blog.sucuri.net Open in urlscan Pro
2a02:fe80:1010::5 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html
Submission: On January 23 via manual (January 23rd 2023, 8:47:31 pm UTC) from US — Scanned from DE

Summary HTTP 72 Redirects Links 58 Behaviour Indicators

Summary

This website contacted 29 IPs in 5 countries across 26 domains to perform 72 HTTP transactions. The main IP is 2a02:fe80:1010::5, located in United States and belongs to SUCURI-SEC, US. The main domain is blog.sucuri.net.
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on September 5th 2022. Valid for: a year.

This is the only time blog.sucuri.net was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
31	2a02:fe80:101... 2a02:fe80:1010::5	30148 (SUCURI-SEC) (SUCURI-SEC)
1	2a00:1450:400... 2a00:1450:4001:80b::200a	15169 (GOOGLE) (GOOGLE)
4	2001:4860:480... 2001:4860:4802:32::178	15169 (GOOGLE) (GOOGLE)
1	35.186.249.72 35.186.249.72	15169 (GOOGLE) (GOOGLE)
2	104.111.216.242 104.111.216.242	16625 (AKAMAI-AS) (AKAMAI-AS)
2	2a00:1450:400... 2a00:1450:4001:813::2003	15169 (GOOGLE) (GOOGLE)
1	2600:1901:0:b... 2600:1901:0:bc29::	15169 (GOOGLE) (GOOGLE)
1	192.229.233.34 192.229.233.34	15133 (EDGECAST) (EDGECAST)
2	2a00:1450:402... 2a00:1450:4025:401::9d	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:400d:804::2008	15169 (GOOGLE) (GOOGLE)
1	2a02:26f0:350... 2a02:26f0:3500:16::215:149b	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2606:4700::68... 2606:4700::6811:d3cc	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	199.232.16.157 199.232.16.157	54113 (FASTLY) (FASTLY)
3	2a03:2880:f02... 2a03:2880:f02d:12:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1 1	2a00:1450:400... 2a00:1450:4001:830::2002	15169 (GOOGLE) (GOOGLE)
1 3	2a00:1450:400... 2a00:1450:4001:80e::2004	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:801::2003	15169 (GOOGLE) (GOOGLE)
1	35.186.240.205 35.186.240.205	15169 (GOOGLE) (GOOGLE)
1	2606:4700:440... 2606:4700:4400::6812:21ab	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:46b0	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2600:9000:212... 2600:9000:2127:ee00:2:53b2:240:93a1	16509 (AMAZON-02) (AMAZON-02)
3 3	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	104.244.42.5 104.244.42.5	13414 (TWITTER) (TWITTER)
1	104.244.42.195 104.244.42.195	13414 (TWITTER) (TWITTER)
1		() ()
1	2001:4860:480... 2001:4860:4802:34::36	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f12... 2a03:2880:f12d:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	34.95.127.121 34.95.127.121	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	2606:4700::68... 2606:4700::6813:9b53	13335 (CLOUDFLAR...) (CLOUDFLARENET)
72	29

31 2a02:fe80:1010::5 (United States)

ASN30148 (SUCURI-SEC, US)

blog.sucuri.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80b::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2001:4860:4802:32::178 (United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.186.249.72 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 72.249.186.35.bc.googleusercontent.com

d.impactradius-event.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.111.216.242 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-216-242.deploy.static.akamaitechnologies.com

tags.tiqcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:813::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1901:0:bc29:: (Kansas City, United States)

ASN15169 (GOOGLE, US)

cdn.mxpnl.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.229.233.34 (United States)

ASN15133 (EDGECAST, US)

static.olark.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4025:401::9d (Den Helder, Netherlands)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400d:804::2008 (Ireland)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:3500:16::215:149b (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6811:d3cc (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-scripts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
js-na1.hs-scripts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 199.232.16.157 (Vienna, Austria)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a03:2880:f02d:12:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:830::2002 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:80e::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:801::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.186.240.205 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 205.240.186.35.bc.googleusercontent.com

sucuri.7eer.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::6812:21ab (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-banner.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:46b0 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-analytics.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2127:ee00:2:53b2:240:93a1 (United States)

ASN16509 (AMAZON-02, US)

cdn.linkedin.oribi.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:21::14 (United States) 3 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.5 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.195 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 (None, )

ASN- ()

blog.sucuri.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:34::36 (United States)

ASN15169 (GOOGLE, US)

region1.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f12d:83:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.95.127.121 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 121.127.95.34.bc.googleusercontent.com

www.ojrq.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6813:9b53 (United States)

ASN13335 (CLOUDFLARENET, US)

track.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
32	sucuri.net blog.sucuri.net	708 KB
5	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 22 region1.google-analytics.com — Cisco Umbrella Rank: 2439	67 KB
4	linkedin.com 3 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 373 www.linkedin.com — Cisco Umbrella Rank: 592 px4.ads.linkedin.com — Cisco Umbrella Rank: 6336	3 KB
3	google.de www.google.de — Cisco Umbrella Rank: 5983	762 B
3	google.com 1 redirects www.google.com — Cisco Umbrella Rank: 2	824 B
3	facebook.net connect.facebook.net — Cisco Umbrella Rank: 153	157 KB
3	doubleclick.net 1 redirects stats.g.doubleclick.net — Cisco Umbrella Rank: 75 googleads.g.doubleclick.net — Cisco Umbrella Rank: 33	1 KB
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 114	234 B
2	hs-scripts.com js.hs-scripts.com — Cisco Umbrella Rank: 2025 js-na1.hs-scripts.com — Cisco Umbrella Rank: 7664	1 KB
2	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 41	120 KB
2	gstatic.com fonts.gstatic.com	62 KB
2	tiqcdn.com tags.tiqcdn.com — Cisco Umbrella Rank: 969	34 KB
1	hubspot.com track.hubspot.com — Cisco Umbrella Rank: 2120	898 B
1	ojrq.net www.ojrq.net — Cisco Umbrella Rank: 5340	448 B
1	twitter.com analytics.twitter.com — Cisco Umbrella Rank: 618	394 B
1	t.co t.co — Cisco Umbrella Rank: 542	378 B
1	oribi.io cdn.linkedin.oribi.io — Cisco Umbrella Rank: 820	376 B
1	hs-analytics.net js.hs-analytics.net — Cisco Umbrella Rank: 1973	20 KB
1	hs-banner.com js.hs-banner.com — Cisco Umbrella Rank: 1985	16 KB
1	7eer.net sucuri.7eer.net	663 B
1	ads-twitter.com static.ads-twitter.com — Cisco Umbrella Rank: 621	15 KB
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 675	5 KB
1	olark.com static.olark.com — Cisco Umbrella Rank: 12384	3 KB
1	mxpnl.com cdn.mxpnl.com — Cisco Umbrella Rank: 2831	18 KB
1	impactradius-event.com d.impactradius-event.com — Cisco Umbrella Rank: 3019	13 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 35	1 KB
72	26

	Domain	Requested by
32	blog.sucuri.net	blog.sucuri.net static.olark.com
4	www.google-analytics.com	blog.sucuri.net www.google-analytics.com
3	www.google.de	blog.sucuri.net
3	www.google.com	1 redirects blog.sucuri.net
3	connect.facebook.net	tags.tiqcdn.com connect.facebook.net
2	www.facebook.com	blog.sucuri.net
2	px.ads.linkedin.com	2 redirects
2	www.googletagmanager.com	tags.tiqcdn.com www.googletagmanager.com
2	stats.g.doubleclick.net	www.google-analytics.com
2	fonts.gstatic.com	fonts.googleapis.com
2	tags.tiqcdn.com	blog.sucuri.net tags.tiqcdn.com
1	track.hubspot.com
1	js-na1.hs-scripts.com	js.hs-analytics.net
1	www.ojrq.net
1	region1.google-analytics.com	www.googletagmanager.com
1	analytics.twitter.com	blog.sucuri.net
1	t.co	blog.sucuri.net
1	px4.ads.linkedin.com	blog.sucuri.net
1	www.linkedin.com	1 redirects
1	cdn.linkedin.oribi.io	snap.licdn.com
1	js.hs-analytics.net	js.hs-scripts.com
1	js.hs-banner.com	js.hs-scripts.com
1	sucuri.7eer.net	d.impactradius-event.com
1	googleads.g.doubleclick.net	1 redirects
1	static.ads-twitter.com	tags.tiqcdn.com
1	js.hs-scripts.com	tags.tiqcdn.com
1	snap.licdn.com	tags.tiqcdn.com
1	static.olark.com	blog.sucuri.net
1	cdn.mxpnl.com	tags.tiqcdn.com
1	d.impactradius-event.com	blog.sucuri.net
1	fonts.googleapis.com	blog.sucuri.net
72	31

This site contains links to these domains. Also see Links.

Domain
sucuri.net
sitecheck.sucuri.net
dashboard.sucuri.net
www.facebook.com
twitter.com
www.malwarebytes.com
sl.wordpress.org
www.linkedin.com
www.youtube.com
www.instagram.com
info.sucuri.net
sucuri.hs-sites.com
kb.sucuri.net
labs.sucuri.net

Subject Issuer	Validity	Valid
*.sucuri.net Go Daddy Secure Certificate Authority - G2	`2022-09-05` - `2023-10-07`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2023-01-02` - `2023-03-27`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-01-02` - `2023-03-27`	3 months	crt.sh
*.impactradius-event.com Sectigo RSA Domain Validation Secure Server CA	`2022-12-07` - `2024-01-06`	a year	crt.sh
*.tiqcdn.com DigiCert TLS RSA SHA256 2020 CA1	`2023-01-12` - `2024-01-14`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2023-01-02` - `2023-03-27`	3 months	crt.sh
*.mxpnl.com GeoTrust Global TLS RSA4096 SHA256 2022 CA1	`2022-07-11` - `2023-07-28`	a year	crt.sh
static.olark.com DigiCert TLS RSA SHA256 2020 CA1	`2022-05-16` - `2023-05-16`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-01-02` - `2023-03-27`	3 months	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2022-03-01` - `2023-03-01`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-06-03` - `2023-06-02`	a year	crt.sh
ads-twitter.com DigiCert TLS RSA SHA256 2020 CA1	`2022-07-22` - `2023-08-22`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2022-11-02` - `2023-01-31`	3 months	crt.sh
*.7eer.net Sectigo RSA Domain Validation Secure Server CA	`2022-12-09` - `2024-01-07`	a year	crt.sh
www.google.com GTS CA 1C3	`2023-01-02` - `2023-03-27`	3 months	crt.sh
www.google.de GTS CA 1C3	`2023-01-02` - `2023-03-27`	3 months	crt.sh
linkedin.oribi.io Amazon	`2022-07-07` - `2023-08-06`	a year	crt.sh
t.co DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-03-07` - `2023-03-06`	a year	crt.sh
*.twitter.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-03-07` - `2023-03-06`	a year	crt.sh
*.ojrq.net Sectigo RSA Domain Validation Secure Server CA	`2022-12-09` - `2024-01-07`	a year	crt.sh
hubspot.com Cloudflare Inc ECC CA-3	`2022-03-08` - `2023-03-07`	a year	crt.sh

This page contains 4 frames:

Primary Page: https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html
Frame ID: 06E5EB348B3C1A9F53699F833AB2BAF9
Requests: 71 HTTP requests in this frame

Frame: https://static.olark.com/jsclient/loader0.js
Frame ID: 25F0701AF015AC04C387E1834B39D23B
Requests: 1 HTTP requests in this frame

Frame: blob://https://blog.sucuri.net/4c657a3d-b45d-4e7b-9546-a1eb55d4c7dc
Frame ID: D052CBD3377CC017A78F4C1CFAAD3A39
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 9E023C0077774929CD03C0765E5664F0
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

New Malware Variants Serve Bogus CloudFlare DDoS Captcha

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

HubSpot Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

js\.hs-analytics\.net/analytics

Impact (Affiliate programs) Expand

Overall confidence: 100%
Detected patterns

d\.impactradius-event\.com

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Select2 (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

select2(?:\.min|\.full)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

72
Requests

97 %
HTTPS

67 %
IPv6

26
Domains

31
Subdomains

29
IPs

5
Countries

1270 kB
Transfer

2620 kB
Size

32
Cookies

58 Outgoing links

These are links going to different origins than the main page.

