/exp/index.js
Request Chain 96
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4053396&time=1687747521459&url=https%3A%2F%2Fblog.cyble.com%2F2023%2F06%2F23%2Ftrojanized-super-mario-game-installer-spreads-supremebot-malware%2F HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4053396&time=1687747521459&url=https%3A%2F%2Fblog.cyble.com%2F2023%2F06%2F23%2Ftrojanized-super-mario-game-installer-spreads-supremebot-malware%2F&cookiesTest=true HTTP 302
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D4053396%26time%3D1687747521459%26url%3Dhttps%253A%252F%252Fblog.cyble.com%252F2023%252F06%252F23%252Ftrojanized-super-mario-game-installer-spreads-supremebot-malware%252F%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4053396&time=1687747521459&url=https%3A%2F%2Fblog.cyble.com%2F2023%2F06%2F23%2Ftrojanized-super-mario-game-installer-spreads-supremebot-malware%2F&cookiesTest=true&liSync=true HTTP 302
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4053396&time=1687747521459&url=https%3A%2F%2Fblog.cyble.com%2F2023%2F06%2F23%2Ftrojanized-super-mario-game-installer-spreads-supremebot-malware%2F&cookiesTest=true&liSync=true&e_ipv6=AQJFMRsJkzhtvAAAAYj1l24pZGKV47TNVL51-2enCkMoo5gs9zKvdtbJiArIxx3uPwsD1qWVPco91hrAlC56q4rLDgNkQw

122 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
blog.cyble.com/2023/06/23/trojanized-super-mario-game-installer-spreads-supremebot-malware/
344 KB
72 KB
Document
General
Full URL
https://blog.cyble.com/2023/06/23/trojanized-super-mario-game-installer-spreads-supremebot-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
326ea53804b6c42e5807ece38f879b7566bdbb1bd90b9cecaf4bb98e15eacc94
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
max-age=246, must-revalidate
cf-edge-cache
cache,platform=wordpress
content-encoding
br
content-type
text/html; charset=UTF-8
date
Mon, 26 Jun 2023 02:45:19 GMT
host-header
WordPress.com
last-modified
Mon, 26 Jun 2023 02:44:25 GMT
link
<https://blog.cyble.com/wp-json/>; rel="https://api.w.org/" <https://blog.cyble.com/wp-json/wp/v2/posts/17797>; rel="alternate"; type="application/json" <https://wp.me/pbX1h1-4D3>; rel=shortlink
server
nginx
strict-transport-security
max-age=31536000
vary
Accept-Encoding Cookie
x-ac
2.hhn _atomic_ams BYPASS
x-hacker
If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.
x-nananana
Batcache-Hit
x-pingback
https://blog.cyble.com/xmlrpc.php
/
blog.cyble.com/_static/
2 MB
211 KB
Stylesheet
General
Full URL
https://blog.cyble.com/_static/??-eJylVNlyqzAM/aHrGrIQ8nCnn9JxbEHVGMR4KZO/ryCkoQ3QMn0xln10ONrcNkJTHaAOMrxCBV4qH5zi1UPwUnsvK6yxQDCycD3SPPHJE9/8a+/OjY0l1l6Wkc0TuFKeIlojT5b0WVg8OeUu0oeLhTlXqy4UgygdmmXgG4RG6fPt+/LOmshJFQNVKgTUtxvxjgaoccBRjOWAwcAOveFlD+IV2tsPsdY2Gs7FG0fPYAWWU8MKxkbDesEJC6XSl3FKZr35bmwvpfEVlGHygijwZ3DoYryXZQYyx/jAwTWRgAy70n3ei/5sSdyknN80x6QG32IDrue4bqcYYmNJmTFDh2/IB7E/JPmPPxSNo7Vqow3I/QSP6Wcn0bFELqVYolqQfdyk6drqc2fJFk3JGsSXKH4YlIpMtNCl+8zr5GzdlPbTL5QxVI/3Ittle53mabHZHtKdSLMsT/b5cUXA+fa4XwPfJds18Cx5YJ9Lw5BC6Umjstd+/2LMEWmiM4Koid8YuPfR6pYvGCRUC56qgYYPBvvvZPzU1mbdAE/yeLK4fpwfaByU0arJqf5eoA4+7Dvoc/U/zfLDJtmkef4B9pWHAw==
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/06/23/trojanized-super-mario-game-installer-spreads-supremebot-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
fb042fd5b6d37629abcbb8734569435d6719471a28d128b47f755930b9c0b434
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/2023/06/23/trojanized-super-mario-game-installer-spreads-supremebot-malware/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-hacker
If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.
date
Mon, 26 Jun 2023 02:45:20 GMT
strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Mon, 19 Jun 2023 19:16:28 GMT
server
nginx
x-ac
2.hhn _atomic_ams BYPASS
x-page-optimize
uncached
etag
W/"b7481a7caa0c8202a60368ba84d9d4bf"
vary
Accept-Encoding
content-type
text/css;charset=utf-8
cache-control
max-age=31536000
host-header
WordPress.com
wp-emoji-release.min.js
blog.cyble.com/wp-includes/js/
18 KB
5 KB
Script
General
Full URL
https://blog.cyble.com/wp-includes/js/wp-emoji-release.min.js?ver=6.2.2
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/06/23/trojanized-super-mario-game-installer-spreads-supremebot-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
4f79a89d16a5f717110fe080c0bf90b7e05ff95a4c4983f64d33110bf5f9c230
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/2023/06/23/trojanized-super-mario-game-installer-spreads-supremebot-malware/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:20 GMT
strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Thu, 02 Feb 2023 00:53:25 GMT
server
nginx
x-ac
2.hhn _atomic_ams BYPASS
etag
W/"63db0985-4904"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=315360000
expires
Thu, 31 Dec 2037 23:55:55 GMT
css
fonts-api.wp.com/
3 KB
1018 B
Stylesheet
General
Full URL
https://fonts-api.wp.com/css?family=Lora%3A400%7CLato%3A400%2C700&display=fallback&ver=4.1.5
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/06/23/trojanized-super-mario-game-installer-spreads-supremebot-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
a1020a8c9c2ec5c451dfc31ff1564dee690d603c4cb68049328581adc77ca7c2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:19 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
content-encoding
gzip
cross-origin-resource-policy
cross-origin
x-xss-protection
0
x-nc
BYPASS hhn 2
last-modified
Mon, 26 Jun 2023 02:45:19 GMT
server
nginx
cross-origin-opener-policy
same-origin-allow-popups
vary
Accept-Encoding, Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
css
fonts-api.wp.com/
76 KB
2 KB
Stylesheet
General
Full URL
https://fonts-api.wp.com/css?family=Open+Sans%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic%7CRoboto+Slab%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic%7CRoboto%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic&display=auto&ver=6.2.2
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/06/23/trojanized-super-mario-game-installer-spreads-supremebot-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
43cd95e62bc0c1b1d69ca1cd990e165063bc64005b3ee18aa947404de928441d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:19 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
content-encoding
gzip
cross-origin-resource-policy
cross-origin
x-xss-protection
0
x-nc
BYPASS hhn 2
last-modified
Mon, 26 Jun 2023 02:45:19 GMT
server
nginx
cross-origin-opener-policy
same-origin-allow-popups
vary
Accept-Encoding, Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
jquery.min.js
blog.cyble.com/wp-includes/js/jquery/
88 KB
31 KB
Script
General
Full URL
https://blog.cyble.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.4
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/06/23/trojanized-super-mario-game-installer-spreads-supremebot-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
afacce23cb4feaaaef37997f8439819d8f827df4951f3ff02704c9f16fb7f53a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/2023/06/23/trojanized-super-mario-game-installer-spreads-supremebot-malware/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:19 GMT
strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Wed, 08 Mar 2023 18:37:33 GMT
server
nginx
x-ac
2.hhn _atomic_ams BYPASS
etag
W/"6408d5ed-15ed7"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=315360000
expires
Thu, 31 Dec 2037 23:55:55 GMT
jquery-migrate.min.js
blog.cyble.com/wp-includes/js/jquery/
13 KB
5 KB
Script
General
Full URL
https://blog.cyble.com/wp-includes/js/jquery/jquery-migrate.min.js?m=1675717155
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/06/23/trojanized-super-mario-game-installer-spreads-supremebot-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
9810aee7e6d57d8cceaa96322b88e6df46710194689ae12b284149148cabc2f3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/2023/06/23/trojanized-super-mario-game-installer-spreads-supremebot-malware/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:19 GMT
strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Mon, 06 Feb 2023 20:59:15 GMT
server
nginx
x-ac
2.hhn _atomic_ams BYPASS
etag
W/"63e16a23-3470"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=315360000
expires
Thu, 31 Dec 2037 23:55:55 GMT
front.min.js
blog.cyble.com/wp-content/plugins/cookie-notice/js/
8 KB
2 KB
Script
General
Full URL
https://blog.cyble.com/wp-content/plugins/cookie-notice/js/front.min.js?ver=2.4.8
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/06/23/trojanized-super-mario-game-installer-spreads-supremebot-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
08756c47213d461baa3b01f42448a76d11f524470c7a34f9018733889bd4f49c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/2023/06/23/trojanized-super-mario-game-installer-spreads-supremebot-malware/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:20 GMT
strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Tue, 28 Mar 2023 18:11:40 GMT
server
nginx
x-ac
2.hhn _atomic_ams BYPASS
etag
W/"64232ddc-21fc"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=315360000
expires
Thu, 31 Dec 2037 23:55:55 GMT
js
www.googletagmanager.com/gtag/
175 KB
64 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=UA-201575643-1
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/06/23/trojanized-super-mario-game-installer-spreads-supremebot-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
7fdc96633d58d8fb43e65670278eabbb439df3ef259027bdadb6918c3ea41b25
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:20 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
65166
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Mon, 26 Jun 2023 02:45:20 GMT
subscribe-to-CRIL.jpg
i0.wp.com/blog.cyble.com/wp-content/uploads/2021/11/
16 KB
16 KB
Image
General
Full URL
https://i0.wp.com/blog.cyble.com/wp-content/uploads/2021/11/subscribe-to-CRIL.jpg
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/06/23/trojanized-super-mario-game-installer-spreads-supremebot-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
382e9768b5578d5ad05e51e37670a3cf93d4593a49bcbee1f5e8b66d0d8c1c53
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-nc
HIT hhn 3
date
Mon, 26 Jun 2023 02:45:20 GMT
x-content-type-options
nosniff
last-modified
Sat, 10 Dec 2022 20:48:17 GMT
server
nginx
etag
"90f4a9863ca68d73"
vary
Accept
access-control-allow-methods
GET, HEAD
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=63115200
timing-allow-origin
*
link
<http://blog.cyble.com/wp-content/uploads/2021/11/subscribe-to-CRIL.jpg>; rel="canonical"
content-length
16232
expires
Tue, 10 Dec 2024 08:48:17 GMT
v2.js
js.hsforms.net/forms/
526 KB
165 KB
Script
General
Full URL
https://js.hsforms.net/forms/v2.js
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/06/23/trojanized-super-mario-game-installer-spreads-supremebot-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:bc41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5f2eaa8243f3b2f1c29a99a509e2e4bcc65c19bd288edcdbcf4f7b2f14cc5e10
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-encoding
br
age
476
x-evy-trace-route-service-name
envoyset-translator
x-amz-server-side-encryption
AES256
content-security-policy-report-only
frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=forms-embed/static-1.3339/bundles/project-v2.js&cfRay=7dd211763f70928f-FRA
x-amz-replication-status
COMPLETED
x-evy-trace-listener
listener_https
etag
W/"ae5063d72b58cf4bd6e3b1970722d727"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
x-evy-trace-virtual-host
all
cache-control
s-maxage=600, max-age=300
x-hs-target-asset
forms-embed/static-1.3339/bundles/project-v2.js
date
Mon, 26 Jun 2023 02:45:20 GMT
x-amz-version-id
.lJqI7SEJc.LNL1fj.0aGIvTPC5x63d4
via
1.1 66b6cd04ec22251498906e833eb08668.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-amz-cf-pop
IAD12-P3
x-cache
Hit from cloudfront
cache-tag
staticjsapp-forms-embed-v2-web-prod,staticjsapp-prod
x-envoy-upstream-service-time
2
alt-svc
h3=":443"; ma=86400
x-evy-trace-route-configuration
listener_https/all
x-request-id
bfda5f61-8073-454a-9caf-0a3daa6263d7
last-modified
Tue, 20 Jun 2023 10:30:05 UTC
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nRkhhpsKMMSll98ujifnhZhcsRYtPGE%2BiXDIbk1qb98aLR7BICl6vf1mCxIi9p%2BQj%2FX%2FbcppnZm7mOViZ9DKAUolY95urrOIw1LtXUrac9EmpQm7bQKz%2FpCvnsATD6Jg1BRHywgkf06%2BByeX"}],"group":"cf-nel","max_age":604800}
x-hs-cache-status
HIT
x-evy-trace-served-by-pod
iad02/app-td/envoy-proxy-57ff77fcd-5flz8
cf-ray
7dd21d113a751c01-FRA
x-amz-cf-id
i9Oge5adcqvZ6nju6ReonMUJs6s7rGjdVMXkgDyH6CSUZyUfgM_wHA==
aib-injectable.js
injection.amibreached.com/
2 KB
1 KB
Script
General
Full URL
https://injection.amibreached.com/aib-injectable.js
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/06/23/trojanized-super-mario-game-installer-spreads-supremebot-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4768 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
186cb05caa2a06748336b3123d7ac53986a650cffcab18f34e5c0ee3c057f591
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:20 GMT
strict-transport-security
max-age=15552000; includeSubDomains; preload
via
1.1 7ce1191b390045e05b9cc74f7514b77a.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-content-type-options
nosniff
age
4533
x-amz-cf-pop
FRA6-C1
content-encoding
br
x-cache
Hit from cloudfront
last-modified
Mon, 23 May 2022 20:31:50 GMT
server
cloudflare
etag
W/"662ed2e07a2c9b151332e0a8da3b9922"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=y1%2Fz9aNDAhYr8CXT98nKx5g8VHi1tOgiopCQEk5jDcytguJShiDN4FkZ7XF2Rqheoa0d%2BIP00r669OMvU88TLuBUkp8h2RqhUrQJE7f%2BD45vzrZVA3GGJ06AbEyRckwasIfYAOUbNmrphhcOOBX9bcZMXxnsID4%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=120
cf-ray
7dd21d12a9ac1cc9-FRA
x-amz-cf-id
OLRXn0U4Mzu3mpfA671Ogubc5Cq-Sxme2Fy4nm2FDyQZ-CZG8opUDw==
bilmur.min.js
s0.wp.com/wp-content/js/
7 KB
3 KB
Script
General
Full URL
https://s0.wp.com/wp-content/js/bilmur.min.js?m=202326
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/06/23/trojanized-super-mario-game-installer-spreads-supremebot-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
51dc1ea3b9642d966bbdf2c63346e4d2d3f668a693fa8e7f1e31bf6acbe48860

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-nc
HIT hhn 2
date
Mon, 26 Jun 2023 02:45:20 GMT
content-encoding
br
x-ac
2.hhn _dfw MISS
last-modified
Fri, 19 May 2023 03:00:48 GMT
server
nginx
etag
W/"6466e660-1a69"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
expires
Tue, 25 Jun 2024 00:00:01 GMT
/
blog.cyble.com/_static/
37 KB
8 KB
Stylesheet
General
Full URL
https://blog.cyble.com/_static/??-eJyVjFsKgCAQAC+ULQaZP9FZTJewfOG6eP0I6gD9zjDTi7A5NUwNSuDDJ4ITWzH2gpgdBySwpmYmDEDdF6xi5+QCjpZo6D/qV4gPPIMtrlItk5y1VvoGzj40MA==
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/06/23/trojanized-super-mario-game-installer-spreads-supremebot-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
cd924076cd6bdad7693c484ab0a812a3e8eb905cf751b36b9533dc97380eb277
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/2023/06/23/trojanized-super-mario-game-installer-spreads-supremebot-malware/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-hacker
If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.
date
Mon, 26 Jun 2023 02:45:20 GMT
strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Tue, 27 Dec 2022 16:34:28 GMT
server
nginx
x-ac
2.hhn _atomic_ams BYPASS
x-page-optimize
uncached
etag
W/"f10c7e84a22172fd36bd0473ba2ec996"
vary
Accept-Encoding
content-type
text/css;charset=utf-8
cache-control
max-age=31536000
host-header
WordPress.com
/
blog.cyble.com/_static/
21 KB
5 KB
Script
General
Full URL
https://blog.cyble.com/_static/??wp-content/themes/astra/assets/js/minified/frontend.min.js,wp-content/plugins/jetpack/jetpack_vendor/automattic/jetpack-image-cdn/dist/image-cdn.js?m=1684390270
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/06/23/trojanized-super-mario-game-installer-spreads-supremebot-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
f9d498e1b9cff1af27250e8d52ebf9eaf672ff517d586e0d381e7bf348bc6ea1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/2023/06/23/trojanized-super-mario-game-installer-spreads-supremebot-malware/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-hacker
If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.
date
Mon, 26 Jun 2023 02:45:20 GMT
strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Thu, 18 May 2023 06:11:10 GMT
server
nginx
x-ac
2.hhn _atomic_ams BYPASS
x-page-optimize
uncached
etag
W/"8ee86e3fe916069b68662d1100a8e664"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=31536000
host-header
WordPress.com
21289959.js
js.hs-scripts.com/
2 KB
1 KB
Script
General
Full URL
https://js.hs-scripts.com/21289959.js?integration=WordPress&ver=10.1.24
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/06/23/trojanized-super-mario-game-installer-spreads-supremebot-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:863b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
aefc1c0ff2296fe06d13165c9103127f201b846d75efb1fbf400fe522e0886d5

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:20 GMT
content-encoding
br
cf-cache-status
EXPIRED
x-hubspot-correlation-id
6ceb8dfa-e49c-43e0-affa-612272142bb4
x-evy-trace-route-service-name
envoyset-translator
x-envoy-upstream-service-time
5
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
52797990-59dc-4321-b8ec-216ceb61ff53
last-modified
Mon, 26 Jun 2023 02:11:08 GMT
server
cloudflare
x-trace
2B49E77891D3EB24D3C5C2FDEC7CAFD6BF1C6CBC74000000000000000000
vary
origin, Accept-Encoding
access-control-max-age
3600
content-type
application/javascript;charset=utf-8
access-control-allow-origin
https://blog.cyble.com
x-evy-trace-virtual-host
all
cache-control
public, max-age=60
access-control-allow-credentials
true
x-evy-trace-served-by-pod
iad02/hubapi-td/envoy-proxy-598c95b5b7-qtxhk
cf-ray
7dd21d122e369963-FRA
expires
Mon, 26 Jun 2023 02:46:20 GMT
/
blog.cyble.com/_static/
46 KB
11 KB
Script
General
Full URL
https://blog.cyble.com/_static/??-eJytjVEOgjAQRC9kLYVa4cNwFLO2KylC23S3ED29/BA5gF8zmUneW5OwMTAGliVNERxJIM4gwLkYjl0YbS5WtbV6Vtpq0SlTN8ro80in9UdJUxl8IDkiJ7CvPe8LBhezhMJxBmZv90dM8HkLP8OAJJ0nln4jZULLfrPGB2FeMP9fcxg2eD/flGl101X1VX8BRL1l5Q==
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/06/23/trojanized-super-mario-game-installer-spreads-supremebot-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ac26533e2901023194baed8e192053457bd8131eb098b5c77890c0bbaf3dc7a3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/2023/06/23/trojanized-super-mario-game-installer-spreads-supremebot-malware/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-hacker
If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.
date
Mon, 26 Jun 2023 02:45:20 GMT
strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Thu, 18 May 2023 06:11:14 GMT
server
nginx
x-ac
2.hhn _atomic_ams BYPASS
x-page-optimize
uncached
etag
W/"747bdee1e027332c48bcff1635823f42"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=31536000
host-header
WordPress.com
e-202326.js
stats.wp.com/
13 KB
4 KB
Script
General
Full URL
https://stats.wp.com/e-202326.js
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/06/23/trojanized-super-mario-game-installer-spreads-supremebot-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ab8517f3d5171dd42a8b9c22af6a2f944b41d00e7ea54ba02b4ed71a6c59e543

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-nc
HIT hhn
date
Mon, 26 Jun 2023 02:45:20 GMT
content-encoding
br
last-modified
Fri, 19 May 2023 02:56:22 GMT
server
nginx
etag
W/"6466e556-3508"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
expires
Sun, 23 Jun 2024 21:00:08 GMT
/
blog.cyble.com/_static/
277 KB
71 KB
Script
General
Full URL
https://blog.cyble.com/_static/??-eJydU9tuwjAM/aGFiAltvEz7FJQ2pk1x4yxOYOzr57aEIaF1oy9N4+NzfM0pqJp8Ap90wNw4z7oFYyGqPVGSAxB6QSlq52vdsd7H0d+uOn463bMzJtebBDdEwwyJde+8En42gMqboxI0r8T4sBC6SncfGeK5YCoCuy+4WHfTbbk2C4EOTvR4N/3NaHWQgqkPejf0p8oOra5NpMyABVPFMCNDITnfk2dpeknGOk5Dy1vAAPGGLKEwW+ABlEIaYCQZml1cMqOTEsbvYg3HlChAORfp3O5IIE48o3IlqxCpCAj5BNXYdLGuYvYSai6XuxR+FBayywNRPdmMwL/MbRzuUfyELFAgPO8dovhATP/gRGhAXM3QgL8TbbJcK4jNZUUnEdmeIdo1+GOpPhCulVc0BLPweWG992/rl+3rZrteb56/AaHku90=
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/06/23/trojanized-super-mario-game-installer-spreads-supremebot-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
2c8d8489d8fd8a050c57648cef913573c447f112000d4b3c7bbf468ad0fef500
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/2023/06/23/trojanized-super-mario-game-installer-spreads-supremebot-malware/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-hacker
If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.
date
Mon, 26 Jun 2023 02:45:20 GMT
strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Fri, 23 Jun 2023 00:45:42 GMT
server
nginx
x-ac
2.hhn _atomic_ams BYPASS
x-page-optimize
uncached
etag
W/"74036a3219672376f67f0a2af9bc0660"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=31536000
host-header
WordPress.com
index.min.js
blog.cyble.com/wp-content/plugins/gutenberg/build/i18n/
9 KB
4 KB
Script
General
Full URL
https://blog.cyble.com/wp-content/plugins/gutenberg/build/i18n/index.min.js?ver=5baa98e4345eccc97e24
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/06/23/trojanized-super-mario-game-installer-spreads-supremebot-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
d743ad07240fdc75d2e2a357b4ff44b334f6d4c53683e31e824aaf61d3bad0c9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/2023/06/23/trojanized-super-mario-game-installer-spreads-supremebot-malware/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:20 GMT
strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Wed, 14 Jun 2023 12:06:14 GMT
server
nginx
x-ac
2.hhn _atomic_ams BYPASS
etag
W/"6489ad36-227d"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=315360000
expires
Thu, 31 Dec 2037 23:55:55 GMT
frontend.min.js
blog.cyble.com/wp-content/plugins/elementor-pro/assets/js/
24 KB
7 KB
Script
General
Full URL
https://blog.cyble.com/wp-content/plugins/elementor-pro/assets/js/frontend.min.js?ver=3.14.0
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/06/23/trojanized-super-mario-game-installer-spreads-supremebot-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
a323774304195e5b85ee7e0006282e22cbb7980ab6509d27d8add0928e55d8ab
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/2023/06/23/trojanized-super-mario-game-installer-spreads-supremebot-malware/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:20 GMT
strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Mon, 19 Jun 2023 13:11:10 GMT
server
nginx
x-ac
2.hhn _atomic_ams BYPASS
etag
W/"649053ee-5f3c"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=315360000
expires
Thu, 31 Dec 2037 23:55:55 GMT
/
blog.cyble.com/_static/
33 KB
10 KB
Script
General
Full URL
https://blog.cyble.com/_static/??wp-content/plugins/elementor/assets/lib/waypoints/waypoints.min.js,wp-includes/js/jquery/ui/core.min.js?m=1687167852
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/06/23/trojanized-super-mario-game-installer-spreads-supremebot-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
f7f54c64cbe8e1c50bf7e5d79509a8e98213738228ada4fb4dca88bebae7d788
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/2023/06/23/trojanized-super-mario-game-installer-spreads-supremebot-malware/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-hacker
If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.
date
Mon, 26 Jun 2023 02:45:20 GMT
strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Mon, 19 Jun 2023 09:44:12 GMT
server
nginx
x-ac
2.hhn _atomic_ams BYPASS
x-page-optimize
uncached
etag
W/"3766434b9bc8548d00099956a269f6f8"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=31536000
host-header
WordPress.com
frontend.min.js
blog.cyble.com/wp-content/plugins/elementor/assets/js/
40 KB
13 KB
Script
General
Full URL
https://blog.cyble.com/wp-content/plugins/elementor/assets/js/frontend.min.js?ver=3.14.0
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/06/23/trojanized-super-mario-game-installer-spreads-supremebot-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
7a3a19faa84ab238ac542e09efa9a6e3575b46805b9a43343b3cb445e08b1ecc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/2023/06/23/trojanized-super-mario-game-installer-spreads-supremebot-malware/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:20 GMT
strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Mon, 19 Jun 2023 09:44:12 GMT
server
nginx
x-ac
2.hhn _atomic_ams BYPASS
etag
W/"6490236c-9f54"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=315360000
expires
Thu, 31 Dec 2037 23:55:55 GMT
elements-handlers.min.js
blog.cyble.com/wp-content/plugins/elementor-pro/assets/js/
29 KB
7 KB
Script
General
Full URL
https://blog.cyble.com/wp-content/plugins/elementor-pro/assets/js/elements-handlers.min.js?ver=3.14.0
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/06/23/trojanized-super-mario-game-installer-spreads-supremebot-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
264b5704353c6b1b2eff2e9599db601876730ffff07a5949b3b3f8be0b9c7b84
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/2023/06/23/trojanized-super-mario-game-installer-spreads-supremebot-malware/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:20 GMT
strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Mon, 19 Jun 2023 13:11:10 GMT
server
nginx
x-ac
2.hhn _atomic_ams BYPASS
etag
W/"649053ee-74fb"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=315360000
expires
Thu, 31 Dec 2037 23:55:55 GMT
jquery.sticky.min.js
blog.cyble.com/wp-content/plugins/elementor-pro/assets/lib/sticky/
4 KB
2 KB
Script
General
Full URL
https://blog.cyble.com/wp-content/plugins/elementor-pro/assets/lib/sticky/jquery.sticky.min.js?m=1687180270
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/06/23/trojanized-super-mario-game-installer-spreads-supremebot-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
34bbd1c367ffc7d80fcff86c7e5f8777e70f4911bb324e8ecfc7dd3604a96e68
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/2023/06/23/trojanized-super-mario-game-installer-spreads-supremebot-malware/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:20 GMT
strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Mon, 19 Jun 2023 13:11:10 GMT
server
nginx
x-ac
2.hhn _atomic_ams BYPASS
etag
W/"649053ee-e89"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=315360000
expires
Thu, 31 Dec 2037 23:55:55 GMT
roundtrip.js
s.adroll.com/j/ELNAF2EZDFHJRAP3ODLCUU/
87 KB
26 KB
Script
General
Full URL
https://s.adroll.com/j/ELNAF2EZDFHJRAP3ODLCUU/roundtrip.js
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/06/23/trojanized-super-mario-game-installer-spreads-supremebot-malware/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:225e:4000:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
add5990fd8f0c489398ae393e3a1fc1b4a2791139f56835f72628b1b15a20ee3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