URL: https://sucuri.net/website-antivirus/signup
Title: Products

Search URL Search Domain Scan URL

URL: https://sucuri.net/website-security-platform/signup/
Title: Website Security Platform

Search URL Search Domain Scan URL

URL: https://sucuri.net/website-firewall/
Title: Website Firewall (WAF)

Search URL Search Domain Scan URL

URL: https://sucuri.net/custom/enterprise/
Title: Enterprise Website Security

Search URL Search Domain Scan URL

URL: https://sucuri.net/custom/agency/
Title: Multisite Solutions

Search URL Search Domain Scan URL

URL: https://sucuri.net/website-security-platform/
Title: Features

Search URL Search Domain Scan URL

URL: https://sucuri.net/malware-detection-scanning/
Title: Detection

Search URL Search Domain Scan URL

URL: https://sucuri.net/website-hack-protection/
Title: Protection

Search URL Search Domain Scan URL

URL: https://sucuri.net/website-performance/
Title: Performance

Search URL Search Domain Scan URL

URL: https://sucuri.net/website-malware-removal/
Title: Response

Search URL Search Domain Scan URL

URL: https://sucuri.net/website-backups/
Title: Backups

Search URL Search Domain Scan URL

URL: https://sucuri.net/partners/
Title: Partners

Search URL Search Domain Scan URL

URL: https://sucuri.net/referral/
Title: Referral Program

Search URL Search Domain Scan URL

URL: https://sucuri.net/ecommerce-website-security/
Title: Ecommerce

Search URL Search Domain Scan URL

URL: https://sucuri.net/guides/
Title: Resources

Search URL Search Domain Scan URL

URL: https://sucuri.net/webinars/
Title: Webinars

Search URL Search Domain Scan URL

URL: https://sucuri.net/infographics/
Title: Infographics

Search URL Search Domain Scan URL

URL: https://sitecheck.sucuri.net/
Title: SiteCheck

Search URL Search Domain Scan URL

URL: https://sucuri.net/reports/
Title: Reports

Search URL Search Domain Scan URL

URL: https://sucuri.net/email-courses/
Title: Email Courses

Search URL Search Domain Scan URL

URL: https://sucuri.net/website-security-platform/help-now
Title: Immediate Help

Search URL Search Domain Scan URL

URL: https://dashboard.sucuri.net/login/
Title: Login

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer.php?u=https%3A%2F%2Fblog.sucuri.net%2F2022%2F09%2Fnew-malware-variants-serve-bogus-cloudflare-ddos-captcha.html
Title: Facebook

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?text=New%20Malware%20Variants%20Serve%20Bogus%20CloudFlare%20DDoS%20Captcha&url=https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html&via=sucurisecurity
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/blog/threats/remote-access-trojan-rat
Title: Remote Access Trojan

Search URL Search Domain Scan URL

URL: https://twitter.com/malwareinfosec
Title: Jerome Segura

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/blog/news/2022/06/raccoon-stealer-returns-with-a-new-bag-of-tricks
Title: Racoon Stealer

Search URL Search Domain Scan URL

URL: https://sl.wordpress.org/plugins/sucuri-scanner/
Title: file integrity monitoring tool

Search URL Search Domain Scan URL

URL: https://twitter.com/_jamsec/
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.facebook.com/SucuriSecurity
Title: Facebook

Search URL Search Domain Scan URL

URL: https://twitter.com/sucurisecurity
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/sucuri-security
Title: LinkedIn

Search URL Search Domain Scan URL

URL: https://www.youtube.com/c/sucurinet
Title: YouTube

Search URL Search Domain Scan URL

URL: https://www.instagram.com/sucurisecurity/
Title: Instagram

Search URL Search Domain Scan URL

URL: https://info.sucuri.net/wordpress-security-course?utm_source=Blog&utm_medium=WidgetLogic&utm_campaign=Email-Course&utm_term=EN&utm_content=WordPress-Security

Search URL Search Domain Scan URL

URL: https://sucuri.net/webinars/anatomy-of-website-malware?utm_source=Blog&utm_medium=WidgetLogic&utm_campaign=Webinar&utm_term=EN&utm_content=Anatomy-of-Malware

Search URL Search Domain Scan URL

URL: https://sucuri.net/guides/wordpress-security?utm_source=Blog&utm_medium=WidgetLogic&utm_campaign=Guide&utm_term=EN&utm_content=WP-Security

Search URL Search Domain Scan URL

URL: http://sucuri.hs-sites.com/subscribe-to-security?__hstc=166519265.27d11138e6af492a97e633273639c236.1674506846203.1674506846203.1674506846203.1&__hssc=166519265.1.1674506846203&__hsfp=3997732991

Search URL Search Domain Scan URL

URL: https://sucuri.net/website-antivirus/
Title: Website AntiVirus

Search URL Search Domain Scan URL

URL: https://sucuri.net/wordpress-security/
Title: WordPress Security

Search URL Search Domain Scan URL

URL: https://sucuri.net/website-firewall/ddos-protection
Title: DDos Protection

Search URL Search Domain Scan URL

URL: https://sucuri.net/website-antivirus/malware-scanning-and-detection
Title: Malware Detection

Search URL Search Domain Scan URL

URL: https://sucuri.net/website-antivirus/malware-removal
Title: Malware Removal

Search URL Search Domain Scan URL

URL: https://sucuri.net/website-firewall/stop-website-attacks-and-hacks
Title: Malware Prevention

Search URL Search Domain Scan URL

URL: https://sucuri.net/website-antivirus/blacklist-removal-and-repair
Title: Blacklist Removal

Search URL Search Domain Scan URL

URL: https://kb.sucuri.net/
Title: Knowledge Base

Search URL Search Domain Scan URL

URL: http://labs.sucuri.net/
Title: Research Labs

Search URL Search Domain Scan URL

URL: https://sucuri.net/faq/
Title: FAQ

Search URL Search Domain Scan URL

URL: https://sucuri.net/company/
Title: About

Search URL Search Domain Scan URL

URL: https://sucuri.net/company/media
Title: Media

Search URL Search Domain Scan URL

URL: https://sucuri.net/company/events
Title: Events

Search URL Search Domain Scan URL

URL: https://sucuri.net/company/employment/
Title: Employment

Search URL Search Domain Scan URL

URL: https://sucuri.net/company/contact-us
Title: Contact

Search URL Search Domain Scan URL

URL: https://sucuri.net/customers/
Title: Testimonials

Search URL Search Domain Scan URL

URL: https://sucuri.net/
Title: Sucuri Home

Search URL Search Domain Scan URL

URL: https://sucuri.net/terms
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://sucuri.net/privacy
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://sucuri.net/cookies
Title: See our policy>>

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 47

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1040458670/?value=1.00&currency_code=USD&label=ZMfLCJ7ZoGgQrseQ8AM&guid=ON&script=0 HTTP 302
https://www.google.com/pagead/1p-user-list/1040458670/?value=1.00&currency_code=USD&label=ZMfLCJ7ZoGgQrseQ8AM&guid=ON&script=0&is_vtc=1&random=1559020560 HTTP 302
https://www.google.de/pagead/1p-user-list/1040458670/?value=1.00&currency_code=USD&label=ZMfLCJ7ZoGgQrseQ8AM&guid=ON&script=0&is_vtc=1&random=1559020560&ipr=y

Request Chain 54

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=179713&time=1674506845040&url=https%3A%2F%2Fblog.sucuri.net%2F2022%2F09%2Fnew-malware-variants-serve-bogus-cloudflare-ddos-captcha.html HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D179713%26time%3D1674506845040%26url%3Dhttps%253A%252F%252Fblog.sucuri.net%252F2022%252F09%252Fnew-malware-variants-serve-bogus-cloudflare-ddos-captcha.html%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=179713&time=1674506845040&url=https%3A%2F%2Fblog.sucuri.net%2F2022%2F09%2Fnew-malware-variants-serve-bogus-cloudflare-ddos-captcha.html&liSync=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=179713&time=1674506845040&url=https%3A%2F%2Fblog.sucuri.net%2F2022%2F09%2Fnew-malware-variants-serve-bogus-cloudflare-ddos-captcha.html&liSync=true&e_ipv6=AQJBrMfMdcwEfgAAAYXgYr49rIwjeTOoDiRLCYaN34JEgweZ2r2Kd5WpJ2WbvslUdPQxK5w

72 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html Show response
blog.sucuri.net/2022/09/ 90 KB
24 KB 129ms
40ms Document
text/html 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

267d496913828ee31abcafa87bd2e256894813516b95642c124afca9a7ddb29c

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: max-age=750
content-encoding: gzip
content-security-policy: upgrade-insecure-requests;
content-type: text/html; charset=UTF-8
date: Mon, 23 Jan 2023 20:47:24 GMT
link: <https://blog.sucuri.net/wp-json/>; rel="https://api.w.org/" <https://blog.sucuri.net/wp-json/wp/v2/posts/29780>; rel="alternate"; type="application/json" <https://blog.sucuri.net/?p=29780>; rel=shortlink
server: nginx
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-gateway-cache-key: 1668728459.439|standard|https|blog.sucuri.net|||/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html
x-gateway-cache-status: HIT
x-gateway-request-id: bfe1cb2cdcf9acdf23180371c33c2aac
x-gateway-skip-cache: 0
x-sucuri-cache: HIT
x-sucuri-id: 15005
x-xss-protection: 1; mode=block

GET
H2 200 style.css
blog.sucuri.net/wp-content/themes/sucuriblog0117/ 72 KB
29 KB 42ms
39ms Stylesheet
text/css 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.sucuri.net/wp-content/themes/sucuriblog0117/style.css?ver=1.2.0

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

442ea9791bad77a328e1a07c59784d92e10bac3f612ba9b00afba5c7518acc6b

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 23 Jan 2023 20:47:24 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests;
content-encoding: gzip
x-sucuri-cache: HIT
x-xss-protection: 1; mode=block
x-gateway-cache-status: HIT
x-gateway-request-id: f7a26403938e5f02ca3a7d119e504350
last-modified: Tue, 06 Sep 2022 21:58:33 GMT
server: nginx
etag: W/"6317c289-120da"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
x-gateway-cache-key: 1668728459.439||https|blog.sucuri.net|||/wp-content/themes/sucuriblog0117/style.css?ver=1.2.0
x-gateway-skip-cache: 0
cache-control: max-age=315360000
x-sucuri-id: 15005
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 style.min.css
blog.sucuri.net/wp-includes/css/dist/block-library/ 93 KB
16 KB 73ms
70ms Stylesheet
text/css 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.sucuri.net/wp-includes/css/dist/block-library/style.min.css?ver=6.1.1

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

c324ef26b20264369e4568dc9ef1c5cb1f325f6bc4e8b7c01f7fe93fa353276a

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 23 Jan 2023 20:47:24 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests;
content-encoding: gzip
x-sucuri-cache: HIT
x-xss-protection: 1; mode=block
x-gateway-cache-status: HIT
x-gateway-request-id: 2ed1fa91ef546a70029056ae5cff2713
last-modified: Tue, 15 Nov 2022 21:14:51 GMT
server: nginx
etag: W/"6374014b-172a9"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
x-gateway-cache-key: 1668728459.439||https|blog.sucuri.net|||/wp-includes/css/dist/block-library/style.min.css?ver=6.1.1
x-gateway-skip-cache: 0
cache-control: max-age=315360000
x-sucuri-id: 15005
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 classic-themes.min.css
blog.sucuri.net/wp-includes/css/ 217 B
725 B 81ms
78ms Stylesheet
text/css 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.sucuri.net/wp-includes/css/classic-themes.min.css?ver=1

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

5a5f39391fbf5b06db84b8f9716d53de575ee97a627d2c5f12f79a991a671eb5

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 23 Jan 2023 20:47:24 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests;
content-encoding: gzip
x-sucuri-cache: HIT
x-xss-protection: 1; mode=block
x-gateway-cache-status: HIT
x-gateway-request-id: 0610bae30f32ab40d9be3dce07cb53ef
last-modified: Tue, 15 Nov 2022 21:14:51 GMT
server: nginx
etag: W/"6374014b-d9"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
x-gateway-cache-key: 1668728459.439||https|blog.sucuri.net|||/wp-includes/css/classic-themes.min.css?ver=1
x-gateway-skip-cache: 0
cache-control: max-age=315360000
x-sucuri-id: 15005
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 select2.min.css
blog.sucuri.net/wp-content/plugins/facetwp-select2/select2/ 15 KB
3 KB 81ms
79ms Stylesheet
text/css 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.sucuri.net/wp-content/plugins/facetwp-select2/select2/select2.min.css?ver=4.0.1

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

ed026fedc8b8130aecd7be55e134a42efcaa8e90a5f2f8ec88aa9a1a5ab934ec

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 23 Jan 2023 20:47:24 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests;
content-encoding: gzip
x-sucuri-cache: HIT
x-xss-protection: 1; mode=block
x-gateway-cache-status: HIT
x-gateway-request-id: 5603348d9b0ae729991e0a31dbc79734
last-modified: Tue, 12 Jul 2016 17:48:32 GMT
server: nginx
etag: W/"57852d70-3af2"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
x-gateway-cache-key: 1668728459.439||https|blog.sucuri.net|||/wp-content/plugins/facetwp-select2/select2/select2.min.css?ver=4.0.1
x-gateway-skip-cache: 0
cache-control: max-age=315360000
x-sucuri-id: 15005
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 mashsb.min.css
blog.sucuri.net/wp-content/plugins/mashsharer/assets/css/ 46 KB
29 KB 81ms
79ms Stylesheet
text/css 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.sucuri.net/wp-content/plugins/mashsharer/assets/css/mashsb.min.css?ver=3.8.5

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

0500bd58f47403106f2f10da96d8d196941a02a4046e88611a59494557861f98

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 23 Jan 2023 20:47:24 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests;
content-encoding: gzip
x-sucuri-cache: HIT
x-xss-protection: 1; mode=block
x-gateway-cache-status: HIT
x-gateway-request-id: 682aac6d3cb7a958efea7bd04227da20
last-modified: Fri, 21 Oct 2022 22:08:29 GMT
server: nginx
etag: W/"6353185d-b6e3"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
x-gateway-cache-key: 1668728459.439||https|blog.sucuri.net|||/wp-content/plugins/mashsharer/assets/css/mashsb.min.css?ver=3.8.5
x-gateway-skip-cache: 0
cache-control: max-age=315360000
x-sucuri-id: 15005
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 css
fonts.googleapis.com/ 13 KB
1 KB 141ms
51ms Stylesheet
text/css 2a00:1450:4001:80b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans:300,400,400italic,700,600

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

97d876b0796d55e1a4d9dec67f958fd62674617e5417b92e4584c0397974e9d9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Mon, 23 Jan 2023 20:47:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 23 Jan 2023 20:47:24 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 23 Jan 2023 20:47:24 GMT

GET
H2 200 cookie-banner.css
blog.sucuri.net/wp-content/themes/sucuriblog0117/css/ 10 KB
3 KB 81ms
80ms Stylesheet
text/css 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.sucuri.net/wp-content/themes/sucuriblog0117/css/cookie-banner.css?ver=20200427

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

40ad5344e8c06d85d6cc2cfd95ad9ed597c3a1aaec5e730efb5fcee9d88b5135

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 23 Jan 2023 20:47:24 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests;
content-encoding: gzip
x-sucuri-cache: HIT
x-xss-protection: 1; mode=block
x-gateway-cache-status: HIT
x-gateway-request-id: 34bf637c501d6d98b2ba83c6b4abe132
last-modified: Sat, 06 Aug 2022 22:14:06 GMT
server: nginx
etag: W/"62eee7ae-287c"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
x-gateway-cache-key: 1668728459.439||https|blog.sucuri.net|||/wp-content/themes/sucuriblog0117/css/cookie-banner.css?ver=20200427
x-gateway-skip-cache: 0
cache-control: max-age=315360000
x-sucuri-id: 15005
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 frontend.min.js Show response
blog.sucuri.net/wp-content/plugins/google-analytics-premium/assets/js/ 9 KB
3 KB 82ms
80ms Script
application/javascript 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.sucuri.net/wp-content/plugins/google-analytics-premium/assets/js/frontend.min.js?ver=7.10.0

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

63a6d926d277a3d64d30e349fa0ea2b0630e9801d173e1947ff3bd6060147ef4

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 23 Jan 2023 20:47:24 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests;
content-encoding: gzip
x-sucuri-cache: HIT
x-xss-protection: 1; mode=block
x-gateway-cache-status: HIT
x-gateway-request-id: 2f3c87ac7032eeeb55899107aea256cf
last-modified: Mon, 18 Nov 2019 16:19:47 GMT
server: nginx
etag: W/"5dd2c4a3-2452"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
x-gateway-cache-key: 1668728459.439||https|blog.sucuri.net|||/wp-content/plugins/google-analytics-premium/assets/js/frontend.min.js?ver=7.10.0
x-gateway-skip-cache: 0
cache-control: max-age=315360000
x-sucuri-id: 15005
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 jquery.min.js Show response
blog.sucuri.net/wp-includes/js/jquery/ 88 KB
36 KB 82ms
81ms Script
application/javascript 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.sucuri.net/wp-includes/js/jquery/jquery.min.js?ver=3.6.1

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

cc7403bab52ed166e24ea9324241045af370be482f5b594468f4a6ac6e7e7981

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 23 Jan 2023 20:47:24 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests;
content-encoding: gzip
x-sucuri-cache: HIT
x-xss-protection: 1; mode=block
x-gateway-cache-status: HIT
x-gateway-request-id: ad7e4f4f22c757fce06e7a9f4ad04467
last-modified: Tue, 15 Nov 2022 21:14:51 GMT
server: nginx
etag: W/"6374014b-15e54"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
x-gateway-cache-key: 1668728459.439||https|blog.sucuri.net|||/wp-includes/js/jquery/jquery.min.js?ver=3.6.1
x-gateway-skip-cache: 0
cache-control: max-age=315360000
x-sucuri-id: 15005
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 jquery-migrate.min.js Show response
blog.sucuri.net/wp-includes/js/jquery/ 11 KB
5 KB 82ms
81ms Script
application/javascript 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.sucuri.net/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 23 Jan 2023 20:47:24 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests;
content-encoding: gzip
x-sucuri-cache: HIT
x-xss-protection: 1; mode=block
x-gateway-cache-status: HIT
x-gateway-request-id: 6141f42c6029358251e93f12b44e5fa1
last-modified: Tue, 15 Nov 2022 21:14:51 GMT
server: nginx
etag: W/"6374014b-2bd8"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
x-gateway-cache-key: 1668728459.439||https|blog.sucuri.net|||/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2
x-gateway-skip-cache: 0
cache-control: max-age=315360000
x-sucuri-id: 15005
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 select2.min.js Show response
blog.sucuri.net/wp-content/plugins/facetwp-select2/select2/ 63 KB
22 KB 111ms
110ms Script
application/javascript 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.sucuri.net/wp-content/plugins/facetwp-select2/select2/select2.min.js?ver=4.0.1

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

ff6377c5173c4ee30318481c90cb7cc19987f2f5304871236266df11b0f48696

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 23 Jan 2023 20:47:24 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests;
content-encoding: gzip
x-sucuri-cache: HIT
x-xss-protection: 1; mode=block
x-gateway-cache-status: HIT
x-gateway-request-id: 12094076778156983d2e997651738752
last-modified: Tue, 12 Jul 2016 17:48:32 GMT
server: nginx
etag: W/"57852d70-fd75"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
x-gateway-cache-key: 1668728459.439||https|blog.sucuri.net|||/wp-content/plugins/facetwp-select2/select2/select2.min.js?ver=4.0.1
x-gateway-skip-cache: 0
cache-control: max-age=315360000
x-sucuri-id: 15005
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 mashsb.min.js Show response
blog.sucuri.net/wp-content/plugins/mashsharer/assets/js/ 4 KB
2 KB 111ms
110ms Script
application/javascript 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.sucuri.net/wp-content/plugins/mashsharer/assets/js/mashsb.min.js?ver=3.8.5

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

876f181150664af9e30a4c1da6f8f95eb462aebeb8781db732ff6bc48a1f6632

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 23 Jan 2023 20:47:24 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests;
content-encoding: gzip
x-sucuri-cache: HIT
x-xss-protection: 1; mode=block
x-gateway-cache-status: HIT
x-gateway-request-id: 72ab40edd12721571c4ac199d672859f
last-modified: Fri, 21 Oct 2022 22:08:29 GMT
server: nginx
etag: W/"6353185d-114d"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
x-gateway-cache-key: 1668728459.439||https|blog.sucuri.net|||/wp-content/plugins/mashsharer/assets/js/mashsb.min.js?ver=3.8.5
x-gateway-skip-cache: 0
cache-control: max-age=315360000
x-sucuri-id: 15005
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 134ms
39ms Script
text/javascript 2001:4860:4802:32::178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4860:4802:32::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 23 Jan 2023 20:26:10 GMT
last-modified: Tue, 10 Jan 2023 21:29:14 GMT
server: Golfe2
age: 1274
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20085
expires: Mon, 23 Jan 2023 22:26:10 GMT

GET
H2 200 17-EN-sucuri-blog-newsletter-banner.png
blog.sucuri.net/wp-content/uploads/2017/09/ 3 KB
3 KB 44ms
42ms Image
image/png 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.sucuri.net/wp-content/uploads/2017/09/17-EN-sucuri-blog-newsletter-banner.png

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

52e26c085124647627c42c2cbce9a619b220a28420761233ea649d320f7c5518

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 23 Jan 2023 20:47:24 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests;
x-sucuri-cache: HIT
content-length: 3010
x-xss-protection: 1; mode=block
x-gateway-cache-status: HIT
x-gateway-request-id: 1a00916b92810851487f62d8b558d995
last-modified: Thu, 10 Oct 2019 13:11:10 GMT
server: nginx
etag: "5d9f2dee-bc2"
x-frame-options: SAMEORIGIN
x-gateway-skip-cache: 0
content-type: image/png
x-gateway-cache-key: 1668728459.439||https|blog.sucuri.net|||/wp-content/uploads/2017/09/17-EN-sucuri-blog-newsletter-banner.png
cache-control: max-age=315360000
x-sucuri-id: 15005
accept-ranges: bytes
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 hoverIntent.min.js Show response
blog.sucuri.net/wp-includes/js/ 1 KB
1 KB 39ms
39ms Script
application/javascript 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.sucuri.net/wp-includes/js/hoverIntent.min.js?ver=1.10.2

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

ed5b5df9ceacfe76857ac51964972b0b417a215b2f50e837fd6b64bad7339c40

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 23 Jan 2023 20:47:24 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests;
content-encoding: gzip
x-sucuri-cache: HIT
x-xss-protection: 1; mode=block
x-gateway-cache-status: HIT
x-gateway-request-id: f7c89107ba47adaa9684783b09d45357
last-modified: Tue, 15 Nov 2022 21:14:51 GMT
server: nginx
etag: W/"6374014b-5db"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
x-gateway-cache-key: 1668728459.439||https|blog.sucuri.net|||/wp-includes/js/hoverIntent.min.js?ver=1.10.2
x-gateway-skip-cache: 0
cache-control: max-age=315360000
x-sucuri-id: 15005
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 superfish.min.js Show response
blog.sucuri.net/wp-content/themes/genesis/lib/js/menu/ 5 KB
2 KB 39ms
39ms Script
application/javascript 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.sucuri.net/wp-content/themes/genesis/lib/js/menu/superfish.min.js?ver=1.7.5

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

68f2b0a3381830c544349d5df116c2b96ba1d8efa46cf0c15e3a130d91bf6ab4

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 23 Jan 2023 20:47:24 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests;
content-encoding: gzip
x-sucuri-cache: HIT
x-xss-protection: 1; mode=block
x-gateway-cache-status: HIT
x-gateway-request-id: a4a5e217925d35f9686f1708e7a05f4b
last-modified: Tue, 27 Nov 2018 17:57:24 GMT
server: nginx
etag: W/"5bfd8584-13ae"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
x-gateway-cache-key: 1668728459.439||https|blog.sucuri.net|||/wp-content/themes/genesis/lib/js/menu/superfish.min.js?ver=1.7.5
x-gateway-skip-cache: 0
cache-control: max-age=315360000
x-sucuri-id: 15005
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 superfish.args.min.js Show response
blog.sucuri.net/wp-content/themes/genesis/lib/js/menu/ 132 B
697 B 41ms
38ms Script
application/javascript 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.sucuri.net/wp-content/themes/genesis/lib/js/menu/superfish.args.min.js?ver=2.7.1

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

20550f7bcb2a817ac9a5879e04260da8268e971c0b8031a6b7a2f48a55ee60d5

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 23 Jan 2023 20:47:24 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests;
content-encoding: gzip
x-sucuri-cache: HIT
x-xss-protection: 1; mode=block
x-gateway-cache-status: HIT
x-gateway-request-id: 5c4c32fa448fe02f2381aebe83b44f41
last-modified: Tue, 27 Nov 2018 17:57:24 GMT
server: nginx
etag: W/"5bfd8584-84"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
x-gateway-cache-key: 1668728459.439||https|blog.sucuri.net|||/wp-content/themes/genesis/lib/js/menu/superfish.args.min.js?ver=2.7.1
x-gateway-skip-cache: 0
cache-control: max-age=315360000
x-sucuri-id: 15005
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 skip-links.min.js Show response
blog.sucuri.net/wp-content/themes/genesis/lib/js/ 344 B
794 B 42ms
38ms Script
application/javascript 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.sucuri.net/wp-content/themes/genesis/lib/js/skip-links.min.js?ver=2.7.1