X-Amz-Version-Id
WNXs5pOSyVo4CQxOo8y0QSF9.6VRSpVz
Content-Encoding
gzip
Via
1.1 dd4531988f4862a3b186f9d3356a6a74.cloudfront.net (CloudFront)
Date
Mon, 26 Jun 2023 02:45:20 GMT
Age
870
X-Amz-Cf-Pop
FRA60-P4
X-Amz-Server-Side-Encryption
AES256
Transfer-Encoding
chunked
X-Cache
Hit from cloudfront
Connection
keep-alive
Last-Modified
Sat, 24 Jun 2023 12:20:01 GMT
Server
AmazonS3
Etag
W/"3aad986131726bb5b4c320c62bb52f4f"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
Content-Type
text/javascript; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=3600, must-revalidate
Access-Control-Allow-Credentials
false
Access-Control-Max-Age
600
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
0g8fPVG68-OceXv3_QtZTeh_FgNlZZvkqiXdrf5-3GHMW_zUK4b1cw==
truncated
/
42 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/gif
api.min.js
a.omappapi.com/app/js/
50 KB
19 KB
Script
General
Full URL
https://a.omappapi.com/app/js/api.min.js
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/06/23/trojanized-super-mario-game-installer-spreads-supremebot-malware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1079:1 , Germany, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software
BunnyCDN-DE1-1079 /
Resource Hash
95ab28dd9cbacf9d30b20a000b9ff8ba46329d26b4ccb8731dcddb61f5fc1975

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:20 GMT
content-encoding
br
cdn-edgestorageid
722
perma-cache
HIT
cdn-storageserver
DE-575
cdn-cachedat
06/23/2023 06:21:08
cdn-pullzone
293267
last-modified
Wed, 21 Jun 2023 22:58:10 GMT
server
BunnyCDN-DE1-1079
cdn-fileserver
383
cdn-requestpullcode
200
cdn-proxyver
1.03
etag
W/"64938082-c67d"
vary
Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
efcab737-66db-4b75-ab55-ed485d5a01dd
access-control-expose-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control
public, max-age=31919000
cdn-requestid
388afa6fafc415ec95bf8e47da21ff8b
cdn-requestcountrycode
DE
access-control-allow-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status
200
cdn-requestpullsuccess
True
0QI6MX1D_JOuGQbT0gvTJPa787weuxJBkq0.woff2
fonts.wp.com/s/lora/v32/
19 KB
19 KB
Font
General
Full URL
https://fonts.wp.com/s/lora/v32/0QI6MX1D_JOuGQbT0gvTJPa787weuxJBkq0.woff2
Requested by
Host: fonts-api.wp.com
URL: https://fonts-api.wp.com/css?family=Lora%3A400%7CLato%3A400%2C700&display=fallback&ver=4.1.5
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
7ff7d3790060dcf14289ea0e50e7df1f00893e53e882ff3101e078b2f948589f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts-api.wp.com/
Origin
https://blog.cyble.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-nc
HIT hhn 2
date
Mon, 26 Jun 2023 02:45:20 GMT
x-content-type-options
nosniff
last-modified
Tue, 21 Feb 2023 21:45:57 GMT
server
nginx
age
60006
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
content-length
19300
x-xss-protection
0
S6uyw4BMUTPHjx4wXg.woff2
fonts.wp.com/s/lato/v24/
23 KB
23 KB
Font
General
Full URL
https://fonts.wp.com/s/lato/v24/S6uyw4BMUTPHjx4wXg.woff2
Requested by
Host: fonts-api.wp.com
URL: https://fonts-api.wp.com/css?family=Lora%3A400%7CLato%3A400%2C700&display=fallback&ver=4.1.5
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts-api.wp.com/
Origin
https://blog.cyble.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-nc
HIT hhn 2
date
Mon, 26 Jun 2023 02:45:20 GMT
x-content-type-options
nosniff
last-modified
Tue, 02 May 2023 15:17:22 GMT
server
nginx
age
587
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
content-length
23580
x-xss-protection
0
fa-solid-900.woff2
blog.cyble.com/wp-content/plugins/elementor/assets/lib/font-awesome/webfonts/
76 KB
77 KB
Font
General
Full URL
https://blog.cyble.com/wp-content/plugins/elementor/assets/lib/font-awesome/webfonts/fa-solid-900.woff2
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/_static/??-eJylVNlyqzAM/aHrGrIQ8nCnn9JxbEHVGMR4KZO/ryCkoQ3QMn0xln10ONrcNkJTHaAOMrxCBV4qH5zi1UPwUnsvK6yxQDCycD3SPPHJE9/8a+/OjY0l1l6Wkc0TuFKeIlojT5b0WVg8OeUu0oeLhTlXqy4UgygdmmXgG4RG6fPt+/LOmshJFQNVKgTUtxvxjgaoccBRjOWAwcAOveFlD+IV2tsPsdY2Gs7FG0fPYAWWU8MKxkbDesEJC6XSl3FKZr35bmwvpfEVlGHygijwZ3DoYryXZQYyx/jAwTWRgAy70n3ei/5sSdyknN80x6QG32IDrue4bqcYYmNJmTFDh2/IB7E/JPmPPxSNo7Vqow3I/QSP6Wcn0bFELqVYolqQfdyk6drqc2fJFk3JGsSXKH4YlIpMtNCl+8zr5GzdlPbTL5QxVI/3Ittle53mabHZHtKdSLMsT/b5cUXA+fa4XwPfJds18Cx5YJ9Lw5BC6Umjstd+/2LMEWmiM4Koid8YuPfR6pYvGCRUC56qgYYPBvvvZPzU1mbdAE/yeLK4fpwfaByU0arJqf5eoA4+7Dvoc/U/zfLDJtmkef4B9pWHAw==
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
d0b4256abed72481585662971262eabee345c19f837af00d7ce24239d3b40eef
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://blog.cyble.com/_static/??-eJylVNlyqzAM/aHrGrIQ8nCnn9JxbEHVGMR4KZO/ryCkoQ3QMn0xln10ONrcNkJTHaAOMrxCBV4qH5zi1UPwUnsvK6yxQDCycD3SPPHJE9/8a+/OjY0l1l6Wkc0TuFKeIlojT5b0WVg8OeUu0oeLhTlXqy4UgygdmmXgG4RG6fPt+/LOmshJFQNVKgTUtxvxjgaoccBRjOWAwcAOveFlD+IV2tsPsdY2Gs7FG0fPYAWWU8MKxkbDesEJC6XSl3FKZr35bmwvpfEVlGHygijwZ3DoYryXZQYyx/jAwTWRgAy70n3ei/5sSdyknN80x6QG32IDrue4bqcYYmNJmTFDh2/IB7E/JPmPPxSNo7Vqow3I/QSP6Wcn0bFELqVYolqQfdyk6drqc2fJFk3JGsSXKH4YlIpMtNCl+8zr5GzdlPbTL5QxVI/3Ittle53mabHZHtKdSLMsT/b5cUXA+fa4XwPfJds18Cx5YJ9Lw5BC6Umjstd+/2LMEWmiM4Koid8YuPfR6pYvGCRUC56qgYYPBvvvZPzU1mbdAE/yeLK4fpwfaByU0arJqf5eoA4+7Dvoc/U/zfLDJtmkef4B9pWHAw==
Origin
https://blog.cyble.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:21 GMT
strict-transport-security
max-age=31536000
x-ac
2.hhn _atomic_ams BYPASS
last-modified
Mon, 19 Jun 2023 09:44:12 GMT
server
nginx
etag
"6490236c-13174"
access-control-allow-methods
GET, HEAD
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
max-age=604800
accept-ranges
bytes
content-length
78196
expires
Mon, 03 Jul 2023 02:45:20 GMT
fa-brands-400.woff2
blog.cyble.com/wp-content/plugins/elementor/assets/lib/font-awesome/webfonts/
75 KB
75 KB
Font
General
Full URL
https://blog.cyble.com/wp-content/plugins/elementor/assets/lib/font-awesome/webfonts/fa-brands-400.woff2
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/_static/??-eJylVNlyqzAM/aHrGrIQ8nCnn9JxbEHVGMR4KZO/ryCkoQ3QMn0xln10ONrcNkJTHaAOMrxCBV4qH5zi1UPwUnsvK6yxQDCycD3SPPHJE9/8a+/OjY0l1l6Wkc0TuFKeIlojT5b0WVg8OeUu0oeLhTlXqy4UgygdmmXgG4RG6fPt+/LOmshJFQNVKgTUtxvxjgaoccBRjOWAwcAOveFlD+IV2tsPsdY2Gs7FG0fPYAWWU8MKxkbDesEJC6XSl3FKZr35bmwvpfEVlGHygijwZ3DoYryXZQYyx/jAwTWRgAy70n3ei/5sSdyknN80x6QG32IDrue4bqcYYmNJmTFDh2/IB7E/JPmPPxSNo7Vqow3I/QSP6Wcn0bFELqVYolqQfdyk6drqc2fJFk3JGsSXKH4YlIpMtNCl+8zr5GzdlPbTL5QxVI/3Ittle53mabHZHtKdSLMsT/b5cUXA+fa4XwPfJds18Cx5YJ9Lw5BC6Umjstd+/2LMEWmiM4Koid8YuPfR6pYvGCRUC56qgYYPBvvvZPzU1mbdAE/yeLK4fpwfaByU0arJqf5eoA4+7Dvoc/U/zfLDJtmkef4B9pWHAw==
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
43c072c16c9ee6d67acdfa6c6d6685ff1e74eb4237b7cc3c1348ab1c108b26af
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://blog.cyble.com/_static/??-eJylVNlyqzAM/aHrGrIQ8nCnn9JxbEHVGMR4KZO/ryCkoQ3QMn0xln10ONrcNkJTHaAOMrxCBV4qH5zi1UPwUnsvK6yxQDCycD3SPPHJE9/8a+/OjY0l1l6Wkc0TuFKeIlojT5b0WVg8OeUu0oeLhTlXqy4UgygdmmXgG4RG6fPt+/LOmshJFQNVKgTUtxvxjgaoccBRjOWAwcAOveFlD+IV2tsPsdY2Gs7FG0fPYAWWU8MKxkbDesEJC6XSl3FKZr35bmwvpfEVlGHygijwZ3DoYryXZQYyx/jAwTWRgAy70n3ei/5sSdyknN80x6QG32IDrue4bqcYYmNJmTFDh2/IB7E/JPmPPxSNo7Vqow3I/QSP6Wcn0bFELqVYolqQfdyk6drqc2fJFk3JGsSXKH4YlIpMtNCl+8zr5GzdlPbTL5QxVI/3Ittle53mabHZHtKdSLMsT/b5cUXA+fa4XwPfJds18Cx5YJ9Lw5BC6Umjstd+/2LMEWmiM4Koid8YuPfR6pYvGCRUC56qgYYPBvvvZPzU1mbdAE/yeLK4fpwfaByU0arJqf5eoA4+7Dvoc/U/zfLDJtmkef4B9pWHAw==
Origin
https://blog.cyble.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:20 GMT
strict-transport-security
max-age=31536000
x-ac
2.hhn _atomic_ams BYPASS
last-modified
Mon, 19 Jun 2023 09:44:12 GMT
server
nginx
etag
"6490236c-12bdc"
access-control-allow-methods
GET, HEAD
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
max-age=604800
accept-ranges
bytes
content-length
76764
expires
Mon, 03 Jul 2023 02:45:20 GMT
S6u9w4BMUTPHh6UVSwiPGQ.woff2
fonts.wp.com/s/lato/v24/
23 KB
23 KB
Font
General
Full URL
https://fonts.wp.com/s/lato/v24/S6u9w4BMUTPHh6UVSwiPGQ.woff2
Requested by
Host: fonts-api.wp.com
URL: https://fonts-api.wp.com/css?family=Lora%3A400%7CLato%3A400%2C700&display=fallback&ver=4.1.5
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
c447dd7677b419db7b21dbdfc6277c7816a913ffda76fd2e52702df538de0e49
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts-api.wp.com/
Origin
https://blog.cyble.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-nc
HIT hhn 2
date
Mon, 26 Jun 2023 02:45:20 GMT
x-content-type-options
nosniff
last-modified
Tue, 02 May 2023 15:07:25 GMT
server
nginx
age
508
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
content-length
23040
x-xss-protection
0
Cyble-CIRIL-pyyv4ww1nowvginyhq7nrmlg0x8pxv1qcifo3udnvq.png
blog.cyble.com/wp-content/uploads/elementor/thumbs/
4 KB
5 KB
Image
General
Full URL
https://blog.cyble.com/wp-content/uploads/elementor/thumbs/Cyble-CIRIL-pyyv4ww1nowvginyhq7nrmlg0x8pxv1qcifo3udnvq.png
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/06/23/trojanized-super-mario-game-installer-spreads-supremebot-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef896b86a77ae191af41c2714906decbab4bbb7fd32321c14f4f398eb7f264ba
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/2023/06/23/trojanized-super-mario-game-installer-spreads-supremebot-malware/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:20 GMT
strict-transport-security
max-age=31536000
x-ac
2.hhn _atomic_ams BYPASS
last-modified
Sat, 10 Dec 2022 19:16:39 GMT
server
nginx
etag
"6394db17-11bc"
access-control-allow-methods
GET, HEAD
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=604800
accept-ranges
bytes
content-length
4540
expires
Mon, 03 Jul 2023 02:45:20 GMT
json
forms.hsforms.com/embed/v3/form/21289959/f7da69d1-3801-430f-b109-5f44b65a9326/
37 KB
7 KB
XHR
General
Full URL
https://forms.hsforms.com/embed/v3/form/21289959/f7da69d1-3801-430f-b109-5f44b65a9326/json?hs_static_app=forms-embed&hs_static_app_version=1.3339&X-HubSpot-Static-App-Info=forms-embed-1.3339
Requested by
Host: js.hsforms.net
URL: https://js.hsforms.net/forms/v2.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:d4f3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e75a4cc582c5731d85eaa2ba9cb2c98af90df08502958147bfb9268d119ef555
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept
application/json, text/plain, */*
Referer
https://blog.cyble.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

X-Origin-Hublet
na1
Date
Mon, 26 Jun 2023 02:45:20 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Encoding
br
CF-Cache-Status
DYNAMIC
X-HubSpot-Correlation-Id
0f06c768-bf55-4650-bb30-7a52e7acb100
x-evy-trace-route-service-name
envoyset-translator
Transfer-Encoding
chunked
x-envoy-upstream-service-time
28
Connection
keep-alive
alt-svc
h3=":443"; ma=86400
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
b6bddca4-58ad-4db5-9412-2b089e574f76
Server
cloudflare
X-Trace
2BFA747D26F6B36D20DAC4A2B3255B1750EC02CC44000000000000000000
Vary
origin
Access-Control-Allow-Methods
OPTIONS, GET
Content-Type
application/json;charset=utf-8
Access-Control-Allow-Origin
https://blog.cyble.com
x-evy-trace-virtual-host
all
Access-Control-Expose-Headers
X-Origin-Hublet
Access-Control-Max-Age
180
Access-Control-Allow-Credentials
false
Cache-Control
max-age=0, no-cache, no-store
X-Robots-Tag
none
Access-Control-Allow-Headers
*
CF-RAY
7dd21d132b9391cf-FRA
x-evy-trace-served-by-pod
iad02/star-hubspot-td/envoy-proxy-759c64d45c-jkmcj
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.wp.com/s/opensans/v35/
47 KB
47 KB
Font
General
Full URL
https://fonts.wp.com/s/opensans/v35/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
Requested by
Host: fonts-api.wp.com
URL: https://fonts-api.wp.com/css?family=Open+Sans%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic%7CRoboto+Slab%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic%7CRoboto%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic&display=auto&ver=6.2.2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
7c7818c25a18e8a38553fcbcbc2ad0b5e964103a7d2e494f82815e3f70bf3fc5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts-api.wp.com/
Origin
https://blog.cyble.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-nc
HIT hhn 2
date
Mon, 26 Jun 2023 02:45:20 GMT
x-content-type-options
nosniff
last-modified
Tue, 02 May 2023 15:08:53 GMT
server
nginx
age
320
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
content-length
48412
x-xss-protection
0
json
forms.hsforms.com/embed/v3/form/21289959/f7da69d1-3801-430f-b109-5f44b65a9326/
37 KB
7 KB
XHR
General
Full URL
https://forms.hsforms.com/embed/v3/form/21289959/f7da69d1-3801-430f-b109-5f44b65a9326/json?hs_static_app=forms-embed&hs_static_app_version=1.3339&X-HubSpot-Static-App-Info=forms-embed-1.3339
Requested by
Host: js.hsforms.net
URL: https://js.hsforms.net/forms/v2.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:d4f3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7320d4130d5a8c6f40ae6e0b9949191c19b024d7320a3845548b682efa20a479
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept
application/json, text/plain, */*
Referer
https://blog.cyble.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

X-Origin-Hublet
na1
Date
Mon, 26 Jun 2023 02:45:20 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Encoding
br
CF-Cache-Status
DYNAMIC
X-HubSpot-Correlation-Id
502d8c4a-3e8e-4190-b215-8a43d5803a72
x-evy-trace-route-service-name
envoyset-translator
Transfer-Encoding
chunked
x-envoy-upstream-service-time
16
Connection
keep-alive
alt-svc
h3=":443"; ma=86400
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
d91de7ca-706b-4cf4-8c69-63392465e912
Server
cloudflare
X-Trace
2B7CEA8A361352AE449D0768C0CA9232BFFB8A4796000000000000000000
Vary
origin
Access-Control-Allow-Methods
OPTIONS, GET
Content-Type
application/json;charset=utf-8
Access-Control-Allow-Origin
https://blog.cyble.com
x-evy-trace-virtual-host
all
Access-Control-Expose-Headers
X-Origin-Hublet
Access-Control-Max-Age
180
Access-Control-Allow-Credentials
false
Cache-Control
max-age=0, no-cache, no-store
X-Robots-Tag
none
Access-Control-Allow-Headers
*
CF-RAY
7dd21d13687f19ad-FRA
x-evy-trace-served-by-pod
iad02/star-hubspot-td/envoy-proxy-759c64d45c-j4dtm
api.min.css
a.omappapi.com/app/js/
9 KB
3 KB
Stylesheet
General
Full URL
https://a.omappapi.com/app/js/api.min.css
Requested by
Host: a.omappapi.com
URL: https://a.omappapi.com/app/js/api.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1079:1 , Germany, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software
BunnyCDN-DE1-1079 /
Resource Hash
b9ca6b16cf168fe60d400a27a3650bcab24f38c88eee70d710e52e81abbbd455

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:20 GMT
content-encoding
br
cdn-edgestorageid
863
perma-cache
HIT
cdn-storageserver
DE-574
cdn-cachedat
06/23/2023 06:21:08
cdn-pullzone
293267
last-modified
Wed, 21 Jun 2023 22:58:09 GMT
server
BunnyCDN-DE1-1079
cdn-fileserver
383
cdn-requestpullcode
200
cdn-proxyver
1.03
etag
W/"64938081-22a1"
vary
Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
efcab737-66db-4b75-ab55-ed485d5a01dd
access-control-expose-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control
public, max-age=31919000
cdn-requestid
dab283fb916e8ef15b14fbba5bf1883c
cdn-requestcountrycode
DE
access-control-allow-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status
200
cdn-requestpullsuccess
True
poopcsalbacovn7gzkxg
api.omappapi.com/v2/embed/239265/
3 KB
2 KB
XHR
General
Full URL
https://api.omappapi.com/v2/embed/239265/poopcsalbacovn7gzkxg
Requested by
Host: a.omappapi.com
URL: https://a.omappapi.com/app/js/api.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.59 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-59.fra56.r.cloudfront.net
Software
Pagely Gateway/1.5.1 /
Resource Hash
40ca23f50bb22c719c27794b5ae6dbca57f4b9848884b8c148fedcdbf71cdd22

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:19 GMT
content-encoding
gzip
via
1.1 02d68f3a4f2a3f8967c5e021dcd7f96a.cloudfront.net (CloudFront)
x-cache-config
0 0
x-amz-cf-pop
FRA56-P5
x-cache-status
HIT
x-cache
Miss from cloudfront
x-optinmonster-campaign
poopcsalbacovn7gzkxg
x-user-agent
standard--
last-modified
Tue, 13 Jun 2023 05:36:50 GMT
server
Pagely Gateway/1.5.1
etag
W/"81d4578a000851a55a6118875c255bed"
vary
Accept-Encoding, User-Agent
content-type
application/json
access-control-allow-origin
*
access-control-expose-headers
X-OptinMonster-Campaign, X-User-Agent
cache-control
public, max-age=30, stale-while-revalidate=1800
access-control-allow-headers
X-CSRF-Token
x-amz-cf-id
Q2hRdE65A9DiVUteh9prid8GneG2QqJ2ktF1N5gYYAbmzxPKM5i6DA==
expires
Mon, 26 Jun 2023 02:24:11 GMT
index.js
s.adroll.com/j/exp/
Redirect Chain
  • https://s.adroll.com/j/exp/ELNAF2EZDFHJRAP3ODLCUU/index.js
  • https://s.adroll.com/j/exp/index.js
28 B
785 B
Script
General
Full URL
https://s.adroll.com/j/exp/index.js
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/06/23/trojanized-super-mario-game-installer-spreads-supremebot-malware/
Protocol
HTTP/1.1
Server
2600:9000:225e:4000:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

X-Amz-Version-Id
KLTaAvzmAP.1_rS.URSLlTS3u46mZQHP
Date
Sun, 25 Jun 2023 23:48:55 GMT
Via
1.1 dd4531988f4862a3b186f9d3356a6a74.cloudfront.net (CloudFront)
Age
10587
X-Amz-Cf-Pop
FRA60-P4
X-Amz-Server-Side-Encryption
AES256
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
28
Last-Modified
Tue, 21 Mar 2023 16:39:30 GMT
Server
AmazonS3
Etag
"5816cced8568d223aa09d889f300692b"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Access-Control-Max-Age
600
Access-Control-Allow-Credentials
false
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
36k5sDhHIr0eVUO1gmHf6GPJ0PH5D3QpxMb-30tiMmPiDjteKrEcAA==