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

0556982c2b3cf8fc78bc3d5d3c1e98b7861a0a8150ef7ecf2f3c7a733e4e0cf8

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 23 Jan 2023 20:47:24 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests;
content-encoding: gzip
x-sucuri-cache: HIT
x-xss-protection: 1; mode=block
x-gateway-cache-status: HIT
x-gateway-request-id: b1398153e8d076c68cee35ffc48d2e58
last-modified: Tue, 27 Nov 2018 17:57:24 GMT
server: nginx
etag: W/"5bfd8584-158"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
x-gateway-cache-key: 1668728459.439||https|blog.sucuri.net|||/wp-content/themes/genesis/lib/js/skip-links.min.js?ver=2.7.1
x-gateway-skip-cache: 0
cache-control: max-age=315360000
x-sucuri-id: 15005
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 theme.js Show response
blog.sucuri.net/wp-content/themes/sucuriblog0117/js/ 3 KB
1 KB 42ms
39ms Script
application/javascript 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.sucuri.net/wp-content/themes/sucuriblog0117/js/theme.js?ver=1.1.0

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

6ae8162fefa27a4c1b69440f19e997af99d94d2e3fef9265e0c44c4caf7cbbda

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 23 Jan 2023 20:47:24 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests;
content-encoding: gzip
x-sucuri-cache: HIT
x-xss-protection: 1; mode=block
x-gateway-cache-status: HIT
x-gateway-request-id: e8874dc04f8473605338b93f8b97c600
last-modified: Wed, 14 Mar 2018 21:46:59 GMT
server: nginx
etag: W/"5aa99853-a37"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
x-gateway-cache-key: 1668728459.439||https|blog.sucuri.net|||/wp-content/themes/sucuriblog0117/js/theme.js?ver=1.1.0
x-gateway-skip-cache: 0
cache-control: max-age=315360000
x-sucuri-id: 15005
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 sticky.js Show response
blog.sucuri.net/wp-content/themes/sucuriblog0117/js/ 9 KB
3 KB 43ms
40ms Script
application/javascript 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.sucuri.net/wp-content/themes/sucuriblog0117/js/sticky.js?ver=1.0.4

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

cc07dc22acd75d21ea2a03ced344d13aeeea586029288b1d7004739f8ce3c7be

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 23 Jan 2023 20:47:24 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests;
content-encoding: gzip
x-sucuri-cache: HIT
x-xss-protection: 1; mode=block
x-gateway-cache-status: HIT
x-gateway-request-id: 99c235a3d28f1e7a34cad61a9bd59ec1
last-modified: Fri, 27 Jan 2017 03:26:08 GMT
server: nginx
etag: W/"588abdd0-2502"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
x-gateway-cache-key: 1668728459.439||https|blog.sucuri.net|||/wp-content/themes/sucuriblog0117/js/sticky.js?ver=1.0.4
x-gateway-skip-cache: 0
cache-control: max-age=315360000
x-sucuri-id: 15005
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 sticky-init.js Show response
blog.sucuri.net/wp-content/themes/sucuriblog0117/js/ 2 KB
1 KB 43ms
40ms Script
application/javascript 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.sucuri.net/wp-content/themes/sucuriblog0117/js/sticky-init.js?ver=1.0.1

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

36d47eadbca93ee9613695d80ee179247a0b6bd78b503a549778dbcbe46b0815

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 23 Jan 2023 20:47:24 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests;
content-encoding: gzip
x-sucuri-cache: HIT
x-xss-protection: 1; mode=block
x-gateway-cache-status: HIT
x-gateway-request-id: 245672d6285e90633a87ceab20c10114
last-modified: Fri, 27 Jan 2017 03:26:08 GMT
server: nginx
etag: W/"588abdd0-667"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
x-gateway-cache-key: 1668728459.439||https|blog.sucuri.net|||/wp-content/themes/sucuriblog0117/js/sticky-init.js?ver=1.0.1
x-gateway-skip-cache: 0
cache-control: max-age=315360000
x-sucuri-id: 15005
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 cookie-banner.js Show response
blog.sucuri.net/wp-content/themes/sucuriblog0117/js/ 4 KB
2 KB 44ms
41ms Script
application/javascript 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.sucuri.net/wp-content/themes/sucuriblog0117/js/cookie-banner.js?ver=20200914

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

5aafcc6bf2a5538e40efb22b67dee2fb1f1809b846853b69df489d70cac45a36

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 23 Jan 2023 20:47:24 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests;
content-encoding: gzip
x-sucuri-cache: HIT
x-xss-protection: 1; mode=block
x-gateway-cache-status: HIT
x-gateway-request-id: a79ae9dc3d42bdab7b75ab3a08634d39
last-modified: Mon, 14 Sep 2020 11:23:40 GMT
server: nginx
etag: W/"5f5f52bc-e5b"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
x-gateway-cache-key: 1668728459.439||https|blog.sucuri.net|||/wp-content/themes/sucuriblog0117/js/cookie-banner.js?ver=20200914
x-gateway-skip-cache: 0
cache-control: max-age=315360000
x-sucuri-id: 15005
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 A166802-5dda-4f98-aad8-1f58dbc8f1771.js Show response
d.impactradius-event.com/ 40 KB
13 KB 230ms
139ms Script
text/javascript 35.186.249.72
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://d.impactradius-event.com/A166802-5dda-4f98-aad8-1f58dbc8f1771.js
Requested by: Host: blog.sucuri.net
URL: https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.249.72 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 72.249.186.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 8235aa051c240d36805f28bb37173c4e2a40cf4b347e1d99d96db420caba3aa0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 23 Jan 2023 20:47:24 GMT
content-encoding: gzip
age: 0
x-guploader-uploadid: ADPycdsGn8GwzXadXZLjaRTNZWK8uXGOKRZpMRrwc6M4lKI1P3aR33JjnI_gT4X54XF34qMmjJKAMK9z2jCwx1avX3F2Yw
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12966
last-modified: Tue, 18 Feb 2020 03:14:51 GMT
server: UploadServer
etag: "7b386031dce97320ca627c68daf254c5"
vary: Accept-Encoding
x-goog-hash: crc32c=zxauHA==, md5=ezhgMdzpcyDKYnxo2vJUxQ==
x-goog-generation: 1581995691826115
access-control-allow-origin: *
content-type: text/javascript; charset=utf-8
cache-control: public,max-age=900,s-maxage=300
x-goog-stored-content-length: 12966
accept-ranges: bytes
expires: Mon, 23 Jan 2023 20:52:24 GMT

GET
H2 200 utag.js Show response
tags.tiqcdn.com/utag/gpl/sucuri/prod/ 139 KB
33 KB 158ms
54ms Script
application/x-javascript 104.111.216.242
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/gpl/sucuri/prod/utag.js
Requested by: Host: blog.sucuri.net
URL: https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.216.242 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-216-242.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 37b06f759d7ecb525d037f9caf9f5abef8fb0917d9c9e795909136e7cb5e3785

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 23 Jan 2023 20:47:24 GMT
content-encoding: gzip
last-modified: Thu, 12 Jan 2023 21:29:29 GMT
server: AkamaiNetStorage
etag: "17aa055090387e6a36012e1d58d8dd93:1673558969.926058"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=300
accept-ranges: bytes
content-length: 33894
expires: Mon, 23 Jan 2023 20:52:24 GMT

GET
H2 200 logo.png
blog.sucuri.net/wp-content/themes/sucuriblog0117/images/ 5 KB
6 KB 42ms
41ms Image
image/png 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.sucuri.net/wp-content/themes/sucuriblog0117/images/logo.png

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/wp-content/themes/sucuriblog0117/style.css?ver=1.2.0

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

ec0f53f11e000f28f7dc3a590f746a21c233b2ccbf695cebbf8601b2b912d14d

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/wp-content/themes/sucuriblog0117/style.css?ver=1.2.0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 23 Jan 2023 20:47:24 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests;
x-sucuri-cache: HIT
content-length: 5361
x-xss-protection: 1; mode=block
x-gateway-cache-status: HIT
x-gateway-request-id: 1b7636f767b1bd9dd8fbc8947cffa49c
last-modified: Sat, 06 Aug 2022 22:27:02 GMT
server: nginx
etag: "62eeeab6-14f1"
x-frame-options: SAMEORIGIN
x-gateway-skip-cache: 0
content-type: image/png
x-gateway-cache-key: 1668728459.439||https|blog.sucuri.net|||/wp-content/themes/sucuriblog0117/images/logo.png
cache-control: max-age=315360000
x-sucuri-id: 15005
accept-ranges: bytes
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v34/ 44 KB
44 KB 131ms
40ms Font
font/woff2 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v34/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,400,400italic,700,600

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8778e9af2422858d7052ff9a0f3c12c08ae976bdd6e0316db144cd5579cd97db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://blog.sucuri.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Tue, 17 Jan 2023 22:49:22 GMT
x-content-type-options: nosniff
age: 511082
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44856
x-xss-protection: 0
last-modified: Mon, 15 Aug 2022 18:20:18 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 17 Jan 2024 22:49:22 GMT

GET
H2 200 footer-logo.png
blog.sucuri.net/wp-content/themes/sucuriblog0117/images/ 5 KB
6 KB 39ms
39ms Image
image/png 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.sucuri.net/wp-content/themes/sucuriblog0117/images/footer-logo.png

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/wp-content/themes/sucuriblog0117/style.css?ver=1.2.0

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

618e2688a71e0742e9a4d0de4d85e59351a5748ffce32f5518cd7a5d292a6d1b

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/wp-content/themes/sucuriblog0117/style.css?ver=1.2.0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 23 Jan 2023 20:47:24 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests;
x-sucuri-cache: HIT
content-length: 5139
x-xss-protection: 1; mode=block
x-gateway-cache-status: HIT
x-gateway-request-id: c22c858bd44868d2eb89b63da1c47c81
last-modified: Sat, 06 Aug 2022 22:38:51 GMT
server: nginx
etag: "62eeed7b-1413"
x-frame-options: SAMEORIGIN
x-gateway-skip-cache: 0
content-type: image/png
x-gateway-cache-key: 1668728459.439||https|blog.sucuri.net|||/wp-content/themes/sucuriblog0117/images/footer-logo.png
cache-control: max-age=315360000
x-sucuri-id: 15005
accept-ranges: bytes
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
DATA 200
OK truncated
/ 11 KB
11 KB Font
application/octet-stream

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 745caffca4b97cf5cf2374d82c6dfb6fb7c7b694e85432f92ec4dcb35f4418c9

Request headers

Referer
Origin: https://blog.sucuri.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Content-Type: application/octet-stream

GET
DATA 200
OK truncated
/ 14 KB
14 KB Font
application/x-font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1cfd32e37f8aba263101f06e8f702adfaef55a6601857cf5e2c6dd0b0388dcd6

Request headers

Referer
Origin: https://blog.sucuri.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Content-Type: application/x-font-woff;charset=utf-8

GET
H2 200 BlogPost_Feature-Image_1490x700_Attackers-Continue-their-Campaign-of-Bogus-DDoS-Pages-745x350.jpg
blog.sucuri.net/wp-content/uploads/2022/09/ 47 KB
48 KB 41ms
39ms Image
image/jpeg 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.sucuri.net/wp-content/uploads/2022/09/BlogPost_Feature-Image_1490x700_Attackers-Continue-their-Campaign-of-Bogus-DDoS-Pages-745x350.jpg

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

45b61924c73d0670bc49dd85013c8fdda740224e71c7a97a2952492aeb6a7f38

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 23 Jan 2023 20:47:24 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests;
x-sucuri-cache: HIT
content-length: 48619
x-xss-protection: 1; mode=block
x-gateway-cache-status: HIT
x-gateway-request-id: ebe9c459f8e742f18098f9de0766a493
last-modified: Tue, 27 Sep 2022 16:15:03 GMT
server: nginx
etag: "63332187-bdeb"
x-frame-options: SAMEORIGIN
x-gateway-skip-cache: 0
content-type: image/jpeg
x-gateway-cache-key: 1668728459.439||https|blog.sucuri.net|||/wp-content/uploads/2022/09/BlogPost_Feature-Image_1490x700_Attackers-Continue-their-Campaign-of-Bogus-DDoS-Pages-745x350.jpg
cache-control: max-age=315360000
x-sucuri-id: 15005
accept-ranges: bytes
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 fake-cloudflare-captcha-notification-650x338.png
blog.sucuri.net/wp-content/uploads/2022/09/ 95 KB
96 KB 43ms
41ms Image
image/png 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.sucuri.net/wp-content/uploads/2022/09/fake-cloudflare-captcha-notification-650x338.png