Redirect headers

Date
Sun, 25 Jun 2023 07:07:20 GMT
Via
1.1 dd4531988f4862a3b186f9d3356a6a74.cloudfront.net (CloudFront)
Age
70680
X-Amz-Cf-Pop
FRA60-P4
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
0
Server
AmazonS3
Access-Control-Max-Age
600
Access-Control-Allow-Methods
GET
Content-Type
application/xml
Location
https://s.adroll.com/j/exp/index.js
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
false
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
143kVuakFJNiVxXYhb3sQWetB7cp1LTy-3K9zVtQCueqVS5kzBBaYw==
fb.js
js.hsadspixel.net/
6 KB
3 KB
Script
General
Full URL
https://js.hsadspixel.net/fb.js
Requested by
Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/21289959.js?integration=WordPress&ver=10.1.24
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:75be , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ef1874f11501aa7118cdfa7af21a9ef1c87301e917881dc941831b122d82b34a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:20 GMT
x-amz-version-id
tZNqk9JR4hpL4HhK3M1JevHxbsFiShRO
via
1.1 05133180bbd1649d4b8f97441bf305e8.cloudfront.net (CloudFront)
cf-cache-status
HIT
content-encoding
br
x-amz-cf-pop
IAD12-P3
age
292
x-amz-server-side-encryption
AES256
x-evy-trace-route-service-name
envoyset-translator
content-security-policy-report-only
frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=adsscriptloaderstatic/static-1.382/bundles/pixels-release.js&cfRay=7dd215ef2c693a92-FRA
x-cache
Hit from cloudfront
cache-tag
staticjsapp-AdsScriptLoaderCloudflare-web-prod,staticjsapp-prod
x-envoy-upstream-service-time
1
x-amz-replication-status
COMPLETED
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
20c839f5-20cb-4428-8f27-9f948b78a494
last-modified
Tue, 20 Jun 2023 11:26:10 UTC
server
cloudflare
etag
W/"15e730192a32cd4563797f160ff1fd6f"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
x-hs-cache-status
HIT
x-evy-trace-virtual-host
all
cache-control
max-age=600
x-evy-trace-served-by-pod
iad02/app-td/envoy-proxy-57ff77fcd-xhv87
cf-ray
7dd21d140edb1963-FRA
x-amz-cf-id
68L5iiP2U1wR_eTO1yc1TDPsQNP9l5yTUKmywdwKi0H6br6kK0I2vA==
x-hs-target-asset
adsscriptloaderstatic/static-1.382/bundles/pixels-release.js
banner.js
js.hs-banner.com/v2/21289959/
210 KB
65 KB
Script
General
Full URL
https://js.hs-banner.com/v2/21289959/banner.js
Requested by
Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/21289959.js?integration=WordPress&ver=10.1.24
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:18c4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1b198e6b8c03a2fcbd389a74e71642eb5fe5339510f8d7df65bb2e6fa29f4398

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:21 GMT
x-amz-version-id
veK9ew0VhxQ6wuOQ1VsINz09jjqLfJPF
content-encoding
br
cf-cache-status
REVALIDATED
x-amz-request-id
MS6D7F69G7MYCV0J
x-evy-trace-route-service-name
envoyset-translator
x-amz-server-side-encryption
AES256
x-envoy-upstream-service-time
26
x-amz-id-2
rPqNMs7J6IQmeeScH3klcrsJg2niKJCgOt3ZMxQ/wddSxwHLm6c/Jg8OddwUVt80I6Z+6nqBJCk=
x-evy-trace-listener
listener_https
x-request-id
01abec54-57fc-4939-a9b6-34cb4387a878
x-evy-trace-route-configuration
listener_https/all
last-modified
Thu, 22 Jun 2023 18:59:58 GMT
server
cloudflare
etag
W/"b19e4f1a69c9783d5760e5a9f9494280"
access-control-max-age
604800
access-control-allow-methods
GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
https://blog.cyble.com
x-evy-trace-virtual-host
all
access-control-expose-headers
x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
cache-control
max-age=300,public
access-control-allow-credentials
true
x-evy-trace-served-by-pod
iad02/analytics-js-proxy-td/envoy-proxy-7dbb6c8f49-9vnjb
vary
origin, Accept-Encoding
timing-allow-origin
*
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
cf-ray
7dd21d140be61c3a-FRA
expires
Mon, 26 Jun 2023 02:50:20 GMT
leadflows.js
js.hsleadflows.net/
545 KB
87 KB
Script
General
Full URL
https://js.hsleadflows.net/leadflows.js
Requested by
Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/21289959.js?integration=WordPress&ver=10.1.24
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:806e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ae5bfbf6629277d9993e143b04fd081fdc22ac1790dbc4edf51165c3d9b52f0f

Request headers

Referer
https://blog.cyble.com/
Origin
https://blog.cyble.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-encoding
br
age
2051
x-evy-trace-route-service-name
envoyset-translator
x-amz-server-side-encryption
AES256
content-security-policy-report-only
frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=lead-flows-js/static-1.1216/bundle/main/lead-flows-release.js&cfRay=7dd1eafcba7739d0-FRA
x-amz-replication-status
COMPLETED
x-evy-trace-listener
listener_https
etag
W/"8f29c013ec69bca0f98e5c18d5d45d87"
vary
Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods
GET
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
x-evy-trace-virtual-host
all
cache-control
s-maxage=86400, max-age=0
x-hs-target-asset
lead-flows-js/static-1.1216/bundle/main/lead-flows-release.js
date
Mon, 26 Jun 2023 02:45:20 GMT
x-amz-version-id
v5..R77GwEs1PfJguIOtzHIVDGDmfqTH
via
1.1 fb1dc2e3bf4105b403e3bfa3a5067970.cloudfront.net (CloudFront)
cf-cache-status
HIT
x-amz-cf-pop
IAD12-P3
x-cache
Hit from cloudfront
cache-tag
staticjsapp-lead-flows-cloudflare-web-prod,staticjsapp-prod
x-envoy-upstream-service-time
7
x-evy-trace-route-configuration
listener_https/all
x-request-id
69daf177-4259-445d-8170-fdbe5f3b7fa0
last-modified
Mon, 19 Jun 2023 09:39:47 UTC
server
cloudflare
access-control-max-age
3000
x-hs-cache-status
MISS
x-evy-trace-served-by-pod
iad02/app-td/envoy-proxy-57ff77fcd-x5fmx
cf-ray
7dd21d140caa3834-FRA
x-amz-cf-id
Xgm_PJ8dXmvZBD_vE1UuhfikcBr8bH9BLScWQGGyzvEED9zje6qdNA==
21289959.js
js.hs-analytics.net/analytics/1687747500000/
66 KB
21 KB
Script
General
Full URL
https://js.hs-analytics.net/analytics/1687747500000/21289959.js
Requested by
Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/21289959.js?integration=WordPress&ver=10.1.24
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:88ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9a57804b3c404eae08417b0a50f161fea515dd8ec7ba75042bda0d7373f2453b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:20 GMT
x-amz-version-id
null
content-encoding
br
cf-cache-status
MISS
x-amz-request-id
ZPHECPSBAQVFVJKH
x-evy-trace-route-service-name
envoyset-translator
x-amz-server-side-encryption
AES256
x-envoy-upstream-service-time
40
x-amz-id-2
BuoNc5Ya/wpLavkJCbb2suQb+DzjVjfO0z74qrhbQp8uxGz9nqSwofOxUJwBGxZdx4037i9kQm8=
x-evy-trace-listener
listener_https
x-request-id
8fc28cc6-3a0a-4cb8-84aa-3c1ee8670943
x-evy-trace-route-configuration
listener_https/all
last-modified
Thu, 15 Jun 2023 15:21:50 GMT
server
cloudflare
etag
W/"b35e8871e3ab6956b7ac0cc79c05c479"
vary
origin, Accept-Encoding
content-type
text/javascript
x-evy-trace-virtual-host
all
x-evy-trace-served-by-pod
iad02/analytics-js-proxy-td/envoy-proxy-7dbb6c8f49-ns2gd
cache-control
max-age=300,public
access-control-allow-credentials
false
cf-ray
7dd21d140b071ad4-FRA
expires
Mon, 26 Jun 2023 02:50:20 GMT
conversations-embed.js
js.usemessages.com/
75 KB
22 KB
Script
General
Full URL
https://js.usemessages.com/conversations-embed.js
Requested by
Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/21289959.js?integration=WordPress&ver=10.1.24
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:64ac , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
77177392c65784a0f09522cea8103cdb6d533b0cf0dd392af1a8480a171cbce7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:20 GMT
x-amz-version-id
SBQJMh8dP8eesg6MtWo7mRv._cMd8p8u
via
1.1 3d4bfc42e9575ee1f9559241c9e3f464.cloudfront.net (CloudFront)
cf-cache-status
HIT
content-encoding
br
x-amz-cf-pop
IAD12-P3
age
356
x-amz-server-side-encryption
AES256
x-evy-trace-route-service-name
envoyset-translator
content-security-policy-report-only
frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=conversations-embed/static-1.13482/bundles/project.js&cfRay=7dd214617a243804-IAD
x-cache
Hit from cloudfront
cache-tag
staticjsapp-conversations-embed-web-prod,staticjsapp-prod
x-envoy-upstream-service-time
0
x-amz-replication-status
COMPLETED
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
d68d3eb3-a0b0-454e-959e-3c723319e614
last-modified
Wed, 21 Jun 2023 05:37:58 UTC
server
cloudflare
etag
W/"299aa98bce12ef75464e7932d9ca16e1"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
x-hs-cache-status
HIT
x-evy-trace-virtual-host
all
cache-control
max-age=600
x-evy-trace-served-by-pod
iad02/app-td/envoy-proxy-57ff77fcd-mm66x
cf-ray
7dd21d140cd237e3-FRA
x-amz-cf-id
oBX-CfyvY3WTuc2DN-BMxrLUlJGJ8q_nHBDCX8mjonF-K1Kb0ZAx9g==
x-hs-target-asset
conversations-embed/static-1.13482/bundles/project.js
js
www.googletagmanager.com/gtag/
255 KB
87 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=G-N9ZXY95EM4&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-201575643-1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
f17dd1b0bc62f3f4e1f5cda9addca2969770bb4b81d84b3b026c4904e7b96d87
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:20 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
89050
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Mon, 26 Jun 2023 02:45:20 GMT
analytics.js
www.google-analytics.com/
52 KB
21 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-201575643-1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Mon, 26 Jun 2023 02:35:22 GMT
last-modified
Mon, 12 Jun 2023 18:23:07 GMT
server
Golfe2
age
598
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20994
expires
Mon, 26 Jun 2023 04:35:22 GMT
js
www.googletagmanager.com/gtag/
193 KB
72 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=G-4FJGSRPM4S&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-201575643-1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
e4da753882087cbbeb8b4c6e3a9f388a2ee34c97e904fa72e7b68f98c25499d5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:20 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
73303
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Mon, 26 Jun 2023 02:45:20 GMT
collect
www.google-analytics.com/j/
2 B
206 B
XHR
General
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j101&aip=1&a=1497837518&t=pageview&_s=1&dl=https%3A%2F%2Fblog.cyble.com%2F2023%2F06%2F23%2Ftrojanized-super-mario-game-installer-spreads-supremebot-malware%2F&ul=en-us&de=UTF-8&dt=Cyble%20%E2%80%94%20Trojanized%20Super%20Mario%20Game%20Installer%20Spreads%20SupremeBot%20Malware&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YGBACUABBAAAACAAI~&jid=435354373&gjid=72242826&cid=1980017434.1687747521&tid=UA-201575643-1&_gid=1210105281.1687747521&_r=1&gtm=457e36l0&did=dZTNiMT&gdid=dZTNiMT&jsscut=1&z=658110458
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.cyble.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Mon, 26 Jun 2023 02:45:20 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://blog.cyble.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/j/
1 B
345 B
XHR
General
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-201575643-1&cid=1980017434.1687747521&jid=435354373&gjid=72242826&_gid=1210105281.1687747521&_u=YGBACUAABAAAACAAI~&z=2043257288
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c07::9c Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.cyble.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
date
Mon, 26 Jun 2023 02:45:20 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://blog.cyble.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1
expires
Fri, 01 Jan 1990 00:00:00 GMT
ELNAF2EZDFHJRAP3ODLCUU
d.adroll.com/consent/check/
453 B
546 B
Script
General
Full URL
https://d.adroll.com/consent/check/ELNAF2EZDFHJRAP3ODLCUU?pv=89386821287.58542&arrfrr=https%3A%2F%2Fblog.cyble.com%2F2023%2F06%2F23%2Ftrojanized-super-mario-game-installer-spreads-supremebot-malware%2F&_s=d3a8ad2f2a4248f38a727eb51836127c&_b=2
Requested by
Host: s.adroll.com
URL: https://s.adroll.com/j/ELNAF2EZDFHJRAP3ODLCUU/roundtrip.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a05:d018:cc3:fe04:b9b8:be87:4a18:7b67 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx/1.22.1 /
Resource Hash
f04e47c7ca5959486a2117466ea32c44bbba6b6534caa27b7232134190a2af31

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:20 GMT
server
nginx/1.22.1
content-length
453
content-type
application/javascript
collect
region1.google-analytics.com/g/
0
253 B
Ping
General
Full URL
https://region1.google-analytics.com/g/collect?v=2&tid=G-4FJGSRPM4S&gtm=45je36l0&_p=1497837518&gdid=dZTNiMT&cid=1980017434.1687747521&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1687747520&sct=1&seg=0&dl=https%3A%2F%2Fblog.cyble.com%2F2023%2F06%2F23%2Ftrojanized-super-mario-game-installer-spreads-supremebot-malware%2F&dt=Cyble%20%E2%80%94%20Trojanized%20Super%20Mario%20Game%20Installer%20Spreads%20SupremeBot%20Malware&en=page_view&_fv=1&_ss=1&_ee=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-4FJGSRPM4S&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 26 Jun 2023 02:45:20 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://blog.cyble.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
region1.google-analytics.com/g/
0
54 B
Ping
General
Full URL
https://region1.google-analytics.com/g/collect?v=2&tid=G-N9ZXY95EM4&gtm=45je36l0&_p=1497837518&cid=1980017434.1687747521&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&ngs=1&_s=1&sid=1687747520&sct=1&seg=0&dl=https%3A%2F%2Fblog.cyble.com%2F2023%2F06%2F23%2Ftrojanized-super-mario-game-installer-spreads-supremebot-malware%2F&dt=Cyble%20%E2%80%94%20Trojanized%20Super%20Mario%20Game%20Installer%20Spreads%20SupremeBot%20Malware&en=page_view&_fv=1&_ss=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-N9ZXY95EM4&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 26 Jun 2023 02:45:20 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://blog.cyble.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
5.0731530a.min.js
a.omappapi.com/app/js/
14 KB
6 KB
Script
General
Full URL
https://a.omappapi.com/app/js/5.0731530a.min.js
Requested by
Host: a.omappapi.com
URL: https://a.omappapi.com/app/js/api.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1079:1 , Germany, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software
BunnyCDN-DE1-1079 /
Resource Hash
5da2efab999313e6a7c003876130edaa14f37fa6704788c707ba0687a829f054

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:20 GMT
content-encoding
br
cdn-edgestorageid
1077
perma-cache
HIT
cdn-storageserver
DE-578
cdn-cachedat
06/23/2023 06:21:08
cdn-pullzone
293267
last-modified
Wed, 21 Jun 2023 22:58:14 GMT
server
BunnyCDN-DE1-1079
cdn-fileserver
599
cdn-requestpullcode
200
cdn-proxyver
1.03
etag
W/"64938086-38e3"
vary
Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
efcab737-66db-4b75-ab55-ed485d5a01dd
access-control-expose-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control
public, max-age=31919000
cdn-requestid
bfe8661ca8b7ec06087f1dd0903c7b62
cdn-requestcountrycode
DE
access-control-allow-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status
200
cdn-requestpullsuccess
True
webfont.js
a.omappapi.com/app/js/webfont/1.5.18/
16 KB
7 KB
Script
General
Full URL
https://a.omappapi.com/app/js/webfont/1.5.18/webfont.js
Requested by
Host: a.omappapi.com
URL: https://a.omappapi.com/app/js/api.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1079:1 , Germany, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software
BunnyCDN-DE1-1079 /
Resource Hash
ce261eb163fcaee6953cedc35059732a133766ab824dc512bbdf9424d48601e4

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:20 GMT
content-encoding
br
cdn-edgestorageid
756
perma-cache
HIT
cdn-storageserver
DE-576
cdn-cachedat
06/23/2023 06:21:08
cdn-pullzone
293267
last-modified
Fri, 19 May 2023 23:24:20 GMT
server
BunnyCDN-DE1-1079
cdn-fileserver
588
cdn-requestpullcode
200
cdn-proxyver
1.03
etag
W/"64680524-40cb"
vary
Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
efcab737-66db-4b75-ab55-ed485d5a01dd
access-control-expose-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control
public, max-age=31919000
cdn-requestid
b3621f68fb07ae51d505cf38bcf5decd
cdn-requestcountrycode
DE
access-control-allow-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status
200
cdn-requestpullsuccess
True
consent_tcfv2.js
s.adroll.com/j/
418 KB
56 KB
Script
General
Full URL
https://s.adroll.com/j/consent_tcfv2.js
Requested by
Host: s.adroll.com
URL: https://s.adroll.com/j/ELNAF2EZDFHJRAP3ODLCUU/roundtrip.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:225e:4000:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
30914e620ba424e4691b6f57c37f29e90c723e2360f0c6aec0757e456a923eb1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

X-Amz-Version-Id
9mxGGJNi8ryLrVUTXj0j28oaWNsGk.Ww
Content-Encoding
gzip
Via
1.1 dd4531988f4862a3b186f9d3356a6a74.cloudfront.net (CloudFront)
Date
Mon, 26 Jun 2023 02:44:48 GMT
Age
59
X-Amz-Cf-Pop
FRA60-P4
X-Amz-Server-Side-Encryption
AES256
Transfer-Encoding
chunked
X-Cache
Hit from cloudfront
Connection
keep-alive
Last-Modified
Mon, 19 Jun 2023 14:34:51 GMT
Server
AmazonS3
Etag
W/"8888d355e5a597edba8cd7932dc2044b"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
Content-Type
text/javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=300, must-revalidate
Access-Control-Allow-Credentials
false
Access-Control-Max-Age
600
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
cLaVvXs8nyAMb1YlRhQn663-zFvRH7exj2cpOghncx6N1GQVOPd6kg==
public
api.hubspot.com/livechat-public/v1/message/ Frame
0
0
Preflight
General
Full URL
https://api.hubspot.com/livechat-public/v1/message/public?portalId=21289959&conversations-embed=static-1.13482&mobile=false&messagesUtk=e2cfb1058d12465db637db36642344d8&traceId=e2cfb1058d12465db637db36642344d8
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept
*/*
Access-Control-Request-Headers
x-hubspot-messages-uri
Access-Control-Request-Method
GET
Origin
https://blog.cyble.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-credentials
false
access-control-allow-headers
Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent, X-HubSpot-Messages-Uri
access-control-allow-methods
GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
access-control-allow-origin
https://blog.cyble.com
allow
HEAD,GET,OPTIONS
alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
7dd21d15be06bb7d-FRA
content-length
18
content-type
text/plain; charset=utf-8
date
Mon, 26 Jun 2023 02:45:21 GMT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nljpHlEinBfN9YM6pIGMDksSbg5iozY2PEFMr2cNmtpkeO1lMZUUZQpMaFJOhG%2Fe0PqPY7GDObLRmkTrwpgc0mXfuXZoN%2FoQTsefSnr0ef1hbZzR%2BF0O6fW%2BrWZUjiZfnHO4%2Bu5a08tUZpgeBw%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
strict-transport-security
max-age=31536000; includeSubDomains; preload
vary
origin, Accept-Encoding
x-envoy-upstream-service-time
1
x-evy-trace-listener
listener_https
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-route-service-name
envoyset-translator
x-evy-trace-served-by-pod
iad02/hubapi-td/envoy-proxy-598c95b5b7-qcqs6
x-evy-trace-virtual-host
all
x-hubspot-correlation-id
bcf16363-5b2b-44cb-87a3-cfab80188e58
x-request-id
88be09a0-3e70-431e-b59d-69cccc29efbd
x-trace
2B9042B0D14C1C3027BB22C8FF2B55EC65B7618D0B000000000000000000
g.gif
pixel.wp.com/
50 B
93 B
Image
General
Full URL
https://pixel.wp.com/g.gif?v=ext&blog=176605947&post=17797&tz=-4&srv=blog.cyble.com&hp=atomic&ac=2&amp=0&j=1%3A12.3-a.7&host=blog.cyble.com&ref=&fcp=896&rand=0.8659128206521638
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/06/23/trojanized-super-mario-game-installer-spreads-supremebot-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-origin
*
date
Mon, 26 Jun 2023 02:45:20 GMT
cache-control
no-cache
server
nginx
content-length
50
content-type
image/gif
public
api.hubspot.com/livechat-public/v1/message/
3 KB
2 KB
XHR
General
Full URL
https://api.hubspot.com/livechat-public/v1/message/public?portalId=21289959&conversations-embed=static-1.13482&mobile=false&messagesUtk=e2cfb1058d12465db637db36642344d8&traceId=e2cfb1058d12465db637db36642344d8
Requested by
Host: js.usemessages.com
URL: https://js.usemessages.com/conversations-embed.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
79b28e6fba6a051ef7b20a681f487457994aa7caeb124be32237914a1b7a6dd4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://blog.cyble.com/
accept-language
de-DE,de;q=0.9
X-HubSpot-Messages-Uri
https://blog.cyble.com/2023/06/23/trojanized-super-mario-game-installer-spreads-supremebot-malware/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:21 GMT
content-encoding
gzip
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-evy-trace-route-service-name
envoyset-translator
x-hubspot-correlation-id
b4d27140-c515-4298-a32b-d76e02a3fa0c
x-envoy-upstream-service-time
88
alt-svc
h3=":443"; ma=86400
content-length
1381
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
9f120320-059b-4a67-8902-8cc74f6d3ccf
server
cloudflare
x-trace
2BC25377343E713E2C8B04AFA59BE78B487D1E1863000000000000000000
vary
origin, Accept-Encoding
access-control-allow-methods
GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type
application/json;charset=utf-8
access-control-allow-origin
https://blog.cyble.com
x-evy-trace-served-by-pod
iad02/hubapi-td/envoy-proxy-598c95b5b7-lh7ht
cache-control
no-cache, no-store, no-transform, must-revalidate, max-age=0
access-control-allow-credentials
false
x-evy-trace-virtual-host
all
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7IZZgaifk9EkrjVLRRAL4%2FfdtZEPogT9JyCBzrzxXgsqCYRm4p9L1hFE3vDhGc%2FhmDscQm6SqJaJncZ70u%2FpSsJEALz90lR%2BuUKDQfY7BBxIpTorJEX4FkuDitEc33OsRAQDsoUQ%2FXMCjAU0zQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
7dd21d168ea3bb7d-FRA
access-control-allow-headers
Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent, X-HubSpot-Messages-Uri
v2.js
js.hsforms.net/forms/ Frame 7764
526 KB
164 KB
Script
General
Full URL
https://js.hsforms.net/forms/v2.js
Requested by
Host: js.hsforms.net
URL: https://js.hsforms.net/forms/v2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:bc41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5f2eaa8243f3b2f1c29a99a509e2e4bcc65c19bd288edcdbcf4f7b2f14cc5e10
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-encoding
br
age
476
x-evy-trace-route-service-name
envoyset-translator
x-amz-server-side-encryption
AES256
content-security-policy-report-only
frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=forms-embed/static-1.3339/bundles/project-v2.js&cfRay=7dd211763f70928f-FRA
x-amz-replication-status
COMPLETED
x-evy-trace-listener
listener_https
etag
W/"ae5063d72b58cf4bd6e3b1970722d727"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
x-evy-trace-virtual-host
all
cache-control
s-maxage=600, max-age=300
x-hs-target-asset
forms-embed/static-1.3339/bundles/project-v2.js
date
Mon, 26 Jun 2023 02:45:20 GMT
x-amz-version-id
.lJqI7SEJc.LNL1fj.0aGIvTPC5x63d4
via
1.1 66b6cd04ec22251498906e833eb08668.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-amz-cf-pop
IAD12-P3
x-cache
Hit from cloudfront
cache-tag
staticjsapp-forms-embed-v2-web-prod,staticjsapp-prod
x-envoy-upstream-service-time
2
alt-svc
h3=":443"; ma=86400
x-evy-trace-route-configuration
listener_https/all
x-request-id
bfda5f61-8073-454a-9caf-0a3daa6263d7
last-modified
Tue, 20 Jun 2023 10:30:05 UTC
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=b2%2Fh2XZMVbXbZPv0Rtqu51FuFSORy3kPbADgfXP6VleAK1dw32%2FpAB8YfB7qTiC90gjqB6%2FQi1Qx4%2FbXSh%2BcZZ7Xa1iCN9NXcrCYfuNpI%2Fs7yEZRR2g5zTRGcbbUDezuRgaRDOOUXOkytANP"}],"group":"cf-nel","max_age":604800}
x-hs-cache-status
HIT
x-evy-trace-served-by-pod
iad02/app-td/envoy-proxy-57ff77fcd-5flz8
cf-ray
7dd21d15bda21c01-FRA
x-amz-cf-id
i9Oge5adcqvZ6nju6ReonMUJs6s7rGjdVMXkgDyH6CSUZyUfgM_wHA==
v2.js
js.hsforms.net/forms/ Frame D1BB
526 KB
164 KB
Script
General
Full URL
https://js.hsforms.net/forms/v2.js
Requested by
Host: js.hsforms.net
URL: https://js.hsforms.net/forms/v2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:bc41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5f2eaa8243f3b2f1c29a99a509e2e4bcc65c19bd288edcdbcf4f7b2f14cc5e10
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-encoding
br
age
476
x-evy-trace-route-service-name
envoyset-translator
x-amz-server-side-encryption
AES256
content-security-policy-report-only
frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=forms-embed/static-1.3339/bundles/project-v2.js&cfRay=7dd211763f70928f-FRA
x-amz-replication-status
COMPLETED
x-evy-trace-listener
listener_https
etag
W/"ae5063d72b58cf4bd6e3b1970722d727"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
x-evy-trace-virtual-host
all
cache-control
s-maxage=600, max-age=300
x-hs-target-asset
forms-embed/static-1.3339/bundles/project-v2.js
date
Mon, 26 Jun 2023 02:45:20 GMT
x-amz-version-id
.lJqI7SEJc.LNL1fj.0aGIvTPC5x63d4
via
1.1 66b6cd04ec22251498906e833eb08668.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-amz-cf-pop
IAD12-P3
x-cache
Hit from cloudfront
cache-tag
staticjsapp-forms-embed-v2-web-prod,staticjsapp-prod
x-envoy-upstream-service-time
2
alt-svc
h3=":443"; ma=86400
x-evy-trace-route-configuration
listener_https/all
x-request-id
bfda5f61-8073-454a-9caf-0a3daa6263d7
last-modified
Tue, 20 Jun 2023 10:30:05 UTC
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sOKimnb%2B9H5Rke9i84R7z1FAM4%2F%2FzzrzhBcYBLrY34GKwATCe9oUD%2BNPdaYBzWhEjtQujK6tvchAK8nRpRfWH60h49XE1tnBS53QYv9r7shzzjMVurDXd%2BtHKv7jLZhjLWxCRBbe3w3%2FItIm"}],"group":"cf-nel","max_age":604800}
x-hs-cache-status
HIT
x-evy-trace-served-by-pod
iad02/app-td/envoy-proxy-57ff77fcd-5flz8
cf-ray
7dd21d15cdaa1c01-FRA
x-amz-cf-id
i9Oge5adcqvZ6nju6ReonMUJs6s7rGjdVMXkgDyH6CSUZyUfgM_wHA==
4.77d69382.min.js
a.omappapi.com/app/js/
41 KB
13 KB
Script
General
Full URL
https://a.omappapi.com/app/js/4.77d69382.min.js
Requested by
Host: a.omappapi.com
URL: https://a.omappapi.com/app/js/api.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1079:1 , Germany, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software
BunnyCDN-DE1-1079 /
Resource Hash
e8adc21c3d8f34e90565c2842e94dae3d22f0ffa500def488b22a9de31017439

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:20 GMT
content-encoding
br
cdn-edgestorageid
865
perma-cache
HIT
cdn-storageserver
DE-575
cdn-cachedat
06/23/2023 06:21:08
cdn-pullzone
293267
last-modified
Wed, 21 Jun 2023 22:58:13 GMT
server
BunnyCDN-DE1-1079
cdn-fileserver
383
cdn-requestpullcode
200
cdn-proxyver
1.03
etag
W/"64938085-a3d8"
vary
Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
efcab737-66db-4b75-ab55-ed485d5a01dd
access-control-expose-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control
public, max-age=31919000
cdn-requestid
1560689969251592fe770bc69514fe8b
cdn-requestcountrycode
DE
access-control-allow-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status
200
cdn-requestpullsuccess
True
UmbralStealer-Super-Mario-Bros-Blog.jpg
i0.wp.com/blog.cyble.com/wp-content/uploads/2023/06/
271 KB
272 KB
Image
General
Full URL
https://i0.wp.com/blog.cyble.com/wp-content/uploads/2023/06/UmbralStealer-Super-Mario-Bros-Blog.jpg?w=1200&ssl=1
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/06/23/trojanized-super-mario-game-installer-spreads-supremebot-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
55894c686411d97d939e11179054c54ae7464038ef9a1af9971c0cd0c071950d
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-nc
HIT hhn 4
date
Mon, 26 Jun 2023 02:45:20 GMT
x-content-type-options
nosniff
last-modified
Fri, 23 Jun 2023 11:01:18 GMT
server
nginx
etag
"2d2b55c756bff58b"
vary
Accept
access-control-allow-methods
GET, HEAD
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=63115200
timing-allow-origin
*
link
<https://blog.cyble.com/wp-content/uploads/2023/06/UmbralStealer-Super-Mario-Bros-Blog.jpg>; rel="canonical"
content-length
277618
expires
Sun, 22 Jun 2025 23:01:18 GMT
share-buttons.0bdd88c45462dfb2b073.bundle.min.js
blog.cyble.com/wp-content/plugins/elementor-pro/assets/js/
1 KB
655 B
Script
General
Full URL
https://blog.cyble.com/wp-content/plugins/elementor-pro/assets/js/share-buttons.0bdd88c45462dfb2b073.bundle.min.js
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/_static/??-eJydU9tuwjAM/aGFiAltvEz7FJQ2pk1x4yxOYOzr57aEIaF1oy9N4+NzfM0pqJp8Ap90wNw4z7oFYyGqPVGSAxB6QSlq52vdsd7H0d+uOn463bMzJtebBDdEwwyJde+8En42gMqboxI0r8T4sBC6SncfGeK5YCoCuy+4WHfTbbk2C4EOTvR4N/3NaHWQgqkPejf0p8oOra5NpMyABVPFMCNDITnfk2dpeknGOk5Dy1vAAPGGLKEwW+ABlEIaYCQZml1cMqOTEsbvYg3HlChAORfp3O5IIE48o3IlqxCpCAj5BNXYdLGuYvYSai6XuxR+FBayywNRPdmMwL/MbRzuUfyELFAgPO8dovhATP/gRGhAXM3QgL8TbbJcK4jNZUUnEdmeIdo1+GOpPhCulVc0BLPweWG992/rl+3rZrteb56/AaHku90=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
9c8b8880afd7d6d3530ce5bc9fd79e177a9e9cf8f943d9466b9ea4b77da4999c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/2023/06/23/trojanized-super-mario-game-installer-spreads-supremebot-malware/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:21 GMT
strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Mon, 19 Jun 2023 13:11:10 GMT
server
nginx
x-ac
2.hhn _atomic_ams BYPASS
etag
W/"649053ee-4bd"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
expires
Mon, 03 Jul 2023 02:45:21 GMT
load-more.b18fee69ce12204b4582.bundle.min.js
blog.cyble.com/wp-content/plugins/elementor-pro/assets/js/
5 KB
2 KB
Script
General
Full URL
https://blog.cyble.com/wp-content/plugins/elementor-pro/assets/js/load-more.b18fee69ce12204b4582.bundle.min.js
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/_static/??-eJydU9tuwjAM/aGFiAltvEz7FJQ2pk1x4yxOYOzr57aEIaF1oy9N4+NzfM0pqJp8Ap90wNw4z7oFYyGqPVGSAxB6QSlq52vdsd7H0d+uOn463bMzJtebBDdEwwyJde+8En42gMqboxI0r8T4sBC6SncfGeK5YCoCuy+4WHfTbbk2C4EOTvR4N/3NaHWQgqkPejf0p8oOra5NpMyABVPFMCNDITnfk2dpeknGOk5Dy1vAAPGGLKEwW+ABlEIaYCQZml1cMqOTEsbvYg3HlChAORfp3O5IIE48o3IlqxCpCAj5BNXYdLGuYvYSai6XuxR+FBayywNRPdmMwL/MbRzuUfyELFAgPO8dovhATP/gRGhAXM3QgL8TbbJcK4jNZUUnEdmeIdo1+GOpPhCulVc0BLPweWG992/rl+3rZrteb56/AaHku90=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
638a50177eaf1ef79fb307a539d9b8637f7ecb2d07179ff4eed7dc585176e27c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/2023/06/23/trojanized-super-mario-game-installer-spreads-supremebot-malware/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:21 GMT
strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Mon, 19 Jun 2023 13:11:10 GMT
server
nginx
x-ac
2.hhn _atomic_ams BYPASS
etag
W/"649053ee-15eb"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
expires
Mon, 03 Jul 2023 02:45:21 GMT
posts.e33113a212454e383747.bundle.min.js
blog.cyble.com/wp-content/plugins/elementor-pro/assets/js/
3 KB
1 KB
Script
General
Full URL
https://blog.cyble.com/wp-content/plugins/elementor-pro/assets/js/posts.e33113a212454e383747.bundle.min.js
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/_static/??-eJydU9tuwjAM/aGFiAltvEz7FJQ2pk1x4yxOYOzr57aEIaF1oy9N4+NzfM0pqJp8Ap90wNw4z7oFYyGqPVGSAxB6QSlq52vdsd7H0d+uOn463bMzJtebBDdEwwyJde+8En42gMqboxI0r8T4sBC6SncfGeK5YCoCuy+4WHfTbbk2C4EOTvR4N/3NaHWQgqkPejf0p8oOra5NpMyABVPFMCNDITnfk2dpeknGOk5Dy1vAAPGGLKEwW+ABlEIaYCQZml1cMqOTEsbvYg3HlChAORfp3O5IIE48o3IlqxCpCAj5BNXYdLGuYvYSai6XuxR+FBayywNRPdmMwL/MbRzuUfyELFAgPO8dovhATP/gRGhAXM3QgL8TbbJcK4jNZUUnEdmeIdo1+GOpPhCulVc0BLPweWG992/rl+3rZrteb56/AaHku90=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
148da439eaba8dfe837cff98be204135245cac5f9a4b10d8315a7f234ec6bba4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/2023/06/23/trojanized-super-mario-game-installer-spreads-supremebot-malware/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:21 GMT
strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Mon, 19 Jun 2023 13:11:10 GMT
server
nginx
x-ac
2.hhn _atomic_ams BYPASS
etag
W/"649053ee-cfd"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
expires
Mon, 03 Jul 2023 02:45:21 GMT
text-editor.2c35aafbe5bf0e127950.bundle.min.js
blog.cyble.com/wp-content/plugins/elementor/assets/js/
1 KB
705 B
Script
General
Full URL
https://blog.cyble.com/wp-content/plugins/elementor/assets/js/text-editor.2c35aafbe5bf0e127950.bundle.min.js
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/_static/??-eJydU9tuwjAM/aGFiAltvEz7FJQ2pk1x4yxOYOzr57aEIaF1oy9N4+NzfM0pqJp8Ap90wNw4z7oFYyGqPVGSAxB6QSlq52vdsd7H0d+uOn463bMzJtebBDdEwwyJde+8En42gMqboxI0r8T4sBC6SncfGeK5YCoCuy+4WHfTbbk2C4EOTvR4N/3NaHWQgqkPejf0p8oOra5NpMyABVPFMCNDITnfk2dpeknGOk5Dy1vAAPGGLKEwW+ABlEIaYCQZml1cMqOTEsbvYg3HlChAORfp3O5IIE48o3IlqxCpCAj5BNXYdLGuYvYSai6XuxR+FBayywNRPdmMwL/MbRzuUfyELFAgPO8dovhATP/gRGhAXM3QgL8TbbJcK4jNZUUnEdmeIdo1+GOpPhCulVc0BLPweWG992/rl+3rZrteb56/AaHku90=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
192811b11cab8b2d4254be60c82edeb3054b8c0a5aa7092b5a934adbd9e3320f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/2023/06/23/trojanized-super-mario-game-installer-spreads-supremebot-malware/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:21 GMT
strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Mon, 19 Jun 2023 09:44:12 GMT
server
nginx
x-ac
2.hhn _atomic_ams BYPASS
etag
W/"6490236c-550"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
expires
Mon, 03 Jul 2023 02:45:21 GMT
counters.gif
forms.hsforms.com/embed/v3/
35 B
624 B
Image
General
Full URL
https://forms.hsforms.com/embed/v3/counters.gif?key=forms-embed-v2-DEFINITION_SUCCESS&count=1
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/06/23/trojanized-super-mario-game-installer-spreads-supremebot-malware/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6811:d4f3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:21 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-cache-status
DYNAMIC
x-hubspot-correlation-id
d8ee2ee9-b940-44c9-9551-10249437c59b
x-evy-trace-route-service-name
envoyset-translator
x-envoy-upstream-service-time
2
alt-svc
h3=":443"; ma=86400
content-length
35
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
cb4fc09d-8350-487b-965d-5c0a5864c1a1
server
cloudflare
x-trace
2B7C8011FFB8414D2E82812A0CD10667706D6E1AD4000000000000000000
vary
origin
content-type
image/gif
x-evy-trace-virtual-host
all
x-evy-trace-served-by-pod
iad02/star-hubspot-td/envoy-proxy-759c64d45c-dfxrz
access-control-expose-headers
X-Origin-Hublet
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
false
x-robots-tag
none
cf-ray
7dd21d16a9fa19a9-FRA
nextroll-32x32.png
s.adroll.com/i/favicon/
2 KB
2 KB
Image
General
Full URL
https://s.adroll.com/i/favicon/nextroll-32x32.png
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/06/23/trojanized-super-mario-game-installer-spreads-supremebot-malware/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:225e:4000:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
bcaf0e3f087296133e0a996ee3d289a8d1a690147c93e0ab62019b505e6f9355

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

X-Amz-Version-Id
eTpwxbAIDHDUN.4tfrROIgU_pzKN9Xh0
Date
Sun, 25 Jun 2023 22:29:05 GMT
Via
1.1 dd4531988f4862a3b186f9d3356a6a74.cloudfront.net (CloudFront)
Age
15376
X-Amz-Cf-Pop
FRA60-P4
X-Amz-Server-Side-Encryption
AES256
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
1615
Last-Modified
Mon, 28 Jun 2021 18:19:21 GMT
Server
AmazonS3
Etag
"403a0a7dcf2d617e7ea852bfb9d11945"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
Content-Type
image/png
Access-Control-Allow-Origin
*
Access-Control-Max-Age
600
Access-Control-Allow-Credentials
false
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
5vcJtZA0YtKv13qtDTP3xkwo6ZwFLNumPKXycMKMxd1P84fwqoRT3g==
17.fd6135fc.min.js
a.omappapi.com/app/js/
458 B
1 KB
Script
General
Full URL
https://a.omappapi.com/app/js/17.fd6135fc.min.js
Requested by
Host: a.omappapi.com
URL: https://a.omappapi.com/app/js/api.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1079:1 , Germany, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software
BunnyCDN-DE1-1079 /
Resource Hash
09cc0c8661bd4873fb75a6e96539b6bfad7a9fcb0d6a79b6a974b11195d6e25d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:21 GMT
content-encoding
br
cdn-edgestorageid
860
perma-cache
HIT
cdn-storageserver
DE-576
cdn-cachedat
06/23/2023 06:21:08
cdn-pullzone
293267
last-modified
Wed, 21 Jun 2023 22:58:11 GMT
server
BunnyCDN-DE1-1079
cdn-fileserver
383
cdn-requestpullcode
200
cdn-proxyver
1.03
etag
W/"64938083-1ca"
vary
Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
efcab737-66db-4b75-ab55-ed485d5a01dd
access-control-expose-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control
public, max-age=31919000
cdn-requestid
f39ea3ab08210d2666f60849908fc5f2
cdn-requestcountrycode
DE
access-control-allow-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status
200
cdn-requestpullsuccess
True
20.bb2e5025.min.js
a.omappapi.com/app/js/
4 KB
2 KB
Script
General
Full URL
https://a.omappapi.com/app/js/20.bb2e5025.min.js
Requested by
Host: a.omappapi.com
URL: https://a.omappapi.com/app/js/api.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1079:1 , Germany, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software
BunnyCDN-DE1-1079 /
Resource Hash
2168dee40954466214d7f5e39e460be903013674f81070d5fb0ad01213a8486a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:21 GMT
content-encoding
br
cdn-edgestorageid
1075
perma-cache
HIT
cdn-storageserver
DE-167
cdn-cachedat
06/23/2023 06:21:08
cdn-pullzone
293267
last-modified
Wed, 21 Jun 2023 22:58:12 GMT
server
BunnyCDN-DE1-1079
cdn-fileserver
383
cdn-requestpullcode
200
cdn-proxyver
1.03
etag
W/"64938084-ec3"
vary
Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
efcab737-66db-4b75-ab55-ed485d5a01dd
access-control-expose-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control
public, max-age=31919000
cdn-requestid
0fc8f25e8075565c4bb40c968fbf7b9c
cdn-requestcountrycode
DE
access-control-allow-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status
200
cdn-requestpullsuccess
True
28.f50e9b45.min.js
a.omappapi.com/app/js/
6 KB
3 KB
Script
General
Full URL
https://a.omappapi.com/app/js/28.f50e9b45.min.js
Requested by
Host: a.omappapi.com
URL: https://a.omappapi.com/app/js/api.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1079:1 , Germany, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software
BunnyCDN-DE1-1079 /
Resource Hash
af710d1f0d2c94a8370cc573a9255f6794500fa0da9839ce8c069f4eaa7f96b0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:21 GMT
content-encoding
br
cdn-edgestorageid
1049
perma-cache
HIT
cdn-storageserver
DE-165
cdn-cachedat
06/23/2023 06:21:08
cdn-pullzone
293267
last-modified
Wed, 21 Jun 2023 22:58:11 GMT
server
BunnyCDN-DE1-1079
cdn-fileserver
599
cdn-requestpullcode
200
cdn-proxyver
1.03
etag
W/"64938083-1726"
vary
Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
efcab737-66db-4b75-ab55-ed485d5a01dd
access-control-expose-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control
public, max-age=31919000
cdn-requestid
9050ff662047a63ca12e3767608a7298
cdn-requestcountrycode
DE
access-control-allow-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status
200
cdn-requestpullsuccess
True
33.65dc6102.min.js
a.omappapi.com/app/js/
10 KB
4 KB
Script
General
Full URL
https://a.omappapi.com/app/js/33.65dc6102.min.js
Requested by
Host: a.omappapi.com
URL: https://a.omappapi.com/app/js/api.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1079:1 , Germany, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software
BunnyCDN-DE1-1079 /
Resource Hash
539ac047374f668cd186c3ed1e1f3ad667c5ffddd4874446980d1cafaf77b655

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:21 GMT
content-encoding
br
cdn-edgestorageid
1080
perma-cache
HIT
cdn-storageserver
DE-573
cdn-cachedat
06/23/2023 06:21:08
cdn-pullzone
293267
last-modified
Wed, 21 Jun 2023 22:58:11 GMT
server
BunnyCDN-DE1-1079
cdn-fileserver
599
cdn-requestpullcode
200
cdn-proxyver
1.03
etag
W/"64938083-291f"
vary
Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
efcab737-66db-4b75-ab55-ed485d5a01dd
access-control-expose-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control
public, max-age=31919000
cdn-requestid
61c591a5ca8bc224340d53e94faadd71
cdn-requestcountrycode
DE
access-control-allow-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status
200
cdn-requestpullsuccess
True
10.c57fdab0.min.js
a.omappapi.com/app/js/
28 KB
9 KB
Script
General
Full URL
https://a.omappapi.com/app/js/10.c57fdab0.min.js
Requested by
Host: a.omappapi.com
URL: https://a.omappapi.com/app/js/api.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1079:1 , Germany, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software
BunnyCDN-DE1-1079 /
Resource Hash
35628b00dd095172f48c7fe4b3f6f48b9751a1a95f9f80552fc1770c93a28627

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:21 GMT
content-encoding
br
cdn-edgestorageid
1047
perma-cache
HIT
cdn-storageserver
DE-570
cdn-cachedat
06/23/2023 06:21:08
cdn-pullzone
293267
last-modified
Wed, 21 Jun 2023 22:58:11 GMT
server
BunnyCDN-DE1-1079
cdn-fileserver
383
cdn-requestpullcode
200
cdn-proxyver
1.03
etag
W/"64938083-6fec"
vary
Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
efcab737-66db-4b75-ab55-ed485d5a01dd
access-control-expose-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control
public, max-age=31919000
cdn-requestid
956a08293ff81cdaa53f482cae869aa1
cdn-requestcountrycode
DE
access-control-allow-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status
200
cdn-requestpullsuccess
True
0.3415d765.min.js
a.omappapi.com/app/js/
7 KB
3 KB
Script
General
Full URL
https://a.omappapi.com/app/js/0.3415d765.min.js
Requested by
Host: a.omappapi.com
URL: https://a.omappapi.com/app/js/api.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1079:1 , Germany, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software
BunnyCDN-DE1-1079 /
Resource Hash
cfdaa671aea1f1a3d6c4a195159a1b8e39f9bb5cc478bfdbf173507f15abfb7f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:21 GMT
content-encoding
br
cdn-edgestorageid
864
perma-cache
HIT
cdn-storageserver
DE-573
cdn-cachedat
06/23/2023 06:21:08
cdn-pullzone
293267
last-modified
Wed, 21 Jun 2023 22:58:12 GMT
server
BunnyCDN-DE1-1079
cdn-fileserver
383
cdn-requestpullcode
200
cdn-proxyver
1.03
etag
W/"64938084-1a8f"
vary
Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
efcab737-66db-4b75-ab55-ed485d5a01dd
access-control-expose-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control
public, max-age=31919000
cdn-requestid
8a2e073457b6888b4b0a30756c86cbcd
cdn-requestcountrycode
DE
access-control-allow-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status
200
cdn-requestpullsuccess
True
9.00860694.min.js
a.omappapi.com/app/js/
2 KB
2 KB
Script
General
Full URL
https://a.omappapi.com/app/js/9.00860694.min.js
Requested by
Host: a.omappapi.com
URL: https://a.omappapi.com/app/js/api.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1079:1 , Germany, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software
BunnyCDN-DE1-1079 /
Resource Hash
906bb156f70a4fd952c4c8f7072d070bf8c2db3417da8f73b25c1f37de5f6427

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:21 GMT
content-encoding
br
cdn-edgestorageid
863
perma-cache
HIT
cdn-storageserver
DE-577
cdn-cachedat
06/23/2023 06:21:08
cdn-pullzone
293267
last-modified
Wed, 21 Jun 2023 22:58:12 GMT
server
BunnyCDN-DE1-1079
cdn-fileserver
599
cdn-requestpullcode
200
cdn-proxyver
1.03
etag
W/"64938084-650"
vary
Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
efcab737-66db-4b75-ab55-ed485d5a01dd
access-control-expose-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control
public, max-age=31919000
cdn-requestid
abaa2269b2f6df58d2a5ec95c33fc6bc
cdn-requestcountrycode
DE
access-control-allow-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status
200
cdn-requestpullsuccess
True
11.1050c28d.min.js
a.omappapi.com/app/js/
2 KB
2 KB
Script
General
Full URL
https://a.omappapi.com/app/js/11.1050c28d.min.js
Requested by
Host: a.omappapi.com
URL: https://a.omappapi.com/app/js/api.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1079:1 , Germany, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software
BunnyCDN-DE1-1079 /
Resource Hash
37012edb80dd5ca2ea633b3300c6b0f19ae755096da9b37921ee8bebeca25954