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

59cc1461e4c31efd86e96e170a1e90c93b3fbc44998482b5571b236c7260a181

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 23 Jan 2023 20:47:24 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests;
x-sucuri-cache: HIT
content-length: 97590
x-xss-protection: 1; mode=block
x-gateway-cache-status: MISS
x-gateway-request-id: a5cf8967eef8a95a08de4d7fe8a6dfaa
last-modified: Tue, 27 Sep 2022 15:09:45 GMT
server: nginx
etag: "63331239-17d36"
x-frame-options: SAMEORIGIN
x-gateway-skip-cache: 0
content-type: image/png
x-gateway-cache-key: 1668728459.439||https|blog.sucuri.net|||/wp-content/uploads/2022/09/fake-cloudflare-captcha-notification-650x338.png
cache-control: max-age=315360000
x-sucuri-id: 15005
accept-ranges: bytes
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 commonly-infected-files-650x431.png
blog.sucuri.net/wp-content/uploads/2022/09/ 126 KB
127 KB 52ms
50ms Image
image/png 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.sucuri.net/wp-content/uploads/2022/09/commonly-infected-files-650x431.png

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

6e16ae6333ac99920de581fb3bf9dedee5c729d8af4dbb45b84df53291d52eb5

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 23 Jan 2023 20:47:24 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests;
x-sucuri-cache: HIT
content-length: 129312
x-xss-protection: 1; mode=block
x-gateway-cache-status: HIT
x-gateway-request-id: 01ed005b530a5ff9f18b67d40833385f
last-modified: Tue, 27 Sep 2022 15:21:14 GMT
server: nginx
etag: "633314ea-1f920"
x-frame-options: SAMEORIGIN
x-gateway-skip-cache: 0
content-type: image/png
x-gateway-cache-key: 1668728459.439||https|blog.sucuri.net|||/wp-content/uploads/2022/09/commonly-infected-files-650x431.png
cache-control: max-age=315360000
x-sucuri-id: 15005
accept-ranges: bytes
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 fake-cloudflare-cpatcha-screen1-650x407.png
blog.sucuri.net/wp-content/uploads/2022/09/ 94 KB
94 KB 529ms
528ms Image
image/png 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.sucuri.net/wp-content/uploads/2022/09/fake-cloudflare-cpatcha-screen1-650x407.png

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

24240537f69fdda4848d2aa1430b84db23d4979c65931a1755a24c2bb8315f8d

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 23 Jan 2023 20:47:25 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests;
x-sucuri-cache: MISS
content-length: 95828
x-xss-protection: 1; mode=block
x-gateway-cache-status: HIT
x-gateway-request-id: 3316f325f6263d0189e04b79c314e4d0
last-modified: Tue, 27 Sep 2022 15:22:11 GMT
server: nginx
etag: "63331523-17654"
x-frame-options: SAMEORIGIN
x-gateway-skip-cache: 0
content-type: image/png
x-gateway-cache-key: 1668728459.439||https|blog.sucuri.net|||/wp-content/uploads/2022/09/fake-cloudflare-cpatcha-screen1-650x407.png
cache-control: max-age=315360000
x-sucuri-id: 15005
accept-ranges: bytes
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 fake-cloudflare-cpatcha-download-650x371.png
blog.sucuri.net/wp-content/uploads/2022/09/ 88 KB
88 KB 528ms
527ms Image
image/png 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.sucuri.net/wp-content/uploads/2022/09/fake-cloudflare-cpatcha-download-650x371.png

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

6851e34add861b54da9ebd0c9ac790221f2e8962175bc5ad763ed7e889fd80e2

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 23 Jan 2023 20:47:25 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests;
x-sucuri-cache: MISS
content-length: 89907
x-xss-protection: 1; mode=block
x-gateway-cache-status: HIT
x-gateway-request-id: 88ce5413b824ea4c200ef3a304623cc1
last-modified: Tue, 27 Sep 2022 15:23:00 GMT
server: nginx
etag: "63331554-15f33"
x-frame-options: SAMEORIGIN
x-gateway-skip-cache: 0
content-type: image/png
x-gateway-cache-key: 1668728459.439||https|blog.sucuri.net|||/wp-content/uploads/2022/09/fake-cloudflare-cpatcha-download-650x371.png
cache-control: max-age=315360000
x-sucuri-id: 15005
accept-ranges: bytes
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 blog-sidebar_widgetlogic_emailCourse_wordpress-security.png
blog.sucuri.net/wp-content/uploads/2019/04/ 12 KB
13 KB 52ms
51ms Image
image/png 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.sucuri.net/wp-content/uploads/2019/04/blog-sidebar_widgetlogic_emailCourse_wordpress-security.png

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

ec374edf9c52c6aae3b672424c611799883a29af5785c94985a6d9e4eb907e93

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 23 Jan 2023 20:47:24 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests;
x-sucuri-cache: HIT
content-length: 12283
x-xss-protection: 1; mode=block
x-gateway-cache-status: HIT
x-gateway-request-id: 99127f9e0e16e103fdc1f6f044fb251b
last-modified: Thu, 10 Oct 2019 13:17:03 GMT
server: nginx
etag: "5d9f2f4f-2ffb"
x-frame-options: SAMEORIGIN
x-gateway-skip-cache: 0
content-type: image/png
x-gateway-cache-key: 1668728459.439||https|blog.sucuri.net|||/wp-content/uploads/2019/04/blog-sidebar_widgetlogic_emailCourse_wordpress-security.png
cache-control: max-age=315360000
x-sucuri-id: 15005
accept-ranges: bytes
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 blog-sidebar_widgetlogic_webinars_anatomy-of-website-malware.png
blog.sucuri.net/wp-content/uploads/2019/05/ 27 KB
28 KB 52ms
52ms Image
image/png 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.sucuri.net/wp-content/uploads/2019/05/blog-sidebar_widgetlogic_webinars_anatomy-of-website-malware.png

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

79f9a0ec2c750edde8d9fa73ee77f59b6df6705fa148544dd00f7f126ce6e6d9

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 23 Jan 2023 20:47:24 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests;
x-sucuri-cache: HIT
content-length: 28078
x-xss-protection: 1; mode=block
x-gateway-cache-status: HIT
x-gateway-request-id: a90397163ff9e04e19c7f3b6647b1f11
last-modified: Thu, 10 Oct 2019 13:18:15 GMT
server: nginx
etag: "5d9f2f97-6dae"
x-frame-options: SAMEORIGIN
x-gateway-skip-cache: 0
content-type: image/png
x-gateway-cache-key: 1668728459.439||https|blog.sucuri.net|||/wp-content/uploads/2019/05/blog-sidebar_widgetlogic_webinars_anatomy-of-website-malware.png
cache-control: max-age=315360000
x-sucuri-id: 15005
accept-ranges: bytes
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 blog-sidebar_widgetlogic_guides_wordpress-security.png
blog.sucuri.net/wp-content/uploads/2019/05/ 13 KB
13 KB 52ms
52ms Image
image/png 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.sucuri.net/wp-content/uploads/2019/05/blog-sidebar_widgetlogic_guides_wordpress-security.png

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

48eb8ebb42357edb3792a468c6daef81e653a9e3ad71954b58de86a0acad238c

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 23 Jan 2023 20:47:24 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests;
x-sucuri-cache: HIT
content-length: 13016
x-xss-protection: 1; mode=block
x-gateway-cache-status: MISS
x-gateway-request-id: 9e45d17e89937b2120e02e3ca7699934
last-modified: Thu, 10 Oct 2019 13:18:21 GMT
server: nginx
etag: "5d9f2f9d-32d8"
x-frame-options: SAMEORIGIN
x-gateway-skip-cache: 0
content-type: image/png
x-gateway-cache-key: 1668728459.439||https|blog.sucuri.net|||/wp-content/uploads/2019/05/blog-sidebar_widgetlogic_guides_wordpress-security.png
cache-control: max-age=315360000
x-sucuri-id: 15005
accept-ranges: bytes
expires: Thu, 31 Dec 2037 23:55:55 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 4 B
209 B 47ms
46ms XHR
text/plain 2001:4860:4802:32::178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j99&a=2023166283&t=pageview&_s=1&dl=https%3A%2F%2Fblog.sucuri.net%2F2022%2F09%2Fnew-malware-variants-serve-bogus-cloudflare-ddos-captcha.html&ul=en-us&de=UTF-8&dt=New%20Malware%20Variants%20Serve%20Bogus%20CloudFlare%20DDoS%20Captcha&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IGBACEABBAAAACAAI~&jid=1192750298&gjid=1138196984&cid=25210339.1674506845&tid=UA-4077922-18&_gid=1556977589.1674506845&_r=1&_slc=1&z=458125854

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4860:4802:32::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.sucuri.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 23 Jan 2023 20:47:24 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://blog.sucuri.net
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 mixpanel-2-latest.min.js Show response
cdn.mxpnl.com/libs/ 50 KB
18 KB 129ms
39ms Script
text/javascript 2600:1901:0:bc29::
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.mxpnl.com/libs/mixpanel-2-latest.min.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/gpl/sucuri/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1901:0:bc29:: Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: UploadServer /
Resource Hash: da7a511c69cdf1e0f950a29019d09854b8919bc154bb95fe5d5ec580ed2f0997

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 23 Jan 2023 20:41:36 GMT
content-encoding: gzip
age: 348
x-guploader-uploadid: ADPycdt3GyM5fQEnGsrHitTPGiXxzgGBIi3bg7wtYXJSk_pJnjBV1IubWgvV-044KqXD1JpTwl3QvIK-B-04Q15Diy4Tvw
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 2
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 17435
last-modified: Thu, 17 Feb 2022 20:21:50 GMT
server: UploadServer
etag: "caa762087e9d75cecc34b5d6626cb7b9"
vary: Accept-Encoding
x-goog-hash: crc32c=PPVzJA==, md5=yqdiCH6ddc7MNLXWYmy3uQ==
x-goog-generation: 1645129310876382
access-control-allow-origin: *
content-type: text/javascript
cache-control: public,max-age=600
x-goog-stored-content-length: 17435
accept-ranges: bytes
expires: Mon, 23 Jan 2023 20:51:36 GMT

GET
H2 200 loader0.js Show response
static.olark.com/jsclient/ Frame 25F0 9 KB
3 KB 195ms
39ms Script
application/javascript 192.229.233.34
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://static.olark.com/jsclient/loader0.js
Requested by: Host: blog.sucuri.net
URL: https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.229.233.34 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (frb/6794) /
Resource Hash: e4d08f877611f0c9211f3099d2bf66a57b97f4c8a03e4bc8f9dcc9299b4d09e7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 23 Jan 2023 20:47:25 GMT
content-encoding: gzip
via: 1.1 google
last-modified: Mon, 05 Dec 2022 22:24:31 GMT
server: ECS (frb/6794)
age: 2116
etag: "638e6f9f-224a"
vary: Accept-Encoding
x-cache: HIT
content-type: application/javascript; charset=utf-8
p3p: CP='Olark does not have a P3P policy. Learn why here: http://olark.com/p3p'
cache-control: max-age=2700
accept-ranges: bytes
content-length: 3152
expires: Mon, 23 Jan 2023 21:32:25 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
442 B 153ms
47ms XHR
text/plain 2a00:1450:4025:401::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j99&tid=UA-4077922-18&cid=25210339.1674506845&jid=1192750298&gjid=1138196984&_gid=1556977589.1674506845&_u=IGBACEAABAAAACAAI~&z=1704477634

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4025:401::9d Den Helder, Netherlands, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.sucuri.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Mon, 23 Jan 2023 20:47:25 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://blog.sucuri.net
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 110 KB
43 KB 223ms
80ms Script
application/javascript 2a00:1450:400d:804::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-4077922-18

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/gpl/sucuri/prod/utag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:804::2008 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

2fb96570e72e91c692d5514fce3528b60f80948e3df2780c986cb252b3263588

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 23 Jan 2023 20:47:25 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44014
x-xss-protection: 0
last-modified: Mon, 23 Jan 2023 20:11:46 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 23 Jan 2023 20:47:25 GMT

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 13 KB
5 KB 146ms
41ms Script
application/x-javascript 2a02:26f0:3500:16::215:149b
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/gpl/sucuri/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:16::215:149b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: f56ccb2db87aacedd9415232e40f80bff9939703df2f9c3f9ec8a092e545349f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 23 Jan 2023 20:47:25 GMT
content-encoding: gzip
last-modified: Tue, 10 Jan 2023 17:22:56 GMT
x-cdn: AKAM
vary: Accept-Encoding
content-type: application/x-javascript;charset=utf-8
cache-control: max-age=80426
accept-ranges: bytes
content-length: 4777