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:21 GMT
content-encoding
br
cdn-edgestorageid
860
perma-cache
HIT
cdn-storageserver
DE-576
cdn-cachedat
06/23/2023 06:21:08
cdn-pullzone
293267
last-modified
Wed, 21 Jun 2023 22:58:12 GMT
server
BunnyCDN-DE1-1079
cdn-fileserver
588
cdn-requestpullcode
200
cdn-proxyver
1.03
etag
W/"64938084-790"
vary
Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
efcab737-66db-4b75-ab55-ed485d5a01dd
access-control-expose-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control
public, max-age=31919000
cdn-requestid
13cb60ecad1194a3418684c722b1847e
cdn-requestcountrycode
DE
access-control-allow-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status
200
cdn-requestpullsuccess
True
29.ff30d6db.min.js
a.omappapi.com/app/js/
3 KB
2 KB
Script
General
Full URL
https://a.omappapi.com/app/js/29.ff30d6db.min.js
Requested by
Host: a.omappapi.com
URL: https://a.omappapi.com/app/js/api.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1079:1 , Germany, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software
BunnyCDN-DE1-1079 /
Resource Hash
098699c15c3576e659f00afae845cd0fe1345dcc39a2022c4efb2a49274bb53f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:21 GMT
content-encoding
br
cdn-edgestorageid
864
perma-cache
HIT
cdn-storageserver
DE-168
cdn-cachedat
06/23/2023 06:21:08
cdn-pullzone
293267
last-modified
Wed, 21 Jun 2023 22:58:09 GMT
server
BunnyCDN-DE1-1079
cdn-fileserver
588
cdn-requestpullcode
200
cdn-proxyver
1.03
etag
W/"64938081-ab6"
vary
Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
efcab737-66db-4b75-ab55-ed485d5a01dd
access-control-expose-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control
public, max-age=31919000
cdn-requestid
5058a0858e4a666ed9362d03248540b5
cdn-requestcountrycode
DE
access-control-allow-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status
200
cdn-requestpullsuccess
True
27.7803672e.min.js
a.omappapi.com/app/js/
1 KB
1 KB
Script
General
Full URL
https://a.omappapi.com/app/js/27.7803672e.min.js
Requested by
Host: a.omappapi.com
URL: https://a.omappapi.com/app/js/api.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1079:1 , Germany, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software
BunnyCDN-DE1-1079 /
Resource Hash
7debfd89879c9e370f42e60a66b1309b795503568cbafb364ce2287ebd019055

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:21 GMT
content-encoding
br
cdn-edgestorageid
1047
perma-cache
HIT
cdn-storageserver
DE-165
cdn-cachedat
06/23/2023 06:21:08
cdn-pullzone
293267
last-modified
Wed, 21 Jun 2023 22:58:12 GMT
server
BunnyCDN-DE1-1079
cdn-fileserver
599
cdn-requestpullcode
200
cdn-proxyver
1.03
etag
W/"64938084-4e1"
vary
Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
efcab737-66db-4b75-ab55-ed485d5a01dd
access-control-expose-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control
public, max-age=31919000
cdn-requestid
b2af60237ccf379e1c047ed4fd6d963d
cdn-requestcountrycode
DE
access-control-allow-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status
200
cdn-requestpullsuccess
True
16.3353bb65.min.js
a.omappapi.com/app/js/
830 B
1 KB
Script
General
Full URL
https://a.omappapi.com/app/js/16.3353bb65.min.js
Requested by
Host: a.omappapi.com
URL: https://a.omappapi.com/app/js/api.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1079:1 , Germany, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software
BunnyCDN-DE1-1079 /
Resource Hash
838fc802c5679d425ab384a1064e73e2214ab6d56a694709ea20565423c46745

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:21 GMT
content-encoding
br
cdn-edgestorageid
864
perma-cache
HIT
cdn-storageserver
DE-165
cdn-cachedat
06/23/2023 06:21:08
cdn-pullzone
293267
last-modified
Wed, 21 Jun 2023 22:58:10 GMT
server
BunnyCDN-DE1-1079
cdn-fileserver
588
cdn-requestpullcode
200
cdn-proxyver
1.03
etag
W/"64938082-33e"
vary
Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
efcab737-66db-4b75-ab55-ed485d5a01dd
access-control-expose-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control
public, max-age=31919000
cdn-requestid
e673b88a551cf5d143cee501ac85b0e2
cdn-requestcountrycode
DE
access-control-allow-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status
200
cdn-requestpullsuccess
True
1.89db9f62.min.js
a.omappapi.com/app/js/
9 KB
3 KB
Script
General
Full URL
https://a.omappapi.com/app/js/1.89db9f62.min.js
Requested by
Host: a.omappapi.com
URL: https://a.omappapi.com/app/js/api.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1079:1 , Germany, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software
BunnyCDN-DE1-1079 /
Resource Hash
484098c79514881a954847db923f12bf7def109e0217a3138ae8c8d91382f23b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:21 GMT
content-encoding
br
cdn-edgestorageid
1047
perma-cache
HIT
cdn-storageserver
DE-570
cdn-cachedat
06/23/2023 06:21:08
cdn-pullzone
293267
last-modified
Wed, 21 Jun 2023 22:58:12 GMT
server
BunnyCDN-DE1-1079
cdn-fileserver
588
cdn-requestpullcode
200
cdn-proxyver
1.03
etag
W/"64938084-2308"
vary
Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
efcab737-66db-4b75-ab55-ed485d5a01dd
access-control-expose-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control
public, max-age=31919000
cdn-requestid
08a01705fedec957f670b3f1260d3769
cdn-requestcountrycode
DE
access-control-allow-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status
200
cdn-requestpullsuccess
True
22.cf6ca517.min.js
a.omappapi.com/app/js/
2 KB
1 KB
Script
General
Full URL
https://a.omappapi.com/app/js/22.cf6ca517.min.js
Requested by
Host: a.omappapi.com
URL: https://a.omappapi.com/app/js/api.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1079:1 , Germany, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software
BunnyCDN-DE1-1079 /
Resource Hash
1c374983633d349ae8e4986739a5c434ea79bf2db929aa0967df26e1380ed1ba

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:21 GMT
content-encoding
br
cdn-edgestorageid
860
perma-cache
HIT
cdn-storageserver
DE-575
cdn-cachedat
06/23/2023 06:21:08
cdn-pullzone
293267
last-modified
Wed, 21 Jun 2023 22:58:12 GMT
server
BunnyCDN-DE1-1079
cdn-fileserver
383
cdn-requestpullcode
200
cdn-proxyver
1.03
etag
W/"64938084-602"
vary
Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
efcab737-66db-4b75-ab55-ed485d5a01dd
access-control-expose-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control
public, max-age=31919000
cdn-requestid
725c3f913427003735bcfdeb0a04d00f
cdn-requestcountrycode
DE
access-control-allow-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status
200
cdn-requestpullsuccess
True
2.28387e62.min.js
a.omappapi.com/app/js/
2 KB
2 KB
Script
General
Full URL
https://a.omappapi.com/app/js/2.28387e62.min.js
Requested by
Host: a.omappapi.com
URL: https://a.omappapi.com/app/js/api.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1079:1 , Germany, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software
BunnyCDN-DE1-1079 /
Resource Hash
f844015a45cc070e5d5b3fca2abfa8ae208738bc5d9bdf49988ea9032e94a373

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:21 GMT
content-encoding
br
cdn-edgestorageid
865
perma-cache
HIT
cdn-storageserver
DE-167
cdn-cachedat
06/23/2023 06:21:28
cdn-pullzone
293267
last-modified
Wed, 21 Jun 2023 22:58:18 GMT
server
BunnyCDN-DE1-1079
cdn-fileserver
588
cdn-requestpullcode
200
cdn-proxyver
1.03
etag
W/"6493808a-87c"
vary
Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
efcab737-66db-4b75-ab55-ed485d5a01dd
access-control-expose-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control
public, max-age=31919000
cdn-requestid
2ebdbf07b1e6fdf7346a09adfd5f7fe7
cdn-requestcountrycode
DE
access-control-allow-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status
200
cdn-requestpullsuccess
True
19.d21f1c8e.min.js
a.omappapi.com/app/js/
1 KB
1 KB
Script
General
Full URL
https://a.omappapi.com/app/js/19.d21f1c8e.min.js
Requested by
Host: a.omappapi.com
URL: https://a.omappapi.com/app/js/api.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1079:1 , Germany, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software
BunnyCDN-DE1-1079 /
Resource Hash
887e3ec760dc258b4964410db699386d4930f35d4acf8cd765b6d906f04cba53

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:21 GMT
content-encoding
br
cdn-edgestorageid
1048
perma-cache
HIT
cdn-storageserver
DE-572
cdn-cachedat
06/23/2023 06:21:38
cdn-pullzone
293267
last-modified
Wed, 21 Jun 2023 22:58:11 GMT
server
BunnyCDN-DE1-1079
cdn-fileserver
588
cdn-requestpullcode
200
cdn-proxyver
1.03
etag
W/"64938083-5c1"
vary
Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
efcab737-66db-4b75-ab55-ed485d5a01dd
access-control-expose-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control
public, max-age=31919000
cdn-requestid
4cda64271c707f6a39d866938afffcdb
cdn-requestcountrycode
DE
access-control-allow-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status
200
cdn-requestpullsuccess
True
counters.gif
forms-na1.hsforms.com/embed/v3/
35 B
983 B
Image
General
Full URL
https://forms-na1.hsforms.com/embed/v3/counters.gif?key=forms-embed-v2-RENDER_SUCCESS&count=1
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/06/23/trojanized-super-mario-game-installer-spreads-supremebot-malware/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:d4f3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Mon, 26 Jun 2023 02:45:21 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
CF-Cache-Status
DYNAMIC
X-HubSpot-Correlation-Id
f4a41ffb-e229-435d-a1ef-3a445838c59c
x-evy-trace-route-service-name
envoyset-translator
x-envoy-upstream-service-time
2
Connection
keep-alive
alt-svc
h3=":443"; ma=86400
Content-Length
35
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
abebf6f8-f865-4b74-94a2-aede671859b5
Server
cloudflare
X-Trace
2BB2D38CDC9BB01D409C0EC24367D0F5B0930B20ED000000000000000000
Vary
origin
Content-Type
image/gif
x-evy-trace-virtual-host
all
x-evy-trace-served-by-pod
iad02/star-hubspot-td/envoy-proxy-759c64d45c-g2zls
Access-Control-Expose-Headers
X-Origin-Hublet
Cache-Control
max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
false
X-Robots-Tag
none
CF-RAY
7dd21d176cd092b3-FRA
json
api.hubapi.com/hs-script-loader-public/v1/config/pixels-and-events/
114 B
1 KB
XHR
General
Full URL
https://api.hubapi.com/hs-script-loader-public/v1/config/pixels-and-events/json?portalId=21289959
Requested by
Host: js.hsadspixel.net
URL: https://js.hsadspixel.net/fb.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:cacc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
90b705145ef82e9d8493aae55c9bfb3200ec0620c8946b20b0b28366557d6a4a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:21 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name
envoyset-translator
x-hubspot-correlation-id
ede50a31-4d94-4c5a-881e-42aecd6ddfa4
x-envoy-upstream-service-time
7
alt-svc
h3=":443"; ma=86400
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
afdde5c4-5274-45cd-abfe-b1c970fd8532
server
cloudflare
x-trace
2BA39F059384B40532E9CC6ADB966F7998ED904FEA000000000000000000
vary
origin, Accept-Encoding
access-control-allow-methods
GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type
application/json;charset=utf-8
access-control-allow-origin
https://blog.cyble.com
x-evy-trace-served-by-pod
iad02/hubapi-td/envoy-proxy-598c95b5b7-4lp8p
access-control-max-age
180
access-control-allow-credentials
false
x-evy-trace-virtual-host
all
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=li4d5KKTM5OtHjyFDv3kU9lx%2Fi0Cs1EaMDGDOEVGBv%2FYb5yjgXKD5lQZE63DjJbn0eXBeYO1A5qx%2FzGfit74Hu7%2Brwp6ofGc8ss%2BbV3OuC8jCto%2BRnM%2FaaY5WrLF8ApPO8tNebdJZWl0yKCk"}],"group":"cf-nel","max_age":604800}
cf-ray
7dd21d17ad8391cf-FRA
access-control-allow-headers
*
share-link.min.js
blog.cyble.com/wp-content/plugins/elementor/assets/lib/share-link/
3 KB
1 KB
Script
General
Full URL
https://blog.cyble.com/wp-content/plugins/elementor/assets/lib/share-link/share-link.min.js?ver=3.14.0
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/wp-content/plugins/elementor/assets/js/frontend.min.js?ver=3.14.0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
138154c0deed3326477b9b4909175101070a5a3a95342291b53d8cc9879a5f47
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/2023/06/23/trojanized-super-mario-game-installer-spreads-supremebot-malware/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:21 GMT
strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Mon, 19 Jun 2023 09:44:12 GMT
server
nginx
x-ac
2.hhn _atomic_ams BYPASS
etag
W/"6490236c-a3c"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=315360000
expires
Thu, 31 Dec 2037 23:55:55 GMT
UmbralStealer-Super-Mario-Bros-Blog.jpg
i0.wp.com/blog.cyble.com/wp-content/uploads/2023/06/
29 KB
29 KB
Image
General
Full URL
https://i0.wp.com/blog.cyble.com/wp-content/uploads/2023/06/UmbralStealer-Super-Mario-Bros-Blog.jpg?fit=300%2C150&ssl=1
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/_static/??-eJydU9tuwjAM/aGFiAltvEz7FJQ2pk1x4yxOYOzr57aEIaF1oy9N4+NzfM0pqJp8Ap90wNw4z7oFYyGqPVGSAxB6QSlq52vdsd7H0d+uOn463bMzJtebBDdEwwyJde+8En42gMqboxI0r8T4sBC6SncfGeK5YCoCuy+4WHfTbbk2C4EOTvR4N/3NaHWQgqkPejf0p8oOra5NpMyABVPFMCNDITnfk2dpeknGOk5Dy1vAAPGGLKEwW+ABlEIaYCQZml1cMqOTEsbvYg3HlChAORfp3O5IIE48o3IlqxCpCAj5BNXYdLGuYvYSai6XuxR+FBayywNRPdmMwL/MbRzuUfyELFAgPO8dovhATP/gRGhAXM3QgL8TbbJcK4jNZUUnEdmeIdo1+GOpPhCulVc0BLPweWG992/rl+3rZrteb56/AaHku90=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
ca1a20243591c8c18ef88cd36d77ac2fab4e30b213368be1c7b6dca1021e2a9d
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-nc
HIT hhn 4
date
Mon, 26 Jun 2023 02:45:21 GMT
x-content-type-options
nosniff
last-modified
Fri, 23 Jun 2023 10:57:55 GMT
server
nginx
etag
"e1d776c4c5f514ee"
vary
Accept
access-control-allow-methods
GET, HEAD
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=63115200
timing-allow-origin
*
link
<https://blog.cyble.com/wp-content/uploads/2023/06/UmbralStealer-Super-Mario-Bros-Blog.jpg>; rel="canonical"
content-length
29964
expires
Sun, 22 Jun 2025 22:57:55 GMT
Mallox-Ransomware-Blog.png
i0.wp.com/blog.cyble.com/wp-content/uploads/2023/06/
40 KB
41 KB
Image
General
Full URL
https://i0.wp.com/blog.cyble.com/wp-content/uploads/2023/06/Mallox-Ransomware-Blog.png?fit=300%2C150&ssl=1
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/_static/??-eJydU9tuwjAM/aGFiAltvEz7FJQ2pk1x4yxOYOzr57aEIaF1oy9N4+NzfM0pqJp8Ap90wNw4z7oFYyGqPVGSAxB6QSlq52vdsd7H0d+uOn463bMzJtebBDdEwwyJde+8En42gMqboxI0r8T4sBC6SncfGeK5YCoCuy+4WHfTbbk2C4EOTvR4N/3NaHWQgqkPejf0p8oOra5NpMyABVPFMCNDITnfk2dpeknGOk5Dy1vAAPGGLKEwW+ABlEIaYCQZml1cMqOTEsbvYg3HlChAORfp3O5IIE48o3IlqxCpCAj5BNXYdLGuYvYSai6XuxR+FBayywNRPdmMwL/MbRzuUfyELFAgPO8dovhATP/gRGhAXM3QgL8TbbJcK4jNZUUnEdmeIdo1+GOpPhCulVc0BLPweWG992/rl+3rZrteb56/AaHku90=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
4e793eac7a4a757ace95a8f403c37da763bd80eed0ba73ef0a8c3a352d70d98a
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-nc
HIT hhn 3
date
Mon, 26 Jun 2023 02:45:21 GMT
x-content-type-options
nosniff
last-modified
Thu, 22 Jun 2023 10:53:22 GMT
server
nginx
etag
"82c671f7ed842aec"
vary
Accept
access-control-allow-methods
GET, HEAD
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=63115200
timing-allow-origin
*
link
<https://blog.cyble.com/wp-content/uploads/2023/06/Mallox-Ransomware-Blog.png>; rel="canonical"
content-length
41276
expires
Sat, 21 Jun 2025 22:53:22 GMT
Vulnerability-Blog.png
i0.wp.com/blog.cyble.com/wp-content/uploads/2023/06/
51 KB
52 KB
Image
General
Full URL
https://i0.wp.com/blog.cyble.com/wp-content/uploads/2023/06/Vulnerability-Blog.png?fit=300%2C150&ssl=1
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/_static/??-eJydU9tuwjAM/aGFiAltvEz7FJQ2pk1x4yxOYOzr57aEIaF1oy9N4+NzfM0pqJp8Ap90wNw4z7oFYyGqPVGSAxB6QSlq52vdsd7H0d+uOn463bMzJtebBDdEwwyJde+8En42gMqboxI0r8T4sBC6SncfGeK5YCoCuy+4WHfTbbk2C4EOTvR4N/3NaHWQgqkPejf0p8oOra5NpMyABVPFMCNDITnfk2dpeknGOk5Dy1vAAPGGLKEwW+ABlEIaYCQZml1cMqOTEsbvYg3HlChAORfp3O5IIE48o3IlqxCpCAj5BNXYdLGuYvYSai6XuxR+FBayywNRPdmMwL/MbRzuUfyELFAgPO8dovhATP/gRGhAXM3QgL8TbbJcK4jNZUUnEdmeIdo1+GOpPhCulVc0BLPweWG992/rl+3rZrteb56/AaHku90=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
435f00991111c79b8bc036b8ed00742762f60e8a3f93728ba8a5f75beafec266
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-nc
HIT hhn 3
date
Mon, 26 Jun 2023 02:45:21 GMT
x-content-type-options
nosniff
last-modified
Tue, 20 Jun 2023 13:03:45 GMT
server
nginx
etag
"9f692b710f067478"
vary
Accept
access-control-allow-methods
GET, HEAD
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=63115200
timing-allow-origin
*
link
<https://blog.cyble.com/wp-content/uploads/2023/06/Vulnerability-Blog.png>; rel="canonical"
content-length
52520
expires
Fri, 20 Jun 2025 01:03:45 GMT
css
fonts.googleapis.com/
3 KB
1 KB
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Open+Sans:400
Requested by
Host: a.omappapi.com
URL: https://a.omappapi.com/app/js/webfont/1.5.18/webfont.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
d265615b79f98fdfff370ea32da7b4b02317fc6017b898cfb9c657a65618ac07
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Mon, 26 Jun 2023 02:45:21 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Mon, 26 Jun 2023 02:16:58 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Mon, 26 Jun 2023 02:45:21 GMT
590d3d292d6178957f6f2d56cd112c07-optin.json
a.omappapi.com/app/campaign-views/b584497dcf5c/poopcsalbacovn7gzkxg/
32 KB
6 KB
XHR
General
Full URL
https://a.omappapi.com/app/campaign-views/b584497dcf5c/poopcsalbacovn7gzkxg/590d3d292d6178957f6f2d56cd112c07-optin.json
Requested by
Host: a.omappapi.com
URL: https://a.omappapi.com/app/js/api.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1079:1 , Germany, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software
BunnyCDN-DE1-1079 /
Resource Hash
801cc197035c539bb4a679fc5e7196cf27c47fbd83626e83164eec8209bd13ef

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:21 GMT
content-encoding
br
cdn-edgestorageid
752
perma-cache
HIT
cdn-storageserver
DE-577
cdn-cachedat
06/23/2023 06:48:09
cdn-pullzone
293267
last-modified
Tue, 13 Jun 2023 05:38:24 GMT
server
BunnyCDN-DE1-1079
cdn-fileserver
588
cdn-requestpullcode
200
cdn-proxyver
1.03
etag
W/"648800d0-7f5b"
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
efcab737-66db-4b75-ab55-ed485d5a01dd
access-control-expose-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control
public, max-age=31919000
cdn-requestid
fe51bfc5763d0bfb6584f113e40431aa
cdn-requestcountrycode
DE
access-control-allow-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status
200
cdn-requestpullsuccess
True
e2cfb1058d12465db637db36642344d8
app.hubspot.com/conversations-visitor/21289959/threads/utk/ Frame 0402
53 KB
19 KB
Document
General
Full URL
https://app.hubspot.com/conversations-visitor/21289959/threads/utk/e2cfb1058d12465db637db36642344d8?uuid=6033cec75f6445d9b3ca509d85a4e507&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=blog.cyble.com&inApp53=false&messagesUtk=e2cfb1058d12465db637db36642344d8&url=https%3A%2F%2Fblog.cyble.com%2F2023%2F06%2F23%2Ftrojanized-super-mario-game-installer-spreads-supremebot-malware%2F&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=true&enableWidgetCookieBanner=false&isInCMS=false
Requested by
Host: js.usemessages.com
URL: https://js.usemessages.com/conversations-embed.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2034f2579b59ec7735c3affb3a4c969baea7beb28bfca3b3113876825d91577e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://blog.cyble.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-credentials
false
age
3587
alt-svc
h3=":443"; ma=86400
cache-control
max-age=600
cache-tag
staticjsapp-conversations-visitor-ui-web-prod,staticjsapp-prod
cf-cache-status
DYNAMIC
cf-ray
7dd21d184d1d995c-FRA
content-encoding
br
content-security-policy-report-only
script-src 'self' www.hubspot.com *.hsappstatic.net *.hs-analytics.net *.hs-banner.com *.hsforms.net *.hsleadflows.net *.hs-scripts.com *.hubspotfeedback.com *.usemessages.com js.hubspot.com *.hsadspixel.net *.hscollectedforms.net js-agent.newrelic.com bam.nr-data.net bam-cell.nr-data.net *.google-analytics.com www.googletagmanager.com data: 'unsafe-inline' 'unsafe-eval' blob: connect.facebook.net www.gstatic.cn www.gstatic.com www.google.com *.fullstory.com fullstory.com apis.google.com snap.licdn.com; report-uri https://send.hsbrowserreports.com/csp/report?resource=conversations-visitor-ui/static-1.15930/html/index.html&cfRay=7dd21d184d1d995c&reqUrl=https%3A%2F%2Fapp.hubspot.com%2Fconversations-visitor%2F21289959%2Fthreads%2Futk%2Fe2cfb1058d12465db637db36642344d8%3Fuuid%3D6033cec75f6445d9b3ca509d85a4e507%26mobile%3Dfalse%26mobileSafari%3Dfalse%26hideWelcomeMessage%3Dfalse%26hstc%3Dnull%26domain%3Dblog.cyble.com%26inApp53%3Dfalse%26messagesUtk%3De2cfb1058d12465db637db36642344d8%26url%3Dhttps%253A%252F%252Fblog.cyble.com%252F2023%252F06%252F23%252Ftrojanized-super-mario-game-installer-spreads-supremebot-malware%252F%26inline%3Dfalse%26isFullscreen%3Dfalse%26globalCookieOptOut%3Dnull%26isFirstVisitorSession%3Dtrue%26isAttachmentDisabled%3Dtrue%26enableWidgetCookieBanner%3Dfalse%26isInCMS%3Dfalse&referrer=https%3A%2F%2Fblog.cyble.com%2F&cfenv=prod&pdt=2023-06-26&csp=ro
content-type
text/html; charset=utf-8
date
Mon, 26 Jun 2023 02:45:21 GMT
etag
W/"37590aaf7e31621f771813bd079dfa69"
last-modified
Wed, 21 Jun 2023 05:37:58 UTC
report-to
{"group":"default","max_age":86400,"endpoints":[{"url":"https://send.hsbrowserreports.com/csp/reports"}]}
reporting-endpoints
default="https://send.hsbrowserreports.com/csp/reports?cfRay=7dd21d184d1d995c&resource=conversations-visitor-ui/static-1.15930/html/index.html"
server
cloudflare
strict-transport-security
max-age=31536000; includeSubDomains; preload
vary
origin, Accept-Encoding
via
1.1 caafbc8a9aa04b09dd564a3ddef60622.cloudfront.net (CloudFront)
x-amz-cf-id
hixUgVdkr9gYSFtwr-Aml9sON1MPcLWFY-UF7mqirbnXhdPMUJB5RA==
x-amz-cf-pop
IAD12-P3
x-amz-replication-status
COMPLETED
x-amz-server-side-encryption
AES256
x-amz-version-id
SWzcNb7KXqxjYrlvP7RCA8tJF7vhqfJY
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
3
x-evy-trace-listener
listener_https
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-route-service-name
envoyset-translator
x-evy-trace-served-by-pod
iad02/app-td/envoy-proxy-57ff77fcd-nnm64
x-evy-trace-virtual-host
all
x-hs-cache-status
MISS
x-hs-target-asset
conversations-visitor-ui/static-1.15930/html/index.html
x-hs-worker-debug-mode
false
x-request-id
769e480d-db5e-4e9f-a12a-87272ad20222
insight.min.js
snap.licdn.com/li.lms-analytics/
1 KB
774 B
Script
General
Full URL
https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by
Host: js.hsadspixel.net
URL: https://js.hsadspixel.net/fb.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3100::1735:28a8 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
77cf16e1867991ea4ed7fb6d470e613528693de636fb0f1352936cc480e180ae
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:21 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 22 Jun 2023 17:56:59 GMT
x-cdn
AKAM
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
content-type
application/x-javascript;charset=utf-8
cache-control
max-age=20873
accept-ranges
bytes
content-length
562
memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI.woff2
fonts.gstatic.com/s/opensans/v35/
18 KB
19 KB
Font
General
Full URL
https://fonts.gstatic.com/s/opensans/v35/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:400
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
441e23601fe7525a142857c98cbb2784997579d51a17f736d7964dceee609709
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://blog.cyble.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sat, 24 Jun 2023 02:30:05 GMT
x-content-type-options
nosniff
age
173716
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
18664
x-xss-protection
0
last-modified
Tue, 02 May 2023 15:19:23 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 23 Jun 2024 02:30:05 GMT
insight.old.min.js
snap.licdn.com/li.lms-analytics/
13 KB
5 KB
Script
General
Full URL
https://snap.licdn.com/li.lms-analytics/insight.old.min.js
Requested by
Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3100::1735:28a8 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
f56ccb2db87aacedd9415232e40f80bff9939703df2f9c3f9ec8a092e545349f
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-edgeconnect-origin-mex-latency
656
date
Mon, 26 Jun 2023 02:45:21 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 21 Jun 2023 22:21:38 GMT
x-cdn
AKAM
x-edgeconnect-midmile-rtt
0
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
content-type
application/x-javascript;charset=utf-8
cache-control
max-age=43414
accept-ranges
bytes
content-length
4777
token
cdn.linkedin.oribi.io/partner/4053396/domain/blog.cyble.com/
36 B
375 B
XHR
General
Full URL
https://cdn.linkedin.oribi.io/partner/4053396/domain/blog.cyble.com/token
Requested by
Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.old.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20eb:1400:2:53b2:240:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89

Request headers

Accept
*
Referer
https://blog.cyble.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:30:51 GMT
content-encoding
gzip
via
1.1 172e63b20fb363ed969de28ae3937e20.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C1
age
870
vary
accept-encoding
x-cache
Hit from cloudfront
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=3600
x-amz-cf-id
Cyqi_bPPM9U6JqVsVUg8eWjf9POfcOU6lAT6AwVBMt0Y3w91y2C-uw==
collect
px4.ads.linkedin.com/
Redirect Chain
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4053396&time=1687747521459&url=https%3A%2F%2Fblog.cyble.com%2F2023%2F06%2F23%2Ftrojanized-super-mario-game-installer-spreads-supremebot-malware%2F
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4053396&time=1687747521459&url=https%3A%2F%2Fblog.cyble.com%2F2023%2F06%2F23%2Ftrojanized-super-mario-game-installer-spreads-supremebot-malware%2F...
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D4053396%26time%3D1687747521459%26url%3Dhttps%253A%252F%252Fblog.cyble.com%252F202...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4053396&time=1687747521459&url=https%3A%2F%2Fblog.cyble.com%2F2023%2F06%2F23%2Ftrojanized-super-mario-game-installer-spreads-supremebot-malware%2F...
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4053396&time=1687747521459&url=https%3A%2F%2Fblog.cyble.com%2F2023%2F06%2F23%2Ftrojanized-super-mario-game-installer-spreads-supremebot-malware%2...
0
266 B
Image
General
Full URL
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4053396&time=1687747521459&url=https%3A%2F%2Fblog.cyble.com%2F2023%2F06%2F23%2Ftrojanized-super-mario-game-installer-spreads-supremebot-malware%2F&cookiesTest=true&liSync=true&e_ipv6=AQJFMRsJkzhtvAAAAYj1l24pZGKV47TNVL51-2enCkMoo5gs9zKvdtbJiArIxx3uPwsD1qWVPco91hrAlC56q4rLDgNkQw
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/06/23/trojanized-super-mario-game-installer-spreads-supremebot-malware/
Protocol
H2
Server
13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:22 GMT
x-li-pop
afd-prod-ltx1-x
x-msedge-ref
Ref A: 659A3BD507A1460EA9FEF856455A46A4 Ref B: FRAEDGE1920 Ref C: 2023-06-26T02:45:22Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
content-type
application/javascript
x-li-fabric
prod-ltx1
x-li-proto
http/2
content-length
0
x-li-uuid
AAX+/1eJkJ4kw+2uRYPxMQ==