GET
H2 200 498146.js Show response
js.hs-scripts.com/ 853 B
792 B 147ms
55ms Script
application/javascript 2606:4700::6811:d3cc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-scripts.com/498146.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/gpl/sucuri/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:d3cc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: df7eefa2027ce07dcfd7d01e576f9c76412f39fe88f93485bcb60b407fd08889

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 23 Jan 2023 20:47:25 GMT
content-encoding: br
cf-cache-status: HIT
x-hubspot-correlation-id: 8f6f8404-644b-432d-aeb1-d38d12eea7fd
age: 1
cf-polished: origSize=960
cf-bgj: minify
last-modified: Mon, 23 Jan 2023 20:47:24 GMT
server: cloudflare
x-trace: 2BC9FDD626B390840E04401EC76C4CC5860C2587C8000000000000000000
access-control-max-age: 3600
vary: origin, Accept-Encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: https://monitor206.sucuri.net
cache-control: public, max-age=60
access-control-allow-credentials: true
cf-ray: 78e362653d559962-FRA
expires: Mon, 23 Jan 2023 20:48:25 GMT

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 56 KB
15 KB 155ms
47ms Script
application/javascript 199.232.16.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/gpl/sucuri/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.232.16.157 Vienna, Austria, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 23 Jan 2023 20:47:25 GMT
content-encoding: gzip
last-modified: Thu, 27 Oct 2022 16:56:53 GMT
etag: "32ad004436155ec972bc50e6238b5b67+gzip+gzip"
vary: Accept-Encoding,Host
x-cache: HIT, HIT
content-type: application/javascript; charset=utf-8
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
x-tw-cdn: FT
cache-control: no-cache
accept-ranges: bytes
content-length: 15375
x-served-by: cache-iad-kjyo7100081-IAD, cache-vie6330-VIE

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 106 KB
28 KB 132ms
41ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/gpl/sucuri/prod/utag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

ef8f067f829af7c95936a36f38e54c98ab090f937f5557e4c78829ed8fcf5ffd

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Mon, 23 Jan 2023 20:47:24 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 27859
x-fb-rlafr: 0
x-xss-protection: 0
pragma: public
x-fb-debug: UJQoVYIIkWUQ1jSCRWSySnmZHySXb8M2CxPnruUOjej3Le3Vct4FTjQHzqAvqyUSG/m502eGT3LwmLmjY/V9IA==
x-fb-trip-id: 917726464
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
origin-agent-cluster: ?0
cache-control: public, max-age=1200
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 utag.v.js Show response
tags.tiqcdn.com/utag/tiqapp/ 2 B
202 B 40ms
40ms Script
application/x-javascript 104.111.216.242
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/tiqapp/utag.v.js?a=gpl/sucuri/202301122129&cb=1674506844890
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/gpl/sucuri/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.216.242 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-216-242.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 23 Jan 2023 20:47:24 GMT
last-modified: Thu, 14 Apr 2016 16:57:51 GMT
server: AkamaiNetStorage
etag: "7bc0ee636b3b83484fc3b9348863bd22:1460653071"
content-type: application/x-javascript
cache-control: max-age=600
accept-ranges: bytes
content-length: 2
expires: Mon, 23 Jan 2023 20:57:24 GMT

GET
H2

200

/
www.google.de/pagead/1p-user-list/1040458670/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1040458670/?value=1.00&currency_code=USD&label=ZMfLCJ7ZoGgQrseQ8AM&guid=ON&script=0
https://www.google.com/pagead/1p-user-list/1040458670/?value=1.00&currency_code=USD&label=ZMfLCJ7ZoGgQrseQ8AM&guid=ON&script=0&is_vtc=1&random=1559020560
https://www.google.de/pagead/1p-user-list/1040458670/?value=1.00&currency_code=USD&label=ZMfLCJ7ZoGgQrseQ8AM&guid=ON&script=0&is_vtc=1&random=1559020560&ipr=y

42 B
154 B

52ms
52ms

Image
image/gif

2a00:1450:4001:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/1040458670/?value=1.00&currency_code=USD&label=ZMfLCJ7ZoGgQrseQ8AM&guid=ON&script=0&is_vtc=1&random=1559020560&ipr=y

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html

Protocol

Server

2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 Jan 2023 20:47:25 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 23 Jan 2023 20:47:25 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
location: https://www.google.de/pagead/1p-user-list/1040458670/?value=1.00&currency_code=USD&label=ZMfLCJ7ZoGgQrseQ8AM&guid=ON&script=0&is_vtc=1&random=1559020560&ipr=y
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 3713 Show response
sucuri.7eer.net/xur/ 113 B
663 B 139ms
49ms XHR
application/json 35.186.240.205
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://sucuri.7eer.net/xur/3713
Requested by: Host: d.impactradius-event.com
URL: https://d.impactradius-event.com/A166802-5dda-4f98-aad8-1f58dbc8f1771.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.240.205 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 205.240.186.35.bc.googleusercontent.com
Software: /
Resource Hash: 0e73c202f1778ce2b03cbc633e6575bb9ac13f127134620796d85af28e053460

Request headers

Referer: https://blog.sucuri.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

pragma: no-cache
date: Mon, 23 Jan 2023 20:47:25 GMT
via: 1.1 google
p3p: policyref="/w3c/p3p.xml", CP="ALL BUS LEG DSP COR ADM CUR DEV PSA OUR NAV INT"
access-control-allow-origin: https://blog.sucuri.net
content-type: application/json; charset=UTF-8
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 23 Jan 2023 20:47:25 GMT

GET
H2 200 498146.js Show response
js.hs-banner.com/ 61 KB
16 KB 257ms
162ms Script
text/javascript 2606:4700:4400::6812:21ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-banner.com/498146.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/498146.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::6812:21ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2c3754dbf3be2a19c5fbe1e5f9ea8eab4ad76db99447205b59ae1d9caae9d0ae

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 23 Jan 2023 20:47:25 GMT
x-amz-version-id: YJL5EQdeSrlaTD3IfzdQO61roVhquRgl
content-encoding: br
cf-cache-status: REVALIDATED
x-amz-request-id: AF033PP0D1XFRP3C
x-amz-server-side-encryption: AES256
x-amz-id-2: 7MdBUJEDqMUwb+9kRw8VAaEMtlTnP8FVaNfn2F83/TrmXtkoQItIPwWlJLbx8DQWyyPRZ6cNf+8=
last-modified: Tue, 25 Oct 2022 19:55:48 GMT
server: cloudflare
etag: W/"9ae527d7cf18b7690dcb17fee9bb6df1"
access-control-max-age: 604800
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: https://wafx.sucuri.net
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
cache-control: max-age=300, public
access-control-allow-credentials: true
vary: origin, Accept-Encoding
timing-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
cf-ray: 78e362662c4c9b61-FRA
expires: Mon, 23 Jan 2023 20:52:25 GMT

GET
H2 200 498146.js Show response
js.hs-analytics.net/analytics/1674506700000/ 65 KB
20 KB 155ms
62ms Script
text/javascript 2606:4700::6811:46b0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-analytics.net/analytics/1674506700000/498146.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/498146.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:46b0 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0511b683eeee87fe647897ba9922f9ca78438d425ce280e9dcb0cfcf750e9141

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 23 Jan 2023 20:47:25 GMT
x-amz-version-id: null
content-encoding: br
cf-cache-status: HIT
x-amz-request-id: N77KGJVY4FVFKGM8
age: 1
x-amz-server-side-encryption: AES256
x-amz-id-2: vqKA62tzX5gDXMJUNQNAkGcfoZM03Zf2DYAJVx+6NrGc7enXwAq7Ntmb9HxBdpa3s3k4+aNTJyi3TIF2ZnPEYQ==
last-modified: Wed, 18 Jan 2023 19:56:49 GMT
server: cloudflare
etag: W/"8531a0b991fbec060753ee8a0a037df3"
vary: origin, Accept-Encoding
content-type: text/javascript
cache-control: max-age=300, public
access-control-allow-credentials: false
cf-ray: 78e362662f599b8c-FRA
expires: Mon, 23 Jan 2023 20:52:24 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
107 B 153ms
65ms Image
image/gif 2a00:1450:4001:80e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j99&tid=UA-4077922-18&cid=25210339.1674506845&jid=1192750298&_u=IGBACEAABAAAACAAI~&z=504641392

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 Jan 2023 20:47:25 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
501 B 165ms
62ms Image
image/gif 2a00:1450:4001:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j99&tid=UA-4077922-18&cid=25210339.1674506845&jid=1192750298&_u=IGBACEAABAAAACAAI~&z=504641392

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 Jan 2023 20:47:25 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 token Show response
cdn.linkedin.oribi.io/partner/179713/domain/blog.sucuri.net/ 36 B
376 B 164ms
41ms XHR
application/json 2600:9000:2127:ee00:2:53b2:240:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.linkedin.oribi.io/partner/179713/domain/blog.sucuri.net/token
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2127:ee00:2:53b2:240:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89

Request headers

Accept: *
Referer: https://blog.sucuri.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 23 Jan 2023 19:56:35 GMT
content-encoding: gzip
via: 1.1 b5f551be30f63eca57ca04273cb75994.cloudfront.net (CloudFront)
x-amz-cf-pop: PRG50-C1
age: 3050
vary: accept-encoding
x-cache: Hit from cloudfront
content-type: application/json
access-control-allow-origin: *
cache-control: public, max-age=3600
x-amz-cf-id: Xlxop2z7BA6uoWnx2Lla_B104nQvsZiNrtmOQSRGrUZ_UvNET24TNA==

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=179713&time=1674506845040&url=https%3A%2F%2Fblog.sucuri.net%2F2022%2F09%2Fnew-malware-variants-serve-bogus-cloudflare-ddos-captcha.html
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D179713%26time%3D1674506845040%26url%3Dhttps%253A%252F%252Fblog.sucuri.net%252F202...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=179713&time=1674506845040&url=https%3A%2F%2Fblog.sucuri.net%2F2022%2F09%2Fnew-malware-variants-serve-bogus-cloudflare-ddos-captcha.html&liSync=true
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=179713&time=1674506845040&url=https%3A%2F%2Fblog.sucuri.net%2F2022%2F09%2Fnew-malware-variants-serve-bogus-cloudflare-ddos-captcha.html&liSync=tr...

0
266 B

325ms
212ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=179713&time=1674506845040&url=https%3A%2F%2Fblog.sucuri.net%2F2022%2F09%2Fnew-malware-variants-serve-bogus-cloudflare-ddos-captcha.html&liSync=true&e_ipv6=AQJBrMfMdcwEfgAAAYXgYr49rIwjeTOoDiRLCYaN34JEgweZ2r2Kd5WpJ2WbvslUdPQxK5w
Requested by: Host: blog.sucuri.net
URL: https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 23 Jan 2023 20:47:25 GMT
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: B12E8F5600F24A6C99FFF9C0BBA7578D Ref B: DUS30EDGE0822 Ref C: 2023-01-23T20:47:25Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-type: application/javascript
x-li-fabric: prod-lor1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXy9IG7/Y52SjTbgf3/cw==

Redirect headers

date: Mon, 23 Jan 2023 20:47:25 GMT
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: A933E84F16604064BFE249E89AAF9175 Ref B: FRAEDGE1719 Ref C: 2023-01-23T20:47:25Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lor1
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=179713&time=1674506845040&url=https%3A%2F%2Fblog.sucuri.net%2F2022%2F09%2Fnew-malware-variants-serve-bogus-cloudflare-ddos-captcha.html&liSync=true&e_ipv6=AQJBrMfMdcwEfgAAAYXgYr49rIwjeTOoDiRLCYaN34JEgweZ2r2Kd5WpJ2WbvslUdPQxK5w
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXy9IG2+aHSmVaR6fHDxQ==

GET
H2 200 identity.js Show response
connect.facebook.net/signals/plugins/ 64 KB
20 KB 40ms
39ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/plugins/identity.js?v=2.9.94

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

7e86f52cb0d423805ec541a4bccae5156a01fbe36355e6d798a450593212651f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 23 Jan 2023 20:47:25 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 20722
x-fb-rlafr: 0
x-xss-protection: 0
pragma: public
x-fb-debug: LhrInEDf/dzt5OWGm5y1fasl67tBmc4iu90j3O4/zr9b70tacG8pnRyGrjU1my1/+gHGQCISq4twHm13mO32UA==
x-fb-trip-id: 917726464
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 309646199598471 Show response
connect.facebook.net/signals/config/ 377 KB
108 KB 259ms
258ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/309646199598471?v=2.9.94&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

73ba3dd83868376948d3baca5ece77346064546ce94ba9c08745c400b8eb014e

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Mon, 23 Jan 2023 20:47:25 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-fb-rlafr: 0
x-xss-protection: 0
pragma: public
x-fb-debug: 76XUWPGC/AnTgI85L8cpnUDklFc/DGFS1TbSxhePEaaFpRDQEDE5bmepPZzHgBnvaor8SEP3E3CFm5TeTUMwkA==
x-fb-trip-id: 917726464
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
origin-agent-cluster: ?0
cache-control: public, max-age=1200
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 adsct
t.co/i/ 43 B
378 B 234ms
146ms Image
image/gif 104.244.42.5
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?bci=3&eci=2&event_id=ee11e54b-cd74-49f5-8e38-f3b27a224a1f&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=ed234163-bca6-47d2-8a33-2e1e428def5b&tw_document_href=https%3A%2F%2Fblog.sucuri.net%2F2022%2F09%2Fnew-malware-variants-serve-bogus-cloudflare-ddos-captcha.html&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nuyl9&type=javascript&version=2.3.29

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.5 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

x-response-time: 107
date: Mon, 23 Jan 2023 20:47:24 GMT
strict-transport-security: max-age=0
server: tsa_o
content-type: image/gif;charset=utf-8
x-transaction-id: d1c4f4211895b36d
cache-control: no-cache, no-store, max-age=0
perf: 7626143928
x-connection-hash: bf2c7b89b9e586338da6507b01ce5f70f8874f9a2d6311490fa9072c8578d9b5
content-length: 43

GET
H2 200 adsct
analytics.twitter.com/i/ 43 B
394 B 250ms
151ms Image
image/gif 104.244.42.195
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=ee11e54b-cd74-49f5-8e38-f3b27a224a1f&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=ed234163-bca6-47d2-8a33-2e1e428def5b&tw_document_href=https%3A%2F%2Fblog.sucuri.net%2F2022%2F09%2Fnew-malware-variants-serve-bogus-cloudflare-ddos-captcha.html&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nuyl9&type=javascript&version=2.3.29

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.195 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

x-response-time: 112
date: Mon, 23 Jan 2023 20:47:24 GMT
strict-transport-security: max-age=631138519
server: tsa_o
content-type: image/gif;charset=utf-8
x-transaction-id: aa28950389da63e5
cache-control: no-cache, no-store, max-age=0
perf: 7626143928
x-connection-hash: 155d306b7bf9ad18fe55c5eec5edbb2dcfe5eaebde245e910587f1288d5bcf2e
content-length: 43

GET
BLOB 200
OK 4c657a3d-b45d-4e7b-9546-a1eb55d4c7dc Show response
https://blog.sucuri.net/ Frame D052 147 B
0 Document
text/html

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://blog.sucuri.net/4c657a3d-b45d-4e7b-9546-a1eb55d4c7dc
Requested by: Host: static.olark.com
URL: https://static.olark.com/jsclient/loader0.js
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ef75b33904d93af24fa40e39bfc332becf6145911fb0715a252445b5e2bcb79e

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Content-Length: 147
Content-Type: text/html

GET
H3 200 js Show response
www.google-analytics.com/gtm/ 121 KB
46 KB 54ms
54ms Script
application/javascript 2001:4860:4802:32::178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/gtm/js?id=GTM-TMKM2TQ&t=gtag_UA_4077922_18&cid=25210339.1674506845

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2001:4860:4802:32::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e4f82acd85fb004f3e33a88ad66c7f525476af9c63b7a30071c15f3141ebacef

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 23 Jan 2023 20:47:25 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 47363
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 23 Jan 2023 20:47:25 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 217 KB
76 KB 91ms
91ms Script
application/javascript 2a00:1450:400d:804::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-L206HXJP92&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-4077922-18

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:804::2008 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

268b666ea21ad355c580c329c1969616da07ff449bf21fd22e2661d5c5e53aff

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 23 Jan 2023 20:47:25 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 77816
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 23 Jan 2023 20:47:25 GMT

POST
H3 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 47ms
46ms XHR
text/plain 2001:4860:4802:32::178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j99&a=2023166283&t=pageview&_s=1&dl=https%3A%2F%2Fblog.sucuri.net%2F2022%2F09%2Fnew-malware-variants-serve-bogus-cloudflare-ddos-captcha.html&ul=en-us&de=UTF-8&dt=New%20Malware%20Variants%20Serve%20Bogus%20CloudFlare%20DDoS%20Captcha&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=6GDACUADRAAAACgCI~&jid=334721260&gjid=1727849046&cid=25210339.1674506845&tid=UA-4077922-18&_gid=1556977589.1674506845&_r=1&gtm=2ou1i0&npa=1&z=2093290231

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2001:4860:4802:32::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.sucuri.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 23 Jan 2023 20:47:25 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://blog.sucuri.net
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
70 B 46ms
46ms XHR
text/plain 2a00:1450:4025:401::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j99&tid=UA-4077922-18&cid=25210339.1674506845&jid=334721260&gjid=1727849046&_gid=1556977589.1674506845&npa=1&_u=6GDACUADRAAAACgCI~&z=329926861

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4025:401::9d Den Helder, Netherlands, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.sucuri.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Mon, 23 Jan 2023 20:47:25 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://blog.sucuri.net
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
region1.google-analytics.com/g/ 0
338 B 139ms
48ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-L206HXJP92&gtm=2oe1i0&_p=2023166283&gdid=dYmQxMT&cid=25210339.1674506845&ul=en-us&sr=1600x1200&_s=1&sid=1674506845&sct=1&seg=0&dl=https%3A%2F%2Fblog.sucuri.net%2F2022%2F09%2Fnew-malware-variants-serve-bogus-cloudflare-ddos-captcha.html&dt=New%20Malware%20Variants%20Serve%20Bogus%20CloudFlare%20DDoS%20Captcha&en=page_view&_fv=1&_ss=1&_ee=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-L206HXJP92&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 Jan 2023 20:47:25 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://blog.sucuri.net
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 0
185 B 130ms
41ms Image
text/plain 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=309646199598471&ev=PageView&dl=https%3A%2F%2Fblog.sucuri.net%2F2022%2F09%2Fnew-malware-variants-serve-bogus-cloudflare-ddos-captcha.html&rl=&if=false&ts=1674506845395&sw=1600&sh=1200&v=2.9.94&r=stable&a=tmtealium&ec=0&o=30&fbp=fb.1.1674506845394.251083386&it=1674506845055&coo=false&eid=4f02f2bf9e332d0a3b2b20596ed239e7&tm=1&rqm=GET

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Mon, 23 Jan 2023 20:47:25 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
107 B 67ms
66ms Image
image/gif 2a00:1450:4001:80e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j99&tid=UA-4077922-18&cid=25210339.1674506845&jid=334721260&npa=1&_u=6GDACUADRAAAACgCI~&z=53081837

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 Jan 2023 20:47:25 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
107 B 65ms
65ms Image
image/gif 2a00:1450:4001:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j99&tid=UA-4077922-18&cid=25210339.1674506845&jid=334721260&npa=1&_u=6GDACUADRAAAACgCI~&z=53081837

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 Jan 2023 20:47:25 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 / Show response
www.facebook.com/tr/ Frame 9E02 0
49 B 40ms
40ms Document
text/plain 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare-ddos-captcha.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Content-Type: application/x-www-form-urlencoded
Origin: https://blog.sucuri.net
Referer: https://blog.sucuri.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin: https://blog.sucuri.net
alt-svc: h3=":443"; ma=86400
content-length: 0
content-type: text/plain
cross-origin-resource-policy: cross-origin
date: Mon, 23 Jan 2023 20:47:25 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains

GET
H2 200 memQYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWq8tWZ0Pw86hd0Rk8ZkWVAewA.woff2
fonts.gstatic.com/s/opensans/v34/ 17 KB
18 KB 40ms
39ms Font
font/woff2 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v34/memQYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWq8tWZ0Pw86hd0Rk8ZkWVAewA.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,400,400italic,700,600

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9ad0a22b0c58240a7a92b4c01aa31f39a5918dea6a8fdfa77e63042abc4fca31

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://blog.sucuri.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 23 Jan 2023 19:14:32 GMT
x-content-type-options: nosniff
age: 5574
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17820
x-xss-protection: 0
last-modified: Mon, 15 Aug 2022 18:13:12 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 23 Jan 2024 19:14:32 GMT

GET
H2 200 /
www.ojrq.net/p/ 50 B
448 B 143ms
47ms Image
image/gif 34.95.127.121
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.ojrq.net/p/?return=&cid=3713&tpsync=no
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.95.127.121 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 121.127.95.34.bc.googleusercontent.com
Software: /
Resource Hash: ec34cd386427fe6deacf99f4fdbeea4b1d1ed25f505411650d7ceaa843a7fc63

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 Jan 2023 20:47:26 GMT
via: 1.1 google
content-type: image/gif
p3p: policyref="/w3c/p3p.xml", CP="ALL BUS LEG DSP COR ADM CUR DEV PSA OUR NAV INT"
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 50
expires: Mon, 23 Jan 2023 20:47:26 GMT

GET
H2 200 498146.js Show response
js-na1.hs-scripts.com/ 853 B
564 B 67ms
57ms Script
application/javascript 2606:4700::6811:d3cc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js-na1.hs-scripts.com/498146.js
Requested by: Host: js.hs-analytics.net
URL: https://js.hs-analytics.net/analytics/1674506700000/498146.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:d3cc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: df7eefa2027ce07dcfd7d01e576f9c76412f39fe88f93485bcb60b407fd08889

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 23 Jan 2023 20:47:26 GMT
content-encoding: br
cf-cache-status: HIT
x-hubspot-correlation-id: f2a0e7be-9f59-47eb-b0c3-aee45fd14131
age: 1
cf-polished: origSize=960
cf-bgj: minify
last-modified: Mon, 23 Jan 2023 20:47:25 GMT
server: cloudflare
x-trace: 2BD6C5F20F905435920BDD0BAF006FC1B90F281DA6000000000000000000
access-control-max-age: 3600
vary: origin, Accept-Encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: https://monitor206.sucuri.net
cache-control: public, max-age=30
access-control-allow-credentials: true
cf-ray: 78e3626cfbd69962-FRA

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
898 B 263ms
171ms Image
image/gif 2606:4700::6813:9b53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=3997732991&v=1.1&a=498146&rcu=https%3A%2F%2Fblog.sucuri.net%2F2022%2F09%2Fnew-malware-variants-serve-bogus-cloudflare-ddos-captcha.html&pu=https%3A%2F%2Fblog.sucuri.net%2F2022%2F09%2Fnew-malware-variants-serve-bogus-cloudflare-ddos-captcha.html&t=New+Malware+Variants+Serve+Bogus+CloudFlare+DDoS+Captcha&cts=1674506846205&vi=27d11138e6af492a97e633273639c236&nc=true&u=166519265.27d11138e6af492a97e633273639c236.1674506846203.1674506846203.1674506846203.1&b=166519265.1.1674506846203&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.sucuri.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 23 Jan 2023 20:47:26 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id: 81a6d9e1-a59f-4eb2-a1bd-5708384d7fe3
p3p: CP="NOI CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 45
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=E%2Bd2P5Q3LrBxiQs0%2FlIR%2BtTwhbaB65AAUh88Un%2BqC1f8%2B6AJ%2BD6LANIcSrTIax9alFaWwYaeCg5jopn81sR07u1ueQCJCv8U7O6M7FH5EF%2F3Hkwj2u%2FLNIazg27KBY3ekbQWnygWLFnsKTGFqJaJ"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
cf-ray: 78e3626d7b9f6904-FRA
x-robots-tag: none