Redirect headers

date
Mon, 26 Jun 2023 02:45:22 GMT
x-li-pop
afd-prod-ltx1-x
x-msedge-ref
Ref A: 636052BA7E7C4B5B94CA5512C5E1064D Ref B: FRAEDGE1212 Ref C: 2023-06-26T02:45:22Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
x-li-fabric
prod-ltx1
location
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4053396&time=1687747521459&url=https%3A%2F%2Fblog.cyble.com%2F2023%2F06%2F23%2Ftrojanized-super-mario-game-installer-spreads-supremebot-malware%2F&cookiesTest=true&liSync=true&e_ipv6=AQJFMRsJkzhtvAAAAYj1l24pZGKV47TNVL51-2enCkMoo5gs9zKvdtbJiArIxx3uPwsD1qWVPco91hrAlC56q4rLDgNkQw
x-li-proto
http/2
content-length
0
x-li-uuid
AAX+/1eGN5GLzFv6mKfZYA==
stats.json
injection.amibreached.com/ Frame A512
124 B
972 B
Fetch
General
Full URL
https://injection.amibreached.com/stats.json
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/06/23/trojanized-super-mario-game-installer-spreads-supremebot-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4768 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
bbdb1d21246d1c1a65aca8b41818f593b2d4704a459983866c0d331151b91887
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:21 GMT
strict-transport-security
max-age=15552000; includeSubDomains; preload
via
1.1 7ce1191b390045e05b9cc74f7514b77a.cloudfront.net (CloudFront)
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-content-type-options
nosniff
age
82786
x-amz-cf-pop
FRA6-C1
content-encoding
br
x-cache
Hit from cloudfront
last-modified
Mon, 23 May 2022 20:31:52 GMT
server
cloudflare
etag
W/"b660d52d56d1db01c2e37397c007a1e4"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/json
access-control-allow-origin
https://blog.cyble.com
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Mg8EgKmcSxGslugqNOMm8Wao2ne01po6Hggiz1D2EPyhFjBcrsHE1R2fstF%2BuaEFtdJ9wyr1r5zB%2Bvh3okbYH8mqnHQ1owETj80kytc89kJgAv0TKj%2FUt0SGulGYz8ETrufnHXlRUauSLe1YIfgZIK4O5xNgyLo%3D"}],"group":"cf-nel","max_age":604800}
access-control-expose-headers
x-amz-server-side-encryption, x-amz-request-id, x-amz-id-2, x-origin
access-control-max-age
3000
access-control-allow-credentials
true
cf-ray
7dd21d19be4f92b7-FRA
x-amz-cf-id
GGhUMdHOu5aLgBCcXpH7h5ntgOVt7N13qXe0m_oVyu0WUJBo0Q3dgw==
inject.8d8a39d8fa64efbb0671.bundle.js
injection.amibreached.com/ Frame A512
130 KB
44 KB
Script
General
Full URL
https://injection.amibreached.com/inject.8d8a39d8fa64efbb0671.bundle.js
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/06/23/trojanized-super-mario-game-installer-spreads-supremebot-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4768 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9af44543fbf7b09c3d68e46dcb21d2cb9ec5f18bbd537cea92360a85c5db793e
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:21 GMT
strict-transport-security
max-age=15552000; includeSubDomains; preload
via
1.1 e635875a1b765e19e161b42a06c4be12.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-content-type-options
nosniff
age
4533
x-amz-cf-pop
BCN50-P1
content-encoding
br
x-cache
Hit from cloudfront
last-modified
Mon, 23 May 2022 20:31:51 GMT
server
cloudflare
etag
W/"046f84a87526210ff005ab33291675c9"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sscpJZZfTyTKRZYRXAbZGsr88ssTSBPjbxtKG%2BNkSoY0a6uwdZEBvfzLiYHV9wKHhbCP0mjfPF2h3DsA0ZqzSOiEoOHOi8Hmt2JDe%2BMglxTPwb9DptIg5WtWqNNmpKYYM4FgSYNEKMsuCcnLXsY28zIR94CtaH0%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=120
cf-ray
7dd21d1a2f0f1cc9-FRA
x-amz-cf-id
dxipvBaBycyuS_mzRBKp7rbDvT3hp0J3rVGDnWIOQ0FjVmcXsGqIUg==
main.8d8a39d8fa64efbb0671.css
injection.amibreached.com/css/ Frame A512
703 B
725 B
Stylesheet
General
Full URL
https://injection.amibreached.com/css/main.8d8a39d8fa64efbb0671.css
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/06/23/trojanized-super-mario-game-installer-spreads-supremebot-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4768 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c7d0240fd43289ab1411c5fa1277574ee436d3a3bbb82d34c4d82f32d04517b8
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:21 GMT
strict-transport-security
max-age=15552000; includeSubDomains; preload
via
1.1 7ed7afde326861e358c3c83359e99894.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-content-type-options
nosniff
age
4533
x-amz-cf-pop
FRA6-C1
content-encoding
br
x-cache
Hit from cloudfront
last-modified
Mon, 23 May 2022 20:31:51 GMT
server
cloudflare
etag
W/"ff4f518052149a21c5b6397b3f717f6a"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Mo5sYqZRoswqatOvOc4iDshqRXVvSu7dlEqpOKGlEh6iB%2FbWv%2FRZgyj82udLi0nnFC%2Brbb0nkMBTsm068EVAULg7c7zrrtIFSgThZpmhVMEFF8WiRtHVeCrJCXaSd2SX9btizYj7flRdBrAi1Cf9Td9x8OLxRy8%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=120
cf-ray
7dd21d1a2f121cc9-FRA
x-amz-cf-id
8PXa3CC5eYjxkX33CBtcnHiSHOrt_ApQpJI_BCFUXPQ6QPoFtOXa8Q==
272.8d8a39d8fa64efbb0671.css
injection.amibreached.com/css/ Frame A512
348 KB
52 KB
Stylesheet
General
Full URL
https://injection.amibreached.com/css/272.8d8a39d8fa64efbb0671.css
Requested by
Host: injection.amibreached.com
URL: https://injection.amibreached.com/inject.8d8a39d8fa64efbb0671.bundle.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4768 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c77d2ba289d0e2827ad7f79b00972a63c7f4426d89b8ce6b5da90a368760cfe4
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:21 GMT
strict-transport-security
max-age=15552000; includeSubDomains; preload
via
1.1 1ac3fd533bf6be1b511077f8b8e23bfc.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-content-type-options
nosniff
age
4532
x-amz-cf-pop
FRA2-C1
content-encoding
br
x-cache
Hit from cloudfront
last-modified
Mon, 23 May 2022 20:31:51 GMT
server
cloudflare
etag
W/"a858af055119af47585aeffbfd69ceac"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2M60SNogD8j%2BmyY3ttbYQ4Oo%2F7G%2B9GA6UOnkHbK%2B0mccOZz%2FxeBXKo%2B5GCoRxdlvk4xzrPj6AdHwEf5roGc7bQdJ5jyy44l21NaQddOl%2BT7XSp4UARToEvT8YiWAcEfoUaML1%2Bmd8B%2BR0Md83QniDXAt9N4Hy%2FQ%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=120
cf-ray
7dd21d1a7f521cc9-FRA
x-amz-cf-id
d3abIhVtrCO4x-03VCo2UNr8YGsixnlX0W_hD3UUGVcG1XBpgK1Dpw==
272.8d8a39d8fa64efbb0671.chunk.js
injection.amibreached.com/chunks/ Frame A512
381 KB
101 KB
Script
General
Full URL
https://injection.amibreached.com/chunks/272.8d8a39d8fa64efbb0671.chunk.js
Requested by
Host: injection.amibreached.com
URL: https://injection.amibreached.com/inject.8d8a39d8fa64efbb0671.bundle.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4768 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
29d409fee0f34ebc05fa36076c101b77e28dccbcfdbfbf4cf248371820ca9ddb
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:21 GMT
strict-transport-security
max-age=15552000; includeSubDomains; preload
via
1.1 a350f357b825293e306b1b0a2cb490c0.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-content-type-options
nosniff
age
4532
x-amz-cf-pop
FRA6-C1
content-encoding
br
x-cache
Hit from cloudfront
last-modified
Mon, 23 May 2022 20:31:50 GMT
server
cloudflare
etag
W/"a161e1a55882deeacea4aadc5ab6a660"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Hr96B20WlkdTKfnk7f%2FIYr9VI%2Flx14EUTcoL02e5B%2BRyAqsgt%2FrosdYw%2B3YgEeylYxY1SCIPadypJGNMt49snOHA0qukKvHsYvq0h87LpJ49GUw6qyHBDRCi85k033YZwiaclNgEMymMcaLzTSztTCnHyS235OA%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=120
cf-ray
7dd21d1a7f531cc9-FRA
x-amz-cf-id
V9MXQQZw8uZ-5-9pOMfLL8_FcHDG4Of0CAszdTL_kGjGMFodP0YKRA==
349.8d8a39d8fa64efbb0671.css
injection.amibreached.com/css/ Frame A512
3 KB
1 KB
Stylesheet
General
Full URL
https://injection.amibreached.com/css/349.8d8a39d8fa64efbb0671.css
Requested by
Host: injection.amibreached.com
URL: https://injection.amibreached.com/inject.8d8a39d8fa64efbb0671.bundle.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4768 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9d904f71a4d973dac278821490969eb0a63dd97635584930bbbbec0a3e608d75
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:21 GMT
strict-transport-security
max-age=15552000; includeSubDomains; preload
via
1.1 21da0a66bafe2c8de8be4a4d8039346a.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-content-type-options
nosniff
age
4532
x-amz-cf-pop
FRA6-C1
content-encoding
br
x-cache
Hit from cloudfront
last-modified
Mon, 23 May 2022 20:31:51 GMT
server
cloudflare
etag
W/"d5e9ad0edf5f90c0d209a111611b1fba"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IqYxPuapBuXzuL9HkiVuyoNwHa2YLguWb9%2FQZ1DVttMshV9bJOk9%2Bjq4w1dfYoBNe2XnO3Z7Bi1xlBzzUnrvtbCNjJygLNNHkQf14%2Bk6d05QEbgU3jZVKwQJBjwDgwsdbU9%2B0ODap1evGbheMi4D%2BiZlMrWeQHo%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=120
cf-ray
7dd21d1a7f541cc9-FRA
x-amz-cf-id
0MZ_ygna4Rldv3fDzNslZYuBoMhii01SD-qFc_WQYh_oOKHJh1aWBA==
349.8d8a39d8fa64efbb0671.chunk.js
injection.amibreached.com/chunks/ Frame A512
16 KB
5 KB
Script
General
Full URL
https://injection.amibreached.com/chunks/349.8d8a39d8fa64efbb0671.chunk.js
Requested by
Host: injection.amibreached.com
URL: https://injection.amibreached.com/inject.8d8a39d8fa64efbb0671.bundle.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4768 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a2c197367cb631f88fca96c13ec0c06d0a99bc5398d0349716bc06ce7a91e8ce
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:21 GMT
strict-transport-security
max-age=15552000; includeSubDomains; preload
via
1.1 c1fb60e38be5022a78e4b52bedded7c2.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-content-type-options
nosniff
age
4532
x-amz-cf-pop
FRA6-C1
content-encoding
br
x-cache
Hit from cloudfront
last-modified
Mon, 23 May 2022 20:31:51 GMT
server
cloudflare
etag
W/"0e05edf25a54d46e1a8ef01ec442978b"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zI9aQOctOaHk%2FY2XcEVSO%2F2ULRvZCWLB6YJwfYMimSA6CiNOsSI%2BAntLjHZVAAY0S7kYVUM7rsS1P712jUt594hWpVVf3VEfpj0dviirax2f05XSRdiD3sP1C3Pr4tWUSL%2BPoFNWCHp5ZEMOq%2FFq9iJ9ymH2s9w%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=120
cf-ray
7dd21d1a7f561cc9-FRA
x-amz-cf-id
LdnB9D-DacYRatnN0fbfI2eQ4M3k1c6ZrmyzpoqV7fTS1dH5EnW0FQ==
primeicons.ttf
injection.amibreached.com/assets/fonts/ Frame A512
56 KB
57 KB
Font
General
Full URL
https://injection.amibreached.com/assets/fonts/primeicons.ttf
Requested by
Host: injection.amibreached.com
URL: https://injection.amibreached.com/css/272.8d8a39d8fa64efbb0671.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4768 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c1e93246e1f3ea9a11fa1a6d7c14e48a1da911f92043e2e6ef59da5ffd38f070
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://injection.amibreached.com/css/272.8d8a39d8fa64efbb0671.css
Origin
https://blog.cyble.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:21 GMT
strict-transport-security
max-age=15552000; includeSubDomains; preload
via
1.1 2f471134491a4de5cfcaef646caf9dde.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-content-type-options
nosniff
age
3569
x-amz-cf-pop
FRA6-C1
x-cache
Hit from cloudfront
content-length
57384
last-modified
Mon, 23 May 2022 20:31:50 GMT
server
cloudflare
etag
"121254f73060bcbb53ca13258dbd134f"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
binary/octet-stream
access-control-allow-origin
https://blog.cyble.com
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mZwiKTSk6hzMQb%2BOUtHP7O1l%2FqFBdzBVf7NT%2Fprd00iwSbeYVsQJCr7uxtZGuJ4gUmcK2qxK%2FwD0h79K1kTBx9qqL3oZc%2BlWjtNTmXxA%2FCX4NBiTzTsboz4OQXEa09%2FsEosYEZJWbf8cEJYj6o1fwNkHS4fxFNA%3D"}],"group":"cf-nel","max_age":604800}
access-control-expose-headers
x-amz-server-side-encryption, x-amz-request-id, x-amz-id-2, x-origin
cache-control
max-age=120
access-control-allow-credentials
true
access-control-max-age
3000
accept-ranges
bytes
cf-ray
7dd21d1b0f1b92b7-FRA
x-amz-cf-id
8fwfFOnPndQwiUXUc519F6YvjeQtDexlCJaJKthzT5dQp2PX2J65mw==
bundle.production.js
static.hsappstatic.net/head-dlb/static-1.338/ Frame 0402
44 KB
17 KB
Script
General
Full URL
https://static.hsappstatic.net/head-dlb/static-1.338/bundle.production.js
Requested by
Host: app.hubspot.com
URL: https://app.hubspot.com/conversations-visitor/21289959/threads/utk/e2cfb1058d12465db637db36642344d8?uuid=6033cec75f6445d9b3ca509d85a4e507&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=blog.cyble.com&inApp53=false&messagesUtk=e2cfb1058d12465db637db36642344d8&url=https%3A%2F%2Fblog.cyble.com%2F2023%2F06%2F23%2Ftrojanized-super-mario-game-installer-spreads-supremebot-malware%2F&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=true&enableWidgetCookieBanner=false&isInCMS=false
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:8d65 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ef39ee441c4e7792c5cda9a8bd86ddce96d9b17bda0cc9f7187f1a70ce9b3ed5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://app.hubspot.com/
Origin
https://app.hubspot.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:21 GMT
x-amz-version-id
uq4ahwTgbmdDVq3iqHPHE8OZSufTo1wc
via
1.1 993c0866e705e48daa4fed5e30627712.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-amz-cf-pop
FRA56-P2
age
1053060
x-amz-server-side-encryption
AES256
content-encoding
br
x-cache
Hit from cloudfront
x-amz-replication-status
COMPLETED
alt-svc
h3=":443"; ma=86400
last-modified
Fri, 28 Apr 2023 15:18:57 GMT
server
cloudflare
etag
W/"d4a36ffcc533bcbae2a557884d3059e8"
access-control-max-age
3000
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
https://app.hubspot.com
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sRXTOg5ipEq5cTORPSCHPgsZgRD61z%2BYPIcPHv4E7Vy7ZutInImiXmj7AYwAcfF1dQ9U7zeg7KlLULgosMgTSyGEgTGH6YJqU1HjabHxCsv1tGm1Ii60Cyj2ASFs5dvRogNSENC1NDSn8ledFPUWv7%2FWAfo%3D"}],"group":"cf-nel","max_age":604800}
vary
Origin,Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-credentials
true
cache-control
public, max-age=31536000
cf-ray
7dd21d1b6cc93621-FRA
x-amz-cf-id
djCh5PQgJFXiNGV3xFPdyuwAR5d1AbM4MkmRmJ04UARCBDQlz8mGEQ==
expires
Tue, 25 Jun 2024 02:45:21 GMT
visitor.css
static.hsappstatic.net/conversations-visitor-ui/static-1.14945/sass/ Frame 0402
20 KB
4 KB
Stylesheet
General
Full URL
https://static.hsappstatic.net/conversations-visitor-ui/static-1.14945/sass/visitor.css
Requested by
Host: app.hubspot.com
URL: https://app.hubspot.com/conversations-visitor/21289959/threads/utk/e2cfb1058d12465db637db36642344d8?uuid=6033cec75f6445d9b3ca509d85a4e507&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=blog.cyble.com&inApp53=false&messagesUtk=e2cfb1058d12465db637db36642344d8&url=https%3A%2F%2Fblog.cyble.com%2F2023%2F06%2F23%2Ftrojanized-super-mario-game-installer-spreads-supremebot-malware%2F&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=true&enableWidgetCookieBanner=false&isInCMS=false
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:8d65 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
36d655313c51c3540e79a4ed3bff5be86110779b4e25043a6e78150a58cdbc66
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://app.hubspot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:21 GMT
x-amz-version-id
eTttM9S_vWGkXsa3G13R54bOHuRyRlPL
via
1.1 83f1b8f73f37458f38e2ee1fc0b9e68c.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-amz-cf-pop
FRA56-P2
age
417341
x-amz-server-side-encryption
AES256
content-encoding
br
x-cache
Hit from cloudfront
x-amz-replication-status
COMPLETED
alt-svc
h3=":443"; ma=86400
last-modified
Mon, 06 Mar 2023 22:24:16 GMT
server
cloudflare
etag
W/"8b2053a9d9199e217c1f3e61d80f5d90"
vary
Origin,Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qiuDarP71%2FV6fe5veTWc83%2FMAH160hBUGyx%2Bh3YQNyCS6N6YIk22KTCUWlM5X%2BbljPhoJx6eIBnU0GhaQvery8TIHsawW5L%2FbsN31O%2BPPKSBQhcUqRFuGNehJG3kp4CVkrTCozVeeyOVWJagtq1aHmmmFJk%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
public, max-age=31536000
cf-ray
7dd21d1b69a835df-FRA
x-amz-cf-id
pk620Ax_62TSdfrvUX4oQsny_VITEHwqLirFduJJyNeTA58oI535pw==
expires
Tue, 25 Jun 2024 02:45:21 GMT
bundle.production.js
static.hsappstatic.net/hubspot-dlb/static-1.392/ Frame 0402
294 KB
94 KB
Script
General
Full URL
https://static.hsappstatic.net/hubspot-dlb/static-1.392/bundle.production.js
Requested by
Host: app.hubspot.com
URL: https://app.hubspot.com/conversations-visitor/21289959/threads/utk/e2cfb1058d12465db637db36642344d8?uuid=6033cec75f6445d9b3ca509d85a4e507&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=blog.cyble.com&inApp53=false&messagesUtk=e2cfb1058d12465db637db36642344d8&url=https%3A%2F%2Fblog.cyble.com%2F2023%2F06%2F23%2Ftrojanized-super-mario-game-installer-spreads-supremebot-malware%2F&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=true&enableWidgetCookieBanner=false&isInCMS=false
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:8d65 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a827ba0a43cbeb52e1f7c01fac1d8526f1a927ef58d5a0bc4ea4047a8b47f075
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://app.hubspot.com/
Origin
https://app.hubspot.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:21 GMT
x-amz-version-id
GyJQrIoHDRIfCuwwSVVsJwX13g1Qp9_O
via
1.1 49f259fbf0878ade02febf4980fecb18.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-amz-cf-pop
CDG52-P4
age
419617
x-amz-server-side-encryption
AES256
content-encoding
br
x-cache
Miss from cloudfront
x-amz-replication-status
COMPLETED
alt-svc
h3=":443"; ma=86400
last-modified
Thu, 06 Apr 2023 11:56:47 GMT
server
cloudflare
etag
W/"90cd3e4c19469ce68f12da7dbe18af11"
access-control-max-age
3000
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
https://app.hubspot.com
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WU%2BhqJJI4uiWppzS%2FTgd1JgP%2B1PSMTQIzpo3KNTy75kVC5572hDEqKvGyATtm%2Bt6xPdWvHqkzXyTD74mAEhEu%2BD4uLnaMiYpOj8Zm8klYMmPk2vFKafny5zYW2MHqKvPGOIsoO5eAxtEKKwsPVRK5Sebed8%3D"}],"group":"cf-nel","max_age":604800}
vary
Origin,Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-credentials
true
cache-control
public, max-age=31536000
cf-ray
7dd21d1b6ccb3621-FRA
x-amz-cf-id
O_MeBtLBcMu2yqoPQs9Iaku5SBxysnDhCN39BwNxRrr04r7Cj6EzUQ==
expires
Tue, 25 Jun 2024 02:45:21 GMT
visitor.js
static.hsappstatic.net/conversations-visitor-ui/static-1.15930/bundles/ Frame 0402
610 KB
179 KB
Script
General
Full URL
https://static.hsappstatic.net/conversations-visitor-ui/static-1.15930/bundles/visitor.js
Requested by
Host: app.hubspot.com
URL: https://app.hubspot.com/conversations-visitor/21289959/threads/utk/e2cfb1058d12465db637db36642344d8?uuid=6033cec75f6445d9b3ca509d85a4e507&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=blog.cyble.com&inApp53=false&messagesUtk=e2cfb1058d12465db637db36642344d8&url=https%3A%2F%2Fblog.cyble.com%2F2023%2F06%2F23%2Ftrojanized-super-mario-game-installer-spreads-supremebot-malware%2F&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=true&enableWidgetCookieBanner=false&isInCMS=false
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:8d65 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cf81ac8c30e3309074d0ed5b617c69c93033794ba854d533c349bc5f5e1b11da
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://app.hubspot.com/
Origin
https://app.hubspot.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:21 GMT
x-amz-version-id
R.g5gmjU3lBlqpxP3WcL7nHoSkS84poq
via
1.1 232da8e84bcfefcf0109ecb77a04d60e.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-amz-cf-pop
MXP64-C3
age
378434
x-amz-server-side-encryption
AES256
content-encoding
br
x-cache
Hit from cloudfront
x-amz-replication-status
COMPLETED
alt-svc
h3=":443"; ma=86400
last-modified
Wed, 21 Jun 2023 13:08:58 GMT
server
cloudflare
etag
W/"2b32fa0c551d7f8e6e69e02fcfd9dd3f"
access-control-max-age
3000
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
https://app.hubspot.com
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wnG2QZ%2BXVfkzEgq2C7eRLa243CseHRUH9ALBwGOoDSukuTydbn9ls%2BuoUEoNb3%2BwrTiapfQblZ4vV79YDViXsw8aZx%2Fw%2FWhZ4%2BF5j%2BdmbKHVhlmG47NKQCQMZU0v72CWespbD1qZAj50BkZNM%2FH0K4qxnIo%3D"}],"group":"cf-nel","max_age":604800}
vary
Origin,Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-credentials
true
cache-control
public, max-age=31536000
cf-ray
7dd21d1b6ccc3621-FRA
x-amz-cf-id
bGeGk-DHjEKz1Us4ldK_tPbJXSA64rFZl6u6qOqhwpdXmSEa5HjxeA==
expires
Tue, 25 Jun 2024 02:45:21 GMT
i18n-data-data-locales-en-us.js
static.hsappstatic.net/conversations-visitor-ui/static-1.15894/ Frame 0402
776 B
919 B
Script
General
Full URL
https://static.hsappstatic.net/conversations-visitor-ui/static-1.15894/i18n-data-data-locales-en-us.js
Requested by
Host: static.hsappstatic.net
URL: https://static.hsappstatic.net/conversations-visitor-ui/static-1.15930/bundles/visitor.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:8d65 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
50e16cd4e9ca2e3fa07a17999a03ea7d64aaf98e589d8f31bf8d058b392006c2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://app.hubspot.com/
Origin
https://app.hubspot.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:22 GMT
x-amz-version-id
W6sRVm4a0TZhhY1dFjRGW6vrlAEpwoIL
via
1.1 fd000a128e6bb534d86b423d2d506d52.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-amz-cf-pop
CDG52-P2
age
378435
x-amz-server-side-encryption
AES256
content-encoding
br
x-cache
Hit from cloudfront
x-amz-replication-status
COMPLETED
alt-svc
h3=":443"; ma=86400
last-modified
Thu, 15 Jun 2023 18:05:54 GMT
server
cloudflare
etag
W/"9632a4ca2c63ac21a220b847bcc31c1c"
access-control-max-age
3000
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
https://app.hubspot.com
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=G6mjeM2f2IO4HLCUVHLaS6zWlxy0hzFfm%2FxMQFY3woa9nI5uNw9oL2A%2BBSfWYoaeEFAdne8jme7nHp6PJeadQVujdswxm%2FQrOOgKGtFN0GkZ3T3iXGvgXp933cFAwI56aqkvk2Z0PgrNjrFnFX546684eDE%3D"}],"group":"cf-nel","max_age":604800}
vary
Origin,Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-credentials
true
cache-control
public, max-age=31536000
cf-ray
7dd21d1c7d803621-FRA
x-amz-cf-id
IY5kx9d_OSJAn5zSp8PzSXjvnfGExabYFEIqu4GOHdfZgW2khID_BQ==
expires
Tue, 25 Jun 2024 02:45:22 GMT
hawk.png
labs.cyble.com/hs-fs/hubfs/ Frame 0402
4 KB
5 KB
Image
General
Full URL
https://labs.cyble.com/hs-fs/hubfs/hawk.png?width=108&height=108
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/06/23/trojanized-super-mario-game-installer-spreads-supremebot-malware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:2c40::c73c:671e , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
079ceaa0981ce7f89ad67f2b125a26b02d93a4b400b0d01c1095d9d03b24c738
Security Headers
Name Value
Content-Security-Policy default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://app.hubspot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:22 GMT
strict-transport-security
max-age=31536000
via
1.1 62e7b24ca032b612bb93fa7f3437469c.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options
nosniff
content-security-policy
default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests
cache-tag
F-83412232556,P-21289959,FLS-ALL
x-hs-https-only
worker
alt-svc
h3=":443"; ma=86400
content-length
4194
cf-resized
internal=ok/m q=0 n=892+0 c=52+46 v=2023.6.2 l=4194
last-modified
Tue, 30 Aug 2022 08:53:18 GMT
cf-bgj
imgq:86,h2pri
server
cloudflare
etag
"cfLv25S9_RZ9mVF-YFCFUfZcZkUn9Bg2vL7Sxl6y2PDQ:ac94ce2bd2684e2d18ebb6c3988701dd"
vary
Accept, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=u68SB8zydD4zrCSX3R28y5iMj%2Fxn9Y50B4sAGTtaS0r7lEUxqqCZJ4EfdNuyDD8zlDDewSFeOhRtehygt7iv2UqT7yGgAIu5vZGTzsaRClDOh09zLIcp5WDLk51G8AMFcp3oIjuX64yun%2BCI"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
accept-ranges
bytes
cf-ray
7dd21d1dbb123736-FRA
rhumb
app.hubspot.com/api/cartographer/v1/ Frame 0402
0
1 KB
Ping
General
Full URL
https://app.hubspot.com/api/cartographer/v1/rhumb?hs_static_app=conversations-visitor-ui&hs_static_app_version=1.15930
Requested by
Host: static.hsappstatic.net
URL: https://static.hsappstatic.net/conversations-visitor-ui/static-1.15930/bundles/visitor.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://app.hubspot.com/conversations-visitor/21289959/threads/utk/e2cfb1058d12465db637db36642344d8?uuid=6033cec75f6445d9b3ca509d85a4e507&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=blog.cyble.com&inApp53=false&messagesUtk=e2cfb1058d12465db637db36642344d8&url=https%3A%2F%2Fblog.cyble.com%2F2023%2F06%2F23%2Ftrojanized-super-mario-game-installer-spreads-supremebot-malware%2F&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=true&enableWidgetCookieBanner=false&isInCMS=false
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Mon, 26 Jun 2023 02:45:22 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name
envoyset-translator
x-hubspot-correlation-id
eb18d3f9-21c5-4627-800b-9319a1407089
x-envoy-upstream-service-time
4
alt-svc
h3=":443"; ma=86400
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
42ab27ec-8d26-40a3-b01d-accb180c494b
server
cloudflare
vary
origin, Accept-Encoding
access-control-allow-methods
GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XtdTS%2FuGhJS7Ok4aWki5cu1NEI8nvArBZzgMvWERx6cK0wVaUv6BKzh7Wvogr0SkW9DWEajFKlEJ5Jp%2FvLwaFI%2FsxFHulACZ5SBnT2KRunGlmWadAC%2F2HmLTRsrxEMaK5r0SJ05SBOiDEeMftQ%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
https://app.hubspot.com
x-evy-trace-served-by-pod
iad02/hubapi-td/envoy-proxy-598c95b5b7-qtxhk
access-control-expose-headers
x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing, X-Hubspot-Correct-Hublet, X-HubSpot-Auth-Failure
access-control-max-age
604800
access-control-allow-credentials
true
x-evy-trace-virtual-host
all
cf-ray
7dd21d1d481b995c-FRA
access-control-allow-headers
Authorization, Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer
timing-allow-origin
*
welcomeMessages
app.hubspot.com/api/livechat-public/v1/bots/public/bot/2122156/ Frame 0402
982 B
1 KB
XHR
General
Full URL
https://app.hubspot.com/api/livechat-public/v1/bots/public/bot/2122156/welcomeMessages?hs_static_app=conversations-visitor-ui&hs_static_app_version=1.15930&conversations-visitor-ui=static-1.15930&traceId=e2cfb1058d12465db637db36642344d8&sessionId=AMOaWbLaoE-BHQf1vypnEzmUBi8NL7Gh9YU9oEUQtPaStmaGYIgt2VSa-kbHSl-RZpQQz0pRqiLQMoYMcNSrgT6TrGs-zIuXDpBubp9kNeg46085OllkJJavmfkNnmsKuxDjGlLNiDtyNQ71SPkldtZay2ygdMXO6IZbYy140fyzy9rVWhlY1VY
Requested by
Host: static.hsappstatic.net
URL: https://static.hsappstatic.net/head-dlb/static-1.338/bundle.production.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b77ec44e91ca88fa577e8e1c7b8a158431872c0b9d7b100f0dedde01cc4cd764
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://app.hubspot.com/conversations-visitor/21289959/threads/utk/e2cfb1058d12465db637db36642344d8?uuid=6033cec75f6445d9b3ca509d85a4e507&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=blog.cyble.com&inApp53=false&messagesUtk=e2cfb1058d12465db637db36642344d8&url=https%3A%2F%2Fblog.cyble.com%2F2023%2F06%2F23%2Ftrojanized-super-mario-game-installer-spreads-supremebot-malware%2F&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=true&enableWidgetCookieBanner=false&isInCMS=false
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:22 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name
envoyset-translator
x-hubspot-correlation-id
bcd5f246-55c9-4532-8fde-39840185b1b3
x-envoy-upstream-service-time
24
alt-svc
h3=":443"; ma=86400
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
8f0875f6-d97e-4b30-9b08-81472a748f2e
server
cloudflare
x-trace
2B52B06C3E0D90BF7F673BDD5CE1744810AECF5AC9000000000000000000
vary
origin, Accept-Encoding
access-control-allow-methods
GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type
application/json;charset=utf-8
x-evy-trace-served-by-pod
iad02/hubapi-td/envoy-proxy-598c95b5b7-nkmk5
x-evy-trace-virtual-host
all
access-control-allow-credentials
false
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LhEgbawoxkMMXmAKPJTIKoudgFiE98cK5WqKKg4sqAssfvUkkLX22UooQ3oH0vXpIfGEZes%2FYsvlrqhAjZ0tRC3kkAswaM%2FwZ2f0JsaNaOBobpJ0oFnD7emzo67VIbvvDL31%2FvFpCocqszwoXA%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
7dd21d1d5829995c-FRA
access-control-allow-headers
Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent, X-HubSpot-Messages-Uri
__ptq.gif
track.hubspot.com/
45 B
527 B
Image
General
Full URL
https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=3485376358&v=1.1&a=21289959&ct=blog-post&rcu=https%3A%2F%2Fblog.cyble.com%2F2023%2F06%2F23%2Ftrojanized-super-mario-game-installer-spreads-supremebot-malware%2F&pu=https%3A%2F%2Fblog.cyble.com%2F2023%2F06%2F23%2Ftrojanized-super-mario-game-installer-spreads-supremebot-malware%2F&t=Cyble+%E2%80%94+Trojanized+Super+Mario+Game+Installer+Spreads+SupremeBot+Malware&cts=1687747522405&vi=e66f1917660748b3289b81f0f7d14042&nc=true&u=27441379.e66f1917660748b3289b81f0f7d14042.1687747522401.1687747522401.1687747522401.1&b=27441379.1.1687747522401&cc=15
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:22 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name
envoyset-translator
x-hubspot-correlation-id
ee9d7a10-c554-4155-95d9-4f0615fa44d4
p3p
CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time
5
alt-svc
h3=":443"; ma=86400
content-length
45
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
ee508671-0827-4c70-b06f-389125205b9f
server
cloudflare
vary
origin, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=c7O5ACdNPa0ECKaxzzQU8fuRSfqAOY9kiKyUivOBF4aZGI0KRQU4Ll2oIvcOxoGFjNC1oIDLZ5CbNiWXXmF2UtZQs9%2FvcG7ef8AdaJNUacDrg2OU38ZpQ6jzFRal4TwcG8DWmOfuUJAsafOdF%2BcA"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
x-evy-trace-served-by-pod
iad02/analytics-tracking-td/envoy-proxy-5f6448c676-8bmqp
x-evy-trace-virtual-host
all
cache-control
no-cache, no-store, no-transform
access-control-allow-credentials
false
cf-ray
7dd21d1f2998995c-FRA
x-robots-tag
none
__ptq.gif
track.hubspot.com/
45 B
491 B
Image
General
Full URL
https://track.hubspot.com/__ptq.gif?k=15&fi=f7da69d1-3801-430f-b109-5f44b65a9326&fci=409f2ff8-1c38-476b-8616-ba0cadad41e1&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=3485376358&v=1.1&a=21289959&ct=blog-post&rcu=https%3A%2F%2Fblog.cyble.com%2F2023%2F06%2F23%2Ftrojanized-super-mario-game-installer-spreads-supremebot-malware%2F&pu=https%3A%2F%2Fblog.cyble.com%2F2023%2F06%2F23%2Ftrojanized-super-mario-game-installer-spreads-supremebot-malware%2F&t=Cyble+%E2%80%94+Trojanized+Super+Mario+Game+Installer+Spreads+SupremeBot+Malware&cts=1687747522409&vi=e66f1917660748b3289b81f0f7d14042&nc=true&u=27441379.e66f1917660748b3289b81f0f7d14042.1687747522401.1687747522401.1687747522401.1&b=27441379.1.1687747522401&cc=15
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:22 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name
envoyset-translator
x-hubspot-correlation-id
d4d2e3ef-68b6-41ae-a098-c490c6dd3ac2
p3p
CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time
5
alt-svc
h3=":443"; ma=86400
content-length
45
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
722efa67-2934-4517-94d8-13208f530075
server
cloudflare
vary
origin, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lejmZP5ht%2FJzk%2F7HusRHH2SmqFyJz6AXio7mwEgFspBJPuJ5cbvPKcezV3aTYo98xRPXXc5PrNPv9TVkEPjyUHCLADBDogjF9Jy%2FPEoLcHLhyyy9oSlrIlAgE5DgAM6382Q68kdZbTlVffKWyAlf"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
x-evy-trace-served-by-pod
iad02/analytics-tracking-td/envoy-proxy-5f6448c676-p7wls
x-evy-trace-virtual-host
all
cache-control
no-cache, no-store, no-transform
access-control-allow-credentials
false
cf-ray
7dd21d1f39a1995c-FRA
x-robots-tag
none
__ptq.gif
track.hubspot.com/
45 B
428 B
Image
General
Full URL
https://track.hubspot.com/__ptq.gif?k=17&fi=f7da69d1-3801-430f-b109-5f44b65a9326&fci=409f2ff8-1c38-476b-8616-ba0cadad41e1&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=3485376358&v=1.1&a=21289959&ct=blog-post&rcu=https%3A%2F%2Fblog.cyble.com%2F2023%2F06%2F23%2Ftrojanized-super-mario-game-installer-spreads-supremebot-malware%2F&pu=https%3A%2F%2Fblog.cyble.com%2F2023%2F06%2F23%2Ftrojanized-super-mario-game-installer-spreads-supremebot-malware%2F&t=Cyble+%E2%80%94+Trojanized+Super+Mario+Game+Installer+Spreads+SupremeBot+Malware&cts=1687747522412&vi=e66f1917660748b3289b81f0f7d14042&nc=true&u=27441379.e66f1917660748b3289b81f0f7d14042.1687747522401.1687747522401.1687747522401.1&b=27441379.1.1687747522401&cc=15
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:22 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name
envoyset-translator
x-hubspot-correlation-id
f164ba1c-92d7-4cf0-92fd-abd99c9f079f
p3p
CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time
7
alt-svc
h3=":443"; ma=86400
content-length
45
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
ecfbd8bb-1b77-41f8-a84d-b38c27a3c535
server
cloudflare
vary
origin, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=G%2Bi91v%2F110Rnwx9Qc1zGi9rn8K6ny%2BbSrO498eT5HBwKD4UO0Tb5ixmo8eHPQkPlqQCWVrOkpXM2ibOxQhWKWlDzbVrNnbTqx3%2BKej%2BnTmeVgMMDkMA%2FXlA3mFfi9jSPsN3a7%2Fz3fRXFp6g%2FViBg"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
x-evy-trace-served-by-pod
iad02/analytics-tracking-td/envoy-proxy-5f6448c676-p7wls
x-evy-trace-virtual-host
all
cache-control
no-cache, no-store, no-transform
access-control-allow-credentials
false
cf-ray
7dd21d1f39a3995c-FRA
x-robots-tag
none
__ptq.gif
track.hubspot.com/
45 B
434 B
Image
General
Full URL
https://track.hubspot.com/__ptq.gif?k=15&fi=f7da69d1-3801-430f-b109-5f44b65a9326&fci=f20dbd47-fe36-4fc2-9da0-63cf86b4a056&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=3485376358&v=1.1&a=21289959&ct=blog-post&rcu=https%3A%2F%2Fblog.cyble.com%2F2023%2F06%2F23%2Ftrojanized-super-mario-game-installer-spreads-supremebot-malware%2F&pu=https%3A%2F%2Fblog.cyble.com%2F2023%2F06%2F23%2Ftrojanized-super-mario-game-installer-spreads-supremebot-malware%2F&t=Cyble+%E2%80%94+Trojanized+Super+Mario+Game+Installer+Spreads+SupremeBot+Malware&cts=1687747522414&vi=e66f1917660748b3289b81f0f7d14042&nc=true&u=27441379.e66f1917660748b3289b81f0f7d14042.1687747522401.1687747522401.1687747522401.1&b=27441379.1.1687747522401&cc=15
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:22 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name
envoyset-translator
x-hubspot-correlation-id
03d38cf1-0bcf-4317-ba4f-28ca34ce0e9a
p3p
CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time
5
alt-svc
h3=":443"; ma=86400
content-length
45
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
008b9508-b81f-4a51-94f1-52e87a128986
server
cloudflare
vary
origin, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kszZx9vcyCdSl15SrQgIsG4nRvhMaIJywK9tW9BuLNwzVXfs2HnZf%2Bq%2BzARx6xY3eI0qt964LOF4kb%2FV4Y0BY5vBAcZ6S253LyfSywyvLx3sUWGpjn9lDclDm61MGj6BTBulcgEzNY%2F9tf712Et0"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
x-evy-trace-served-by-pod
iad02/analytics-tracking-td/envoy-proxy-5f6448c676-2c4rt
x-evy-trace-virtual-host
all
cache-control
no-cache, no-store, no-transform
access-control-allow-credentials
false
cf-ray
7dd21d1f39a4995c-FRA
x-robots-tag
none
__ptq.gif
track.hubspot.com/
45 B
677 B
Image
General
Full URL
https://track.hubspot.com/__ptq.gif?k=17&fi=f7da69d1-3801-430f-b109-5f44b65a9326&fci=f20dbd47-fe36-4fc2-9da0-63cf86b4a056&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=3485376358&v=1.1&a=21289959&ct=blog-post&rcu=https%3A%2F%2Fblog.cyble.com%2F2023%2F06%2F23%2Ftrojanized-super-mario-game-installer-spreads-supremebot-malware%2F&pu=https%3A%2F%2Fblog.cyble.com%2F2023%2F06%2F23%2Ftrojanized-super-mario-game-installer-spreads-supremebot-malware%2F&t=Cyble+%E2%80%94+Trojanized+Super+Mario+Game+Installer+Spreads+SupremeBot+Malware&cts=1687747522415&vi=e66f1917660748b3289b81f0f7d14042&nc=true&u=27441379.e66f1917660748b3289b81f0f7d14042.1687747522401.1687747522401.1687747522401.1&b=27441379.1.1687747522401&cc=15
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:22 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name
envoyset-translator
x-hubspot-correlation-id
a0eed286-4e94-4aca-b25b-79591022ecbc
p3p
CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time
6
alt-svc
h3=":443"; ma=86400
content-length
45
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
7dbf6128-ade3-4124-9cd0-57e4e7866e0f
server
cloudflare
vary
origin, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Vp2L1wBJmHJU%2BmMg1LSJK0%2FHD5vSwZwHsmzwrRgF0gu0ThSipgCO3%2BRjovw0TSs7b0vchDM%2BVYo3DzCkUJS3J0M2DZm2hPF0qb2jn25ECJHqprlOanZtt2ZqKwiM6Jl%2BiJyWR4mDUfAgInjS5GDk"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
x-evy-trace-served-by-pod
iad02/analytics-tracking-td/envoy-proxy-5f6448c676-vrlgm
x-evy-trace-virtual-host
all
cache-control
no-cache, no-store, no-transform
access-control-allow-credentials
false
cf-ray
7dd21d1f39a5995c-FRA
x-robots-tag
none
json
forms.hubspot.com/lead-flows-config/v1/config/
5 KB
2 KB
XHR
General
Full URL
https://forms.hubspot.com/lead-flows-config/v1/config/json?portalId=21289959&utk=e66f1917660748b3289b81f0f7d14042&__hstc=27441379.e66f1917660748b3289b81f0f7d14042.1687747522401.1687747522401.1687747522401.1&__hssc=27441379.1.1687747522401&currentUrl=https%3A%2F%2Fblog.cyble.com%2F2023%2F06%2F23%2Ftrojanized-super-mario-game-installer-spreads-supremebot-malware%2F
Requested by
Host: js.hsleadflows.net
URL: https://js.hsleadflows.net/leadflows.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d2e60979787dc4523c4ab9251c1317ed9caa08482dbf7b59a79d833ede3f0e66
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:22 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id
50230423-3286-46b8-b530-561a897c74d9
x-evy-trace-route-service-name
envoyset-translator
x-envoy-upstream-service-time
30
alt-svc
h3=":443"; ma=86400
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
ed9e3f4f-77e2-4c16-b874-1c4f911c1e17
server
cloudflare
vary
origin
access-control-allow-methods
GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type
application/json;charset=utf-8
access-control-allow-origin
https://blog.cyble.com
x-evy-trace-virtual-host
all
access-control-max-age
180
access-control-allow-credentials
false
cache-control
max-age=0, no-cache, no-store
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tAwQx62KG4VC35mk2mKrSgOKWn8bhRRvhduFo8nGtnvmZ6SJjeTfE5kPmw2fZBx5FLHeN6QCYhsYRIvt74DT3gkaeizCojXiFSqyQvVld2rEKApp4ryuW6M6hnwEYE90xRqV6BNkVASVEfxj%2FT5m"}],"group":"cf-nel","max_age":604800}
x-robots-tag
none
access-control-allow-headers
Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent
cf-ray
7dd21d1f8d49bb7d-FRA
x-evy-trace-served-by-pod
iad02/star-hubspot-td/envoy-proxy-759c64d45c-llkhw
__ptq.gif
track.hubspot.com/
45 B
914 B
Image
General
Full URL
https://track.hubspot.com/__ptq.gif?k=16&fi=790ac0ff-0b05-4061-9a47-31d43798706a&lfi=3647704&ft=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=3485376358&v=1.1&a=21289959&ct=blog-post&rcu=https%3A%2F%2Fblog.cyble.com%2F2023%2F06%2F23%2Ftrojanized-super-mario-game-installer-spreads-supremebot-malware%2F&pu=https%3A%2F%2Fblog.cyble.com%2F2023%2F06%2F23%2Ftrojanized-super-mario-game-installer-spreads-supremebot-malware%2F&t=Cyble+%E2%80%94+Trojanized+Super+Mario+Game+Installer+Spreads+SupremeBot+Malware&cts=1687747522885&vi=e66f1917660748b3289b81f0f7d14042&nc=true&u=27441379.e66f1917660748b3289b81f0f7d14042.1687747522401.1687747522401.1687747522401.1&b=27441379.1.1687747522401&cc=15
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:23 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name
envoyset-translator
x-hubspot-correlation-id
4313bbbf-f5c4-4373-b149-58e8e312921d
p3p
CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time
4
alt-svc
h3=":443"; ma=86400
content-length
45
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
1178b177-6baa-42c0-805d-78076b9cd18c
server
cloudflare
vary
origin, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TTS8JdFHzUzT9tJGrR0odPii90cfi8fb3vRiOsPQWO90N%2BGYqHoUCM0uuqx%2BPPwPyA2I2c50i%2BMrqKbz97U80Tt1EaC5V0hBaCUUXgji%2BDZxA6gnYpPPK3rt2bsKRZAkjrvhvfQf0RYKsdmiJ%2FrN"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
x-evy-trace-served-by-pod
iad02/analytics-tracking-td/envoy-proxy-5f6448c676-86grs
x-evy-trace-virtual-host
all
cache-control
no-cache, no-store, no-transform
access-control-allow-credentials
false
cf-ray
7dd21d221dd15c5c-FRA
x-robots-tag
none
__ptq.gif
track.hubspot.com/
45 B
881 B
Image
General
Full URL
https://track.hubspot.com/__ptq.gif?k=16&fi=cee71856-29e8-471c-8003-80db9e58e8dc&lfi=5011554&ft=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=3485376358&v=1.1&a=21289959&ct=blog-post&rcu=https%3A%2F%2Fblog.cyble.com%2F2023%2F06%2F23%2Ftrojanized-super-mario-game-installer-spreads-supremebot-malware%2F&pu=https%3A%2F%2Fblog.cyble.com%2F2023%2F06%2F23%2Ftrojanized-super-mario-game-installer-spreads-supremebot-malware%2F&t=Cyble+%E2%80%94+Trojanized+Super+Mario+Game+Installer+Spreads+SupremeBot+Malware&cts=1687747522886&vi=e66f1917660748b3289b81f0f7d14042&nc=true&u=27441379.e66f1917660748b3289b81f0f7d14042.1687747522401.1687747522401.1687747522401.1&b=27441379.1.1687747522401&cc=15
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 02:45:23 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name
envoyset-translator
x-hubspot-correlation-id
1dd4e7ed-ebb4-4e65-ad10-e8b7510b3b12
p3p
CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time
6
alt-svc
h3=":443"; ma=86400
content-length
45
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
8b388ce5-b443-47a3-8a25-06307a464d44
server
cloudflare
vary
origin, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hlbqXLdr7EUZmb2xG6U%2B7xNzQ7XiLMI7qAglxoM1mxO%2BR4hXTvZEmd15FZ%2B0valkq3edF3BHbSgp1bAPechwWT7%2Biq%2F%2BesRZXmWblse3FmEEi0fluJjx%2BkoNcH63NuiuTl77T6y97jHmWcDecsei"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
x-evy-trace-served-by-pod
iad02/analytics-tracking-td/envoy-proxy-5f6448c676-p7wls
x-evy-trace-virtual-host
all
cache-control
no-cache, no-store, no-transform
access-control-allow-credentials
false
cf-ray
7dd21d221dd25c5c-FRA
x-robots-tag
none
boom.gif
pixel.wp.com/
0
37 B
Image
General
Full URL
https://pixel.wp.com/boom.gif?bilmur=1&cumulative_layout_shift=0.083&largest_contentful_paint=1498&batcache_hit=0&provider=wordpress.com&service=atomic&effective_connection_type=4g&rtt=0&downlink=10000&host_name=blog.cyble.com&url_path=%2F2023%2F06%2F23%2Ftrojanized-super-mario-game-installer-spreads-supremebot-malware%2F&nt_fetchStart=0&nt_domainLookupStart=1&nt_domainLookupEnd=12&nt_connectStart=12&nt_connectEnd=26&nt_secureConnectionStart=18&nt_requestStart=26&nt_responseStart=218&nt_responseEnd=258&nt_domLoading=221&nt_domInteractive=1332&nt_domContentLoadedEventStart=1334&nt_domContentLoadedEventEnd=1388&nt_domComplete=2847&nt_loadEventStart=2847&nt_loadEventEnd=2903&nt_redirectCount=0&nt_nextHopProtocol=h2&nt_api_level=2&start_render=896&first_contentful_paint=896&resource_size=2661801&resource_transferred=507419&js_size=629862&js_transferred=181388&resource_cache_percent=0&js_cache_percent=0&last_resource_end=3499
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-origin
*
date
Mon, 26 Jun 2023 02:45:25 GMT
cache-control
no-cache
server
nginx

Verdicts & Comments Add Verdict or Comment

168 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 boolean| credentialless object| onbeforetoggle object| onscrollend object| _wpemojiSettings function| advanced_ads_ready object| advanced_ads_ready_queue object| twemoji object| wp undefined| $ function| jQuery object| cnArgs function| gtag object| dataLayer object| _hsq string| adroll_adv_id string| adroll_pix_id string| adroll_version boolean| __adroll_loaded object| adroll object| hsConversationsSettings object| hubspot object| HubSpotForms object| hbspt object| hsFormsOnReady object| artemis boolean| poopcsalbacovn7gzkxg_shortcode object| astra function| astraGetParents function| getParents function| astraToggleClass function| toggleClass function| astraTriggerEvent function| astraSmoothScroll function| astScrollToTopHandler function| popupTriggerClick function| AstraToggleSubMenu function| AstraToggleSetup function| astraNavMenuToggle object| leadin_wordpress object| astraAddon object| jetpackLazyImagesL10n function| display_mega_menu_on_load object| items function| apply_megamenu_width_styles function| astraToggleSetupPro function| astraNavMenuTogglePro string| sticky_header_on_devices string| site_layout_box_width string| hook_sticky_footer string| sticky_footer_on_devices object| _stq object| jetpackSwiperLibraryPath object| jetpackCarouselStrings object| uael_posts_script object| webpackChunkom_api_js object| _omapp function| OptinMonsterApp boolean| om_loaded object| poopcsalbacovn7gzkxg object| _omq function| omq function| __adroll__ string| adroll_sid object| __adroll function| __cmp function| __tcfapi boolean| adroll_sendrolling_cross_device object| adroll_form_fields function| adroll_tpc_callback object| google_tag_manager object| google_tag_data object| _hsp string| GoogleAnalyticsObject function| ga object| adroll_exp_list boolean| PIXELS_RAN object| enabledEventSettings object| gaplugins object| gaGlobal object| gaData object| globalRoot undefined| hns function| bindToWindowOnError function| defineProperties object| leadflows function| OutpostErrorReporter function| _registerAvailablePopup object| _availablePopups boolean| popupPoliceActive undefined| hns2 undefined| jade undefined| I18n undefined| Pikaday undefined| reqwest undefined| exports undefined| define boolean| LEAD_FLOWS_RAN boolean| COMMON_SETUP_RAN object| __adroll_consent_data function| onYouTubeIframeAPIReady object| runtime function| addResizeListener function| removeResizeListener function| Cookies object| OMAPI_Helper function| EvEmitter function| imagesLoaded function| jQueryBridget function| getSize function| matchesSelector object| fizzyUIUtils function| Outlayer function| Isotope function| Masonry object| webpackChunkelementor_pro object| webpackChunkelementor object| elementorModules object| regeneratorRuntime function| setImmediate function| clearImmediate function| sprintf function| vsprintf object| ElementorProFrontendConfig object| elementorProFrontend function| Waypoint object| uael_particles_script object| elementorFrontendConfig object| elementorFrontend object| scope_array number| backend function| Sticky object| omapi_localized object| omapi_data object| __adroll_consent boolean| __adroll_consent_is_gdpr string| __adroll_consent_user_country string| __adroll_consent_adv_country object| _paq function| sanitizeKey boolean| _hstc_loaded function| st_go function| linktracker_init object| wpcom boolean| hubspot_live_messages_running object| HubSpotConversations object| WebFont object| $jscomp string| BANNER_VERSION string| TCF_VERSION string| IABWRITE_NO_COOKIE object| __adroll_consent_banner object| __adroll_consent_prev_lastchild object| ompoopcsalbacovn7gzkxg boolean| _hspb_loaded boolean| _hspb_ran object| _omns object| _linkedin_data_partner_ids function| ShareLink function| lintrk boolean| _already_called_lintrk boolean| _hstc_ran string| __hsUserToken number| expireDateTime boolean| LEAD_FLOW_DOCUMENT_READY_RAN

24 Cookies

Domain/Path Name / Value
blog.cyble.com/ Name: _omappvp
Value: D7clwMe5nkFZGZF73L9MzKtovtGk7Eo9raNP1Zu4QCk9UHpOvXTr2WoRz4Qh0T01Zz9ystDWVEcFy5visgFJTZV0aQRNNy5Y
blog.cyble.com/ Name: _omappvs
Value: 1687747520597
.cyble.com/ Name: _gid
Value: GA1.2.1210105281.1687747521
.cyble.com/ Name: _gat_gtag_UA_201575643_1
Value: 1
.cyble.com/ Name: _ga_4FJGSRPM4S
Value: GS1.1.1687747520.1.0.1687747520.0.0.0
.cyble.com/ Name: _ga
Value: GA1.1.1980017434.1687747521
.cyble.com/ Name: _ga_N9ZXY95EM4
Value: GS1.1.1687747520.1.0.1687747520.0.0.0
blog.cyble.com/ Name: omSeen-poopcsalbacovn7gzkxg
Value: 1687747521340
blog.cyble.com/ Name: ln_or
Value: eyI0MDUzMzk2IjoiZCJ9
.linkedin.com/ Name: li_sugr
Value: 4179ea0b-4a78-41dc-997e-576d9e2347f3
.linkedin.com/ Name: bcookie
Value: "v=2&080f9de7-2f06-49c2-8920-9e962ca6ee65"
.linkedin.com/ Name: lidc
Value: "b=TGST02:s=T:r=T:a=T:p=T:g=3036:u=1:x=1:i=1687747521:t=1687833921:v=2:sig=AQHYmfXNsWRP3WHZqshIfGZZfkicLIIk"
.hubspot.com/ Name: __cf_bm
Value: FI_aPfYfsS3ULDdVSOHWKd.q29OTAy8iire3zV9eVaQ-1687747521-0-AfO49LjntO8NEMnPnkXddMRWvjLHx0yOs/aWCneWsZdDtQoiqPL7s0OKsDoHy8F4cE5zVCcQP/cMTmsJuwz4BIw=
.linkedin.com/ Name: UserMatchHistory
Value: AQL6opZnTIy_QwAAAYj1l2y2XkuAPMg7L9qyHGig5O1F3L6A7fy3Zlw_o7dRKzj7f8n_1BoDHqe13Q
.linkedin.com/ Name: AnalyticsSyncHistory
Value: AQI4SXbmaYUmiwAAAYj1l2y2HeibkB6ZkkC1aZ_i2r0WMDgAZLZfu7rQcci4ipVQY2UgojPwuWfJAfDskHp-Ag
.www.linkedin.com/ Name: bscookie
Value: "v=1&20230626024521b9d35a83-590b-4f57-82eb-e233cf427f99AQF-Ah7t5DGtVPk94jBUU639QkRRw9hH"
.linkedin.com/ Name: li_gc
Value: MTswOzE2ODc3NDc1MjE7MjswMjEsJCbMdJ8wZ/2ak6NgmX4+ca5hB7IX6pFgXgLXO9WNKQ==
.blog.cyble.com/ Name: messagesUtk
Value: e2cfb1058d12465db637db36642344d8
.labs.cyble.com/ Name: __cf_bm
Value: cRSbJBF8ZlZS5EzXkPzdpZVhlWMzNoglYXp_KEpH90A-1687747522-0-Abl0Fzf6oCWfYHt8lAVDd821P0Gy8I9yTsB4gPe4FjBFATr4nKDsolhFhT/1HcE6/NTy9QgQlpnw4v85JQIaGh0=
.labs.cyble.com/ Name: __cfruid
Value: 95c978e4a9ec961846464f03a389b7b036de51d1-1687747522
.cyble.com/ Name: __hstc
Value: 27441379.e66f1917660748b3289b81f0f7d14042.1687747522401.1687747522401.1687747522401.1
.cyble.com/ Name: hubspotutk
Value: e66f1917660748b3289b81f0f7d14042
.cyble.com/ Name: __hssrc
Value: 1
.cyble.com/ Name: __hssc
Value: 27441379.1.1687747522401

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.omappapi.com
api.hubapi.com
api.hubspot.com
api.omappapi.com
app.hubspot.com
blog.cyble.com
cdn.linkedin.oribi.io
d.adroll.com
fonts-api.wp.com
fonts.googleapis.com
fonts.gstatic.com
fonts.wp.com
forms-na1.hsforms.com
forms.hsforms.com
forms.hubspot.com
i0.wp.com
injection.amibreached.com
js.hs-analytics.net
js.hs-banner.com
js.hs-scripts.com
js.hsadspixel.net
js.hsforms.net
js.hsleadflows.net
js.usemessages.com
labs.cyble.com
pixel.wp.com
px.ads.linkedin.com
px4.ads.linkedin.com
region1.google-analytics.com
s.adroll.com
s0.wp.com
snap.licdn.com
static.hsappstatic.net
stats.g.doubleclick.net
stats.wp.com
track.hubspot.com
www.google-analytics.com
www.googletagmanager.com
www.linkedin.com
13.107.42.14
18.66.112.59
192.0.76.3
192.0.77.2
192.0.77.32
192.0.78.183
2001:4860:4802:32::36
2400:52e0:1e00::1079:1
2600:9000:20eb:1400:2:53b2:240:93a1
2600:9000:225e:4000:6:9280:1080:93a1
2606:2c40::c73c:671e
2606:4700:20::ac43:4768
2606:4700::6810:75be
2606:4700::6810:88ce
2606:4700::6810:bc41
2606:4700::6811:64ac
2606:4700::6811:806e
2606:4700::6811:cacc
2606:4700::6811:d4f3
2606:4700::6812:18c4
2606:4700::6812:863b
2606:4700::6812:8d65
2606:4700::6813:9b53
2620:1ec:21::14
2a00:1450:4001:808::200a
2a00:1450:4001:80e::2003
2a00:1450:4001:811::200e
2a00:1450:4001:82b::2008
2a00:1450:400c:c07::9c
2a02:26f0:3100::1735:28a8
2a05:d018:cc3:fe04:b9b8:be87:4a18:7b67
079ceaa0981ce7f89ad67f2b125a26b02d93a4b400b0d01c1095d9d03b24c738
08756c47213d461baa3b01f42448a76d11f524470c7a34f9018733889bd4f49c
098699c15c3576e659f00afae845cd0fe1345dcc39a2022c4efb2a49274bb53f
09cc0c8661bd4873fb75a6e96539b6bfad7a9fcb0d6a79b6a974b11195d6e25d
138154c0deed3326477b9b4909175101070a5a3a95342291b53d8cc9879a5f47
148da439eaba8dfe837cff98be204135245cac5f9a4b10d8315a7f234ec6bba4
186cb05caa2a06748336b3123d7ac53986a650cffcab18f34e5c0ee3c057f591
192811b11cab8b2d4254be60c82edeb3054b8c0a5aa7092b5a934adbd9e3320f
1b198e6b8c03a2fcbd389a74e71642eb5fe5339510f8d7df65bb2e6fa29f4398
1c374983633d349ae8e4986739a5c434ea79bf2db929aa0967df26e1380ed1ba
2034f2579b59ec7735c3affb3a4c969baea7beb28bfca3b3113876825d91577e
2168dee40954466214d7f5e39e460be903013674f81070d5fb0ad01213a8486a
264b5704353c6b1b2eff2e9599db601876730ffff07a5949b3b3f8be0b9c7b84
29d409fee0f34ebc05fa36076c101b77e28dccbcfdbfbf4cf248371820ca9ddb
2c8d8489d8fd8a050c57648cef913573c447f112000d4b3c7bbf468ad0fef500
30914e620ba424e4691b6f57c37f29e90c723e2360f0c6aec0757e456a923eb1
326ea53804b6c42e5807ece38f879b7566bdbb1bd90b9cecaf4bb98e15eacc94
34bbd1c367ffc7d80fcff86c7e5f8777e70f4911bb324e8ecfc7dd3604a96e68
35628b00dd095172f48c7fe4b3f6f48b9751a1a95f9f80552fc1770c93a28627
36d655313c51c3540e79a4ed3bff5be86110779b4e25043a6e78150a58cdbc66
37012edb80dd5ca2ea633b3300c6b0f19ae755096da9b37921ee8bebeca25954
382e9768b5578d5ad05e51e37670a3cf93d4593a49bcbee1f5e8b66d0d8c1c53
40ca23f50bb22c719c27794b5ae6dbca57f4b9848884b8c148fedcdbf71cdd22
435f00991111c79b8bc036b8ed00742762f60e8a3f93728ba8a5f75beafec266
43c072c16c9ee6d67acdfa6c6d6685ff1e74eb4237b7cc3c1348ab1c108b26af
43cd95e62bc0c1b1d69ca1cd990e165063bc64005b3ee18aa947404de928441d
441e23601fe7525a142857c98cbb2784997579d51a17f736d7964dceee609709
484098c79514881a954847db923f12bf7def109e0217a3138ae8c8d91382f23b
4e793eac7a4a757ace95a8f403c37da763bd80eed0ba73ef0a8c3a352d70d98a
4f79a89d16a5f717110fe080c0bf90b7e05ff95a4c4983f64d33110bf5f9c230
50e16cd4e9ca2e3fa07a17999a03ea7d64aaf98e589d8f31bf8d058b392006c2
51dc1ea3b9642d966bbdf2c63346e4d2d3f668a693fa8e7f1e31bf6acbe48860
539ac047374f668cd186c3ed1e1f3ad667c5ffddd4874446980d1cafaf77b655
55894c686411d97d939e11179054c54ae7464038ef9a1af9971c0cd0c071950d
5da2efab999313e6a7c003876130edaa14f37fa6704788c707ba0687a829f054
5f2eaa8243f3b2f1c29a99a509e2e4bcc65c19bd288edcdbcf4f7b2f14cc5e10
638a50177eaf1ef79fb307a539d9b8637f7ecb2d07179ff4eed7dc585176e27c
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
7320d4130d5a8c6f40ae6e0b9949191c19b024d7320a3845548b682efa20a479
77177392c65784a0f09522cea8103cdb6d533b0cf0dd392af1a8480a171cbce7
77cf16e1867991ea4ed7fb6d470e613528693de636fb0f1352936cc480e180ae
79b28e6fba6a051ef7b20a681f487457994aa7caeb124be32237914a1b7a6dd4
7a3a19faa84ab238ac542e09efa9a6e3575b46805b9a43343b3cb445e08b1ecc
7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89
7c7818c25a18e8a38553fcbcbc2ad0b5e964103a7d2e494f82815e3f70bf3fc5
7debfd89879c9e370f42e60a66b1309b795503568cbafb364ce2287ebd019055
7fdc96633d58d8fb43e65670278eabbb439df3ef259027bdadb6918c3ea41b25
7ff7d3790060dcf14289ea0e50e7df1f00893e53e882ff3101e078b2f948589f
801cc197035c539bb4a679fc5e7196cf27c47fbd83626e83164eec8209bd13ef
838fc802c5679d425ab384a1064e73e2214ab6d56a694709ea20565423c46745
887e3ec760dc258b4964410db699386d4930f35d4acf8cd765b6d906f04cba53
906bb156f70a4fd952c4c8f7072d070bf8c2db3417da8f73b25c1f37de5f6427
90b705145ef82e9d8493aae55c9bfb3200ec0620c8946b20b0b28366557d6a4a
918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537
95ab28dd9cbacf9d30b20a000b9ff8ba46329d26b4ccb8731dcddb61f5fc1975
9810aee7e6d57d8cceaa96322b88e6df46710194689ae12b284149148cabc2f3
9a57804b3c404eae08417b0a50f161fea515dd8ec7ba75042bda0d7373f2453b
9af44543fbf7b09c3d68e46dcb21d2cb9ec5f18bbd537cea92360a85c5db793e
9c8b8880afd7d6d3530ce5bc9fd79e177a9e9cf8f943d9466b9ea4b77da4999c
9d904f71a4d973dac278821490969eb0a63dd97635584930bbbbec0a3e608d75
a1020a8c9c2ec5c451dfc31ff1564dee690d603c4cb68049328581adc77ca7c2
a2c197367cb631f88fca96c13ec0c06d0a99bc5398d0349716bc06ce7a91e8ce
a323774304195e5b85ee7e0006282e22cbb7980ab6509d27d8add0928e55d8ab
a827ba0a43cbeb52e1f7c01fac1d8526f1a927ef58d5a0bc4ea4047a8b47f075
ab8517f3d5171dd42a8b9c22af6a2f944b41d00e7ea54ba02b4ed71a6c59e543
ac26533e2901023194baed8e192053457bd8131eb098b5c77890c0bbaf3dc7a3
add5990fd8f0c489398ae393e3a1fc1b4a2791139f56835f72628b1b15a20ee3
ae5bfbf6629277d9993e143b04fd081fdc22ac1790dbc4edf51165c3d9b52f0f
aefc1c0ff2296fe06d13165c9103127f201b846d75efb1fbf400fe522e0886d5
af710d1f0d2c94a8370cc573a9255f6794500fa0da9839ce8c069f4eaa7f96b0
afacce23cb4feaaaef37997f8439819d8f827df4951f3ff02704c9f16fb7f53a
b77ec44e91ca88fa577e8e1c7b8a158431872c0b9d7b100f0dedde01cc4cd764
b9ca6b16cf168fe60d400a27a3650bcab24f38c88eee70d710e52e81abbbd455
bbdb1d21246d1c1a65aca8b41818f593b2d4704a459983866c0d331151b91887
bcaf0e3f087296133e0a996ee3d289a8d1a690147c93e0ab62019b505e6f9355
c1e93246e1f3ea9a11fa1a6d7c14e48a1da911f92043e2e6ef59da5ffd38f070
c447dd7677b419db7b21dbdfc6277c7816a913ffda76fd2e52702df538de0e49
c77d2ba289d0e2827ad7f79b00972a63c7f4426d89b8ce6b5da90a368760cfe4
c7d0240fd43289ab1411c5fa1277574ee436d3a3bbb82d34c4d82f32d04517b8
ca1a20243591c8c18ef88cd36d77ac2fab4e30b213368be1c7b6dca1021e2a9d
cd924076cd6bdad7693c484ab0a812a3e8eb905cf751b36b9533dc97380eb277
ce261eb163fcaee6953cedc35059732a133766ab824dc512bbdf9424d48601e4
cf81ac8c30e3309074d0ed5b617c69c93033794ba854d533c349bc5f5e1b11da
cfdaa671aea1f1a3d6c4a195159a1b8e39f9bb5cc478bfdbf173507f15abfb7f
d0b4256abed72481585662971262eabee345c19f837af00d7ce24239d3b40eef
d265615b79f98fdfff370ea32da7b4b02317fc6017b898cfb9c657a65618ac07
d2e60979787dc4523c4ab9251c1317ed9caa08482dbf7b59a79d833ede3f0e66
d743ad07240fdc75d2e2a357b4ff44b334f6d4c53683e31e824aaf61d3bad0c9
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4da753882087cbbeb8b4c6e3a9f388a2ee34c97e904fa72e7b68f98c25499d5
e75a4cc582c5731d85eaa2ba9cb2c98af90df08502958147bfb9268d119ef555
e8adc21c3d8f34e90565c2842e94dae3d22f0ffa500def488b22a9de31017439
ef1874f11501aa7118cdfa7af21a9ef1c87301e917881dc941831b122d82b34a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef39ee441c4e7792c5cda9a8bd86ddce96d9b17bda0cc9f7187f1a70ce9b3ed5
ef896b86a77ae191af41c2714906decbab4bbb7fd32321c14f4f398eb7f264ba
f04e47c7ca5959486a2117466ea32c44bbba6b6534caa27b7232134190a2af31
f17dd1b0bc62f3f4e1f5cda9addca2969770bb4b81d84b3b026c4904e7b96d87
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
f56ccb2db87aacedd9415232e40f80bff9939703df2f9c3f9ec8a092e545349f
f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52
f7f54c64cbe8e1c50bf7e5d79509a8e98213738228ada4fb4dca88bebae7d788
f844015a45cc070e5d5b3fca2abfa8ae208738bc5d9bdf49988ea9032e94a373
f9d498e1b9cff1af27250e8d52ebf9eaf672ff517d586e0d381e7bf348bc6ea1
fb042fd5b6d37629abcbb8734569435d6719471a28d128b47f755930b9c0b434