Verdicts & Comments Add Verdict or Comment

61 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

32 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.sucuri.net/	1970-01-20 09:09:53	Name: _gid Value: GA1.2.1556977589.1674506845
.sucuri.net/	1970-01-20 09:08:26	Name: _gat Value: 1
.sucuri.net/	1970-01-20 11:18:02	Name: CONSENTMGR Value: c1:1%7Cc2:1%7Cc3:1%7Cc4:1%7Cc5:1%7Cc6:1%7Cc7:1%7Cc8:1%7Cc9:1%7Cc10:1%7Cc11:1%7Cc12:1%7Cc13:1%7Cc14:1%7Cc15:1%7Cts:1674506844857%7Cconsent:true
.sucuri.net/	1970-01-20 17:54:02	Name: utag_main Value: v_id:0185e062baba000e558ec3b819f203073005d06b00b08$_sn:1$_ss:1$_st:1674508644859$ses_id:1674506844859%3Bexp-session$_pn:1%3Bexp-session
.sucuri.net/	1969-12-31 23:59:59	Name: IR_gbd Value: sucuri.net
.sucuri.net/	1969-12-31 23:59:59	Name: IR_3713 Value: 1674506844893%7C0%7C1674506844891%7C%7C
.sucuri.net/	1970-01-20 17:54:02	Name: mp_c59343135653bd9019d29f1db79e348b_mixpanel Value: %7B%22distinct_id%22%3A%20%22185e062bb54718-040f7cba4e4c93-13363b7c-1d4c00-185e062bb55be6%22%2C%22%24device_id%22%3A%20%22185e062bb54718-040f7cba4e4c93-13363b7c-1d4c00-185e062bb55be6%22%2C%22%24initial_referrer%22%3A%20%22%24direct%22%2C%22%24initial_referring_domain%22%3A%20%22%24direct%22%7D
.7eer.net/	1970-01-20 18:44:26	Name: brwsr Value: 2435b035-9b5f-11ed-86d7-ab499bde5257
.7eer.net/	1970-01-20 09:09:53	Name: irtps Value: 1
.sucuri.net/	1970-01-20 18:44:26	Name: IR_PI Value: 2435b035-9b5f-11ed-86d7-ab499bde5257%7C1674593244891
.doubleclick.net/	1970-01-20 09:08:27	Name: test_cookie Value: CheckForPermission
blog.sucuri.net/	1970-01-20 09:09:53	Name: ln_or Value: eyIxNzk3MTMiOiJkIn0%3D
.sucuri.net/	1970-01-20 09:08:26	Name: _gat_gtag_UA_4077922_18 Value: 1
.t.co/	1970-01-20 18:44:26	Name: muc_ads Value: 33cd717a-5955-4388-b26d-57da8b6b6138
.twitter.com/	1970-01-20 18:44:26	Name: personalization_id Value: "v1_lEab0glY4RmjLqBWU6wiCw=="
.sucuri.net/	1970-01-20 18:44:26	Name: _ga_L206HXJP92 Value: GS1.1.1674506845.1.0.1674506845.0.0.0
.sucuri.net/	1970-01-20 18:44:26	Name: _ga Value: GA1.1.25210339.1674506845
.sucuri.net/	1970-01-20 11:18:02	Name: _fbp Value: fb.1.1674506845394.251083386
.linkedin.com/	1970-01-20 09:51:38	Name: UserMatchHistory Value: AQKUkT4PhGyyCQAAAYXgYrxsOv5nZSCztNW-qk9IaxvWpwNEg_ZHfrcVL55QOnKAdxylUiLpzUJOeQ
.linkedin.com/	1970-01-20 09:51:38	Name: AnalyticsSyncHistory Value: AQJ-zylne7ABFwAAAYXgYrxsDh99vuBbm5vJYw2n4HUtERwHfosoE7a0zMyMRkgs03Q9zZeGkw8_s0Z4hat3EA
.ads.linkedin.com/	1969-12-31 23:59:59	Name: lang Value: v=2&lang=en-us
.linkedin.com/	1970-01-20 17:54:02	Name: bcookie Value: "v=2&2c390276-a2ce-4454-805f-26da423d9a3e"
.linkedin.com/	1970-01-20 09:09:53	Name: lidc Value: "b=OGST08:s=O:r=O:a=O:p=O:g=2470:u=1:x=1:i=1674506845:t=1674593245:v=2:sig=AQHR0B4US-C4mRM4fjlzELfIMpux2tbd"
.linkedin.com/	1969-12-31 23:59:59	Name: lang Value: v=2&lang=de-de
.www.linkedin.com/	1970-01-20 17:54:02	Name: bscookie Value: "v=1&202301232047258e92bc25-c3a3-4a66-8623-468f90aee2b5AQGdRu7uUiKXl_0qMqrXmiw97l1e1djG"
.linkedin.com/	1970-01-20 13:27:38	Name: li_gc Value: MTswOzE2NzQ1MDY4NDU7MjswMjEsbMGEA7akXybe5EHqQgwLBZ43gnGTCPQyPuIWbqb8dw==
.sucuri.net/	1970-01-20 13:27:38	Name: __hstc Value: 166519265.27d11138e6af492a97e633273639c236.1674506846203.1674506846203.1674506846203.1
.sucuri.net/	1970-01-20 13:27:38	Name: hubspotutk Value: 27d11138e6af492a97e633273639c236
.sucuri.net/	1969-12-31 23:59:59	Name: __hssrc Value: 1
.sucuri.net/	1970-01-20 09:08:28	Name: __hssc Value: 166519265.1.1674506846203
.ojrq.net/	1970-01-20 18:44:26	Name: brwsr Value: 24fe09cd-9b5f-11ed-a377-cbfd81194aca
.hubspot.com/	1970-01-20 09:08:28	Name: __cf_bm Value: IBWF8YhgB5ZpB.6GtUlFBNajPjLFUXce3Ux0evV3gM0-1674506846-0-AboYkGo62UTkUsC5RDNMNtqFbAHAJxxuVeOK2jp/ofOIZBlgWplg455y2j0AIh6v2RMoab5TsaYJZNh739W1tnE=

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

analytics.twitter.com
blog.sucuri.net
cdn.linkedin.oribi.io
cdn.mxpnl.com
connect.facebook.net
d.impactradius-event.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
js-na1.hs-scripts.com
js.hs-analytics.net
js.hs-banner.com
js.hs-scripts.com
px.ads.linkedin.com
px4.ads.linkedin.com
region1.google-analytics.com
snap.licdn.com
static.ads-twitter.com
static.olark.com
stats.g.doubleclick.net
sucuri.7eer.net
t.co
tags.tiqcdn.com
track.hubspot.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.linkedin.com
www.ojrq.net

104.111.216.242
104.244.42.195
104.244.42.5
13.107.42.14
192.229.233.34
199.232.16.157
2001:4860:4802:32::178
2001:4860:4802:34::36
2600:1901:0:bc29::
2600:9000:2127:ee00:2:53b2:240:93a1
2606:4700:4400::6812:21ab
2606:4700::6811:46b0
2606:4700::6811:d3cc
2606:4700::6813:9b53
2620:1ec:21::14
2a00:1450:4001:801::2003
2a00:1450:4001:80b::200a
2a00:1450:4001:80e::2004
2a00:1450:4001:813::2003
2a00:1450:4001:830::2002
2a00:1450:400d:804::2008
2a00:1450:4025:401::9d
2a02:26f0:3500:16::215:149b
2a02:fe80:1010::5
2a03:2880:f02d:12:face:b00c:0:3
2a03:2880:f12d:83:face:b00c:0:25de
34.95.127.121
35.186.240.205
35.186.249.72
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300
0500bd58f47403106f2f10da96d8d196941a02a4046e88611a59494557861f98
0511b683eeee87fe647897ba9922f9ca78438d425ce280e9dcb0cfcf750e9141
0556982c2b3cf8fc78bc3d5d3c1e98b7861a0a8150ef7ecf2f3c7a733e4e0cf8
0e73c202f1778ce2b03cbc633e6575bb9ac13f127134620796d85af28e053460
1cfd32e37f8aba263101f06e8f702adfaef55a6601857cf5e2c6dd0b0388dcd6
20550f7bcb2a817ac9a5879e04260da8268e971c0b8031a6b7a2f48a55ee60d5
24240537f69fdda4848d2aa1430b84db23d4979c65931a1755a24c2bb8315f8d
267d496913828ee31abcafa87bd2e256894813516b95642c124afca9a7ddb29c
268b666ea21ad355c580c329c1969616da07ff449bf21fd22e2661d5c5e53aff
2c3754dbf3be2a19c5fbe1e5f9ea8eab4ad76db99447205b59ae1d9caae9d0ae
2fb96570e72e91c692d5514fce3528b60f80948e3df2780c986cb252b3263588
36d47eadbca93ee9613695d80ee179247a0b6bd78b503a549778dbcbe46b0815
37b06f759d7ecb525d037f9caf9f5abef8fb0917d9c9e795909136e7cb5e3785
40ad5344e8c06d85d6cc2cfd95ad9ed597c3a1aaec5e730efb5fcee9d88b5135
442ea9791bad77a328e1a07c59784d92e10bac3f612ba9b00afba5c7518acc6b
45b61924c73d0670bc49dd85013c8fdda740224e71c7a97a2952492aeb6a7f38
48eb8ebb42357edb3792a468c6daef81e653a9e3ad71954b58de86a0acad238c
52e26c085124647627c42c2cbce9a619b220a28420761233ea649d320f7c5518
5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de
59cc1461e4c31efd86e96e170a1e90c93b3fbc44998482b5571b236c7260a181
5a5f39391fbf5b06db84b8f9716d53de575ee97a627d2c5f12f79a991a671eb5
5aafcc6bf2a5538e40efb22b67dee2fb1f1809b846853b69df489d70cac45a36
618e2688a71e0742e9a4d0de4d85e59351a5748ffce32f5518cd7a5d292a6d1b
63a6d926d277a3d64d30e349fa0ea2b0630e9801d173e1947ff3bd6060147ef4
6851e34add861b54da9ebd0c9ac790221f2e8962175bc5ad763ed7e889fd80e2
68f2b0a3381830c544349d5df116c2b96ba1d8efa46cf0c15e3a130d91bf6ab4
6ae8162fefa27a4c1b69440f19e997af99d94d2e3fef9265e0c44c4caf7cbbda
6e16ae6333ac99920de581fb3bf9dedee5c729d8af4dbb45b84df53291d52eb5
73ba3dd83868376948d3baca5ece77346064546ce94ba9c08745c400b8eb014e
745caffca4b97cf5cf2374d82c6dfb6fb7c7b694e85432f92ec4dcb35f4418c9
79f9a0ec2c750edde8d9fa73ee77f59b6df6705fa148544dd00f7f126ce6e6d9
7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89
7e86f52cb0d423805ec541a4bccae5156a01fbe36355e6d798a450593212651f
8235aa051c240d36805f28bb37173c4e2a40cf4b347e1d99d96db420caba3aa0
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
876f181150664af9e30a4c1da6f8f95eb462aebeb8781db732ff6bc48a1f6632
8778e9af2422858d7052ff9a0f3c12c08ae976bdd6e0316db144cd5579cd97db
97d876b0796d55e1a4d9dec67f958fd62674617e5417b92e4584c0397974e9d9
9ad0a22b0c58240a7a92b4c01aa31f39a5918dea6a8fdfa77e63042abc4fca31
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
c324ef26b20264369e4568dc9ef1c5cb1f325f6bc4e8b7c01f7fe93fa353276a
cc07dc22acd75d21ea2a03ced344d13aeeea586029288b1d7004739f8ce3c7be
cc7403bab52ed166e24ea9324241045af370be482f5b594468f4a6ac6e7e7981
cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee
da7a511c69cdf1e0f950a29019d09854b8919bc154bb95fe5d5ec580ed2f0997
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
df7eefa2027ce07dcfd7d01e576f9c76412f39fe88f93485bcb60b407fd08889
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4d08f877611f0c9211f3099d2bf66a57b97f4c8a03e4bc8f9dcc9299b4d09e7
e4f82acd85fb004f3e33a88ad66c7f525476af9c63b7a30071c15f3141ebacef
ec0f53f11e000f28f7dc3a590f746a21c233b2ccbf695cebbf8601b2b912d14d
ec34cd386427fe6deacf99f4fdbeea4b1d1ed25f505411650d7ceaa843a7fc63
ec374edf9c52c6aae3b672424c611799883a29af5785c94985a6d9e4eb907e93
ed026fedc8b8130aecd7be55e134a42efcaa8e90a5f2f8ec88aa9a1a5ab934ec
ed5b5df9ceacfe76857ac51964972b0b417a215b2f50e837fd6b64bad7339c40
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef75b33904d93af24fa40e39bfc332becf6145911fb0715a252445b5e2bcb79e
ef8f067f829af7c95936a36f38e54c98ab090f937f5557e4c78829ed8fcf5ffd
f56ccb2db87aacedd9415232e40f80bff9939703df2f9c3f9ec8a092e545349f
ff6377c5173c4ee30318481c90cb7cc19987f2f5304871236266df11b0f48696

blog.sucuri.net Open in urlscan Pro 2a02:fe80:1010::5 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

72 Requests

97 %HTTPS

67 %IPv6

26 Domains

31 Subdomains

29 IPs

5 Countries

1270 kBTransfer

2620 kBSize

32 Cookies

58 Outgoing links

Redirected requests

72 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

blog.sucuri.net Open in urlscan Pro
2a02:fe80:1010::5 Public Scan

Screenshot
Live screenshot

Full Image

72
Requests

97 %
HTTPS

67 %
IPv6

26
Domains

31
Subdomains

29
IPs

5
Countries

1270 kB
Transfer

2620 kB
Size

32
Cookies

72 HTTP transactions
2 data transactions